Europol published a threat intelligence report linking Midnight Blizzard to a new campaign exploiting CVE-2020-17296 in Ubuntu 22.04. The attackers deployed Qbot via Hashcat, establishing C2 communication with 163 [ . ] 183 [ . ] 32 [ . ] 204 and storagebackup[ . ]tech. A secondary payload was downloaded from hxxps://cache-proxy[ . ]link/admin/config. The malware binary (SHA256: 5ab115bd718dd63abb977e65564b14729ceca6875aae2a98d2b49c7f5958fad4) was dropped to C:\Users\admin\AppData\Local\Temp\taskhost.exe. Phishing emails were sent from updates@phishing-domain[.]com targeting enterprise users. A backup C2 server was identified at 56 [ . ] 219 [ . ] 108 [ . ] 127.


Malware Analysis Report: Dridex (SHA1: 9361bc61bb02ae5363238069c39f4417113531ec). Upon execution on Microsoft Exchange, the sample creates C:\Users\Public\Documents\backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 190[.]26[.]70[.]18 every 60 seconds and DNS queries to cache-update[ . ]net. The second stage was fetched from hxxps://cdnproxy[ . ]link/callback and written to C:\Users\admin\Downloads\shell.php. The payload uses Certutil-style techniques for defense evasion. A secondary hash (MD5: 51aebf756cf2e3378df7787c31b5345e) was extracted from the unpacked payload.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at /opt/app/bin/implant.so. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via /var/tmp/config.dat. Network forensics identified connections to 31 [ . ] 107 [ . ] 26 [ . ] 210 and cdn-login[ . ]org. Email headers traced the initial vector to contact@mail-service[.]info. File C:\ProgramData\helper.sh (MD5: 29bf7c2cc699db507cc1328e51191d88) was identified as the initial dropper. A staging URL hxxp://mail-static[ . ]online/login resolved to 186[.]101[.]140[.]178. Secondary artifact hash: SHA1: 0422fe108e7f404a84f408a4dd90614cb92295e3.


Vulnerability Advisory: CVE-2026-10212 is a critical CSRF vulnerability affecting MOVEit Transfer. Trend Micro confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers Play (MD5: d7dd3ace432cec804d42f5c033ae6b47) which is dropped to C:\Windows\Tasks\loader.exe. The exploit payload is hosted at hxxps://secure-auth[ . ]online/panel/index.html and communicates to 10[.]204[.]133[.]78 for C2.


The registrant information for kernel[ . ]ws also provided a geolocation of Tehran , IR and the email provider for the address used in checkgoogle[.]org was the same used for mydomain1607[ . ]com , chmail.ir .


Below are some of the elements showing the relation . In order to exfiltrate the compromised data , APT10 employed custom malware that used Dropbox as its C2 . The domain , softfix[ . ]co[ . ]kr was registered in 2014 .


Vulnerability in the Oracle Help Technologies product of Oracle Fusion Middleware (component: Web UIX). Supported versions that are affected are 11[.]1[.]1[.]9.0 and 12[.]2[.]1[.]3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Help Technologies. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Help Technologies, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Help Technologies accessible data as well as unauthorized update, insert or delete access to some of Oracle Help Technologies accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).


A backdoor also known as: Worm.Theals W32/Theals.dam Worm.Theals.Win32.2 Win32.Trojan.WisdomEyes.16070401.9500.9975 Win32/VB.VOMRAe Win.Exploit.DCOM-5 Net-Worm.Win32.Theals.c Virus.Win32.Theals.vvbf Net.Worm.W32!c Virus.Win32.Theals_re.c Win32.Zombie.4214 BehavesLike[.]Win32[.]Virut[.]ch Worm/Theals.i W32/Theals.D Win32.Theals.bd.8704 Net-Worm.Win32.Theals.c Worm/Win32.Theals.C1456665 Virus.Win32.Stealth.c W32/Theals.C!worm.im Win32/Trojan.529


Blog Post by Cisco Talos: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-33723 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from admin@identity-verify[.]cc delivering Conti. Post-compromise, the attackers deploy RedLine Stealer and use PowerView for reconnaissance. C2 infrastructure includes 68 [ . ] 9 [ . ] 59 [ . ] 13 and backup-portal[ . ]com. A staging server at hxxp://static-cloud[ . ]dev/secure/token hosts additional tooling. Key artifact: C:\Users\admin\Downloads\config.dat (SHA256: 1563c768f146f70543dc95a83e36c0623fd9de6607697482fd8521b0849f0232).


The malicious executables all called out to the same URLs on windowsnewupdates[.]com .


public passive DNS data , in 2017 was used to host the domain server1cs[.]exodus[.]connexxa[.]it .


This variant of SofacyCarberp was configured to use the following domain as its C2 server : cdnverify[ . ]net .


A backdoor also known as: Backdoor.Tosct BKDR_WEBRV.A Win32.Trojan.WisdomEyes.16070401.9500.9995 BKDR_WEBRV.A W32/Trojan.FUQN-2612 W32.Trojan.Downloader Trojan.Heur.RP.EBE28B Backdoor:Win32/Tosct.A W32/Dloader[ . ]GQ!tr


CTU researchers have observed BRONZE PRESIDENT batch scripts named doc[.]bat , xls[.]bat , xlsx[ . ]bat , ppt[ . ]bat , pptx[ . ]bat , pdf[ . ]bat , and txt[ . ]bat .


A backdoor also known as: BDS/Iroffer.1221.5 Backdoor.Iroffer.AM W32/Iroffer.BC Trojan.Ioffer Backdoor.Win32.Iroffer.1221 Backdoor.Iroffer.1[.]2[.]2[.]1 W32/Iroffer.AM@bd BackDoor.Iroffer.1221 Backdoor.Win32.Iroffer.1221 W32/Iroffer.AM@bd Backdoor.Iroffer.1221.4098 Backdoor:Win32/Iroffer.1_221 Backdoor.Iroffer.1221 Win32/Iroffer.1222 Backdoor.Win32.Iroffer.1221 BackDoor.Iroffer.AD


async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates[.]io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body. One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request. Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary. This has been addressed in async-h1 2.3.0 and previous versions have been yanked.


This led us to additional infrastructure for Zebrocy at 185 [ . ] 25 [ . ] 51 [ . ] 198 and 185 [ . ] 25 [ . ] 50 [ . ] 93 .


Forensic Investigation Notes: Analysis of the compromised host revealed Mimikatz artifacts at C:\Users\admin\Desktop\dropper.ps1. Memory dump analysis confirmed execution of PowerView. Registry modifications pointed to persistence via /dev/shm/agent.py. Network forensics identified connections to 96[.]142[.]129[.]17 and cacherelay[.]com. Email headers traced the initial vector to confirm@mail-service[ . ]info. File C:\Windows\Temp\helper.sh (SHA256: 13d365c4532896bac68852e075aa8b99d0165a1279454dbc8816723515da3a5f) was identified as the initial dropper. A staging URL hxxps://storageedge[.]com/secure/token resolved to 172[.]50[.]223[.]101. Secondary artifact hash: SHA256: dc8217c1ff77fad2583557d1499f6c685fb4ad6976693d5a287b83c41cb8a7f4.


In the Linux kernel, the following vulnerability has been resolved:

ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses

Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account
freed memory map alignment") changes the semantics of pfn_valid() to check
presence of the memory map for a PFN. A valid page for an address which
is reserved but not mapped by the kernel[1], the system crashed during
some uio test with the following memory layout:

 node   0: [mem 0x00000000c0a00000-0x00000000cc8fffff]
 node   0: [mem 0x00000000d0000000-0x00000000da1fffff]
 the uio layout is：0xc0900000, 0x100000

the crash backtrace like:

  Unable to handle kernel paging request at virtual address bff00000
  [...]
  CPU: 1 PID: 465 Comm: startapp.bin Tainted: G           O      5.10.0 #1
  Hardware name: Generic DT based system
  PC is at b15_flush_kern_dcache_area+0x24/0x3c
  LR is at __sync_icache_dcache+0x6c/0x98
  [...]
   (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98)
   (__sync_icache_dcache) from (set_pte_at+0x28/0x54)
   (set_pte_at) from (remap_pfn_range+0x1a0/0x274)
   (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio])
   (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4)
   (__mmap_region) from (__do_mmap_mm+0x3ec/0x440)
   (__do_mmap_mm) from (do_mmap+0x50/0x58)
   (do_mmap) from (vm_mmap_pgoff+0xfc/0x188)
   (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4)
   (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c)
  Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e)
  ---[ end trace 09cf0734c3805d52 ]---
  Kernel panic - not syncing: Fatal exception

So check if PG_reserved was set to solve this issue.

[1]: hxxps://lore[ . ]kernel[ . ]org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/


Phishing Campaign Report: INTERPOL identified a large-scale phishing operation. Emails originated from account@mail-service[ . ]info and report@phishing-domain[ . ]com, spoofing legitimate services. Victims were directed to hxxps://cloudbackup[ . ]org/wp-content/uploads/doc.php which hosted a credential harvesting page on edgegateway[.]online. A secondary link hxxp://cache-relay[.]top/gate.php delivered RedLine Stealer (MD5: 3c5a69d7d426552b0b7e8bafa7fdc25d). The malware was saved to C:\Users\Public\Documents\agent.py and established C2 with 192 [ . ] 217 [ . ] 136 [ . ] 233.


cmd[.]exe /c dir rasext[ . ]dll , cmd[ . ]exe /c dir msctfp[ . ]dat , cmd[ . ]exe /c tasklist /svc | findstr RasMan , cmd[.]exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan\ThirdParty /v DllName /d rasext[ . ]dll /f .


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at /var/tmp/loader.exe - SHA256: 0a05928a49b4a37219ddd89de71269ec113beed92be59803be9b5f08fcaccd47
Stage 2 loader at C:\Users\admin\Downloads\loader.exe - SHA1: 72f3968e91bcc323136dd30d85ae887382c487e2
Final payload at /etc/cron.d/update.dll - SHA1: 346f216583a1460bb97ebeee0e67f852d9770a45
Exfiltration module - MD5: f6c75c26890bae32e785b3c16b1dda08
All stages communicated with 37[.]237[.]169[.]1. Metasploit signatures detected in Stage 2.


Volexity detected a multi-stage attack chain. The initial phishing email from security@account-update[.]xyz contained a link to hxxps://cloudgateway[ . ]top/login. This redirected to hxxps://cache-node[ . ]org/secure/token on relay-backup[.]net. A secondary email from it@account-update[ . ]xyz pointed to hxxp://node-auth[ . ]info/admin/config which delivered SmokeLoader. The final payload callback was hxxp://relaycdn[ . ]org/callback resolving to 83[.]103[.]41[.]49 via cdngateway[.]com.


ESET Research detected a multi-stage attack chain. The initial phishing email from security@auth-check[.]org contained a link to hxxp://login-portal[ . ]io/assets/js/payload.js. This redirected to hxxp://nodeproxy[ . ]com/collect on portal-login[ . ]online. A secondary email from account@secure-verify[ . ]net pointed to hxxp://authgateway[.]top/panel/index.html which delivered Vidar. The final payload callback was hxxps://edge-backup[.]tech/panel/index.html resolving to 192 [ . ] 238 [ . ] 201 [ . ] 252 via clouddata[.]net.


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from notification@urgent-notice[.]online and contact@auth-check[.]org, spoofing legitimate services. Victims were directed to hxxps://gatewaysecure[.]org/download/update.exe which hosted a credential harvesting page on update-mail[ . ]dev. A secondary link hxxp://secure-cloud[ . ]club/admin/config delivered NjRAT (SHA256: fd94894a16772fc852de488d158c774a62eacef12116e733614f9eaf93814fb9). The malware was saved to /tmp/svchost.exe and established C2 with 10 [ . ] 9 [ . ] 192 [ . ] 64.


According to Kaspersky Lab’s report , NetTraveler has been active since as early as 2004; however , the highest volume of activity occurred from 2010 – 2013 . APT41 has also deployed rootkits and Master Boot Record (MBR) bootkits on a limited basis to hide their malware and maintain persistence on select victim systems . The limited use of these tools by APT41 suggests the group reserves more advanced TTPs and malware only for high-value targets . Like other Chinese espionage operators , APT41 appears to have moved toward strategic intelligence collection and establishing access and aACT from direct intellectual property theft since 2015 . This shift , however , has not affected the group's consistent interest in targeting the video game industry for financially motivated reasons . BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e. , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e. , possibly en masse . With the contents of the emails , included links and decoy PDFs all involving taxes , the attackers are apparently targeting the financial departments of organizations in the Balkans region . Some parts of the campaign were briefly described by a Serbian security provider in 2016 and the Croatian CERT in 2017 . The campaign has been active at least from January 2016 to the time of writing the most recent detections in our telemetry are from July 2019 . Our findings show that the mentioned attacks have been orchestrated and we consider them a single long-term campaign that spans Croatia , Serbia , Montenegro , and Bosnia and Herzegovina . We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 . Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina . According to our telemetry , the campaign spreading these tools has been live since 2016 , with the most recent detections as late as in July 2019 . In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e. , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 . Via the BalkanDoor backdoor , the attacker sends a backdoor command to unlock the screen… and using BalkanRAT , they can do whatever they want on the computer . The BalkanDoor backdoor does not implement any Exfiltration channel . APT41 leveraged ADORE.XSEC , a Linux backdoor launched by the Adore-NG rootkit , throughout an organization's Linux environment . The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience . The main part of the BalkanRAT malware is a copy of the Remote Utilities software for remote access . Interestingly , some of the APT41's POISONPLUG malware samples leverage the Steam Community website associated with Valve , a video game developer and publisher . The campaign targeting accountants in the Balkans shows some similarities with a campaign aimed at Ukrainian notaries reported in 2016 . Based on the Let’s Encrypt certificate issuance date , we believe this campaign to be active from May 2019 . One of the domains uncovered during the investigation was identified by the Chinese security vendor CERT 360 as being part of the BITTER APT campaign in May 2019 . Further analysis of the BITTER APT’s infrastructure uncovered a broader phishing campaign targeting other government sites and state-owned enterprises in China . Further investigation revealed approximately 40 additional sites , all of which appear to be targeting the government of China and other organisations in China . We expect to see BITTER APT continuing to target the government of China by employing spoofed login pages designed to steal user credentials and obtain access to privileged account information . This domain and IP address has been previously associated with the BITTER APT and targeting government agencies in China with phishing attacks , based on reporting from 360-CERT . At the time of analysis , the subdomains did not host a website; however , based on BITTER APT group’s targeting patterns , it is highly likely that they were created to host faux login phishing pages designed to steal user’s credentials . BITTER APT campaigns are primarily targeting China , Pakistan and Saudi Arabia historically . As part of its ongoing research initiatives , the Anomali Threat Research Team has discovered a new phishing attack leveraging spoof sites that seem to be designed to steal email credentials from the target victims within the government of the People’s Republic of China . 360 Threat Intelligence Center has reported on related indicators being attributed to BITTER APT a South Asian country suspected Indian APT in open source reporting . China Chopper is a tool that has been used by some state-sponsored actors such as Leviathan and Threat Group-3390 , but during our investigation we've seen actors with varying skill levels . China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool . Cisco Talos discovered significant China Chopper activity over a two-year period beginning in June 2017 , which shows that even nine years after its creation , attackers are using China Chopper without significant modifications . Here , we investigate a campaign targeting an Asian government organization . We observed another campaign targeting an organisation located in Lebanon . China Chopper contains a remote shell ( Virtual Terminal ) function that has a first suggested command of netstat an|find ESTABLISHED . They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword[.]exe . The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords . The actor attempts to exploit CVE-2018–8440 — an elevation of privilege vulnerability in Windows when it improperly handles calls to Advanced Local Procedure Call — to elevate the privileges using a modified proof-of-concept exploit . The attacker obtains the required privileges and launches a few other tools to modify the access control lists (ACLs) of all websites running on the affected server . The Windows branch of the Cloud Atlas intrusion set still uses spear-phishing emails to target high profile victims . From the beginning of 2019 until July , we have been able to identify different spear-phishing campaigns related to this threat actor mostly focused on Russia , Central Asia and regions of Ukraine with ongoing military conflicts . We described one of the techniques used by Cloud Atlas in 2017 and our colleagues at Palo Alto Networks also wrote about it in November 2018 . The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server . Previously , Cloud Atlas dropped its validator” implant named PowerShower” directly , after exploiting the Microsoft Equation vulnerability CVE-2017-11882 mixed with CVE-2018-0802 . This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage . Cloud Atlas remains very prolific in Eastern Europe and Central Asia . During its recent campaigns , Cloud Atlas used a new polymorphic” infection chain relying no more on PowerShower directly after infection , but executing a polymorphic HTA hosted on a remote server , which is used to drop three different files on the local system . The Gamaredon Group has been actively launching spear-phishing attacks against Ukrainian government and military departments from the mid-2013s . In addition , the anonymous cybersecurity experts referenced in the article connected the malicious Gamaredon Group actors with Russian state-sponsored hackers . In one article published in the Kharkiv Observer – an independent Ukranian online publication – an unnamed source stated that even the Ukrainian Presidential Administration has been attacked by malware developed by the Gamaredon Group . Gamaredon Group primarily target Ukrainian organizations and resources using spear-phishing attacks , and they use military or similar documents as bait . Once they have found a victim , they then deploy remote manipulation system binaries (RMS) via self-extracting archives and batch command files . The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . During a recent incident response investigation , our team identified new attacks by the financially motivated attack group ITG08 , also known as FIN6 . More recently , ITG08 has been observed targeting e-commerce environments by injecting malicious code into online checkout pages of compromised websites — a technique known as online skimming — thereby stealing payment card data transmitted to the vendor by unsuspecting customers . This tool , a TTP observed in ITG08 attacks since 2018 , is sold on the dark web by an underground malware-as-a-service (MaaS) provider . ITG08 is an organized cybercrime gang that has been active since 2015 , mostly targeting pointof-sale (POS) machines in brick-and-mortar retailers and companies in the hospitality sector in the U.S. and Europe . Past campaigns by ITG08 using the More_eggs backdoor were last reported in February 2019 . Attackers use it to create , expand and cement their foothold in compromised environments . Lastly , ITG08 used Comodo code-signing certificates several times during the course of the campaign . Let’s take a closer look at ITG08’s TTPs that are relevant to the campaign we investigated , starting with its spear phishing and intrusion tactics and covering information on its use of the More_eggs backdoor . Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd[.]exe . X-Force IRIS determined that the More_eggs backdoor later downloaded additional files , including a signed binary shellcode loader and a signed Dynamic Link Library ( DLL ) , as described below , to create a reverse shell and connect to a remote host . Once the ITG08 established a foothold on the network , they employed WMI and PowerShell techniques to perform network reconnaissance and move laterally within the environment . The attackers used this technique to remotely install a Metasploit reverse TCP stager on select systems , subsequently spawning a Meterpreter session and Mimikatz . In addition to the More_eggs malware , ITG08 leveraged in-memory attacks by injecting malicious code , in this case Mimikatz , into legitimate system processes . A recently rising attack tool in ITG08 campaigns has been the More_eggs JScript backdoor . Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . After a successful phishing attack in which users have opened emails and browsed to malicious links , ITG08 attackers install the More_eggs JScript backdoor on user devices alongside several other malware components . Beyond using More_eggs as a backdoor , ITG08 in this campaign also used offensive security tools and PowerShell scripts to carry out the different stages of the attack . After injecting Meterpreter into memory , the attacker had complete control of the infected device . IBM X-Force IRIS has gained insight into ITG08’s intrusion methods , ability to navigate laterally , use of custom and open-source tools , and typical persistence mechanisms . After the phishing email resulted in a successful infiltration , ITG08 used the More_eggs backdoor to gain a foothold and infect additional devices . In addition , configuring PowerShell script logging and identifying any obfuscation will assist in mitigating ITG08’s use of PowerShell to conduct malicious activity . The LYCEUM threat group targets organizations in sectors of strategic national importance , including oil and gas and possibly telecommunications . CTU research indicates that LYCEUM may have been active as early as April 2018 . In May 2019 , the threat group launched a campaign against oil and gas organizations in the Middle East . This campaign followed a sharp uptick in development and testing of their toolkit against a public multivendor malware scanning service in February 2019 . Stylistically , the observed tradecraft resembles activity from groups such as COBALT GYPSY (which is related to OilRig , Crambus , and APT34 and COBALT TRINITY also known as Elfin and APT33 . When CTU researchers first published information about LYCEUM to Secureworks Threat Intelligence clients , no public documentation on the group existed . Using compromised accounts , LYCEUM send spearphishing emails with malicious Excel attachments to deliver the DanBot malware , which subsequently deploys post-intrusion tools . The developer consistently used Accept-Enconding” (note the extra ‘n’) in all DanBot samples analyzed by CTU researchers . Get-LAPSP.ps1 is a PowerShell script that gathers account information from Active Directory via LDAP . LYCEUM deployed this tool via DanBot shortly after gaining initial access to a compromised environment . LYCEUM delivers weaponized maldocs via spearphishing from the compromised accounts to the targeted executives , human resources (HR) staff , and IT personnel . This focus on training aligns with LYCEUM’s targeting of executives , HR staff , and IT personnel . Despite the initial perception that the maldoc sample was intended for ICS or OT staff , LYCEUM has not demonstrated an interest in those environments . However , CTU researchers cannot dismiss the possibility that the LYCEUM could seek access to OT environments after establishing robust access to the IT environment . LYCEUM is an emerging threat to energy organizations in the Middle East , but organizations should not assume that future targeting will be limited to this sector . Aside from deploying novel malware , LYCEUM’s activity demonstrates capabilities CTU researchers have observed from other threat groups and reinforces the value of a few key controls . Password spraying , DNS tunneling , social engineering , and abuse of security testing frameworks are common tactics , particularly from threat groups operating in the Middle East . The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations . Machete is still very active at the time of this publication , regularly introducing changes to its malware , infrastructure and spearphishing campaigns . ESET has been tracking a new version of Machete (the group’s Python-based toolset) that was first seen in April 2018 . This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted with the Machete malware . Their long run of attacks , focused on Latin American countries , has allowed them to collect intelligence and refine their tactics over the years . Machete is interested in files that describe navigation routes and positioning using military grids . The Machete group sends very specific emails directly to its victims , and these change from target to target . The Machete group is very active and has introduced several changes to its malware since a new version was released in April 2018 . Previous versions were described by Kaspersky in 2014 and Cylance in 2017 . Since August 2018 , the Machete components have been delivered with an extra layer of obfuscation . The GoogleUpdate[ . ]exe component is responsible for communicating with the remote C&C server . ESET has been tracking this threat for months and has observed several changes , sometimes within weeks . This ACT , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries . The presence of code to exfiltrate data to removable drives when there is physical access to a compromised computer may indicate that Machete operators could have a presence in one of the targeted countries , although we cannot be certain . This group is very active and continues to develop new features for its malware , and implement infrastructure changes in 2019 . Machete's long run of attacks , focused in Latin American countries , has allowed them to collect intelligence and refine their tactics over the years . ESET researchers have detected an ongoing , highly targeted campaign , with a majority of the targets being military organizations . The group behind Machete uses effective spearphishing techniques . First described by Kaspersky in 2014 [1] and later , by Cylance in 2017 [2] , Machete is a piece of malware found to be targeting high profile individuals and organizations in Latin American countries . In 2018 Machete reappeared with new code and new features . As of June 2019 , ESET has seen over 50 victims being actively spied upon by Machete , with more than half of them being computers belonging to the Venezuelan military forces . Machete has Latin American targets and has been developed by a Spanish-speaking group , presumably from a LATAM country . Machete was active and constantly working on very effective spearphishing campaigns . In some cases , Machete trick new victims by sending real documents that had been stolen on the very same day . Machete relies on spearphishing to compromise its targets . They seem to have specialized knowledge about military operations , as they are focused on stealing specific files such as those that describe navigation routes . Attackers take advantage of that , along with their knowledge of military jargon and etiquette , to craft very convincing phishing emails . Operators behind Machete apparently already have information about individuals or organizations of interest to them in Latin America , how to reach them , and how best to trick them into getting compromised . Since the end of March up until the end of May 2019 , ESET observed that there were more than 50 victimized computers actively communicating with the C&C server . This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted by Machete . Machete is malware that has been developed and is actively maintained by a Spanish-speaking group . Since it was active in 2012 , it has been carrying out attacks against sensitive targets in China and is one of the most active APT attack organizations targeting mainland China in recent years . By introducing small changes to their code and infrastructure , the group has bypassed several security products . OceanLotus will release malicious sub-packages in the background , receive the remote control command , steal the privacy information of users such as SMS messages , contacts , call records , geographic locations , and browser records . They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . It can be seen that after the code leakage , the CEO of the HackingTeam organization said that the leaked code is only a small part is based on the facts , which also reflects that the network arms merchants have lowered the threshold of APT attacks to a certain extent , making more uncertainties of cyber attacks . This report includes details related to the major hacking targets of the SectorJ04 group in 2019 , how those targets were hacked , characteristics of their hacking activities this year and recent cases of the SectorJ04 group’s hacking . In 2019 , the SectorJ04 group expanded its hacking activities to cover various industrial sectors located across Southeast Asia and East Asia , and is changing the pattern of their attacks from targeted attacks to searching for random victims . The SectorJ04 group has maintained the scope of its existing hacking activities while expanding its hacking activities to companies in various industrial sectors located in East Asia and Southeast Asia . There was a significant increase in SectorJ04's hacking activities in 2019 , especially those targeting South Korea . They mainly utilize spam email to deliver their backdoor to the infected system that can perform additional commands from the attacker’s server . We saw SectorJ04 group activity in Germany , Indonesia , the United States , Taiwan , India . The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system . The SectorJ04 group’s preexisting targets were financial institutions located in countries such as North America and Europe , or general companies such as retail and manufacturing , but they recently expanded their LOCs of activity to include the medical , pharmaceutical , media , energy and manufacturing industries . The SectorJ04 group mainly used their own backdoor , ServHelper and FlawedAmmy RAT , for hacking .


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from admin@urgent-notice[ . ]online and ceo@mail-service[.]info, spoofing legitimate services. Victims were directed to hxxps://edge-gateway[ . ]online/callback which hosted a credential harvesting page on data-gateway[ . ]net. A secondary link hxxps://cdn-cdn[ . ]com/admin/config delivered Ryuk (SHA256: c1547549316258ca58cf61442f777b5f1f9a6c3aa89da7c89417df160ae17c29). The malware was saved to C:\Windows\Tasks\chrome_helper.exe and established C2 with 192 [ . ] 43 [ . ] 162 [ . ] 24.


Incident Response Summary: On detection of anomalous traffic to 172 [ . ] 74 [ . ] 109 [ . ] 82, the Microsoft MSRC IR team identified SystemBC running as C:\Program Files\Common Files\backdoor.elf. The threat actor, believed to be Midnight Blizzard, used BloodHound for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to gatewayproxy[ . ]xyz and cloud-update[.]link. The initial dropper (SHA256: 0be1316b3afdc0e2e6ae7e28996840f002af825af6cf86d7fb0e570c56a02fe6) was delivered via a phishing email from info@mail-service[ . ]info. A second C2 node was observed at 192 [ . ] 194 [ . ] 31 [ . ] 240, with a persistence mechanism writing to /usr/local/bin/config.dat.


Malware Analysis Report: ShadowPad (MD5: 561b92984a9ce23ceb8228b961011f42). Upon execution on Ubuntu 22.04, the sample creates /dev/shm/dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 172[.]190[.]74[.]83 every 60 seconds and DNS queries to gatewaysecure[ . ]cc. The second stage was fetched from hxxps://mailrelay[ . ]tech/download/update.exe and written to C:\Program Files\Common Files\csrss.exe. The payload uses Sliver-style techniques for defense evasion. A secondary hash (SHA1: e2fd0b75be730bbf9734bd05078c91dab4f4b7e4) was extracted from the unpacked payload.


Lazarus Group used Net-GPPPassword for credential dumping and ADFind for lateral movement. Credentials were exfiltrated to 158[.]118[.]81[.]238. The attacker pivoted to 216 [ . ] 3 [ . ] 118 [ . ] 160 and dropped C:\Recovery\WindowsRE\agent.exe (MD5: 1d62870c66779c42edf8de1f8d3734f6). C2 traffic was routed through data-backup[[ . ]]site.


Malware Analysis Report: BumbleBee (SHA1: b8f5787ce46ec96d8f909a4d60aca6d067d0b338). Upon execution on VMware ESXi, the sample creates C:\Users\Public\Documents\shell.php and injects into legitimate processes. Network analysis shows beaconing to 192[.]222[.]136[.]27 every 60 seconds and DNS queries to edgestatic[.]live. The second stage was fetched from hxxp://staticnode[ . ]live/login and written to C:\Users\Public\Documents\shell.php. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (MD5: 7c72780a56275f245e7bda7e0a49630b) was extracted from the unpacked payload.


Incident Response Summary: On detection of anomalous traffic to 11[.]181[.]71[.]120, the Trend Micro IR team identified Emotet running as /opt/app/bin/sam.hive. The threat actor, believed to be OilRig, used Burp Suite for credential harvesting and BloodHound for lateral movement. Exfiltrated data was sent to mail-node[ . ]site and secure-login[.]tech. The initial dropper (SHA1: bf1feef567cdc17543d10c3daba5dc737e63dee9) was delivered via a phishing email from service@secure-verify[.]net. A second C2 node was observed at 71[.]4[.]81[.]92, with a persistence mechanism writing to C:\Windows\System32\backdoor.elf.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from info@account-update[.]xyz and report@account-update[.]xyz, spoofing legitimate services. Victims were directed to hxxp://mail-cache[.]club/download/update.exe which hosted a credential harvesting page on login-cache[ . ]tech. A secondary link hxxp://authapi[ . ]tech/wp-content/uploads/doc.php delivered RemcosRAT (SHA1: 95744d675ee05e8e5951cf6cfc30c9339e0fcbb4). The malware was saved to C:\Users\admin\Desktop\helper.sh and established C2 with 63 [ . ] 237 [ . ] 78 [ . ] 166.


A common misconfiguration attempts to download the non-existant file at hxxp://www[.]server[.]com/sqlite3.dll


Incident Response Summary: On detection of anomalous traffic to 172 [ . ] 10 [ . ] 201 [ . ] 143, the Cisco Talos IR team identified RemcosRAT running as /opt/app/bin/taskhost.exe. The threat actor, believed to be Lazarus Group, used WinPEAS for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to secure-static[.]club and update-edge[ . ]online. The initial dropper (SHA1: ee15444db6355986caa1363ebb0bee0d2c43b820) was delivered via a phishing email from security@secure-verify[ . ]net. A second C2 node was observed at 17[.]63[.]106[.]248, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\payload.bin.


ScanCode[.]io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible command injection vulnerability in the docker fetch process as it allows to append malicious commands in the `docker_reference` parameter.

In the function `scanpipe/pipes/fetch.py:fetch_docker_image` the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`.  However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of `docker://;`, it would allow appending malicious commands.

Version 32.5.1 contains a patch for this issue. The `docker_reference` input should be sanitized to avoid command injections and, as a workaround, one may avoid creating commands with user controlled input directly.


It 's often hard for average users to know if their phones have been rooted , and Shedun apps often wait some period of time before displaying obtrusive ads or installing apps . The campaign 's use of an SMB worm to distribute WCry contributed to the ransomware 's virulence . APT33 : 64[.]251[.]19[.]216 [REDACTED][ . ]myftp[ . ]biz . Considering that both Royal and BlackSuit were active last month , however , a rebrand probably is n’t happening any time soon .


The developers refer to this tool by the name Kazuar , which is a Trojan written using the Microsoft[ . ]NET Framework that offers actors complete access to compromised systems targeted by its operator .


IOC Bulletin - DarkSide Campaign:
Network Indicators:
- 202 [ . ] 218 [ . ] 84 [ . ] 147
- 203 [ . ] 94 [ . ] 193 [ . ] 98
- 10[.]73[.]167[.]115
- proxy-data[ . ]top
- gatewayedge[ . ]live
URLs:
- hxxps://proxy-cdn[ . ]club/gate.php
- hxxps://cloud-data[ . ]info/callback
Email Senders:
- contact@identity-verify[ . ]cc
- alert@phishing-domain[.]com
File Indicators:
- SHA1: c60b0b49fa71b2818e9895b6561c4d5aee6f3c67
- SHA1: 6aae40c1d8adc5d1c55382a063af98350c61fa1e
- Drop path: /etc/cron.d/taskhost.exe


Vulnerability Advisory: CVE-2022-34807 is a critical command injection affecting Barracuda ESG. Proofpoint confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers DanaBot (MD5: 09ff5e82c135dfe8b268556361562a4f) which is dropped to /opt/app/bin/taskhost.exe. The exploit payload is hosted at hxxps://dataportal[.]top/collect and communicates to 10 [ . ] 103 [ . ] 8 [ . ] 72 for C2.


Artifact Analysis for SmokeLoader campaign:
Stage 1 dropper at /opt/app/bin/agent.py - SHA1: bc3596961e3c7d365d3e46e20a52b68e683361f9
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\csrss.exe - SHA256: 839e132455cd1373f93bd1679955b0abdf6de865c08e35fcdaaa35d88ad90ae9
Final payload at /home/user/.config/beacon.dll - SHA1: d55c529b6dc988b95797fd47682c851fe2848e32
Exfiltration module - SHA1: b12f52d2d60e711afe4aca818a798910229bcb74
All stages communicated with 126 [ . ] 172 [ . ] 68 [ . ] 204. PsExec signatures detected in Stage 2.


The above code allows DealersChoice to load a second SWF object , specifically loading it with an argument that includes a C2 URL of “ hxxp://ndpmedia24[.]com/0pq6m4f.m3u8 ” .


CrowdStrike detected a multi-stage attack chain. The initial phishing email from helpdesk@account-update[ . ]xyz contained a link to hxxps://mailportal[ . ]online/wp-content/uploads/doc.php. This redirected to hxxps://apistorage[.]xyz/admin/config on update-cloud[ . ]online. A secondary email from admin@urgent-notice[ . ]online pointed to hxxp://backupcloud[ . ]cc/gate.php which delivered Vidar. The final payload callback was hxxps://node-auth[ . ]org/gate.php resolving to 10 [ . ] 131 [ . ] 49 [ . ] 209 via update-auth[ . ]com.


Vulnerability Advisory: CVE-2022-46178 is a critical cross-site scripting affecting SonicWall SMA. CrowdStrike confirmed active exploitation by Sandworm in the wild. Exploitation delivers Conti (SHA1: c91a653c5981c3859b73a4810be1749cf31983e8) which is dropped to /tmp/lsass.dmp. The exploit payload is hosted at hxxp://nodeapi[.]online/login and communicates to 59 [ . ] 63 [ . ] 111 [ . ] 196 for C2.


Subdomains at phmail[ . ]us have been linked to malicious activity dating back as far as December 2011 .


If the original SMS app has been restored , it will send “ the app returned to its original place. ” Controlling TrickMo TrickMo ’ s operators can control the malware via two channels : Through its C & C via a plaintext HTTP protocol using JSON objects Through encrypted SMS messages There are predefined commands to change the malware ’ s configuration and make it execute certain tasks . PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries . Symantec has found evidence of Starloader files being named AdobeUpdate[ . ]exe , AcrobatUpdate[.]exe , and INTELUPDATE[ . ]EXE among others .


Vulnerability Advisory: CVE-2022-46178 is a critical authentication bypass affecting Palo Alto PAN-OS. Palo Alto Unit 42 confirmed active exploitation by Gamaredon in the wild. Exploitation delivers TrickBot (MD5: 089c8212c153466ee584086b545ee73e) which is dropped to /dev/shm/payload.bin. The exploit payload is hosted at hxxps://portalcache[.]io/callback and communicates to 10 [ . ] 150 [ . ] 72 [ . ] 199 for C2.


Blog Post by Rapid7: Tracking UNC2452's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-37666 against Windows 11 deployments. The initial access vector involves spear-phishing emails from verify@account-update[.]xyz delivering RemcosRAT. Post-compromise, the attackers deploy Latrodectus and use Impacket for reconnaissance. C2 infrastructure includes 2 [ . ] 253 [ . ] 168 [ . ] 183 and cloudedge[ . ]link. A staging server at hxxp://mail-cloud[ . ]club/secure/token hosts additional tooling. Key artifact: C:\Program Files\Common Files\loader.exe (SHA1: 7152a2dd386c6afb2d701303f4ed9e5f933540e5).


A backdoor also known as: Win32.Malachite.A W32.WLKSM.A1 Virus.WLKSM.Win32.1 Win32.Malachite.A Win32.Virus.MoonRover.a W32/Malachite.A Virus.Win32.MoonRover Virus.Win32.WLKSM.a Virus.Win32.Infector.dleseh Virus.Win32.WLKSM.AA BehavesLike[ . ]Win32[ . ]Virut[ . ]cc W32/Malachite.A Win32.Malachite.A Virus.Win32.WLKSM.a Win32.Malachite.A Win32.Malachite.A Win32.Malachite.A Virus.Win32.Wlksm.c


IOC Bulletin - Royal Campaign:
Network Indicators:
- 163[.]101[.]55[.]169
- 10[.]128[.]175[.]33
- 177 [ . ] 168 [ . ] 212 [ . ] 116
- cache-storage[ . ]com
- cdn-mail[.]site
URLs:
- hxxp://relay-api[.]org/secure/token
- hxxps://backup-static[.]info/panel/index.html
Email Senders:
- it@account-update[.]xyz
- report@urgent-notice[.]online
File Indicators:
- SHA1: ca3ff41f5d258f837c84eb0c2f474993d2c667a8
- MD5: d1df35e334d24bab4e10c12bc5d57bbd
- Drop path: /var/tmp/loader.exe


A backdoor also known as: Trojan/W32.Zapchast.113152 Backdoor.KeyBoy Trojan.Zapchast.Win32.29227 Trojan.Heur.LP.EDDB38 Win32.Trojan.WisdomEyes.151026.9950.9999 Backdoor.Kboy Trojan.Win32.Zapchast.afhn Trojan.Win32.Zapchast.cjltha Win32.Trojan.Zapchast.Htcu BehavesLike[.]Win32[.]GameVance[.]ch Trojan/Zapchast.iik TR/Spy.113152.29 Trojan/Win32.Zapchast Backdoor.Win32.KeyBoy.113152[h] Win-Trojan/Keyboy.113152 Trojan.Win32.Zapchast.afhn Trojan.Zapchast!0ThicNhZU3g Trojan.Win32.Zapchast W32/Zapchast.AFHN!tr Win32/Trojan.020


Android malware has drastically lower rates of success when app installations outside of Google Play are barred . Last week Microsoft , working together with Facebook , took strong steps to protect our customers and the internet from ongoing attacks by the Lazarus Group . APT33 : 162[.]250[.]145[.]222 [REDACTED][.]ddns[.]net . loop all over the string to execute the decoding operation .


The Android developer documentation describes the accessibility event class as a class that " represents accessibility events that are seen by the system when something notable happens in the user interface . and as discovered later , even the U.S. and UK governments . ShadowHammer : hxxps://liveupdate01s[.]asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER360.zip . Because phishing often leverages the impersonation of trusted associates from highlevel executives to legitimate vendors and partner organizations and includes personal details skimmed from social media or other publicly available information , its tempting to call them sophisticated .


Incident Response Summary: On detection of anomalous traffic to 186 [ . ] 182 [ . ] 66 [ . ] 180, the CISA IR team identified BatLoader running as C:\Users\admin\AppData\Local\Temp\agent.py. The threat actor, believed to be Sandworm, used Hashcat for credential harvesting and Seatbelt for lateral movement. Exfiltrated data was sent to update-cache[ . ]link and proxycache[ . ]live. The initial dropper (SHA1: cef1e7cc266b642d25f1a83551b8424ea7bc467b) was delivered via a phishing email from info@secure-verify[.]net. A second C2 node was observed at 172[.]208[.]51[.]129, with a persistence mechanism writing to C:\Users\admin\Downloads\payload.bin.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from verify@mail-service[.]info and account@login-portal[.]tech, spoofing legitimate services. Victims were directed to hxxps://relay-cloud[ . ]club/callback which hosted a credential harvesting page on node-api[ . ]online. A secondary link hxxps://securecache[ . ]xyz/secure/token delivered WarmCookie (SHA256: dcaab862c474b782cecaba7df67958c94366c06a7a0b97718669bd903263a3de). The malware was saved to /home/user/.config/payload.bin and established C2 with 211[.]185[.]174[.]145.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from helpdesk@mail-service[ . ]info and verify@mail-service[ . ]info, spoofing legitimate services. Victims were directed to hxxps://secure-storage[ . ]xyz/admin/config which hosted a credential harvesting page on cdn-proxy[.]online. A secondary link hxxp://proxy-static[.]tech/api/v2/auth delivered Qbot (SHA1: 08de67f0dca5ccf4ec6354b9a03c7b5bb584b087). The malware was saved to C:\Users\admin\Downloads\chrome_helper.exe and established C2 with 90[.]31[.]115[.]108.


Incident Response Summary: On detection of anomalous traffic to 102[.]41[.]96[.]225, the Tenable IR team identified Conti running as C:\Program Files\Common Files\chrome_helper.exe. The threat actor, believed to be Velvet Tempest, used Impacket for credential harvesting and Sharphound for lateral movement. Exfiltrated data was sent to nodeedge[.]top and cachebackup[ . ]club. The initial dropper (MD5: 812c81fa7bbec1f9dffb3f98e33d93ca) was delivered via a phishing email from noreply@mail-service[.]info. A second C2 node was observed at 43[.]218[.]129[.]178, with a persistence mechanism writing to C:\Users\Public\Documents\shell.php.


A backdoor also known as: Trojan.Downloader.Harnig.al Trojan-Downloader.Win32.Harnig!O Downloader.Small.28090 Trojan/Downloader.Harnig.al Win32.Trojan.WisdomEyes.16070401.9500.9939 Downloader.Trojan Win.Downloader.Small-579 Trojan.Downloader.Harnig.al Trojan-Downloader.Win32.Harnig.al Trojan.Downloader.Harnig.al Trojan.Win32.Harnig.voqq Trojan.Win32.A.Downloader.10240.FS Troj.Downloader.W32.Harnig.al!c Trojan.Downloader.Harnig.al TrojWare.Win32.TrojanDownloader.Harnig.AL Trojan.Downloader.Harnig.al Trojan.DownLoader.919 Downloader.Harnig.Win32.353 BehavesLike[ . ]Win32[ . ]Cutwail[ . ]lt Trojan-Downloader.Win32.Harnig Trojan/Startpage.nv W32.Trojan.Downloader.Harnig Trojan[Downloader]/Win32.Harnig Trojan.Downloader.Harnig.al Trojan-Downloader.Win32.Harnig.al Trojan/Win32.Downloader.R39433 Trojan.Downloader.Harnig.al OScope.Downloader.GCLA Trj/Harnig.AD Win32/TrojanDownloader.Harnig.AL Win32.Trojan-downloader.Harnig.Sxyp Trojan.QHost.L W32/Harnig.AI!tr


Criminals are increasingly using obfuscation , the deliberate act of creating complex code to make it difficult to analyze . LAS VEGAS—Today at the Black Hat information security conference , Dell SecureWorks researchers unveiled a report on a newly detected hacking group that has targeted companies around the world while stealing massive amounts of industrial data . The difference between the original and patched hpqhvind[ . ]exe . Paired with KillNet ’s reported compromise and leak of North Atlantic Treaty Organization ( NATO ) documents , this sudden increase in capability could indicate significant investment from more sophisticated actors , particularly when measured against KillNet ’s capabilities since the collective ’s inception in late 2021 .


Palo Alto Unit 42 published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2020-16717 in Cisco ASA. The attackers deployed Emotet via LaZagne, establishing C2 communication with 10[.]28[.]102[.]69 and backup-cloud[ . ]link. A secondary payload was downloaded from hxxp://mail-relay[.]net/assets/js/payload.js. The malware binary (SHA1: 31de1c02f56ef5ec2512db09f71df92e84e8e098) was dropped to C:\Users\admin\Desktop\helper.sh. Phishing emails were sent from account@mail-service[.]info targeting enterprise users. A backup C2 server was identified at 172 [ . ] 128 [ . ] 74 [ . ] 215.


SentinelOne published a threat intelligence report linking Gamaredon to a new campaign exploiting CVE-2021-24446 in Atlassian Confluence. The attackers deployed Play via Brute Ratel, establishing C2 communication with 192[.]99[.]113[.]201 and apinode[ . ]site. A secondary payload was downloaded from hxxps://proxy-storage[ . ]cc/admin/config. The malware binary (MD5: cb214460df2524d9f2d95ffb3ebec031) was dropped to C:\Users\admin\Desktop\payload.bin. Phishing emails were sent from contact@auth-check[ . ]org targeting enterprise users. A backup C2 server was identified at 51 [ . ] 11 [ . ] 42 [ . ] 138.


The BlackCat ransomware, also tracked as ALPHV, deployed a new variant in 2024 targeting VMware ESXi hypervisors. The Linux variant with SHA1 hash 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b was designed to encrypt virtual machine disk files on ESXi hosts. The attack began with exploitation of CVE-2024-37085 in VMware ESXi to gain administrative access. The threat actor used SSH to connect to ESXi hosts from 172[.]16[.]45[.]3 and uploaded the ransomware to /tmp/esxi_encrypt. The ransomware configuration was stored at /tmp/.config.json. Exfiltration of sensitive data occurred via rclone to Mega cloud storage, with traffic routed through 185 [ . ] 174 [ . ] 137 [ . ] 92. Additional SHA256 hashes: d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5 and a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1. C2 communications used the domain alphv-paymentsite[ . ]onion.


Vulnerability Advisory: CVE-2023-27691 is a critical heap overflow affecting F5 BIG-IP. Europol confirmed active exploitation by Granite Typhoon in the wild. Exploitation delivers Dridex (SHA256: 0315dab475e280e354e79c3b6b7d98d58054aa0e093ee3fe03a3984a162b025a) which is dropped to C:\Users\admin\Desktop\backdoor.elf. The exploit payload is hosted at hxxp://loginsync[.]site/login and communicates to 172[.]53[.]140[.]215 for C2.


AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows of leakage of cross-domain cookies and protected headers in requests redirect. AutoGPT uses a wrapper around the requests python library, located in autogpt_platform/backend/backend/util/request.py. In this wrapper, redirects are specifically NOT followed for the first request. If the wrapper is used with allow_redirects set to True (which is the default), any redirect is not followed by the initial request, but rather re-requested by the wrapper using the new location. However, there is a fundamental flaw in manually re-requesting the new location: it does not account for security-sensitive headers which should not be sent cross-origin, such as the Authorization and Proxy-Authorization header, and cookies. For example in autogpt_platform/backend/backend/blocks/github/_api.py, an Authorization header is set when retrieving data from the GitHub API. However, if GitHub suffers from an open redirect vulnerability (such as the made-up example of hxxps://api[ . ]github[ . ]com/repos/{owner}/{repo}/issues/comments/{comment_id}/../../../../../redirect/?url=hxxps://joshua.hu/), and the script can be coerced into visiting it with the Authorization header, the GitHub credentials in the Authorization header will be leaked. This allows leaking auth headers and private cookies. This vulnerability is fixed in 0.6.1.


Malware Analysis Report: Emotet (SHA256: 6e5e20d1fead7fe9f9fda50776850e5e04600198a5d74b4077cd412109504e27). Upon execution on Ivanti Connect Secure, the sample creates C:\Program Files\Common Files\lsass.dmp and injects into legitimate processes. Network analysis shows beaconing to 54[.]34[.]30[.]194 every 60 seconds and DNS queries to loginlogin[ . ]online. The second stage was fetched from hxxp://data-portal[ . ]link/admin/config and written to /tmp/helper.sh. The payload uses Covenant-style techniques for defense evasion. A secondary hash (MD5: f6fe795a70dbfe4be1a038f33c21a2ae) was extracted from the unpacked payload.


Blog Post by NSA: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-40108 against Apache Struts deployments. The initial access vector involves spear-phishing emails from support@identity-verify[.]cc delivering Vidar. Post-compromise, the attackers deploy Royal and use LinPEAS for reconnaissance. C2 infrastructure includes 172[.]48[.]46[.]153 and synccdn[ . ]link. A staging server at hxxps://secureproxy[ . ]io/panel/index.html hosts additional tooling. Key artifact: /tmp/chrome_helper.exe (SHA1: ef454b124e0163623f8223e1014c400250e8147d).


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from updates@document-share[.]link and updates@urgent-notice[.]online, spoofing legitimate services. Victims were directed to hxxps://login-data[ . ]top/admin/config which hosted a credential harvesting page on proxycache[ . ]link. A secondary link hxxps://mailgateway[ . ]io/portal/verify delivered Gootloader (SHA256: 1435898cb7c23425eb14eb401ef1d006e4729337072d75ca97845245fef22440). The malware was saved to C:\Program Files\Common Files\ntds.dit and established C2 with 209[.]11[.]33[.]111.


Once the user attempts to open the document , Microsoft Word immediately attempts to load the remote template containing a malicious macro and payload from the location specified within the settings[ . ]xml[ . ]rels file of the DOCX document .


Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-pv2r-x8pm/CVE-2021-41276, the initial fix was incomplete. Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. The following versions contain the fix: Tuleap Community Edition 13[.]2[.]99[.]83, Tuleap Enterprise Edition 13.1-6, and Tuleap Enterprise Edition 13.2-4.


A backdoor also known as: HW32.Packed.3E85 Backdoor.Win32.Nepoe!O Dropper.Paradrop.Win32.108 W32/Korgo.worm PE_AGOBOT.AQM Win32.Trojan.WisdomEyes.16070401.9500.9889 W32/Bobax.AO W32.Bleshare PE_AGOBOT.AQM Win.Trojan.Poebot-45 Trojan-Dropper.Win32.Paradrop.a Trojan.Win32.Paradrop.xhlx Dropper.Paradrop.180736 Troj.Dropper.W32.Paradrop.kYTK TrojWare.Win32.TrojanDropper.Paradrop.a0 Trojan.MulDrop.2267 BehavesLike[.]Win32[.]Conficker[.]cc Backdoor.Win32.PoeBot.C W32/Bobax.LVYX-1108 TrojanDropper.Paradrop TR/Drop.Paradro.a.3 Trojan[Backdoor]/Win32.Agobot TrojanDropper:Win32/Paradrop.J Trojan-Dropper.Win32.Paradrop.a W32/Polybot.dr Backdoor.PoeBot Trj/Droppofonic.A Win32/TrojanDropper.Paradrop.A Worm.PoeBot.S W32/Paradrop.B!tr.dr


IOC Bulletin - Meduza Stealer Campaign:
Network Indicators:
- 10[.]143[.]46[.]198
- 192 [ . ] 114 [ . ] 71 [ . ] 131
- 172 [ . ] 94 [ . ] 178 [ . ] 62
- authnode[.]tech
- storagemail[.]info
URLs:
- hxxp://storage-edge[ . ]dev/api/v2/auth
- hxxp://updatecdn[ . ]dev/secure/token
Email Senders:
- service@login-portal[.]tech
- admin@login-portal[ . ]tech
File Indicators:
- SHA256: 13bc7078d254063e5d45ba0580bc85f008076b67c6dc5556a84e35cf2917687c
- SHA1: f56ecda5823de4a73e2bb579c2a2d0be6f3b6125
- Drop path: C:\Users\admin\Downloads\loader.exe


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G Virus.Virut.Win32.27 W32/Virut.AI W32[ . ]Virut[ . ]CF Win32/Virut.17408 PE_VIRUX.A-1 Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.tt Virus.Win32.Virut.CE Trojan.MulDrop1.57199 PE_VIRUX.A-1 BehavesLike.Win32.Virut.dc W32/Virut.AI Win32/Virut.bn Trojan[Dropper]/Win32.Injector Win32.Virut.nc.53248 Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.06 Win32.Virut.E Win32/Virut.NBP IM-Worm.Win32.Zeroll W32/Sality.AO Virus.Win32.VirutChangeEntry.A


In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix data-race around unix_tot_inflight.

unix_tot_inflight is changed under spin_lock(unix_gc_lock), but
unix_release_sock() reads it locklessly.

Let's use READ_ONCE() for unix_tot_inflight.

Note that the writer side was marked by commit 9d6d7f1cb67c ("af_unix:
annote lockless accesses to unix_tot_inflight & gc_in_progress")

BUG: KCSAN: data-race in unix_inflight / unix_release_sock

write (marked) to 0xffffffff871852b8 of 4 bytes by task 123 on cpu 1:
 unix_inflight+0x130/0x180 net/unix/scm.c:64
 unix_attach_fds+0x137/0x1b0 net/unix/scm.c:123
 unix_scm_to_skb net/unix/af_unix.c:1832 [inline]
 unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1955
 sock_sendmsg_nosec net/socket.c:724 [inline]
 sock_sendmsg+0x148/0x160 net/socket.c:747
 ____sys_sendmsg+0x4e4/0x610 net/socket.c:2493
 ___sys_sendmsg+0xc6/0x140 net/socket.c:2547
 __sys_sendmsg+0x94/0x140 net/socket.c:2576
 __do_sys_sendmsg net/socket.c:2585 [inline]
 __se_sys_sendmsg net/socket.c:2583 [inline]
 __x64_sys_sendmsg+0x45/0x50 net/socket.c:2583
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

read to 0xffffffff871852b8 of 4 bytes by task 4891 on cpu 0:
 unix_release_sock+0x608/0x910 net/unix/af_unix.c:671
 unix_release+0x59/0x80 net/unix/af_unix.c:1058
 __sock_release+0x7d/0x170 net/socket.c:653
 sock_close+0x19/0x30 net/socket.c:1385
 __fput+0x179/0x5e0 fs/file_table.c:321
 ____fput+0x15/0x20 fs/file_table.c:349
 task_work_run+0x116/0x1a0 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204
 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297
 do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

value changed: 0x00000000 -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 4891 Comm: systemd-coredum Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1[ . ]16[ . ]0-0-gd239552ce722-prebuilt[ . ]qemu[ . ]org 04/01/2014


A backdoor also known as: W32.Chiko.Worm Trojan/W32.StartPage.377856 Trojan.Win32.StartPage!O Worm.AutoRun W32.W.Fearso.kYUv WORM_SILLY.ICA Win32.Worm.Delf.cg W32.SillyFDC Win32/Chike.A Worm.Win32.AutoRun.ihn Trojan.Win32.StartPage.yqro Trojan.Win32.StartPage.377856 Trojan.StartPage.52501 Trojan.StartPage.Win32.1 Virus.Win32.Alman Trojan/StartPage[ . ]de TR/Delf.AKP Trojan/Win32.StartPage Win32.Virut.ce.57344 Trojan.Heur.ED91C9 Worm.Win32.AutoRun.ihn Worm:Win32/Chiki.A HEUR/Fakon.mwf TScope.Trojan.Delf W32/Chike.C.worm Win32/Delf.NFT Win32.Worm.Autorun.Pavh Trojan.StartPage!orHv1sw9Olo W32/StartPage.AJH!tr


A backdoor also known as: Win32.Trojan-Downloader.Dluca.by Trojan.Downloader.Dluca-29 Trojan-Downloader.Win32.Dluca.by TrojWare.Win32.TrojanDownloader.Dluca.~D3 Dialer.Adultparty Trojan-Downloader.Win32.Dluca.dj!IK TrojanDownloader[.]Dluca[.]bg TrojanDownloader:Win32/Dluca[ . ]DK Win-Trojan/Dluca.94208 Trojan-Downloader.Win32.Dluca.dj


Phishing Campaign Report: Europol identified a large-scale phishing operation. Emails originated from notification@auth-check[ . ]org and admin@credential-check[.]site, spoofing legitimate services. Victims were directed to hxxps://node-edge[.]site/login which hosted a credential harvesting page on cdn-edge[.]com. A secondary link hxxp://proxymail[ . ]link/login delivered Ryuk (SHA256: 7f93ffbeae05b3ff6a1b061cb08c17fb3b7c6aaf18f710cca8a8719cb1eb805d). The malware was saved to C:\Users\admin\AppData\Local\Temp\config.dat and established C2 with 10 [ . ] 190 [ . ] 153 [ . ] 226.


Forensic Investigation Notes: Analysis of the compromised host revealed Certutil artifacts at C:\ProgramData\implant.so. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Users\Public\Documents\svchost.exe. Network forensics identified connections to 165[.]194[.]47[.]5 and loginauth[ . ]site. Email headers traced the initial vector to contact@urgent-notice[ . ]online. File C:\Program Files\Common Files\taskhost.exe (SHA1: f2ced5a1df3a4e8769902d1282d536d987665292) was identified as the initial dropper. A staging URL hxxp://login-api[.]top/secure/token resolved to 192 [ . ] 67 [ . ] 81 [ . ] 171. Secondary artifact hash: SHA1: c55a95118f286de674c162d21b02f3df66e83873.


IOC Bulletin - Lumma Stealer Campaign:
Network Indicators:
- 54 [ . ] 181 [ . ] 56 [ . ] 236
- 10[.]210[.]254[.]80
- 28[.]117[.]219[.]59
- mailstatic[.]com
- updatesync[ . ]net
URLs:
- hxxps://loginlogin[.]xyz/download/update.exe
- hxxp://proxynode[ . ]link/login
Email Senders:
- billing@account-update[ . ]xyz
- billing@urgent-notice[ . ]online
File Indicators:
- MD5: 99030999623790fce84dc5fd55382d0e
- SHA256: f63586a5751edf100a3839f82e5cb2fcb8e070e2d1a21fc0f63d1be9d1dbc0f8
- Drop path: C:\Users\Public\Documents\payload.bin


Other than that , its major functionality is to collect private device information , upload it to a remote C2 server , and handle any commands as requested by the C2 server . In May 2016 , Unit 42 began researching attacks that used spear-phishing emails with attachments , specifically malicious Excel spreadsheets sent to financial organizations within Saudi Arabia . The script will check the presence of the “ IndexOfﬁce[ . ]exe ” artifact : if true then it will delete it and it will download a new ﬁle/script from “ hxxp://masseffect[.]space/<PC_Name>_<Hex_Drive_SN>/post.php ” . To date , the ransomware has only been used in a limited fashion .


A backdoor also known as: W32.HfsAutoB.4D03 Trojan.Zenshirsh.SL7 Win32.Trojan.WisdomEyes.16070401.9500.9639 Trojan.Win32.TPM.eslggg BehavesLike[.]Win32[.]PWSZbot[.]cc Trojan.Heur.RP.ZyWaayyb2wki Trojan.Win32.Z.Ircbot.839168.A Win32.Trojan.Crypt.Hqux Trojan.Themida! Trojan-PWS.OnlineGames Trj/CI.A


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at /var/tmp/shell.php. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via C:\Windows\System32\config.dat. Network forensics identified connections to 10[.]166[.]205[.]247 and securenode[ . ]online. Email headers traced the initial vector to info@mail-service[ . ]info. File C:\Users\Public\Documents\helper.sh (SHA256: b7f0f4cf45fca295d1ade884e5f7db5157b3f2dd093337305f1a8340b7ab6f1f) was identified as the initial dropper. A staging URL hxxp://backup-cache[.]tech/download/update.exe resolved to 54[.]67[.]241[.]145. Secondary artifact hash: MD5: 199d4e83864eb06462efbd89a5951e57.


] addroider[.]com ’ . Our investigations revealed that the attackers drove around several cities in Russia , stealing money from ATMs belonging to different banks . There is no evidence that Suckfly gained any benefits from attacking the government organizations , but someone else may have benefited from these attacks .


The URLs — abused as part of XLoader ’ s C & C — are hidden in three webpages , and the C & C server that XLoader connects to differ per region . Other open source and semi-legitimate pen-testing tools like nbtscan and powercat are being used for mapping available resources and lateral movement as well . During the analysis , we also noticed the “ veter1605_MAPS_10cr0[.]exe ” file slightly changed run after run , a few hours after the initial discovery the infection chain dropped it with different icons , different suffix , from “ cr0 ” to “ cr24 ” , and appendix from “ veter1605_ ” to “ veter2005_ ” .


In an e-mail , a Lookout representative stood by its analysis and said company researchers planned to publish an in-depth response in the coming days . Working with U.S. Government partners , DHS and FBI identified Trojan malware variants used by the North Korean government – commonly known as HARDRAIN . APT33 : 91[.]230[.]121[.]143 backupnet[.]ddns[.]net . The ads are very similar to other brand impersonation campaigns .


In the example server response below , the green fields show text to be shown to the user . One curious trait of Bahamut is that it develops fully-functional applications in support of its espionage activities , rather than push nonfunctional fake apps or bundle malware with legitimate software . It then adds the “ Loveusd[ . ]sys ” extracted driver name to the upper filter list . In the case of ProxyNotShell , the targeted backend service is the Remote PowerShell service .


Incident Response Summary: On detection of anomalous traffic to 172 [ . ] 181 [ . ] 4 [ . ] 26, the Trend Micro IR team identified AgentTesla running as /usr/local/bin/helper.sh. The threat actor, believed to be Kimsuky, used Mimikatz for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to gateway-auth[.]dev and updatelogin[.]link. The initial dropper (MD5: 3e7d0838083d5cab37c16c16bacd01fe) was delivered via a phishing email from it@identity-verify[ . ]cc. A second C2 node was observed at 126[.]101[.]43[.]136, with a persistence mechanism writing to /dev/shm/lsass.dmp.


Zscaler ThreatLabz detected a multi-stage attack chain. The initial phishing email from contact@document-share[ . ]link contained a link to hxxps://syncbackup[.]tech/download/update.exe. This redirected to hxxp://portallogin[ . ]org/login on node-cdn[.]online. A secondary email from notification@login-portal[ . ]tech pointed to hxxps://sync-gateway[ . ]live/admin/config which delivered Raccoon Stealer. The final payload callback was hxxp://logincache[.]cc/api/v2/auth resolving to 88 [ . ] 38 [ . ] 18 [ . ] 244 via edge-portal[ . ]com.


Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor[.]Sogu .


A backdoor also known as: Trojan-Dropper.Win32.Halk!O Backdoor.CIA BKDR_NERTE.780 Backdoor.Win32.NerTe.780 Backdoor.Win32.Nerte_780.Inst[h] Backdoor.Win32.NerTe.780 Trojan.MulDrop.1253 BKDR_NERTE.780 W32/Risk.YHOK-6554 BDS/Nerte78.Inst Win32.Hack.NerteZip.kcloud Backdoor:Win32/Nerte.7_80.dr Bck/Iroffer[ . ]BG Win32/NerTe.78.Client W32/NerTe.V780!tr.bdr BackDoor.Nerte Backdoor.Win32.NerTe.ajn


For example , if an infected device is connected to a public Wi-Fi network any other host will be able to obtain a terminal on the device without any form of authentication or verification by simply connecting to the port . Most of the group 's attacks are focused on government or technology related companies and organizations . Asala[ . ]mp3 : The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


Malware Analysis Report: Conti (SHA1: 8648cd3dacd28a83b0e1afdb62c16f0b8026ef55). Upon execution on Zyxel USG, the sample creates /usr/local/bin/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 106[.]173[.]72[.]234 every 60 seconds and DNS queries to proxy-cloud[.]info. The second stage was fetched from hxxp://storage-api[.]online/wp-content/uploads/doc.php and written to /home/user/.config/sam.hive. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (SHA256: 2526e71c692da3557d475d25f097fd45d9c24627b166b9d4cfedf1c513536d4e) was extracted from the unpacked payload.


Blog Post by Trend Micro: Tracking Diamond Sleet's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-39439 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from confirm@document-share[.]link delivering BumbleBee. Post-compromise, the attackers deploy Cobalt Strike and use BloodHound for reconnaissance. C2 infrastructure includes 219 [ . ] 204 [ . ] 66 [ . ] 168 and backupsecure[ . ]link. A staging server at hxxp://storage-secure[.]live/secure/token hosts additional tooling. Key artifact: C:\Windows\Tasks\runtime.dll (SHA1: ed4c6da0cf4152d9984c870e854a576211a58938).


IOC Bulletin - Gootloader Campaign:
Network Indicators:
- 164[.]55[.]7[.]74
- 193[.]251[.]126[.]184
- 108 [ . ] 222 [ . ] 153 [ . ] 66
- clouddata[.]io
- edgecdn[ . ]club
URLs:
- hxxps://node-cache[ . ]com/callback
- hxxp://mailapi[.]io/gate.php
Email Senders:
- confirm@mail-service[.]info
- updates@credential-check[ . ]site
File Indicators:
- SHA1: 72096980728e719a33d326425eb34856c89226c0
- MD5: dcb49797c751598ca0edbdaccb3279cd
- Drop path: C:\ProgramData\shell.php


snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1 [ . ] 1 [ . ] 10 [ . ] 1, causing an unrecoverable fatal error.

The function `compress(char[] input)` in the file `Snappy.java` receives an array of characters and compresses it. It does so by multiplying the length by 2 and passing it to the rawCompress` function.

Since the length is not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress function then uses the received length and passes it to the natively compiled maxCompressedLength function, using the returned value to allocate a byte array.

Since the maxCompressedLength function treats the length as an unsigned integer, it doesn’t care that it is negative, and it returns a valid value, which is casted to a signed integer by the Java engine. If the result is negative, a `java.lang.NegativeArraySizeException` exception will be raised while trying to allocate the array `buf`. On the other side, if the result is positive, the `buf` array will successfully be allocated, but its size might be too small to use for the compression, causing a fatal Access Violation error.

The same issue exists also when using the `compress` functions that receive double, float, int, long and short, each using a different multiplier that may cause the same issue. The issue most likely won’t occur when using a byte array, since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place.

Version 1 [ . ] 1 [ . ] 10 [ . ] 1 contains a patch for this issue.


Krybit is a ransomware group that operates as a ransomware-as-a-service provider, offering affiliates 80% of ransom proceeds in exchange for technical support and a malware suite. The group has claimed attacks on various organizations across multiple countries, including asesoriauriel[ . ]com in Spain and fraper[ . ]com in Spain, without disclosing the volume of data exfiltrated. Krybit is currently engaged in a turf war with another group, 0APT, and has been accused of fabricating victim claims. Their leak site has been used to publish compromised data and to issue threats to rivals and victims alike.


In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugetlb vs. core-mm PT locking

We recently made GUP's common page table walking code to also walk hugetlb
VMAs without most hugetlb special-casing, preparing for the future of
having less hugetlb-specific page table walking code in the codebase.
Turns out that we missed one page table locking detail: page table locking
for hugetlb folios that are not mapped using a single PMD/PUD.

Assume we have hugetlb folio that spans multiple PTEs (e.g., 64 KiB
hugetlb folios on arm64 with 4 KiB base page size).  GUP, as it walks the
page tables, will perform a pte_offset_map_lock() to grab the PTE table
lock.

However, hugetlb that concurrently modifies these page tables would
actually grab the mm->page_table_lock: with USE_SPLIT_PTE_PTLOCKS, the
locks would differ.  Something similar can happen right now with hugetlb
folios that span multiple PMDs when USE_SPLIT_PMD_PTLOCKS.

This issue can be reproduced [1], for example triggering:

[ 3105.936100] ------------[ cut here ]------------
[ 3105.939323] WARNING: CPU: 31 PID: 2732 at mm/gup.c:142 try_grab_folio+0x11c/0x188
[ 3105.944634] Modules linked in: [...]
[ 3105.974841] CPU: 31 PID: 2732 Comm: reproducer Not tainted 6.10.0-64.eln141.aarch64 #1
[ 3105.980406] Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-4.fc40 05/24/2024
[ 3105.986185] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 3105.991108] pc : try_grab_folio+0x11c/0x188
[ 3105.994013] lr : follow_page_pte+0xd8/0x430
[ 3105.996986] sp : ffff80008eafb8f0
[ 3105.999346] x29: ffff80008eafb900 x28: ffffffe8d481f380 x27: 00f80001207cff43
[ 3106.004414] x26: 0000000000000001 x25: 0000000000000000 x24: ffff80008eafba48
[ 3106.009520] x23: 0000ffff9372f000 x22: ffff7a54459e2000 x21: ffff7a546c1aa978
[ 3106.014529] x20: ffffffe8d481f3c0 x19: 0000000000610041 x18: 0000000000000001
[ 3106.019506] x17: 0000000000000001 x16: ffffffffffffffff x15: 0000000000000000
[ 3106.024494] x14: ffffb85477fdfe08 x13: 0000ffff9372ffff x12: 0000000000000000
[ 3106.029469] x11: 1fffef4a88a96be1 x10: ffff7a54454b5f0c x9 : ffffb854771b12f0
[ 3106.034324] x8 : 0008000000000000 x7 : ffff7a546c1aa980 x6 : 0008000000000080
[ 3106.038902] x5 : 00000000001207cf x4 : 0000ffff9372f000 x3 : ffffffe8d481f000
[ 3106.043420] x2 : 0000000000610041 x1 : 0000000000000001 x0 : 0000000000000000
[ 3106.047957] Call trace:
[ 3106.049522]  try_grab_folio+0x11c/0x188
[ 3106.051996]  follow_pmd_mask.constprop.0.isra.0+0x150/0x2e0
[ 3106.055527]  follow_page_mask+0x1a0/0x2b8
[ 3106.058118]  __get_user_pages+0xf0/0x348
[ 3106.060647]  faultin_page_range+0xb0/0x360
[ 3106.063651]  do_madvise+0x340/0x598

Let's make huge_pte_lockptr() effectively use the same PT locks as any
core-mm page table walker would.  Add ptep_lockptr() to obtain the PTE
page table lock using a pte pointer -- unfortunately we cannot convert
pte_lockptr() because virt_to_page() doesn't work with kmap'ed page tables
we can have with CONFIG_HIGHPTE.

Handle CONFIG_PGTABLE_LEVELS correctly by checking in reverse order, such
that when e.g., CONFIG_PGTABLE_LEVELS==2 with
PGDIR_SIZE==P4D_SIZE==PUD_SIZE==PMD_SIZE will work as expected.  Document
why that works.

There is one ugly case: powerpc 8xx, whereby we have an 8 MiB hugetlb
folio being mapped using two PTE page tables.  While hugetlb wants to take
the PMD table lock, core-mm would grab the PTE table lock of one of both
PTE page tables.  In such corner cases, we have to make sure that both
locks match, which is (fortunately!) currently guaranteed for 8xx as it
does not support SMP and consequently doesn't use split PT locks.

[1] hxxps://lore[ . ]kernel[ . ]org/all/1bbfcc7f-f222-45a5-ac44-c5a1381c596d@redhat.com/


However , it does n't request permissions like BIND_ADMIN . Since exposure of its operations in 2013 , APT10 has made a number of significant changes intended to thwart detection of its campaigns . The malicious updaters were hosted on the official liveupdate01s[.]asus[.]com and liveupdate01[.]asus[.]com ASUS update servers . Given the widespread adoption of Citrix in enterprises globally , we suspect the number of impacted organizations is far greater and in several sectors .


Sandworm, attributed to Russia's GRU Unit 74455 and tracked by Microsoft as Seashell Blizzard, deployed destructive malware against Ukrainian energy infrastructure. The group used Industroyer2 to target industrial control systems at substations, alongside CaddyWiper (SHA256 a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7) to destroy data on Windows systems. The attack was coordinated with OrcShred wiper for Linux and Solaris targets with hash c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9. C2 infrastructure was hosted at 91 [ . ] 245 [ . ] 228 [ . ] 56 and 176[.]57[.]215[.]92. Malicious scripts were deployed to /var/tmp/.update.sh and /opt/oracle/extproc.sh. The Industroyer2 configuration targeted IEC-104 protocol on ports 2404 and contained hardcoded IP addresses of substation RTUs at 10[.]25[.]100[.]1 and 10 [ . ] 25 [ . ] 100 [ . ] 2.


Incident Response Summary: On detection of anomalous traffic to 194[.]81[.]11[.]8, the CrowdStrike IR team identified BatLoader running as C:\Users\Public\Documents\sam.hive. The threat actor, believed to be MuddyWater, used Burp Suite for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to cdn-mail[.]info and authcdn[.]link. The initial dropper (SHA1: 8d6918f4f6e82b4e86d9a7abf67ec9341847e5da) was delivered via a phishing email from updates@auth-check[.]org. A second C2 node was observed at 62 [ . ] 155 [ . ] 216 [ . ] 253, with a persistence mechanism writing to /home/user/.config/shell.php.


] com and ora.studiolegalebasili [ . China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool . Poison Ivy is a remote access tool that is freely available for download from its official web site at www[ . ]poisonivy-rat[ . ]com .


Vulnerability Advisory: CVE-2024-24392 is a critical buffer overflow affecting Windows Server 2019. FBI confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers ShadowPad (SHA1: 92b73a73036a93c3213e153aaf6a65704f6a0553) which is dropped to C:\Program Files\Common Files\shell.php. The exploit payload is hosted at hxxp://backupdata[ . ]link/collect and communicates to 180 [ . ] 44 [ . ] 159 [ . ] 144 for C2.


MSEdgeRedirect is a tool to redirect news, search, widgets, weather, and more to a user's default browser. MSEdgeRedirect versions before 0[.]5[.]0[.]1 are vulnerable to Remote Code Execution via specifically crafted URLs. This vulnerability requires user interaction and the acceptance of a prompt. With how MSEdgeRedirect is coded, parameters are impossible to pass to any launched file. However, there are two possible scenarios in which an attacker can do more than a minor annoyance. In Scenario 1 (confirmed), a user visits an attacker controlled webpage; the user is prompted with, and downloads, an executable payload; the user is prompted with, and accepts, the aforementioned crafted URL prompt; and RCE executes the payload the user previously downloaded, if the download path is successfully guessed. In Scenario 2 (not yet confirmed), a user visits an attacked controlled webpage; the user is prompted with, and accepts, the aforementioned crafted URL prompt; and a payload on a remote, attacker controlled, SMB server is executed. The issue was found in the _DecodeAndRun() function, in which I incorrectly assumed _WinAPI_UrlIs() would only accept web resources. Unfortunately, file:/// passes the default _WinAPI_UrlIs check(). File paths are now directly checked for and must fail. There is no currently known exploitation of this vulnerability in the wild. A patched version, 0[.]5[.]0[.]1, has been released that checks for and denies these crafted URLs. There are no workarounds for this issue. Users are advised not to accept any unexpected prompts from web pages.


Vulnerability Advisory: CVE-2024-36290 is a critical remote code execution affecting Zyxel USG. Trend Micro confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers Lumma Stealer (SHA256: e73c5523060665c8e2b5559518acff04518f6b43f0870d44efb3cf4abd61592d) which is dropped to /etc/cron.d/svchost.exe. The exploit payload is hosted at hxxps://login-relay[ . ]cc/secure/token and communicates to 172 [ . ] 51 [ . ] 226 [ . ] 181 for C2.


Blog Post by Kaspersky GReAT: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-19065 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from support@document-share[.]link delivering RedLine Stealer. Post-compromise, the attackers deploy IcedID and use Hashcat for reconnaissance. C2 infrastructure includes 10 [ . ] 78 [ . ] 242 [ . ] 105 and portal-edge[.]cc. A staging server at hxxp://relaydata[.]io/collect hosts additional tooling. Key artifact: C:\Windows\System32\csrss.exe (SHA256: 21b1afd43645efe4e5eb322c5ffe88cc4b18270351ecd47c80f7c75bd84b1c34).


TG-3390 : 72[.]11[.]141[.]133 .


The second type of apps reveals an evolution in the author 's tactics . This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files . The ELMER variant 6c33223db475f072119fe51a2437a542 beaconed to the C2 IP address 121 [ . ] 127 [ . ] 249 [ . ] 74 over port 443 . The final payloads include the AgentTesla remote access trojan ( RAT ) , Cobalt Strike beacons and njRAT .


IOC Bulletin - SystemBC Campaign:
Network Indicators:
- 201[.]120[.]184[.]182
- 45[.]234[.]87[.]159
- 10[.]173[.]241[.]229
- secure-sync[.]com
- cache-node[.]site
URLs:
- hxxp://static-node[.]info/portal/verify
- hxxp://synclogin[ . ]top/wp-content/uploads/doc.php
Email Senders:
- notification@urgent-notice[.]online
- helpdesk@auth-check[.]org
File Indicators:
- SHA1: f0fbf39e7c2e6911cafb7689ddde128ebb075953
- MD5: 7aec4ec51ae460a3260d45f1915d37b6
- Drop path: C:\Users\admin\Desktop\csrss.exe


Here is an approximate diagram of the opcode data structure : Figure 5 . The Lotus Blossom actors using Emissary have been active for at least seven years in Southeast Asia . If for a particular reason you need them , reach out to us at threatintel@eset[.]com . Also , ideology as a motivator could mean your group is the target of nation states .


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at /etc/cron.d/winlogon.exe. Memory dump analysis confirmed execution of Certutil. Registry modifications pointed to persistence via /usr/local/bin/agent.py. Network forensics identified connections to 22 [ . ] 109 [ . ] 195 [ . ] 236 and cloud-edge[ . ]live. Email headers traced the initial vector to alert@document-share[.]link. File C:\ProgramData\taskhost.exe (SHA1: 213fe93b81928609f1b06209c4151478790cda64) was identified as the initial dropper. A staging URL hxxps://relay-gateway[.]io/api/v2/auth resolved to 49[.]9[.]173[.]37. Secondary artifact hash: SHA256: 57d7e72f63a13cd53260efd61521680f35f37bc1ba68bdad5736b28ac80a4420.


Symantec detected a multi-stage attack chain. The initial phishing email from support@credential-check[.]site contained a link to hxxp://backupcdn[ . ]net/assets/js/payload.js. This redirected to hxxps://backup-cloud[.]live/wp-content/uploads/doc.php on relaystorage[ . ]live. A secondary email from hr@document-share[ . ]link pointed to hxxp://syncsecure[.]tech/download/update.exe which delivered WarmCookie. The final payload callback was hxxps://updateproxy[ . ]club/wp-content/uploads/doc.php resolving to 192[.]162[.]9[.]96 via data-sync[.]link.


When a suitable .exe file candidate is found , it is copied into the malware installation folder ( for example , C : \ProgramData ) . Between December 28 , 2016 and January 1 , 2017 , CTU researchers observed a phishing campaign targeting Middle Eastern organizations . wsc_proxy[ . ]exe plugins-setup[ . ]exe SoftManager[ . ]exe GetEFA[.]exe . Rhysida appears to have first popped up back in May , with several high - profile compromises posted on their leak site .


Recorded Future observed Turla, the Russian cyber espionage group also tracked as VENOMOUS BEAR, using compromised Starlink terminals as command-and-control relay points in Ukraine. The group deployed an updated version of the Snake implant that uses named pipes for inter-process communication and encrypts all traffic with ChaCha20. Network indicators included the domain cdn-analytics[.]cloud-delivery[.]net.


If it did , the malware downloaded additional modules , including ones allowing for the automatic creation of unauthorized payment orders , changing details in legal payment orders , etc . The second , aptly titled " kontrakt87[ . ]doc " , copies a generic telecommunications service contract from MegaFon , a large Russian mobile phone operator .


It was executed via rundll32 commands such as : rundll32[ . ]exe “ C:\Windows\twain_64[.]dll ” .


FBI published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2023-33283 in MOVEit Transfer. The attackers deployed TrickBot via ADFind, establishing C2 communication with 192 [ . ] 26 [ . ] 245 [ . ] 44 and cloud-update[ . ]online. A secondary payload was downloaded from hxxp://gatewaylogin[ . ]site/callback. The malware binary (SHA1: 21acf9cca989c315cc10860dd3d9802687a3fc1d) was dropped to /dev/shm/update.dll. Phishing emails were sent from noreply@urgent-notice[ . ]online targeting enterprise users. A backup C2 server was identified at 38 [ . ] 124 [ . ] 16 [ . ] 147.


XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13[.]1[.]0[.]5 and 14.3-rc-1, some resources are missing a check for inactive (not yet activated or disabled) users in XWiki, including the REST service. This means a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default, so an inactive user could perform actions for such extensions. This issue has existed since at least version 1.1 of XWiki for instance configured with the email activation required for new users. Now it's more critical for versions 11.3-rc-1 and later since the maintainers provided the capability to disable user without deleting them and encouraged using that feature. XWiki 14.3-rc-1 and XWiki 13.10.5 contain a patch. There is no workaround for this other than upgrading XWiki.


] databit [ . The first attack started in early July with a ShimRatReporter payload . The POST URI is changed to /bbs/ search[ . ]asp ( as mentioned , earlier Aumlib variants used a POST URI of /bbs/ info[ . ]asp . ) The POST body is now encoded . FireEye currently tracks this activity in three clusters , UNC2639 , UNC2640 , and UNC2643 .


Malware Analysis Report: Dridex (MD5: 24a42dceaf8d2ced05517979fdab3652). Upon execution on Palo Alto PAN-OS, the sample creates /tmp/beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 192[.]53[.]8[.]121 every 60 seconds and DNS queries to login-secure[ . ]club. The second stage was fetched from hxxps://gateway-update[.]top/collect and written to /var/tmp/update.dll. The payload uses Sliver-style techniques for defense evasion. A secondary hash (SHA256: 6412d63d36cf538bd4557562d5580fda77148dd599996175b852e3db158b977c) was extracted from the unpacked payload.


IOC Bulletin - Ryuk Campaign:
Network Indicators:
- 172[.]63[.]248[.]241
- 219 [ . ] 5 [ . ] 15 [ . ] 52
- 92[.]201[.]141[.]235
- storageproxy[ . ]link
- proxy-backup[.]link
URLs:
- hxxp://portalportal[ . ]com/download/update.exe
- hxxps://portal-portal[ . ]club/portal/verify
Email Senders:
- verify@mail-service[.]info
- alert@account-update[ . ]xyz
File Indicators:
- MD5: 358de74077e360f643efce8b9904214d
- SHA1: 58f8c74e2e01b9c0b063f4972b29620253fba227
- Drop path: C:\Windows\Temp\dropper.ps1


CSRF in Web Compliance Manager in Quest Policy Authority 8[.]1[.]2[.]200 allows remote attackers to force user modification/creation via a specially crafted link to the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer


IOC Bulletin - RedLine Stealer Campaign:
Network Indicators:
- 192 [ . ] 133 [ . ] 200 [ . ] 47
- 172[.]164[.]217[.]38
- 172 [ . ] 56 [ . ] 81 [ . ] 106
- login-portal[.]link
- auth-edge[ . ]site
URLs:
- hxxp://update-static[ . ]dev/callback
- hxxps://cache-api[.]cc/collect
Email Senders:
- admin@urgent-notice[.]online
- info@credential-check[.]site
File Indicators:
- SHA1: d2bf09f886129b6fca988b8f2f7cf43950e9a613
- SHA256: 2546eb6d93eb3abfea5139a395dba6467d4c751dcf7b8f32cf4a57e556cd7a34
- Drop path: C:\Users\admin\AppData\Local\Temp\update.dll


Blog Post by Symantec: Tracking TA505's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-46781 against Palo Alto PAN-OS deployments. The initial access vector involves spear-phishing emails from verify@phishing-domain[ . ]com delivering FormBook. Post-compromise, the attackers deploy PlugX and use SharpHound for reconnaissance. C2 infrastructure includes 20 [ . ] 240 [ . ] 135 [ . ] 24 and gateway-portal[.]cc. A staging server at hxxps://backupstorage[.]top/panel/index.html hosts additional tooling. Key artifact: /tmp/backdoor.elf (MD5: 56453130dc7b949fbbbe2172f0b21ef9).


In the Linux kernel, the following vulnerability has been resolved:

nvme: fix memory allocation in nvme_pr_read_keys()

nvme_pr_read_keys() takes num_keys from userspace and uses it to
calculate the allocation size for rse via struct_size(). The upper
limit is PR_KEYS_MAX (64K).

A malicious or buggy userspace can pass a large num_keys value that
results in a 4MB allocation attempt at most, causing a warning in
the page allocator when the order exceeds MAX_PAGE_ORDER.

To fix this, use kvzalloc() instead of kzalloc().

This bug has the same reasoning and fix with the patch below:
hxxps://lore[.]kernel[.]org/linux-block/20251212013510.3576091-1-kartikey406@gmail.com/

Warning log:
WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216, CPU#1: syz-executor117/272
Modules linked in:
CPU: 1 UID: 0 PID: 272 Comm: syz-executor117 Not tainted 6.19.0 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1[.]16[.]3-0-ga6ed6b701f0a-prebuilt[.]qemu[.]org 04/01/2014
RIP: 0010:__alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216
Code: ff 83 bd a8 fe ff ff 0a 0f 86 69 fb ff ff 0f b6 1d f9 f9 c4 04 80 fb 01 0f 87 3b 76 30 ff 83 e3 01 75 09 c6 05 e4 f9 c4 04 01 <0f> 0b 48 c7 85 70 fe ff ff 00 00 00 00 e9 8f fd ff ff 31 c0 e9 0d
RSP: 0018:ffffc90000fcf450 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff920001f9ea0
RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0
RBP: ffffc90000fcf648 R08: ffff88800b6c3380 R09: 0000000000000001
R10: ffffc90000fcf840 R11: ffff88807ffad280 R12: 0000000000000000
R13: 0000000000040dc0 R14: 0000000000000001 R15: ffffc90000fcf620
FS:  0000555565db33c0(0000) GS:ffff8880be26c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000000c CR3: 0000000003b72000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 alloc_pages_mpol+0x236/0x4d0 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof+0x149/0x180 mm/mempolicy.c:2557
 ___kmalloc_large_node+0x10c/0x140 mm/slub.c:5598
 __kmalloc_large_node_noprof+0x25/0xc0 mm/slub.c:5629
 __do_kmalloc_node mm/slub.c:5645 [inline]
 __kmalloc_noprof+0x483/0x6f0 mm/slub.c:5669
 kmalloc_noprof include/linux/slab.h:961 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 nvme_pr_read_keys+0x8f/0x4c0 drivers/nvme/host/pr.c:245
 blkdev_pr_read_keys block/ioctl.c:456 [inline]
 blkdev_common_ioctl+0x1b71/0x29b0 block/ioctl.c:730
 blkdev_ioctl+0x299/0x700 block/ioctl.c:786
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x1bf/0x220 fs/ioctl.c:583
 x64_sys_call+0x1280/0x21b0 mnt/fuzznvme_1/fuzznvme/linux-build/v6.19/./arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x71/0x330 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fb893d3108d
Code: 28 c3 e8 46 1e 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffff61f2f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffff61f3138 RCX: 00007fb893d3108d
RDX: 0000000020000040 RSI: 00000000c01070ce RDI: 0000000000000003
RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffff61f3138
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffff61f3128 R14: 00007fb893dae530 R15: 0000000000000001
 </TASK>


ba9f4d3f4eba3fa7dce726150fe402e37359a7f36c07f3932a92bd711436f88c e194268bf682d81fc7dc1e437c53c952ffae55a9d15a1fc020f0219527b7c2ec С & C 2014–2015 : secondby[ . ]ru darkclub[.]net holerole[ . ]org googleapis.link 2015–2016 : test2016[ . ]ru blackstar[.]pro synchronize[.]pw lineout[.]pw sync-weather[.]pw The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio . APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia .


Modified DLL file ( goopdate[ . ]dll ) used by BRONZE PRESIDENT to install RCSession : 0617cad9e5d559356c43d4037c86227f , f14eaf5d648aebb2ed7b00b2cf4349263b30fb1c , 2ea9ccf653f63bcc3549a313ec9d0bada341556cc32dd2ca4b73e0c034492740 .


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at /var/tmp/lsass.dmp - SHA256: a6a404e3771fd33d7830cb47b7455502802b681bbd45021791f5ea6f937c54b4
Stage 2 loader at C:\ProgramData\helper.sh - SHA256: 533cc53d308ed07bf7cd542aa464f36d7ec9c385c642090a3fc25591e692278e
Final payload at C:\Windows\Temp\chrome_helper.exe - SHA256: af96a03902d3eb56d9b0a349c414bdcfe24dc4b9b83df0e5a9b9d85ff41a1ba6
Exfiltration module - SHA1: 77022c34bdbe34e159aa3bf97fcd1495c6c3cbb8
All stages communicated with 71[.]55[.]246[.]41. Burp Suite signatures detected in Stage 2.


The output in Figure 3 shows the Process ID ( PID ) of the csrss[.]exe process to be 716 .


Due to this feature , it is clear that the developers paid special attention to the work of the implant on Huawei devices . Despite this shift in toolset , the group still relies on old infrastructure as evidenced by their reuse of servers hosted by the service providers Choopa and Atlantic[ . ]net . Axiom : Group72 .


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at /home/user/.config/ntds.dit - SHA256: eb04273bb24b8b6f3a7cad6c3f1b6be66c4b120eaf11f6a2b19f2fc78e1c09c2
Stage 2 loader at /opt/app/bin/chrome_helper.exe - SHA1: 47044f5fbfa47a02d2b519907948086fdee0c8ad
Final payload at C:\Users\admin\AppData\Local\Temp\runtime.dll - SHA1: 78d87995bcbe3dc0b4878cabcde7dee9f7fc9773
Exfiltration module - SHA1: 30241c274b04dbf8e895ba42dfb799c0b4033895
All stages communicated with 10[.]70[.]150[.]23. Certutil signatures detected in Stage 2.