Forensic Investigation Notes: Analysis of the compromised host revealed Havoc artifacts at /home/user/.config/winlogon.exe. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\winlogon.exe. Network forensics identified connections to 113 [ . ] 116 [ . ] 51 [ . ] 243 and backup-node[ . ]tech. Email headers traced the initial vector to info@mail-service[ . ]info. File C:\Windows\System32\payload.bin (SHA1: a8e8efc33eb8468d23ed3d20b890f128c179e8ed) was identified as the initial dropper. A staging URL hxxp://cdn-login[ . ]tech/callback resolved to 10[.]143[.]117[.]212. Secondary artifact hash: SHA1: 663254acc13c6c7e14596ef3875b4dd07c6d16d7.


Incident Response Summary: On detection of anomalous traffic to 24[.]204[.]130[.]46, the INTERPOL IR team identified QakBot running as /home/user/.config/beacon.dll. The threat actor, believed to be Aqua Blizzard, used Impacket for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to secure-portal[ . ]link and backuplogin[.]net. The initial dropper (SHA1: e18ca283e50fd7dd3d3b395a86e8c03b980bc62b) was delivered via a phishing email from noreply@auth-check[.]org. A second C2 node was observed at 172 [ . ] 45 [ . ] 10 [ . ] 219, with a persistence mechanism writing to C:\Program Files\Common Files\agent.py.


The most widely infected major Android versions are KitKat with 50 percent , followed by Jelly Bean with 40 percent . If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit . APT33 : 64[.]251[.]19[.]231 [REDACTED][ . ]ddns[ . ]net . Adversaries may manipulate control systems devices or possibly leverage their own , to communicate with and command physical control processes .


Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens. This permits an attacker who recognised an HTTP-based Canarytoken (a URL) to execute Javascript in the Canarytoken's history page (domain: canarytokens[ . ]org) when the history page is later visited by the Canarytoken's creator. This vulnerability could be used to disable or delete the affected Canarytoken, or view its activation history. It might also be used as a stepping stone towards revealing more information about the Canarytoken's creator to the attacker. For example, an attacker could recover the email address tied to the Canarytoken, or place Javascript on the history page that redirect the creator towards an attacker-controlled Canarytoken to show the creator's network location. An attacker could only act on the discovered Canarytoken. This issue did not expose other Canarytokens or other Canarytoken creators. The issue has been patched on Canarytokens[ . ]org and in the latest release. No signs of successful exploitation of this vulnerability have been found. Users are advised to upgrade. There are no known workarounds for this issue.


Once launched , null will first verify whether it is able to fork on the system and that there is no other instance of itself currently running by checking whether the local port number 6842 is available . It has conducted attacks on similar organizations in Saudi Arabia , likely because of the access that those organizations have . Daily_Report[ . ]docx : The Winnti group diversified its targets to include enterprises such as those in pharmaceutics and telecommunications .


Blog Post by Trend Micro: Tracking Charming Kitten's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-27546 against Ivanti Connect Secure deployments. The initial access vector involves spear-phishing emails from billing@mail-service[.]info delivering Lumma Stealer. Post-compromise, the attackers deploy IcedID and use Mimikatz for reconnaissance. C2 infrastructure includes 145[.]45[.]185[.]197 and datasync[.]top. A staging server at hxxp://portalmail[ . ]net/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /usr/local/bin/update.dll (MD5: 74c2735811bcfaee412e6e4287e94239).


Figure 5 – Keylogger component Figure 6 shows one of the most noteworthy functions of Anubis : its ransomware module . Based on the profile of the victims and the type of information targeted by the attackers , Symantec believes that Butterfly is financially motivated , stealing information it can potentially profit from . FIN7 S-APT/GRIFFON : hpservice-cdn[ . ]com realtek-cdn[ . ]com logitech-cdn[.]com pci-cdn[ . ]com appleservice-cdn[ . ]com servicebing-cdn[ . ]com . On June 22 , @AnFam17 spotted the same fake browser update leveraging URL shortcuts .


A backdoor also known as: W32.DeadBeef.Worm Worm/W32.AutoRun.175104 Worm.Win32.AutoRun!O Worm.AutoRun.Win32.8121 W32/AutoRun.pv W32.SillyFDC Win32/Wainlas.A WORM_AUTORUN_000002c.TOMA Win.Worm.Autorun-1414 Worm.Win32.AutoRun.pv Trojan.Win32.AutoRun.ltul Win32.Worm.Autorun.Tbim Worm.Win32.AutoRun.~MAA Win32.HLLW.Autoruner.748 WORM_AUTORUN_000002c.TOMA Worm/AutoRun.bhu TR/Drop.AutoRun.BM Worm/Win32.AutoRun Worm.Win32.Autorun.12728 Worm.Win32.AutoRun.pv Worm/Win32.AutoRun.R16694 Worm.AutoRun Worm.Win32.AutoRun W32/AutoRun.NTQ!worm Trj/Debat.A Trojan[ . ]PSW[ . ]Win32[ . ]QQPass[ . ]CF


Symantec published a threat intelligence report linking APT29 to a new campaign exploiting CVE-2022-40108 in SonicWall SMA. The attackers deployed Latrodectus via BITSAdmin, establishing C2 communication with 13[.]176[.]195[.]202 and portalsecure[.]link. A secondary payload was downloaded from hxxp://datadata[ . ]info/gate.php. The malware binary (SHA256: 166d51ec8b6262b278b7a6e1347a8a4ec40242344b44da1cf87ab1c11d566a63) was dropped to C:\Program Files\Common Files\ntds.dit. Phishing emails were sent from confirm@urgent-notice[.]online targeting enterprise users. A backup C2 server was identified at 179 [ . ] 213 [ . ] 209 [ . ] 39.


Uploading any incoming SMS messages ( including the balance inquiry results ) to the remote C2 server . BlackOasis in recent months sent a wave of phishing emails . The second one is the setting of the persistence mechanism through the writing of the vbs code in the Startup folder with name “ templates[ . ]vbs ” . When Bradshaw refused to sell the domain , he and his then - girlfriend were subject to an unrelenting campaign of online harassment and blackmail .


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from confirm@mail-service[ . ]info and billing@login-portal[.]tech, spoofing legitimate services. Victims were directed to hxxp://cloud-data[ . ]top/secure/token which hosted a credential harvesting page on static-sync[ . ]tech. A secondary link hxxp://node-portal[.]net/download/update.exe delivered FormBook (MD5: 410cdd0ebbbe8086c372d4033dcca27d). The malware was saved to /opt/app/bin/payload.bin and established C2 with 172[.]95[.]204[.]77.


CISA detected a multi-stage attack chain. The initial phishing email from security@identity-verify[ . ]cc contained a link to hxxps://dataedge[.]xyz/api/v2/auth. This redirected to hxxps://edgemail[ . ]online/callback on backup-backup[.]site. A secondary email from info@credential-check[ . ]site pointed to hxxps://gatewayupdate[ . ]io/admin/config which delivered WarmCookie. The final payload callback was hxxps://apinode[ . ]top/admin/config resolving to 172 [ . ] 193 [ . ] 17 [ . ] 238 via edge-node[.]link.


Europol published a threat intelligence report linking Volt Typhoon to a new campaign exploiting CVE-2021-37696 in Ivanti Connect Secure. The attackers deployed Meduza Stealer via Ligolo, establishing C2 communication with 217[.]234[.]88[.]209 and data-backup[.]net. A secondary payload was downloaded from hxxp://mail-login[ . ]io/callback. The malware binary (SHA1: 36ac1f70c33bf6477c22d4076969fc664ef0b6db) was dropped to C:\Windows\System32\shell.php. Phishing emails were sent from service@identity-verify[ . ]cc targeting enterprise users. A backup C2 server was identified at 158[.]43[.]68[.]81.


Artifact Analysis for Hive campaign:
Stage 1 dropper at /usr/local/bin/lsass.dmp - SHA256: 1bcb0a6eed1c296651a768bb74cc64d005c762063547ff12704940f80d60384f
Stage 2 loader at C:\Users\Public\Documents\agent.py - SHA256: 665e5f2d382cea6d7f9da97bb0d4d87569a997beaee37f85e1ac143aea71c46a
Final payload at /tmp/loader.exe - MD5: fceb7b43f0db4102ab6a7afcb092763c
Exfiltration module - SHA1: 8fa3b6f7705cbdcd5780d42a8039942081baad88
All stages communicated with 172 [ . ] 254 [ . ] 153 [ . ] 182. Covenant signatures detected in Stage 2.


TG-3390 : 208[.]115[.]242[.]36 .


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 10 [ . ] 6 [ . ] 70 [ . ] 98
- 172 [ . ] 225 [ . ] 84 [ . ] 18
- 50 [ . ] 128 [ . ] 197 [ . ] 245
- storagecloud[.]live
- apimail[.]dev
URLs:
- hxxp://auth-update[.]tech/login
- hxxp://api-edge[ . ]online/login
Email Senders:
- notification@auth-check[.]org
- support@credential-check[ . ]site
File Indicators:
- MD5: 55bf2caa24753bb78545a256d07f7df6
- MD5: 823c55e38fb689af79d69524ac7a97e2
- Drop path: /tmp/helper.sh


Google TAG published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2026-10752 in Progress Telerik. The attackers deployed Cobalt Strike via ADFind, establishing C2 communication with 192 [ . ] 154 [ . ] 178 [ . ] 108 and static-mail[.]live. A secondary payload was downloaded from hxxps://relay-cloud[ . ]info/wp-content/uploads/doc.php. The malware binary (SHA256: bac29a9b6aeefd90b4e10c373953c04504252cfd57f3d6b883630053b3e6b62a) was dropped to C:\Windows\System32\beacon.dll. Phishing emails were sent from verify@account-update[.]xyz targeting enterprise users. A backup C2 server was identified at 192 [ . ] 120 [ . ] 98 [ . ] 31.


Dvmap : the first Android malware with code injection 08 JUN 2017 In April 2017 we started observing new rooting malware being distributed through the Google Play Store . Hackers first actively spread bots using the Niteris exploit , and then search for infected devices at banks amongst their bots by analyzing IP addresses , cracked passwords and results of the modules performance . The attached file , Reserva Advogados Associados[ . ]docx ( Attorneys Associates Reservation[.]docx ) , is a malicious Word file that drops a remote OLE object via template injection to execute macro code . Though few details are currently available about CVE-2023 - 37450 , Apple indicated it had been exploited in the wild and could be triggered by a vulnerable browser processing specially crafted web content .


Vetta Loader is a persistent Loader spreading with infected USB drives. It downloads other components leveraging legit hosting services.
hxxps://yoroi[.]company/wp-content/uploads/2023/12/202311-Vetta-Loader_Def-min.pdf


In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix mlx5e_priv_init() cleanup flow

When mlx5e_priv_init() fails, the cleanup flow calls mlx5e_selq_cleanup which
calls mlx5e_selq_apply() that assures that the `priv->state_lock` is held using
lockdep_is_held().

Acquire the state_lock in mlx5e_selq_cleanup().

Kernel log:
=============================
WARNING: suspicious RCU usage
6.8.0-rc3_net_next_841a9b5 #1 Not tainted
-----------------------------
drivers/net/ethernet/mellanox/mlx5/core/en/selq.c:124 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
2 locks held by systemd-modules/293:
 #0: ffffffffa05067b0 (devices_rwsem){++++}-{3:3}, at: ib_register_client+0x109/0x1b0 [ib_core]
 #1: ffff8881096c65c0 (&device->client_data_rwsem){++++}-{3:3}, at: add_client_context+0x104/0x1c0 [ib_core]

stack backtrace:
CPU: 4 PID: 293 Comm: systemd-modules Not tainted 6.8.0-rc3_net_next_841a9b5 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1[ . ]13[ . ]0-0-gf21b5a4aeb02-prebuilt[ . ]qemu[ . ]org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x8a/0xa0
 lockdep_rcu_suspicious+0x154/0x1a0
 mlx5e_selq_apply+0x94/0xa0 [mlx5_core]
 mlx5e_selq_cleanup+0x3a/0x60 [mlx5_core]
 mlx5e_priv_init+0x2be/0x2f0 [mlx5_core]
 mlx5_rdma_setup_rn+0x7c/0x1a0 [mlx5_core]
 rdma_init_netdev+0x4e/0x80 [ib_core]
 ? mlx5_rdma_netdev_free+0x70/0x70 [mlx5_core]
 ipoib_intf_init+0x64/0x550 [ib_ipoib]
 ipoib_intf_alloc+0x4e/0xc0 [ib_ipoib]
 ipoib_add_one+0xb0/0x360 [ib_ipoib]
 add_client_context+0x112/0x1c0 [ib_core]
 ib_register_client+0x166/0x1b0 [ib_core]
 ? 0xffffffffa0573000
 ipoib_init_module+0xeb/0x1a0 [ib_ipoib]
 do_one_initcall+0x61/0x250
 do_init_module+0x8a/0x270
 init_module_from_file+0x8b/0xd0
 idempotent_init_module+0x17d/0x230
 __x64_sys_finit_module+0x61/0xb0
 do_syscall_64+0x71/0x140
 entry_SYSCALL_64_after_hwframe+0x46/0x4e
 </TASK>


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at C:\Users\Public\Documents\lsass.dmp. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\payload.bin. Network forensics identified connections to 10 [ . ] 27 [ . ] 109 [ . ] 215 and securebackup[ . ]info. Email headers traced the initial vector to it@identity-verify[.]cc. File C:\Windows\System32\sam.hive (SHA1: f847f0475fed82c2a5d009f8a085124923436d4e) was identified as the initial dropper. A staging URL hxxps://api-auth[.]org/wp-content/uploads/doc.php resolved to 173[.]90[.]251[.]18. Secondary artifact hash: MD5: e07534afaa11fd0762aa8a8602f99fc2.


The threat actors appear to have leveraged publicly available exploit code that can be found on Github at the URL : hxxps://github[.]com/rxwx/CVE-2017-8570 . For example , we have observed frequent reuse of older ( patched ) exploits in malware operations against the Tibetan community .


Chisel is an open-source project by Jaime Pillora (jpillora) that allows tunneling TCP and UDP connections via HTTP. It is available across platforms and written in Go. While benign in itself, Chisel has been utilized by multiple threat actors. It was for example observed by SentinelOne during a PYSA ransomware campaign to achieve persistence and used as backdoor.
Github: hxxps://github[.]com/jpillora/chisel


Forensic Investigation Notes: Analysis of the compromised host revealed Seatbelt artifacts at /usr/local/bin/update.dll. Memory dump analysis confirmed execution of LaZagne. Registry modifications pointed to persistence via /usr/local/bin/payload.bin. Network forensics identified connections to 19[.]40[.]80[.]96 and node-cdn[.]online. Email headers traced the initial vector to info@document-share[ . ]link. File C:\Windows\System32\agent.py (MD5: 2fc8739d4c5ab2b5afcec4540af3074f) was identified as the initial dropper. A staging URL hxxps://data-mail[ . ]dev/secure/token resolved to 220 [ . ] 44 [ . ] 67 [ . ] 83. Secondary artifact hash: MD5: cfb71a80eb61496f0b8dcb2e661fabd9.


A backdoor also known as: Worm/W32.DipNet.139264 W32/DipNet.f Trojan.Win32.DipNet.emkm W32/Dipnet.F Trojan.Netdepix.B Win32/Dipnet.NAD Net-Worm.Win32.DipNet.f Worm.DipNet!vTuZ7jF3dLw Worm.Win32.DipNet.139264[h] W32.W.DipNet.f!c Virus.Win32.Part.a Worm.Win32.Dipnet.NAD BackDoor.Xdoor.351 Worm.DipNet.Win32.8 BehavesLike[ . ]Win32[ . ]Trojan[ . ]ch W32/Dipnet.XULH-0302 Worm/DipNet.a WORM/DipNet.b W32/Netdepix.B!worm Worm[Net]/Win32.DipNet Win32/Dipnet.worm.139264 Worm:Win32/DipNet.H Win32/Oddbob.E Net-Worm.DipNet W32/Oddbob.E.worm Backdoor.Win32.Xdoor Worm/Dipnet.M Worm.Win32.DipNet.aMVE


Trend Micro published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2024-19363 in Cisco ASA. The attackers deployed TrickBot via Merlin, establishing C2 communication with 10[.]124[.]52[.]179 and mailapi[.]io. A secondary payload was downloaded from hxxp://updategateway[ . ]live/api/v2/auth. The malware binary (MD5: 07249a544d17e701e0372ed140c27327) was dropped to /etc/cron.d/sam.hive. Phishing emails were sent from noreply@identity-verify[ . ]cc targeting enterprise users. A backup C2 server was identified at 218 [ . ] 61 [ . ] 21 [ . ] 89.


Microsoft MSRC published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2025-45322 in Cisco ASA. The attackers deployed Dridex via Metasploit, establishing C2 communication with 192 [ . ] 86 [ . ] 33 [ . ] 94 and gateway-proxy[ . ]info. A secondary payload was downloaded from hxxp://portalmail[.]online/gate.php. The malware binary (SHA1: f41c15beab8bb6c53694a6b74a6693a860692dee) was dropped to /usr/local/bin/payload.bin. Phishing emails were sent from updates@secure-verify[.]net targeting enterprise users. A backup C2 server was identified at 172 [ . ] 102 [ . ] 206 [ . ] 32.


IOC Bulletin - Latrodectus Campaign:
Network Indicators:
- 10[.]205[.]20[.]236
- 192 [ . ] 251 [ . ] 22 [ . ] 10
- 39[.]64[.]41[.]136
- mailrelay[ . ]dev
- cachegateway[.]tech
URLs:
- hxxps://storage-login[.]online/assets/js/payload.js
- hxxp://mail-static[ . ]cc/api/v2/auth
Email Senders:
- alert@mail-service[.]info
- billing@auth-check[ . ]org
File Indicators:
- SHA1: c071fbae3550fb7e50e7d112a7f0d450f3ae2ad5
- SHA1: fefcc6e631c1ef450715220f048b04f50993f717
- Drop path: /tmp/update.dll


The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.

The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web):  hxxps://github[.]com/eclipse-vertx/vert.x/pull/5895

Steps to reproduce
Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example hxxps://example[.]com/foo/index.html can be denied with hxxps://example[ . ]com/foo/bar%2F..%2Findex.html

Mitgation
Disabling Static Handler cache fixes the issue.

StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);


JuiceLedger is a threat actor known for infostealing through their JuiceStealer .NET assembly. They have evolved from spreading fraudulent applications to conducting supply chain attacks, targeting PyPI contributors with phishing campaigns and typosquatting. Their malicious packages contain a code snippet that downloads and executes JuiceStealer, which has evolved to support additional browsers and Discord. Victims of JuiceLedger attacks are advised to reset passwords and report any suspicious activity to security@pypi[ . ]org.


IOC Bulletin - SmokeLoader Campaign:
Network Indicators:
- 118 [ . ] 245 [ . ] 209 [ . ] 222
- 20 [ . ] 121 [ . ] 223 [ . ] 88
- 5 [ . ] 17 [ . ] 46 [ . ] 179
- staticmail[ . ]club
- relaynode[ . ]xyz
URLs:
- hxxps://cachecloud[.]site/api/v2/auth
- hxxp://apilogin[.]top/login
Email Senders:
- contact@identity-verify[ . ]cc
- alert@urgent-notice[.]online
File Indicators:
- SHA256: 0a15bd5951703f091bd9efc7ca0720d1173973a627624c704fe12d231461e0f4
- SHA256: 0e0aa25ec710d059739c30dd0662252817cd8f33c114157c66830f53b70a5b9f
- Drop path: /opt/app/bin/helper.sh


Artifact Analysis for Royal campaign:
Stage 1 dropper at /var/tmp/taskhost.exe - SHA1: f8e95e214e3679b5d836b6292ed4f7e3cb9acc91
Stage 2 loader at /var/tmp/beacon.dll - SHA256: 7c812af944df48ca140539c161c7859d9e6133dae2cb848605149fe4122ce059
Final payload at /dev/shm/backdoor.elf - SHA1: 6d846d93d899729fe7bbac0619454d9e46234e20
Exfiltration module - SHA1: 63ca06c5b1e4acfdd0266369c4ce0d22318bfff4
All stages communicated with 10[.]30[.]174[.]190. Nmap signatures detected in Stage 2.


In the Linux kernel, the following vulnerability has been resolved:

erspan: Initialize options_len before referencing options.

The struct ip_tunnel_info has a flexible array member named
options that is protected by a counted_by(options_len)
attribute.

The compiler will use this information to enforce runtime bounds
checking deployed by FORTIFY_SOURCE string helpers.

As laid out in the GCC documentation, the counter must be
initialized before the first reference to the flexible array
member.

After scanning through the files that use struct ip_tunnel_info
and also refer to options or options_len, it appears the normal
case is to use the ip_tunnel_info_opts_set() helper.

Said helper would initialize options_len properly before copying
data into options, however in the GRE ERSPAN code a partial
update is done, preventing the use of the helper function.

Before this change the handling of ERSPAN traffic in GRE tunnels
would cause a kernel panic when the kernel is compiled with
GCC 15+ and having FORTIFY_SOURCE configured:

memcpy: detected buffer overflow: 4 byte write of buffer size 0

Call Trace:
 <IRQ>
 __fortify_panic+0xd/0xf
 erspan_rcv.cold+0x68/0x83
 ? ip_route_input_slow+0x816/0x9d0
 gre_rcv+0x1b2/0x1c0
 gre_rcv+0x8e/0x100
 ? raw_v4_input+0x2a0/0x2b0
 ip_protocol_deliver_rcu+0x1ea/0x210
 ip_local_deliver_finish+0x86/0x110
 ip_local_deliver+0x65/0x110
 ? ip_rcv_finish_core+0xd6/0x360
 ip_rcv+0x186/0x1a0

Reported-at: hxxps://launchpad[ . ]net/bugs/2129580


A backdoor also known as: Trojan[ . ]Crypt[ . ]ES Trojan[ . ]Crypt[ . ]ES Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan[.]Crypt[.]ES Trojan.Win32.Crypt.ewgrry Trojan[ . ]Crypt[ . ]ES Trojan[.]Crypt[.]ES BehavesLike.Win32.BadFile.lm Backdoor:Win32/Huceqoo.A Trojan.Win32.Z.Crypt.73728.BQ Trojan/Win32.Scar.C8074 Trojan[.]Crypt[.]ES BScope.Trojan.Dropper.we Trj/GdSda.A Trojan[.]Crypt[.]ES Win32/Trojan.b63


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.R Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Worm.GBYU-0953 W32[.]Virut[.]CF Win32/Virut.17408 PE_VIRUX.R Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Worm.Win32.Delf.579072 Virus.Win32.Virut.CE Win32.Virut.56 Virus.Virut.Win32.1938 Virus.Win32.Ramnit W32/Worm.APDA Win32/Virut.bt Virus/Win32.Virut.ce W32.Virut.lJ4T Virus.Win32.Virut.ce HEUR/Fakon.mwf Virus.Virut.14 W32/Sality.AO Virus.Win32.Virut.M


CrowdStrike detected a multi-stage attack chain. The initial phishing email from report@auth-check[.]org contained a link to hxxp://secureproxy[.]live/collect. This redirected to hxxps://login-gateway[ . ]club/collect on login-backup[ . ]com. A secondary email from report@urgent-notice[.]online pointed to hxxp://syncsecure[.]online/assets/js/payload.js which delivered BatLoader. The final payload callback was hxxp://static-data[.]club/callback resolving to 192 [ . ] 213 [ . ] 38 [ . ] 171 via securenode[ . ]net.


Malware Analysis Report: BumbleBee (MD5: df5ee9ef1c10d7be6b403da2975112d7). Upon execution on SonicWall SMA, the sample creates C:\Users\admin\Downloads\svchost.exe and injects into legitimate processes. Network analysis shows beaconing to 209 [ . ] 201 [ . ] 20 [ . ] 89 every 60 seconds and DNS queries to relaycache[.]live. The second stage was fetched from hxxps://portal-gateway[ . ]top/wp-content/uploads/doc.php and written to /opt/app/bin/taskhost.exe. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (SHA1: 98a9aba421b7fcbc90318065dc0b2b1883d01c51) was extracted from the unpacked payload.


Blog Post by Tenable: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-26049 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from service@secure-verify[ . ]net delivering Play. Post-compromise, the attackers deploy ShadowPad and use PsExec for reconnaissance. C2 infrastructure includes 172 [ . ] 84 [ . ] 0 [ . ] 244 and nodeapi[ . ]top. A staging server at hxxps://logincache[ . ]xyz/collect hosts additional tooling. Key artifact: /etc/cron.d/update.dll (SHA1: 62f7316c6465a4675d457101dd9a70c5db65c6df).


QakBot C2 server 178[.]62[.]3[.]223 was first observed on 2026-02-17 communicating over port 443. A second QakBot command-and-control node at 27[.]133[.]154[.]218:443 appeared on 2026-03-04. Both servers are hosted on commercial VPS infrastructure and use TLS encryption to evade detection.


A backdoor also known as: Win32.Redrac.A@mm Win32.Redrac.A@mm Win32.Redrac.A@mm Trojan.Win32.Redrac.enor W32.Redrac@mm Win32/Redrac.A Email-Worm.Win32.Redrac Win32.Redrac.A@mm Worm.Redrac!vQPr8wluFnM W32.W.Redrac!c Win32.Redrac.A@mm Worm.Win32.Redrac.A Win32.Redrac.A@mm Win32.HLLM.Redrac Worm.Redrac.Win32.1 BehavesLike[ . ]Win32[ . ]AdwareRBlast[ . ]cc W32/Redrac.AFIQ-7566 Worm/Sramota.axa WORM/Redrac.A Worm[Email]/Win32.Redrac Win32.Redrac.E90817 Trojan/Win32.Xema Worm:Win32/Redrac.A@mm Virus.Win32.Heur.l W32/Gnome.C.worm Win32.Redrac.A@mm I-Worm/Redrac.A


Internal name : snd[.]dll File format : PE32 DLL MD5: 8c4d896957c36ec4abeb07b2802268b9 Linker version : 11.0 , Microsoft Visual Studio Linker timestamp : 2015.07.24 12:07:27 ( GMT ) Exported functions :


APT29 used Rubeus for credential dumping and BloodHound for lateral movement. Credentials were exfiltrated to 151 [ . ] 90 [ . ] 165 [ . ] 131. The attacker pivoted to 181[.]174[.]252[.]216 and dropped C:\Windows\Temp\procdump64.exe (MD5: a3889edbfc83694edfd257f9b0b7d090). C2 traffic was routed through fast-cdn[[ . ]]xyz.


Vulnerability Advisory: CVE-2026-44676 is a critical use-after-free affecting Windows 11. FBI confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers BatLoader (SHA1: 94b48ca18ad4d8cd33111a1921277cca12b27f3e) which is dropped to /home/user/.config/shell.php. The exploit payload is hosted at hxxp://storage-gateway[ . ]org/assets/js/payload.js and communicates to 147 [ . ] 136 [ . ] 127 [ . ] 60 for C2.


A backdoor also known as: Trojan.Tinba.WR4 Trojan/Tinba[.]be Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Tinba.dqteol TrojWare[.]Win32[.]Roitamit[.]BE Trojan.PWS.Tinba.153 Trojan.Tinba.Win32.1916 TR/Crypt.ZPACK.137753 Trojan/Win32.Skeeyah.R216296 Trojan.Tinba Win32/Tinba[ . ]BE Trojan.Tinba!GN4G+jbMfD0 Trojan.Win32.Tinba W32/Tinba[ . ]BE!tr Win32/Trojan.6ed


A backdoor also known as: Ransom.Exxroute.A3 Trojan.Ransom.Lukitos.1 Ransom_CERBER.SM37 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Ramnit!dr Ransom_CERBER.SM37 Trojan.PWS.Sphinx.2 BehavesLike[.]Win32[.]Ransomware[.]cc Trojan:Win32/CeeInject.MJ!bit Trojan/Win32.Fareit.R189070 Trj/GdSda.A


Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort[ . ]org . The presence of code to exfiltrate data to removable drives when there is physical access to a compromised computer may indicate that Machete operators could have a presence in one of the targeted countries , although we cannot be certain . During this heist , APT38 waited for a holiday weekend in the respective countries to increase the likelihood of hiding the transactions from banking authorities .


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at C:\ProgramData\loader.exe. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via /usr/local/bin/payload.bin. Network forensics identified connections to 115[.]156[.]83[.]41 and proxyproxy[.]link. Email headers traced the initial vector to it@login-portal[ . ]tech. File /var/tmp/runtime.dll (MD5: 85a1466e4e86f82b6d0fe8baa0dc4781) was identified as the initial dropper. A staging URL hxxp://secure-secure[ . ]site/assets/js/payload.js resolved to 192[.]165[.]213[.]176. Secondary artifact hash: SHA1: 9fbafb71b8fccb96f76d8d18debe2e07d6de6604.


But some clues , such as the existence of a hidden menu for operator control , point to a manual installation method – the attackers used physical access to a victim ’ s device to install the malware . According to trusted third-party reporting , HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace , telecommunications , and finance industries . Later at 20:57 , the attackers became active on the compromised machine and proceeded to download the archiving tool WinRAR . 89[.]34[.]237[.]118 808 hxxp://89[.]34[.]237[.]118:808/Rar32.exe . Based on the use of domain names they registered , the group started out in the business of fake / rogue anti - virus products in 2007 .


The message was sent from an account created under her name on lesser known email provider 1 1's Mail[ . ]com, a common tactic in recent months, with a link to a file hosted on Dropbox and an additional credential phishing attempt.


Figure 8 . Additionally , there is evidence to suggest APT33 targeted Saudi Arabian and Western organizations that provide training , maintenance and support for Saudi Arabia 's military and commercial fleets . The malicious DLL exports the same function names as the original mcvsocfg[.]dll library . HHS HC3 warned that the stolen credentials may have been used to compromise a number of healthcare organizations and enterprises in other industries .


Powerview[ . ]ps1 — This PowerShell-based module for network reconnaissance is part of the PowerSploit penetration testing framework .


TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`. This is because the implementation(hxxps://github[.]com/tensorflow/tensorflow/blob/55a97caa9e99c7f37a0bbbeb414dc55553d3ae7f/tensorflow/core/kernels/quantized_batch_norm_op.cc) does not validate all constraints specified in the op's contract(hxxps://www[ . ]tensorflow[ . ]org/api_docs/python/tf/raw_ops/QuantizedBatchNormWithGlobalNormalization). The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.


In the Linux kernel, the following vulnerability has been resolved:

io_uring/io-wq: Use set_bit() and test_bit() at worker->flags

Utilize set_bit() and test_bit() on worker->flags within io_uring/io-wq
to address potential data races.

The structure io_worker->flags may be accessed through various data
paths, leading to concurrency issues. When KCSAN is enabled, it reveals
data races occurring in io_worker_handle_work and
io_wq_activate_free_worker functions.

	 BUG: KCSAN: data-race in io_worker_handle_work / io_wq_activate_free_worker
	 write to 0xffff8885c4246404 of 4 bytes by task 49071 on cpu 28:
	 io_worker_handle_work (io_uring/io-wq.c:434 io_uring/io-wq.c:569)
	 io_wq_worker (io_uring/io-wq.c:?)
<snip>

	 read to 0xffff8885c4246404 of 4 bytes by task 49024 on cpu 5:
	 io_wq_activate_free_worker (io_uring/io-wq.c:? io_uring/io-wq.c:285)
	 io_wq_enqueue (io_uring/io-wq.c:947)
	 io_queue_iowq (io_uring/io_uring.c:524)
	 io_req_task_submit (io_uring/io_uring.c:1511)
	 io_handle_tw_list (io_uring/io_uring.c:1198)
<snip>

Line numbers against commit 18daea77cca6 ("Merge tag 'for-linus' of
git://git[.]kernel[.]org/pub/scm/virt/kvm/kvm").

These races involve writes and reads to the same memory location by
different tasks running on different CPUs. To mitigate this, refactor
the code to use atomic operations such as set_bit(), test_bit(), and
clear_bit() instead of basic "and" and "or" operations. This ensures
thread-safe manipulation of worker flags.

Also, move `create_index` to avoid holes in the structure.


In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

As Dipanjan Das <mail.dipanjan.das@gmail[ . ]com> reported, syzkaller
found a f2fs bug as below:

RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295
Call Trace:
 write_all_xattrs fs/f2fs/xattr.c:487 [inline]
 __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743
 f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790
 f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86
 __vfs_setxattr+0x115/0x180 fs/xattr.c:182
 __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216
 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277
 vfs_setxattr+0x13f/0x330 fs/xattr.c:303
 setxattr+0x146/0x160 fs/xattr.c:611
 path_setxattr+0x1a7/0x1d0 fs/xattr.c:630
 __do_sys_lsetxattr fs/xattr.c:653 [inline]
 __se_sys_lsetxattr fs/xattr.c:649 [inline]
 __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

NAT entry and nat bitmap can be inconsistent, e.g. one nid is free
in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it
may trigger BUG_ON() in f2fs_new_node_page(), fix it.


In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix kernel crash during reboot when adapter is in recovery mode

If the driver detects during probe that firmware is in recovery
mode then i40e_init_recovery_mode() is called and the rest of
probe function is skipped including pci_set_drvdata(). Subsequent
i40e_shutdown() called during shutdown/reboot dereferences NULL
pointer as pci_get_drvdata() returns NULL.

To fix call pci_set_drvdata() also during entering to recovery mode.

Reproducer:
1) Lets have i40e NIC with firmware in recovery mode
2) Run reboot

Result:
[  139.084698] i40e: Intel(R) Ethernet Connection XL710 Network Driver
[  139.090959] i40e: Copyright (c) 2013 - 2019 Intel Corporation.
[  139.108438] i40e 0000:02:00.0: Firmware recovery mode detected. Limiting functionality.
[  139.116439] i40e 0000:02:00.0: Refer to the Intel(R) Ethernet Adapters and Devices User Guide for details on firmware recovery mode.
[  139.129499] i40e 0000:02:00.0: fw 8.3.64775 api 1.13 nvm 8.30 0x8000b78d 1.3106.0 [8086:1583] [15d9:084a]
[  139.215932] i40e 0000:02:00.0 enp2s0f0: renamed from eth0
[  139.223292] i40e 0000:02:00.1: Firmware recovery mode detected. Limiting functionality.
[  139.231292] i40e 0000:02:00.1: Refer to the Intel(R) Ethernet Adapters and Devices User Guide for details on firmware recovery mode.
[  139.244406] i40e 0000:02:00.1: fw 8.3.64775 api 1.13 nvm 8.30 0x8000b78d 1.3106.0 [8086:1583] [15d9:084a]
[  139.329209] i40e 0000:02:00.1 enp2s0f1: renamed from eth0
...
[  156.311376] BUG: kernel NULL pointer dereference, address: 00000000000006c2
[  156.318330] #PF: supervisor write access in kernel mode
[  156.323546] #PF: error_code(0x0002) - not-present page
[  156.328679] PGD 0 P4D 0
[  156.331210] Oops: 0002 [#1] PREEMPT SMP NOPTI
[  156.335567] CPU: 26 PID: 15119 Comm: reboot Tainted: G            E      6.2.0+ #1
[  156.343126] Hardware name: Abacus electric, s.r.o. - servis@abacus[ . ]cz Super Server/H12SSW-iN, BIOS 2.4 04/13/2022
[  156.353369] RIP: 0010:i40e_shutdown+0x15/0x130 [i40e]
[  156.358430] Code: c1 fc ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 55 48 89 fd 53 48 8b 9f 48 01 00 00 <f0> 80 8b c2 06 00 00 04 f0 80 8b c0 06 00 00 08 48 8d bb 08 08 00
[  156.377168] RSP: 0018:ffffb223c8447d90 EFLAGS: 00010282
[  156.382384] RAX: ffffffffc073ee70 RBX: 0000000000000000 RCX: 0000000000000001
[  156.389510] RDX: 0000000080000001 RSI: 0000000000000246 RDI: ffff95db49988000
[  156.396634] RBP: ffff95db49988000 R08: ffffffffffffffff R09: ffffffff8bd17d40
[  156.403759] R10: 0000000000000001 R11: ffffffff8a5e3d28 R12: ffff95db49988000
[  156.410882] R13: ffffffff89a6fe17 R14: ffff95db49988150 R15: 0000000000000000
[  156.418007] FS:  00007fe7c0cc3980(0000) GS:ffff95ea8ee80000(0000) knlGS:0000000000000000
[  156.426083] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  156.431819] CR2: 00000000000006c2 CR3: 00000003092fc005 CR4: 0000000000770ee0
[  156.438944] PKRU: 55555554
[  156.441647] Call Trace:
[  156.444096]  <TASK>
[  156.446199]  pci_device_shutdown+0x38/0x60
[  156.450297]  device_shutdown+0x163/0x210
[  156.454215]  kernel_restart+0x12/0x70
[  156.457872]  __do_sys_reboot+0x1ab/0x230
[  156.461789]  ? vfs_writev+0xa6/0x1a0
[  156.465362]  ? __pfx_file_free_rcu+0x10/0x10
[  156.469635]  ? __call_rcu_common.constprop.85+0x109/0x5a0
[  156.475034]  do_syscall_64+0x3e/0x90
[  156.478611]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[  156.483658] RIP: 0033:0x7fe7bff37ab7


Multiple Ryuk samples identified:
- SHA256: 75d25a29646de86ae604bf927fefdba5af3d3d04b806bf8be3ab4f0fd9bfb0d0
- SHA256: eaed36f53105a93364c678de8fd8560673f4cb5c300594540bfc0c7c7e29bd01
- MD5: 82752ae2f5d6008330bcc2d4cab188b2
- MD5: eefcb459329b2a8358f28e4833326f5e
All samples beacon to 185 [ . ] 169 [ . ] 50 [ . ] 103 and fast-cdn[[ . ]]xyz.


Blog Post by Tenable: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-24373 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from service@secure-verify[ . ]net delivering TrickBot. Post-compromise, the attackers deploy BumbleBee and use Sliver for reconnaissance. C2 infrastructure includes 192 [ . ] 95 [ . ] 237 [ . ] 112 and syncedge[ . ]org. A staging server at hxxps://cloudmail[ . ]com/gate.php hosts additional tooling. Key artifact: C:\Program Files\Common Files\csrss.exe (SHA1: d9b08c98352efc57e7a6bfeccf68f795c452f86f).


Vulnerability Advisory: CVE-2024-27546 is a critical privilege escalation affecting Windows 11. SentinelOne confirmed active exploitation by OilRig in the wild. Exploitation delivers XLoader (SHA1: d1695472df975d7ad4802c5d249cd422d6a89470) which is dropped to C:\Users\admin\AppData\Local\Temp\chrome_helper.exe. The exploit payload is hosted at hxxps://cachecache[.]com/callback and communicates to 19[.]17[.]30[.]105 for C2.


Blog Post by Palo Alto Unit 42: Tracking UNC2452's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from alert@auth-check[ . ]org delivering RemcosRAT. Post-compromise, the attackers deploy Ryuk and use LaZagne for reconnaissance. C2 infrastructure includes 104 [ . ] 143 [ . ] 5 [ . ] 41 and gateway-login[.]io. A staging server at hxxps://auth-static[ . ]xyz/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /usr/local/bin/helper.sh (SHA256: 4605af2baca54892eb0e528de909c882e832bbb79835d920b82ccec650ad7829).


Lazarus Group, also known as Hidden Cobra and attributed to North Korea's RGB, conducted the TraderTraitor campaign targeting cryptocurrency firms. The FBI and CISA published a joint advisory documenting the attacks. The group distributed trojanized cryptocurrency trading applications with SHA256 hashes e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6 and b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0. The applications connected to C2 infrastructure at api-trader[.]chainfund[.]io and exchange-data[.]cryptonode[.]org on port 8443. Malicious payloads were hosted at hxxps://api-trader[ . ]chainfund[ . ]io/v2/update/electron.asar. The backdoor was installed to /Library/Application Support/.daemon/updater and ~/Library/LaunchAgents/com.apple.update.plist on macOS targets. C2 IP addresses included 104[.]168[.]174[.]22 and 107 [ . ] 189 [ . ] 10 [ . ] 143. The group also used social engineering via LinkedIn, sending messages from accounts like recruit@hrnodes[ . ]io.


Blog Post by Europol: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-37651 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from security@credential-check[.]site delivering Ryuk. Post-compromise, the attackers deploy SmokeLoader and use Havoc for reconnaissance. C2 infrastructure includes 114[.]50[.]7[.]170 and update-sync[.]top. A staging server at hxxp://nodeproxy[ . ]dev/portal/verify hosts additional tooling. Key artifact: /home/user/.config/shell.php (SHA256: 48543e3f2e319fbaaf263854e8b40567843b8858b0e07684f183e7166d1c66ce).


Cisco Talos detected a multi-stage attack chain. The initial phishing email from notification@auth-check[ . ]org contained a link to hxxp://backup-portal[.]cc/gate.php. This redirected to hxxp://secureapi[ . ]io/download/update.exe on relay-auth[ . ]site. A secondary email from updates@document-share[ . ]link pointed to hxxp://relaycache[.]top/download/update.exe which delivered DarkSide. The final payload callback was hxxp://proxyportal[.]top/gate.php resolving to 172[.]233[.]189[.]178 via apisync[.]io.


Open sourced javascript info stealer, with the capabilities of stealing crypto wallets, password, cookies and modify discord clients hxxps://github[ . ]com/doener2323/doenerium


OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowed_idps configuration trait of CILogonOAuthenticator is documented to be a list of domains that indicate the institutions whose users are authorized to access this JupyterHub. This authorization is validated by ensuring that the *email* field provided to us by CILogon has a *domain* that matches one of the domains listed in `allowed_idps`.If `allowed_idps` contains `berkeley[ . ]edu`, you might expect only users with valid current credentials provided by University of California, Berkeley to be able to access the JupyterHub. However, CILogonOAuthenticator does *not* verify which provider is used by the user to login, only the email address provided. So a user can login with a GitHub account that has email set to `<something>@berkeley[.]edu`, and that will be treated exactly the same as someone logging in using the UC Berkeley official Identity Provider. The patch fixing this issue makes a *breaking change* in how `allowed_idps` is interpreted. It's no longer a list of domains, but configuration representing the `EntityID` of the IdPs that are allowed, picked from the [list maintained by CILogon](hxxps://cilogon[ . ]org/idplist/). Users are advised to upgrade.


First described by Kaspersky in 2014 and later by Cylance in 2017 , Machete is a piece of malware found to be targeting high profile individuals and organizations in Latin American countries . The initial indicator of the attack was a malicious Web shell that was detected on an IIS server , coming out of the w3wp[.]exe process .


Forensic Investigation Notes: Analysis of the compromised host revealed Hashcat artifacts at C:\Users\Public\Documents\implant.so. Memory dump analysis confirmed execution of PowerView. Registry modifications pointed to persistence via /dev/shm/sam.hive. Network forensics identified connections to 196 [ . ] 218 [ . ] 79 [ . ] 70 and nodeportal[.]live. Email headers traced the initial vector to helpdesk@document-share[.]link. File /var/tmp/taskhost.exe (MD5: c6515cb220045fcce617de02f8fe2101) was identified as the initial dropper. A staging URL hxxp://proxy-portal[ . ]io/admin/config resolved to 184[.]77[.]100[.]203. Secondary artifact hash: SHA256: d39e3adb7100acd0703fe52a6097a1c21474858b1506a591f9aca812610b6e2d.


Incident Response Summary: On detection of anomalous traffic to 192[.]227[.]43[.]207, the NCSC IR team identified TrickBot running as C:\Users\admin\Desktop\backdoor.elf. The threat actor, believed to be FIN11, used GhostPack for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to storage-gateway[.]org and updatenode[ . ]tech. The initial dropper (SHA256: 3efdb9dbe144dc9e664bbbfcfc5ebf2efb9b49ceb24a0c93791075f1b0dacc46) was delivered via a phishing email from security@mail-service[ . ]info. A second C2 node was observed at 103 [ . ] 23 [ . ] 251 [ . ] 221, with a persistence mechanism writing to C:\ProgramData\taskhost.exe.


DNS analysis for Agent Tesla infrastructure: smtp-relay[[.]]icu resolved to 80 [ . ] 68 [ . ] 36 [ . ] 64, phish-kit[[.]]xyz resolved to 213[.]68[.]192[.]150, and share-files[[ . ]]biz was used as a DNS-over-HTTPS tunnel. The implant hash is a780ced71594af256b57e8911b0ab73a.


Google TAG detected a multi-stage attack chain. The initial phishing email from security@auth-check[.]org contained a link to hxxp://maildata[ . ]tech/gate.php. This redirected to hxxp://proxynode[.]tech/assets/js/payload.js on cdnbackup[.]org. A secondary email from service@credential-check[.]site pointed to hxxp://storagenode[ . ]xyz/api/v2/auth which delivered PikaBot. The final payload callback was hxxp://relay-backup[ . ]info/wp-content/uploads/doc.php resolving to 10 [ . ] 61 [ . ] 245 [ . ] 208 via syncstorage[ . ]com.


Malware Analysis Report: IcedID (SHA256: 073ef0072781e5ffc16ce5bd909ccc097d9f21765a28b97732d29731aaa27563). Upon execution on Windows Server 2019, the sample creates C:\Users\Public\Documents\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 172 [ . ] 224 [ . ] 12 [ . ] 224 every 60 seconds and DNS queries to apidata[.]cc. The second stage was fetched from hxxps://edgesecure[ . ]org/login and written to C:\Program Files\Common Files\loader.exe. The payload uses Certutil-style techniques for defense evasion. A secondary hash (SHA256: 7f22279bb920973cb46e02994674ecff74a47cd9be1eca2f2e637a53d001f1db) was extracted from the unpacked payload.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from report@account-update[ . ]xyz and billing@login-portal[ . ]tech, spoofing legitimate services. Victims were directed to hxxp://apirelay[ . ]info/secure/token which hosted a credential harvesting page on edge-portal[.]xyz. A secondary link hxxp://backuplogin[ . ]live/login delivered Qbot (SHA256: da2e3d0c8d304194d39c9aa3b1ca09580e54e3029bdab02c77cb7946e22ab787). The malware was saved to C:\Users\admin\Desktop\runtime.dll and established C2 with 192[.]182[.]195[.]229.


TensorFlow is an end-to-end open source platform for machine learning. In affected versions providing a negative element to `num_elements` list argument of `tf.raw_ops.TensorListReserve` causes the runtime to abort the process due to reallocating a `std::vector` to have a negative number of elements. The [implementation](hxxps://github[ . ]com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/list_kernels.cc#L312) calls `std::vector.resize()` with the new size controlled by input given by the user, without checking that this input is valid. We have patched the issue in GitHub commit 8a6e874437670045e6c7dc6154c7412b4a2135e2. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.


FireEye published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2022-25256 in Palo Alto PAN-OS. The attackers deployed PlugX via BloodHound, establishing C2 communication with 40 [ . ] 43 [ . ] 57 [ . ] 190 and authbackup[ . ]online. A secondary payload was downloaded from hxxp://updatestorage[ . ]xyz/wp-content/uploads/doc.php. The malware binary (SHA1: 174dfec32c8c594e215f44d70f76b0404284931a) was dropped to /usr/local/bin/dropper.ps1. Phishing emails were sent from verify@document-share[.]link targeting enterprise users. A backup C2 server was identified at 10[.]75[.]147[.]4.


Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20 [ . ] 3 [ . ] 1 [ . ] 2 and 21 [ . ] 0 [ . ] 0 [ . ] 2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from service@identity-verify[ . ]cc and it@identity-verify[ . ]cc, spoofing legitimate services. Victims were directed to hxxps://securestatic[ . ]live/collect which hosted a credential harvesting page on storage-storage[ . ]xyz. A secondary link hxxp://login-storage[.]online/portal/verify delivered StealC (SHA1: 6fc7007f58cc5584914a46c4d4333999c92f9dcb). The malware was saved to C:\Program Files\Common Files\svchost.exe and established C2 with 189 [ . ] 152 [ . ] 69 [ . ] 149.


Malware Analysis Report: XLoader (SHA1: 038433fda6e93adcf2f6b92249df058a5d144b9c). Upon execution on MOVEit Transfer, the sample creates /dev/shm/loader.exe and injects into legitimate processes. Network analysis shows beaconing to 17 [ . ] 43 [ . ] 74 [ . ] 198 every 60 seconds and DNS queries to mail-sync[ . ]site. The second stage was fetched from hxxps://relaystorage[.]info/portal/verify and written to /dev/shm/lsass.dmp. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA256: da5728de5cff60ed9bfd581adfa2150989cc57af5f803e8d755f97f65e01c475) was extracted from the unpacked payload.


Typically , however , cybercriminals first test-run a technology on the Russian sector of the Internet and then roll it out globally , attacking users in other countries . The codename for Turla APT group in this presentation is MAKERSMARK . Winnti : CLR[.]exe . We searched for the unique string and identified a single match to a cyber range ( aka polygon ) developed by Rostelecom - Solar , a Russian cyber security company that received a government in 2019 to begin training cyber security experts and conducting electric power disruption and emergency response exercises .


Shamoon2 : 104 [ . ] 218 [ . ] 120 [ . ] 128 .


Artifact Analysis for Lumma Stealer campaign:
Stage 1 dropper at C:\Windows\System32\update.dll - SHA1: 8bbb74922c4ac80bb9548a9ca50a0cf07773f406
Stage 2 loader at C:\Users\admin\Desktop\dropper.ps1 - SHA256: 19549578513cec2aef4c23c919224015c87e850eab68f36d646b1f7a69bd56c1
Final payload at C:\Windows\System32\shell.php - SHA1: 1aef6245b355faa7477201663bf9fae816bdc935
Exfiltration module - SHA1: 4cab829dd8d16c3f9e61f4599232857f479198c8
All stages communicated with 88[.]21[.]88[.]238. Mythic signatures detected in Stage 2.


Incident Response Summary: On detection of anomalous traffic to 125 [ . ] 224 [ . ] 114 [ . ] 227, the Rapid7 IR team identified Gootloader running as C:\Users\admin\Downloads\svchost.exe. The threat actor, believed to be Turla, used Metasploit for credential harvesting and Burp Suite for lateral movement. Exfiltrated data was sent to sync-login[.]net and edge-node[.]link. The initial dropper (SHA1: 057b8eafab20c3e2af169470e2becbae2a3e3c97) was delivered via a phishing email from billing@phishing-domain[.]com. A second C2 node was observed at 172[.]132[.]54[.]237, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\dropper.ps1.


Trend Micro detected a multi-stage attack chain. The initial phishing email from alert@phishing-domain[ . ]com contained a link to hxxps://secure-auth[.]club/callback. This redirected to hxxps://secure-cdn[.]tech/callback on logincloud[ . ]site. A secondary email from support@account-update[ . ]xyz pointed to hxxp://cdnportal[.]dev/admin/config which delivered Cobalt Strike. The final payload callback was hxxps://storage-edge[ . ]io/portal/verify resolving to 192 [ . ] 192 [ . ] 251 [ . ] 104 via cachesync[.]net.


Artifact Analysis for BlackCat campaign:
Stage 1 dropper at C:\Windows\Tasks\helper.sh - SHA256: 640a97f94a3ac1e0811517f9f39a4a12ae08219a956019a463e072ab2e26838f
Stage 2 loader at C:\Users\Public\Documents\lsass.dmp - SHA1: 587f425dcf610f037b556aafd402842a7712c79d
Final payload at /tmp/helper.sh - SHA1: e77ef94cf33dea9f8d97c062da655c970346b606
Exfiltration module - SHA256: 1c13f53bc228670d512451a477167e756f7a3109b010fc97f20317e954756bb7
All stages communicated with 10[.]254[.]87[.]79. Burp Suite signatures detected in Stage 2.


A backdoor also known as: JS:Trojan.JS.Redirector.BS JS[.]Redirector[.]DE JS:Trojan.JS.Redirector.BS JS/Redir.WI Trojan.Malscript!html JS:Trojan.JS.Redirector.BS JS:Trojan.JS.Redirector.BS Trojan.Script.Expack.drqfka JS:Trojan.JS.Redirector.BS JS:Trojan.JS.Redirector.BS BehavesLike.PDF.Trojan.db JS/Redir.WI TrojanDownloader.JS.aufd JS/Redirector.OA.1 JS:Trojan.JS.Redirector.BS


Customers have to send a set text message from their phone to a specific bank number . Skipper , which has been linked to Turla in the past , was found alongside Gazer in most cases we investigated . Winnti : C&C : b[org_name][.]dnslookup[.]services : 443 . Organizations can collect this intelligence , review the threats described , consider if and how the threat is relevant to them , and the necessity of making any potential additional mitigations .


The malicious document – Hotel_Reservation_Form[.]doc ( MD5 : 9b10685b774a783eabfecdb6119a8aa3 ) , contains a macro that base64 decodes a dropper that then deploys APT28 ’s signature GAMEFISH malware ( MD5 : 1421419d1be31f1f9ea60e8ed87277db ) , which uses mvband[.]net and mvtband[.]net as command and control ( C2 ) domains .


Malware Analysis Report: BatLoader (MD5: 871b258a3b957b58be76ab0289ae84db). Upon execution on Citrix NetScaler, the sample creates /home/user/.config/implant.so and injects into legitimate processes. Network analysis shows beaconing to 172[.]140[.]198[.]206 every 60 seconds and DNS queries to sync-cache[.]net. The second stage was fetched from hxxp://securerelay[.]info/login and written to /opt/app/bin/ntds.dit. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA256: 4f9f9d9f947a8457211b27ec145af1de85f10717333923d522cd6716fa4d5b36) was extracted from the unpacked payload.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3 [ . ] 6 [ . ] 6 [ . ] 922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11194.


Blog Post by Palo Alto Unit 42: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-46781 against SonicWall SMA deployments. The initial access vector involves spear-phishing emails from billing@account-update[.]xyz delivering PlugX. Post-compromise, the attackers deploy Raccoon Stealer and use Seatbelt for reconnaissance. C2 infrastructure includes 39[.]207[.]177[.]139 and cloudportal[.]live. A staging server at hxxp://login-mail[ . ]xyz/panel/index.html hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\implant.so (MD5: 171dd901e782e4020d65d365798562b6).


Haniyeh_will_remain_abroad_and_Hamas_rises_in_Gaza[ . ]pdf : 5b476e05aacea9edc14f7e4bab1b724ef54915f30c39ac87503ed395feae611e .


Tap Menu > Play Protect . Based on data collected from Palo Alto Networks AutoFocus threat intelligence , we discovered continued operations of activity very similar to the Roaming Tiger attack campaign that began in the August 2015 timeframe , with a concentration of attacks in late October and continuing into December . The sole indicator on the source host that at[ . ]exe had been run was an application Prefetch file ( C:\Windows\Prefetch\AT[.]EXE-BB02E639[.]pf ) that was created when the tool was executed . The Metasploit code was released on December 29 , 2012 and the vulnerability was officialy fixed on January 14 , 2013 ( MS13 - 008 ) while the page with the exploit was uploaded on February 11 , 2013 .


According to the public information, cfm[ . ]com[ . ]ua domain belongs to the «Crystal Finance Millennium» software developer.


A backdoor also known as: W32.WinwebA.Trojan TrojanDropper.Henbang.A6 Win32.Worm.AutoRun.c W32/Adware.PXAH-3010 W32[ . ]Virut[ . ]CF Win32/SillyBHO.OL Worm.Win32.AutoRun.ibh Trojan.Win32.AutoRun.cqpmwl Trojan.MulDrop.32523 BehavesLike.Win32.AdwareBetterSurf.gh W32/Adware.ACXN Win32.Virut.cr.61440 TrojanDropper:Win32/Henbang.A Worm.Win32.AutoRun.ibh Win32.Trojan.Webdat.A Worm/Win32.AutoRun.R56346 Backdoor.WinNT.PcClient Win32/Worm.FakeFolder.FF


IOC Bulletin - NjRAT Campaign:
Network Indicators:
- 192 [ . ] 141 [ . ] 160 [ . ] 215
- 169 [ . ] 150 [ . ] 152 [ . ] 111
- 197 [ . ] 164 [ . ] 73 [ . ] 61
- update-sync[.]net
- securebackup[.]live
URLs:
- hxxps://proxyedge[ . ]tech/portal/verify
- hxxp://updateapi[.]io/gate.php
Email Senders:
- report@auth-check[ . ]org
- support@secure-verify[ . ]net
File Indicators:
- SHA256: 07d74d8ab071f8be242bc15510b1edb860eb63b7a8426caceaad63213336f6df
- SHA1: 7ca699f631f3ccebf72fe1da8c479403d7ed80c4
- Drop path: /home/user/.config/lsass.dmp


A backdoor also known as: JS/Iframe.DGS Script.Trojan-Downloader.IFrame.AE Trojan-Downloader.JS.Iframe.deg Trojan.Script.Expack.bvtkmp PDF.DownLoader.3 BehavesLike.PDF.BadFile.db JS/BlacoleRef[ . ]CZ.29 Trojan[Downloader]/JS.Iframe.deg Trojan-Downloader.JS.Iframe.deg JS/Moat.241E54F!tr


A backdoor also known as: W32.ShitOverVBx.PE Trojan.Win32.Cosmu!O W32.Lamer.EL3 Trojan.Downloader Downloader.VB.Win32.9689 Troj.Downloader.W32.VB.l4ji Trojan/Downloader.VB.eex TROJ_DLOADR.SMM Win32.Virus.VBbind.a W32/Worm.BAOX W32.Besverit Win32/VB.P TROJ_DLOADR.SMM Virus.Win32.Lamer.el Trojan.Win32.VB.csnpye Worm.Win32.VB.kp Win32.HLLW.Autoruner.6014 BehavesLike.Win32.Dropper.rh W32/Worm.EMYS-2108 Trojan/VB.kro WORM/VB.NVA Virus/Win32.Lamer.el Trojan:Win32/Dorv.A Trojan.Win32.Downloader.90650.B Virus.Win32.Lamer.el Win32.Application.Unwanted.B Dropper/Win32.Cosmu.R14017 SIM.Trojan.VBO.0859 Trojan.Cosmu Win32/AutoRun[.]VB[.]JP Worm.VB.FMYJ Worm.Win32 W32/OverDoom.A Worm.Win32.VB.C


PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries . The C&C server ( 82 [ . ] 137 [ . ] 255 [ . ] 56 ) used by the above backdoors was used by APT-C-27 ( Goldmouse ) many times since 2017 .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike[ . ]Win32[ . ]Trojan[ . ]cc TR/Crypt.ZPACK.oltlq Trojan.Barys.DD8C9 HackTool:Win64/Mimikatz.A Win-Trojan/MSILKrypt02.Exp Trojan.MSIL.Inject MSIL/Injector.QOT!tr Trj/GdSda.A


Cisco Talos published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2026-49052 in Atlassian Confluence. The attackers deployed StealC via WinPEAS, establishing C2 communication with 172[.]163[.]149[.]189 and portalmail[ . ]net. A secondary payload was downloaded from hxxps://cache-edge[.]org/assets/js/payload.js. The malware binary (MD5: 79798afe27b70af8dab3fb741dab7633) was dropped to /tmp/sam.hive. Phishing emails were sent from finance@secure-verify[ . ]net targeting enterprise users. A backup C2 server was identified at 148[.]124[.]166[.]97.


Sophos X-Ops published a threat intelligence report linking APT29 to a new campaign exploiting CVE-2026-35009 in Juniper SRX. The attackers deployed BlackCat via WinPEAS, establishing C2 communication with 39 [ . ] 71 [ . ] 167 [ . ] 239 and nodenode[.]io. A secondary payload was downloaded from hxxps://cachebackup[ . ]online/secure/token. The malware binary (MD5: ff480f115c2f9a8bfc917fd06825c91f) was dropped to C:\Users\Public\Documents\ntds.dit. Phishing emails were sent from notification@mail-service[.]info targeting enterprise users. A backup C2 server was identified at 42[.]201[.]153[.]152.


Incident Response Summary: On detection of anomalous traffic to 96 [ . ] 27 [ . ] 54 [ . ] 170, the Microsoft MSRC IR team identified LockBit running as C:\Program Files\Common Files\payload.bin. The threat actor, believed to be Volt Typhoon, used LinPEAS for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to loginapi[.]xyz and update-cache[.]live. The initial dropper (SHA1: 92b21d33d60cb17cc016bb67c04dc86ef88569c1) was delivered via a phishing email from account@mail-service[ . ]info. A second C2 node was observed at 172 [ . ] 80 [ . ] 15 [ . ] 38, with a persistence mechanism writing to C:\Users\admin\Downloads\beacon.dll.


Vulnerability Advisory: CVE-2023-14679 is a critical use-after-free affecting Windows 11. ESET Research confirmed active exploitation by Aqua Blizzard in the wild. Exploitation delivers Qbot (SHA256: 7f34fe03dacea410e58a7dc58ae2341cabea11bd32d2b8538da43599cd053d6d) which is dropped to C:\Users\admin\Downloads\config.dat. The exploit payload is hosted at hxxp://edgeauth[.]dev/gate.php and communicates to 53[.]128[.]52[.]102 for C2.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at C:\ProgramData\svchost.exe. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via C:\Program Files\Common Files\csrss.exe. Network forensics identified connections to 80[.]173[.]129[.]97 and api-backup[.]com. Email headers traced the initial vector to info@account-update[ . ]xyz. File C:\Windows\Tasks\helper.sh (MD5: c211ee1e68447fe7d7870f46fbdacbb7) was identified as the initial dropper. A staging URL hxxps://cloud-api[ . ]cc/secure/token resolved to 192[.]176[.]62[.]7. Secondary artifact hash: SHA256: 8a5cc2effcc53140675759b5f3e5a15769f1b7faffbcd1d4121b3bfb95ac9363.


A backdoor also known as: Trojan.Win32.Rimecud.1!O Trojan.Rimecud.U TROJ_RIMECUD.SMX Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_RIMECUD.SMX Trojan.Win32.Fsysna.eqph TrojWare.Win32.Kryptik.AMMN BehavesLike[ . ]Win32[ . ]PWSZbot[ . ]ch Virus.Win32.Cryptor Ransom:Win32/Grymegat.A Trojan.Kazy.D16E7F Trojan.Win32.Fsysna.eqph Trojan/Win32.Jorik.R40701 Trj/Rimecud.f W32/Rimecud.GRC!tr Win32/Trojan.801


In the Linux kernel, the following vulnerability has been resolved:

Revert "libfs: fix infinite directory reads for offset dir"

The current directory offset allocator (based on mtree_alloc_cyclic)
stores the next offset value to return in octx->next_offset. This
mechanism typically returns values that increase monotonically over
time. Eventually, though, the newly allocated offset value wraps
back to a low number (say, 2) which is smaller than other already-
allocated offset values.

Yu Kuai <yukuai3@huawei[.]com> reports that, after commit 64a7ce76fb90
("libfs: fix infinite directory reads for offset dir"), if a
directory's offset allocator wraps, existing entries are no longer
visible via readdir/getdents because offset_readdir() stops listing
entries once an entry's offset is larger than octx->next_offset.
These entries vanish persistently -- they can be looked up, but will
never again appear in readdir(3) output.

The reason for this is that the commit treats directory offsets as
monotonically increasing integer values rather than opaque cookies,
and introduces this comparison:

	if (dentry2offset(dentry) >= last_index) {

On 64-bit platforms, the directory offset value upper bound is
2^63 - 1. Directory offsets will monotonically increase for millions
of years without wrapping.

On 32-bit platforms, however, LONG_MAX is 2^31 - 1. The allocator
can wrap after only a few weeks (at worst).

Revert commit 64a7ce76fb90 ("libfs: fix infinite directory reads for
offset dir") to prepare for a fix that can work properly on 32-bit
systems and might apply to recent LTS kernels where shmem employs
the simple_offset mechanism.


TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGrad` is vulnerable to a heap buffer overflow. The implementation(hxxps://github[.]com/tensorflow/tensorflow/blob/ab1e644b48c82cb71493f4362b4dd38f4577a1cf/tensorflow/core/kernels/maxpooling_op.cc#L194-L203) fails to validate that indices used to access elements of input/output arrays are valid. Whereas accesses to `input_backprop_flat` are guarded by `FastBoundsCheck`, the indexing in `out_backprop_flat` can result in OOB access. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.


Malware Analysis Report: Qbot (SHA256: 64f55ce017bf221672e98bc8e0d260c6c69297176c46b376cab60596ea4cb137). Upon execution on Ubuntu 22.04, the sample creates /etc/cron.d/payload.bin and injects into legitimate processes. Network analysis shows beaconing to 4[.]157[.]81[.]87 every 60 seconds and DNS queries to staticgateway[ . ]cc. The second stage was fetched from hxxps://static-login[ . ]io/secure/token and written to /etc/cron.d/shell.php. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (MD5: 7b6a675c5c4a58104ce84f59432e9ce4) was extracted from the unpacked payload.


These services appear to be running on all network interfaces and are therefore accessible to anyone sharing a local network with an infected device . The certificates Blackfly stole were also from South Korean companies , primarily in the video game and software development industry . Describes a resolution by the Asian Parliamentary Assembly ( APA ) held in Anatalya , announcing unlimited support for the Palestinian people 7b4c736b92ce702fb584845380e237aa55ddb4ef693ea65a766c9d9890b3852c . jalsa[.]rar : The attackers behind Earth Vetala use features of remote access software to steal sensitive information or download malware for additional cyber operations , leveraging spearphishing emails and lure documents containing embedded links to a legitimate filesharing service Onehub to distribute archives containing the ScreenConnect remote administrator tool and RemoteUtilities software .


Vulnerability Advisory: CVE-2021-28231 is a critical privilege escalation affecting Apache Struts. Google TAG confirmed active exploitation by OilRig in the wild. Exploitation delivers RemcosRAT (SHA1: b325133fdedd0c4e671ac2fde32b98dd59cc2275) which is dropped to C:\Windows\System32\payload.bin. The exploit payload is hosted at hxxps://nodelogin[ . ]dev/login and communicates to 10 [ . ] 145 [ . ] 11 [ . ] 203 for C2.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from confirm@secure-verify[.]net and finance@auth-check[ . ]org, spoofing legitimate services. Victims were directed to hxxps://backuprelay[ . ]club/wp-content/uploads/doc.php which hosted a credential harvesting page on static-auth[ . ]dev. A secondary link hxxps://updateauth[ . ]cc/secure/token delivered Dridex (MD5: 16980bdfc57b526c6c1fabe7989f8be5). The malware was saved to /dev/shm/ntds.dit and established C2 with 183[.]219[.]174[.]15.


The executable file , xxxx[.]exe in this case , is then executed .


Kirby is a content management system. A vulnerability in versions prior to 3[.]5[.]8[.]3, 3 [ . ] 6 [ . ] 6 [ . ] 3, 3 [ . ] 7 [ . ] 5 [ . ] 2, 3[.]8[.]4[.]1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary file to the content folder. Kirby sites are not affected if they don't allow file uploads for untrusted users or visitors or if the file extensions of uploaded files are limited to a fixed safe list. The attack requires user interaction by another user or visitor and cannot be automated.

An editor with write access to the Kirby Panel could upload a file with an unknown file extension like `.xyz` that contains HTML code including harmful content like `<script>` tags. The direct link to that file could be sent to other users or visitors of the site. If the victim opened that link in a browser where they are logged in to Kirby and the file had not been opened by anyone since the upload, Kirby would not be able to send the correct MIME content type, instead falling back to `text/html`. The browser would then run the script, which could for example trigger requests to Kirby's API with the permissions of the victim.

The issue was caused by the underlying `Kirby\Http\Response::file()` method, which didn't have an explicit fallback if the MIME type could not be determined from the file extension. If you use this method in site or plugin code, these uses may be affected by the same vulnerability.

The problem has been patched in Kirby 3 [ . ] 5 [ . ] 8 [ . ] 3, 3 [ . ] 6 [ . ] 6 [ . ] 3, 3 [ . ] 7 [ . ] 5 [ . ] 2, 3 [ . ] 8 [ . ] 4 [ . ] 1, and 3.9.6. In all of the mentioned releases, the maintainers have fixed the affected method to use a fallback MIME type of `text/plain` and set the `X-Content-Type-Options: nosniff` header if the MIME type of the file is unknown.


CrowdStrike published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2024-27359 in SonicWall SMA. The attackers deployed Vidar via PowerShell Empire, establishing C2 communication with 172[.]109[.]95[.]71 and backup-proxy[.]site. A secondary payload was downloaded from hxxp://cdnapi[ . ]info/download/update.exe. The malware binary (MD5: 21541cbf5664f89075a34fa4fc4b029e) was dropped to /tmp/loader.exe. Phishing emails were sent from helpdesk@urgent-notice[ . ]online targeting enterprise users. A backup C2 server was identified at 115[.]76[.]17[.]158.


A phishing email was received from it-admin@helpdesk-ticket[ . ]site with subject line 'Urgent Account Verification Required'. The email contained a hyperlink to hxxps://portal-auth[[ . ]]info/login/verify which redirected to a credential harvesting page. Victims who clicked the link also downloaded Ryuk (SHA256: 33af21e00813dd9554b194f7b8e5707a40c369ccedb2afd70840707b1e10e6a4) which was saved to C:\ProgramData\VMware\update_service.dll.


IOC Bulletin - StealC Campaign:
Network Indicators:
- 38[.]145[.]236[.]206
- 172[.]141[.]93[.]111
- 75[.]33[.]223[.]191
- cache-secure[ . ]online
- datacache[.]io
URLs:
- hxxps://data-edge[ . ]top/panel/index.html
- hxxp://node-cache[ . ]xyz/admin/config
Email Senders:
- billing@account-update[.]xyz
- updates@urgent-notice[ . ]online
File Indicators:
- MD5: f2bddb5fd30d982ec2b98b230e87bb56
- SHA1: 0b474236969f06e0c5c7a46c6a42d3546978e89c
- Drop path: C:\Program Files\Common Files\loader.exe


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from support@auth-check[ . ]org and it@login-portal[.]tech, spoofing legitimate services. Victims were directed to hxxps://updatemail[ . ]link/admin/config which hosted a credential harvesting page on storage-static[.]live. A secondary link hxxp://proxy-cloud[.]cc/assets/js/payload.js delivered PlugX (MD5: 32e0030d5163c1897bfbfade7cacbce9). The malware was saved to C:\Windows\Temp\winlogon.exe and established C2 with 192[.]164[.]210[.]116.


TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixSetDiagV*`. The [implementation](hxxps://github[.]com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of `k` is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong. We have patched the issue in GitHub commit ff8894044dfae5568ecbf2ed514c1a37dc394f1b. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.


TG-3390 : american[.]blackcmd[.]com .


Blog Post by Microsoft MSRC: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-27486 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from finance@urgent-notice[.]online delivering SmokeLoader. Post-compromise, the attackers deploy PlugX and use BloodHound for reconnaissance. C2 infrastructure includes 10 [ . ] 138 [ . ] 55 [ . ] 43 and apistatic[ . ]io. A staging server at hxxps://cdnedge[.]cc/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\payload.bin (MD5: 4cef9e6649d9b6590b197a296edc4359).


A backdoor also known as: TrojanDownloader.Rakhni Downloader.Rakhni.Win32.344 Trojan-Downloader.Win32.Rakhni.moc TrojanDownloader[ . ]Rakhni[ . ]hu TR/Dldr.Delf.ltfzo TrojanDownloader:Win32/Docdobex.A Trojan.Zusy.D3FCFF Trojan-Downloader.Win32.Rakhni.moc Downloader/Win32.Rakhni.C2136522 TrojanDownloader.Rakhni W32/Delf.CDW!tr.bdr Trj/GdSda.A


mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then naively split on spaces before being passed to spawn(). Unlike all other tools in the codebase which correctly use array-based argument passing with execFileSync(), port_forward treats every space in user-controlled fields (namespace, resourceType, resourceName, localPort, targetPort) as an argument boundary, allowing an attacker to inject arbitrary kubectl flags. This enables exposure of internal Kubernetes services to the network by injecting --address=0 [ . ] 0 [ . ] 0 [ . ] 0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation via prompt injection against AI agents connected to the MCP server. This issue has been fixed in version 3.5.0.


Bitpylock is a ransomware that encrypts files by using asymmetric keys and puts '.bitpy' as suffix once the encryption phase ended. The ransom note appears on the affected user's Desktop with the following name: "# # HELP_TO_DECRYPT_YOUR_FILES # .html". At the time of writing the ransom request is 0.8 BTC and the communication email is: helpbitpy@cock[ . ]li.


Artifact Analysis for NjRAT campaign:
Stage 1 dropper at C:\Windows\System32\csrss.exe - MD5: 1fec74d50de58bdaa03b28a52d7b29b3
Stage 2 loader at /etc/cron.d/helper.sh - SHA256: 0a94b8cce0388d2ba2832a83b87e5e694628c8d1d2c7e888cb31d64203d59abb
Final payload at C:\Users\Public\Documents\sam.hive - SHA256: e880b0d1e76974085e371144c48e8030f93198e391eea4cb6265e0664a0690bf
Exfiltration module - SHA1: b3a25cf49a4e4549f624c6671e3edc3eb6eda6ef
All stages communicated with 172[.]200[.]52[.]112. Hashcat signatures detected in Stage 2.


Another common step taken by threat actors is changing their system's MAC Address to avoid being uniquely identified . This was the case in two known intrusions in 2015 , where attackers named the implant DLL " ASPNET_FILTER[.]DLL " to disguise it as the DLL for the ASP[ . ]NET ISAPI Filter .


Blog Post by ESET Research: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-22601 against Windows 11 deployments. The initial access vector involves spear-phishing emails from alert@account-update[.]xyz delivering Ryuk. Post-compromise, the attackers deploy IcedID and use PsExec for reconnaissance. C2 infrastructure includes 10 [ . ] 243 [ . ] 168 [ . ] 49 and cdnsecure[.]live. A staging server at hxxps://portalcache[ . ]info/assets/js/payload.js hosts additional tooling. Key artifact: /tmp/payload.bin (SHA1: 3dc28f2fd02408ac40c9aa5d3c1c44aa207aa25d).


A graphical representation of the data structure used to store each VM opcode The VM handler is completely able to generate different code blocks and deal with relocated code due to address space layout randomization ( ASLR ) . Magic Hound has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia . Payload Samples ( Win32/Winnti[.]AG ) Surprisingly enough , it does not take very long to get some information about Hack520 : someone with this handle runs a blog and a Twitter account ( with a handle close to Hack520 ) that is also directly linked to the blog .


Also , we found the IP address 185[.]25[.]50[.]93 hosting C2 services for a Delphi backdoor that ESET ’s report states is the final stage payload for these attacks .


Malware Analysis Report: Lumma Stealer (SHA256: ad94756b526476b72d2716ad80a02096f808456e7ba6c1592619e8e73ec49926). Upon execution on VMware ESXi, the sample creates C:\ProgramData\lsass.dmp and injects into legitimate processes. Network analysis shows beaconing to 177 [ . ] 65 [ . ] 94 [ . ] 209 every 60 seconds and DNS queries to data-login[.]club. The second stage was fetched from hxxps://data-data[.]club/assets/js/payload.js and written to C:\Windows\System32\runtime.dll. The payload uses Nmap-style techniques for defense evasion. A secondary hash (SHA1: 4d3a6e8b780782031ddaac7a4c1a742c3da7c1e0) was extracted from the unpacked payload.


Vulnerability Advisory: CVE-2024-30622 is a critical remote code execution affecting Windows Server 2019. Google TAG confirmed active exploitation by Granite Typhoon in the wild. Exploitation delivers Lumma Stealer (SHA1: 0a013cec2d748bb8c192917583bfb522c6fa5953) which is dropped to /usr/local/bin/sam.hive. The exploit payload is hosted at hxxp://storage-cloud[.]live/secure/token and communicates to 195[.]25[.]40[.]82 for C2.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from noreply@secure-verify[.]net and noreply@secure-verify[ . ]net, spoofing legitimate services. Victims were directed to hxxps://gatewaysync[.]cc/download/update.exe which hosted a credential harvesting page on syncbackup[ . ]top. A secondary link hxxp://synccache[.]link/login delivered Dridex (SHA256: e24013265f68e863b0f7b101cf166fb0b86d57885f51f5a46f8dcb0065186697). The malware was saved to C:\Users\Public\Documents\implant.so and established C2 with 199[.]100[.]41[.]136.


Malware Analysis Report: SystemBC (SHA1: 277812d1f47ed2c8f9e023e478e7900eebd309f4). Upon execution on Progress Telerik, the sample creates /dev/shm/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 218[.]30[.]242[.]64 every 60 seconds and DNS queries to update-storage[.]tech. The second stage was fetched from hxxps://edgelogin[.]link/secure/token and written to /tmp/runtime.dll. The payload uses Merlin-style techniques for defense evasion. A secondary hash (SHA256: fe846ae4f5f4e5940700d391463685f3027f767d399237317b20ca43055860bc) was extracted from the unpacked payload.


FireEye network devices blocked infection attempts at over a dozen victims primarily in Germany , Japan , and the U.S until Oct. 24 at 15:00 UTC , when the infection attempts ceased and attacker infrastructure – both 1dnscontrol[.]com and the legitimate websites containing the rogue code – were taken offline . During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros .


A nubmer of downloaders installing further malware from hxxp://mondaynightfundarts[[ . ]]com/images/Nu48djdi.zip


Secureworks published a threat intelligence report linking UNC2452 to a new campaign exploiting CVE-2020-24328 in Fortinet FortiGate. The attackers deployed PikaBot via Burp Suite, establishing C2 communication with 113[.]5[.]103[.]218 and cdn-mail[ . ]xyz. A secondary payload was downloaded from hxxp://secure-api[.]info/secure/token. The malware binary (SHA1: f6ed137f1afcbb33e10792625b45a449a4f9dafa) was dropped to C:\Users\admin\Desktop\lsass.dmp. Phishing emails were sent from notification@login-portal[.]tech targeting enterprise users. A backup C2 server was identified at 50[.]17[.]118[.]158.


Filename : ntslwin[.]exe MD5 : 7e67122d3a052e4755b02965e2e56a2e Filename : ~de03fc12a[ . ]docm MD5 : 9d703d31795bac83c4dd90527d149796 . templates[.]dotm dropped the following :


Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins. The main impact is to services passing user input to Composer, including Packagist[.]org and Private Packagist. This allowed users to trigger remote code execution. The vulnerability has been patched on Packagist[.]org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs, to the best of our knowledge, was not abused by anyone. Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately. Versions 1.10.22 and 2.0.13 include patches for this issue.


The file is named netwf[ . ]dat .


Incident Response Summary: On detection of anomalous traffic to 192 [ . ] 60 [ . ] 148 [ . ] 77, the CISA IR team identified RedLine Stealer running as /dev/shm/update.dll. The threat actor, believed to be Kimsuky, used Hashcat for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to cloudbackup[ . ]dev and relay-static[ . ]live. The initial dropper (SHA1: 3a39377afe1bac8f0be98e6d37fd4147cc9cff79) was delivered via a phishing email from ceo@mail-service[.]info. A second C2 node was observed at 76[.]135[.]109[.]1, with a persistence mechanism writing to /etc/cron.d/svchost.exe.


The domain on this campaign was registered on Jan. 19 , 2019 . Our report will detail the most recent campaigns conducted by APT10 , including the sustained targeting of MSPs , which we have named Operation Cloud Hopper , and the targeting of a number of Japanese institutions . OceanLotus : worker[ . ]baraeme[ . ]com:8888 11b4 . The Platform can look for indicators across file attachments , embedded links , and more and provides inplatform scoring .


Phishing Campaign Report: Microsoft MSRC identified a large-scale phishing operation. Emails originated from it@login-portal[.]tech and helpdesk@identity-verify[.]cc, spoofing legitimate services. Victims were directed to hxxp://securebackup[.]dev/portal/verify which hosted a credential harvesting page on edge-cache[ . ]club. A secondary link hxxp://gatewaystorage[.]top/secure/token delivered FormBook (SHA1: 3a9af2d26d0ab2db5d2eaeb9985df6ea912a402a). The malware was saved to /opt/app/bin/helper.sh and established C2 with 172[.]103[.]198[.]127.


This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server.

Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H allows an unauthenticated attacker to remotely expose assets in your environment susceptible to exploitation which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.

Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

* Confluence Data Center and Server 7.19: Upgrade to a release 7.19.18, or any higher 7.19.x release
* Confluence Data Center and Server 8.5: Upgrade to a release 8.5.5 or any higher 8.5.x release
* Confluence Data Center and Server 8.7: Upgrade to a release 8.7.2 or any higher release

See the release notes (hxxps://confluence[ . ]atlassian[ . ]com/doc/confluence-release-notes-327.html ). You can download the latest version of Confluence Data Center and Server from the download center (hxxps://www[.]atlassian[.]com/software/confluence/download-archives).


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at /tmp/shell.php - MD5: 6810d117f26a0e06ab15cd907e92f29b
Stage 2 loader at C:\Users\admin\Downloads\helper.sh - SHA1: a481a934c600bf7e95fbc6a1d4336fe03a6da4fc
Final payload at C:\ProgramData\loader.exe - SHA256: a7b61940ecb64720bb7c3d786d5f589a429a5792dcd6ef3cb171392161e11587
Exfiltration module - MD5: ee6b0481fbd5374be860c7f5598ed0e4
All stages communicated with 192 [ . ] 43 [ . ] 13 [ . ] 140. Brute Ratel signatures detected in Stage 2.


Incident Response Summary: On detection of anomalous traffic to 192[.]110[.]239[.]210, the FireEye IR team identified IcedID running as C:\Windows\System32\loader.exe. The threat actor, believed to be Ember Bear, used BloodHound for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to cache-node[ . ]io and backuprelay[.]top. The initial dropper (SHA256: 90520882cecff2f4351728e80a1323e79e4f83f516caaafce2b446cb04e29bf7) was delivered via a phishing email from it@identity-verify[ . ]cc. A second C2 node was observed at 49[.]249[.]53[.]88, with a persistence mechanism writing to C:\Users\Public\Documents\payload.bin.


Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 11[.]1[.]2[.]3.0 and 12[.]2[.]1[.]3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).