While they still use RAR SFX format for the initial payloads , ZeroT now uses a the legitimate McAfee utility ( SHA256 3124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe ) named mcut[.]exe instead of the Norman Safeground AS for sideloading as they have in the past .


CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering . However , Kaspersky Security Network (KSN) records also contain links that victims clicked from the Outlook web client outlook[ . ]live[ . ]com” as well as attachments arriving through the Outlook desktop application .


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at /usr/local/bin/loader.exe. Memory dump analysis confirmed execution of Mimikatz. Registry modifications pointed to persistence via /home/user/.config/agent.py. Network forensics identified connections to 105 [ . ] 60 [ . ] 35 [ . ] 252 and data-cdn[.]link. Email headers traced the initial vector to contact@auth-check[.]org. File /dev/shm/implant.so (SHA256: 0e5e9d9bcd63d9d4d87a3ae4af3f60e27728aae3c479f49f9234779f6a93fad9) was identified as the initial dropper. A staging URL hxxps://nodeupdate[.]live/wp-content/uploads/doc.php resolved to 105[.]205[.]69[.]181. Secondary artifact hash: MD5: c31d5928c73089c7bb35e241f3d7afe1.


Vulnerability Advisory: CVE-2025-49086 is a critical race condition affecting Apache Struts. Trend Micro confirmed active exploitation by Storm-0558 in the wild. Exploitation delivers Hive (MD5: 5995e7914920a0d6afd0bc6850bc7517) which is dropped to C:\Users\admin\Desktop\csrss.exe. The exploit payload is hosted at hxxps://cacherelay[.]dev/api/v2/auth and communicates to 128 [ . ] 205 [ . ] 152 [ . ] 147 for C2.


A backdoor also known as: Troj.W32.Buzus.kZ4S BKDR_PHDET.SMI Win32.Trojan.WisdomEyes.16070401.9500.9959 BKDR_PHDET.SMI Trojan[ . ]Win32[ . ]A[ . ]Downloader[ . ]34304[ . ]CO BackDoor.Dax BehavesLike.Win32.FDoSBEnergy.nt W32.Trojan.Trojan-downloader.Ge Backdoor:Win32/Phdet.B


From early 2014 until December 2018 , ns0.idm.net.lb pointed to 194[.]126[.]10[.]18 , which appropriately enough is an Internet address based in Lebanon .


Definition of populateConfigMap , which loads the map with values Correlating the last two steps , one can observe that the malware payload receives the configuration for the following properties : number – The default number to be send to the server ( in case the number is not available from the device ) api – The API key url – The URL to be used in WebView to display on the ransom note The malware saves this configuration to the shared preferences of the app data and then it sets up all the Broadcast Receivers . There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group . WinZip version 11.2 and 24.0, and the built-in unzIP S-TOOL tool in Windows , recognized that the attachment SHIPPING_MX00034900_PL_INV_pdf[ . ]zip is an invalid . The threat actor first detected towards the end of last year when it attacked at least 87 organizations around the world in two months ' time .


Vulnerability Advisory: CVE-2021-34898 is a critical deserialization flaw affecting Ubuntu 22.04. INTERPOL confirmed active exploitation by OilRig in the wild. Exploitation delivers IcedID (SHA1: 5784d45f69a6909b1226dd4ff004916d811ace43) which is dropped to C:\Windows\Tasks\update.dll. The exploit payload is hosted at hxxps://login-static[ . ]online/panel/index.html and communicates to 36 [ . ] 223 [ . ] 136 [ . ] 46 for C2.


Vulnerability Advisory: CVE-2020-15697 is a critical deserialization flaw affecting Atlassian Confluence. Mandiant confirmed active exploitation by OilRig in the wild. Exploitation delivers XLoader (MD5: 15bbda24e4f35d8380cbda63998a30e5) which is dropped to C:\Users\admin\Downloads\sam.hive. The exploit payload is hosted at hxxp://proxy-cloud[ . ]com/portal/verify and communicates to 172[.]125[.]180[.]81 for C2.


IOC Bulletin - PikaBot Campaign:
Network Indicators:
- 172[.]32[.]117[.]91
- 173 [ . ] 226 [ . ] 163 [ . ] 225
- 10[.]36[.]82[.]113
- cachegateway[ . ]xyz
- cloudapi[.]net
URLs:
- hxxps://data-auth[.]dev/panel/index.html
- hxxp://securedata[.]com/assets/js/payload.js
Email Senders:
- ceo@document-share[.]link
- hr@phishing-domain[ . ]com
File Indicators:
- MD5: 7689dbff6ea326d45b4274538f6aa027
- SHA1: 9a6fd1b12dce59812cc6359974b847ca60068dfc
- Drop path: C:\Windows\Temp\helper.sh


Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Web Server). Supported versions that are affected are 5[.]5[.]0[.]0.0, 11 [ . ] 1 [ . ] 1 [ . ] 9.0, 12 [ . ] 2 [ . ] 1 [ . ] 3.0 and 12[.]2[.]1[.]4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).


Vulnerability Advisory: CVE-2022-14558 is a critical cross-site scripting affecting Fortinet FortiGate. Huntress confirmed active exploitation by Kimsuky in the wild. Exploitation delivers Qbot (SHA1: 757465a40f1e173f565f97b98608229218862958) which is dropped to /dev/shm/ntds.dit. The exploit payload is hosted at hxxp://nodeedge[ . ]org/collect and communicates to 172 [ . ] 174 [ . ] 182 [ . ] 14 for C2.


Forensic Investigation Notes: Analysis of the compromised host revealed Metasploit artifacts at /tmp/agent.py. Memory dump analysis confirmed execution of Chisel. Registry modifications pointed to persistence via /var/tmp/ntds.dit. Network forensics identified connections to 205 [ . ] 89 [ . ] 72 [ . ] 186 and databackup[ . ]live. Email headers traced the initial vector to billing@auth-check[.]org. File /dev/shm/beacon.dll (SHA256: 59dbbb67daba322fb1ea439f819be2a6fa600b7fbd413315eb79b740525aab40) was identified as the initial dropper. A staging URL hxxps://relayauth[.]com/api/v2/auth resolved to 192 [ . ] 136 [ . ] 27 [ . ] 125. Secondary artifact hash: MD5: f435621b2eb843ae45737f81868806a1.


Malware Analysis Report: TrickBot (SHA1: ba625661ea87ee5c4f15c2ed8bb29001a323fafe). Upon execution on Fortinet FortiGate, the sample creates /etc/cron.d/helper.sh and injects into legitimate processes. Network analysis shows beaconing to 73 [ . ] 198 [ . ] 230 [ . ] 234 every 60 seconds and DNS queries to proxy-static[ . ]info. The second stage was fetched from hxxp://relayproxy[ . ]dev/gate.php and written to C:\Windows\System32\agent.py. The payload uses Sharphound-style techniques for defense evasion. A secondary hash (MD5: 85a8eab5038058e64f2007b85e753a44) was extracted from the unpacked payload.


Vulnerability Advisory: CVE-2025-27219 is a critical authentication bypass affecting Microsoft Exchange. SentinelOne confirmed active exploitation by Midnight Blizzard in the wild. Exploitation delivers DanaBot (SHA1: 8a9c3162c0893621ea1c6dc148cd1356a9a1b53c) which is dropped to C:\Users\admin\AppData\Local\Temp\svchost.exe. The exploit payload is hosted at hxxps://portalportal[ . ]club/admin/config and communicates to 192 [ . ] 137 [ . ] 15 [ . ] 170 for C2.


Moreover , we retrieved his University ID ; a quick googling showed some of his exam grades . The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits , including the EternalBlue exploit used in the WannaCry attack from May 2017 . jams481[.]site[.]bz .


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from admin@credential-check[.]site and noreply@credential-check[ . ]site, spoofing legitimate services. Victims were directed to hxxp://data-relay[ . ]net/api/v2/auth which hosted a credential harvesting page on loginlogin[.]dev. A secondary link hxxps://updateedge[ . ]club/collect delivered Hive (SHA1: a98a1432984b12d124a1cba9a828099114e2e95f). The malware was saved to C:\Users\admin\Desktop\backdoor.elf and established C2 with 126[.]61[.]101[.]125.


Vulnerability Advisory: CVE-2024-23826 is a critical integer overflow affecting Apache Struts. Dragos confirmed active exploitation by Kimsuky in the wild. Exploitation delivers Cobalt Strike (SHA1: 30181c4b5819692cfe8d4538d90a597897e1a1b7) which is dropped to C:\Users\admin\AppData\Local\Temp\taskhost.exe. The exploit payload is hosted at hxxp://login-sync[ . ]online/login and communicates to 10[.]128[.]245[.]216 for C2.


* Dec 22 - [[Group-IB] Anunak: APT against financial institutions](hxxp://www[ . ]group-ib[ . ]com/files/Anunak_APT_against_financial_institutions.pdf) | :closed_book:
* Dec 21 - [[ThreatConnect] Operation Poisoned Helmand](hxxp://www[ . ]threatconnect[ . ]com/news/operation-poisoned-helmand/) | :closed_book:
* Dec 19 - [[US-CERT] TA14-353A: Targeted Destructive Malware (wiper)](hxxps://www[ . ]us-cert[ . ]gov/ncas/alerts/TA14-353A) | :closed_book:
* Dec 18 - [[Citizen Lab] Malware Attack Targeting Syrian ISIS Critics](hxxps://citizenlab[ . ]org/2014/12/malware-attack-targeting-syrian-isis-critics/) | :closed_book:
* Dec 17 - [[CISCO] Wiper Malware – A Detection Deep Dive](hxxp://blogs[ . ]cisco[ . ]com/security/talos/wiper-malware) | :closed_book:
* Dec 12 - [[Fidelis] Bots, Machines, and the Matrix](hxxp://www[.]fidelissecurity[.]com/sites/default/files/FTA_1014_Bots_Machines_and_the_Matrix.pdf) | :closed_book:
* Dec 12 - [[AirBus] Vinself now with steganography](hxxp://blog[ . ]cybersecurity-airbusds[ . ]com/post/2014/12/Vinself) | :closed_book:
* Dec 10 - [[Ahnlab] South Korea MBR Wiper](hxxp://asec[ . ]ahnlab[ . ]com/1015) | :closed_book:
* Dec 10 - [[F-Secure] W64/Regin, Stage #1](hxxps://www[.]f-secure[.]com/documents/996508/1030745/w64_regin_stage_1.pdf) | :closed_book:
* Dec 10 - [[F-Secure] W32/Regin, Stage #1](hxxps://www[.]f-secure[.]com/documents/996508/1030745/w32_regin_stage_1.pdf) | :closed_book:
* Dec 10 - [[Kaspersky] Cloud Atlas: RedOctober APT](hxxp://securelist[.]com/blog/research/68083/cloud-atlas-redoctober-apt-is-back-in-style/) | :closed_book:
* Dec 09 - [[BlueCoat] The Inception Framework](hxxps://www[ . ]bluecoat[ . ]com/security-blog/2014-12-09/blue-coat-exposes-%E2%80%9C-inception-framework%E2%80%9D-very-sophisticated-layered-malware) | :closed_book:
* Dec 08 - [[Kaspersky] The 'Penquin' Turla](hxxp://securelist[.]com/blog/research/67962/the-penquin-turla-2/) | :closed_book:
* Dec 05 - [[Cylance] Operation Cleaver: The Notepad Files](hxxp://blog[.]cylance[.]com/operation-cleaver-the-notepad-files) | :closed_book:
* Dec 02 - [[Cylance] Operation Cleaver](hxxp://cdn2[.]hubspot[.]net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf) | IOCs  | [:closed_book:](../../blob/ma


In the Linux kernel, the following vulnerability has been resolved:

cgroup: split cgroup_destroy_wq into 3 workqueues

A hung task can occur during [1] LTP cgroup testing when repeatedly
mounting/unmounting perf_event and net_prio controllers with
systemd.unified_cgroup_hierarchy=1. The hang manifests in
cgroup_lock_and_drain_offline() during root destruction.

Related case:
cgroup_fj_function_perf_event cgroup_fj_function.sh perf_event
cgroup_fj_function_net_prio cgroup_fj_function.sh net_prio

Call Trace:
	cgroup_lock_and_drain_offline+0x14c/0x1e8
	cgroup_destroy_root+0x3c/0x2c0
	css_free_rwork_fn+0x248/0x338
	process_one_work+0x16c/0x3b8
	worker_thread+0x22c/0x3b0
	kthread+0xec/0x100
	ret_from_fork+0x10/0x20

Root Cause:

CPU0                            CPU1
mount perf_event                umount net_prio
cgroup1_get_tree                cgroup_kill_sb
rebind_subsystems               // root destruction enqueues
				// cgroup_destroy_wq
// kill all perf_event css
                                // one perf_event css A is dying
                                // css A offline enqueues cgroup_destroy_wq
                                // root destruction will be executed first
                                css_free_rwork_fn
                                cgroup_destroy_root
                                cgroup_lock_and_drain_offline
                                // some perf descendants are dying
                                // cgroup_destroy_wq max_active = 1
                                // waiting for css A to die

Problem scenario:
1. CPU0 mounts perf_event (rebind_subsystems)
2. CPU1 unmounts net_prio (cgroup_kill_sb), queuing root destruction work
3. A dying perf_event CSS gets queued for offline after root destruction
4. Root destruction waits for offline completion, but offline work is
   blocked behind root destruction in cgroup_destroy_wq (max_active=1)

Solution:
Split cgroup_destroy_wq into three dedicated workqueues:
cgroup_offline_wq – Handles CSS offline operations
cgroup_release_wq – Manages resource release
cgroup_free_wq – Performs final memory deallocation

This separation eliminates blocking in the CSS free path while waiting for
offline operations to complete.

[1] hxxps://github[ . ]com/linux-test-project/ltp/blob/master/runtest/controllers


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 192 [ . ] 103 [ . ] 109 [ . ] 124
- 192[.]241[.]183[.]221
- 169 [ . ] 251 [ . ] 63 [ . ] 169
- cdn-login[.]site
- portalsync[.]top
URLs:
- hxxp://authapi[ . ]tech/assets/js/payload.js
- hxxps://node-relay[.]com/api/v2/auth
Email Senders:
- admin@credential-check[ . ]site
- notification@secure-verify[.]net
File Indicators:
- MD5: eefc702db8e948bce4d4e3014752f0d3
- SHA1: 3fb7e472b58fe46ee3ed0a995261d00d65e7628a
- Drop path: C:\Users\Public\Documents\ntds.dit


Phishing Campaign Report: Qualys identified a large-scale phishing operation. Emails originated from confirm@credential-check[ . ]site and support@auth-check[ . ]org, spoofing legitimate services. Victims were directed to hxxps://apiportal[.]io/callback which hosted a credential harvesting page on relaycache[ . ]cc. A secondary link hxxps://cloud-sync[.]cc/callback delivered WarmCookie (MD5: ec8c039bc0befc1dc510b83101b923fe). The malware was saved to C:\Users\admin\Desktop\svchost.exe and established C2 with 132[.]219[.]227[.]160.


The blog post said HummingBad " uses a completely different infrastructure with little in common '' with Shedun . simultaneous use of the detected Win32/KillDisk.NBO variants . APT33 : 5 [ . ] 187 [ . ] 21 [ . ] 71 backupnet[ . ]ddns[ . ]net . In some instances , two randomly generated bytes are added to the end of the file , which invalidates the detection of the dropped files using simple checksum - based techniques .


Malware Analysis Report: Latrodectus (SHA1: 23c260a7e848094cdb5a4740aa502bba349d6152). Upon execution on Barracuda ESG, the sample creates C:\Windows\Temp\runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 116[.]80[.]110[.]245 every 60 seconds and DNS queries to gatewaysecure[ . ]cc. The second stage was fetched from hxxp://syncstorage[.]info/assets/js/payload.js and written to C:\Users\admin\Desktop\agent.py. The payload uses Ligolo-style techniques for defense evasion. A secondary hash (SHA1: b3af32d6ed30aaf46881333cf7c5f4557f5308c1) was extracted from the unpacked payload.


In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Return CQE error if invalid lkey was supplied

RXE is missing update of WQE status in LOCAL_WRITE failures.  This caused
the following kernel panic if someone sent an atomic operation with an
explicitly wrong lkey.

[leonro@vm ~]$ mkt test
test_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ...
 WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe]
 Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core
 CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1[.]13[.]0-0-gf21b5a4aeb02-prebuilt[.]qemu[.]org 04/01/2014
 RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe]
 Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff
 RSP: 0018:ffff8880158af090 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652
 RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210
 RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b
 R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8
 R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c
 FS:  00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 Call Trace:
  rxe_do_task+0x130/0x230 [rdma_rxe]
  rxe_rcv+0xb11/0x1df0 [rdma_rxe]
  rxe_loopback+0x157/0x1e0 [rdma_rxe]
  rxe_responder+0x5532/0x7620 [rdma_rxe]
  rxe_do_task+0x130/0x230 [rdma_rxe]
  rxe_rcv+0x9c8/0x1df0 [rdma_rxe]
  rxe_loopback+0x157/0x1e0 [rdma_rxe]
  rxe_requester+0x1efd/0x58c0 [rdma_rxe]
  rxe_do_task+0x130/0x230 [rdma_rxe]
  rxe_post_send+0x998/0x1860 [rdma_rxe]
  ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs]
  ib_uverbs_write+0x847/0xc80 [ib_uverbs]
  vfs_write+0x1c5/0x840
  ksys_write+0x176/0x1d0
  do_syscall_64+0x3f/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xae


On Android , an Intent is a software mechanism that allows users to coordinate the functions of different Activities to achieve a task . This attack used the crisis in Syria as a lure to deliver malware to its targets . Suspicious attachment name: The name of attachment SHIPPING_MX00034900_PL_INV_pdf[.]zip ends with pdf[.]zip . The group appears to commonly deploy double extortion of the victims that have been listed on the leak site , several of them have had some portion of their exfiltrated data exposed .


In the Linux kernel, the following vulnerability has been resolved:

regulator: core: Use different devices for resource allocation and DT lookup

Following by the below discussion, there's the potential UAF issue
between regulator and mfd.
hxxps://lore[ . ]kernel[ . ]org/all/20221128143601.1698148-1-yangyingliang@huawei.com/

From the analysis of Yingliang

CPU A				|CPU B
mt6370_probe()			|
  devm_mfd_add_devices()	|
				|mt6370_regulator_probe()
				|  regulator_register()
				|    //allocate init_data and add it to devres
				|    regulator_of_get_init_data()
i2c_unregister_device()		|
  device_del()			|
    devres_release_all()	|
      // init_data is freed	|
      release_nodes()		|
				|  // using init_data causes UAF
				|  regulator_register()

It's common to use mfd core to create child device for the regulator.
In order to do the DT lookup for init data, the child that registered
the regulator would pass its parent as the parameter. And this causes
init data resource allocated to its parent, not itself. The issue happen
when parent device is going to release and regulator core is still doing
some operation of init data constraint for the regulator of child device.

To fix it, this patch expand 'regulator_register' API to use the
different devices for init data allocation and DT lookup.


TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a division by zero error in LSH [implementation](hxxps://github[.]com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/lsh_projection.cc#L118). We have patched the issue in GitHub commit 0575b640091680cfb70f4dd93e70658de43b94f9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick thiscommit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.


IOC Bulletin - BatLoader Campaign:
Network Indicators:
- 190[.]101[.]43[.]147
- 58[.]29[.]177[.]42
- 161 [ . ] 26 [ . ] 133 [ . ] 182
- portal-cache[.]dev
- secure-mail[.]live
URLs:
- hxxp://gateway-sync[ . ]org/login
- hxxp://login-proxy[.]info/collect
Email Senders:
- admin@secure-verify[ . ]net
- verify@identity-verify[.]cc
File Indicators:
- SHA1: 74806f38495308385f63bda18588e6bf028a278e
- SHA1: 775c91a65ca47896e2c25c41b2732bcd3cf6022c
- Drop path: /tmp/taskhost.exe


The most common way to achieve this is by creating a broadcast receiver that is registered to the “ android.intent.action.BOOT_COMPLETED ” broadcast action and adding code that boots the application when the broadcast is fired . Once in possession of compromised payment card credentials , these actors use tools commonly known as card generators to generate new card numbers based on the compromised ones , creating additional opportunities for monetization . The June 2017 sample of Clayslide contained the same OfficeServicesStatus[ . ]vbs file found in the ISMAgent Clayslide document , but instead of having the payload embedded in the macro as segregated base64 strings that would be concatenated , this variant obtained its payload from multiple cells within the " Incompatible " worksheet .


Artifact Analysis for DarkSide campaign:
Stage 1 dropper at /tmp/agent.py - MD5: f0f77ea05d2a1f62324f3887124b3da2
Stage 2 loader at /etc/cron.d/shell.php - SHA256: bc652e95557574acb820d000c13f163fe2d31e3f599f29dcc88035ac59e06df3
Final payload at /etc/cron.d/dropper.ps1 - SHA256: cad0ed1f0267d5090a29b1d1a8e4a0bbdd64618c5165113038fe2bfc893d5a12
Exfiltration module - SHA256: 301d396ee37111ccad8d5b5c79ef76603c403e17bd29a0737828ac04af75386c
All stages communicated with 102[.]179[.]203[.]41. Sharphound signatures detected in Stage 2.


CISA published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2020-15697 in Atlassian Confluence. The attackers deployed Qbot via Chisel, establishing C2 communication with 10[.]28[.]136[.]199 and portalupdate[ . ]net. A secondary payload was downloaded from hxxps://portal-relay[.]xyz/wp-content/uploads/doc.php. The malware binary (MD5: be1a85f332c58d19463bb6b892fb4088) was dropped to C:\Users\Public\Documents\loader.exe. Phishing emails were sent from billing@credential-check[.]site targeting enterprise users. A backup C2 server was identified at 19[.]240[.]92[.]50.


] top/ Oct 17 , 2017 hxxp : //online[ . ]bankaustria[ . ]at.id58729 [ . In addition to the MitM server IP addresses published in previous reports , Talos identified 16 additional servers leveraged by the actor during the observed attacks . APT28 : SNAKEMACKEREL , Swallowtail , Group 74 , Sednit , Sofacy , Pawn Storm , Fancy Bear , STRONTIUM , Tsar Team , Threat Group-4127 , TG-4127 .


Incident Response Summary: On detection of anomalous traffic to 172 [ . ] 8 [ . ] 254 [ . ] 187, the NCSC IR team identified SystemBC running as /home/user/.config/winlogon.exe. The threat actor, believed to be Ember Bear, used Burp Suite for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to portal-data[ . ]online and proxycache[.]net. The initial dropper (SHA256: df7070f3461f6799941c50ab4a721fe0c840202fc59d3ed525100a9ec3e57de1) was delivered via a phishing email from security@login-portal[ . ]tech. A second C2 node was observed at 96[.]55[.]231[.]58, with a persistence mechanism writing to C:\Windows\System32\chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 192[.]148[.]215[.]55, the Kaspersky GReAT IR team identified Ryuk running as /etc/cron.d/helper.sh. The threat actor, believed to be UNC2452, used Brute Ratel for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to authmail[.]link and gatewayportal[.]com. The initial dropper (SHA1: 5f337b3ba854942d50d056f701abfa4e6cbc76fb) was delivered via a phishing email from finance@identity-verify[.]cc. A second C2 node was observed at 172 [ . ] 195 [ . ] 58 [ . ] 51, with a persistence mechanism writing to /home/user/.config/backdoor.elf.


In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads

This patch fixes slab-out-of-bounds reads in brcmfmac that occur in
brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count
value of channel specifications provided by the device is greater than
the length of 'list->element[]', decided by the size of the 'list'
allocated with kzalloc(). The patch adds checks that make the functions
free the buffer and return -EINVAL if that is the case. Note that the
negative return is handled by the caller, brcmf_setup_wiphybands() or
brcmf_cfg80211_attach().

Found by a modified version of syzkaller.

Crash Report from brcmf_construct_chaninfo():
==================================================================
BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430
Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896

CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G        W  O      5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1[ . ]12[ . ]1-0-ga5cab58e9a3f-prebuilt[ . ]qemu[ . ]org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
 dump_stack_lvl+0x57/0x7d
 print_address_description.constprop.0.cold+0x93/0x334
 kasan_report.cold+0x83/0xdf
 brcmf_setup_wiphybands+0x1238/0x1430
 brcmf_cfg80211_attach+0x2118/0x3fd0
 brcmf_attach+0x389/0xd40
 brcmf_usb_probe+0x12de/0x1690
 usb_probe_interface+0x25f/0x710
 really_probe+0x1be/0xa90
 __driver_probe_device+0x2ab/0x460
 driver_probe_device+0x49/0x120
 __device_attach_driver+0x18a/0x250
 bus_for_each_drv+0x123/0x1a0
 __device_attach+0x207/0x330
 bus_probe_device+0x1a2/0x260
 device_add+0xa61/0x1ce0
 usb_set_configuration+0x984/0x1770
 usb_generic_driver_probe+0x69/0x90
 usb_probe_device+0x9c/0x220
 really_probe+0x1be/0xa90
 __driver_probe_device+0x2ab/0x460
 driver_probe_device+0x49/0x120
 __device_attach_driver+0x18a/0x250
 bus_for_each_drv+0x123/0x1a0
 __device_attach+0x207/0x330
 bus_probe_device+0x1a2/0x260
 device_add+0xa61/0x1ce0
 usb_new_device.cold+0x463/0xf66
 hub_event+0x10d5/0x3330
 process_one_work+0x873/0x13e0
 worker_thread+0x8b/0xd10
 kthread+0x379/0x450
 ret_from_fork+0x1f/0x30

Allocated by task 1896:
 kasan_save_stack+0x1b/0x40
 __kasan_kmalloc+0x7c/0x90
 kmem_cache_alloc_trace+0x19e/0x330
 brcmf_setup_wiphybands+0x290/0x1430
 brcmf_cfg80211_attach+0x2118/0x3fd0
 brcmf_attach+0x389/0xd40
 brcmf_usb_probe+0x12de/0x1690
 usb_probe_interface+0x25f/0x710
 really_probe+0x1be/0xa90
 __driver_probe_device+0x2ab/0x460
 driver_probe_device+0x49/0x120
 __device_attach_driver+0x18a/0x250
 bus_for_each_drv+0x123/0x1a0
 __device_attach+0x207/0x330
 bus_probe_device+0x1a2/0x260
 device_add+0xa61/0x1ce0
 usb_set_configuration+0x984/0x1770
 usb_generic_driver_probe+0x69/0x90
 usb_probe_device+0x9c/0x220
 really_probe+0x1be/0xa90
 __driver_probe_device+0x2ab/0x460
 driver_probe_device+0x49/0x120
 __device_attach_driver+0x18a/0x250
 bus_for_each_drv+0x123/0x1a0
 __device_attach+0x207/0x330
 bus_probe_device+0x1a2/0x260
 device_add+0xa61/0x1ce0
 usb_new_device.cold+0x463/0xf66
 hub_event+0x10d5/0x3330
 process_one_work+0x873/0x13e0
 worker_thread+0x8b/0xd10
 kthread+0x379/0x450
 ret_from_fork+0x1f/0x30

The buggy address belongs to the object at ffff888115f24000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1536 bytes inside of
 2048-byte region [ffff888115f24000, ffff888115f24800)

Memory state around the buggy address:
 ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crash Report from brcmf_enable_bw40_2g():
==========
---truncated---


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from support@account-update[.]xyz and security@urgent-notice[.]online, spoofing legitimate services. Victims were directed to hxxp://gatewayportal[ . ]tech/gate.php which hosted a credential harvesting page on static-data[ . ]com. A secondary link hxxp://securecloud[.]xyz/panel/index.html delivered BlackCat (SHA256: d4e94b5bb47ac248ee00c635a052cdf8471ecc1f12918a4cc9baa32a0e3ea780). The malware was saved to /opt/app/bin/lsass.dmp and established C2 with 10[.]104[.]5[.]59.


Incident Response Summary: On detection of anomalous traffic to 10[.]226[.]184[.]135, the Secureworks IR team identified Raccoon Stealer running as /usr/local/bin/beacon.dll. The threat actor, believed to be BlackTech, used Rubeus for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to syncnode[.]dev and static-sync[.]com. The initial dropper (SHA1: 8cbf60f27f705c029084d8b3a47798af9a1e3ea3) was delivered via a phishing email from hr@mail-service[ . ]info. A second C2 node was observed at 10 [ . ] 158 [ . ] 168 [ . ] 25, with a persistence mechanism writing to C:\Users\admin\Desktop\update.dll.


android.media.RINGER_MODE_CHANGED android.sms.msg.action.SMS_SEND android.sms.msg.action.SMS_DELIVERED Creating a Web Server to Phish XLoader creates a provisional web server to receive the broadcast events . From the attack activity captured this time , it is obvious that Donot APT group is still keen on Pakistan as primary target of attack , and even expands scope of attack to include Pakistani staffs and institutions in China . The script is quite different from the previous one : it guarantees its persistence on the victim machine through the setting of “ HKCU\Software\Microsoft\Windows\CurrentVersion\Run ” registry key , creating a new entry named “ Windows Anytime Upgrade ” which points to “ winserv[ . ]exe ” , just stored into the same folder .


Malware Analysis Report: ShadowPad (SHA256: 7304c425d49a8e5e315daa4d88d2974f92112722312a3522a9fb38d862025223). Upon execution on Fortinet FortiGate, the sample creates /usr/local/bin/dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 154 [ . ] 138 [ . ] 252 [ . ] 162 every 60 seconds and DNS queries to storage-node[.]online. The second stage was fetched from hxxp://backupsync[.]live/secure/token and written to /home/user/.config/sam.hive. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (MD5: fccefff77d0b9b5868617ca508e5e143) was extracted from the unpacked payload.


Qualys published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2023-39714 in Microsoft Exchange. The attackers deployed XLoader via LinPEAS, establishing C2 communication with 112 [ . ] 113 [ . ] 76 [ . ] 234 and nodecdn[.]site. A secondary payload was downloaded from hxxp://proxyauth[.]online/wp-content/uploads/doc.php. The malware binary (SHA256: ff1c5da8010ed28cff28c306aef9983ad9d4349ef391d47cb05d5140387e024e) was dropped to C:\Windows\Temp\ntds.dit. Phishing emails were sent from billing@account-update[ . ]xyz targeting enterprise users. A backup C2 server was identified at 172[.]22[.]20[.]254.


A backdoor also known as: Backdoor.Win32.Noobot!O Backdoor.Poftsyun Backdoor.W32.Noobot.h!c Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Ecltys Backdoor.Win32.Noobot.h Trojan.Win32.Noobot.ylgzy Backdoor.Win32.A.Noobot.158756 Backdoor.Noobot.Win32.6 BehavesLike[ . ]Win32[ . ]Downloader[ . ]ch Backdoor.Win32.Ecltys W32/Trojan.SKHW-8707 Backdoor/Noobot.d BDS/Noobot.A.14 Backdoor:Win32/Poftsyun.A Backdoor.Win32.Noobot.h Trojan/Win32.Noobot.R214072 Backdoor.Noobot Trojan.Zusy.D49A6 Win32.Backdoor.Noobot.Pfts Backdoor.Noobot!KDSSDgztHWQ W32/Noobot.H!tr.bdr Win32/Trojan.231


Check Point Research published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2024-19363 in Ivanti Connect Secure. The attackers deployed DarkSide via Ligolo, establishing C2 communication with 192[.]128[.]192[.]250 and proxyproxy[.]dev. A secondary payload was downloaded from hxxp://node-login[ . ]online/wp-content/uploads/doc.php. The malware binary (SHA256: 284667f1a0446fec040f50af7ee6d6a926c3e3b66cd09a7793292556ba17686d) was dropped to /usr/local/bin/runtime.dll. Phishing emails were sent from noreply@account-update[ . ]xyz targeting enterprise users. A backup C2 server was identified at 192[.]207[.]180[.]210.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from support@secure-verify[.]net and report@login-portal[ . ]tech, spoofing legitimate services. Victims were directed to hxxps://backupstorage[ . ]link/wp-content/uploads/doc.php which hosted a credential harvesting page on static-cloud[.]link. A secondary link hxxps://cachenode[.]live/assets/js/payload.js delivered BumbleBee (SHA256: 0574fd3a2e0b3bc4c0c82818840f9035ce431741791294da0f80cf914632a80c). The malware was saved to /home/user/.config/helper.sh and established C2 with 42 [ . ] 218 [ . ] 67 [ . ] 2.


Many of the strings in the application are XOR 'd with the key Kjk1MmphFG : After some additional requests , the dropper made a POST request to https : //54[.]71[.]249[.]137/56e087c9-fc56-49bb-bbd0-4fafc4acd6e1 which returned a zip file containing the second stage binaries .


Forensic examination of the compromised host identified Ryuk artifacts. The primary payload was located at C:\Windows\System32\config\SAM with SHA256 hash fad5464ca78bf7ea789d0b75d495dd68e0be607fddb3fef461889a996900649b. A secondary implant was found at /tmp/.hidden/beacon (MD5: f2405ea9ed106751b3fab66afe53efbc). Network logs showed outbound connections to 51[.]238[.]93[.]225 and DNS queries to code-deploy[[ . ]]store.


In the Linux kernel, the following vulnerability has been resolved:

nexthop: Forbid FDB status change while nexthop is in a group

The kernel forbids the creation of non-FDB nexthop groups with FDB
nexthops:

 # ip nexthop add id 1 via 192 [ . ] 0 [ . ] 2 [ . ] 1 fdb
 # ip nexthop add id 2 group 1
 Error: Non FDB nexthop group cannot have fdb nexthops.

And vice versa:

 # ip nexthop add id 3 via 192[.]0[.]2[.]2 dev dummy1
 # ip nexthop add id 4 group 3 fdb
 Error: FDB nexthop group can only have fdb nexthops.

However, as long as no routes are pointing to a non-FDB nexthop group,
the kernel allows changing the type of a nexthop from FDB to non-FDB and
vice versa:

 # ip nexthop add id 5 via 192 [ . ] 0 [ . ] 2 [ . ] 2 dev dummy1
 # ip nexthop add id 6 group 5
 # ip nexthop replace id 5 via 192 [ . ] 0 [ . ] 2 [ . ] 2 fdb
 # echo $?
 0

This configuration is invalid and can result in a NPD [1] since FDB
nexthops are not associated with a nexthop device:

 # ip route add 198 [ . ] 51 [ . ] 100 [ . ] 1/32 nhid 6
 # ping 198[.]51[.]100[.]1

Fix by preventing nexthop FDB status change while the nexthop is in a
group:

 # ip nexthop add id 7 via 192 [ . ] 0 [ . ] 2 [ . ] 2 dev dummy1
 # ip nexthop add id 8 group 7
 # ip nexthop replace id 7 via 192[.]0[.]2[.]2 fdb
 Error: Cannot change nexthop FDB status while in a group.

[1]
BUG: kernel NULL pointer dereference, address: 00000000000003c0
[...]
Oops: Oops: 0000 [#1] SMP
CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014
RIP: 0010:fib_lookup_good_nhc+0x1e/0x80
[...]
Call Trace:
 <TASK>
 fib_table_lookup+0x541/0x650
 ip_route_output_key_hash_rcu+0x2ea/0x970
 ip_route_output_key_hash+0x55/0x80
 __ip4_datagram_connect+0x250/0x330
 udp_connect+0x2b/0x60
 __sys_connect+0x9c/0xd0
 __x64_sys_connect+0x18/0x20
 do_syscall_64+0xa4/0x2a0
 entry_SYSCALL_64_after_hwframe+0x4b/0x53


Symantec published a threat intelligence report linking Lazarus Group to a new campaign exploiting CVE-2022-45142 in Apache Struts. The attackers deployed Dridex via Ligolo, establishing C2 communication with 10[.]84[.]141[.]29 and backup-gateway[.]top. A secondary payload was downloaded from hxxp://proxy-mail[.]site/assets/js/payload.js. The malware binary (SHA1: 64cc478ff183fbab60d87027b717505acbe5e1bd) was dropped to C:\Windows\Temp\agent.py. Phishing emails were sent from billing@secure-verify[ . ]net targeting enterprise users. A backup C2 server was identified at 172[.]77[.]104[.]134.


Malware Analysis Report: ShadowPad (MD5: 919bfc3c41e1402c36e73f1d0c4f3666). Upon execution on SonicWall SMA, the sample creates C:\Users\admin\AppData\Local\Temp\ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 62[.]90[.]236[.]129 every 60 seconds and DNS queries to static-storage[.]live. The second stage was fetched from hxxps://data-relay[ . ]club/login and written to /dev/shm/lsass.dmp. The payload uses Impacket-style techniques for defense evasion. A secondary hash (SHA256: d730ce66b507164e8fd30ccbd579f134dae1ad2e34d8a0837d387a1cab78a2d6) was extracted from the unpacked payload.


Once the user double-clicks on the executable file , the dropper drops a Word document in %AppData% and displays the following decoy document to the victim , while the dropper runs in the background and installs the backdoor . %appdata%\info[ . ]docx :


Phishing Campaign Report: Sophos X-Ops identified a large-scale phishing operation. Emails originated from account@identity-verify[ . ]cc and ceo@auth-check[ . ]org, spoofing legitimate services. Victims were directed to hxxps://storage-login[ . ]org/assets/js/payload.js which hosted a credential harvesting page on gatewayproxy[.]com. A secondary link hxxp://auth-backup[.]link/login delivered Ryuk (SHA256: 829548717eac38897bea47900c502c63545b0780a21815bb08ca3232e56a72d5). The malware was saved to /usr/local/bin/winlogon.exe and established C2 with 10 [ . ] 48 [ . ] 205 [ . ] 109.


Unfortunately , there is a specific feature of Android vulnerabilities that means it is only possible to get rid of them by receiving an update from the device manufacturers . A variety of malware , including the PlugX tool , was shared with other known Chinese threat groups . It then creates a service named clr_optimization_v4.0.30229_32 , which is responsible for executing CLR[.]exe . The sample of LIGHTWORK we obtained includes eight hardcoded IEC-104 information object addresses ( IOA ) , which typically correlate with input or output data elements on a device and may correspond to power line switches or circuit breakers in an RTU or relay configuration .


Malware Analysis Report: Vidar (SHA1: 71a3aaaab8e01e071e82ee30a4e6deaddb5776fb). Upon execution on SonicWall SMA, the sample creates C:\ProgramData\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 111 [ . ] 120 [ . ] 146 [ . ] 63 every 60 seconds and DNS queries to storage-secure[.]cc. The second stage was fetched from hxxps://cacheportal[.]live/api/v2/auth and written to C:\Windows\Temp\payload.bin. The payload uses Certutil-style techniques for defense evasion. A secondary hash (SHA256: 9f4045ba031c3d49fa1b5f6d2beacc1312b6b5afe71ae0eb19e37b07466ad321) was extracted from the unpacked payload.


Tenable detected a multi-stage attack chain. The initial phishing email from finance@secure-verify[.]net contained a link to hxxps://cloud-cdn[ . ]io/portal/verify. This redirected to hxxp://cloudcloud[ . ]info/login on storagesync[.]online. A secondary email from contact@login-portal[ . ]tech pointed to hxxps://staticedge[ . ]org/gate.php which delivered LockBit. The final payload callback was hxxp://update-update[.]org/gate.php resolving to 172[.]41[.]53[.]121 via cloudstatic[.]site.


A backdoor also known as: W32.eHeur.Virus02 Trojan/W32.Cobalt.196608 Trojan.Conbea Win.Tool.CobaltStrike-6336852-0 HackTool.Win32.Cobalt.k Trojan.Win32.Cobalt.egtrej BackDoor.Meterpreter.42 BehavesLike[.]Win32[.]Backdoor[.]ch HackTool.CobaltStrike HackTool/Win32.Cobalt Trojan.Application.HackTool.CobaltStrike.1 HackTool.Win32.Cobalt.k HackTool/Win32.Cobalt.R197271 TrojanDownloader.Agresbeak RiskWare.HackTool Riskware.HackTool!t96XHdFe7u4 W32/CobaltStrike_Beacon.A!tr Win32/Application.Hacktool.e79


Microsoft MSRC published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2021-48618 in Progress Telerik. The attackers deployed Lumma Stealer via BloodHound, establishing C2 communication with 200 [ . ] 80 [ . ] 8 [ . ] 226 and cache-backup[.]site. A secondary payload was downloaded from hxxps://logincloud[ . ]org/panel/index.html. The malware binary (MD5: 8045a876307c5034a9207efb379a2ca0) was dropped to C:\Program Files\Common Files\helper.sh. Phishing emails were sent from security@document-share[.]link targeting enterprise users. A backup C2 server was identified at 21 [ . ] 3 [ . ] 3 [ . ] 46.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0[.]9[.]8[.]923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the check_ip parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9707.


Incident Response Summary: On detection of anomalous traffic to 192[.]164[.]108[.]74, the Volexity IR team identified QakBot running as C:\Windows\Temp\dropper.ps1. The threat actor, believed to be Turla, used BloodHound for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to proxymail[.]tech and authauth[.]top. The initial dropper (MD5: 540b9e174e9d8993d8f938f7eeae785d) was delivered via a phishing email from it@document-share[.]link. A second C2 node was observed at 72[.]51[.]220[.]48, with a persistence mechanism writing to C:\Windows\System32\winlogon.exe.


NSA detected a multi-stage attack chain. The initial phishing email from confirm@credential-check[ . ]site contained a link to hxxps://cloud-proxy[ . ]net/admin/config. This redirected to hxxp://nodeportal[ . ]com/callback on cachecloud[.]online. A secondary email from it@phishing-domain[ . ]com pointed to hxxp://logincloud[.]site/assets/js/payload.js which delivered Qbot. The final payload callback was hxxps://storagenode[ . ]io/assets/js/payload.js resolving to 172[.]235[.]33[.]18 via sync-relay[.]top.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from confirm@phishing-domain[ . ]com and service@mail-service[ . ]info, spoofing legitimate services. Victims were directed to hxxp://loginupdate[ . ]com/download/update.exe which hosted a credential harvesting page on portalportal[.]info. A secondary link hxxp://relaynode[ . ]online/secure/token delivered Vidar (MD5: e8b7a5d23d9dde6be874d9428d3ff8b4). The malware was saved to C:\Users\Public\Documents\implant.so and established C2 with 186[.]66[.]111[.]76.


Moreover , BusyGasper boasts some keylogging tools – the malware processes every user tap , gathering its coordinates and calculating characters by matching given values with hardcoded ones . The campaign lasted from April to October and used job descriptions relevant to target organizations , in both English and Korean language . The email contained a malicious link to hxxp://mynetwork[ . ]ddns[ . ]net:880 . UNC1878 has used various offensive security tools , most commonly Cobalt Strike BEACON , along with legitimate tools and built - in commands such as PSEXEC , WMI , and BITSadmin .


Artifact Analysis for Royal campaign:
Stage 1 dropper at /dev/shm/winlogon.exe - MD5: 044bd431ea8e7afd6fb8d8d4fb7085b4
Stage 2 loader at /usr/local/bin/loader.exe - SHA1: 7c3cce49d758619b8e05a053713c5f3954d5a393
Final payload at /var/tmp/implant.so - SHA1: 507860f7aa59b4bcb03f053b3bd74e02e6599155
Exfiltration module - SHA1: 5fd8043623225118dddf98e0abc5ba2b6aff3438
All stages communicated with 124 [ . ] 67 [ . ] 225 [ . ] 189. PowerShell Empire signatures detected in Stage 2.


A backdoor also known as: BackDoor-FHS.dr Trojan/Witthy.a Trojan.Win32.Clicker.crbxjx Trojan.Click2.48783 BehavesLike[ . ]Win32[ . ]VirRansom[ . ]cc Trojan.Win32.Merlos TR/Rogue.7786243 Trj/CI.A Win32/Witthy.A W32/Witthy.A!tr.bdr


Incident Response Summary: On detection of anomalous traffic to 118[.]252[.]57[.]217, the ESET Research IR team identified PlugX running as C:\Windows\Temp\loader.exe. The threat actor, believed to be BlackTech, used WinPEAS for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to securesecure[ . ]club and cachecache[.]xyz. The initial dropper (SHA256: 911f1f3bb80cb6acbf96dfc6a58de249764f2d3c1e7ea95278d2722fac119f9c) was delivered via a phishing email from verify@secure-verify[ . ]net. A second C2 node was observed at 10[.]178[.]47[.]53, with a persistence mechanism writing to C:\Users\admin\Downloads\ntds.dit.


A backdoor also known as: Trojan/W32.Morkus.73728 Trojan.Gambee.BB3 Trojan.Kazy.D13FF6 Trojan.Win32.Morkus.bcz Win32.Trojan.Morkus.Tayq TrojWare.Win32.TrojanClicker.VB.IDP Trojan.DownLoader5.64540 BehavesLike[ . ]Win32[ . ]Trojan[ . ]lt TR/VB.Click.idpmnua Win32.Troj.Undef.kcloud TrojanDownloader:Win32/Gambee.A Trojan.Win32.Morkus.bcz Trojan/Win32.OnlineGameHack.R30007 Win32/TrojanClicker.VB.NYI Trojan-Clicker.Win32.VB W32/VBClicker.NY!tr


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests . The self-extracting RAR writes a legitimate executable , an actor-created DLL called Loader[.]dll and a file named readme[.]txt to the filesystem and then executes the legitimate executable .


Malware Analysis Report: AsyncRAT (MD5: 7afce390a5777656fc861f345bdd152e). Upon execution on Citrix NetScaler, the sample creates C:\Windows\System32\payload.bin and injects into legitimate processes. Network analysis shows beaconing to 10[.]87[.]21[.]177 every 60 seconds and DNS queries to gatewayrelay[.]dev. The second stage was fetched from hxxp://storageportal[.]online/gate.php and written to C:\Users\admin\Desktop\ntds.dit. The payload uses Mimikatz-style techniques for defense evasion. A secondary hash (MD5: 7e81320c73b3c036163e6afc0f81b499) was extracted from the unpacked payload.


If the lateral movement with credentials fails , then the malware uses PingCastle MS17-010 scanner (PingCastle is a French Active Directory security tool) to scan that particular host to determine if its vulnerable to EternalBlue , and uses it to spread to that host . There was code to download a decoy document from the Internet and open it in a second winword[.]exe process using the Start-Process cmdlet .


Vulnerability Advisory: CVE-2026-27486 is a critical SQL injection affecting Atlassian Confluence. Google TAG confirmed active exploitation by Turla in the wild. Exploitation delivers Conti (MD5: 03a91c32e8529fbc7cb403943bad4879) which is dropped to /var/tmp/svchost.exe. The exploit payload is hosted at hxxps://cacheportal[.]site/gate.php and communicates to 153[.]73[.]165[.]202 for C2.


Blog Post by SentinelOne: Tracking Turla's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-27219 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from service@login-portal[ . ]tech delivering Meduza Stealer. Post-compromise, the attackers deploy RedLine Stealer and use BloodHound for reconnaissance. C2 infrastructure includes 205 [ . ] 136 [ . ] 148 [ . ] 24 and cloud-storage[ . ]dev. A staging server at hxxp://securestorage[.]io/collect hosts additional tooling. Key artifact: /opt/app/bin/ntds.dit (SHA256: 62f46c0faa720a9f297447d48fbc1dff5f4f4d726763d38ffd9f7fdf6d2ff6f6).


### SentinelOne
:small_orange_diamond: 2024 - [[SentinelOne] WatchTower 2023 Intelligence-Driven Threat Hunting](hxxps://www[.]sentinelone[.]com/resources/watchtower-end-of-year-report-2023/) | :closed_book:

### Red Canary
:small_orange_diamond: 2021 - [[Red_Canary] 2021 Threat Detection Report](hxxps://redcanary[.]com/threat-detection-report/) | :closed_book:

### NSA
:small_orange_diamond: Jan 08 2021 - [[NSA] 2020 Cybersecurity Year in Review report](hxxps://media[ . ]defense[ . ]gov/2021/Jan/08/2002561651/-1/-1/0/NSA%20CYBERSECURITY%202020%20YEAR%20IN%20REVIEW.PDF/NSA%20CYBERSECURITY%202020%20YEAR%20IN%20REVIEW.PDF) | :closed_book:

### Objective-See
:small_orange_diamond: Jan 01 2024 - [[Objective-See] The Mac Malware of 2023](hxxps://objective-see[.]org/downloads/MacMalware_2023.pdf) | :closed_book:
:small_orange_diamond: Jan 01 2023 - [[Objective-See] The Mac Malware of 2022](hxxps://objective-see[ . ]org/downloads/MacMalware_2022.pdf) | :closed_book:
:small_orange_diamond: Jan 01 2022 - [[Objective-See] The Mac Malware of 2021](hxxps://objective-see[.]com/downloads/MacMalware_2021.pdf) | :closed_book:
:small_orange_diamond: Jan 04 2021 - [[Objective-See] The Mac Malware of 2020](hxxps://objective-see[ . ]com/downloads/MacMalware_2020.pdf/) | :closed_book:
### ESET
:small_orange_diamond: Q3 2023 - [[ESET] 2023 Q2-Q3 APT Activity Report](hxxps://web-assets[ . ]esetstatic[ . ]com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2023-q3-2023.pdf) | :closed_book:
:small_orange_diamond: Jun 2022 - [[ESET] ESET Threat Report T1 2022](hxxps://www[ . ]welivesecurity[ . ]com/wp-content/uploads/2022/06/eset_threat_report_t12022.pdf) | :closed_book:
:small_orange_diamond: Feb 09 2022 - [[ESET] ESET Threat Report T3 2021](hxxps://www[.]welivesecurity[.]com/2022/02/09/eset-threat-report-t32021/) | :closed_book:
:small_orange_diamond: Sep 30 2021 - [[ESET] ESET Threat Report T2 2021](hxxps://www[ . ]welivesecurity[ . ]com/2021/09/30/eset-threat-report-t22021/) | :closed_book:
:small_orange_diamond: Jun 03 2021 - [[ESET] ESET Threat Report T1 2021](hxxps://www[.]welivesecurity[.]com/2021/06/03/eset-threat-report-t12021/) | :closed_book:
:small_orange_diamond: Oct 18 2020 - [


Blog Post by FBI: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-20016 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from notification@phishing-domain[.]com delivering PikaBot. Post-compromise, the attackers deploy NjRAT and use PsExec for reconnaissance. C2 infrastructure includes 10[.]147[.]87[.]80 and data-proxy[.]net. A staging server at hxxp://dataupdate[.]live/assets/js/payload.js hosts additional tooling. Key artifact: /etc/cron.d/loader.exe (SHA256: 2f19f8492457076d00340766316fd4ddacf8fe7136b1136c73f39eb00b0f9314).


Impact:

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: hxxps://github[ . ]com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches:

This issue is patched in 4.18.0.

Workarounds:

None. Upgrade to the patched version.


Vulnerability Advisory: CVE-2020-26049 is a critical remote code execution affecting VMware ESXi. NSA confirmed active exploitation by Turla in the wild. Exploitation delivers SystemBC (SHA1: 14885c9b4aedebb6e76e93491a1f55faca017c83) which is dropped to /usr/local/bin/backdoor.elf. The exploit payload is hosted at hxxp://nodeapi[.]live/secure/token and communicates to 192 [ . ] 202 [ . ] 225 [ . ] 122 for C2.


# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]```see hxxps://guides[ . ]rubyonrails[ . ]org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```<%= sanitize @comment.body, tags: ["select", "style"] %>```see hxxps://api[ . ]rubyonrails[ . ]org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])```All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](hxxps://hackerone[ . ]com/windshock?type=user).


MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP → Configuration → Settings → Clickable Smilies and BB Code: [Clickable MyCode Editor](hxxps://github[.]com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP → Your Profile → Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP → Configuration → Settings_):
- _Clickable Smilies and BB Code → [Clickable MyCode Editor](hxxps://github[ . ]com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP → Your Profile → Edit Options_) _Show the MyCode formatting options on the posting pages_.


IOC Bulletin - Cobalt Strike Campaign:
Network Indicators:
- 91[.]195[.]87[.]212
- 209 [ . ] 138 [ . ] 213 [ . ] 177
- 10[.]18[.]48[.]101
- gatewaygateway[ . ]xyz
- static-cloud[ . ]top
URLs:
- hxxp://backup-cloud[.]club/callback
- hxxps://storage-data[ . ]top/portal/verify
Email Senders:
- admin@login-portal[ . ]tech
- support@credential-check[ . ]site
File Indicators:
- MD5: 279c48cae6018507b8e5ecb11bfaad97
- SHA256: 6f8f4d12afc7289095d1e60ddd0a81879c035579ac89e0d3bd33181892fe944f
- Drop path: /opt/app/bin/winlogon.exe


Malware Analysis Report: TrickBot (MD5: 965479a704fa32bab5e0cf9f11c57914). Upon execution on Progress Telerik, the sample creates C:\Users\Public\Documents\config.dat and injects into legitimate processes. Network analysis shows beaconing to 172[.]25[.]228[.]113 every 60 seconds and DNS queries to cloudcloud[.]link. The second stage was fetched from hxxp://cacheauth[.]net/panel/index.html and written to /tmp/taskhost.exe. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (SHA1: 40cc44ccc5e0788b38d8cbea6db6e2fe7239ae4e) was extracted from the unpacked payload.


SimpleTea for Linux is an HTTP(S) RAT.

It was discovered in Q1 2023 as an instance of the Lazarus group's Operation DreamJob campaign for Linux. It was a payload downloaded in an execution chain which started with an HSBC-themed job offer lure. It shared the same C&C server as payloads from the 3CX incident around the same time.

It’s an object-oriented project, which does not run on Linux distributions without a graphical user interface, and decrypts its configuration from /home/%user%/.config/apdl[.]cf using 0x7E as the XOR key. It uses AES-GCM for encryption and decryption of its network traffic.

It supports basic commands that include operations on the victim’s filesystem, manipulation with its configuration, file exfiltration (via ZIP archives), and the download and execution of additional tools from the attacker’s arsenal. The commands are indexed by 16-bit integers, starting with the value 0x27C3.

SimpleTea for Linux seems like an updated version of BadCall for Linux, rewritten from C to C++, as there are similarities in class names and function names between the two.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from security@urgent-notice[ . ]online and service@urgent-notice[.]online, spoofing legitimate services. Victims were directed to hxxp://api-secure[.]club/admin/config which hosted a credential harvesting page on api-cache[ . ]xyz. A secondary link hxxps://cloud-node[.]io/callback delivered Meduza Stealer (SHA1: 88cb3d7c781f676e3d01fb7e737776a99814b11a). The malware was saved to C:\ProgramData\backdoor.elf and established C2 with 148 [ . ] 5 [ . ] 11 [ . ] 189.


A backdoor also known as: W32.WpechkLTD.Trojan Trojan-Spy/W32.Vskim.160256 Trojan.Mauvaise.SL1 Dropper.Dapato.Win32.16801 Trojan/Spy.POSCardStealer.k Win32.Trojan.WisdomEyes.16070401.9500.9904 Backdoor.Trojan BKDR_HESETOX.SMJ Trojan.Win32.Vskim.cqipth Backdoor.Win32.Hesetox.160260 Trojan.DownLoader8.15980 BKDR_HESETOX.SMJ BehavesLike[.]Win32[.]Dropper[.]ch Trojan[Dropper]/Win32.Dapato Backdoor:Win32/Hesetox.A Win-Trojan/Hesetox.160256 TrojanSpy.Vskim Backdoor.Bot.X Backdoor.Win32.Hesetox Win32/Trojan.IM.73c


A backdoor also known as: Backdoor.Bladabindi.FC.3722 Trojan.Zusy.D3D182 Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike[ . ]Win32[ . ]Trojan[ . ]lt MSIL/Small.CM!tr


Forensic examination of the compromised host identified FormBook artifacts. The primary payload was located at C:\ProgramData\VMware\update_service.dll with SHA256 hash 7aeb949379c93fb6eefd7dd8c11d4c718ba7e9390fa52a98602b131dc2a8db46. A secondary implant was found at /dev/shm/.payload (MD5: a1bd9b43f231677400faa187388aa018). Network logs showed outbound connections to 62 [ . ] 250 [ . ] 237 [ . ] 97 and DNS queries to mail-relay[[.]]icu.


The researchers say the malware uses the unusually tight control it gains over infected devices to create windfall profits and steadily increase its numbers . The cybercriminal group Lazarus has a history of attacking financial organizations in Asia and Latin America . APT33 : 8[.]26[.]21[.]117 srvhost[.]servehttp[.]com . " Indicators of attack IoAs refer to the series of behaviors that a cybercriminal exhibits prior to executing a cyberattack .


A backdoor also known as: Trojan-PWS/W32.Hukle.157044 Trojan.Hukle.Win32.18 Trojan/PSW.Hukle.o Trojan.PWS.Hukle!uPlO8aKf2dU W32/Trojan2.GWXZ Infostealer.Hukle TROJ_HUKLE.O Win.Trojan.Hukle-16 Trojan-PSW.Win32.Hukle.o Trojan.Win32.Hukle.dhvf Troj.PSW32.W.Hukle.o!c TrojWare.Win32.PSW.Hukle.~R Trojan.PWS.Hukle.145 TROJ_HUKLE.O BehavesLike[ . ]Win32[ . ]PWSZbot[ . ]ch W32/Trojan.TBYH-4941 Trojan/Hiddukel.t W32/Hukle.O!tr.pws Trojan[PSW]/Win32.Hukle Trojan.Zusy.Elzob.D3190 Win-Trojan/Hukle.151040 PWS:Win32/Hukle.O Trojan-PWS.Win32.Hukle Trojan.Win32.InfoStealer.o


The domain was registered on March 8th , 2013 : Registration Service Provided By : SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO. , LTD. Domain Name : DLMDOCUMENTSEXCHANGE[ . ]COM Registration Date : 08-Mar-2013 Expiration Date : 08-Mar-2014 Status : LOCKED The domain registration data indicates the following owner : Registrant Contact Details : peng jia peng jia ( bdoufwke123010 @ gmail[.]com ) beijingshiahiidienquc.d beijingshi beijing,100000 CN Tel .


IOC Bulletin - LockBit Campaign:
Network Indicators:
- 192[.]99[.]177[.]69
- 217 [ . ] 7 [ . ] 235 [ . ] 20
- 192[.]7[.]237[.]194
- static-node[.]tech
- secure-data[.]top
URLs:
- hxxp://updategateway[ . ]site/api/v2/auth
- hxxp://edgestorage[ . ]xyz/admin/config
Email Senders:
- billing@secure-verify[ . ]net
- verify@secure-verify[.]net
File Indicators:
- SHA1: 3981d9dfc054681a987485a28356baf4d23c469e
- SHA256: a646338b2a209096e6fbda18dddade1247d3ca8fd938b0a2aa398b3afd7dfea1
- Drop path: /usr/local/bin/sam.hive


hxxp://188[.]241[.]58[.]170/local/s3/filters.php hxxps://200[.]122[.]181[.]25/catalog/products/books.php .


A backdoor also known as: Trojan.Dynamer Win32.Trojan.WisdomEyes.16070401.9500.9999 MSIL.Packed.Skaldring.D Win32.Trojan.Fsysna.Hwwo Trojan.DownLoader14.15241 BehavesLike[ . ]Win32[ . ]Trojan[ . ]cc Trojan.Crypt TR/Dropper.MSIL.rpjh Trojan.Barys.DCAFA Trojan:Win32/Bshan.A Trojan.Fsysna! MSIL/Injector.PKZ!tr Trj/GdSda.A


Otherwise , in the case of conditional opcodes , the variable part can contain the next JIT packet ID or the next relative virtual address ( RVA ) where code execution should continue . In addition to the malware evolution , the actors also shifted from solely spear-phishing targets with attachments to also compromising legitimate websites to host malware . Winnti : dde82093decde6371eb852a5e9a1aa4acf3b56ba hxxps://bugcheck[.]xigncodeservice[.]com/Common/Lib/common.php . LockBit reportedly squeezed about $ 91 million out of US organizations with around 1,700 attacks since 2020 , according to a June report by CISA .


Figure 2 . To mitigate the threat of the described campaign , security teams can consider blocking access to the C2 server 103[.]236[.]150[.]14 and , where applicable , ensure that the Microsoft Security Update KB2553204 is installed in order to patch the CVE-2017-11882 vulnerability . The samples we have analyzed were actually quite large , each of them about 60 MB . In terms of detection , organizations should look to align their detection strategy with the MITRE ATTCK Framework to help detect a ransomware attack before its too late .


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from noreply@credential-check[ . ]site and info@phishing-domain[.]com, spoofing legitimate services. Victims were directed to hxxp://secure-cloud[.]dev/collect which hosted a credential harvesting page on edgemail[ . ]com. A secondary link hxxp://apimail[ . ]net/login delivered Qbot (MD5: 68b8e891e8185a00039ea8a0bfd66a23). The malware was saved to C:\Program Files\Common Files\winlogon.exe and established C2 with 192 [ . ] 132 [ . ] 159 [ . ] 98.


Blog Post by Trend Micro: Tracking APT28's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-35009 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from confirm@auth-check[ . ]org delivering RemcosRAT. Post-compromise, the attackers deploy Emotet and use Nmap for reconnaissance. C2 infrastructure includes 7 [ . ] 244 [ . ] 218 [ . ] 42 and sync-mail[ . ]cc. A staging server at hxxp://relaydata[ . ]site/login hosts additional tooling. Key artifact: C:\Users\Public\Documents\implant.so (SHA1: fa5956a7d8611623d4d1033b0aef96c346caf9de).


According to unpac[ . ]me, StormKitty is a Remote Access Trojan (RAT), written in C#, primarily designed to perform extensive system reconnaissance and data collection. It leverages Windows Management Instrumentation for execution and conducts a thorough discovery of system information, including querying the registry, identifying system owners and users, and discovering network configurations. StormKitty is also capable of collecting data from information repositories and performing file and directory discovery. For defense evasion, it employs techniques such as obfuscating files or information and checks for virtualization or sandbox environments to avoid detection. These capabilities enable StormKitty to maintain persistence and gather sensitive information from compromised systems.


Palo Alto Unit 42 published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2026-17310 in Citrix NetScaler. The attackers deployed QakBot via Covenant, establishing C2 communication with 43[.]82[.]165[.]240 and edge-sync[.]org. A secondary payload was downloaded from hxxp://staticedge[.]net/collect. The malware binary (SHA1: 2303482ab61f96fb5e4ebbee91d6163f507305be) was dropped to C:\Windows\System32\config.dat. Phishing emails were sent from report@document-share[.]link targeting enterprise users. A backup C2 server was identified at 172[.]145[.]40[.]65.


Artifact Analysis for Amadey campaign:
Stage 1 dropper at C:\Users\admin\AppData\Local\Temp\csrss.exe - MD5: 1cf4586d3b17db7d689b88566bec53be
Stage 2 loader at /etc/cron.d/winlogon.exe - SHA1: f1b8e36ff716aacc7abb74781d6da61887e30059
Final payload at C:\Windows\System32\helper.sh - MD5: 48a44aa6a2673b6f6cdaf5f2643c2670
Exfiltration module - SHA256: 4db01633d044213f192fc19799b0b82927aa4fdd0c93117d32de69b668c114df
All stages communicated with 192[.]14[.]129[.]157. LaZagne signatures detected in Stage 2.


Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10[.]0[.]0[.]187(C00E60R4P11); versions earlier than 10[.]0[.]0[.]187(C00E60R4P11); versions earlier than 10 [ . ] 0 [ . ] 0 [ . ] 176(C00E60R2P11);9 [ . ] 1 [ . ] 0 [ . ] 135(C00E133R2P1); versions earlier than 10 [ . ] 1 [ . ] 0 [ . ] 123(C431E22R3P5), versions earlier than 10 [ . ] 1 [ . ] 0 [ . ] 126(C636E5R3P4), versions earlier than 10[.]1[.]0[.]160(C00E160R2P11); versions earlier than 10 [ . ] 1 [ . ] 0 [ . ] 126(C185E8R5P1), versions earlier than 10[.]1[.]0[.]126(C636E9R2P4), versions earlier than 10 [ . ] 1 [ . ] 0 [ . ] 160(C00E160R2P8); versions earlier than 10 [ . ] 0 [ . ] 0 [ . ] 179(C636E3R4P3), versions earlier than 10 [ . ] 0 [ . ] 0 [ . ] 180(C185E3R3P3), versions earlier than 10 [ . ] 0 [ . ] 0 [ . ] 180(C432E10R3P4), versions earlier than 10[.]0[.]0[.]181(C675E5R1P2) have an out of bound read vulnerability. The software reads data past the end of the intended buffer. The attacker tricks the user into installing a crafted application, successful exploit may cause information disclosure or service abnormal.


Blog Post by NSA: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-23031 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from alert@auth-check[.]org delivering Amadey. Post-compromise, the attackers deploy StealC and use Hashcat for reconnaissance. C2 infrastructure includes 10[.]54[.]196[.]91 and mail-cdn[ . ]io. A staging server at hxxps://mail-cache[.]tech/portal/verify hosts additional tooling. Key artifact: C:\Windows\Temp\sam.hive (SHA256: dd72b5d26dfb6da6527fccac226d9acc8294987f9a80aab77c9ffaf400bb22da).


Files Description CMDS * .txt Text files with commands to execute supersu.apk SuperSU ( eu.chainfire.supersu , https : //play[.]google[.]com/store/apps/details ? id=eu.chainfire.supersu ) tool 246[ . ]us us.x SuperSU ELF binaries supersu.cfg supersu.cfg.ju supersu.cfg.old SuperSU configs with spyware implant mention bb.txt BusyBox v1.26.2 ELF file bdata.xml Config file for excluding malware components from Android battery saver feature Doze bdatas.apk Main implant module com.android.network.irc.apk Start implant module MobileManagerService.apk ASUS firmware system component ( clean ) mobilemanager.apk Corrupted archive privapp.txt Looks like a list of system applications ( including spyware components ) from the infected device run-as.x run-as.y Run-as tool ELF file SuperSU config fragment for implant components and the busybox tool supersu.cfg : This config allows the implant to use all root features silently .


This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center.

This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to
modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction.

Atlassian recommends that you upgrade your instance to latest version. If you're unable to upgrade to latest, upgrade to one of these fixed versions: 9.2.3 and 9.3.1. See the release notes ([hxxps://confluence[.]atlassian[.]com/bambooreleases/bamboo-release-notes-1189793869.html|hxxps://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Bamboo Server from the download center ([hxxps://www[.]atlassian[.]com/software/bamboo/download-archives|hxxps://www.atlassian.com/software/bamboo/download-archives]).

This vulnerability was reported via our Penetration Testing program.


Rapid7 published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2024-30622 in F5 BIG-IP. The attackers deployed TrickBot via Ligolo, establishing C2 communication with 89[.]164[.]198[.]70 and cdnproxy[ . ]io. A secondary payload was downloaded from hxxps://cachedata[ . ]org/wp-content/uploads/doc.php. The malware binary (SHA1: 846a391db1ac51ca39ad717d064b41b4270806d3) was dropped to /var/tmp/backdoor.elf. Phishing emails were sent from confirm@phishing-domain[.]com targeting enterprise users. A backup C2 server was identified at 10 [ . ] 163 [ . ] 112 [ . ] 8.


Incident Response Summary: On detection of anomalous traffic to 10 [ . ] 157 [ . ] 208 [ . ] 174, the Cisco Talos IR team identified LockBit running as /opt/app/bin/backdoor.elf. The threat actor, believed to be Turla, used Nmap for credential harvesting and Seatbelt for lateral movement. Exfiltrated data was sent to backup-portal[.]net and logingateway[.]dev. The initial dropper (SHA256: 83a4be0879a879f81a54832c3c920ba51234475bf47388c0fdb48f064e6382b3) was delivered via a phishing email from helpdesk@document-share[ . ]link. A second C2 node was observed at 10 [ . ] 166 [ . ] 92 [ . ] 7, with a persistence mechanism writing to C:\Users\admin\Desktop\taskhost.exe.


A ZIP archive recovered during our investigations , schtasks[.]zip , contained an installer and uninstaller of CATRUNNER that includes two versions of an XML scheduled task definitions for a masquerading service ‘ ProgramDataUpdater . ’ The malicious installation version has a task name and description in English , and the clean uninstall version has a task name and description in Cyrillic .


Urgent_Information_Report[.]exe :


id= $ NUM ” . The registrant information for kernel[ . ]ws also provided a geolocation of Tehran , IR and the email provider for the address used in checkgoogle[.]org was the same used for mydomain1607[.]com , chmail.ir . Gamaredon : c1524a4573bc6acbe59e559c2596975c657ae6bbc0b64f943fffca663b98a95f . But what happens when an unidentified virus infects a victims computer Antivirus programs can only protect against threats they already know .


As a rule , bots self-proliferate by sending out text messages with a malicious link to addresses in the victim ’ s address book . the targeted system with a piece of malware called HyperBro , a Remote Access Trojan ( RAT ) . When the malicious DLL is loaded at hpqhvind[.]exe startup , its DLLMain function is called that will check its parent process for the following sequence of bytes at offset 0x10BA . It crafts configurable IEC-104 ASDU messages , to change the state of RTU IOAs to ON or OFF .


In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix a WARN during dereg_mr for DM type

Memory regions (MR) of type DM (device memory) do not have an associated
umem.

In the __mlx5_ib_dereg_mr() -> mlx5_free_priv_descs() flow, the code
incorrectly takes the wrong branch, attempting to call
dma_unmap_single() on a DMA address that is not mapped.

This results in a WARN [1], as shown below.

The issue is resolved by properly accounting for the DM type and
ensuring the correct branch is selected in mlx5_free_priv_descs().

[1]
WARNING: CPU: 12 PID: 1346 at drivers/iommu/dma-iommu.c:1230 iommu_dma_unmap_page+0x79/0x90
Modules linked in: ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry ovelay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core fuse mlx5_core
CPU: 12 UID: 0 PID: 1346 Comm: ibv_rc_pingpong Not tainted 6.12.0-rc7+ #1631
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1[.]13[.]0-0-gf21b5a4aeb02-prebuilt[.]qemu[.]org 04/01/2014
RIP: 0010:iommu_dma_unmap_page+0x79/0x90
Code: 2b 49 3b 29 72 26 49 3b 69 08 73 20 4d 89 f0 44 89 e9 4c 89 e2 48 89 ee 48 89 df 5b 5d 41 5c 41 5d 41 5e 41 5f e9 07 b8 88 ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 66 0f 1f 44 00
RSP: 0018:ffffc90001913a10 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88810194b0a8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffff88810194b0a8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f537abdd740(0000) GS:ffff88885fb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f537aeb8000 CR3: 000000010c248001 CR4: 0000000000372eb0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
? __warn+0x84/0x190
? iommu_dma_unmap_page+0x79/0x90
? report_bug+0xf8/0x1c0
? handle_bug+0x55/0x90
? exc_invalid_op+0x13/0x60
? asm_exc_invalid_op+0x16/0x20
? iommu_dma_unmap_page+0x79/0x90
dma_unmap_page_attrs+0xe6/0x290
mlx5_free_priv_descs+0xb0/0xe0 [mlx5_ib]
__mlx5_ib_dereg_mr+0x37e/0x520 [mlx5_ib]
? _raw_spin_unlock_irq+0x24/0x40
? wait_for_completion+0xfe/0x130
? rdma_restrack_put+0x63/0xe0 [ib_core]
ib_dereg_mr_user+0x5f/0x120 [ib_core]
? lock_release+0xc6/0x280
destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs]
uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs]
uobj_destroy+0x3f/0x70 [ib_uverbs]
ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs]
? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs]
? lock_acquire+0xc1/0x2f0
? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs]
? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs]
? lock_release+0xc6/0x280
ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs]
? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs]
__x64_sys_ioctl+0x1b0/0xa70
do_syscall_64+0x6b/0x140
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f537adaf17b
Code: 0f 1e fa 48 8b 05 1d ad 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ed ac 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffff218f0b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffff218f1d8 RCX: 00007f537adaf17b
RDX: 00007ffff218f1c0 RSI: 00000000c0181b01 RDI: 0000000000000003
RBP: 00007ffff218f1a0 R08: 00007f537aa8d010 R09: 0000561ee2e4f270
R10: 00007f537aace3a8 R11: 0000000000000246 R12: 00007ffff218f190
R13: 000000000000001c R14: 0000561ee2e4d7c0 R15: 00007ffff218f450
</TASK>


Artifact Analysis for Emotet campaign:
Stage 1 dropper at /usr/local/bin/winlogon.exe - SHA1: c617f5b66b8cb27f811c87cd8cb6d7cf14d49c1d
Stage 2 loader at C:\ProgramData\taskhost.exe - SHA1: 36fb2b9f8743d6ab9a4c7a96f5c7007c04bae23d
Final payload at /etc/cron.d/shell.php - SHA1: 5c88785e18698adad9f6544de0c8ae80342fccdd
Exfiltration module - MD5: d3b984434da5a85c7d4fe72b130a7802
All stages communicated with 172[.]211[.]233[.]1. Hashcat signatures detected in Stage 2.


The Cowrie SSH honeypot recorded 118 unique attacker IP addresses over 24 hours on 2026-04-24. Top attackers by connection volume were 222[.]186[.]42[.]137 (4,521 attempts), 218[.]92[.]0[.]56 (3,877 attempts), and 106[.]75[.]85[.]134 (2,103 attempts). Attackers attempted to download payloads from hxxp://185[ . ]196[ . ]8[ . ]124/bins/mirai.arm7 and hxxp://45[ . ]95[ . ]147[ . ]236/ssh_botnet.sh. Common usernames targeted included root, admin, oracle, and postgres. Payloads were identified as Mirai botnet variants.


Artifact Analysis for WarmCookie campaign:
Stage 1 dropper at C:\Users\admin\Desktop\implant.so - MD5: 7c3e542708b6d48c04704591862c8a33
Stage 2 loader at /dev/shm/implant.so - SHA256: aed800f7ed075cd08b9e43acf068c924492fe1bfd60195e7a7e01fc7b5c2ffb2
Final payload at /etc/cron.d/update.dll - MD5: c5225fc5dc3cf6ae4dba0157013f0920
Exfiltration module - MD5: 396bede1e1c13c1c1763962f1e74784d
All stages communicated with 177[.]203[.]208[.]215. BloodHound signatures detected in Stage 2.


Recorded Future published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2020-12082 in SonicWall SMA. The attackers deployed Royal via BITSAdmin, establishing C2 communication with 180 [ . ] 32 [ . ] 30 [ . ] 240 and login-gateway[.]tech. A secondary payload was downloaded from hxxps://relayportal[.]site/admin/config. The malware binary (SHA1: 26686e9771ce132aa0f5c6f08149413040d4839c) was dropped to C:\Windows\System32\csrss.exe. Phishing emails were sent from alert@account-update[.]xyz targeting enterprise users. A backup C2 server was identified at 172[.]16[.]146[.]105.


Blog Post by Trend Micro: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-43392 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from admin@identity-verify[ . ]cc delivering QakBot. Post-compromise, the attackers deploy NjRAT and use Mimikatz for reconnaissance. C2 infrastructure includes 158[.]10[.]77[.]62 and cdn-static[.]link. A staging server at hxxps://gatewaysecure[ . ]net/assets/js/payload.js hosts additional tooling. Key artifact: C:\Users\Public\Documents\lsass.dmp (MD5: 0e3aa6691ef076ee77a8deb95b559e6e).


In the Linux kernel, the following vulnerability has been resolved:

mtd: core: Fix refcount error in del_mtd_device()

del_mtd_device() will call of_node_put() to mtd_get_of_node(mtd), which
is mtd->dev.of_node. However, memset(&mtd->dev, 0) is called before
of_node_put(). As the result, of_node_put() won't do anything in
del_mtd_device(), and causes the refcount leak.

del_mtd_device()
    memset(&mtd->dev, 0, sizeof(mtd->dev) # clear mtd->dev
    of_node_put()
        mtd_get_of_node(mtd) # mtd->dev is cleared, can't locate of_node
                             # of_node_put(NULL) won't do anything

Fix the error by caching the pointer of the device_node.

OF: ERROR: memory leak, expected refcount 1 instead of 2,
of_node_get()/of_node_put() unbalanced - destroy cset entry: attach
overlay node /spi/spi-sram@0
CPU: 3 PID: 275 Comm: python3 Tainted: G N 6.1.0-rc3+ #54
    0d8a1edddf51f172ff5226989a7565c6313b08e2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1[.]15[.]0-0-g2dd4b9b3f840-prebuilt[.]qemu[.]org 04/01/2014
Call Trace:
<TASK>
    dump_stack_lvl+0x67/0x83
    kobject_get+0x155/0x160
    of_node_get+0x1f/0x30
    of_fwnode_get+0x43/0x70
    fwnode_handle_get+0x54/0x80
    fwnode_get_nth_parent+0xc9/0xe0
    fwnode_full_name_string+0x3f/0xa0
    device_node_string+0x30f/0x750
    pointer+0x598/0x7a0
    vsnprintf+0x62d/0x9b0
    ...
    cfs_overlay_release+0x30/0x90
    config_item_release+0xbe/0x1a0
    config_item_put+0x5e/0x80
    configfs_rmdir+0x3bd/0x540
    vfs_rmdir+0x18c/0x320
    do_rmdir+0x198/0x330
    __x64_sys_rmdir+0x2c/0x40
    do_syscall_64+0x37/0x90
    entry_SYSCALL_64_after_hwframe+0x63/0xcd

[<miquel.raynal@bootlin[.]com>: Light reword of the commit log]


A backdoor also known as: TROJ_DROPPER.FK Win32.Trojan.WisdomEyes.16070401.9500.9995 Infostealer.Gampass TROJ_DROPPER.FK Trojan.Win32.XDR.euxmtw Trojan.MulDrop.18385 BehavesLike[ . ]Win32[ . ]Virut[ . ]cc Win32.Infect.a.124448 Win32/Trojan.5f3


Symantec detected a multi-stage attack chain. The initial phishing email from contact@document-share[.]link contained a link to hxxp://updatenode[.]site/wp-content/uploads/doc.php. This redirected to hxxps://cache-static[ . ]top/login on storage-cdn[ . ]top. A secondary email from security@auth-check[ . ]org pointed to hxxp://portalportal[.]top/callback which delivered RedLine Stealer. The final payload callback was hxxps://storage-mail[ . ]com/admin/config resolving to 192 [ . ] 18 [ . ] 179 [ . ] 252 via edge-cloud[.]com.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from finance@phishing-domain[ . ]com and info@login-portal[.]tech, spoofing legitimate services. Victims were directed to hxxps://storage-cloud[.]tech/callback which hosted a credential harvesting page on mailstorage[ . ]org. A secondary link hxxp://secureportal[ . ]net/panel/index.html delivered RemcosRAT (SHA1: 6bae7eabf5d21713d633433fb38ce2cb2ba4fee2). The malware was saved to /dev/shm/agent.py and established C2 with 10 [ . ] 71 [ . ] 186 [ . ] 73.


Malware Analysis Report: Conti (MD5: ffdf6f86b266dd6b6fec4ad734668304). Upon execution on Cisco ASA, the sample creates C:\Windows\Temp\dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 73[.]220[.]123[.]60 every 60 seconds and DNS queries to static-static[.]cc. The second stage was fetched from hxxp://edgemail[.]live/download/update.exe and written to /opt/app/bin/helper.sh. The payload uses Rubeus-style techniques for defense evasion. A secondary hash (SHA1: 01fbcd6ca63acb13312ca7a9b3d4741abe84a84c) was extracted from the unpacked payload.


Recorded Future published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2023-28217 in Ivanti Connect Secure. The attackers deployed AgentTesla via Mythic, establishing C2 communication with 41 [ . ] 224 [ . ] 154 [ . ] 157 and sync-auth[ . ]dev. A secondary payload was downloaded from hxxps://edge-login[ . ]info/collect. The malware binary (SHA256: 78f706009e82940aadb53106035b179b28fe918c2b1d8580ca768e3e8da9e64d) was dropped to /opt/app/bin/runtime.dll. Phishing emails were sent from hr@urgent-notice[ . ]online targeting enterprise users. A backup C2 server was identified at 192[.]153[.]53[.]241.


Vulnerability Advisory: CVE-2021-20463 is a critical CSRF vulnerability affecting SonicWall SMA. Cisco Talos confirmed active exploitation by MuddyWater in the wild. Exploitation delivers PikaBot (MD5: c24368cbc473c40582f65345f1ae45b3) which is dropped to C:\Users\admin\AppData\Local\Temp\update.dll. The exploit payload is hosted at hxxps://proxysecure[.]club/callback and communicates to 86 [ . ] 41 [ . ] 160 [ . ] 146 for C2.


Malware Analysis Report: ShadowPad (MD5: 989184ff1c7a6711dbdbf118cf5f8364). Upon execution on F5 BIG-IP, the sample creates /dev/shm/backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 218 [ . ] 240 [ . ] 132 [ . ] 148 every 60 seconds and DNS queries to storagenode[.]org. The second stage was fetched from hxxps://staticdata[ . ]xyz/callback and written to /opt/app/bin/loader.exe. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (SHA1: 69f8ba122a086af4b1e15a923b341898ecfeef18) was extracted from the unpacked payload.


In this case , a URL used to download the PowerShell component shared a naming convention found in the IBM report , hxxp://69[.]87[.]223[.]26:8080/eiloShaegae1 and connected to the IP address used by the previous three samples .


IOC Bulletin - Dridex Campaign:
Network Indicators:
- 192[.]52[.]228[.]151
- 128[.]244[.]179[.]1
- 10 [ . ] 157 [ . ] 170 [ . ] 196
- login-cdn[ . ]org
- secureportal[ . ]cc
URLs:
- hxxps://login-portal[ . ]top/secure/token
- hxxp://mail-relay[ . ]xyz/login
Email Senders:
- report@phishing-domain[ . ]com
- updates@mail-service[ . ]info
File Indicators:
- SHA256: 292fcaf1a11abdc90430629e03a7fd64f0616b9981ee416f53f7e74725db5424
- SHA256: 645c1b9c7d6964ce89b3536d0be0124095f8a47a7dfafb3c15d3ef11cec9afce
- Drop path: C:\Users\admin\AppData\Local\Temp\lsass.dmp


CVE-2026-35073: Dell PowerProtect Data Domain, versions 7 [ . ] 7 [ . ] 1 [ . ] 0 through 8[.]7[.]0[.]0, LTS2025 release versions 8[.]3[.]1[.]0 through 8 [ . ] 3 [ . ] 1 [ . ] 20, LTS2024 release versions 7[.]13[.]1[.]0 through 7[.]13[.]1[.]60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from info@urgent-notice[ . ]online and hr@login-portal[.]tech, spoofing legitimate services. Victims were directed to hxxp://auth-cache[ . ]org/login which hosted a credential harvesting page on static-proxy[ . ]xyz. A secondary link hxxp://gatewayproxy[.]xyz/wp-content/uploads/doc.php delivered BlackCat (SHA1: 15529b78ea3a38033423a8fd154dbd12f25aed91). The malware was saved to C:\Users\admin\Desktop\agent.py and established C2 with 11[.]95[.]68[.]83.


Vulnerability Advisory: CVE-2022-49565 is a critical CSRF vulnerability affecting Fortinet FortiGate. CISA confirmed active exploitation by Gamaredon in the wild. Exploitation delivers Latrodectus (MD5: 14002449b55a0787c563a3b413454423) which is dropped to /opt/app/bin/implant.so. The exploit payload is hosted at hxxps://api-storage[.]cc/panel/index.html and communicates to 173[.]105[.]218[.]77 for C2.


Malware Analysis Report: Vidar (SHA256: 50df7eaf6c17024c396639b4e074d33807f8fa16b3be489a06c5e69bb1003340). Upon execution on Atlassian Confluence, the sample creates /etc/cron.d/ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 206[.]131[.]54[.]211 every 60 seconds and DNS queries to edge-data[ . ]live. The second stage was fetched from hxxp://data-relay[.]dev/api/v2/auth and written to C:\Users\admin\Desktop\ntds.dit. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA1: 6e9f28b1a35307e2abefd6b75fb15d4dc1882d74) was extracted from the unpacked payload.


In the Linux kernel, the following vulnerability has been resolved:

proc: fix UAF in proc_get_inode()

Fix race between rmmod and /proc/XXX's inode instantiation.

The bug is that pde->proc_ops don't belong to /proc, it belongs to a
module, therefore dereferencing it after /proc entry has been registered
is a bug unless use_pde/unuse_pde() pair has been used.

use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops
never changes so information necessary for inode instantiation can be
saved _before_ proc_register() in PDE itself and used later, avoiding
pde->proc_ops->...  dereference.

      rmmod                         lookup
sys_delete_module
                         proc_lookup_de
			   pde_get(de);
			   proc_get_inode(dir->i_sb, de);
  mod->exit()
    proc_remove
      remove_proc_subtree
       proc_entry_rundown(de);
  free_module(mod);

                               if (S_ISREG(inode->i_mode))
	                         if (de->proc_ops->proc_read_iter)
                           --> As module is already freed, will trigger UAF

BUG: unable to handle page fault for address: fffffbfff80a702b
PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:proc_get_inode+0x302/0x6e0
RSP: 0018:ffff88811c837998 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007
RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158
RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20
R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0
R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001
FS:  00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 proc_lookup_de+0x11f/0x2e0
 __lookup_slow+0x188/0x350
 walk_component+0x2ab/0x4f0
 path_lookupat+0x120/0x660
 filename_lookup+0x1ce/0x560
 vfs_statx+0xac/0x150
 __do_sys_newstat+0x96/0x110
 do_syscall_64+0x5f/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[adobriyan@gmail[.]com: don't do 2 atomic ops on the common path]


We were able to discover this particular version by diving further into connections to analytics-google[ . ]org .


TensorFlow is an end-to-end open source platform for machine learning. TFlite graphs must not have loops between nodes. However, this condition was not checked and an attacker could craft models that would result in infinite loop during evaluation. In certain cases, the infinite loop would be replaced by stack overflow due to too many recursive calls. For example, the `While` implementation(hxxps://github[ . ]com/tensorflow/tensorflow/blob/106d8f4fb89335a2c52d7c895b7a7485465ca8d9/tensorflow/lite/kernels/while.cc) could be tricked into a scneario where both the body and the loop subgraphs are the same. Evaluating one of the subgraphs means calling the `Eval` function for the other and this quickly exhaust all stack space. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Please consult our security guide(hxxps://github[.]com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


Vulnerability Advisory: CVE-2023-46500 is a critical heap overflow affecting MOVEit Transfer. CrowdStrike confirmed active exploitation by APT28 in the wild. Exploitation delivers SmokeLoader (SHA1: ec853b9035b322739988c30bd4363004c1267dfd) which is dropped to /var/tmp/dropper.ps1. The exploit payload is hosted at hxxps://relayauth[.]dev/login and communicates to 10[.]25[.]228[.]151 for C2.


To their credit , both Google and Amazon appear to have put pressure on device manufacturers to fix their devices when flaws are found , Strazzere says . As observed previously with CVE-2017-11882 and CVE-2018-0802 , the weaponizer was used exclusively by Chinese cyber espionage actors for approximately one year December 2017 through December 2018 , after which cybercrime actors began to incorporate it in their malicious activity . C2 : krjregh[ . ]sacreeflame[ . ]com .


IOC Bulletin - Conti Campaign:
Network Indicators:
- 177 [ . ] 99 [ . ] 210 [ . ] 105
- 71[.]228[.]187[.]131
- 215 [ . ] 124 [ . ] 247 [ . ] 233
- cdn-storage[.]xyz
- mail-cache[.]com
URLs:
- hxxps://relayauth[ . ]io/wp-content/uploads/doc.php
- hxxps://updateauth[ . ]online/wp-content/uploads/doc.php
Email Senders:
- admin@mail-service[.]info
- support@account-update[ . ]xyz
File Indicators:
- MD5: 976f74083a5780dcf563e00751c44406
- SHA1: 992a1bc84be507c4dfe69046188f1880b8214bca
- Drop path: /etc/cron.d/lsass.dmp


Qualys detected a multi-stage attack chain. The initial phishing email from updates@urgent-notice[.]online contained a link to hxxp://mailrelay[.]io/wp-content/uploads/doc.php. This redirected to hxxps://static-cache[.]link/wp-content/uploads/doc.php on cache-storage[.]online. A secondary email from billing@phishing-domain[.]com pointed to hxxps://update-cache[.]top/api/v2/auth which delivered Lumma Stealer. The final payload callback was hxxp://relayedge[ . ]online/panel/index.html resolving to 192[.]221[.]185[.]162 via node-data[ . ]cc.


A backdoor also known as: W32.HfsAdware.6632 PUP.Optional.Nosibay TROJ_GE.FF4D51A5 Adware.Downware.11318 virus[.]win32[.]sality[.]at PUA/BubbleDock.A PUP.Nosibay/Variant NSIS.Application.SilentInstaller.A Win32.Trojan.Bubbledock.Huzb


Blog Post by CISA: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-36175 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from verify@urgent-notice[.]online delivering REvil. Post-compromise, the attackers deploy BlackCat and use PsExec for reconnaissance. C2 infrastructure includes 10 [ . ] 89 [ . ] 240 [ . ] 88 and sync-auth[.]io. A staging server at hxxps://static-static[ . ]club/secure/token hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\config.dat (SHA1: 84cead1be1bb20babc7bd427d844ff0481f8dab2).


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0[.]9[.]8[.]891. Authentication is not required to exploit this vulnerability. The specific flaw exists within loader_ajax.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9259.


The Sogu gang use a custom developed threat – Backdoor[.]Sogu , whereas the group described in this document use an off the shelf threat – Poison Ivy .


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from report@auth-check[.]org and it@document-share[.]link, spoofing legitimate services. Victims were directed to hxxp://secure-proxy[.]top/callback which hosted a credential harvesting page on edge-storage[ . ]com. A secondary link hxxps://apibackup[.]cc/login delivered DarkSide (MD5: d64ed40267123be39effbb6c2df5785e). The malware was saved to /opt/app/bin/chrome_helper.exe and established C2 with 172 [ . ] 147 [ . ] 130 [ . ] 225.


Shamoon2 : 5 [ . ] 254 [ . ] 100 [ . ] 200 Shamoon2 : URLs .


Analysis of FormBook sample (SHA256: 4e0863e4cc68d9634d0af31a52e2d7933912795b397385adb96d06e507ded32e) revealed command-and-control communication with 82[.]70[.]73[.]155 over port 9090. A secondary C2 channel was observed connecting to exfil-data[[ . ]]club which resolved to 104 [ . ] 184 [ . ] 88 [ . ] 53. The malware binary was written to C:\ProgramData\svchost.exe and established persistence via a scheduled task.


* Dec 29 - [[NTT] Report on APT Attacks by BlackTech](hxxps://jp[ . ]security[ . ]ntt/resources/EN-BlackTech_2021.pdf) | :closed_book:
* Dec 16 - [[Zscaler] New DarkHotel APT attack chain identified](hxxps://www[.]zscaler[.]com/blogs/security-research/new-darkhotel-apt-attack-chain-identified) | :closed_book:
* Dec 11 - [[ESET] Jumping the air gap: 15 years of nation-state effort](hxxps://www[.]welivesecurity[.]com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf) | :closed_book:
* Dec 07 - [[Mandiant] FIN13: A Cybercriminal Threat Actor Focused on Mexico](hxxps://www[ . ]mandiant[ . ]com/resources/fin13-cybercriminal-mexico) | :closed_book:
* Dec 03 - [[Pwc] Conti cyber attack on the HSE](hxxps://www[ . ]hse[ . ]ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf) | :closed_book:
* Nov 29 - [[Trend Micro] Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites](hxxps://www[ . ]trendmicro[ . ]com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html) | :closed_book:
* Nov 16 - [[Mandiant] UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests](hxxps://www[.]mandiant[.]com/resources/unc1151-linked-to-belarus-government) | :closed_book:
* Nov 16 - [[ESET] Strategic web compromises in the Middle East with a pinch of Candiru](hxxps://www[ . ]welivesecurity[ . ]com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/) | :closed_book:
* Nov 11 - [[Google] Analyzing a watering hole campaign using macOS exploits](hxxps://blog[.]google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/) | :closed_book:
* Nov 10 - [[Trend Micro] Void Balaur: Tracking a Cybermercenary’s Activities](hxxps://documents[.]trendmicro[.]com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf) | :closed_book:
* Nov 08 - [[NCCGroup] TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access](hxxps://research[ . ]nccgroup[ . ]com/2021/11/08/ta505-exploits-solarwinds-serv-u-vulnerability-cve-2021-35211-for-initial-access/) | :closed_book:
* Nov 04 - [[SSU] Gamaredon Armageddon Group](hxxps://ssu[ . ]gov[ . ]ua/uploads/files/DKIB/Technical%20report%20Armagedon.pdf) | :closed_book:
* Oct 19 - [[CrowdStrike] LightBasin: A Roaming Threat to Telecommunications Companies](hxxps://www[ . ]crowdstrik