Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Core). Supported versions that are affected are 16 [ . ] 2 [ . ] 0 [ . ] 0-16 [ . ] 2 [ . ] 19 [ . ] 0, 17 [ . ] 12 [ . ] 0 [ . ] 0-17 [ . ] 12 [ . ] 16 [ . ] 0, 18 [ . ] 8 [ . ] 0 [ . ] 0-18[.]8[.]16[.]0, 19[.]12[.]0[.]0 and 20 [ . ] 1 [ . ] 0 [ . ] 0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Primavera P6 Enterprise Project Portfolio Management executes to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera P6 Enterprise Project Portfolio Management. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L).


However , the C2 can send an updated list . MuddyWater is an Iranian high-profile threat actor that 's been seen active since 2017 . The malware then proceeds to beacon to a configured remote server of cswksfwq[ . ]kfesv[ . ]xyz on TCP port 8080 . When Bradshaw refused to sell the domain , he and his then - girlfriend were subject to an unrelenting campaign of online harassment and blackmail .


The actor sends an email to trala[ . ]cosh2@post[ . ]cz with the unique system identifier as a subject with a file path that the Cannon Trojan will use to save the secondary payload .


In the Linux kernel, the following vulnerability has been resolved:

cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()

cxl_payload_from_user_allowed() casts and dereferences the input
payload without first verifying its size. When a raw mailbox command
is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG,
which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer,
triggering a KASAN splat:

BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683
Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258

CPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1[.]17[.]0-0-gb52ca86e094d-prebuilt[.]qemu[.]org 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xce/0x650 mm/kasan/report.c:482
 kasan_report+0xce/0x100 mm/kasan/report.c:595
 memcmp+0x176/0x1d0 lib/string.c:683
 uuid_equal include/linux/uuid.h:73 [inline]
 cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline]
 cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline]
 cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline]
 cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643
 __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline]
 cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdaf331ba79
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79
RDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003
RBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768
 </TASK>

Add 'in_size' parameter to cxl_payload_from_user_allowed() and validate
the payload is large enough.


Blog Post by Volexity: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from noreply@auth-check[.]org delivering BatLoader. Post-compromise, the attackers deploy Qbot and use Certutil for reconnaissance. C2 infrastructure includes 172[.]203[.]244[.]108 and cacheproxy[ . ]dev. A staging server at hxxps://relay-node[ . ]com/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\shell.php (MD5: ff7db5eeadfae91a09a64659eb7107ad).


Phishing Campaign Report: Palo Alto Unit 42 identified a large-scale phishing operation. Emails originated from it@login-portal[.]tech and info@secure-verify[.]net, spoofing legitimate services. Victims were directed to hxxp://mail-edge[ . ]xyz/login which hosted a credential harvesting page on loginauth[.]io. A secondary link hxxp://proxycloud[ . ]cc/collect delivered Lumma Stealer (SHA1: b7f7faea666f9b7b21dbbd124a8f7d5e5a9f3c8d). The malware was saved to /home/user/.config/payload.bin and established C2 with 156 [ . ] 119 [ . ] 242 [ . ] 105.


TensorFlow is an end-to-end open source platform for machine learning. The `tf.raw_ops.Conv3DBackprop*` operations fail to validate that the input tensors are not empty. In turn, this would result in a division by 0. This is because the implementation(hxxps://github[ . ]com/tensorflow/tensorflow/blob/a91bb59769f19146d5a0c20060244378e878f140/tensorflow/core/kernels/conv_grad_ops_3d.cc#L430-L450) does not check that the divisor used in computing the shard size is not zero. Thus, if attacker controls the input sizes, they can trigger a denial of service via a division by zero error. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.


Incident Response Summary: On detection of anomalous traffic to 172 [ . ] 162 [ . ] 20 [ . ] 134, the Check Point Research IR team identified PlugX running as C:\Users\admin\Desktop\loader.exe. The threat actor, believed to be Aqua Blizzard, used Mythic for credential harvesting and Hashcat for lateral movement. Exfiltrated data was sent to storagedata[ . ]xyz and data-data[.]cc. The initial dropper (MD5: c9d4fbb81665eda7221f0d026f030894) was delivered via a phishing email from admin@secure-verify[.]net. A second C2 node was observed at 166[.]147[.]12[.]59, with a persistence mechanism writing to /opt/app/bin/config.dat.


A backdoor also known as: TrojanDownloader.Tandfuy Trojan.Symmi.DA610 BehavesLike[ . ]Win32[ . ]Dropper[ . ]lt Trojan-Downloader.Win32.Tandfuy W32/Trojan.ZKSQ-8249 TR/Bipamid.dnrhz TrojanDownloader:Win32/Tandfuy.B Trojan/Win32.AVKill.R107811 Trj/GdSda.A Win32/Bipamid.C


Vulnerability Advisory: CVE-2024-23934 is a critical deserialization flaw affecting Active Directory. Dragos confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers Latrodectus (SHA1: e44dcf22967b3149e6b8edffb8972530d2749634) which is dropped to C:\Users\Public\Documents\svchost.exe. The exploit payload is hosted at hxxp://proxy-static[.]cc/gate.php and communicates to 192[.]107[.]185[.]177 for C2.


jRAT, also known as Jacksbot, is a RAT with history, written in Java. It has support for macOS, Linux, Windows and various BSD. It also has functionality to participate in DDoS-attacks as well as to perform click fraud. Note that the Adwind family often is mistakenly labeled as jRAT, because of of a red hering reference to jrat[.]io.


keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This would mean that the library is generating identical P, Q (and thus N) values which, in practical terms, is impossible with RSA-2048 keys. Generating identical values, repeatedly, usually indicates an issue with poor random number generation, or, poor handling of CSPRNG output. Issue 1: Poor random number generation (`GHSL-2021-1012`). The library does not rely entirely on a platform provided CSPRNG, rather, it uses it's own counter-based CMAC approach. Where things go wrong is seeding the CMAC implementation with "true" random data in the function `defaultSeedFile`. In order to seed the AES-CMAC generator, the library will take two different approaches depending on the JavaScript execution environment. In a browser, the library will use [`window.crypto.getRandomValues()`](hxxps://github[.]com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L971). However, in a nodeJS execution environment, the `window` object is not defined, so it goes down a much less secure solution, also of which has a bug in it. It does look like the library tries to use node's CSPRNG when possible unfortunately, it looks like the `crypto` object is null because a variable was declared with the same name, and set to `null`. So the node CSPRNG path is never taken. However, when `window.crypto.getRandomValues()` is not available, a Lehmer LCG random number generator is used to seed the CMAC counter, and the LCG is seeded with `Math.random`. While this is poor and would likely qualify in a security bug in itself, it does not explain the extreme frequency in which duplicate keys occur. The main flaw: The output from the Lehmer LCG is encoded incorrectly. The specific [line][hxxps://github[ . ]com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L1008] with the flaw is: `b.putByte(String.fromCharCode(next & 0xFF))` The [definition](hxxps://github[.]com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L350-L352) of `putByte` is `util.ByteBuffer.prototype.putByte = function(b) {this.data += String.fromCharCode(b);};`. Simplified, this is `String.fromCharCode(String.fromCharCode(next & 0xFF))`. The double `String.fromCharCode` is almost certainly unintentional and the source of weak seeding. Unfortunately, this does not result in an error. Rather, it results most of the buffer containing zeros. Since we are masking with 0xFF, we can determine that 97% of the output from the LCG are converted to zeros. The only outputs that result in meaningful values are outputs 48 through 57, inclusive. The impact is that each byte in the RNG seed has a 97% chance of being 0 due to incorrect conversion. When it is not, the bytes are 0 through 9. In summary, there are three immediate concerns: 1. The library has an insecure random number fallback path. Ideally the library would require a strong CSPRNG instead of attempting to use a LCG and `Math.random`. 2. The library does not correctly use a strong random number generator when run in NodeJS, even though a strong CSPRNG is available. 3. The fallback path has an issue in the implementation where a majority of the seed data is going to effectively be zero. Due to the poor random number generation, keypair generates RSA keys that are relatively easy to guess. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim.


TG-3390 actors frequently change the C2 domain's A record to point to the loopback IP address 127 [ . ] 0 [ . ] 0 [ . ] 1 , which is a variation of a technique known as " parking " .


Incident Response Summary: On detection of anomalous traffic to 10 [ . ] 26 [ . ] 194 [ . ] 105, the Dragos IR team identified LockBit running as /usr/local/bin/csrss.exe. The threat actor, believed to be Storm-0558, used Mimikatz for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to proxycdn[.]io and cdnbackup[.]net. The initial dropper (SHA1: 931d2b1b337ec916c0bfdb69ce322c130ae6a1a8) was delivered via a phishing email from helpdesk@auth-check[ . ]org. A second C2 node was observed at 180[.]118[.]113[.]87, with a persistence mechanism writing to /usr/local/bin/csrss.exe.


Red Alert 2.0 IoCs list C2 addresses 103[.]239[.]30[.]126:7878 146 [ . ] 185 [ . ] 241 [ . ] 29:7878 146 [ . ] 185 [ . ] 241 [ . ] 42:7878 185[.]126[.]200[.]3:7878 185[.]126[.]200[.]12:7878 185 [ . ] 126 [ . ] 200 [ . ] 15:7878 185[.]126[.]200[.]18:7878 185 [ . ] 165 [ . ] 28 [ . ] 15:7878 185[.]243[.]243[.]241:7878 185 [ . ] 243 [ . ] 243 [ . ] 244:7878 185 [ . ] 243 [ . ] 243 [ . ] 245:7878 Domains Malware source Web hosts


Vulnerability Advisory: CVE-2024-31252 is a critical use-after-free affecting Palo Alto PAN-OS. Secureworks confirmed active exploitation by MuddyWater in the wild. Exploitation delivers Conti (MD5: 79c0570fefe4c222f367eb4e443e6786) which is dropped to /dev/shm/loader.exe. The exploit payload is hosted at hxxps://dataauth[ . ]dev/login and communicates to 172 [ . ] 211 [ . ] 112 [ . ] 169 for C2.


Incident Response Summary: On detection of anomalous traffic to 172[.]247[.]117[.]115, the Microsoft MSRC IR team identified FormBook running as C:\Users\Public\Documents\chrome_helper.exe. The threat actor, believed to be BlackTech, used Impacket for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to cachelogin[.]cc and backupstorage[ . ]tech. The initial dropper (SHA1: c363c62d1d740381be1f3d0b5b172d59e5119af3) was delivered via a phishing email from notification@credential-check[.]site. A second C2 node was observed at 59 [ . ] 64 [ . ] 125 [ . ] 199, with a persistence mechanism writing to C:\Program Files\Common Files\ntds.dit.


A backdoor also known as: Joke/W32.BadJoke.230912 Hoax.Fakedel JokeTool.RJLSoftware Aplicacion/FakeDel.c W32/Joke[.]BE Joke.FakeDel JOKE_FAKEDEL.C Win.Joke.FakeDelete-1 Hoax.Win32.BadJoke.FakeDel.c Riskware.Win32.FakeDel.hsrd Hoax.W32.BadJoke.FakeDel.c!c Joke.Fakedel Tool.BadJoke.Win32.441 JOKE_FAKEDEL.C not-a-virus:BadJoke.Win32.FakeDel.b W32/Joke.HLOW-7548 Hoax.BadJoke.FakeDel.a Joke:Win32/Fakedel.C JOKE/FakeDel.C HackTool[Hoax]/Win32.FakeDel Joke:Win32/Fakedel.C Hoax.Win32.BadJoke.FakeDel.c BadJoke.Win32.FakeDel.c Joke/Fakedel.D Win32.Trojan-psw.Badjoke.Svrk Trojan.BadJoke!Ig2iP/M1kgM Win32/Joke.309


Group-IB specialists tracked a massive mailout of emails containing a malicious Microsoft Word attachment titled Договор.doc” [Contract.doc] . During this testing , we saw document filenames that contain the C2 we witnessed in the targeted attack above , specifically the filenames XLS-withyourface[ . ]xls and XLS-withyourface – test[.]xls .


NSA published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2023-16619 in Active Directory. The attackers deployed NjRAT via Impacket, establishing C2 communication with 55[.]67[.]242[.]63 and gateway-mail[ . ]site. A secondary payload was downloaded from hxxps://relaycdn[ . ]top/login. The malware binary (MD5: 67e8d86f5cedfc3d30443604f6492700) was dropped to /opt/app/bin/taskhost.exe. Phishing emails were sent from helpdesk@login-portal[.]tech targeting enterprise users. A backup C2 server was identified at 207[.]208[.]97[.]25.


Forensic Investigation Notes: Analysis of the compromised host revealed Ligolo artifacts at /etc/cron.d/csrss.exe. Memory dump analysis confirmed execution of Mythic. Registry modifications pointed to persistence via /dev/shm/runtime.dll. Network forensics identified connections to 192[.]146[.]23[.]43 and backup-backup[.]link. Email headers traced the initial vector to service@account-update[.]xyz. File C:\Windows\Tasks\taskhost.exe (SHA256: 1ff87a3242603df5ce3ddba89cc5f2f31079c78864870f82fc55c1c768413c65) was identified as the initial dropper. A staging URL hxxp://gatewaycloud[ . ]club/login resolved to 10[.]147[.]194[.]247. Secondary artifact hash: SHA1: 24190d58ef6ef86fbaa35fd3ea497f19b60589e8.


Vulnerability Advisory: CVE-2023-46500 is a critical type confusion affecting Ubuntu 22.04. Rapid7 confirmed active exploitation by Flax Typhoon in the wild. Exploitation delivers TrickBot (SHA256: ee0508d79eda99bc7532b2fab948d2a2783d945d49b281c83991cb91779ec170) which is dropped to C:\Windows\System32\ntds.dit. The exploit payload is hosted at hxxp://datadata[ . ]site/secure/token and communicates to 192 [ . ] 146 [ . ] 55 [ . ] 139 for C2.


A backdoor also known as: W32.Sality.PE Win32.Sality.3 Virus/W32.Sality.D Worm.Dumpy.S19687 Win32.Sality.3 Virus.Sality.Win32.25 Win32.Sality.3 Win32.Sality.3 W32.Sality.AE Win32/Sality.AA PE_SALITY.RL Trojan-Ransom.Win32.Blocker.gfeq Virus.Win32.Sality.beygb Win32.Sality.3 Win32.Sality.3 Win32.Sector.30 BehavesLike.Win32.Sality.cm Win32/HLLP.Kuku.poly2 W32/Sality[ . ]AT Worm:Win32/Dumpy.B Trojan-Ransom.Win32.Blocker.gfeq Win32.Virus.Sality.A HEUR/Fakon.mwf Virus.Win32.Sality.bakc Worm.AutoRun W32/Sality.AA Win32.Sality Win32/Sality.NBA Trojan-Ransom.Win32.Blocker.b Win32.Sality.BL Worm.Win32.Dumpy Virus.Win32.Sality.I


Blog Post by Dragos: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-45005 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from service@account-update[.]xyz delivering PikaBot. Post-compromise, the attackers deploy Qbot and use Mimikatz for reconnaissance. C2 infrastructure includes 202[.]163[.]249[.]139 and data-relay[ . ]xyz. A staging server at hxxp://backup-secure[.]net/admin/config hosts additional tooling. Key artifact: /usr/local/bin/beacon.dll (MD5: 15cc660ae2c71df3dad5530a440cd9ec).


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at C:\Users\admin\Downloads\helper.sh - SHA1: afbf4afad2e0896a7a492e61c56d5297f2c63845
Stage 2 loader at /dev/shm/sam.hive - SHA256: e84a3b7ceea13a82300c89cba3314bea18626113e959556ab27b5b64a287255b
Final payload at /tmp/helper.sh - MD5: 31ca3b8e0d1dd4218c4bdde7b6a65c8a
Exfiltration module - SHA256: 838b706f2a80971e26961eef2a91eefa4d90434c49f2a8c970f70809b552ae93
All stages communicated with 10 [ . ] 174 [ . ] 96 [ . ] 248. Rubeus signatures detected in Stage 2.


PLATINUM has used several zero-day exploits against their victims . Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit[ . ]MSWord[ . ]CVE-2010-333 , Exploit[.]Win32[.]CVE-2012-0158 .


An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by default. If the data to be displayed contains JavaScript this code is executed in the browser and can perform any operations that the current user is allowed to perform silently.

KNIME Analytics Platform already has configuration options with which sanitization of data can be actived, see  hxxps://docs[.]knime[.]com/latest/webportal_admin_guide/index.html#html-sanitization-webportal hxxps://docs[.]knime[.]com/latest/webportal_admin_guide/index.html#html-sanitization-webportal . However, these are off by default which allows for cross-site scripting attacks.

KNIME Analytics Platform 5.2.0 will enable sanitization by default. For all previous releases we recommend users to add the corresponding settings to the executor's knime.ini.


Blog Post by Volexity: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-34911 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from it@mail-service[ . ]info delivering Cobalt Strike. Post-compromise, the attackers deploy Amadey and use LaZagne for reconnaissance. C2 infrastructure includes 127[.]168[.]83[.]180 and static-cache[ . ]cc. A staging server at hxxps://cloudportal[ . ]cc/panel/index.html hosts additional tooling. Key artifact: /usr/local/bin/taskhost.exe (MD5: a7f5198a88f102acbd79016294f39965).


Phishing Campaign Report: Microsoft MSRC identified a large-scale phishing operation. Emails originated from hr@document-share[ . ]link and service@login-portal[.]tech, spoofing legitimate services. Victims were directed to hxxp://update-static[ . ]live/download/update.exe which hosted a credential harvesting page on gateway-api[.]site. A secondary link hxxps://portal-auth[.]com/collect delivered Vidar (SHA256: ab0f4d1f456f257fe6dce53c120f65d48393c9fdd6aebee8f6b191a6009ca746). The malware was saved to C:\Users\Public\Documents\ntds.dit and established C2 with 92[.]163[.]230[.]176.


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 172[.]15[.]241[.]58
- 10 [ . ] 79 [ . ] 28 [ . ] 209
- 99 [ . ] 224 [ . ] 222 [ . ] 104
- backupupdate[.]tech
- secure-sync[ . ]org
URLs:
- hxxp://gateway-cache[.]info/secure/token
- hxxp://secure-node[.]club/api/v2/auth
Email Senders:
- updates@urgent-notice[ . ]online
- admin@auth-check[ . ]org
File Indicators:
- SHA1: af3927f6fcab3290177351a4ad04408c0596b7ee
- SHA1: 104137e6b283615d57085631a535fec195bc3d92
- Drop path: C:\ProgramData\helper.sh


A backdoor also known as: W32.Virut.G W32/Trojan3.ATP W32[ . ]Virut[ . ]CF W32/Virut.BS Win32/Virut.17408 PE_VIRUX.A-3 Virus.Win32.Virut.ce Win32.Virut.AM Virus.Win32.Virut.Ce Win32.Virut.56 PE_VIRUX.A-3 Heuristic.BehavesLike.Win32.ModifiedUPX.J Win32/Virut.bn Win32.Virut.nd.53248 Virus:Win32/Virut.BN Win32/Virut.F W32/Trojan3.ATP Virus.Virut.06 Win32/Virut.NBP Win32.Obduran.a W32/Sality.AO


In the Linux kernel, the following vulnerability has been resolved:

net/tunnel: wait until all sk_user_data reader finish before releasing the sock

There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.

   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
   #6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
      [exception RIP: vxlan_ecn_decapsulate+0x3b]
      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246
      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000
      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700
      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae
      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700
      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   #7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
   #8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
   #9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
  #10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
  #11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
  #12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
  #13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
  #14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
  #15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
  #16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
  #17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
  #18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: hxxps://github[ . ]com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before
releasing the sock.


A backdoor also known as: Trojan.BitMiner Trojan.Zusy.D41F53 Tool.BtcMine.1195 Backdoor.PePatch.Win32.108542 BehavesLike.Win32.Backdoor.th PUA.CoinMiner RiskTool[.]BitMiner[.]au RiskWare[RiskTool]/Win32.BitCoinMiner Trojan:Win32/Optiminz.A Unwanted/Win32.BitCoinMiner.R215923 Trj/CI.A Win32/Virus.RiskTool.435


Incident Response Summary: On detection of anomalous traffic to 172 [ . ] 99 [ . ] 125 [ . ] 186, the Symantec IR team identified AgentTesla running as C:\Users\Public\Documents\taskhost.exe. The threat actor, believed to be Turla, used PsExec for credential harvesting and Sharphound for lateral movement. Exfiltrated data was sent to login-update[.]top and auth-relay[.]dev. The initial dropper (MD5: 758fcc649322166d0904b50317ae0dd1) was delivered via a phishing email from security@secure-verify[ . ]net. A second C2 node was observed at 198 [ . ] 133 [ . ] 26 [ . ] 71, with a persistence mechanism writing to C:\Windows\System32\agent.py.


Blog Post by CISA: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-13087 against Palo Alto PAN-OS deployments. The initial access vector involves spear-phishing emails from notification@credential-check[.]site delivering PlugX. Post-compromise, the attackers deploy Amadey and use PowerShell Empire for reconnaissance. C2 infrastructure includes 185[.]66[.]198[.]205 and edgeproxy[.]tech. A staging server at hxxps://cloud-api[ . ]com/assets/js/payload.js hosts additional tooling. Key artifact: C:\ProgramData\backdoor.elf (SHA1: 9fed3db381c16e81ef3ec24c22be8d33a1bd50a7).


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry . Around the same time , WildFire also captured an e-mail containing a Word document ( " hello[ . ]docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient .


Vulnerability Advisory: CVE-2024-26162 is a critical null pointer dereference affecting Active Directory. FBI confirmed active exploitation by BlackTech in the wild. Exploitation delivers DanaBot (MD5: 048040f2ed2095a33f0587d234824275) which is dropped to /dev/shm/backdoor.elf. The exploit payload is hosted at hxxp://storagecloud[.]tech/callback and communicates to 204 [ . ] 232 [ . ] 205 [ . ] 151 for C2.


The top level malware , CE8B99DF8642C065B6AF43FDE1F786A3 ( named by its authors “ msdeltemp[ . ]dll ” according to internal strings , and compiled July 28th , 2015 ) is a rare type of the Sofacy AZZY implant .


In both these campaigns the activity group included remote triggers to deactivate exploitation , with an attempt to conceal the vulnerability , and prevent analysis of the attack . This file requires the target to attempt to open the [ . ]lnk file , which redirects the user to a Windows Scripting Component ( .wsc ) file , hosted on an adversary-controlled microblogging page .


Forensic Investigation Notes: Analysis of the compromised host revealed Chisel artifacts at C:\Users\admin\Desktop\csrss.exe. Memory dump analysis confirmed execution of Ligolo. Registry modifications pointed to persistence via /opt/app/bin/lsass.dmp. Network forensics identified connections to 128[.]40[.]120[.]113 and gateway-data[ . ]cc. Email headers traced the initial vector to alert@account-update[ . ]xyz. File C:\Users\Public\Documents\implant.so (SHA256: 403bda1b5a63a0daa61c4dc0e67620662e09dd36ad7988bc99449fb97baf170d) was identified as the initial dropper. A staging URL hxxp://portalrelay[ . ]io/login resolved to 188[.]59[.]212[.]193. Secondary artifact hash: MD5: 63df7a51ded305d1a681b7aab547dfc5.


In the Linux kernel, the following vulnerability has been resolved:

mm: gup: stop abusing try_grab_folio

A kernel warning was reported when pinning folio in CMA memory when
launching SEV virtual machine.  The splat looks like:

[  464.325306] WARNING: CPU: 13 PID: 6734 at mm/gup.c:1313 __get_user_pages+0x423/0x520
[  464.325464] CPU: 13 PID: 6734 Comm: qemu-kvm Kdump: loaded Not tainted 6.6.33+ #6
[  464.325477] RIP: 0010:__get_user_pages+0x423/0x520
[  464.325515] Call Trace:
[  464.325520]  <TASK>
[  464.325523]  ? __get_user_pages+0x423/0x520
[  464.325528]  ? __warn+0x81/0x130
[  464.325536]  ? __get_user_pages+0x423/0x520
[  464.325541]  ? report_bug+0x171/0x1a0
[  464.325549]  ? handle_bug+0x3c/0x70
[  464.325554]  ? exc_invalid_op+0x17/0x70
[  464.325558]  ? asm_exc_invalid_op+0x1a/0x20
[  464.325567]  ? __get_user_pages+0x423/0x520
[  464.325575]  __gup_longterm_locked+0x212/0x7a0
[  464.325583]  internal_get_user_pages_fast+0xfb/0x190
[  464.325590]  pin_user_pages_fast+0x47/0x60
[  464.325598]  sev_pin_memory+0xca/0x170 [kvm_amd]
[  464.325616]  sev_mem_enc_register_region+0x81/0x130 [kvm_amd]

Per the analysis done by yangge, when starting the SEV virtual machine, it
will call pin_user_pages_fast(..., FOLL_LONGTERM, ...) to pin the memory.
But the page is in CMA area, so fast GUP will fail then fallback to the
slow path due to the longterm pinnalbe check in try_grab_folio().

The slow path will try to pin the pages then migrate them out of CMA area.
But the slow path also uses try_grab_folio() to pin the page, it will
also fail due to the same check then the above warning is triggered.

In addition, the try_grab_folio() is supposed to be used in fast path and
it elevates folio refcount by using add ref unless zero.  We are guaranteed
to have at least one stable reference in slow path, so the simple atomic add
could be used.  The performance difference should be trivial, but the
misuse may be confusing and misleading.

Redefined try_grab_folio() to try_grab_folio_fast(), and try_grab_page()
to try_grab_folio(), and use them in the proper paths.  This solves both
the abuse and the kernel warning.

The proper naming makes their usecase more clear and should prevent from
abusing in the future.

peterx said:

: The user will see the pin fails, for gpu-slow it further triggers the WARN
: right below that failure (as in the original report):
:
:         folio = try_grab_folio(page, page_increm - 1,
:                                 foll_flags);
:         if (WARN_ON_ONCE(!folio)) { <------------------------ here
:                 /*
:                         * Release the 1st page ref if the
:                         * folio is problematic, fail hard.
:                         */
:                 gup_put_folio(page_folio(page), 1,
:                                 foll_flags);
:                 ret = -EFAULT;
:                 goto out;
:         }

[1] hxxps://lore[ . ]kernel[ . ]org/linux-mm/1719478388-31917-1-git-send-email-yangge1116@126.com/

[shy828301@gmail[.]com: fix implicit declaration of function try_grab_folio_fast]


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework . MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com[ . ]mxi[ . ]videoplay ) .


Malware Analysis Report: Ryuk (MD5: bf20e740299d2a3d8f9f5c812bbb729d). Upon execution on VMware ESXi, the sample creates C:\Users\admin\AppData\Local\Temp\agent.py and injects into legitimate processes. Network analysis shows beaconing to 176[.]51[.]207[.]206 every 60 seconds and DNS queries to secure-storage[.]org. The second stage was fetched from hxxp://relayupdate[.]online/callback and written to C:\Program Files\Common Files\backdoor.elf. The payload uses LinPEAS-style techniques for defense evasion. A secondary hash (SHA256: 17dcd73e3f9841a7ab14221b4569821faae79d57b8bd038623abeeaea8cd8976) was extracted from the unpacked payload.


The screenshot below shows SpyNote RAT scanning for Wi-Fi and enabling it if a known channel is found : Additional features - SpyNote RAT could click photos using the device 's camera , based on commands from C & C . Group-IB experts established that the server 185[.]20[.]187[.]89 started functioning no later than 28 January 2019 . Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt .


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 102[.]22[.]89[.]57
- 172[.]44[.]211[.]248
- 87[.]11[.]214[.]196
- sync-relay[ . ]tech
- storagelogin[.]site
URLs:
- hxxp://data-portal[.]top/assets/js/payload.js
- hxxps://login-relay[ . ]club/api/v2/auth
Email Senders:
- admin@phishing-domain[.]com
- it@identity-verify[.]cc
File Indicators:
- MD5: 42dc4c381a108d36af9abc0ca1d81fdb
- SHA256: 2c5ffb2bf5b6595d8385c5811c5bf4a41fadafbe0b1b3d9ff09bbb09e67a7c6c
- Drop path: /dev/shm/update.dll


INDICATORS OF COMPROMISE ( IOCS ) Domains Facebook-photos-au[.]su Homevideo2-12l[ . ]ml videohosting1-5j[ . ]gq URLs hxxp : //88.99.227 [ . Between February and March 2019 , probable MuddyWater-associated samples indicated that BlackWater established persistence on the compromised host , at used PowerShell commands to enumerate the victim 's machine and contained the IP address of the actor 's command and control ( C2 ) . It beacons to domain connect[.]bafunpda[.]xyz and attempts to connect to TCP port 4433 . They once attacked a game server to illicitly farm in - game currency ( “ gaming gold ” , which also has real - world value ) and stole source codes of online game projects .


] 230 [ . This is in stark contrast to some other suspected Russian threat actors ( such as Operation Pawn Storm ) who appear to have increased their targeting of Ukraine following the crisis . The image below depicts the contents of the o402ek2m[.]php file . The Systemd configuration file leveraged by Sandworm enabled the group to maintain persistence on systems .


In the Linux kernel, the following vulnerability has been resolved:

arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD

Currently the ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround isn't
quite right, as it is supposed to be applied after the last explicit
memory access, but is immediately followed by an LDR.

The ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround is used to
handle Cortex-A520 erratum 2966298 and Cortex-A510 erratum 3117295,
which are described in:

* hxxps://developer[.]arm[.]com/documentation/SDEN2444153/0600/?lang=en
* hxxps://developer[.]arm[.]com/documentation/SDEN1873361/1600/?lang=en

In both cases the workaround is described as:

| If pagetable isolation is disabled, the context switch logic in the
| kernel can be updated to execute the following sequence on affected
| cores before exiting to EL0, and after all explicit memory accesses:
|
| 1. A non-shareable TLBI to any context and/or address, including
|    unused contexts or addresses, such as a `TLBI VALE1 Xzr`.
|
| 2. A DSB NSH to guarantee completion of the TLBI.

The important part being that the TLBI+DSB must be placed "after all
explicit memory accesses".

Unfortunately, as-implemented, the TLBI+DSB is immediately followed by
an LDR, as we have:

| alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
| 	tlbi	vale1, xzr
| 	dsb	nsh
| alternative_else_nop_endif
| alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0
| 	ldr	lr, [sp, #S_LR]
| 	add	sp, sp, #PT_REGS_SIZE		// restore sp
| 	eret
| alternative_else_nop_endif
|
| [ ... KPTI exception return path ... ]

This patch fixes this by reworking the logic to place the TLBI+DSB
immediately before the ERET, after all explicit memory accesses.

The ERET is currently in a separate alternative block, and alternatives
cannot be nested. To account for this, the alternative block for
ARM64_UNMAP_KERNEL_AT_EL0 is replaced with a single alternative branch
to skip the KPTI logic, with the new shape of the logic being:

| alternative_insn "b .L_skip_tramp_exit_\@", nop, ARM64_UNMAP_KERNEL_AT_EL0
| 	[ ... KPTI exception return path ... ]
| .L_skip_tramp_exit_\@:
|
| 	ldr	lr, [sp, #S_LR]
| 	add	sp, sp, #PT_REGS_SIZE		// restore sp
|
| alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
| 	tlbi	vale1, xzr
| 	dsb	nsh
| alternative_else_nop_endif
| 	eret

The new structure means that the workaround is only applied when KPTI is
not in use; this is fine as noted in the documented implications of the
erratum:

| Pagetable isolation between EL0 and higher level ELs prevents the
| issue from occurring.

... and as per the workaround description quoted above, the workaround
is only necessary "If pagetable isolation is disabled".


spear phishing : 69[.]87[.]223[.]26 .


Blog Post by Rapid7: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-17296 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from confirm@auth-check[ . ]org delivering RemcosRAT. Post-compromise, the attackers deploy Gootloader and use Metasploit for reconnaissance. C2 infrastructure includes 124[.]66[.]181[.]251 and backup-cdn[.]org. A staging server at hxxps://edgestatic[ . ]club/login hosts additional tooling. Key artifact: /opt/app/bin/loader.exe (SHA1: 79c08e77f2ee94783432e33d9eb054e7e67d7960).


" Accessing these devices and their sensitive data creates a new and steady stream of revenue for cybercriminals , '' Check Point researchers wrote in a recently published report . We determined that these backdoors were installed on the targets ' machines on September 19 2018 , based mainly on the service creation time of the loader component . APT33 : 8 [ . ] 26 [ . ] 21 [ . ] 117 srvhost[ . ]servehttp[ . ]com . The login , as mentioned above , was also designed to look legitimate .


Vulnerability Advisory: CVE-2020-25247 is a critical use-after-free affecting MOVEit Transfer. Trend Micro confirmed active exploitation by Velvet Tempest in the wild. Exploitation delivers Hive (MD5: a2ee9f69463b7ec667c51354aeaab66d) which is dropped to /var/tmp/shell.php. The exploit payload is hosted at hxxps://portalcloud[ . ]top/collect and communicates to 77 [ . ] 18 [ . ] 225 [ . ] 248 for C2.


x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: hxxp://xenbits[ . ]xen[ . ]org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: hxxps://software[ . ]intel[ . ]com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated.


This Go written malware was observed during campaign of COBALT MIRAGE; it includes FRP (Fast Reverse Proxy) published by fatedier on GitHub (hxxps://github[.]com/fatedier/frp) and other projects additionally.


CrowdStrike published a threat intelligence report linking Turla to a new campaign exploiting CVE-2022-24935 in Apache Struts. The attackers deployed Dridex via BITSAdmin, establishing C2 communication with 172 [ . ] 115 [ . ] 147 [ . ] 44 and sync-edge[.]live. A secondary payload was downloaded from hxxp://edgecdn[.]link/panel/index.html. The malware binary (SHA256: d0cd76fd9eb10f91e2d6848d7b8c166d9229c6424bde16adf0d25d164902bdc1) was dropped to C:\Program Files\Common Files\taskhost.exe. Phishing emails were sent from helpdesk@mail-service[.]info targeting enterprise users. A backup C2 server was identified at 145[.]253[.]57[.]147.


Malware Analysis Report: Play (SHA1: f9ab81b8a8a2a712f8d6aa9ab0b0651eeb5c181a). Upon execution on Ubuntu 22.04, the sample creates /tmp/csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 10[.]107[.]101[.]34 every 60 seconds and DNS queries to relaycdn[ . ]top. The second stage was fetched from hxxps://datastatic[.]org/api/v2/auth and written to /home/user/.config/ntds.dit. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (SHA256: 65842fb0c32b8b0ca4c7a6b9e2e473e919f21e7582a5c254dff3119425a9c9dc) was extracted from the unpacked payload.


Forensic Investigation Notes: Analysis of the compromised host revealed Metasploit artifacts at /dev/shm/csrss.exe. Memory dump analysis confirmed execution of Chisel. Registry modifications pointed to persistence via /home/user/.config/csrss.exe. Network forensics identified connections to 159 [ . ] 70 [ . ] 34 [ . ] 15 and storageupdate[ . ]link. Email headers traced the initial vector to security@identity-verify[.]cc. File /usr/local/bin/chrome_helper.exe (MD5: 846560ce3c1096a71b0c9faffc5c7d6e) was identified as the initial dropper. A staging URL hxxps://syncsync[ . ]org/wp-content/uploads/doc.php resolved to 104 [ . ] 212 [ . ] 67 [ . ] 224. Secondary artifact hash: MD5: 16bf9a924f6956a8830b5d638fae4124.


A backdoor also known as: W32.BaragoneE.Trojan Trojan.Win32.Cosmu!O Trojan.Cosmu.Win32.14181 TROJ_COSMU.SMJ0 Win32/Cosmu.OP TROJ_COSMU.SMJ0 Win.Trojan.Mybot-8550 Trojan.Win32.Bot.ercyne TrojWare.Win32.Phishbank.DA Trojan.Click1.57939 BehavesLike[ . ]Win32[ . ]Downloader[ . ]ch Trojan/Win32.Cosmu.awlb Trojan:Win32/Phishbank.A W32.W.Mydoom.kZJ8 TScope.Malware-Cryptor.SB Trojan.Win32.Sisron Trojan.Win32.Phishbank.A


] com on port 22011 . In 2015 , Suckfly conducted a multistage attack . Directory of Government Services[ . ]pdf : Tracked by Mandiant as FREEFIRE , it is a lightweight backdoor written for .NET .


CISA published a threat intelligence report linking Ember Bear to a new campaign exploiting CVE-2023-34867 in Palo Alto PAN-OS. The attackers deployed BumbleBee via Chisel, establishing C2 communication with 45[.]57[.]191[.]201 and proxy-node[ . ]org. A secondary payload was downloaded from hxxps://storage-proxy[.]club/secure/token. The malware binary (SHA256: 478043fae335f8711a5d06cce2abf26bb14c5f6c82b97c4d85e7b946a5dd7c33) was dropped to C:\Users\Public\Documents\loader.exe. Phishing emails were sent from noreply@login-portal[.]tech targeting enterprise users. A backup C2 server was identified at 10[.]47[.]227[.]130.


Incident Response Summary: On detection of anomalous traffic to 10 [ . ] 249 [ . ] 204 [ . ] 125, the Trend Micro IR team identified FormBook running as /etc/cron.d/sam.hive. The threat actor, believed to be Salt Typhoon, used PowerShell Empire for credential harvesting and LinPEAS for lateral movement. Exfiltrated data was sent to edgeapi[ . ]info and proxyauth[.]online. The initial dropper (SHA256: 74928cf25de668b34449066dcc019776038152e0f515140a0e1ef97fd1f465ab) was delivered via a phishing email from billing@credential-check[ . ]site. A second C2 node was observed at 60 [ . ] 31 [ . ] 9 [ . ] 109, with a persistence mechanism writing to C:\Program Files\Common Files\svchost.exe.


Malware Analysis Report: Royal (MD5: f531700044e9b51483a841f6b37424f9). Upon execution on Windows Server 2019, the sample creates C:\Users\admin\AppData\Local\Temp\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 172[.]79[.]205[.]148 every 60 seconds and DNS queries to login-gateway[.]tech. The second stage was fetched from hxxp://datalogin[.]link/secure/token and written to C:\ProgramData\chrome_helper.exe. The payload uses Mimikatz-style techniques for defense evasion. A secondary hash (SHA1: 2ce745a1fd71db25afa19306f087607f54d46755) was extracted from the unpacked payload.


This is known as a targeted attack . The Leafminer 's post-compromise toolkit suggests that Leafminer is looking for email data , files , and database servers on compromised target systems . APT33 : 192[.]119[.]15[.]37 mynetwork[.]ddns[.]net . What ’s more , two other vulnerabilities in MOVEit were found while new victims were still coming forward .


The initial beacon to index[ . ]php changed to index[.]txt but ZeroT still expects an RC4 encrypted response using a static key : “ (*^GF (9042&* ” .


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from contact@account-update[ . ]xyz and report@mail-service[.]info, spoofing legitimate services. Victims were directed to hxxps://cdn-gateway[ . ]site/secure/token which hosted a credential harvesting page on cloud-auth[.]xyz. A secondary link hxxps://staticnode[ . ]com/api/v2/auth delivered WarmCookie (SHA256: c40c1e97b1c75850302e9cc023f4bd1c59b19e57997e07c520e6ea5d5a39fe0b). The malware was saved to C:\Users\admin\AppData\Local\Temp\backdoor.elf and established C2 with 192[.]80[.]32[.]210.


Incident Response Summary: On detection of anomalous traffic to 157[.]135[.]160[.]112, the Palo Alto Unit 42 IR team identified RedLine Stealer running as /dev/shm/backdoor.elf. The threat actor, believed to be Diamond Sleet, used Sliver for credential harvesting and Burp Suite for lateral movement. Exfiltrated data was sent to cdncloud[.]org and data-secure[.]com. The initial dropper (MD5: 3527c5ba873762b2a9c00f7d247c814f) was delivered via a phishing email from verify@phishing-domain[ . ]com. A second C2 node was observed at 172[.]251[.]77[.]143, with a persistence mechanism writing to C:\Users\admin\Downloads\sam.hive.


There is no lot of IOCs in this article so we take one sample and try to extract some interesting IOCs, our findings below :

CamuBot sample : 37ca2e37e1dc26d6b66ba041ed653dc8ee43e1db71a705df4546449dd7591479

Dropped Files on disk :

C:\Users\user~1\AppData\Local\Temp\protecao.exe : 0af612461174eedec813ce670ba35e74a9433361eacb3ceab6d79232a6fe13c1

C:\Users\user~1\AppData\Local\Temp\Renci.SshNet.dll : 3E3CD9E8D94FC45F811720F5E911B892A17EE00F971E498EAA8B5CAE44A6A8D8

C:\ProgramData\m.msi : AD90D4ADFED0BDCB2E56871B13CC7E857F64C906E2CF3283D30D6CFD24CD2190

Protecao.exe try to download hxxp://www[.]usb-over-network[.]com/usb-over-network-64bit.msi

A new driver is installed : C:\Windows\system32\drivers\ftusbload2.sys : 9255E8B64FB278BC5FFE5B8F70D68AF8

ftusbload2.sys set 28 IRP handlers.


The injected code copies xxxx[.]exe to %System%\winsys[.]exe and connects to the Command and Control ( C&C ) server on TCP port 80 .


Incident Response Summary: On detection of anomalous traffic to 172 [ . ] 249 [ . ] 147 [ . ] 17, the SentinelOne IR team identified Gootloader running as /etc/cron.d/svchost.exe. The threat actor, believed to be Gamaredon, used Certutil for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to cacheauth[.]com and backupupdate[ . ]site. The initial dropper (SHA256: 26e28601d045d09baca578856569f6725ce640c6de4e97551fdef360c3a40edb) was delivered via a phishing email from finance@urgent-notice[.]online. A second C2 node was observed at 4 [ . ] 232 [ . ] 20 [ . ] 56, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\backdoor.elf.


on 167[.]99[.]176[.]61 : free-androidvpn.date free-androidvpn.download free-androidvpn[.]online free-vpn.date free-vpn.download free-vpn[ . ]online Hashes 22fcfce096392f085218c3a78dd0fa4be9e67ed725bce42b965a27725f671cf 55292a4dde8727faad1c40c914cf1be9dfdcf4e67b515aa593bcd8d86e824372


ed234e61849dcb95223676abe2312e1378d6130c0b00851d82cda545b946ec83 27410d4019251a70d38f0635277f931fb73f67ac9f2e1f3b475ce680ebfde12a 6e6c210535b414c5aa2dd9e67f5153feeb43a8ac8126d8e249e768f501323a3e 4a32ced20df7001da7d29edc31ca76e13eef0c9b355f62c44888853435e9794f In the second set they are making use of a dynamic DNS service by ChangeIP[ . ]com . The new campaigns mark the first significant stirrings from the group since it went silent in January in the wake of a detailed expose of the group and its exploits — and a retooling of what security researchers believe is a massive spying operation based in China . FakeSG has different browser templates depending on which browser the victim is running .


Cisco Talos detected a multi-stage attack chain. The initial phishing email from noreply@document-share[ . ]link contained a link to hxxp://secure-cache[.]dev/portal/verify. This redirected to hxxp://authapi[.]club/secure/token on cache-gateway[.]site. A secondary email from service@identity-verify[ . ]cc pointed to hxxp://gateway-update[.]io/download/update.exe which delivered Dridex. The final payload callback was hxxps://cachestorage[.]dev/wp-content/uploads/doc.php resolving to 123 [ . ] 33 [ . ] 47 [ . ] 132 via storage-relay[ . ]tech.


Blog Post by Cisco Talos: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-16140 against Ivanti Connect Secure deployments. The initial access vector involves spear-phishing emails from verify@login-portal[ . ]tech delivering LockBit. Post-compromise, the attackers deploy Conti and use GhostPack for reconnaissance. C2 infrastructure includes 172 [ . ] 132 [ . ] 28 [ . ] 115 and cdnbackup[ . ]live. A staging server at hxxps://api-cloud[.]club/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Program Files\Common Files\csrss.exe (SHA1: 17dce84c6bdbe6c3ef264e47f1a1213b10ba04c0).


Malware Analysis Report: WarmCookie (MD5: 8bbf21c057b0f18a069856fccf900c1e). Upon execution on Fortinet FortiGate, the sample creates C:\Program Files\Common Files\svchost.exe and injects into legitimate processes. Network analysis shows beaconing to 192 [ . ] 50 [ . ] 196 [ . ] 149 every 60 seconds and DNS queries to gatewaygateway[ . ]xyz. The second stage was fetched from hxxps://static-data[ . ]org/collect and written to /opt/app/bin/implant.so. The payload uses PsExec-style techniques for defense evasion. A secondary hash (MD5: 59ecdab799d91d8c481bd60f3e7f51cd) was extracted from the unpacked payload.


Artifact Analysis for Latrodectus campaign:
Stage 1 dropper at C:\Users\admin\Desktop\sam.hive - MD5: c5541733709ef2df6e6fed4ccfde18da
Stage 2 loader at C:\Users\admin\Desktop\payload.bin - MD5: 5913d38534c58ea1afe36f951c688d58
Final payload at /home/user/.config/payload.bin - SHA1: a61dda965395a88b4404bc984e842bc0544e8ce2
Exfiltration module - SHA256: eeebefb06e47e58bd6df32bb8759b17b8cd7dda6c8c9e7f7fa2ca1c0840a2973
All stages communicated with 67[.]16[.]158[.]6. Chisel signatures detected in Stage 2.


The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

  *  Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
  *  Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.

Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the  Log4j 1 to Log4j 2 migration guide hxxps://logging[.]apache[.]org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.


Blog Post by Dragos: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-26043 against SonicWall SMA deployments. The initial access vector involves spear-phishing emails from notification@account-update[ . ]xyz delivering FormBook. Post-compromise, the attackers deploy Amadey and use BITSAdmin for reconnaissance. C2 infrastructure includes 166[.]231[.]34[.]134 and cloudgateway[.]club. A staging server at hxxps://data-cache[ . ]tech/admin/config hosts additional tooling. Key artifact: C:\ProgramData\taskhost.exe (MD5: cdd631f6fdd06f878cc0e3f28162e4b3).


Malware Analysis Report: XLoader (SHA256: aa90121b9a54b7586a88772e639d3ebf15eff2a3251a615a80b93c3584544919). Upon execution on Ubuntu 22.04, the sample creates C:\Users\admin\Downloads\helper.sh and injects into legitimate processes. Network analysis shows beaconing to 8 [ . ] 98 [ . ] 191 [ . ] 101 every 60 seconds and DNS queries to staticdata[ . ]club. The second stage was fetched from hxxp://proxy-static[.]link/admin/config and written to /home/user/.config/beacon.dll. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (MD5: ba30891fabcca2a835bae9d1e23fcfda) was extracted from the unpacked payload.


Based on observations associated with the malicious document , we observed subsequent shell sessions probably associated with Metasploit B-MAL S-TOOL ’s Meterpreter that enabled deployment of additional tools and malware preceding deployment of three Shamoon-related files : ntertmgr32[ . ]exe , ntertmgr64[ . ]exe and vdsk911[ . ]sys .


It steals money from the victim ’ s bank account . Southeastern Europe as well as countries in the former Soviet Union Republichas recently been the main target . Winnti : hpqhvsei[ . ]dll . Simultaneously , a threat researcher outside of CrowdStrike discovered an attacker ’s tooling via an open repository , downloaded all of the tools , and made them available through a MegaUpload link in a Twitter post.2


CVE-2026-23853: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7 [ . ] 7 [ . ] 1 [ . ] 0 through 8.5, LTS2025 release version 8 [ . ] 3 [ . ] 1 [ . ] 0 through 8 [ . ] 3 [ . ] 1 [ . ] 20, LTS2024 release versions 7[.]13[.]1[.]0 through 7[.]13[.]1[.]50, contain a use of weak credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to the system.


The attackers stole organizations' SSL certificates associated with security appliances such as ASA to obtain VPN credentials , allowing the actors to gain access to the targeted network . This was the case in two known intrusions in 2015 , where attackers named the implant DLL " ASPNET_FILTER[.]DLL " to disguise it as the DLL for the ASP[ . ]NET ISAPI Filter .


Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Supported versions that are affected are 12[.]2[.]1[.]3.0 and 12[.]2[.]1[.]4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).


Secureworks published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2020-49453 in Ubuntu 22.04. The attackers deployed Emotet via LinPEAS, establishing C2 communication with 186 [ . ] 178 [ . ] 177 [ . ] 247 and cacheupdate[.]info. A secondary payload was downloaded from hxxps://gateway-node[.]net/panel/index.html. The malware binary (MD5: 348e1d59429cea872abbcce3350fad25) was dropped to /opt/app/bin/taskhost.exe. Phishing emails were sent from account@mail-service[.]info targeting enterprise users. A backup C2 server was identified at 58[.]99[.]232[.]239.


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 192 [ . ] 104 [ . ] 229 [ . ] 181
- 10[.]197[.]195[.]63
- 10[.]241[.]62[.]90
- edgeapi[ . ]io
- authdata[ . ]xyz
URLs:
- hxxps://nodegateway[.]com/gate.php
- hxxps://portalrelay[ . ]online/collect
Email Senders:
- noreply@urgent-notice[ . ]online
- confirm@document-share[.]link
File Indicators:
- SHA256: f5d1bc9b876af8dc58341783c1fdc9e966c8dfb00fe823e4f72491fbbbbca166
- SHA256: 057d39b05f1838fd299857f78b68eb2f6d1ff895720cbbabea08b9ee424399e7
- Drop path: C:\Windows\System32\update.dll


Malwr[ . ]com observed this site in association with another sample that called out to mailsinfo[.]net – a host identified in the Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA blog .


The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users . The email contained an attachment named Seminar-Invitation[ . ]doc , which is a malicious Microsoft Word document we track as ThreeDollars .


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from info@account-update[.]xyz and noreply@auth-check[ . ]org, spoofing legitimate services. Victims were directed to hxxp://cache-storage[ . ]site/panel/index.html which hosted a credential harvesting page on datacloud[.]online. A secondary link hxxp://syncnode[.]club/wp-content/uploads/doc.php delivered DanaBot (SHA256: 5e8f02d0217e758dfb23b357a96e17b301ff4bad7de100ae0faed7d30176a1ed). The malware was saved to C:\Users\admin\Downloads\taskhost.exe and established C2 with 10[.]44[.]24[.]31.


By integrating the findings with prior research , it was possible to connect MONSOON directly with infrastructure used by the HANGOVER group via a series of strong connections . In late September 2015 Mofang used the website of Myanmara 's national airline hosted at www[.]flymna[.]com for an attack against an organization in Myanmar .


Artifact Analysis for Dridex campaign:
Stage 1 dropper at C:\Windows\Tasks\shell.php - SHA1: ba4a697129fe0a157e80462ed3bd2916fd333014
Stage 2 loader at /tmp/implant.so - SHA1: 67f93cd86492d0b5f5dc4287b06703f010e7fb66
Final payload at /home/user/.config/helper.sh - MD5: 6b36d9ab6a185c99cb7fbacd3f75f406
Exfiltration module - SHA256: a8a886bf32d7f7476559d79d9cb660c10c9d08977fa2d59ee92d7fd4394568d2
All stages communicated with 172 [ . ] 81 [ . ] 36 [ . ] 92. Burp Suite signatures detected in Stage 2.


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from info@mail-service[.]info contained a link to hxxps://relaygateway[.]dev/admin/config. This redirected to hxxp://cdnstorage[.]cc/portal/verify on update-gateway[ . ]tech. A secondary email from helpdesk@mail-service[ . ]info pointed to hxxp://cdndata[.]xyz/portal/verify which delivered AgentTesla. The final payload callback was hxxp://backup-storage[.]link/assets/js/payload.js resolving to 192 [ . ] 106 [ . ] 244 [ . ] 19 via datalogin[.]site.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from noreply@account-update[.]xyz and updates@secure-verify[ . ]net, spoofing legitimate services. Victims were directed to hxxp://loginportal[ . ]site/admin/config which hosted a credential harvesting page on proxy-update[.]top. A secondary link hxxps://portalmail[.]com/callback delivered Cobalt Strike (MD5: 3273f400313a6299159989ed01de5273). The malware was saved to /usr/local/bin/taskhost.exe and established C2 with 10[.]193[.]215[.]221.


The MuddyWater threat group, attributed to Iran's Ministry of Intelligence and Security, deployed a new backdoor called PhonyC2 against Israeli organizations. The malware was delivered via phishing emails containing malicious Excel macros. PhonyC2 communicates with the domain connect[ . ]civilstream[ . ]com using HTTPS POST requests. The backdoor supports file upload, download, and arbitrary command execution on compromised Windows hosts.


The loader first dynamically rebuilds a simple import address table ( IAT ) , resolving all the API needed from Kernel32 and NtDll libraries . The Magic Hound campaign used Word and Excel documents containing malicious macros as a delivery method , specifically attempting to load MagicHound.Rollover . Winnti : bb4ab0d8d05a3404f1f53f152ebd79f4ba4d4d81 2018-10-10 09:57:31 hxxp://checkin[ . ]travelsanignacio[ . ]com . Developed in - house using C++ , the NoEscape ransomware uses a hybrid approach to encryption , combining ChaCha20 and RSA encryption algorithms for file encryption and key protection .


Check that the mutex WininetStartupMutex0 does not already exist Check that no DLL whose base name has hash value of 0xC9CEF3E4 is mapped into the malware address space The hashes in these checks are most likely correspond to sandbox or security products that the FinFisher authors want to avoid . During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros . This white paper describes the steganography algorithm used in two distinct loader variants and looks at the launcher of the backdoor that was encoded in one of the .png cover images . mcvsocfg[ . ]dll : In April , Talos discovered a new ransomware actor , RA Group , conducting double extortion attacks using their ransomware variant based on leaked Babuk source code .


The initial sample we intercepted was a Microsoft Word document ( SHA256 : 2cfc4b3686511f959f14889d26d3d9a0d06e27ee2bb54c9afb1ada6b8205c55f ) with the filename crash list ( Lion Air Boeing 737 )[ . ]docx using the author name Joohn .


Malware Analysis Report: Conti (SHA256: ecf918534bbe284a5ca72aec778d12972d7e503d1366b6a35fdb0322e8707549). Upon execution on Zyxel USG, the sample creates /opt/app/bin/implant.so and injects into legitimate processes. Network analysis shows beaconing to 10[.]38[.]90[.]96 every 60 seconds and DNS queries to login-cache[.]link. The second stage was fetched from hxxps://api-api[ . ]com/assets/js/payload.js and written to C:\ProgramData\payload.bin. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA256: ca5ef186bf7de79650af30eaa62b1214e435e406447a2461820d543ee2461302) was extracted from the unpacked payload.


Check Point Research published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2022-27335 in Palo Alto PAN-OS. The attackers deployed PlugX via LinPEAS, establishing C2 communication with 14[.]135[.]59[.]14 and edgedata[ . ]site. A secondary payload was downloaded from hxxp://proxysync[ . ]org/login. The malware binary (MD5: 7d27e5624bcd4fc2a207a778570181ee) was dropped to C:\Windows\Tasks\lsass.dmp. Phishing emails were sent from ceo@urgent-notice[.]online targeting enterprise users. A backup C2 server was identified at 172 [ . ] 204 [ . ] 243 [ . ] 78.


Content of bdata.xml file : It can be added to the /system/etc/sysconfig/ path to allowlist specified implant components from the battery saving system . The malware known as RATANKBA is just one of the weapons in Lazarus ' arsenal . APT33 : 162 [ . ] 250 [ . ] 145 [ . ] 234 mynetwork[ . ]ddns[ . ]net . When it comes to Cuba and similar threats , access to highfidelity threat intelligence to help identify the highest risk , most actively exploitable vulnerabilities can help prioritization efforts when organizations are faced with a backlog of vulnerabilities to address .


A backdoor also known as: W32.UsernameReimuatH.Trojan Worm/W32[.]WBNA[.]294912[.]AU Trojan.Win32.Diple!O Trojan.Beebone.D Trojan/VBObfus.fz Win32.Worm.Pronny.d Win32/VB.KXfdHDB WORM_VOBFUS.SM37 Win.Packer.VBCrypt-5731517-0 Worm.Win32.Vobfus.erof Trojan.Win32.Vobfus.enwdjc Win32.Worm.Vobfus.Wvay Win32.HLLW.Autoruner2.18084 WORM_VOBFUS.SM37 BehavesLike.Win32.Autorun.dh Win32.Virut.ce.57344 Trojan.Symmi.D13A73 Trojan.Win32.A.Diple.299008.BAT Worm.Win32.Vobfus.erof Worm/Win32.WBNA.R108353 TScope.Trojan.VB Worm.Win32.Vobfus


Blog Post by SentinelOne: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-35928 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from admin@credential-check[ . ]site delivering TrickBot. Post-compromise, the attackers deploy PlugX and use Mimikatz for reconnaissance. C2 infrastructure includes 34 [ . ] 197 [ . ] 111 [ . ] 48 and portalsecure[.]dev. A staging server at hxxps://cloudlogin[ . ]site/gate.php hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\backdoor.elf (SHA256: 21c6009812e29c0115d91c20b55be492cab84bd4484dd4a121ea75b03b1f8563).


FBI published a threat intelligence report linking Flax Typhoon to a new campaign exploiting CVE-2021-16698 in Apache Struts. The attackers deployed FormBook via PowerView, establishing C2 communication with 172 [ . ] 78 [ . ] 216 [ . ] 203 and edgenode[ . ]dev. A secondary payload was downloaded from hxxps://edgecdn[ . ]link/assets/js/payload.js. The malware binary (SHA1: 269d116dc2f561c564d776bf88795a92865561a6) was dropped to C:\ProgramData\taskhost.exe. Phishing emails were sent from helpdesk@auth-check[ . ]org targeting enterprise users. A backup C2 server was identified at 19[.]229[.]245[.]150.


X-Force IRIS discovered that the threat actor was hosting at least one malicious executable on a server hosted on ntg-sa[.]com .


The LockBit attack began with exploitation of CVE-2023-20198. The ransomware binary (SHA256: c393ca0eb7bc6f728f14083b5758604c5b8faf4892456ae05961359e44cf655e) was deployed to C:\Windows\System32\drivers\ndis_helper.sys. Ransom negotiation portal was hosted at monitor-net[[ . ]]org (151[.]172[.]125[.]55). Contact email for payment: alert@security-warning[.]dev.


Vulnerability Advisory: CVE-2026-10752 is a critical buffer overflow affecting MOVEit Transfer. CrowdStrike confirmed active exploitation by Sandworm in the wild. Exploitation delivers BlackCat (SHA256: 5f0ad18e93b1440da3a0705e96a645fa180928b3fa457be1585cf97d97751d69) which is dropped to /usr/local/bin/beacon.dll. The exploit payload is hosted at hxxp://gatewaysync[.]com/download/update.exe and communicates to 10 [ . ] 204 [ . ] 112 [ . ] 237 for C2.


Incident Response Summary: On detection of anomalous traffic to 91[.]163[.]253[.]109, the Dragos IR team identified Dridex running as /var/tmp/lsass.dmp. The threat actor, believed to be Scattered Spider, used CrackMapExec for credential harvesting and Rubeus for lateral movement. Exfiltrated data was sent to portal-gateway[.]io and edgeedge[.]online. The initial dropper (SHA1: 943c555498a203507d3f868cae0be4c2e7913e02) was delivered via a phishing email from account@document-share[.]link. A second C2 node was observed at 178 [ . ] 211 [ . ] 170 [ . ] 36, with a persistence mechanism writing to C:\ProgramData\shell.php.


The group has repeatedly used social media , particularly LinkedIn , to identify and interact with employees at targeted organizations , and then used weaponized Excel documents to deliver RATs such as PupyRAT . This includes Python scripts . Usually , the Stageless Meterpreter has the Ext_server_stdapi[.]x64[.]dll” , Ext_server_extapi[.]x64[.]dll” , and Ext_server_espia[ . ]x64[ . ]dll” extensions .


Vulnerability in the Oracle Applications DBA component of Oracle Database Server. Supported versions that are affected are 12 [ . ] 1 [ . ] 0 [ . ] 2, 12[.]2[.]0[.]1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Oracle Applications DBA executes to compromise Oracle Applications DBA. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications DBA accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications DBA. CVSS 3.0 Base Score 3.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L).


Incident Response Summary: On detection of anomalous traffic to 29 [ . ] 61 [ . ] 189 [ . ] 147, the Google TAG IR team identified RedLine Stealer running as C:\Program Files\Common Files\update.dll. The threat actor, believed to be Diamond Sleet, used Metasploit for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to mailbackup[ . ]info and updatelogin[ . ]org. The initial dropper (SHA256: 750cff1ae73a22643b24fd5bb0d0b5bd02264854f51c63f9623c8d6c8869740e) was delivered via a phishing email from verify@phishing-domain[.]com. A second C2 node was observed at 11[.]78[.]60[.]96, with a persistence mechanism writing to /home/user/.config/agent.py.


Incident Response Summary: On detection of anomalous traffic to 37 [ . ] 100 [ . ] 221 [ . ] 150, the Dragos IR team identified Latrodectus running as /home/user/.config/implant.so. The threat actor, believed to be Mustang Panda, used Impacket for credential harvesting and WinPEAS for lateral movement. Exfiltrated data was sent to dataportal[.]site and authsync[.]dev. The initial dropper (SHA1: 67be9dd5c4ef78fb6114649b843cad70ed0844d3) was delivered via a phishing email from ceo@document-share[.]link. A second C2 node was observed at 172[.]112[.]16[.]122, with a persistence mechanism writing to /home/user/.config/config.dat.


Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10[.]3[.]6[.]0.0, 12[.]1[.]3[.]0.0, 12[.]2[.]1[.]3.0 and 12[.]2[.]1[.]4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from billing@login-portal[.]tech and report@urgent-notice[.]online, spoofing legitimate services. Victims were directed to hxxp://api-backup[ . ]online/wp-content/uploads/doc.php which hosted a credential harvesting page on storageapi[.]club. A secondary link hxxps://relay-login[ . ]club/collect delivered Vidar (MD5: 8bed84c16529363b442c0a57cc2c62a9). The malware was saved to C:\Windows\Tasks\svchost.exe and established C2 with 51[.]208[.]112[.]172.


Poison Ivy is a remote access tool that is freely available for download from its official web site at www[ . ]poisonivy-rat[ . ]com .


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from verify@phishing-domain[.]com and verify@credential-check[.]site, spoofing legitimate services. Victims were directed to hxxp://mailsync[ . ]info/assets/js/payload.js which hosted a credential harvesting page on apibackup[ . ]site. A secondary link hxxp://edge-login[ . ]dev/api/v2/auth delivered IcedID (SHA1: 7f621723a29e0d15c417f54bb2bd88462fc1bcd5). The malware was saved to /opt/app/bin/helper.sh and established C2 with 108[.]248[.]198[.]105.


A backdoor also known as: W32.SampleswareTG.Trojan Trojan-GameThief.Win32.Magania!O Backdoor.Farfli.O Trojan/Magania.eken Win32.Trojan.Farfli.ai Win32/Farfli.GKH Win.Trojan.Magania-19224 Trojan-GameThief.Win32.Magania.uagj Trojan.Win32.Magania.bvkxn Troj.W32.MMM.ljA2 Backdoor.Win32.Gh0st.g Trojan.Magania.Win32.38676 BKDR_INJECT.SMJ BehavesLike[.]Win32[.]Backdoor[.]cc Backdoor/IRCBot.qan Trojan.Barys.62 Trojan-GameThief.Win32.Magania.uagj Trojan/Win32.PcClient.R12944 TrojanPSW.Magania Win32/Farfli.AK Trojan.Farfli!czCLTsqt/Nw Backdoor.Win32.FirstInj Backdoor.Win32.Gh0st.BH


Blog Post by Check Point Research: Tracking UNC2452's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-26162 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from account@phishing-domain[ . ]com delivering IcedID. Post-compromise, the attackers deploy XLoader and use Certutil for reconnaissance. C2 infrastructure includes 172[.]204[.]32[.]225 and proxy-cache[.]com. A staging server at hxxps://securemail[ . ]org/callback hosts additional tooling. Key artifact: C:\Program Files\Common Files\dropper.ps1 (MD5: 7dd06682833ede7f4f1b4e2fe2552a80).


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from helpdesk@phishing-domain[.]com and noreply@auth-check[ . ]org, spoofing legitimate services. Victims were directed to hxxps://update-static[ . ]info/download/update.exe which hosted a credential harvesting page on dataauth[.]cc. A secondary link hxxp://relay-mail[.]cc/assets/js/payload.js delivered DarkSide (SHA256: 8aab0c3d27847582657c5321b5e0d3716223b4df94098b5057f868683f5b88c5). The malware was saved to C:\Users\admin\AppData\Local\Temp\implant.so and established C2 with 12 [ . ] 68 [ . ] 237 [ . ] 90.


In the Linux kernel, the following vulnerability has been resolved:

lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()

alloc_tag_top_users() attempts to lock alloc_tag_cttype->mod_lock even
when the alloc_tag_cttype is not allocated because:

  1) alloc tagging is disabled because mem profiling is disabled
     (!alloc_tag_cttype)
  2) alloc tagging is enabled, but not yet initialized (!alloc_tag_cttype)
  3) alloc tagging is enabled, but failed initialization
     (!alloc_tag_cttype or IS_ERR(alloc_tag_cttype))

In all cases, alloc_tag_cttype is not allocated, and therefore
alloc_tag_top_users() should not attempt to acquire the semaphore.

This leads to a crash on memory allocation failure by attempting to
acquire a non-existent semaphore:

  Oops: general protection fault, probably for non-canonical address 0xdffffc000000001b: 0000 [#3] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
  CPU: 2 UID: 0 PID: 1 Comm: systemd Tainted: G      D             6.16.0-rc2 #1 VOLUNTARY
  Tainted: [D]=DIE
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
  RIP: 0010:down_read_trylock+0xaa/0x3b0
  Code: d0 7c 08 84 d2 0f 85 a0 02 00 00 8b 0d df 31 dd 04 85 c9 75 29 48 b8 00 00 00 00 00 fc ff df 48 8d 6b 68 48 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 88 02 00 00 48 3b 5b 68 0f 85 53 01 00 00 65 ff
  RSP: 0000:ffff8881002ce9b8 EFLAGS: 00010016
  RAX: dffffc0000000000 RBX: 0000000000000070 RCX: 0000000000000000
  RDX: 000000000000001b RSI: 000000000000000a RDI: 0000000000000070
  RBP: 00000000000000d8 R08: 0000000000000001 R09: ffffed107dde49d1
  R10: ffff8883eef24e8b R11: ffff8881002cec20 R12: 1ffff11020059d37
  R13: 00000000003fff7b R14: ffff8881002cec20 R15: dffffc0000000000
  FS:  00007f963f21d940(0000) GS:ffff888458ca6000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007f963f5edf71 CR3: 000000010672c000 CR4: 0000000000350ef0
  Call Trace:
   <TASK>
   codetag_trylock_module_list+0xd/0x20
   alloc_tag_top_users+0x369/0x4b0
   __show_mem+0x1cd/0x6e0
   warn_alloc+0x2b1/0x390
   __alloc_frozen_pages_noprof+0x12b9/0x21a0
   alloc_pages_mpol+0x135/0x3e0
   alloc_slab_page+0x82/0xe0
   new_slab+0x212/0x240
   ___slab_alloc+0x82a/0xe00
   </TASK>

As David Wang points out, this issue became easier to trigger after commit
780138b12381 ("alloc_tag: check mem_profiling_support in alloc_tag_init").

Before the commit, the issue occurred only when it failed to allocate and
initialize alloc_tag_cttype or if a memory allocation fails before
alloc_tag_init() is called.  After the commit, it can be easily triggered
when memory profiling is compiled but disabled at boot.

To properly determine whether alloc_tag_init() has been called and its
data structures initialized, verify that alloc_tag_cttype is a valid
pointer before acquiring the semaphore.  If the variable is NULL or an
error value, it has not been properly initialized.  In such a case, just
skip and do not attempt to acquire the semaphore.

[harry.yoo@oracle[ . ]com: v3]


Forensic Investigation Notes: Analysis of the compromised host revealed Mimikatz artifacts at /var/tmp/agent.py. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via /usr/local/bin/chrome_helper.exe. Network forensics identified connections to 220[.]160[.]183[.]128 and sync-gateway[.]xyz. Email headers traced the initial vector to contact@secure-verify[.]net. File /dev/shm/taskhost.exe (MD5: 0be6383fdc3e9ae48b1d8a47606bc5a6) was identified as the initial dropper. A staging URL hxxps://loginapi[.]top/assets/js/payload.js resolved to 172 [ . ] 221 [ . ] 118 [ . ] 45. Secondary artifact hash: SHA1: d37d89f867324261d0e44634f39529788fd32387.


Malware Analysis Report: BlackCat (SHA1: 4badc3fe5d500a0ee06b28a7b79ac9522412317b). Upon execution on VMware ESXi, the sample creates C:\Windows\System32\ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 63[.]72[.]8[.]231 every 60 seconds and DNS queries to relay-sync[.]online. The second stage was fetched from hxxp://relayrelay[.]tech/gate.php and written to C:\Users\admin\AppData\Local\Temp\helper.sh. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (MD5: da078f267320b633160e8c1632de0e61) was extracted from the unpacked payload.


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 172 [ . ] 243 [ . ] 112 [ . ] 126
- 91[.]175[.]131[.]113
- 17[.]224[.]65[.]114
- proxydata[.]tech
- backupedge[ . ]dev
URLs:
- hxxp://authsecure[.]dev/callback
- hxxp://authstorage[.]dev/collect
Email Senders:
- billing@document-share[ . ]link
- noreply@document-share[ . ]link
File Indicators:
- SHA256: 67778e4a7cc0aa37fc999dcd453d3acc97e4263a659a45f4536a2dc088581cb5
- MD5: 0957fcf13fb365823854fec6542ee5b4
- Drop path: /usr/local/bin/config.dat


Malware Analysis Report: WarmCookie (SHA1: b8be3f9d1120996537073d8c2087373051aeabb3). Upon execution on Active Directory, the sample creates /var/tmp/beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 200 [ . ] 59 [ . ] 120 [ . ] 237 every 60 seconds and DNS queries to edgestorage[.]org. The second stage was fetched from hxxps://update-gateway[ . ]net/admin/config and written to C:\Windows\Temp\taskhost.exe. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (SHA1: 8b171cfa4962ff8f7bb0261df6fe81ad2c86117b) was extracted from the unpacked payload.


Malware Analysis Report: RemcosRAT (SHA256: 38ad20887d2715778f071a6cc5a0528469f6a883e242d9f68a10a32c3858d660). Upon execution on F5 BIG-IP, the sample creates /opt/app/bin/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 124[.]176[.]96[.]161 every 60 seconds and DNS queries to relaycloud[ . ]online. The second stage was fetched from hxxps://edgerelay[ . ]net/admin/config and written to C:\Users\admin\Downloads\backdoor.elf. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (SHA1: dd008052b4ed983e7fd1aa5891fd930232661f7a) was extracted from the unpacked payload.


A backdoor also known as: Riskware.Confuser! Trojan.Win32.SteamBurglar.dmdrlr Trojan.SteamBurglar.621 Trojan.Katusha.Win32.39398 BehavesLike[ . ]Win32[ . ]Backdoor[ . ]cc TR/Confuser.181248 MSIL/Injector.LTM!tr PWS:MSIL/Stimilini.C Trj/CI.A Trojan.MSIL.Stimilik MSIL6.AKRX Trojan.MSIL.Stimilik.DT


The Play ransomware group has targeted organizations using CVE-2022-41040 and CVE-2022-41082 in Microsoft Exchange Server, collectively known as ProxyNotShell. After exploitation, the actors deployed a webshell at C:\inetpub\wwwroot\aspnet_client\discover.aspx. The ransomware encrypted files with the .play extension. FBI investigation uncovered command and control infrastructure at 45[.]76[.]172[.]198 and 64 [ . ] 190 [ . ] 113 [ . ] 52. Encrypted DNS over HTTPS was used to evade detection.


Vulnerability Advisory: CVE-2022-32541 is a critical null pointer dereference affecting Palo Alto PAN-OS. Google TAG confirmed active exploitation by Turla in the wild. Exploitation delivers Emotet (SHA1: 6ffd0536fe3267b8116f4f2fb2cc647326325d14) which is dropped to C:\Windows\Temp\chrome_helper.exe. The exploit payload is hosted at hxxp://cdn-auth[.]com/wp-content/uploads/doc.php and communicates to 192 [ . ] 108 [ . ] 85 [ . ] 38 for C2.


Hanieh_will_remain_abroad_and_Hamas_steps_up_in_Gaza[ . ]r23 :


The Bumblebee loader contacts three staging URLs: hxxps://loader-bin[[.]]work/download/payload.exe, hxxp://share-files[[.]]biz/gate.php, and hxxps://token-auth[[ . ]]space/api/beacon. The final payload (SHA256: 0dca123ba69c7c94a793d25435d3a271d9c66b68f6a5b90b3454a57293902f5d) is downloaded and executed. Fallback C2 is at 159 [ . ] 65 [ . ] 60 [ . ] 31.


At the time of writing this research , four versions of the EventBot malware were observed : Version 0 [ . ] 0 [ . ] 0 [ . ] 1 , 0[.]0[.]0[.]2 , and 0[.]3[.]0[.]1 and 0[.]4[.]0[.]1 . This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others . In December 2015 , Unit 42 published a blog about a cyber espionage attack using the Emissary Trojan as a payload .


In Version 0[.]0[.]0[.]1 , the communication with the C2 is encrypted using Base64 and RC4 . Development of Bemstour has continued into 2019 . One payload was a Python based open source remote administration tool ( RAT ) called Pupy .


Tenable detected a multi-stage attack chain. The initial phishing email from ceo@phishing-domain[.]com contained a link to hxxp://backupapi[ . ]net/secure/token. This redirected to hxxps://relay-gateway[.]link/collect on cdn-relay[ . ]net. A secondary email from it@account-update[ . ]xyz pointed to hxxp://relaysecure[ . ]club/assets/js/payload.js which delivered Amadey. The final payload callback was hxxp://cloudcloud[.]cc/panel/index.html resolving to 10[.]48[.]33[.]37 via static-backup[ . ]online.


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 192 [ . ] 100 [ . ] 201 [ . ] 206
- 36 [ . ] 220 [ . ] 185 [ . ] 215
- 172 [ . ] 234 [ . ] 97 [ . ] 112
- cachestatic[ . ]dev
- api-update[ . ]org
URLs:
- hxxps://static-cdn[ . ]top/assets/js/payload.js
- hxxp://update-cloud[.]io/download/update.exe
Email Senders:
- alert@account-update[ . ]xyz
- alert@auth-check[ . ]org
File Indicators:
- SHA1: 23dc382b600a69f4ef7bcb10b99a5ac3b6e8a490
- MD5: c3318098c6d5d76e6febb40abef2dc59
- Drop path: C:\ProgramData\shell.php


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from support@auth-check[.]org and info@identity-verify[ . ]cc, spoofing legitimate services. Victims were directed to hxxps://mailsync[ . ]tech/download/update.exe which hosted a credential harvesting page on backupupdate[ . ]org. A secondary link hxxps://sync-backup[ . ]info/panel/index.html delivered Hive (SHA1: 6be675b404f934eb4372c1c4b5c503471d73e6e8). The malware was saved to C:\Program Files\Common Files\dropper.ps1 and established C2 with 5 [ . ] 119 [ . ] 162 [ . ] 211.


**Dump Domain Registration Patterns:*From about 2015 to at least October 2018 possibly longer, IBM X-Force assesses that ITG08's POS malware used the same notable domain naming convention: all known dump domains used by FrameworkPOS and GratefulPOS contained the same base name -akamaitechnologies[ . ]com. In fact, all said domains are nearly identical looking to a legitimate Akamai content delivery network CDN domain, differing only by a single character replacing a .' with - .


We were able to collect a second delivery document that shared the Joohn author from the crash list ( Lion Air Boeing 737 )[.]docx document , as well as the 188[.]241[.]58[.]170 C2 IP to host its remote template .


FireEye published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2023-28217 in Windows Server 2019. The attackers deployed DarkSide via PowerShell Empire, establishing C2 communication with 172[.]252[.]34[.]154 and proxyauth[ . ]tech. A secondary payload was downloaded from hxxps://sync-secure[.]cc/download/update.exe. The malware binary (MD5: 95974a7bf27e08ea33589fdb737c315f) was dropped to C:\Windows\Tasks\payload.bin. Phishing emails were sent from it@account-update[.]xyz targeting enterprise users. A backup C2 server was identified at 149[.]246[.]223[.]223.


IOC Bulletin - WarmCookie Campaign:
Network Indicators:
- 10 [ . ] 10 [ . ] 87 [ . ] 218
- 140 [ . ] 224 [ . ] 90 [ . ] 134
- 102[.]239[.]109[.]101
- api-portal[.]xyz
- update-edge[ . ]info
URLs:
- hxxp://proxy-secure[.]club/download/update.exe
- hxxp://data-cloud[.]club/portal/verify
Email Senders:
- report@phishing-domain[.]com
- account@mail-service[ . ]info
File Indicators:
- MD5: 156af39be9b520c4c110258bbfab84c6
- SHA256: 6f2935cf8ab114370f34a59ea6a628c5afe4e5234d9627f368b5792b1bf83fa8
- Drop path: /dev/shm/agent.py


Blog Post by Cisco Talos: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-24110 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from service@phishing-domain[ . ]com delivering WarmCookie. Post-compromise, the attackers deploy XLoader and use Brute Ratel for reconnaissance. C2 infrastructure includes 91[.]53[.]140[.]72 and gatewaygateway[.]dev. A staging server at hxxp://static-gateway[ . ]link/assets/js/payload.js hosts additional tooling. Key artifact: C:\ProgramData\winlogon.exe (MD5: b47838070e7f78158b7f031cc072dcdf).


The “ core ” module contacts the C & C server , trying to get a fresh list of applications to search for , or if that fails , use a default app list : whatsapp lenovo.anyshare.gps mxtech.videoplayer.ad jio[.]jioplay[.]tv jio.media.jiobeats jiochat.jiochatapp jio.join good.gamecollection opera.mini.native startv.hotstar meitu.beautyplusme domobile.applock touchtype.swiftkey flipkart.android cn.xender It is worth noting that attackers used the same compromised websites to spread Buhtrap as those that had been used for the Corkow Trojan . In later stages , Dexphot targets a few other system processes for process hollowing : svchost[ . ]exe , tracert[.]exe , and setup[.]exe . Enterprise T1078 Valid Accounts APT29 has used a compromised account to access an organization 's VPN infrastructure .


TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for `tf.raw_ops.BoostedTreesCreateEnsemble` can result in a use after free error if an attacker supplies specially crafted arguments. The [implementation](hxxps://github[ . ]com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/boosted_trees/resource_ops.cc#L55) uses a reference counted resource and decrements the refcount if the initialization fails, as it should. However, when the code was written, the resource was represented as a naked pointer but later refactoring has changed it to be a smart pointer. Thus, when the pointer leaves the scope, a subsequent `free`-ing of the resource occurs, but this fails to take into account that the refcount has already reached 0, thus the resource has been already freed. During this double-free process, members of the resource object are accessed for cleanup but they are invalid as the entire resource has been freed. We have patched the issue in GitHub commit 5ecec9c6fbdbc6be03295685190a45e7eee726ab. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.


Fail2ban honeypot data from 2026-04-23 revealed 63 IP addresses conducting SSH brute-force attacks. Several IPs also probed for CVE-2024-6387, a critical OpenSSH vulnerability known as regreSSHion. Top attacking IPs included 218 [ . ] 92 [ . ] 0 [ . ] 107, 61 [ . ] 177 [ . ] 173 [ . ] 16, and 112[.]85[.]42[.]88. These IPs are associated with known botnet infrastructure originating from Chinese autonomous systems.


Artifact Analysis for Royal campaign:
Stage 1 dropper at /tmp/payload.bin - SHA256: b0cfa2721a8b6a7309101bd87646148d837b4d6d6a8de32a78889ded4d9841f1
Stage 2 loader at /var/tmp/agent.py - SHA1: 646c44f1b445e2676eb8121bee8b1240c81ddcf1
Final payload at /opt/app/bin/helper.sh - SHA1: c54686ffee846c752987e1eb34720ae0ab396eff
Exfiltration module - SHA256: f7326c08024d3709fd6f6f0bc959382c9ba86fea13d7e4e87b3f634a17e71d31
All stages communicated with 107[.]82[.]67[.]199. Chisel signatures detected in Stage 2.


In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race when deleting quota root from the dirty cow roots list

When disabling quotas we are deleting the quota root from the list
fs_info->dirty_cowonly_roots without taking the lock that protects it,
which is struct btrfs_fs_info::trans_lock. This unsynchronized list
manipulation may cause chaos if there's another concurrent manipulation
of this list, such as when adding a root to it with
ctree.c:add_root_to_dirty_list().

This can result in all sorts of weird failures caused by a race, such as
the following crash:

  [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI
  [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1
  [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1[ . ]14[ . ]0-0-g155821a1990b-prebuilt[ . ]qemu[ . ]org 04/01/2014
  [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]
  [337571.279928] Code: 85 38 06 00 (...)
  [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206
  [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000
  [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070
  [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b
  [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600
  [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48
  [337571.281723] FS:  00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000
  [337571.281950] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0
  [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  [337571.282874] Call Trace:
  [337571.283101]  <TASK>
  [337571.283327]  ? __die_body+0x1b/0x60
  [337571.283570]  ? die_addr+0x39/0x60
  [337571.283796]  ? exc_general_protection+0x22e/0x430
  [337571.284022]  ? asm_exc_general_protection+0x22/0x30
  [337571.284251]  ? commit_cowonly_roots+0x11f/0x250 [btrfs]
  [337571.284531]  btrfs_commit_transaction+0x42e/0xf90 [btrfs]
  [337571.284803]  ? _raw_spin_unlock+0x15/0x30
  [337571.285031]  ? release_extent_buffer+0x103/0x130 [btrfs]
  [337571.285305]  reset_balance_state+0x152/0x1b0 [btrfs]
  [337571.285578]  btrfs_balance+0xa50/0x11e0 [btrfs]
  [337571.285864]  ? __kmem_cache_alloc_node+0x14a/0x410
  [337571.286086]  btrfs_ioctl+0x249a/0x3320 [btrfs]
  [337571.286358]  ? mod_objcg_state+0xd2/0x360
  [337571.286577]  ? refill_obj_stock+0xb0/0x160
  [337571.286798]  ? seq_release+0x25/0x30
  [337571.287016]  ? __rseq_handle_notify_resume+0x3ba/0x4b0
  [337571.287235]  ? percpu_counter_add_batch+0x2e/0xa0
  [337571.287455]  ? __x64_sys_ioctl+0x88/0xc0
  [337571.287675]  __x64_sys_ioctl+0x88/0xc0
  [337571.287901]  do_syscall_64+0x38/0x90
  [337571.288126]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
  [337571.288352] RIP: 0033:0x7f478aaffe9b

So fix this by locking struct btrfs_fs_info::trans_lock before deleting
the quota root from that list.


A backdoor also known as: W32/Autorun.Worm.aaeh Win32.Trojan.WisdomEyes.16070401.9500.9867 TSPY_TEPFER.GB Trojan.Win32.VBTrojan.bvufrt TrojWare[ . ]Win32[ . ]VB[ . ]HR Trojan.DownLoader10.21377 TSPY_TEPFER.GB BehavesLike[.]Win32[.]Swisyn[.]cc Trojan:Win32/Beelog.C Trojan.Win32.Jorik.28672.A Trojan/Win32.Jorik.R44838 Trj/CI.A Win32/Trojan.Downloader.f2c


Malware Analysis Report: Emotet (SHA256: 052dcb920be5a1866a31792ad66276ac21edde89b39c16608902259658f7d822). Upon execution on MOVEit Transfer, the sample creates /var/tmp/implant.so and injects into legitimate processes. Network analysis shows beaconing to 192[.]59[.]148[.]2 every 60 seconds and DNS queries to storage-secure[ . ]site. The second stage was fetched from hxxp://mail-portal[.]com/download/update.exe and written to /usr/local/bin/ntds.dit. The payload uses PowerView-style techniques for defense evasion. A secondary hash (MD5: 5c47bfb1f42b0df00fa93e5f9760b569) was extracted from the unpacked payload.


Some example file names using this technique include : AntiVirus_update_package[.]7z , acquisition[.]7z , offer[.]7z , update_flashplayer10ax[.]7z .


Malware Analysis Report: Dridex (SHA1: 639784c521af2928bd2e87879e2e558738cbb2bb). Upon execution on Citrix NetScaler, the sample creates C:\Program Files\Common Files\implant.so and injects into legitimate processes. Network analysis shows beaconing to 10 [ . ] 18 [ . ] 240 [ . ] 123 every 60 seconds and DNS queries to auth-data[.]com. The second stage was fetched from hxxps://secureapi[.]link/wp-content/uploads/doc.php and written to /etc/cron.d/sam.hive. The payload uses LinPEAS-style techniques for defense evasion. A secondary hash (MD5: 22828dfd50fe6b019abc606ed78cdd39) was extracted from the unpacked payload.


In the Linux kernel, the following vulnerability has been resolved:

rtl818x: Prevent using not initialized queues

Using not existing queues can panic the kernel with rtl8180/rtl8185 cards.
Ignore the skb priority for those cards, they only have one tx queue. Pierre
Asselin (pa@panix[.]com) reported the kernel crash in the Gentoo forum:

hxxps://forums[.]gentoo[.]org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html

He also confirmed that this patch fixes the issue. In summary this happened:

After updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a
"divide error: 0000" when connecting to an AP. Control port tx now tries to
use IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in
2.10.

Since only the rtl8187se part of the driver supports QoS, the priority
of the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185
cards.

rtl8180 is then unconditionally reading out the priority and finally crashes on
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this
patch:
	idx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries

"ring->entries" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got
initialized.


Malware Analysis Report: PlugX (SHA1: 04e53ab7e9c48038c583633c9265f0b8e8ee092a). Upon execution on F5 BIG-IP, the sample creates C:\Windows\Temp\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 192 [ . ] 227 [ . ] 160 [ . ] 28 every 60 seconds and DNS queries to relaysync[ . ]xyz. The second stage was fetched from hxxp://backupsecure[ . ]cc/secure/token and written to C:\Users\admin\AppData\Local\Temp\winlogon.exe. The payload uses Certutil-style techniques for defense evasion. A secondary hash (MD5: e8e6c237398482121103362166ec3c54) was extracted from the unpacked payload.


Blog Post by Proofpoint: Tracking Kimsuky's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-26043 against Active Directory deployments. The initial access vector involves spear-phishing emails from updates@account-update[ . ]xyz delivering FormBook. Post-compromise, the attackers deploy BatLoader and use Nmap for reconnaissance. C2 infrastructure includes 152 [ . ] 214 [ . ] 144 [ . ] 94 and sync-backup[.]net. A staging server at hxxps://secure-node[.]dev/api/v2/auth hosts additional tooling. Key artifact: /usr/local/bin/backdoor.elf (SHA256: 4297e10d3eb510192ad6cbd31213d4dcde9d0d0578ae29c7441598ee6c470991).


Phishing Campaign Report: Microsoft MSRC identified a large-scale phishing operation. Emails originated from confirm@phishing-domain[.]com and it@document-share[ . ]link, spoofing legitimate services. Victims were directed to hxxps://auth-login[ . ]live/portal/verify which hosted a credential harvesting page on storagestatic[ . ]cc. A secondary link hxxp://secure-cache[ . ]com/secure/token delivered Meduza Stealer (SHA256: 66a282c45e27ce9328111ae8c1fcee81ca2c7cd7ca5b3c54dea94ade436a63d3). The malware was saved to C:\Users\Public\Documents\payload.bin and established C2 with 172[.]205[.]101[.]20.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at C:\Users\admin\AppData\Local\Temp\loader.exe. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via /dev/shm/beacon.dll. Network forensics identified connections to 176[.]146[.]122[.]241 and cloudrelay[ . ]club. Email headers traced the initial vector to hr@phishing-domain[ . ]com. File /usr/local/bin/beacon.dll (MD5: b653caa707f8cd58a24fab7fa59a0735) was identified as the initial dropper. A staging URL hxxp://proxy-portal[.]online/panel/index.html resolved to 215 [ . ] 171 [ . ] 70 [ . ] 151. Secondary artifact hash: SHA1: b08a1ea2f3b2d40d6d2126041f168b7606ab3762.


TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToVariant`. The [implementation](hxxps://github[.]com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L129) has an incomplete validation of the splits values, missing the case when the argument would be empty. We have patched the issue in GitHub commit be7a4de6adfbd303ce08be4332554dff70362612. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.