electrum

Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls. Avalon combines credential collection, lateral movement, remote access, recovery disruption, and ransomware execution, bringing together diverse functions under one umbrella. The ransomware component has been internally named CrownX. "The attack began with a spoofed legal document email directing recipients to a password protected archive on Proton Drive," Blackpoint Cyber researchers Nevan Beal and Sam Decker said. "Malicious content was embedded inside an ISO image rather than attached directly, reducing the likelihood of detection at the email layer." Should the email recipient interact with a document-themed Windows Shortcut ("Secure Document CA-283505.pdf.lnk") inside the mounted image, it triggers a staged malware sequence that culminates in the deployment of Avalon. Specifically, the shortcut runs a command to launch an MSBuild project located in the ISO image. The MSBuild project, for its part, loads an embedded .NET assembly, which then interferes with the regular functioning of Event Tracing for Windows (ETW) to reduce forensic visibility and download a next-stage payload over HTTPS responsible for launching Avalon. The malware framework boasts of an extensive defense evasion subsystem that aims to evade detection, while incorporating specific methods to conceal execution from security tools associated with Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender. "These capabilities give the framework a multitude of ways to reduce telemetry, bypass user mode monitoring, and adjust its execution depending on the defensive controls present on the host," the researchers said. The complete set of features built into Avalon is as follows - Harvest credentials, cookies, history, and bookmarks from Chromium-based browsers and Mozilla Firefox. Gather data from cryptocurrency wallet apps like MetaMask, Phantom, Coinbase Wallet, Exodus, Electrum, Atomic Wallet, Ledger Live, and Bitcoin Core, along with Discord, Slack, Teams, OpenVPN, WireGuard, and Windows Credential Manager. Collect details about SSH known hosts, saved RDP connections, Wi-Fi profiles, and Group Policy Preferences cpassword artifacts. Exfiltrate data to a remote server ("helloxcherry[.]com") and poll the server for receiving tasking commands. Perform reconnaissance and prioritize systems that can expand the scope of the compromise. Encrypt files associated with business operations, software development, engineering, data storage, and virtual infrastructure using Windows Cryptography API and deliver a ransom note containing payment instructions and deadline timers that show how much time is left before the ransom amount is increased. Inhibit system recovery by terminating the Volume Shadow Copy Service and deleting shadow copies. Remove traces of artifacts using an anti-forensic cleanup subsystem to complicate incident response efforts. Directly interact with disk structures likely in an effort to damage partition information, boot records, or other critical areas of the drive, effectively rendering the system unusable. "CrownX represented the final extortion stage, but the damage extended well beyond the encryption itself," the company said. "By the time the ransom note appeared, the broader framework had already collected credentials, established C2 communications, prepared multiple paths for lateral movement, and weakened local recovery options." Another important detail is that Avalon shows signs of artificial intelligence (AI)-assisted development, one that has assembled multiple components with scant regard for sophisticated tradecraft or operational security, something that requires significant expertise to build. The findings are yet another sign of how AI can lower the barrier to entry, making malware development more accessible with little time and effort, and even allowing actors with little technical expertise and resources to come up with tools that may require extensive development effort. In other words, the presence of a certain capability is no longer a reliable indicator of a threat actor's sophistication or operational maturity. "The kill chain illustrates how a familiar business lure can progress into a reusable, multi-capability framework designed to harvest credentials, retrieve subsequent payloads entirely in memory, and stage multiple follow-on actions from a single compromised endpoint," Blackpoint Cyber said. LLM Behind an Agentic Ransomware Attack The disclosure comes as Sysdig detailed what it said was the first publicly documented agentic ransomware infection driven by a large language model from start to finish, while retrying and tweaking its actions in real-time to complete tasks. The agentic threat actor (ATA) behind the operation has been codenamed JADEPUFFER. The operator "gained initial access to an internet-facing Langflow instance through CVE-2025-3248 and ran an adaptive and fully automated campaign, ultimately pivoting to the intended target and running a destructive database-extortion playbook against the victim's production database server," Sysdig's Michael Clark said. "The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero." AI Malware That Uses LLM in a Codeless Attack The findings also follow the discovery of an AI malware that brings together a Telegram bot with a public LLM API to devise a codeless attack. Once launched, the implant transmits basic details about the compromised system to the attacker's Telegram bot and enters into a command-and-control (C2) loop that polls the bot API every 5 seconds for new messages. The results of the command execution are exfiltrated back using the same channel. The speciality of this malware is that each operator message is forwarded to a public LLM API endpoint ("api.groq[.]com/openai/v1/chat/completions"), which then translates the natural language instructions provided by the attacker into its equivalent shell command. The artifact was uploaded to the VirusTotal platform on March 11, 2026, and has zero detections across all engines to date. "This work introduces an LLM translation layer that replaces shell syntax with plain text. The attacker types plaintext instructions in Telegram," Palo Alto Networks Unit 42 said. "The LLM translates the instructions into shell commands. And the victim executes the shell commands. No command-line knowledge is required."

Hackers are exploiting a recently disclosed critical vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a previously undocumented cross-platform information stealer targeting Windows, macOS, and Linux. The SimpleHelp platform is primarily used by managed service providers (MSPs), IT departments, helpdesks, and system administrators for remote monitoring and management (RMM). Earlier this month, offensive security company Horizon3.ai published details about CVE-2026-48558, saying that the flaw could be leveraged to create highly privileged technician accounts without authentication. Exploiting the vulnerability is possible on servers using the OpenID Connect (OIDC) authentication protocol. According to the researchers, around 1,000 SimpleHelp servers exposed online were running a vulnerable configuration at the time of the disclosure. In an incident investigated by managed detection and response (MDR) provider Blackpoint, a threat actor exploited the critical authentication bypass vulnerability to establish an authenticated technician session on an internet-facing SimpleHelp server before deploying the TaskWeaver malware loader and the Djinn Stealer. Based on the findings from the Adversary Pursuit Group (APG), the company's threat intelligence and research team, both pieces of malware are new and have not been documented before. "The compromised RMM platform provided the operator with a trusted administrative channel capable of transferring files and executing commands on systems managed through the server," Blackpoint says. The investigation revealed that TaskWeaver was downloaded in the form of an obfuscated JavaScript file named ‘jquery.js’ from a temporary Cloudflare domain. TaskWeaver is a generic malware loader that fingerprints the compromised device and communicates with the command-and-control (C2) infrastructure to receive new JavaScript modules for execution. The loader then installs Djinn Stealer to collect in a single pass all the sensitive data it can find on a developer's machine, be it Windows, macOS, or Linux. Blackpoint mentions that Djinn Stealer has a particular focus on AI development tools, but targets a broad collection of developer and infrastructure credentials: Cloud provider credentials, identity services, deployment platforms, and cloud management tools. Git configuration, GitHub CLI, SSH keys, Docker credentials, Helm, infrastructure-as-code tools (Terraform, Pulumi), secrets management solutions (HashiCorp Vault), and package manager credentials. Authentication data for package registries and build tools (npm, Yarn, pnpm, Cargo, Maven, Gradle, pip, NuGet), potentially enabling access to private packages or malicious package publication. Local configuration files, authentication tokens, session data, and Model Context Protocol (MCP) configuration for AI coding assistants (Claude, Gemini, Codex, Cline, OpenCode, and Kilo). Cryptocurrency wallets and keystores associated with multiple desktop cryptocurrency clients (Bitcoin, Litecoin, Dogecoin, Dash, Ethereum, Monero, Zcash, Exodus, Atomic Wallet, and Electrum). Browser data, shell history, SSH configuration, PGP keys, database client configuration, operating system information, and other user files. On Linux, the malware also attempts to read the /proc/ /cmdline and /proc/ /environ virtual files that contain information about a running process, including secrets (e.g., API keys, credentials, session tokens, file paths, URLs). Blackpoint researchers warn that stealing credentials for AI development tooling, which is widely used for coding and software development, could allow attackers to inherit the AI assistant's authorized access to repositories, cloud resources, databases, and APIs. “Many of these tools rely on the Model Context Protocol (MCP) to connect an AI assistant to external tools and data on the developer's behalf, including source repositories, databases, cloud accounts, and internal APIs,” explain the researchers. “The settings and tokens for those connections are stored locally in files such as ~/.claude/mcp.json. Stealing them can grant an attacker the same downstream access the developer extended to their AI agent, reaching well beyond the AI service itself.” Before exfiltrating the sensitive data to the C2 server, Djinn Stealer packs it into a TAR archive, then compresses it with GZIP, and encrypts it with an AES-256-GCM key protected by an RSA-2048 public key embedded in TaskWeaver. Active exploitation of CVE-2026-48558 should serve as an urgent call for system administrators to prioritize updating SimpleHelp instances to the latest versions. It is also recommended to invalidate technician sessions that they don’t recognize. If breached, rotate all credentials and API keys. Blackpoint's report provides indicators of compromise (IoCs) observed in the investigated intrusion, which include hashes for the TaskWeaver loader and Djinn Stealer, network infrastructure, host and behavioral indicators. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. The campaign is infecting Mac devices with the Atomic macOS Stealer (AMOS) infostealer, which steals browser credentials, cryptocurrency wallet data, Keychain data, messaging app information, and user documents. Researchers at Palo Alto Networks Unit 42 first discovered the campaign and say it begins with a fake CAPTCHA page that tells users to open Terminal and paste a malicious command to verify themselves. Once executed, the command downloads a DMG file from an attacker-controlled server, silently mounts it with macOS's native hdiutil utility, locates the application bundle it contains, and launches it automatically. ClickFix is a social engineering technique that displays fake CAPTCHAs, browser errors, or system alerts to trick visitors into copying and executing attacker-supplied "fix instructions." The technique has grown in popularity among threat actors in the past year and has been used by both cybercriminals and state-sponsored hacking groups to distribute malware. While ClickFix attacks involving DMGs are not new, previous campaigns typically relied on users manually opening downloaded DMG files to launch malicious applications or execute scripts from attacker-controlled servers. The campaign spotted by Palo Alto combines both approaches by using a Terminal command to quietly download a DMG file and launch the malware it contains. After running the Terminal command, the attack downloads a malicious DMG from svs-verificationdate[.]beer using curl with the quiet "-fsSL" flags and saves it to the /tmp folder under a random filename. The command then executes 'hdiutil attach -nobrowse' to mount the downloaded disk image without displaying it in Finder or on the desktop. The script then searches up to three directory levels deep for the first available .app or .pkg installer, and if one is found, launches it using the macOS open command. Researchers observed the malware being delivered as a disk image named "s.01M0td.dmg," which mounted a volume containing a self-signed application bundle named "NNApp.app." This payload is part of the Atomic macOS Stealer family, which is used to steal credentials, browser history, authentication tokens, and cryptocurrency wallets from infected devices. The stealer will display a fake System Preferences authentication prompt that asks the user to enter their password, allowing the malware to steal it. According to the researchers, the malware targets eight Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, and Yandex. It steals cookies, login databases, autofill information, stored payment cards, and browser profile data. The stealer also targets Firefox-derived browsers, including LibreWolf, SeaMonkey, Tor Browser, Waterfox, and Zen Browser, stealing the same information. Palo Alto says the malware searches for and steals cryptocurrency wallet data, including Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, and TonKeeper. The malware also steals Telegram Desktop and Discord data, Apple Notes databases, Safari cookies, Apple Keychain database files, and user documents with the PDF, TXT, or RTF extensions. All harvested data is then stored in a ZIP archive and uploaded to the attacker's server, where the attacker can retrieve it. Of particular interest, the researchers found that the malware will replace legitimate installations of Ledger Live and Trezor Suite with malicious versions, likely to perform crypto theft. The campaign was observed using command-and-control servers at svs-verificationdate[.]beer and 196.251.107[.]171. As a general rule, users should always be cautious when websites instruct them to open Terminal and execute commands. This is especially true when they claim to be part of CAPTCHA verifications, browser fixes, or other troubleshooting steps. If you do not 100% understand what a command does, do not run it. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A likely North Korean threat actor has phished software developers at almost 100 organizations with fake job and code-review lures to steal cryptocurrency and credentials. According to new analysis from Proofpoint, which tracks the cluster as UNK_DeadDrop, the campaign sent more than 250 emails in April and May 2026. Targets were mostly US-based and worked in technology, education or finance, with a focus on cryptocurrency firms. Each email linked to a GitHub or GitLab repository dressed up as a coding assignment, with instructions to clone it and open the folder in an editor such as VS Code or Cursor. The pretexts shifted across the weeks: jobs for full-stack and "agent lead" developer roles, requests to peer-review open-source code, a task to test an ERC-4626 smart-contract vault in Foundry and a project building AI payment agents. Inside each repository sits a hidden tasks.json file rigged to run the instant the folder opens, abusing a legitimate editor feature. VS Code at least shows a trust prompt; Cursor shows none, running the payload silently with no interaction. The script installs a malicious VS Code extension posing as a Google service, which relaunches the malware whenever the editor reopens on macOS or Linux. The chains then split, with Linux and macOS getting a Go remote access trojan from the open-source Overlord framework, while the Windows version runs as JavaScript inside the editor itself, leaving no file on disk. Fake Prompts and Drained Wallets Whatever the platform, the goal is the same: drain cryptocurrency and credentials. The malware scans for browser data and a long list of cryptocurrency wallets, including: Browser-based wallet extensions such as MetaMask, Phantom and Keplr Desktop wallet apps including Exodus, Electrum and Ledger Live Saved passwords and cookies from Chrome, Brave, Edge and Firefox To reach protected secrets, the macOS and Linux versions show a fake password dialog, then reuse the captured password to relaunch as root and dump the keychain or keyring. The Windows variant instead bypasses Chrome's app-bound encryption. After uploading the haul, the loader deletes its files to cover its tracks. Proofpoint said they saw clear echoes of Contagious Interview, the long-running North Korean operation that baits developers with fake recruiters, but is tracking UNK_DeadDrop separately. The team cited the campaign's email-led delivery, the industrial scale of repository creation and a self-contained payload that survives infrastructure takedowns as key differentiators. "While attribution to a known actor remains unconfirmed, Proofpoint continues to track this ongoing activity as an independent cluster," the company concluded. North Korea-aligned crews have targeted developers this way since at least 2022, using fake recruiter personas and poisoned developer tools.

Stolen credentials are the primary access route for cybercriminals. The use of infostealers to supply those credentials is the basis of modern cybercrime. Infostealers continuously improve in both sophistication and use. Venom Stealer is a newly discovered kit available through malware-as-a-service (MaaS) to anybody wishing to use it. It is not sold but provided on license at $250 per month or $1,800 for lifetime usage. This provides use and updates. The Venom Stealer kit, discovered and analyzed by BlackFog, demonstrates both the improving sophistication of infostealers and the ongoing efficiency of the MaaS marketplace. Under the handle of VenomStealer, the developer sells both licensing and an affiliate program via Telegram. Frequent updates to the kit show the value of licensing over outright purchase, and suggest this is a full-time operation for the developer. Each licensed operator configures their own custom domain via Cloudflare DNS. This way, the infostealer URL never appears in any issued commands. Once this domain is configured with Venom Stealer’s operating panel, everything else is automatic. A range of pre-built, professional social engineering ClickFix lures are available to install the Windows targeting payload. These can be selected from the kit’s operating panel. Although Venom Stealer targets Windows, it is operated via an internet domain and can be acquired and used by both Windows and macOS systems. The pre-built ClickFix templates include a fake Cloudflare CAPTCHA, a fake OS update, a fake SSL certificate error, and a fake font install page. Each lure asks the target to open a Run dialog or Terminal, paste a command, and press Enter. If successful, the Venom Stealer payload is installed and executed. It sweeps every Chromium and Firefox browser on the system. It extracts saved passwords, session cookies, browsing history, autofill data, and cryptocurrency wallet vaults from every profile. “Chrome’s v10 and v20 password encryption is bypassed using a silent privilege escalation that extracts the decryption key without triggering any UAC dialog, leaving no forensic artifacts,” report the researchers. System fingerprinting and browser extension inventories are also captured alongside the credentials, giving cybercriminals a complete profile of each target. All this data is immediately exfiltrated with little or no local staging or delay. It is at this point that traditional infostealers generally leave the victim as quietly and quickly as they arrived. But the current infostealer will remain, demonstrating the value of an ongoing license over a one-off purchase. Venom Stealer is built for persistence rather than the usual rapid steal and depart. Persistence itself is not entirely new to infostealers, but Venom Stealer goes further – it remains in operation. A session listener now runs silently and continuously in background. The listener phones home twice each day with information on any newly saved passwords. This would defeat password rotation by the victim, whether it is instigated by standard company policy or as an incident response to learning that details have become available on the dark web. The listener also reports new wallet activity. The listener was added to Venom Stealer in one of the updates provided in March 2026, demonstrating the adversarial advantage of an ongoing license rather than a one-off purchase. Other updates that arrived in March included the Chrome v10/v20 bypass, and auto-crack support for the Tonkeeper TON wallet extension that recovers the full seed phrase and TON address across Chrome, Edge, Brave and Opera. Stolen wallet data is passed to a server-side cracking engine running on GPU infrastructure. This auto-cracks MetaMask, Phantom, Solflare, Trust Wallet, Atomic, Exodus, Electrum, Bitcoin Core, Monero, and Tonkeeper. Once cracked, say the researchers, “the auto-transfer engine sweeps funds immediately across nine chains including ERC-20/SPL tokens, liquid staking positions, and DeFi protocol positions.” Although more sophisticated than earlier infostealers, Venom Stealer (like all other stealers) is not an automatic slam dunk for the attacker. Exposure can be reduced by restricting PowerShell execution, disabling the Run dialog for standard users, and improving employee social engineering recognition. If these fail and the stealer is installed and operational, continuous monitoring of and control over outbound traffic provides an opportunity to detect or prevent exfiltration activity: the existence of the stealer’s payload can be detected and theft of the information mother lode halted. Related: Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs Related: Over 100 GitHub Repositories Distributing BoryptGrab Stealer Related: ‘Arkanix Stealer’ Malware Disappears Shortly After Debut Related: Sophisticated ClickFix Campaign Targeting Hospitality Sector

Tails 7.6 ships automatic Tor bridge retrieval and a new password manager Tails 7.6 is out, and for users operating on networks that block Tor, the most consequential addition is built-in bridge retrieval. The Tor Connection assistant can now detect when a direct connection to Tor is restricted and automatically request bridges suited to the user’s region. The request goes through the Tor Project’s Moat API, and the connection to that API is disguised via domain fronting, making it appear as traffic to an ordinary website. Previously, users on censored networks had to obtain bridges manually and enter them by hand. The feature closes a long-standing gap in Tails’ censorship-circumvention capability. Users who prefer to take action themselves can also select the option to request region-specific bridges directly from the connection assistant screen. Password manager switches from KeePassXC to Secrets Tails 7.6 replaces KeePassXC with the GNOME Secrets password manager as the default credential storage tool. Secrets has a simpler interface and integrates more tightly with the GNOME desktop environment. Accessibility features that were broken under KeePassXC, including the on-screen keyboard and cursor size adjustments, work again with Secrets. Existing KeePassXC database files are compatible with Secrets’ format, so stored credentials carry over without any conversion step. Users who depend on features specific to KeePassXC can still install it manually. Component upgrades and Qt5 removal The kernel moves to Linux 6.12.74. Tor Browser advances to 15.0.8, built on Firefox ESR 140.9. Thunderbird reaches 140.8.0esr. Electrum moves to 4.7.0, and that upgrade is tied directly to the removal of Qt5 from the distribution. The changelog confirms that Qt5 support packages have been stripped out entirely, and tests now verify that no Qt5 package ships with the build. The base distribution advances to Debian 13.4 (Trixie). Firmware packages also receive an update: firmware-nonfree moves to version 20260110-1, improving hardware support for graphics cards and wireless adapters on newer machines. The forge.js library, used in Tails’ web-facing components, upgrades to v1.3.3. The update includes a step to make it harder for external CDNs to target the project, and it brings the project’s license documentation into compliance with BSD 3-clause terms. Bug fixes targeting localization and upgrade reliability Three user-facing bugs are resolved in this release. Automated upgrades failed for users running Tails with the language set to Turkish; that problem is fixed. A broken link in the Thunderbird migration notification, the “Learn More” button that was supposed to point users to documentation, is restored. The confirmation dialog displayed when saving a language and keyboard layout to the USB stick in unencrypted form was not honoring available translations; it now renders in the user’s selected language. Upgrading Automatic upgrades are available for any installation running Tails 7.0 or later. The upgrade preserves data stored in Persistent Storage. Users whose automatic upgrade fails, or whose system does not start after an update, can follow the manual upgrade path available on the Tails documentation site.

A convincing fake version of the popular Mac utility CleanMyMac is tricking users into installing malware. The site instructs visitors to paste a command into Terminal. If they do, it installs SHub Stealer, macOS malware designed to steal sensitive data including saved passwords, browser data, Apple Keychain contents, cryptocurrency wallets, and Telegram sessions. It can even modify wallet apps such as Exodus, Atomic Wallet, Ledger Wallet, and Ledger Live so attackers can later steal the wallet’s recovery phrase. The site impersonates the CleanMyMac website, but is unconnected to the legitimate software or the developers, MacPaw. Remember: Legitimate apps almost never require you to paste commands into Terminal to install them. If a website tells you to do this, treat it as a major red flag and do not proceed. When in doubt, download software only from the developer’s official website or the App Store. Read the deep-dive to see what we discovered. “Open Terminal and paste the following command” The attack begins at cleanmymacos[.]org, a website designed to look like the real CleanMyMac product page. Visitors are shown what appears to be an advanced installation option of the kind a power user might expect. The page instructs them to open Terminal, paste a command, and press Return. There’s no download prompt, disk image, or security dialog. That command performs three actions in quick succession: First, it prints a reassuring line: macOS-CleanMyMac-App: https://macpaw.com/cleanmymac/us/app to make the Terminal output look legitimate. Next, it decodes a base64-encoded link that hides the real destination. Finally, it downloads a shell script from the attacker’s server and pipes it directly into zsh for immediate execution. From the user’s perspective, nothing unusual happens. This technique, known as ClickFix, has become a common delivery method for Mac infostealers. Instead of exploiting a vulnerability, it tricks the user into running the malware themselves. Because the command is executed voluntarily, protections such as Gatekeeper, notarization checks, and XProtect offer little protection once the user pastes the command and presses Return. Geofencing: Not everyone gets the payload The first script that arrives on the victim’s Mac is a loader, which is a small program that checks the system before continuing the attack. One of its first checks looks at the macOS keyboard settings to see whether a Russian-language keyboard is installed. If it finds one, the malware sends a cis_blocked event to the attacker’s server and exits without doing anything else. This is a form of geofencing. Malware linked to Russian-speaking cybercriminal groups often avoids infecting machines that appear to belong to users in CIS countries (the Commonwealth of Independent States, which includes Russia and several neighboring nations). By avoiding systems that appear to belong to Russian users, the attackers reduce the risk of attracting attention from local law enforcement. The behavior does not prove where SHub was developed, but it follows a pattern long observed in that ecosystem, where malware is configured not to infect systems in the operators’ own region. If the system passes this check, the loader sends a profile of the machine to the command-and-control server at res2erch-sl0ut[.]com. The report includes the device’s external IP address, hostname, macOS version, and keyboard locale. Each report is tagged with a unique build hash, a 32-character identifier that acts as a tracking ID. The same identifier appears in later communications with the server, allowing the operators to link activity to a specific victim or campaign. “System Preferences needs your password to continue” Comparing payloads served with and without a build hash reveals another campaign-level field in the malware builder: BUILD_NAME. In the sample tied to a build hash, the value is set to PAds; in the version without a hash, the field is empty. The value is embedded in the malware’s heartbeat script and sent to the command-and-control (C2) server during every beacon check-in alongside the bot ID and build ID. What PAds stands for cannot be confirmed from the payload alone, but its structure matches the kind of traffic-source tag commonly used in pay-per-install or advertising campaigns to track where infections originate. If that interpretation is correct, it suggests victims may be reaching the fake CleanMyMac site through paid placements rather than organic search or direct links. Once the loader confirms a viable target, it downloads and executes the main payload: an AppleScript hosted at res2erch-sl0ut[.]com/debug/payload.applescript. AppleScript is Apple’s built-in automation language, which allows the malware to interact with macOS using legitimate system features. Its first action is to close the Terminal window that launched it, removing the most obvious sign that anything happened. Next comes the password harvest. The script displays a dialog box that closely mimics a legitimate macOS system prompt. The title reads “System Preferences”, the window shows Apple’s padlock icon, and the message says: The awkward wording—“for continue” instead of “to continue”—is one clue the prompt is fake, though many users under pressure might not notice it. “Required Application Helper. Please enter password for continue.” If the user enters their password, the malware immediately checks whether it is correct using the macOS command-line tool dscl. If the password is wrong, it is logged and the prompt appears again. The script will repeat the prompt up to ten times until a valid password is entered or the attempts run out. That password is valuable because it unlocks the macOS Keychain, Apple’s encrypted storage system for saved passwords, Wi-Fi credentials, app tokens, and private keys. Without the login password, the Keychain database is just encrypted data. With it, the contents can be decrypted and read. A systematic sweep of everything worth stealing With the password in hand, SHub begins a systematic sweep of the machine. All collected data is staged in a randomly named temporary folder—something like /tmp/shub_4823917/—before being packaged and sent to the attackers. The browser targeting is extensive. SHub searches 14 Chromium-based browsers (Chrome, Brave, Edge, Opera, OperaGX, Vivaldi, Arc, Sidekick, Orion, Coccoc, Chrome Canary, Chrome Dev, Chrome Beta, and Chromium), stealing saved passwords, cookies, and autofill data from every profile it finds. Firefox receives the same treatment for stored credentials. The malware also scans installed browser extensions, looking for 102 known cryptocurrency wallet extensions by their internal identifiers. These include MetaMask, Phantom, Coinbase Wallet, Exodus Web3, Trust Wallet, Keplr, and many others. Desktop wallet applications are also targeted. SHub collects local storage data from 23 wallet apps, including Exodus, Electrum, Atomic Wallet, Guarda, Coinomi, Sparrow, Wasabi, Bitcoin Core, Monero, Litecoin Core, Dogecoin Core, BlueWallet, Ledger Live, Ledger Wallet, Trezor Suite, Binance, and TON Keeper. Each wallet folder is capped at 100 MB to keep the archive manageable. Beyond wallets and browsers, SHub also captures the macOS Keychain directory, iCloud account data, Safari cookies and browsing data, Apple Notes databases, and Telegram session files—information that could allow attackers to hijack accounts without knowing the passwords. It also copies shell history files (.zsh_history and .bash_history) and .gitconfig, which often contain API keys or authentication tokens used by developers. All of this data is compressed into a ZIP archive and uploaded to res2erch-sl0ut[.]com/gate along with a hardcoded API key identifying the malware build. The archive and temporary files are then deleted, leaving minimal traces on the system. The part that keeps stealing after you’ve cleaned up Most infostealers are smash-and-grab operations: they run once, take everything, and leave. SHub does that, but it also goes a step further. If it finds certain wallet applications installed, it downloads a replacement for the application’s core logic file from the attacker’s server and swaps it in silently. We retrieved and analyzed five such replacements. All five were backdoored, each tailored to the architecture of the target application. The targets are Electron-based apps. These are desktop applications built on web technologies whose core logic lives in a file called app.asar. SHub kills the running application, downloads a replacement app.asar from the C2 server, overwrites the original inside the application bundle, strips the code signature, and re-signs the app so macOS will accept it. The process runs silently in the background. The five confirmed crypto wallet apps are Exodus, Atomic Wallet, Ledger Wallet, Ledger Live, and Trezor Suite. Exodus: silent credential theft on every unlock On every wallet unlock, the modified app silently sends the user’s password and seed phrase to wallets-gate[.]io/api/injection. A one-line bypass is added to the network filter to allow the request through Exodus’s own domain allowlist. Atomic Wallet: the same exfiltration, no bypass required On every unlock, the modified app sends the user’s password and mnemonic to wallets-gate[.]io/api/injection. No network filter bypass is required—Atomic Wallet’s Content Security Policy already allows outbound HTTPS connections to any domain. Ledger Wallet: TLS bypass and a fake recovery wizard The modified app disables TLS certificate validation at startup. Five seconds after launch, it replaces the interface with a fake three-page recovery wizard that asks the user for their seed phrase and sends it to wallets-gate[.]io/api/injection. Ledger Live: identical modifications Ledger Live receives the same modifications as Ledger Wallet: TLS validation is disabled and the user is presented with the same fake recovery wizard. Trezor Suite: fake security update overlay After the application loads, a full-screen overlay styled to match Trezor Suite’s interface appears, presenting a fake critical security update that asks for the user’s seed phrase. The phrase is validated using the app’s own bundled BIP39 library before being sent to wallets-gate[.]io/api/injection. At the same time, the app’s update mechanism is disabled through Redux store interception so the modified version remains in place. Five wallets, one endpoint, one operator Across all five modified applications, the exfiltration infrastructure is identical: the same wallets-gate[.]io/api/injection endpoint, the same API key, and the same build ID. Each request includes a field identifying the source wallet—exodus, atomic, ledger, ledger_live, or trezor_suite—allowing the backend to route incoming credentials by product. This consistency across five independently modified applications strongly suggests that a single operator built all of the backdoors against the same backend infrastructure. A persistent backdoor disguised as Google’s own update service To maintain long-term access, SHub installs a LaunchAgent, which is a background task that macOS automatically runs every time the user logs in. The file is placed at: ~/Library/LaunchAgents/com.google.keystone.agent.plist The location and name are chosen to mimic Google’s legitimate Keystone updater. The task runs every sixty seconds. Each time it runs, it launches a hidden bash script located at: ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate The script collects a unique hardware identifier from the Mac (the IOPlatformUUID) and sends it to the attacker’s server as a bot ID. The server can respond with base64-encoded commands, which the script decodes, executes, and then deletes. In practice, this gives the attackers the ability to run commands on the infected Mac at any time until the persistence mechanism is discovered and removed. The final step is a decoy error message shown to the user: “Your Mac does not support this application. Try reinstalling or downloading the version for your system.” This explains why CleanMyMac appeared not to install and sends the victim off to troubleshoot a problem that doesn’t actually exist. SHub’s place in a growing family of Mac stealers SHub is not an isolated creation. It belongs to a rapidly evolving family of AppleScript-based macOS infostealers including campaigns such as MacSync Stealer (an expanded version of malware known as Mac.c, first seen in April 2025) and Odyssey Stealer, and shares traits with other credential-stealing malware such as Atomic Stealer. These families share a similar architecture: a ClickFix delivery chain, an AppleScript payload, a fake System Preferences password prompt, recursive data harvesting functions, and exfiltration through a ZIP archive uploaded to a command-and-control server. What distinguishes SHub is the sophistication of its infrastructure. Features such as per-victim build hashes for campaign tracking, detailed wallet targeting, wallet application backdooring, and a heartbeat system capable of running remote commands all suggest an author who studied earlier variants and invested heavily in expanding them. The result resembles a malware-as-a-service platform rather than a simple infostealer. The presence of a DEBUG tag in the malware’s internal identifier, along with the detailed telemetry it sends during execution, suggests the builder was still under active development at the time of analysis. The campaign also fits a broader pattern of brand impersonation attacks. Researchers have documented similar ClickFix campaigns impersonating GitHub repositories, Google Meet, messaging platforms, and other software tools, with each designed to convince users that they are following legitimate installation instructions. The cleanmymacos.org site appears to follow the same playbook, using a well-known Mac utility as the lure. What to do if you may have been affected The most effective part of this attack is also its simplest: it convinces the victim to run the malicious command themselves. By presenting a Terminal command as a legitimate installation step, the campaign sidesteps many of macOS’s built-in protections. No app download is required, no disk image is opened, and no obvious security warning appears. The user simply pastes the command and presses Return. This reflects a broader trend: macOS is becoming a more attractive target, and the tools attackers use are becoming more capable and more professional. SHub Stealer, even in its current state, represents a step beyond many earlier macOS infostealers. For most users, the safest rule is also the simplest: install software only from the App Store or from a developer’s official website. The App Store handles installation automatically, so there is no Terminal command, no guesswork, and no moment where you have to decide whether to trust a random website. Do not run the command. If you have not yet executed the Terminal command shown on cleanmymacos[.]org or a similar site, close the page and do not return. Check for the persistence agent. Open Finder, press Cmd + Shift + G, and navigate to ~/Library/LaunchAgents/ . If you see a file named com.google.keystone.agent.plist that you did not install, delete it. Also check:~/Library/Application Support/Google/ . If a folder named GoogleUpdate.app is present and you did not install it, remove it. Treat your wallet seed phrase as compromised. If you have Exodus, Atomic Wallet, Ledger Live, Ledger Wallet, or Trezor Suite installed and you ran this command, assume your seed phrase and wallet password have been exposed. Move your funds to a new wallet created on a clean device immediately. Seed phrases cannot be changed, and anyone with a copy can access the wallet. Change your passwords. Your macOS login password and any passwords stored in your browser or Keychain should be considered exposed. Change them from a device you trust. Revoke sensitive tokens. If your shell history contained API keys, SSH keys, or developer tokens, revoke and regenerate them. Run Malwarebytes for Mac. It can detect and remove remaining components of the infection, including the LaunchAgent and modified files. Indicators of compromise (IOCs) Domains cleanmymacos[.]org — phishing site impersonating CleanMyMac res2erch-sl0ut[.]com — primary command-and-control server (loader delivery, telemetry, data exfiltration) wallets-gate[.]io — secondary C2 used by wallet backdoors to exfiltrate seed phrases and passwords From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

L’attacco informatico che ha colpito la Polonia lo scorso 29 dicembre 2025 rappresenta un’importante escalation nella strategia di sabotaggio digitale della Russia contro le infrastrutture critiche europee. L’operazione ha preso di mira trenta impianti energetici, tra cui centrali di cogenerazione e sistemi di gestione della distribuzione di energia da fonti rinnovabili, che nel paese rappresentano il 29% della produzione totale. Gli aggressori sono riusciti a penetrare nei sistemi di tecnologia operativa, l’interfaccia che collega le reti informatiche ai dispositivi fisici, danneggiando alcune apparecchiature. L’attacco ha interessato anche un grande impianto di cogenerazione che fornisce calore a quasi mezzo milione di utenti: secondo le autorità polacche non si sono verificate interruzioni effettive della fornitura, ma l’episodio ha comunque dimostrato il potenziale impatto che un’operazione di questo tipo avrebbe potuto avere in un momento in cui le temperature erano particolarmente rigide. Indice degli argomenti L’aspetto più significativo di questa vicenda, secondo l’analisi condotta dalla società di sicurezza informatica Dragos e confermato da funzionari polacchi e specialisti del settore, riguarda l’identità degli autori dell’attacco. Le evidenze raccolte da Dragos puntano verso un gruppo identificato con il nome di Electrum, mentre altre valutazioni tecniche e istituzionali collegano l’operazione a un’unità dell’FSB, il servizio di sicurezza dello stato russo, conosciuta nell’ambiente della cybersecurity come Berserk Bear. Questa distinzione rivela un mutamento nelle tattiche e nella strategia operativa russa. L’ipotesi di un coinvolgimento diretto di Berserk Bear, qualora confermata, segnerebbe un cambiamento significativo rispetto al passato. Storicamente, infatti, le operazioni più distruttive contro infrastrutture critiche erano state attribuite principalmente a Sandworm e al GRU, noti per un approccio aggressivo e orientato al sabotaggio immediato. Il GRU ha storicamente privilegiato approcci rumorosi e distruttivi, puntando al caos immediato piuttosto che alla segretezza prolungata. Le sue operazioni sono spesso descritte come aggressive e poco attente alla discrezione. L’FSB, al contrario, ha sempre condotto operazioni digitali orientate principalmente allo spionaggio, caratterizzate da lentezza, discrezione e cautela. Come sottolineato da John Hultquist, analista capo del Threat Intelligence Group di Google, in dodici anni di presenza nelle reti avversarie, questo gruppo non aveva mai mostrato l’intenzione di provocare interruzioni operative, limitandosi a posizionarsi in profondità nei sistemi e attendere ordini che potessero arrivare in futuro. L’attacco polacco rappresenta quindi la prima volta che Berserk Bear passa dalla ricognizione all’azione, segnando un cambio di dottrina operativa. L’incidente polacco si inserisce in un quadro più ampio di intensificazione delle attività ostili russe in Europa. Nel 2023 soggetti legati alla Russia hanno interferito con il traffico ferroviario nella Polonia nord-occidentale trasmettendo, tramite frequenze radio, un segnale non autorizzato di arresto di emergenza che ha provocato la fermata di circa venti treni su rotte utilizzate anche per l’invio di aiuti all’Ucraina. L’operazione aveva dimostrato la capacità di creare disservizi su infrastrutture di trasporto critiche, seppure con effetti limitati. Negli stessi anni diversi paesi europei, tra cui la Repubblica Ceca, hanno denunciato ripetuti tentativi di intrusione e sabotaggio contro reti ferroviarie e altri sistemi essenziali, confermando un pattern di attività ostili mirate alle linee di rifornimento verso il fronte ucraino. Successivamente, la campagna si è estesa a obiettivi civili senza connessione diretta al conflitto ucraino: lo scorso anno è stata presa di mira una diga nel sud-ovest della Norvegia, provocando il flusso incontrollato di acqua per quattro ore. Queste operazioni rappresentano un’escalation rispetto al comportamento russo degli anni precedenti. Gli hacker russi hanno da tempo violato reti informatiche europee per raccogliere informazioni e sondare le infrastrutture alla ricerca di vulnerabilità, ma si erano spinti molto oltre solo in Ucraina, dove nel 2015 e 2016 avevano condotto attacchi particolarmente audaci contro la rete elettrica, causando blackout che avevano colpito centinaia di migliaia di persone. Al di fuori del teatro ucraino, invece, avevano mantenuto un approccio più cauto, che ora sembra progressivamente abbandonato. Il cambiamento di strategia suggerisce una valutazione diversa del rapporto rischio-beneficio da parte del Cremlino, che evidentemente ritiene di poter sostenere le conseguenze diplomatiche e politiche di operazioni più aggressive. Gli analisti prevedono un ulteriore deterioramento della situazione nei prossimi mesi e anni. Chelsea Cederbaum, ex analista della CIA ora presso la società di intelligence Recorded Future, individua una finestra di opportunità che il Cremlino sta attivamente sfruttando: le divisioni tra Usa ed Europa, evidenziate in particolare dalla questione della Groenlandia, e il periodo che precede le elezioni presidenziali americane del 2028, che potrebbero portare all’insediamento di un presidente meno filorusso. In questo contesto, la tolleranza al rischio da parte russa sarebbe in rapida crescita, con una disposizione a testare i limiti della risposta occidentale attraverso azioni sempre più audaci. La Russia è stata esclusa dall’evento dei Giochi Olimpici invernali in Italia e in precedenza aveva già dimostrato la propria capacità e volontà di attaccare grandi manifestazioni sportive, colpendo le Olimpiadi di Pyeongchang nel 2018 e quelle di Parigi nel 2024. Il 5 febbraio, mentre i giochi stavano per iniziare, le autorità italiane hanno dichiarato di aver bloccato attacchi russi contro siti web collegati all’evento, confermando la concretezza della minaccia e l’importanza di mantenere elevati livelli di vigilanza. La capacità di prevenire questi attacchi dimostra che, nonostante l’escalation delle minacce, le difese europee stanno migliorando e sviluppando maggiore resilienza di fronte alle campagne di sabotaggio digitale russe, sebbene rimanga fondamentale non abbassare la guardia e continuare a investire in capacità difensive e di intelligence.

OT teams are losing the time advantage against industrial threat actors In many industrial environments, internet-facing gateways, remote access appliances, and boundary systems sit close enough to production networks that attackers can move from IT intrusion to operational disruption with limited resistance. Dragos’ 2026 OT/ICS Year in Review describes a threat landscape where adversaries are spending more time learning how physical processes work and less time treating OT access as a passive foothold. A shift in 2025 involved multiple state-aligned groups moving into control-loop mapping. That includes identifying engineering workstations, pulling configuration and alarm files, and collecting enough operational context to interfere with physical outcomes. Control-loop mapping removes a key barrier between unauthorized access and physical impact, since attackers no longer need to guess how a process behaves. “Adversaries are mapping how control systems work, understanding where commands originate, how they propagate, and where physical effects can be induced,” said Robert M. Lee, CEO of Dragos. “We’re seeing the ecosystem evolve with specialized threat groups systematically building access pathways for more capable adversaries to reach OT environments. Meanwhile, ransomware groups are causing more operational disruption and multi-day outages that require OT-specific recovery. Yet industrial organizations significantly underestimate the reach of ransomware into OT environments because they think it’s ‘just IT.’” Dragos tracked 26 threat groups targeting OT environments, including three new groups identified in 2025: AZURITE, PYROXENE, and SYLVANITE. The activity across these groups shows more specialization and a growing division of labor, where one team focuses on gaining access and another focuses on OT operations. Initial access groups are feeding OT-capable operators SYLVANITE was tracked as a large-scale initial access group targeting industrial organizations through internet-facing systems. Its operations relied heavily on rapid exploitation of vulnerabilities in products from Ivanti, F5, SAP, and ConnectWise. The group also used tooling such as Cobalt Strike, Sliver, and multiple web shells, then handed access to other actors, including VOLTZITE. A May 2025 incident involved exploitation of Ivanti Endpoint Manager Mobile (EPMM) at a U.S. utility through CVE-2025-4427 and CVE-2025-4428. Attackers extracted data from the backend MySQL database, including LDAP user details and Office 365 tokens, then replayed those credentials internally for lateral movement. The incident response effort was limited by lack of telemetry in adjacent networks, leaving responders unable to confirm whether attackers moved toward OT systems. This type of access brokering compresses the time between vulnerability disclosure and operational risk. It also increases the number of industrial organizations exposed to follow-on OT attacks, even when the initial compromise appears limited to a DMZ or enterprise-adjacent system. Control-loop reconnaissance is becoming routine KAMACITE and ELECTRUM remained central examples of how access-building translates into disruptive operations. KAMACITE has historically operated as an access development group supporting ELECTRUM, the actor tied to Ukraine’s 2015 and 2016 power outages. In late 2024 through early 2025, KAMACITE expanded beyond Ukraine and targeted the European OT supply chain. Activity included spear phishing aimed at engineering and vendor personnel and long-running conversations using industry-specific terms. After that campaign, KAMACITE shifted into sustained reconnaissance against internet-exposed industrial devices in the United States between March and July 2025. The scanning focused on specific components including Schneider Electric Altivar variable frequency drives, Smart HMIs, Accuenergy AXM modules, and Sierra Wireless Airlink gateways. The sequencing suggested deliberate mapping of entire control loops, moving from operator interfaces to actuators, metering points, and remote gateways. Dragos found no evidence of successful exploitation during the scanning activity. The reconnaissance still indicates that exposed edge devices are being treated as operational intelligence sources, with collected data that could support future disruption planning. Destructive malware development continues to mature ELECTRUM activity in 2025 included destructive operations targeting Ukrainian infrastructure. In late May 2025, the group targeted eight Ukrainian ISPs, with responsibility claimed through the pro-Russian hacktivist persona Solntsepek. Dragos verified outages, including a four-hour disruption affecting Corbina’s autonomous system. In parallel, researchers identified a destructive malware family called PathWiper, linked by Dragos to ELECTRUM with moderate confidence. PathWiper was identified in June 2025, with samples appearing in the wild beginning in March 2025. The malware overwrote filesystem structures, enumerated mounted volumes, and targeted all accessible storage media to cause irreversible data loss. Dragos also identified another destructive wiper variant in December 2025, reinforcing ongoing iteration in ELECTRUM’s malware pipeline. Ransomware remains an OT outage driver Ransomware groups continued to target industrial organizations at scale. Dragos tracked 119 ransomware groups impacting more than 3,300 industrial organizations in 2025, up from 80 groups in 2024. Manufacturing accounted for more than two-thirds of observed victims. A recurring issue involved misclassification of ransomware events as IT-only incidents. In multiple cases, engineering workstations and HMI systems were treated as standard Windows endpoints, even when they supported SCADA or other operational workloads. The operational disruption often came through boundary systems such as VMware ESXi hosts and OT-support servers that ran historian and engineering functions. Visibility gaps are leaving defenders blind Dragos found that 30 percent of its incident response cases in 2025 began with operational staff reporting abnormal behavior, not with alerts or confirmed detection. In many cases, the telemetry required to determine whether cyber activity was involved had never been collected. Dragos estimated fewer than 10 percent of OT networks worldwide have visibility and monitoring in place. The overall pattern across 2025 showed attackers moving faster, operating deeper, and relying on weak segmentation and exposed access paths. The most urgent challenge remains basic: collect OT network data before an incident, monitor remote access pathways, and treat engineering workstations and OT boundary systems as high-value operational assets.

Three new threat groups started targeting industrial control systems (ICS) and other operational technology (OT) in 2025, according to a new report from cybersecurity company Dragos. The security firm’s 9th annual Year in Review OT/ICS Cybersecurity Report shows that of the total of 26 threat groups tracked by Dragos, 11 were active in 2025. Three of them are newly added to the list: Sylvanite, Azurite, and Pyroxene. Sylvanite appears to act as a “rapid exploitation broker” that enables the group named Voltzite to access critical infrastructure. Voltzite is known for gaining long-term access to targets, including the US electric grid. Sylvanite has been observed quickly weaponizing n-day vulnerabilities — for instance, it exploited Ivanti VPN vulnerabilities within 48 hours of their disclosure. The hackers then installed persistent web shells on F5 appliances, extracted Active Directory credentials, and then handed over access to Voltzite. The group has targeted electric power, oil and gas, water, manufacturing, and public administration organizations in North America, Europe, Japan, South Korea, the Philippines, Saudi Arabia, and Guam. Sylvanite overlaps with groups and activity previously linked by other cybersecurity firms to China, including UNC5221 (known for the use of the Brickstorm malware). However, Dragos noted that precise attribution remains challenging, and overlapping activity between two groups does not necessarily mean they are the same entity. The second new group, Azurite, has also been linked to threat groups tied by other cybersecurity firms to China, including to Flax Typhoon, Ethereal Panda, and UNC5923. Some links to Voltzite have also been found. The threat group has been seen stealing operational information from manufacturing, automotive, electric, defense, oil and gas, and government organizations in Taiwan, the United States, Japan, South Korea, Australia, and Europe. The hackers have compromised SOHO routers to build proxy infrastructure. They have also leveraged compromised edge devices to pivot to OT, including engineering workstations, from which they can conduct malicious activities using existing software to evade detection. According to Dragos, Azurite has exfiltrated OT network diagrams and operational data, including alarm data, PLC configurations, and HMI data. While the goal may be intellectual property theft, the stolen information could also be used to cause disruption in the targeted organization. “Azurite has not been observed manipulating, stopping, or modifying OT-specific software; it has only identified and exfiltrated information already on target assets,” the security firm said in its report. “This activity is highly likely to support capability development, target designation, and environment awareness for the preparation of offensive operations in case of geopolitical conflict.” The third new group is Pyroxene, whose activity and techniques overlap with groups known to be associated with Iran, including APT35 (Charming Kitten). Pyroxene, which has been around since at least 2023, specializes in cross-domain access, enabling movement from IT to OT networks. The group stands out for its use of social engineering, including creating fake LinkedIn profiles that pose as aerospace recruiters, and the use of wipers. Pyroxene has targeted the manufacturing, transportation, logistics, aerospace, aviation, and utilities sectors in the United States, Europe, and the Middle East. “Wiper malware targeting IT systems can have a severe downstream impact on ICS operations. Destructive wiping of IT systems can render systems unbootable and disrupt operational dependencies, resulting in loss of availability. Even without direct PLC targeting, the loss of supporting IT services can halt operations, delay recovery, and increase safety risk across industrial environments,” the security firm noted. It added, “Dragos assesses with moderate confidence Pyroxene is actively positioning for future ICS-impacting operations by exploiting supply chains, trusted relationships, and IT-OT dependencies, creating a credible risk of disruption or destruction even when OT networks are not directly targeted.” Updates on known threat groups targeting ICS/OT Kamacite, a Russia-linked group tracked by Dragos for more than a decade and responsible for reconnaissance and initial access in Electrum attacks, has been seen expanding its targets beyond Ukraine. The security firm has observed the hackers scanning for industrial devices in the US, including HMIs, gateways, meters, and variable-frequency drives (VFDs). Electrum has been conducting disruptive attacks, often targeting Ukraine. However, this threat group has also recently expanded beyond Ukraine, including for the recent campaign targeting Poland’s power grid. According to Dragos, this appears to be a result of the conflict in Ukraine — or at least the cyber aspect of the war — winding down, and Russian threat actors resuming global operations in the interests of Moscow, as they did before the war. In a briefing with the media, Dragos CEO Robert M. Lee pointed out that threat groups are still largely focusing on the theft of intellectual property. However, they are also increasingly focused on collecting data that can later be used to cause disruption or damage. Dragos’ full 2026 report also includes information on other known threat groups, ransomware attacks on industrial organizations, vulnerabilities affecting ICS/OT products, and recommendations for defenders. Related: 5 Bills to Boost Energy Sector Cyber Defenses Clear House Panel

The recent attack on Poland’s power grid, believed to have been conducted by Russian threat actors, targeted communication and control systems across roughly 30 sites and in some cases resulted in permanent industrial control system (ICS) damage, according to industrial cybersecurity firm Dragos. In a report published this week, the security firm, which has been involved in responding to the incident, described it as the first major operation specifically targeting distributed energy resources (DER). The attackers gained access to operational technology (OT) systems at combined heat and power (CHP) plants and renewable energy dispatch centers for wind and solar facilities, primarily targeting grid safety and stability monitoring systems rather than active power generation. Unlike the attacks targeting Ukraine’s grid in 2015 and 2016, the incident did not result in electrical outages. However, the attackers’ activities resulted in some equipment at the affected sites being bricked. ESET last week attributed the attack to Sandworm, a Russian state-sponsored threat group, reporting that the attackers had deployed wiper malware on compromised systems. Dragos has linked the attack — with moderate confidence — to a group it tracks as Electrum, which it describes as related to, but not always the same as, Sandworm. According to Dragos’s technical analysis, the hackers systematically compromised communication infrastructure and remote terminal units (RTUs), devices that interface between physical equipment at distributed sites and control systems. “Taking over these devices requires capabilities beyond simply understanding their technical flaws,” Dragos explained. “It requires knowledge of their specific implementation. The adversaries demonstrated this by successfully compromising RTUs at approximately 30 sites, suggesting they had mapped common configurations and operational patterns to exploit systematically.” Dragos found that some ICS devices were irreparably damaged during the attack. Phil Tonkin, Field CTO at Dragos, told SecurityWeek that a process has been developed to repair hacked RTUs, but some devices were “sufficiently damaged that there was no way to restore them in the field”. ICS devices bricked “We can’t confirm the specific function of the devices at this time, but can confirm that the mix of OT devices we describe in report were affected in ways which disrupted their operation, some of which were bricked,” Tonkin explained. The absence of power outages appears to result from the inherent design of electricity systems. When communication infrastructure is lost, most industrial devices continue to operate in their last known state, allowing the power to stay on even when remote monitoring and control are disabled. While the attack on Poland’s power grid bears similarities to the operations aimed at Ukraine a decade ago, Dragos noted that the recent attack lacked the coordinated sequencing seen in the Ukraine blackouts. The new attack appears rushed and opportunistic, and it’s unclear whether the hackers attempted to issue malicious operational commands to trigger an outage or if they were satisfied with disrupting communications and damaging hardware, the security firm said. The company pointed out that Electrum does possess the skills to cause more damage, but conducting an attack requires a significant amount of time, including for developing custom payloads for each of the targeted sites. It appears that the compressed timeline from reconnaissance to final execution left little room for the preparation required to launch a more disruptive assault. “Dragos assesses with moderate confidence that opportunism was a key factor in the attack. Rather than executing a precisely planned operation with specific outcomes, Electrum exploited whatever opportunities their access provided: wiping Windows-based devices, resetting configurations, or attempting to permanently damage (or brick) equipment,” Dragos noted, adding, “It appears the operation was rushed, but Dragos cannot make an assessment as to why.” Related: New Reports Reinforce Cyberattack’s Role in Maduro Capture Blackout Related: Access System Flaws Enabled Hackers to Unlock Doors at Major European Firms

The "coordinated" cyber attack targeting multiple sites across the Polish power grid has been attributed with medium confidence to a Russian state-sponsored hacking crew known as ELECTRUM. Operational technology (OT) cybersecurity company Dragos, in a new intelligence brief published Tuesday, described the late December 2025 activity as the first major cyber attack targeting distributed energy resources (DERs). "The attack affected communication and control systems at combined heat and power (CHP) facilities and systems managing the dispatch of renewable energy systems from wind and solar sites," Dragos said. "While the attack did not result in power outages, adversaries gained access to operational technology systems critical to grid operations and disabled key equipment beyond repair at the site." It's worth pointing out that ELECTRUM and KAMACITE share overlaps with a cluster referred to as Sandworm (aka APT44 and Seashell Blizzard). KAMACITE focuses on establishing and maintaining initial access to targeted organizations using spear-phishing, stolen credentials, and exploitation of exposed services. Beyond initial access, the threat actor performs reconnaissance and persistence activities over extended periods of time as part of efforts to burrow deep into target OT environments and keep a low profile, signaling a careful preparatory phase that precedes actions executed by ELECTRUM targeting the industrial control systems. "Following access enablement, ELECTRUM conducts operations that bridge IT and OT environments, deploying tooling within operational networks, and performs ICS-specific actions that manipulate control systems or disrupt physical processes," Dragos said. "These actions have included both manual interactions with operator interfaces and the deployment of purpose-built ICS malware, depending on the operational requirements and objectives." Put differently, the two clusters have clear separation of roles and responsibilities, enabling flexibility in execution and facilitating sustained OT-focused intrusions when conditions are favourable. As recently as July 2025, KAMACITE is said to have engaged in scanning activity against industrial devices located in the U.S. Although no follow-on OT disruptions have been publicly reported to date, this highlights an operational model that is not geographically constrained and facilitates early-stage access identification and positioning. "KAMACITE's access-oriented operations create the conditions under which OT impact becomes possible, while ELECTRUM applies execution tradecraft when timing, access, and risk tolerance align," it explained. "This division of labor enables flexibility in execution and allows OT impact to remain an option, even when it is not immediately exercised. This extends risk beyond discrete incidents and into prolonged periods of latent exposure." Dragos said the Poland attack targeted systems that facilitate communication and control between grid operators and DER assets, including assets that enable network connectivity, allowing the adversary to successfully disrupt operations at about 30 distributed generation sites. The threat actors are assessed to have breached Remote Terminal Units (RTUs) and communication infrastructure at the affected sites using exposed network devices and exploited vulnerabilities as initial access vectors. The findings indicate that the attackers possess a deep understanding of electrical grid infrastructure, allowing them to disable communications equipment, including some OT devices. That said, the full scope of the malicious actions undertaken by ELECTRUM is unknown, with Dragos noting that it's unclear if the threat actor attempted to issue operational commands to this equipment or focused solely on disabling communications. The Poland attack is also assessed to be more opportunistic and rushed than a precisely planned operation, allowing the hackers to take advantage of the unauthorized access to inflict as much damage as possible by wiping Windows-based devices to impede recovery, resetting configurations, or attempting to permanently brick equipment. The majority of the equipment is targeted at grid safety and stability monitoring, per Dragos. "This incident demonstrates that adversaries with OT-specific capabilities are actively targeting systems that monitor and control distributed generation," it added. "The disabling of certain OT or industrial control system (ICS) equipment beyond repair at the site moved what could have been seen as a pre-positioning attempt by the adversary into an attack."

A new variant of the banking trojan 'Coyote' has begun abusing a Windows accessibility feature, Microsoft's UI Automation framework, to identify which banking and cryptocurrency exchange sites are accessed on the device for potential credential theft. Microsoft UIA is a Windows accessibility framework designed to allow assistive technologies to interact with, inspect, and control user interface (UI) elements in applications. Windows apps expose their UI elements through a UI Automation tree, and the UIA API provides a way to traverse it, query the properties of each element, and interact with it. Akamai researchers had warned about the possibility of Windows UIA being abused to steal credentials in December 2024, highlighting that the technique evades endpoint detection and response (EDR) protections. Now, the same researchers report that they have seen attacks leveraging the technique in the wild since February 2025, marking the first real-world case of malware abusing Microsoft UIA for data theft. Coyote evolution and UIA abuse Coyote is a banking trojan that attempts to steal credentials for 75 banking and cryptocurrency exchange apps, primarily targeting Brazilian users. The malware was first documented in February 2024, utilizing tactics such as keylogging and phishing overlays, and has undergone significant development since then. Akamai reports that, while the latest Coyote variant continues to steal data using traditional methods for hardcoded apps, it has added UIA abuse when the user opens web-based banking or cryptocurrency services in a browser. If Coyote cannot identify a target via the window title, it uses UIA to extract the web address from within the browser's UI elements (tabs or address bars). Finally, it compares it against a hardcoded list of 75 targeted services. "If no match is found, Coyote will then use UIA to parse through the UI child elements of the window in an attempt to identify browser tabs or address bars," explains Akamai in the report. "The content of these UI elements will then be cross-referenced with the same list of addresses from the first comparison." Some of the banks and exchanges that are identified using this method are Banco do Brasil, CaixaBank, Banco Bradesco, Santander, Original bank, Sicredi, Banco do Nordeste, Expanse apps, and Cryptocurrency (Binance, Electrum, Bitcoin, Foxbit, and others). Although the abuse of this Windows accessibility feature stops at the reconnaissance phase, Akamai shared a proof-of-concept demonstration of how UIA can also be abused to steal inputted credentials for these sites. BleepingComputer has contacted Microsoft to ask about the potential introduction of safeguards to stop the abuse of UIA on Windows, but a comment wasn't immediately available. Accessibility systems are designed to be powerful, allowing people with disabilities to fully utilize the capabilities of their devices. However, this power also invites malicious use. In Android, this problem has taken massive proportions, with malware abusing Accessibility Services extensively. Over the years, Google has implemented multiple measures to address this issue. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report