ALERT: Gh0st RAT detected on Confluence Server endpoint. Process C:\Windows\Temp\debug.exe (MD5: 44a95bcfbefb0a37275dacea5d2dc1ee) initiated outbound connection to 23 [ . ] 121 [ . ] 5 [ . ] 192 resolving monitor-net[[.]]org. Immediate containment recommended.


Vulnerability Advisory: CVE-2024-36290 is a critical cross-site scripting affecting Active Directory. Tenable confirmed active exploitation by Flax Typhoon in the wild. Exploitation delivers REvil (SHA256: ebe5f5622b56e020c0405d60fcc24493f23f3d2ccdc4eadb3df0d5cfc45d1123) which is dropped to /dev/shm/helper.sh. The exploit payload is hosted at hxxps://nodesync[.]top/login and communicates to 172 [ . ] 204 [ . ] 76 [ . ] 62 for C2.


Huntress published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2020-12082 in Ubuntu 22.04. The attackers deployed Meduza Stealer via Impacket, establishing C2 communication with 129 [ . ] 54 [ . ] 148 [ . ] 202 and portalportal[.]live. A secondary payload was downloaded from hxxp://proxy-secure[ . ]io/download/update.exe. The malware binary (SHA1: 97a05e736aacd79574fe3a5d5d0b599d7bcf638e) was dropped to C:\Users\admin\Desktop\dropper.ps1. Phishing emails were sent from finance@account-update[ . ]xyz targeting enterprise users. A backup C2 server was identified at 156 [ . ] 44 [ . ] 144 [ . ] 196.


Blog Post by Symantec: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-20659 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from account@login-portal[ . ]tech delivering Latrodectus. Post-compromise, the attackers deploy Qbot and use Ligolo for reconnaissance. C2 infrastructure includes 172 [ . ] 50 [ . ] 111 [ . ] 172 and mailproxy[.]info. A staging server at hxxps://edgeportal[ . ]net/assets/js/payload.js hosts additional tooling. Key artifact: /var/tmp/agent.py (MD5: d18dd20df96d1fdff92806c64bddbf48).


Malware Analysis Report: Gootloader (SHA256: 6302f4cb2eb5592f761ace9da3188c559b551f3334a41ece7c7a2655fa623944). Upon execution on Citrix NetScaler, the sample creates /opt/app/bin/runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 171 [ . ] 83 [ . ] 242 [ . ] 208 every 60 seconds and DNS queries to mailnode[ . ]info. The second stage was fetched from hxxp://portalgateway[.]link/portal/verify and written to /var/tmp/sam.hive. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (MD5: 4b268f56470128b36d3042d5d65d900d) was extracted from the unpacked payload.


CVE-2025-4654: The Soumettre[ . ]fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to create/edit/delete Soumettre posts. This vulnerability affects only installations where the soumettre account is not connected (i.e. API key is not installed)


A backdoor also known as: Trojandownloader.Tosct Win32.Trojan.WisdomEyes.16070401.9500.9994 BKDR_WEBRV.A Trojan.Click2.39104 BKDR_WEBRV.A W32/Trojan.KRMY-0312 Trojan[.]Heur[.]JP.ED64BF TrojanDownloader:Win32/Tosct.B


TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.FractionalAvgPool`. This is because the implementation(hxxps://github[ . ]com/tensorflow/tensorflow/blob/acc8ee69f5f46f92a3f1f11230f49c6ac266f10c/tensorflow/core/kernels/fractional_avg_pool_op.cc#L85-L89) computes a divisor quantity by dividing two user controlled values. The user controls the values of `input_size[i]` and `pooling_ratio_[i]` (via the `value.shape()` and `pooling_ratio` arguments). If the value in `input_size[i]` is smaller than the `pooling_ratio_[i]`, then the floor operation results in `output_size[i]` being 0. The `DCHECK_GT` line is a no-op outside of debug mode, so in released versions of TF this does not trigger. Later, these computed values are used as arguments(hxxps://github[.]com/tensorflow/tensorflow/blob/acc8ee69f5f46f92a3f1f11230f49c6ac266f10c/tensorflow/core/kernels/fractional_avg_pool_op.cc#L96-L99) to `GeneratePoolingSequence`(hxxps://github[ . ]com/tensorflow/tensorflow/blob/acc8ee69f5f46f92a3f1f11230f49c6ac266f10c/tensorflow/core/kernels/fractional_pool_common.cc#L100-L108). There, the first computation is a division in a modulo operation. Since `output_length` can be 0, this results in runtime crashing. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.


A backdoor also known as: Trojan.Win32.Malware.1 Trojan.Rootkit.GGA Backdoor:W32/PcClient.ALE BACKDOOR.Trojan Backdoor:Win32/Xinia.C Trojan.Rootkit.GGA RootKit[.]Win32[.]Undef[.]ru W32/Rootkit.A SHeur.CPFS


jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](hxxps://developer[.]mozilla[.]org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)


Vulnerability Advisory: CVE-2022-28965 is a critical privilege escalation affecting Ubuntu 22.04. Zscaler ThreatLabz confirmed active exploitation by OilRig in the wild. Exploitation delivers PikaBot (SHA256: 56e500ca7d83c6220c2f8eb11cad312e1abf3982c8c1512e11e39c76ae2cd56f) which is dropped to /tmp/taskhost.exe. The exploit payload is hosted at hxxps://proxy-backup[ . ]site/download/update.exe and communicates to 192 [ . ] 82 [ . ] 45 [ . ] 107 for C2.


NSA published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2021-39439 in Citrix NetScaler. The attackers deployed SystemBC via Havoc, establishing C2 communication with 16 [ . ] 141 [ . ] 64 [ . ] 180 and portal-proxy[.]org. A secondary payload was downloaded from hxxps://gatewayportal[ . ]online/admin/config. The malware binary (SHA256: 2efd63356677694ca494c881d44536f0be396e2b75068ad9f144e5101318755e) was dropped to C:\Users\admin\Desktop\loader.exe. Phishing emails were sent from hr@auth-check[.]org targeting enterprise users. A backup C2 server was identified at 10 [ . ] 74 [ . ] 164 [ . ] 213.


A backdoor also known as: Trojan.Win32.Kolweb!O Trojan.Lokrodem.25745 Trojan.Kolweb.Win32.139 Troj.W32.Kolweb.mBu8 Trojan/Kolweb.a Win32.Trojan.WisdomEyes.16070401.9500.9687 Adware.Margoc Win32/Startpage[.]SK Win.Trojan.Kolweb-96 Trojan.Win32.Kolweb.a Trojan.Win32.Kolweb.cxqwlv Trojan.Win32.A.Kolweb.224389[ASPack] Trojan.PWS.Mirka BehavesLike.Win32.Sality.fc Trojan/Kolweb.cm TR/Delf[ . ]CF.13 Trojan/Win32.Kolweb Trojan:Win32/Lokrodem.A.dll Trojan.Win32.Kolweb.a Trojan/Win32.Kolweb.C12167 Trojan.Kolweb Trojan.Graftor.D33DE Win32.Trojan.Kolweb.Edns Trojan.PWS.Delf!+6OEG1VoGF8 Win32/Trojan.f0c


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . Analysts in our DeepSight Managed Adversary and Threat Intelligence ( MATI ) team have found a new backdoor , Backdoor[ . ]Powemuddy , new variants of Seedworm 's Powermud backdoor ( aka POWERSTATS ) , a GitHub repository used by the group to store their scripts , as well as several post-compromise tools the group uses to exploit victims once they have established a foothold in their network .


A backdoor also known as: W32.LRQwegierExe.Trojan Trojan/W32[.]Small[.]14848[.]CH Trojan.Daws.17020 Trojan.Kazy.D192B Win32.Trojan.Dalixi.f Trojan-Dropper.Win32.Daws.dyru Troj.W32.KillAV.lCzy BehavesLike.Win32.VTFlooder.lh Trojan:Win32/Ghodow.A Trojan-Dropper.Win32.Daws.dyru Win32/Dalixi.A Trojan.Dalixi!sYT5S6B5t8c W32/Dloader.IQS!tr.dldr Win32/Trojan.b7f


FireEye published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2020-48698 in Barracuda ESG. The attackers deployed Lumma Stealer via SharpHound, establishing C2 communication with 140[.]241[.]76[.]94 and portal-mail[ . ]io. A secondary payload was downloaded from hxxp://data-static[ . ]top/panel/index.html. The malware binary (SHA256: 3e53f8b989435e5f98f75ecaee4922b736b44e850fdf9719ff280fc6fb2cf3b6) was dropped to C:\Windows\Tasks\config.dat. Phishing emails were sent from security@document-share[ . ]link targeting enterprise users. A backup C2 server was identified at 58[.]148[.]68[.]119.


In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is [understood to be feasible on a local network, but not on the public internet](hxxps://groups[ . ]google[ . ]com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ).

Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability.

This has been patched in 2.7.3, 2.8.2, 2.9.


ALERT: Mimikatz detected on Nginx endpoint. Process C:\Users\Public\Libraries\shell.ps1 (MD5: 78a8258631abcaf49dde4311227bd06b) initiated outbound connection to 204[.]243[.]141[.]43 resolving cert-verify[[.]]dev. Immediate containment recommended.


Blog Post by Rapid7: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-46781 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from admin@secure-verify[ . ]net delivering QakBot. Post-compromise, the attackers deploy DanaBot and use SharpHound for reconnaissance. C2 infrastructure includes 34[.]197[.]204[.]215 and data-auth[.]site. A staging server at hxxp://backup-cdn[.]dev/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /dev/shm/chrome_helper.exe (SHA256: 8a7790351e3a349454b62034b153635b13f6bcd13923e54cbd5432af1eaa804f).


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from confirm@account-update[ . ]xyz and finance@document-share[.]link, spoofing legitimate services. Victims were directed to hxxps://cachedata[.]cc/callback which hosted a credential harvesting page on nodecloud[.]club. A secondary link hxxps://mail-data[.]top/api/v2/auth delivered ShadowPad (SHA256: 85cc003f56ae70bca4bd18b039f25c7b4e2f3a739a651567d33e972e033958be). The malware was saved to /var/tmp/svchost.exe and established C2 with 207 [ . ] 106 [ . ] 242 [ . ] 34.


In this scenario , the domain cdnverify[.]net was registered on January 30 , 2018 and just two days later , an attack was launched using this domain as a C2 .


In addition , at this stage the app can process one of these commands : • Collect device info • Install app • Is online ? APT33 registered multiple domains that masquerade as Saudi Arabian aviation companies and Western organizations that together have partnerships to provide training , maintenance and support for Saudi 's military and commercial fleet . Inside the binaries the compiler left references to the names of the C source file modules used: operation_reg[.]c , thread_command[.]c and thread_upload[.]c . What makes COSMICENERGY unique is that based on our analysis , a contractor may have developed it as a red teaming tool for simulated power disruption exercises hosted by Rostelecom - Solar , a Russian cyber security company .


Automated botnet fingerprinting identified two high-threat command-and-control nodes. IP 79 [ . ] 127 [ . ] 138 [ . ] 77 (fingerprint 9f96b00ce11bc787) and IP 3[.]236[.]224[.]33 (fingerprint fce59ecbc730e00a) both received threat scores of 95/100. The C2 panels were accessible at hxxp://79[.]127[.]138[.]77:8080/panel and hxxp://3[ . ]236[ . ]224[ . ]33:9090/admin. Both nodes serve as relay infrastructure for distributing DDoS payloads.


Suspected TEMP.Veles incidents include malicious activity originating from 87 [ . ] 245 [ . ] 143 [ . ] 140 , which is registered to CNIIHM .


Vulnerability Advisory: CVE-2023-40294 is a critical type confusion affecting Cisco ASA. Recorded Future confirmed active exploitation by Aqua Blizzard in the wild. Exploitation delivers Vidar (MD5: 470ea820abeb27a8f99694b9064e5318) which is dropped to /dev/shm/update.dll. The exploit payload is hosted at hxxp://static-gateway[ . ]io/gate.php and communicates to 10 [ . ] 255 [ . ] 138 [ . ] 203 for C2.


That domain, electronicfrontierfoundation[ . ]org, is designed to trick users into a false sense of trust and it appears to have been used in a spear phishing attack, though it is unclear who the intended targets were.


A backdoor also known as: Trojan.Win32.Antilam.gzgw Backdoor.Trojan Antilam.FE BKDR_ANTILAM.A Backdoor.Win32.Antilam.20.b Backdoor.Antilam!vJ4jD43D2/o NORMAL:Trojan.SERVER_3!27802 Backdoor.Win32.Antilam.dfer BackDoor.AntiLame.23 BKDR_ANTILAM.A BehavesLike[ . ]Win32[ . ]Backdoor[ . ]cc W32/Risk.BTKH-4955 Backdoor/Antilam.20.ao BDS/Antilam.20.C Trojan[Backdoor]/Win32.Antilam Backdoor:Win32/Antilam.20.B Trojan/Win32.Xema Backdoor.AntiLamer Win32/Antilam.20.B Backdoor.Win32.Antilam W32/Antilam.B!tr.bdr


The group's Cobalt Strike installation typically uses a payload named svchost[.]exe in an attempt to disguise Cobalt Strike activity as the legitimate Windows svchost[ . ]exe executable .


Incident Response Summary: On detection of anomalous traffic to 154 [ . ] 169 [ . ] 171 [ . ] 158, the Proofpoint IR team identified NjRAT running as /tmp/helper.sh. The threat actor, believed to be Sandworm, used PowerView for credential harvesting and PowerShell Empire for lateral movement. Exfiltrated data was sent to cdnproxy[.]xyz and data-data[.]online. The initial dropper (SHA1: edb04ccfb4ef20ac3fa5bbf206ab7c1f1528799a) was delivered via a phishing email from billing@identity-verify[.]cc. A second C2 node was observed at 108 [ . ] 168 [ . ] 83 [ . ] 27, with a persistence mechanism writing to /dev/shm/winlogon.exe.


How do you know if your Google account is breached ? You can check if your account is compromised by accessing the following web site that we created : https : //gooligan[ . ]checkpoint[ . ]com/ .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government . Symantec during 2012 linked the Elderwood Project to Operation Aurora ; Trojan.Naid and Backdoor[.]Moudoor were also used in Aurora , by the Elderwood Gang , and by Hidden Lynx .


Why Did Chinese Spyware Linger in U.S . After almost two weeks , on August 30 , 2018 , APT10 attackers used their access to the network to move laterally and made their first deployment of an RC4- and Salsa20-encrypted variant of the Trochilus malware using a previously associated DLL sideloading techniquE . The message asked the recipient to rename the attachment extension from “ [ . ]_X_ ” to “ .exe ” and opening it with the password specified in the email to view the Happy New Year eCard in the correct and polite language .


Blog Post by Zscaler ThreatLabz: Tracking Granite Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-24446 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from finance@account-update[ . ]xyz delivering PikaBot. Post-compromise, the attackers deploy AgentTesla and use Rubeus for reconnaissance. C2 infrastructure includes 135[.]158[.]221[.]9 and portal-cloud[ . ]io. A staging server at hxxp://cache-portal[.]club/panel/index.html hosts additional tooling. Key artifact: C:\Windows\Temp\agent.py (SHA1: 32ad0456a4bb79c0707c23630c427901e8e2bca7).


We can observe below , the procedure through which the artifact attempts to establish a connection with the IP address 176 [ . ] 31 [ . ] 112 [ . ] 10 .


Cisco Talos detected a multi-stage attack chain. The initial phishing email from billing@secure-verify[ . ]net contained a link to hxxps://securemail[.]club/panel/index.html. This redirected to hxxp://securecache[.]xyz/login on edgelogin[.]live. A secondary email from contact@credential-check[ . ]site pointed to hxxp://securemail[.]live/assets/js/payload.js which delivered RedLine Stealer. The final payload callback was hxxps://portal-update[ . ]io/secure/token resolving to 218 [ . ] 10 [ . ] 32 [ . ] 22 via gateway-login[ . ]link.


Officials at BLU could n't be immediately reached for comment . Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer . C2 : phot[.]healthsvsolu[.]com .


Forensic Investigation Notes: Analysis of the compromised host revealed BloodHound artifacts at /var/tmp/config.dat. Memory dump analysis confirmed execution of Chisel. Registry modifications pointed to persistence via C:\ProgramData\config.dat. Network forensics identified connections to 192 [ . ] 102 [ . ] 223 [ . ] 60 and api-edge[.]dev. Email headers traced the initial vector to security@auth-check[ . ]org. File /home/user/.config/agent.py (SHA256: 0db4e25ab6261020a90b47f8866da6e56b157a6c42a5d30f250229de2874a693) was identified as the initial dropper. A staging URL hxxps://cachestorage[ . ]cc/assets/js/payload.js resolved to 165 [ . ] 11 [ . ] 128 [ . ] 24. Secondary artifact hash: SHA1: 9b44b0196a748264807df2046678bf9b3a23f7df.


In the Linux kernel, the following vulnerability has been resolved:

tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'

When generate a synthetic event with many params and then create a trace
action for it [1], kernel panic happened [2].

It is because that in trace_action_create() 'data->n_params' is up to
SYNTH_FIELDS_MAX (current value is 64), and array 'data->var_ref_idx'
keeps indices into array 'hist_data->var_refs' for each synthetic event
param, but the length of 'data->var_ref_idx' is TRACING_MAP_VARS_MAX
(current value is 16), so out-of-bound write happened when 'data->n_params'
more than 16. In this case, 'data->match_data.event' is overwritten and
eventually cause the panic.

To solve the issue, adjust the length of 'data->var_ref_idx' to be
SYNTH_FIELDS_MAX and add sanity checks to avoid out-of-bound write.

[1]
 # cd /sys/kernel/tracing/
 # echo "my_synth_event int v1; int v2; int v3; int v4; int v5; int v6;\
int v7; int v8; int v9; int v10; int v11; int v12; int v13; int v14;\
int v15; int v16; int v17; int v18; int v19; int v20; int v21; int v22;\
int v23; int v24; int v25; int v26; int v27; int v28; int v29; int v30;\
int v31; int v32; int v33; int v34; int v35; int v36; int v37; int v38;\
int v39; int v40; int v41; int v42; int v43; int v44; int v45; int v46;\
int v47; int v48; int v49; int v50; int v51; int v52; int v53; int v54;\
int v55; int v56; int v57; int v58; int v59; int v60; int v61; int v62;\
int v63" >> synthetic_events
 # echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="bash"' >> \
events/sched/sched_waking/trigger
 # echo "hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(\
pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\
pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\
pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\
pid,pid,pid,pid,pid,pid,pid,pid,pid)" >> events/sched/sched_switch/trigger

[2]
BUG: unable to handle page fault for address: ffff91c900000000
PGD 61001067 P4D 61001067 PUD 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 2 PID: 322 Comm: bash Tainted: G        W          6.1.0-rc8+ #229
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1[ . ]15[ . ]0-0-g2dd4b9b3f840-prebuilt[ . ]qemu[ . ]org 04/01/2014
RIP: 0010:strcmp+0xc/0x30
Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee
c3 cc cc cc cc 0f 1f 00 31 c0 eb 08 48 83 c0 01 84 d2 74 13 <0f> b6 14
07 3a 14 06 74 ef 19 c0 83 c8 01 c3 cc cc cc cc 31 c3
RSP: 0018:ffff9b3b00f53c48 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffffba958a68 RCX: 0000000000000000
RDX: 0000000000000010 RSI: ffff91c943d33a90 RDI: ffff91c900000000
RBP: ffff91c900000000 R08: 00000018d604b529 R09: 0000000000000000
R10: ffff91c9483eddb1 R11: ffff91ca483eddab R12: ffff91c946171580
R13: ffff91c9479f0538 R14: ffff91c9457c2848 R15: ffff91c9479f0538
FS:  00007f1d1cfbe740(0000) GS:ffff91c9bdc80000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff91c900000000 CR3: 0000000006316000 CR4: 00000000000006e0
Call Trace:
 <TASK>
 __find_event_file+0x55/0x90
 action_create+0x76c/0x1060
 event_hist_trigger_parse+0x146d/0x2060
 ? event_trigger_write+0x31/0xd0
 trigger_process_regex+0xbb/0x110
 event_trigger_write+0x6b/0xd0
 vfs_write+0xc8/0x3e0
 ? alloc_fd+0xc0/0x160
 ? preempt_count_add+0x4d/0xa0
 ? preempt_count_add+0x70/0xa0
 ksys_write+0x5f/0xe0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f1d1d0cf077
Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e
fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00
f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74
RSP: 002b:00007ffcebb0e568 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000143 RCX: 00007f1d1d0cf077
RDX: 0000000000000143 RSI: 00005639265aa7e0 RDI: 0000000000000001
RBP: 00005639265aa7e0 R08: 000000000000000a R09: 0000000000000142
R
---truncated---


Incident Response Summary: On detection of anomalous traffic to 172[.]246[.]158[.]145, the Symantec IR team identified Conti running as /opt/app/bin/chrome_helper.exe. The threat actor, believed to be MuddyWater, used Chisel for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to login-node[ . ]top and relayrelay[ . ]org. The initial dropper (SHA256: dca8da1f07404dcd18245ffee064ce6ac6fef092fb7a3aa59c5e06743240cfe4) was delivered via a phishing email from service@auth-check[.]org. A second C2 node was observed at 87 [ . ] 193 [ . ] 243 [ . ] 214, with a persistence mechanism writing to C:\Program Files\Common Files\lsass.dmp.


The adware functionality is the same in all the apps we analyzed . Kaspersky also observed some activity from Gaza Team and MuddyWater . Here is the complete list of files internally used by the RAT: error[ . ]tmp (the log file of the keylogger) tedsul[ . ]ocx helpsol[ . ]ocx trepsl[ . ]ocx psltred[ . ]ocx solhelp[.]ocx sulted[.]ocx .


However , a simple Google search for the adware package name returned a “ TestDelete ” project that had been available in his repository at some point The malicious developer also has apps in Apple ’ s App Store . The malware then writes the R resource data to the file C:\WINDOWS\tasksche.exe . Filename: conhote[.]dll .


] 144 [ . APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea . In the case of old Windows versions like XP , main module events[.]exe runs an edited XPTask[ . ]vbs Microsoft sample script to create a weekly scheduled task for . The duration of manipulation may be temporary or longer sustained , depending on operator detection .


A backdoor also known as: W32.AppdataAdobLnrC.Trojan Net-Worm.Win32.Cynic!O Worm.Cynic Worm.Cynic.Win32.96 Win32.Trojan.WisdomEyes.16070401.9500.9997 Net-Worm.Win32.Cynic.iu Trojan.Win32.Bot.crrkzb BackDoor.IRC.Bot.1244 BehavesLike.Win32.Downloader.ct TR/Zbot.var Worm[Net]/Win32.Cynic Worm:Win32/Vexral.A Trojan.Barys.657 Worm[.]Win32[.]A[.]Net-Cynic.95744 Net-Worm.Win32.Cynic.iu Trojan/Win32.IRCBot.R23264 Worm.Cynic Win32/AutoRun.IRCBot.II Trojan.Injector!y7pxtOpaO3Y Net-Worm.Win32.Cynic W32/Injector.HXK!tr


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0 [ . ] 9 [ . ] 8 [ . ] 923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_start parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9719.


Malware Analysis Report: Hive (MD5: b73d1d39467e447cdea82a221faee369). Upon execution on Ubuntu 22.04, the sample creates /var/tmp/sam.hive and injects into legitimate processes. Network analysis shows beaconing to 172 [ . ] 77 [ . ] 218 [ . ] 141 every 60 seconds and DNS queries to cloudupdate[.]net. The second stage was fetched from hxxp://cdn-sync[.]club/api/v2/auth and written to C:\Users\admin\Downloads\beacon.dll. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA1: 76aa029a5d5258ca206d2e10dbd108961db3dadb) was extracted from the unpacked payload.


ESET detects this adware , collectively , as Android/AdDisplay.Ashas . In January , Kaspersky identified new activity by the Transparent Tribe APT group aka PROJECTM and MYTHIC LEOPARD , a threat actor with interests aligned with Pakistan that has shown a persistent focus on Indian military targets . The malware configuration contains one Command and Control: pactchfilepacks[.]net23[.]net .


Vulnerability in the Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Target Management). Supported versions that are affected are 12 [ . ] 1 [ . ] 0 [ . ] 5, 13[.]2[.]0[.]0 and 13[.]3[.]0[.]0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Enterprise Manager for Oracle Database. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager for Oracle Database accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager for Oracle Database accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Enterprise Manager for Oracle Database. CVSS 3.0 Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L).


In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix infinite recursion in fib6_dump_done().

syzkaller reported infinite recursive calls of fib6_dump_done() during
netlink socket destruction.  [1]

From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then
the response was generated.  The following recvmmsg() resumed the dump
for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due
to the fault injection.  [0]

  12:01:34 executing program 3:
  r0 = socket$nl_route(0x10, 0x3, 0x0)
  sendmsg$nl_route(r0, ... snip ...)
  recvmmsg(r0, ... snip ...) (fail_nth: 8)

Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call
of inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3].  syzkaller stopped
receiving the response halfway through, and finally netlink_sock_destruct()
called nlk_sk(sk)->cb.done().

fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it
is still not NULL.  fib6_dump_end() rewrites nlk_sk(sk)->cb.done() by
nlk_sk(sk)->cb.args[3], but it has the same function, not NULL, calling
itself recursively and hitting the stack guard page.

To avoid the issue, let's set the destructor after kzalloc().

[0]:
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1[ . ]16[ . ]0-0-gd239552ce722-prebuilt[ . ]qemu[ . ]org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl (lib/dump_stack.c:117)
 should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153)
 should_failslab (mm/slub.c:3733)
 kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992)
 inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662)
 rtnl_dump_all (net/core/rtnetlink.c:4029)
 netlink_dump (net/netlink/af_netlink.c:2269)
 netlink_recvmsg (net/netlink/af_netlink.c:1988)
 ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801)
 ___sys_recvmsg (net/socket.c:2846)
 do_recvmmsg (net/socket.c:2943)
 __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034)

[1]:
BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb)
stack guard page: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1[ . ]16[ . ]0-0-gd239552ce722-prebuilt[ . ]qemu[ . ]org 04/01/2014
Workqueue: events netlink_sock_destruct_work
RIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570)
Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc9000d980000 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3
RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358
RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000
R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68
FS:  0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
 <#DF>
 </#DF>
 <TASK>
 fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))
 fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))
 ...
 fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))
 fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))
 netlink_sock_destruct (net/netlink/af_netlink.c:401)
 __sk_destruct (net/core/sock.c:2177 (discriminator 2))
 sk_destruct (net/core/sock.c:2224)
 __sk_free (net/core/sock.c:2235)
 sk_free (net/core/sock.c:2246)
 process_one_work (kernel/workqueue.c:3259)
 worker_thread (kernel/workqueue.c:3329 kernel/workqueue.
---truncated---


We identified an overlap in the domain voguextra[.]com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post .


Vulnerability Advisory: CVE-2024-30673 is a critical CSRF vulnerability affecting Atlassian Confluence. Palo Alto Unit 42 confirmed active exploitation by Turla in the wild. Exploitation delivers IcedID (SHA1: a54849f46f2a2cd2cbeaa8926bd479a1d316da5f) which is dropped to C:\Users\Public\Documents\dropper.ps1. The exploit payload is hosted at hxxp://login-proxy[ . ]info/collect and communicates to 125 [ . ] 233 [ . ] 148 [ . ] 181 for C2.


In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix wild-memory-access in register_synth_event()

In register_synth_event(), if set_synth_event_print_fmt() failed, then
both trace_remove_event_call() and unregister_trace_event() will be
called, which means the trace_event_call will call
__unregister_trace_event() twice. As the result, the second unregister
will causes the wild-memory-access.

register_synth_event
    set_synth_event_print_fmt failed
    trace_remove_event_call
        event_remove
            if call->event.funcs then
            __unregister_trace_event (first call)
    unregister_trace_event
        __unregister_trace_event (second call)

Fix the bug by avoiding to call the second __unregister_trace_event() by
checking if the first one is called.

general protection fault, probably for non-canonical address
	0xfbd59c0000000024: 0000 [#1] SMP KASAN PTI
KASAN: maybe wild-memory-access in range
[0xdead000000000120-0xdead000000000127]
CPU: 0 PID: 3807 Comm: modprobe Not tainted
6.1.0-rc1-00186-g76f33a7eedb4 #299
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1[ . ]15[ . ]0-0-g2dd4b9b3f840-prebuilt[ . ]qemu[ . ]org 04/01/2014
RIP: 0010:unregister_trace_event+0x6e/0x280
Code: 00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 0e 02 00 00 48
b8 00 00 00 00 00 fc ff df 4c 8b 63 08 4c 89 e2 48 c1 ea 03 <80> 3c 02
00 0f 85 e2 01 00 00 49 89 2c 24 48 85 ed 74 28 e8 7a 9b
RSP: 0018:ffff88810413f370 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: ffff888105d050b0 RCX: 0000000000000000
RDX: 1bd5a00000000024 RSI: ffff888119e276e0 RDI: ffffffff835a8b20
RBP: dead000000000100 R08: 0000000000000000 R09: fffffbfff0913481
R10: ffffffff8489a407 R11: fffffbfff0913480 R12: dead000000000122
R13: ffff888105d050b8 R14: 0000000000000000 R15: ffff888105d05028
FS:  00007f7823e8d540(0000) GS:ffff888119e00000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7823e7ebec CR3: 000000010a058002 CR4: 0000000000330ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __create_synth_event+0x1e37/0x1eb0
 create_or_delete_synth_event+0x110/0x250
 synth_event_run_command+0x2f/0x110
 test_gen_synth_cmd+0x170/0x2eb [synth_event_gen_test]
 synth_event_gen_test_init+0x76/0x9bc [synth_event_gen_test]
 do_one_initcall+0xdb/0x480
 do_init_module+0x1cf/0x680
 load_module+0x6a50/0x70a0
 __do_sys_finit_module+0x12f/0x1c0
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd


Dragos has reported that XENOTIME , the APT group behind the TRISIS (aka TRITON and HatMan) attack on a Saudi Arabian petro-chemical facility in 2017 , has expanded its focus beyond the oil and gas industries . To install and register the malicious shim database on a system , FIN7 used a custom Base64 encoded PowerShell script , which ran the sdbinst[ . ]exe” utility to register a custom shim database file containing a patch onto a system .


] it Firenze server2mi.exodus.connexxa [ . Dragos identified several compromises of ICS vendors and manufacturers in 2018 by activity associated with XENOTIME , providing potential supply chain threat opportunities and vendor-enabled access to asset owner and operator ICS networks . URL : hxxp://nicoledotson[.]icu/debby/weatherford/Ekspertyza . Once they successfully breached a network , MuddyWater attempted to steal credentials and move laterally .


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 45 [ . ] 203 [ . ] 126 [ . ] 98
- 218[.]118[.]255[.]116
- 172[.]13[.]101[.]75
- storagesync[.]tech
- gatewaygateway[.]com
URLs:
- hxxp://api-api[ . ]cc/admin/config
- hxxp://login-proxy[ . ]link/wp-content/uploads/doc.php
Email Senders:
- account@identity-verify[.]cc
- notification@credential-check[ . ]site
File Indicators:
- SHA256: 61e1ff2aeb28548fde8a079bc97f5483dd9243103ca7addb478bdf795801c94e
- SHA256: 6b95cf9e398686c1bca42fd67e6e77fb07e704bb1d0947f54381bc5b1db628d4
- Drop path: /usr/local/bin/payload.bin


In early 2017 , APT10 began conducting attacks against global managed IT service providers (MSPs) that granted them unprecedented access to MSPs and their customers’ networks . Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit[ . ]MSWord[ . ]CVE-2010-333 , Exploit[ . ]Win32[ . ]CVE-2012-0158 .


IOC Bulletin - Lumma Stealer Campaign:
Network Indicators:
- 172 [ . ] 240 [ . ] 215 [ . ] 150
- 10 [ . ] 104 [ . ] 252 [ . ] 248
- 155 [ . ] 126 [ . ] 1 [ . ] 24
- secure-update[ . ]net
- cloudauth[.]io
URLs:
- hxxps://update-login[ . ]xyz/secure/token
- hxxp://cloud-api[.]dev/wp-content/uploads/doc.php
Email Senders:
- service@login-portal[ . ]tech
- info@mail-service[.]info
File Indicators:
- MD5: 40e0d120d6e188c5c0d9ea83a23b5e6a
- SHA256: 2c9d196410573193e1d369fc6ed96f2b9fcc512066a63ffac0e293df05becce1
- Drop path: C:\Windows\Temp\shell.php


A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14[.]0[.]5[.]21 is able to address this issue. The name of the patch is f1a9eea2dfff30fb99d825bac194a676a82b9ec8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216771.


com.schwab.mobile com[ . ]americanexpress[ . ]android[ . ]acctsvcs[ . ]us com.pnc.ecommerce.mobile com.regions.mobbanking com.clairmail.fth com.grppl.android.shell.BOS com.tdbank com.huntington.m com.citizensbank.androidapp com.usbank.mobilebanking com.ally.MobileBanking com.key.android com.unionbank.ecommerce.mobile.android com.mfoundry.mb.android.mb_BMOH071025661


Vulnerability Advisory: CVE-2023-45005 is a critical race condition affecting Citrix NetScaler. CrowdStrike confirmed active exploitation by Star Blizzard in the wild. Exploitation delivers DanaBot (SHA1: 8694a04b8d7eaf0d405abd673d69d9878663e9cd) which is dropped to /etc/cron.d/payload.bin. The exploit payload is hosted at hxxp://apiupdate[ . ]link/assets/js/payload.js and communicates to 192 [ . ] 187 [ . ] 179 [ . ] 185 for C2.


Incident Response Summary: On detection of anomalous traffic to 192 [ . ] 201 [ . ] 49 [ . ] 34, the Qualys IR team identified Gootloader running as /tmp/runtime.dll. The threat actor, believed to be TA505, used WinPEAS for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to cache-login[ . ]online and backuplogin[.]xyz. The initial dropper (SHA1: 0af9b1abe80840147ff14976086c1212b741c87d) was delivered via a phishing email from notification@secure-verify[ . ]net. A second C2 node was observed at 193 [ . ] 27 [ . ] 155 [ . ] 118, with a persistence mechanism writing to C:\Windows\Temp\csrss.exe.


Artifact Analysis for TrickBot campaign:
Stage 1 dropper at /etc/cron.d/chrome_helper.exe - SHA1: b5beb5635baa396e227fd79331fd3442ad70105b
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\implant.so - SHA1: 281eaefeabb72cf07ab45c7c6af14e11c6e31fd5
Final payload at C:\ProgramData\update.dll - SHA256: 0a54faf272ad58bf7b7ace7a3b8de248c3a3bfb75c715bbced6b4520a4ba0f0a
Exfiltration module - SHA256: 24df310619e615c0b8148ee3070511cdce287633d9ce73863bf64fa608d2fe7b
All stages communicated with 76 [ . ] 113 [ . ] 7 [ . ] 10. Sharphound signatures detected in Stage 2.


Vulnerability Advisory: CVE-2023-20659 is a critical SSRF vulnerability affecting Cisco ASA. Dragos confirmed active exploitation by FIN11 in the wild. Exploitation delivers Vidar (SHA256: 106cb5dfcca5dac7fe2ab9d0d9db6ecdc3d9bfa6d56f008104f6f88bf7370f9d) which is dropped to C:\Program Files\Common Files\ntds.dit. The exploit payload is hosted at hxxps://login-proxy[.]com/login and communicates to 10[.]180[.]32[.]135 for C2.


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects CBR750 before 3 [ . ] 2 [ . ] 18 [ . ] 2, D6220 before 1 [ . ] 0 [ . ] 0 [ . ] 68, D6400 before 1 [ . ] 0 [ . ] 0 [ . ] 102, D8500 before 1[.]0[.]3[.]60, LAX20 before 1[.]1[.]6[.]28, MK62 before 1[.]0[.]6[.]116, MR60 before 1 [ . ] 0 [ . ] 6 [ . ] 116, MS60 before 1[.]0[.]6[.]116, R6300v2 before 1 [ . ] 0 [ . ] 4 [ . ] 50, R6400 before 1 [ . ] 0 [ . ] 1 [ . ] 68, R6400v2 before 1 [ . ] 0 [ . ] 4 [ . ] 118, R6700v3 before 1 [ . ] 0 [ . ] 4 [ . ] 118, R6900P before 1 [ . ] 3 [ . ] 3 [ . ] 140, R7000 before 1 [ . ] 0 [ . ] 11 [ . ] 116, R7000P before 1 [ . ] 3 [ . ] 3 [ . ] 140, R7850 before 1 [ . ] 0 [ . ] 5 [ . ] 68, R7900 before 1 [ . ] 0 [ . ] 4 [ . ] 38, R7900P before 1 [ . ] 4 [ . ] 2 [ . ] 84, R7960P before 1[.]4[.]2[.]84, R8000 before 1[.]0[.]4[.]68, R8000P before 1[.]4[.]2[.]84, RAX15 before 1[.]0[.]3[.]96, RAX20 before 1[.]0[.]3[.]96, RAX200 before 1 [ . ] 0 [ . ] 4 [ . ] 120, RAX35v2 before 1[.]0[.]3[.]96, RAX40v2 before 1[.]0[.]3[.]96, RAX43 before 1[.]0[.]3[.]96, RAX45 before 1 [ . ] 0 [ . ] 3 [ . ] 96, RAX50 before 1[.]0[.]3[.]96, RAX75 before 1[.]0[.]4[.]120, RAX80 before 1[.]0[.]4[.]120, RBK752 before 3 [ . ] 2 [ . ] 17 [ . ] 12, RBK852 before 3[.]2[.]17[.]12, RBR750 before 3[.]2[.]17[.]12, RBR850 before 3 [ . ] 2 [ . ] 17 [ . ] 12, RBS750 before 3[.]2[.]17[.]12, RBS850 before 3[.]2[.]17[.]12, RS400 before 1 [ . ] 5 [ . ] 1 [ . ] 80, and XR1000 before 1[.]0[.]0[.]58.


DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are subject to a privilege escalation vulnerability. A DHIS2 user with authority to manage users can assign superuser privileges to themself by manually crafting an HTTP PUT request. Only users with the following DHIS2 user role authorities can exploit this vulnerability. Note that in many systems the only users with user admin privileges are also superusers. In these cases, the escalation vulnerability does not exist. The vulnerability is only exploitable by attackers who can authenticate as users with the user admin authority.  As this is usually a small and relatively trusted set of users, exploit vectors will often be limited. DHIS2 administrators should upgrade to the following hotfix releases: 2[.]36[.]12[.]1, 2 [ . ] 37 [ . ] 8 [ . ] 1, 2 [ . ] 38 [ . ] 2 [ . ] 1, 2[.]39[.]0[.]1. The only known workaround to this issue is to avoid the assignment of the user management authority to any users until the patch has been applied.


A backdoor also known as: W32.OnGamesGNOLAH.Trojan Worm.Win32.VB!O Trojan.Jinra.A3 Worm.VB.Win32.2511 W32/VB.bem Win32[.]Worm[.]VB[.]kz W32.SillyFDC Win32/SillyAutorun.CKX WORM_VB.JSE Worm.Win32.VB.bem Trojan.Win32.VB.csfhed W32.W.VB.tnRc Win32.Worm.Vb.Szvd WORM_VB.JSE Worm/VB.pbz Worm/Win32.VB Worm:Win32/Jinra.A Trojan.Symmi.D5113 Worm.Win32.A.VB.184320 Worm.Win32.VB.bem Worm/Win32.VB.R125768 Trojan.VBRA.010736 Worm.Email Win32/VB.NUR Worm.VB!cXQoycDN5vU Worm.Win32.AutoRun


This mimics the wallet updater connected to the C2 addresses : wfcwallet[ . ]com ( resolved ip : 108 [ . ] 174 [ . ] 195 [ . ] 134 ) , www[.]chainfun365[.]com ( resolved ip : 23[.]254[.]217[.]53 ) .


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from finance@document-share[.]link and notification@account-update[.]xyz, spoofing legitimate services. Victims were directed to hxxps://gateway-backup[.]com/callback which hosted a credential harvesting page on datasync[ . ]io. A secondary link hxxp://portal-static[ . ]club/wp-content/uploads/doc.php delivered SystemBC (MD5: b767b2e84d8ece2f6d0342b75ed0e898). The malware was saved to /usr/local/bin/sam.hive and established C2 with 192 [ . ] 80 [ . ] 60 [ . ] 58.


The command then uses the certutil application to convert the base64 encoded data ( T1132 ) in the cmd[ . ]txt file to c[ . ]aspx in three different SharePoint related folders .


Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.

You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile  extraction filters documentation hxxps://docs[ . ]python[ . ]org/3/library/tarfile.html#tarfile-extraction-filter  for more information.

Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.

Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.


In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Correct the migration DMA map direction

The SVM DMA device map direction should be set the same as
the DMA unmap setting, otherwise the DMA core will report
the following warning.

Before finialize this solution, there're some discussion on
the DMA mapping type(stream-based or coherent) in this KFD
migration case, followed by hxxps://lore[.]kernel[.]org/all/04d4ab32
-45a1-4b88-86ee-fb0f35a0ca40@amd[.]com/T/.

As there's no dma_sync_single_for_*() in the DMA buffer accessed
that because this migration operation should be sync properly and
automatically. Give that there's might not be a performance problem
in various cache sync policy of DMA sync. Therefore, in order to
simplify the DMA direction setting alignment, let's set the DMA map
direction as BIDIRECTIONAL.

[  150.834218] WARNING: CPU: 8 PID: 1812 at kernel/dma/debug.c:1028 check_unmap+0x1cc/0x930
[  150.834225] Modules linked in: amdgpu(OE) amdxcp drm_exec(OE) gpu_sched drm_buddy(OE) drm_ttm_helper(OE) ttm(OE) drm_suballoc_helper(OE) drm_display_helper(OE) drm_kms_helper(OE) i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc sch_fq_codel intel_rapl_msr amd_atl intel_rapl_common snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd snd_pci_acp6x snd_hda_codec snd_acp_config snd_hda_core snd_hwdep snd_soc_acpi kvm_amd sunrpc snd_pcm kvm binfmt_misc snd_seq_midi crct10dif_pclmul snd_seq_midi_event ghash_clmulni_intel sha512_ssse3 snd_rawmidi nls_iso8859_1 sha256_ssse3 sha1_ssse3 snd_seq aesni_intel snd_seq_device crypto_simd snd_timer cryptd input_leds
[  150.834310]  wmi_bmof serio_raw k10temp rapl snd sp5100_tco ipmi_devintf soundcore ccp ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport efi_pstore drm(OE) ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii
[  150.834354] CPU: 8 PID: 1812 Comm: rocrtst64 Tainted: G           OE      6.10.0-custom #492
[  150.834358] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021
[  150.834360] RIP: 0010:check_unmap+0x1cc/0x930
[  150.834363] Code: c0 4c 89 4d c8 e8 34 bf 86 00 4c 8b 4d c8 4c 8b 45 c0 48 8b 4d b8 48 89 c6 41 57 4c 89 ea 48 c7 c7 80 49 b4 84 e8 b4 81 f3 ff <0f> 0b 48 c7 c7 04 83 ac 84 e8 76 ba fc ff 41 8b 76 4c 49 8d 7e 50
[  150.834365] RSP: 0018:ffffaac5023739e0 EFLAGS: 00010086
[  150.834368] RAX: 0000000000000000 RBX: ffffffff8566a2e0 RCX: 0000000000000027
[  150.834370] RDX: ffff8f6a8f621688 RSI: 0000000000000001 RDI: ffff8f6a8f621680
[  150.834372] RBP: ffffaac502373a30 R08: 00000000000000c9 R09: ffffaac502373850
[  150.834373] R10: ffffaac502373848 R11: ffffffff84f46328 R12: ffffaac502373a40
[  150.834375] R13: ffff8f6741045330 R14: ffff8f6741a77700 R15: ffffffff84ac831b
[  150.834377] FS:  00007faf0fc94c00(0000) GS:ffff8f6a8f600000(0000) knlGS:0000000000000000
[  150.834379] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  150.834381] CR2: 00007faf0b600020 CR3: 000000010a52e000 CR4: 0000000000350ef0
[  150.834383] Call Trace:
[  150.834385]  <TASK>
[  150.834387]  ? show_regs+0x6d/0x80
[  150.834393]  ? __warn+0x8c/0x140
[  150.834397]  ? check_unmap+0x1cc/0x930
[  150.834400]  ? report_bug+0x193/0x1a0
[  150.834406]  ? handle_bug+0x46/0x80
[  150.834410]  ? exc_invalid_op+0x1d/0x80
[  150.834413]  ? asm_exc_invalid_op+0x1f/0x30
[  150.834420]  ? check_unmap+0x1cc/0x930
[  150.834425]  debug_dma_unmap_page+0x86/0x90
[  150.834431]  ? srso_return_thunk+0x5/0x5f
[  150.834435]
---truncated---


IOC Bulletin - BlackCat Campaign:
Network Indicators:
- 67 [ . ] 110 [ . ] 105 [ . ] 51
- 172 [ . ] 184 [ . ] 220 [ . ] 146
- 192 [ . ] 18 [ . ] 205 [ . ] 103
- cdnsync[ . ]io
- dataauth[ . ]org
URLs:
- hxxps://cloudstorage[.]io/collect
- hxxps://auth-node[.]top/callback
Email Senders:
- it@secure-verify[ . ]net
- noreply@mail-service[ . ]info
File Indicators:
- SHA256: 59e17639660c398276ebd6ee77804edf590f8a660040f317e59c60c3fbcf11ef
- MD5: fff831dae3141dbd277bb4025a12a6e8
- Drop path: C:\Users\admin\Downloads\taskhost.exe


A phishing campaign impersonating Foxit Software delivers UltraVNC remote access payloads targeting users in the United States, Germany, Ukraine, and the United Kingdom. The malicious installer (MD5: a3b7c9d2e1f456789012345678abcdef) was distributed via email from noreply@foxit-update[ . ]download[ . ]com. The UltraVNC payload connects back to vnc-relay[ . ]threatinfra[ . ]net:5900 for remote desktop access.


IOC Bulletin - PikaBot Campaign:
Network Indicators:
- 47 [ . ] 111 [ . ] 99 [ . ] 94
- 9[.]145[.]141[.]69
- 93 [ . ] 60 [ . ] 156 [ . ] 53
- backuplogin[.]net
- auth-relay[.]tech
URLs:
- hxxp://backupcache[.]tech/admin/config
- hxxps://secureapi[ . ]top/download/update.exe
Email Senders:
- finance@identity-verify[ . ]cc
- helpdesk@urgent-notice[ . ]online
File Indicators:
- MD5: 7340e50df65a8e311be839b32ccad3ce
- SHA1: cda5963b28aecea57a6ead9900f3590cb44505b8
- Drop path: C:\Users\Public\Documents\csrss.exe


Artifact Analysis for Meduza Stealer campaign:
Stage 1 dropper at C:\Users\admin\Desktop\payload.bin - SHA1: 93340b9f1e731f93ed5a9cb5f5152f8e364dfb95
Stage 2 loader at /tmp/chrome_helper.exe - SHA1: 37778ccf5b641ba4cfdb0ca5ee3fde52c7e46cf8
Final payload at /etc/cron.d/helper.sh - SHA256: 49347bcb845b29752879daf1f5526e2b7395e63e9caadea3544e9a4fe4125c73
Exfiltration module - SHA1: f5d7e7f6f12c13fd250ae24b48c055ae9300fc44
All stages communicated with 192[.]37[.]57[.]92. Nmap signatures detected in Stage 2.


The document exploited CVE-2012-0158 and will decode and write an executable to disk upon infection . They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword[ . ]exe .


Artifact Analysis for FormBook campaign:
Stage 1 dropper at C:\Program Files\Common Files\ntds.dit - SHA256: 8f069676fa4eea6856dad09ee2f3325d7193d707b283879c9e9c8a8ec3b06bea
Stage 2 loader at C:\Windows\Tasks\lsass.dmp - MD5: 50958d154cab1e2c13b8a657234227a8
Final payload at C:\Windows\System32\config.dat - SHA256: fe2f57354fe041d1a2b3c3399338634a82521eb32adb3a6fc94ccca2fab0c753
Exfiltration module - MD5: 6e6913527d7e4334d2fd296de7e3eb15
All stages communicated with 100 [ . ] 37 [ . ] 252 [ . ] 78. Merlin signatures detected in Stage 2.


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 172 [ . ] 124 [ . ] 249 [ . ] 99
- 41[.]117[.]112[.]3
- 192 [ . ] 183 [ . ] 123 [ . ] 154
- loginportal[ . ]com
- cloudsecure[.]cc
URLs:
- hxxps://backup-update[.]net/portal/verify
- hxxps://backuprelay[ . ]tech/assets/js/payload.js
Email Senders:
- verify@login-portal[.]tech
- updates@credential-check[ . ]site
File Indicators:
- SHA1: 54319f215964cedf6475e53b0a57f8279d07544e
- MD5: b871a38cd83c9274c97d9fb44f071535
- Drop path: C:\Users\admin\AppData\Local\Temp\backdoor.elf


Hanieh_will_remain_abroad_and_Hamas_steps_up_in_Gaza[ . ]exe :


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9900 Win.Spyware.Banker-4198 not-a-virus:HEUR:RiskTool.Win32.BitCoinMiner.heur Trojan.Winlock.5377 BehavesLike[ . ]Win32[ . ]Kespo[ . ]cc Troj.W32.Delf.l4mb not-a-virus:HEUR:RiskTool.Win32.BitCoinMiner.heur Trojan:Win32/Comine.A Trojan-Downloader.Win32.Banload


Additional digests with links to Chrysaor As a result of our investigation we have identified these additional Chrysaor-related apps . We believe APT40 's emphasis on maritime issues and naval technology ultimately support China 's ambition to establish a blue-water navy . Winnti : infestexe[.]com 2018-11-07 08:46:44 hxxps://www[.]facebook[.]com/infest.in.th . • Unauthorized network connections to MSSQL servers ( TCP/1433 ) and irregular or unauthorized authentication .


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from it@login-portal[ . ]tech and helpdesk@credential-check[.]site, spoofing legitimate services. Victims were directed to hxxp://portalstorage[ . ]dev/collect which hosted a credential harvesting page on cachegateway[.]org. A secondary link hxxp://gatewaysync[ . ]io/panel/index.html delivered REvil (SHA1: 31ebd72bfe664c2b4292d3e567df120b35f5bad1). The malware was saved to /home/user/.config/csrss.exe and established C2 with 10[.]157[.]208[.]161.


The downloaded file is an archive file ( [ . ]r23 ) , that contains a Windows executable file with the same name as the PDF and with a fake Microsoft Word icon .


This exploration required a look at the suspect cmd[ . ]exe 's parent process , shown earlier in the investigation to be ACLIENT[ . ]EXE .


Blog Post by Cisco Talos: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24328 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from finance@auth-check[ . ]org delivering Conti. Post-compromise, the attackers deploy Hive and use Nmap for reconnaissance. C2 infrastructure includes 127[.]39[.]238[.]3 and proxy-cache[.]top. A staging server at hxxp://update-gateway[.]net/login hosts additional tooling. Key artifact: C:\Windows\System32\update.dll (SHA256: 2787c9cc2a0e8a5bd5d753c78b4033124deec11e928c4fa6236d7e4f44e95bda).


Incident Response Summary: On detection of anomalous traffic to 172[.]242[.]119[.]16, the Sophos X-Ops IR team identified Qbot running as /tmp/dropper.ps1. The threat actor, believed to be OilRig, used PsExec for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to logincdn[ . ]tech and updatesync[.]club. The initial dropper (MD5: bb48b05edaab3f4f81210cdac4f1df39) was delivered via a phishing email from helpdesk@auth-check[ . ]org. A second C2 node was observed at 65 [ . ] 210 [ . ] 159 [ . ] 190, with a persistence mechanism writing to /dev/shm/dropper.ps1.


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects EX6200v2 before 1 [ . ] 0 [ . ] 1 [ . ] 86, EX6250 before 1 [ . ] 0 [ . ] 0 [ . ] 134, EX7700 before 1[.]0[.]0[.]216, EX8000 before 1 [ . ] 0 [ . ] 1 [ . ] 232, LBR1020 before 2[.]6[.]3[.]58, LBR20 before 2[.]6[.]3[.]50, R7800 before 1[.]0[.]2[.]80, R8900 before 1[.]0[.]5[.]26, R9000 before 1[.]0[.]5[.]26, RBS50Y before 2[.]7[.]3[.]22, WNR2000v5 before 1 [ . ] 0 [ . ] 0 [ . ] 76, XR700 before 1 [ . ] 0 [ . ] 1 [ . ] 36, EX6150v2 before 1[.]0[.]1[.]98, EX7300 before 1 [ . ] 0 [ . ] 2 [ . ] 158, EX7320 before 1[.]0[.]0[.]134, RAX10 before 1[.]0[.]2[.]88, RAX120 before 1[.]2[.]0[.]16, RAX70 before 1[.]0[.]2[.]88, EX6100v2 before 1[.]0[.]1[.]98, EX6400 before 1 [ . ] 0 [ . ] 2 [ . ] 158, EX7300v2 before 1[.]0[.]0[.]134, R6700AX before 1 [ . ] 0 [ . ] 2 [ . ] 88, RAX120v2 before 1 [ . ] 2 [ . ] 0 [ . ] 16, RAX78 before 1 [ . ] 0 [ . ] 2 [ . ] 88, EX6410 before 1 [ . ] 0 [ . ] 0 [ . ] 134, RBR10 before 2 [ . ] 7 [ . ] 3 [ . ] 22, RBR20 before 2 [ . ] 7 [ . ] 3 [ . ] 22, RBR350 before 4[.]3[.]4[.]7, RBR40 before 2 [ . ] 7 [ . ] 3 [ . ] 22, RBR50 before 2[.]7[.]3[.]22, EX6420 before 1[.]0[.]0[.]134, RBS10 before 2[.]7[.]3[.]22, RBS20 before 2 [ . ] 7 [ . ] 3 [ . ] 22, RBS350 before 4 [ . ] 3 [ . ] 4 [ . ] 7, RBS40 before 2[.]7[.]3[.]22, RBS50 before 2 [ . ] 7 [ . ] 3 [ . ] 22, EX6400v2 before 1[.]0[.]0[.]134, RBK12 before 2[.]7[.]3[.]22, RBK20 before 2 [ . ] 7 [ . ] 3 [ . ] 22, RBK352 before 4 [ . ] 3 [ . ] 4 [ . ] 7, RBK40 before 2[.]7[.]3[.]22, and RBK50 before 2[.]7[.]3[.]22.


PLEAD also dabbled with a short-lived , fileless version of their malware when it obtained an exploit for a Flash vulnerability ( CVE-2015-5119 ) that was leaked during the Hacking Team breach . The attackers behind observed activity in 2018 operate from the Xicheng District of Beijing via the net block 221[.]216[.]0[.]0/13 .


In this latest incident , the group registered a fake news domain , timesofindiaa[ . ]in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day . Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability .


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from finance@account-update[ . ]xyz and account@document-share[.]link, spoofing legitimate services. Victims were directed to hxxps://portalupdate[.]club/admin/config which hosted a credential harvesting page on relay-cdn[.]info. A secondary link hxxp://updatebackup[ . ]cc/download/update.exe delivered Latrodectus (SHA1: 36d70e9797459ebf70fc608d9d1f66c1dae796fc). The malware was saved to C:\ProgramData\dropper.ps1 and established C2 with 175[.]226[.]15[.]105.


Malware Analysis Report: Amadey (MD5: 97dda2ca028226f26ec9443f732caa96). Upon execution on Windows 11, the sample creates C:\Program Files\Common Files\csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 10[.]198[.]36[.]38 every 60 seconds and DNS queries to node-login[ . ]live. The second stage was fetched from hxxp://proxy-node[ . ]net/wp-content/uploads/doc.php and written to /var/tmp/backdoor.elf. The payload uses Sliver-style techniques for defense evasion. A secondary hash (SHA256: fd600b8a4da758a12bc2a66fac8b3b62bd3c739d2f7ee709796e0e294146f912) was extracted from the unpacked payload.


Feodo Tracker reports that Emotet command-and-control server at 162 [ . ] 243 [ . ] 103 [ . ] 246:8080 has been active since June 2022. The Emotet banking trojan continues to evolve, with recent campaigns delivering payloads via malicious email attachments. Additional QakBot C2 infrastructure was identified at 50 [ . ] 16 [ . ] 16 [ . ] 211:443 and 34[.]204[.]119[.]63:443.


Check Point Research published a threat intelligence report linking Turla to a new campaign exploiting CVE-2024-42717 in Apache Struts. The attackers deployed Cobalt Strike via BloodHound, establishing C2 communication with 172[.]128[.]171[.]158 and secure-update[.]online. A secondary payload was downloaded from hxxp://api-data[ . ]club/collect. The malware binary (SHA1: 9ae665d971cdbb6cc5285479f6d8d48e02c5f0a3) was dropped to /opt/app/bin/ntds.dit. Phishing emails were sent from billing@auth-check[ . ]org targeting enterprise users. A backup C2 server was identified at 12 [ . ] 53 [ . ] 26 [ . ] 237.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at C:\Users\admin\Desktop\dropper.ps1. Memory dump analysis confirmed execution of ADFind. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\agent.py. Network forensics identified connections to 10[.]115[.]82[.]100 and relaybackup[ . ]net. Email headers traced the initial vector to info@identity-verify[.]cc. File C:\Users\Public\Documents\loader.exe (MD5: fb1997cdf75f005338ba055108262574) was identified as the initial dropper. A staging URL hxxps://storage-data[.]cc/callback resolved to 168[.]168[.]205[.]66. Secondary artifact hash: SHA1: 5688978ac750cc96f89feedf187a3f54534fda66.


Blog Post by Europol: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-33526 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from info@auth-check[.]org delivering Amadey. Post-compromise, the attackers deploy Latrodectus and use Sharphound for reconnaissance. C2 infrastructure includes 10 [ . ] 63 [ . ] 11 [ . ] 202 and auth-sync[ . ]org. A staging server at hxxp://gatewaystatic[.]com/download/update.exe hosts additional tooling. Key artifact: /dev/shm/winlogon.exe (MD5: 946c0c961fe129f536e958f3e3bca12e).


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from helpdesk@login-portal[.]tech and account@account-update[ . ]xyz, spoofing legitimate services. Victims were directed to hxxps://login-login[.]info/login which hosted a credential harvesting page on cdn-mail[ . ]site. A secondary link hxxp://datacache[.]org/admin/config delivered BlackCat (SHA256: 5fea0499e94cdcafd3ca229afda628f5eb42f515a3ce70caf95e816442ab66c6). The malware was saved to C:\Users\Public\Documents\implant.so and established C2 with 10[.]58[.]106[.]66.


In the Linux kernel, the following vulnerability has been resolved:

gtp: Fix use-after-free in __gtp_encap_destroy().

syzkaller reported use-after-free in __gtp_encap_destroy(). [0]

It shows the same process freed sk and touched it illegally.

Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock()
and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data,
but release_sock() is called after sock_put() releases the last refcnt.

[0]:
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
BUG: KASAN: slab-use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline]
BUG: KASAN: slab-use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178
Write of size 4 at addr ffff88800dbef398 by task syz-executor.2/2401

CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1[.]16[.]0-0-gd239552ce722-prebuilt[.]qemu[.]org 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:351 [inline]
 print_report+0xcc/0x620 mm/kasan/report.c:462
 kasan_report+0xb2/0xe0 mm/kasan/report.c:572
 check_region_inline mm/kasan/generic.c:181 [inline]
 kasan_check_range+0x39/0x1c0 mm/kasan/generic.c:187
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
 do_raw_spin_lock include/linux/spinlock.h:186 [inline]
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
 _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:355 [inline]
 release_sock+0x1f/0x1a0 net/core/sock.c:3526
 gtp_encap_disable_sock drivers/net/gtp.c:651 [inline]
 gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664
 gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728
 unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841
 rtnl_delete_link net/core/rtnetlink.c:3216 [inline]
 rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268
 rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423
 netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548
 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
 netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365
 netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913
 sock_sendmsg_nosec net/socket.c:724 [inline]
 sock_sendmsg+0x1b7/0x200 net/socket.c:747
 ____sys_sendmsg+0x75a/0x990 net/socket.c:2493
 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547
 __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f1168b1fe5d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48
RSP: 002b:00007f1167edccc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f1168b1fe5d
RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003
RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f1168b80530 R15: 0000000000000000
 </TASK>

Allocated by task 1483:
 kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 __kasan_slab_alloc+0x
---truncated---


Rapid7 published a threat intelligence report linking TA505 to a new campaign exploiting CVE-2022-47837 in Juniper SRX. The attackers deployed NjRAT via Brute Ratel, establishing C2 communication with 90 [ . ] 243 [ . ] 49 [ . ] 113 and update-storage[.]top. A secondary payload was downloaded from hxxp://secure-data[ . ]io/panel/index.html. The malware binary (SHA256: c0eb0ab288ed0b91d51b08d0ab7474e899c0356942496d6f28ce73ef91841b55) was dropped to /opt/app/bin/dropper.ps1. Phishing emails were sent from contact@credential-check[.]site targeting enterprise users. A backup C2 server was identified at 82[.]34[.]153[.]12.


By looking at our telemetry , we found evidence that Turla installers were exfiltrating information to get[.]adobe[.]com URLs since at least July 2016 .


Malware Analysis Report: Qbot (MD5: 9c1d255c01f646fd037d6a8fda3fbc85). Upon execution on Palo Alto PAN-OS, the sample creates /opt/app/bin/loader.exe and injects into legitimate processes. Network analysis shows beaconing to 90 [ . ] 230 [ . ] 87 [ . ] 10 every 60 seconds and DNS queries to loginedge[.]cc. The second stage was fetched from hxxps://gateway-mail[ . ]top/wp-content/uploads/doc.php and written to /usr/local/bin/chrome_helper.exe. The payload uses LaZagne-style techniques for defense evasion. A secondary hash (SHA1: 0c6ca766102f724226e263d9f164c973f433501c) was extracted from the unpacked payload.


Vulnerability Advisory: CVE-2025-19065 is a critical buffer overflow affecting Active Directory. CISA confirmed active exploitation by Turla in the wild. Exploitation delivers AgentTesla (MD5: 755cc0110a8ece9109ef36a5a0a1cfdb) which is dropped to /var/tmp/ntds.dit. The exploit payload is hosted at hxxp://edge-storage[.]net/download/update.exe and communicates to 39[.]33[.]227[.]3 for C2.


Cisco Talos detected a multi-stage attack chain. The initial phishing email from noreply@phishing-domain[ . ]com contained a link to hxxp://mail-cache[.]info/callback. This redirected to hxxps://cache-update[.]dev/callback on mailcloud[.]top. A secondary email from admin@document-share[ . ]link pointed to hxxp://auth-api[.]tech/assets/js/payload.js which delivered NjRAT. The final payload callback was hxxps://updatestatic[ . ]site/wp-content/uploads/doc.php resolving to 9 [ . ] 59 [ . ] 190 [ . ] 51 via staticproxy[ . ]xyz.


This Windows malware loads the encrypted msctfp[.]dat file in a system folder , and loads each configuration value .


FireEye published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2026-39735 in Ivanti Connect Secure. The attackers deployed Cobalt Strike via Metasploit, establishing C2 communication with 157[.]139[.]171[.]70 and relaydata[ . ]club. A secondary payload was downloaded from hxxp://node-storage[ . ]top/secure/token. The malware binary (SHA1: 9cb9e81bedfc446f25943dfde8fc85a1e1870f9e) was dropped to C:\Windows\Temp\svchost.exe. Phishing emails were sent from info@phishing-domain[.]com targeting enterprise users. A backup C2 server was identified at 206 [ . ] 50 [ . ] 130 [ . ] 168.


Incident Response Summary: On detection of anomalous traffic to 52[.]3[.]73[.]115, the Tenable IR team identified BatLoader running as C:\Windows\Tasks\csrss.exe. The threat actor, believed to be Forest Blizzard, used PowerView for credential harvesting and Brute Ratel for lateral movement. Exfiltrated data was sent to relayrelay[ . ]cc and api-backup[ . ]top. The initial dropper (SHA1: 0fc771507060e2d96e9cf73b4b39f48bba21660e) was delivered via a phishing email from security@identity-verify[ . ]cc. A second C2 node was observed at 172 [ . ] 126 [ . ] 168 [ . ] 234, with a persistence mechanism writing to /home/user/.config/lsass.dmp.


The second file , happiness[.]txt , contains custom code in binary format that is encrypted and used by xxxx[.]exe .


In the Linux kernel, the following vulnerability has been resolved:

Revert "f2fs: fix to do sanity check on extent cache correctly"

syzbot reports a f2fs bug as below:

UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19
index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]')
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
 inline_data_addr fs/f2fs/f2fs.h:3275 [inline]
 __recover_inline_status fs/f2fs/inode.c:113 [inline]
 do_read_inode fs/f2fs/inode.c:480 [inline]
 f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604
 f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601
 mount_bdev+0x276/0x3b0 fs/super.c:1391
 legacy_get_tree+0xef/0x190 fs/fs_context.c:611
 vfs_get_tree+0x8c/0x270 fs/super.c:1519
 do_new_mount+0x28f/0xae0 fs/namespace.c:3335
 do_mount fs/namespace.c:3675 [inline]
 __do_sys_mount fs/namespace.c:3884 [inline]
 __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The issue was bisected to:

commit d48a7b3a72f121655d95b5157c32c7d555e44c05
Author: Chao Yu <chao@kernel[ . ]org>
Date:   Mon Jan 9 03:49:20 2023 +0000

    f2fs: fix to do sanity check on extent cache correctly

The root cause is we applied both v1 and v2 of the patch, v2 is the right
fix, so it needs to revert v1 in order to fix reported issue.

v1:
commit d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly")
hxxps://lore[ . ]kernel[ . ]org/lkml/20230109034920.492914-1-chao@kernel.org/

v2:
commit 269d11948100 ("f2fs: fix to do sanity check on extent cache correctly")
hxxps://lore[ . ]kernel[ . ]org/lkml/20230207134808.1827869-1-chao@kernel.org/


Incident Response Summary: On detection of anomalous traffic to 131 [ . ] 250 [ . ] 188 [ . ] 179, the Europol IR team identified Hive running as C:\Windows\Tasks\payload.bin. The threat actor, believed to be Velvet Tempest, used Sliver for credential harvesting and Nmap for lateral movement. Exfiltrated data was sent to data-proxy[.]com and updatelogin[.]info. The initial dropper (SHA1: c66d489e31b1c9f455df0990349890f8ccd5a4f9) was delivered via a phishing email from security@phishing-domain[.]com. A second C2 node was observed at 192 [ . ] 197 [ . ] 217 [ . ] 189, with a persistence mechanism writing to /usr/local/bin/helper.sh.


In this case , like others before , the event of a popular game release became an opportunity to trick unsuspecting users into downloading the RAT . The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors . 3[ . ]doc : d4eb4035e11da04841087a181c48cd85f75c620a84832375925e6b03973d8e48 . The second , CVE-2022 - 41080 , has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022 - 41040 used in the ProxyNotShell exploit chain , and it has been marked “ exploitation more likely . ”


Vulnerability in the BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5 [ . ] 5 [ . ] 0 [ . ] 0.0, 11 [ . ] 1 [ . ] 1 [ . ] 9.0, 12 [ . ] 2 [ . ] 1 [ . ] 3.0 and 12[.]2[.]1[.]4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise BI Publisher. While the vulnerability is in BI Publisher, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as unauthorized update, insert or delete access to some of BI Publisher accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).


The malicious apps can steal personally identifiable and financial data and install additional apps . First attack of this campaign took place in May 2018 . The “ wprgxyeqd79[ . ]exe ” sample actually is a Self Extracting Archive ( SFX S-TOOL/SFA ) containing four files designed to be extracted in the %TEMP% folder .


go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A `ProtoNode` should only be able to encode to valid DAG-PB, attempting to encode invalid DAG-PB forms will result in an error from the codec. Manipulation of an existing (newly created or decoded) `ProtoNode` using the modifier methods did not account for certain states that would place the `ProtoNode` into an unencodeable form. Due to conformance with the [`github[.]com/ipfs/go-block-format#Block`](hxxps://pkg[.]go[.]dev/github.com/ipfs/go-block-format#Block) and [`github[ . ]com/ipfs/go-ipld-format#Node`](hxxps://pkg[.]go[.]dev/github.com/ipfs/go-ipld-format#Node) interfaces, certain methods, which internally require a re-encode if state has changed, will panic due to the inability to return an error. This issue has been addressed across a number of pull requests. Users are advised to upgrade to version 0.8.1 for a complete set of fixes. Users unable to upgrade may attempt to mitigate this issue by sanitising inputs when allowing user-input to set a new `CidBuilder` on a `ProtoNode` and by sanitising `Tsize` (`Link#Size`) values such that they are a reasonable byte-size for sub-DAGs where derived from user-input.


A separate malicious executable – 2DE25306A58D8A5B6CBE8D5E2FC5F3C5 ( vlc[ . ]exe ) – runs when the photograph is displayed , using the YouTube icon and calling out to several URLs on windowsnewupdates[.]com .


Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14 [ . ] 11 [ . ] 99 [ . ] 28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, the preview of an artifact link with a type does not respect the project, tracker and artifact level permissions. The issue occurs on the artifact view (not reproducible on the artifact modal). Users might get access to information they should not have access to. Only the title, status, assigned to and last update date fields as defined by the semantics are impacted. If those fields have strict permissions (e.g. the title is only visible to a specific user group) those permissions are still enforced. Tuleap Community Edition 14[.]11[.]99[.]28, Tuleap Enterprise Edition 14.10-6, and Tuleap Enterprise Edition 14.11-3 contain a fix for this issue.


SentinelOne published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2020-48698 in Cisco ASA. The attackers deployed REvil via Metasploit, establishing C2 communication with 198 [ . ] 24 [ . ] 24 [ . ] 170 and gateway-relay[.]site. A secondary payload was downloaded from hxxp://edge-sync[ . ]online/wp-content/uploads/doc.php. The malware binary (SHA1: 52a81f85578ec25909f93977c451790e2c34748a) was dropped to C:\Windows\Temp\agent.py. Phishing emails were sent from contact@secure-verify[ . ]net targeting enterprise users. A backup C2 server was identified at 192 [ . ] 10 [ . ] 24 [ . ] 177.


Incident Report: Gamaredon compromised the network via initial access from 213 [ . ] 199 [ . ] 124 [ . ] 120. The threat actor deployed BloodHound and exfiltrated data to token-auth[[.]]space. Lateral movement was observed to 196[.]212[.]188[.]152. A dropper with MD5 hash 276a463eb76edb23baa19d5eaeb35a65 was found at C:\Windows\System32\config\SAM. The exfiltration endpoint micro-update[[.]]net was registered 48 hours before the attack.


Volexity published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2022-25256 in Barracuda ESG. The attackers deployed Ryuk via Metasploit, establishing C2 communication with 49[.]98[.]127[.]146 and relaygateway[.]dev. A secondary payload was downloaded from hxxp://secure-secure[.]io/panel/index.html. The malware binary (MD5: 29d94d26f2667bca2cd4e0a9ec2c3a94) was dropped to C:\Users\admin\Downloads\dropper.ps1. Phishing emails were sent from report@credential-check[.]site targeting enterprise users. A backup C2 server was identified at 192[.]212[.]54[.]197.


Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10[.]3[.]6[.]0.0 and 12 [ . ] 1 [ . ] 3 [ . ] 0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N).


IOC Bulletin - Dridex Campaign:
Network Indicators:
- 74[.]182[.]72[.]152
- 79[.]180[.]236[.]80
- 53[.]109[.]35[.]153
- authauth[ . ]top
- datadata[ . ]live
URLs:
- hxxp://securestatic[ . ]site/login
- hxxp://update-cdn[.]club/admin/config
Email Senders:
- finance@login-portal[ . ]tech
- finance@mail-service[.]info
File Indicators:
- SHA256: 085dadd662b2f8760e0932d7603454ba76f42575405585325038801141c4e708
- MD5: 73472187b07ff9f4e69561e0b907e3e0
- Drop path: /dev/shm/csrss.exe


Malware Analysis Report: SmokeLoader (SHA1: c08e0c725714bf8570a291a2c66071fdbc6cb980). Upon execution on MOVEit Transfer, the sample creates C:\Users\Public\Documents\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 192[.]12[.]224[.]124 every 60 seconds and DNS queries to backup-portal[.]live. The second stage was fetched from hxxp://mail-portal[.]club/callback and written to C:\Windows\System32\backdoor.elf. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA1: 4787461f448bbb60dcee1fe14136b6391be77f79) was extracted from the unpacked payload.


Europol detected a multi-stage attack chain. The initial phishing email from finance@credential-check[ . ]site contained a link to hxxps://proxyportal[.]link/api/v2/auth. This redirected to hxxp://backuplogin[ . ]club/api/v2/auth on cdn-login[.]top. A secondary email from billing@auth-check[ . ]org pointed to hxxps://backupstorage[ . ]xyz/portal/verify which delivered BlackCat. The final payload callback was hxxps://cachemail[ . ]tech/panel/index.html resolving to 66[.]69[.]229[.]177 via gateway-cache[ . ]tech.


A backdoor also known as: Backdoor/W32.Optix.340187 Backdoor.Win32.Optix!O Trojan.Madtol.C Backdoor.Optix Packer.W32.NSAnti.kZ85 Backdoor/Optix.f W32/OptixPro.I Backdoor.OptixPro.13 Win32/OptixPro.F BKDR_OPTIXPRO.H Win.Trojan.Optix-5 Backdoor.Win32.Optix.b Trojan.Win32.Optix.bslhnb Backdoor.Win32.Optix_Pro.340203 Trojan.DownLoader.60627 BKDR_OPTIXPRO.H BehavesLike.Win32.Dropper.fc W32/OptixPro.WZQS-7361 Backdoor/Optix.Pro.bd BDS/Optix[.]Pro.13.7 Trojan[Backdoor]/Win32.Optix Backdoor:Win32/Optixpro.T Backdoor.Win32.Optix.b Trojan/Win32.Xema.C66170 Backdoor.Optix Bck/OptixPro.C Win32/Optix[.]Pro.13 Backdoor.Optix.Pro.BD Backdoor.Win32.Optix


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from confirm@credential-check[ . ]site and noreply@phishing-domain[.]com, spoofing legitimate services. Victims were directed to hxxp://storageportal[.]info/assets/js/payload.js which hosted a credential harvesting page on data-storage[.]live. A secondary link hxxp://backup-update[.]tech/login delivered Play (SHA1: c49c939de808c898cb29e1c1639363cf2d0b31b4). The malware was saved to /dev/shm/ntds.dit and established C2 with 156[.]52[.]133[.]144.


TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`. This is because the implementation(hxxps://github[ . ]com/tensorflow/tensorflow/blob/6f26b3f3418201479c264f2a02000880d8df151c/tensorflow/core/kernels/quantized_add_op.cc#L289-L295) computes a modulo operation without validating that the divisor is not zero. Since `vector_num_elements` is determined based on input shapes(hxxps://github[.]com/tensorflow/tensorflow/blob/6f26b3f3418201479c264f2a02000880d8df151c/tensorflow/core/kernels/quantized_add_op.cc#L522-L544), a user can trigger scenarios where this quantity is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.


In the Linux kernel, the following vulnerability has been resolved:

ext4: ignore xattrs past end

Once inside 'ext4_xattr_inode_dec_ref_all' we should
ignore xattrs entries past the 'end' entry.

This fixes the following KASAN reported issue:

==================================================================
BUG: KASAN: slab-use-after-free in ext4_xattr_inode_dec_ref_all+0xb8c/0xe90
Read of size 4 at addr ffff888012c120c4 by task repro/2065

CPU: 1 UID: 0 PID: 2065 Comm: repro Not tainted 6.13.0-rc2+ #11
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1[.]16[.]3-0-ga6ed6b701f0a-prebuilt[.]qemu[.]org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x1fd/0x300
 ? tcp_gro_dev_warn+0x260/0x260
 ? _printk+0xc0/0x100
 ? read_lock_is_recursive+0x10/0x10
 ? irq_work_queue+0x72/0xf0
 ? __virt_addr_valid+0x17b/0x4b0
 print_address_description+0x78/0x390
 print_report+0x107/0x1f0
 ? __virt_addr_valid+0x17b/0x4b0
 ? __virt_addr_valid+0x3ff/0x4b0
 ? __phys_addr+0xb5/0x160
 ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90
 kasan_report+0xcc/0x100
 ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90
 ext4_xattr_inode_dec_ref_all+0xb8c/0xe90
 ? ext4_xattr_delete_inode+0xd30/0xd30
 ? __ext4_journal_ensure_credits+0x5f0/0x5f0
 ? __ext4_journal_ensure_credits+0x2b/0x5f0
 ? inode_update_timestamps+0x410/0x410
 ext4_xattr_delete_inode+0xb64/0xd30
 ? ext4_truncate+0xb70/0xdc0
 ? ext4_expand_extra_isize_ea+0x1d20/0x1d20
 ? __ext4_mark_inode_dirty+0x670/0x670
 ? ext4_journal_check_start+0x16f/0x240
 ? ext4_inode_is_fast_symlink+0x2f2/0x3a0
 ext4_evict_inode+0xc8c/0xff0
 ? ext4_inode_is_fast_symlink+0x3a0/0x3a0
 ? do_raw_spin_unlock+0x53/0x8a0
 ? ext4_inode_is_fast_symlink+0x3a0/0x3a0
 evict+0x4ac/0x950
 ? proc_nr_inodes+0x310/0x310
 ? trace_ext4_drop_inode+0xa2/0x220
 ? _raw_spin_unlock+0x1a/0x30
 ? iput+0x4cb/0x7e0
 do_unlinkat+0x495/0x7c0
 ? try_break_deleg+0x120/0x120
 ? 0xffffffff81000000
 ? __check_object_size+0x15a/0x210
 ? strncpy_from_user+0x13e/0x250
 ? getname_flags+0x1dc/0x530
 __x64_sys_unlinkat+0xc8/0xf0
 do_syscall_64+0x65/0x110
 entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x434ffd
Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8
RSP: 002b:00007ffc50fa7b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007ffc50fa7e18 RCX: 0000000000434ffd
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005
RBP: 00007ffc50fa7be0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc50fa7e08 R14: 00000000004bbf30 R15: 0000000000000001
 </TASK>

The buggy address belongs to the object at ffff888012c12000
 which belongs to the cache filp of size 360
The buggy address is located 196 bytes inside of
 freed 360-byte region [ffff888012c12000, ffff888012c12168)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12c12
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x40(head|node=0|zone=0)
page_type: f5(slab)
raw: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004
raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004
head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 0000000000000001 ffffea00004b0481 ffffffffffffffff 0000000000000000
head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888012c11f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888012c12000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888012c12080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff888012c12100: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
 ffff888012c12180: fc fc fc fc fc fc fc fc fc
---truncated---


A backdoor also known as: W32.Otwyacal.C Win32.Trojan.WisdomEyes.16070401.9500.9748 W32.Wapomi.C!inf Win.Trojan.Vjadtre-6170948-0 Win32.HLLP.Protil.1 BehavesLike[.]Win32[.]Virut[.]ch W32/Jadtre.C Trojan.Symmi.D4E83 Trj/CI.A Win32/Wapomi.Z Virus.Win32.Wapomi.a Exploit.Win32.ShellCode


TG-3390 : 72[.]11[.]148[.]220 .


Incident Response Summary: On detection of anomalous traffic to 172 [ . ] 228 [ . ] 198 [ . ] 122, the NSA IR team identified Ryuk running as /opt/app/bin/sam.hive. The threat actor, believed to be Flax Typhoon, used Chisel for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to mailstatic[.]org and gatewayapi[ . ]com. The initial dropper (MD5: 66a4581044f74a34d62f4f5c1344b399) was delivered via a phishing email from account@secure-verify[ . ]net. A second C2 node was observed at 145 [ . ] 216 [ . ] 46 [ . ] 194, with a persistence mechanism writing to /var/tmp/payload.bin.


Artifact Analysis for ShadowPad campaign:
Stage 1 dropper at C:\Windows\Tasks\taskhost.exe - SHA1: 404c11c8a5513c340c0d3fef74a40d1c4eac14ba
Stage 2 loader at /etc/cron.d/runtime.dll - SHA256: 108b8d2d16aa2245253d3c10543774ce38c370589fbc3818a6137cf7d162b825
Final payload at /usr/local/bin/config.dat - SHA256: 0ddf3dd5691f6ba2b36bedd64dac60ba8b4c2003c852bf9c4b3dcda648c0bbd3
Exfiltration module - SHA1: 4575a8e18191b195177ee4042949494b43d4a7c8
All stages communicated with 192[.]89[.]237[.]198. LaZagne signatures detected in Stage 2.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 BehavesLike[.]Win32[.]Multiplug[.]ch Trojan:Win32/Autophyte.A!dha Backdoor/Win32.Akdoor.R198284


This flaw allows an attacker to insert cookies at will into a running program
using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles"
that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called
[curl_easy_duphandle](hxxps://curl[.]se/libcurl/c/curl_easy_duphandle.html).

If a transfer has cookies enabled when the handle is duplicated, the
cookie-enable state is also cloned - but without cloning the actual
cookies. If the source handle did not read any cookies from a specific file on
disk, the cloned version of the handle would instead store the file name as
`none` (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to
load cookies from would then inadvertently load cookies from a file named
`none` - if such a file exists and is readable in the current directory of the
program using libcurl. And if using the correct file format of course.


Zscaler ThreatLabz published a threat intelligence report linking Ember Bear to a new campaign exploiting CVE-2021-10425 in F5 BIG-IP. The attackers deployed Vidar via Sliver, establishing C2 communication with 19 [ . ] 41 [ . ] 164 [ . ] 156 and portalstatic[ . ]io. A secondary payload was downloaded from hxxp://relaynode[.]cc/api/v2/auth. The malware binary (SHA1: a3c2a25cd751695ce81b16d01f567cc42b44e656) was dropped to C:\Users\Public\Documents\dropper.ps1. Phishing emails were sent from billing@identity-verify[ . ]cc targeting enterprise users. A backup C2 server was identified at 10 [ . ] 64 [ . ] 140 [ . ] 160.


Electronicfrontierfoundation[ . ]org was not the only domain involved in this attack.


Forensic Investigation Notes: Analysis of the compromised host revealed Havoc artifacts at C:\Windows\System32\loader.exe. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via /etc/cron.d/ntds.dit. Network forensics identified connections to 10 [ . ] 43 [ . ] 182 [ . ] 249 and proxy-relay[ . ]tech. Email headers traced the initial vector to confirm@account-update[ . ]xyz. File C:\Windows\Tasks\payload.bin (SHA1: cfc8d12241a5d24a9b2c8808ba471120108cc75a) was identified as the initial dropper. A staging URL hxxp://secure-portal[ . ]org/portal/verify resolved to 185 [ . ] 111 [ . ] 125 [ . ] 221. Secondary artifact hash: MD5: af0b6abbf3b0dc5964b3536a85a2bfe6.


Blog Post by Europol: Tracking Gamaredon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-16619 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from admin@credential-check[.]site delivering AgentTesla. Post-compromise, the attackers deploy QakBot and use Burp Suite for reconnaissance. C2 infrastructure includes 75[.]51[.]203[.]70 and cdnnode[ . ]site. A staging server at hxxp://cache-storage[ . ]xyz/download/update.exe hosts additional tooling. Key artifact: C:\Windows\System32\backdoor.elf (SHA256: ca75918ba9553a2d2b86a1b6adcf61e66715933cff2a596a896dfa3d404837ab).


Artifact Analysis for BatLoader campaign:
Stage 1 dropper at C:\ProgramData\agent.py - SHA1: f8989b56cc480be9ae80b2fa721e3be19fc95aa4
Stage 2 loader at /opt/app/bin/config.dat - MD5: 53eecbd9df190056a69c90861f6f1112
Final payload at /opt/app/bin/payload.bin - MD5: ccb0dd1d4b6b2bf6c52e923b70514a4f
Exfiltration module - MD5: 0eeffd30add4ff0ce1eba5ce0ce31a3e
All stages communicated with 77 [ . ] 194 [ . ] 162 [ . ] 222. Seatbelt signatures detected in Stage 2.


NSA published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2025-13087 in Windows Server 2019. The attackers deployed Lumma Stealer via PsExec, establishing C2 communication with 192 [ . ] 175 [ . ] 61 [ . ] 253 and portal-api[ . ]club. A secondary payload was downloaded from hxxps://auth-storage[ . ]tech/download/update.exe. The malware binary (MD5: c35be3fdba9bf683edaf783fa12b9c89) was dropped to C:\Windows\System32\payload.bin. Phishing emails were sent from info@urgent-notice[.]online targeting enterprise users. A backup C2 server was identified at 178[.]67[.]244[.]19.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at C:\Windows\System32\config.dat. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via C:\Users\admin\Downloads\backdoor.elf. Network forensics identified connections to 10 [ . ] 210 [ . ] 125 [ . ] 48 and auth-edge[.]net. Email headers traced the initial vector to finance@mail-service[.]info. File C:\Users\Public\Documents\implant.so (SHA1: 212effc3dae43cd0de555adde2786da7c8973dfb) was identified as the initial dropper. A staging URL hxxps://securebackup[ . ]link/download/update.exe resolved to 172[.]160[.]157[.]231. Secondary artifact hash: SHA1: 4eb75ba1d6dbed442affdb929b07e49d88a8f53f.


After investigation , QiAnXin suspect this attack is carried out by Molerats . It contains a Word document in plaintext ( written to Bienvenue_a_Sahaja_Yoga_Toulouse[ . ]doc ) , along with an executable ( Update[.]exe ) and DLL ( McUpdate[.]dll ) .


The C2 server will then provide a secondary payload to the beacon in ASCII hexadecimal representation , which the Trojan will decode and write to the following location : %APPDATA%\Roaming\Audio\soundfix[ . ]exe .


Incident Response Summary: On detection of anomalous traffic to 81[.]42[.]56[.]41, the SentinelOne IR team identified BlackCat running as /opt/app/bin/agent.py. The threat actor, believed to be APT28, used Ligolo for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to relayproxy[ . ]live and sync-secure[.]top. The initial dropper (MD5: ccf6264f30606e6fb640fdc1d6102059) was delivered via a phishing email from security@identity-verify[.]cc. A second C2 node was observed at 192[.]66[.]210[.]203, with a persistence mechanism writing to /tmp/chrome_helper.exe.


CVE-2026-23778: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7 [ . ] 7 [ . ] 1 [ . ] 0 through 8.5, LTS2025 release version 8 [ . ] 3 [ . ] 1 [ . ] 0 through 8[.]3[.]1[.]20, LTS2024 release versions 7[.]13[.]1[.]0 through 7 [ . ] 13 [ . ] 1 [ . ] 50, contain a command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability to gain root-level access.


Forensic Investigation Notes: Analysis of the compromised host revealed Nmap artifacts at C:\Users\admin\Downloads\helper.sh. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via /var/tmp/svchost.exe. Network forensics identified connections to 109 [ . ] 146 [ . ] 8 [ . ] 81 and securelogin[.]net. Email headers traced the initial vector to it@secure-verify[.]net. File C:\Users\admin\Downloads\shell.php (SHA1: 780a2f6055fd5b3ada318fb8cee450d1d9f50478) was identified as the initial dropper. A staging URL hxxp://api-edge[ . ]site/login resolved to 215 [ . ] 246 [ . ] 123 [ . ] 160. Secondary artifact hash: SHA256: df4e312cc92286b5477c912ee22ce7c27bf8a195ada2efe8af521773da1bc578.


Blog Post by CrowdStrike: Tracking Silk Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-46256 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from account@secure-verify[.]net delivering Conti. Post-compromise, the attackers deploy Dridex and use Merlin for reconnaissance. C2 infrastructure includes 172 [ . ] 14 [ . ] 198 [ . ] 27 and cdn-auth[.]net. A staging server at hxxp://relay-cloud[.]io/api/v2/auth hosts additional tooling. Key artifact: C:\Windows\Tasks\config.dat (SHA1: 72d9accf70316f50e473b0cf5e8b14b57ab6c44b).


Starting in October 2016 , NewsBeef compromised a set of legitimate servers (shown below) , and injected JavaScript to redirect visitors to hxxp://analytics-google[ . ]org:69/Check.aspx .


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from finance@credential-check[ . ]site and verify@account-update[.]xyz, spoofing legitimate services. Victims were directed to hxxp://updateedge[ . ]info/wp-content/uploads/doc.php which hosted a credential harvesting page on cdn-sync[.]net. A secondary link hxxps://sync-secure[ . ]xyz/panel/index.html delivered ShadowPad (SHA256: ee189d531cf1659610508af2b64eaca170c0d433c61be9309b43eecd3aa66773). The malware was saved to /home/user/.config/taskhost.exe and established C2 with 88[.]126[.]203[.]154.


Ongoing activity While monitoring this particular threat , we found another XLoader variant posing as a pornography app aimed at South Korean users . Despite the differing sponsorship , penetration of Hong Kong and Taiwan-based media organizations continues to be a priority for China-based APT16 . Note the request number parameter is now 0001: 39e965e000caD60001679C79T[ . ]sample-domain[ . ]evil . The ransomware is a 64bit executable written in Rust and it recognises the following commandline parameters


Incident Response Summary: On detection of anomalous traffic to 134[.]165[.]190[.]145, the Tenable IR team identified Gootloader running as /opt/app/bin/payload.bin. The threat actor, believed to be Aqua Blizzard, used Merlin for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to nodestatic[.]info and relaycloud[ . ]dev. The initial dropper (SHA1: 222742d9e290ccde12fc5c6ee3ccf51ba2c27269) was delivered via a phishing email from verify@phishing-domain[ . ]com. A second C2 node was observed at 10 [ . ] 148 [ . ] 104 [ . ] 206, with a persistence mechanism writing to C:\Users\admin\Downloads\loader.exe.


This would explain the number of victims – there are less than 10 of them and according to our detection statistics , they are all located in the Russia . The malware is a fully functional RAT with multiple commands that the actors can issue from a command and control ( C2 ) server to a victim 's system via dual proxies . At 23:29 , the attackers then proceeded to deploy an updated version of their POSHC2 stager . 192 [ . ] 119 [ . ] 15 [ . ] 35 880 hxxp://mynetwork[.]ddns[.]net:880/st-36-p4578.ps1 . The group 's long - standing center focus has been Ukraine , where it has carried out a campaign of disruptive and destructive attacks over the past decade using wiper malware , including during Russia 's re - invasion in 2022 .


Vulnerability Advisory: CVE-2021-32059 is a critical SSRF vulnerability affecting Ubuntu 22.04. Proofpoint confirmed active exploitation by BlackTech in the wild. Exploitation delivers Emotet (SHA256: 042fb290fe9035bf2a412109049ee3591bf6f44d89657d81b364a8cf376c0d45) which is dropped to C:\Users\admin\Downloads\sam.hive. The exploit payload is hosted at hxxps://edgecdn[.]net/collect and communicates to 2[.]246[.]33[.]16 for C2.