puppet

Latin America and Europe become the target of two banking trojan campaigns that are designed to infect Windows and Android devices with Grandoreiro and BTMOB malware, respectively. That's according to new findings from WatchGuard and ESET, which have observed the two malware families being used to single out companies in Spain, Portugal, and Mexico, as well as mobile users in Brazil. The Grandoreiro campaign "uses the DLL Side-Loading technique abusing four different software, targeting banks in Portugal," WatchGuard researcher Euler Neto said. Active since 2016, Grandoreiro is an actively evolving banking malware that's capable of stealing credentials associated with thousands of financial institutions across 45 countries and territories. It's typically distributed via phishing emails, instructing recipients to click on sketchy links. Despite some arrests and attempts by Brazilian authorities to dismantle its infrastructure in early 2024, the malware has continued to expand its targeting footprint, while incorporating CAPTCHA checks to resist analysis. The latest campaign flagged by WatchGuard has been found to leverage DLL side-loading to launch DLLs that are developed in Delphi 11, a programming language commonly used for malware targeting the region. Two of the DLLs - mingwm10.dll and libwebp.dll - have been found to incorporate sgcWebSockets, a WebSocket and real-time communication library, for peer-to-peer (P2P) and WebRTC communications. "The DLLs associated with this case use the Session Traversal Utilities for NAT (STUN) protocol, which is a protocol that helps devices behind a NAT discover their public IP address and port number, enabling peer-to-peer communication," WatchGuard explained. "The advantage for threat actors to use web conferencing traffic in their campaigns is due to this traffic being noisy, being difficult to monitor, and due to WebRTC being commonly used across all major web-conferencing platforms." Two other DLLs associated with the campaign are libffi-6.dll and libpng15.dll, which make use of the Interactive Connectivity Establishment (ICE) protocol instead of STUN to achieve the same goal. These files specifically reference banks and financial institutions that operate in Portugal, such as Abanca, Banco de Portugal, BBVA PT, Caixa Geral Depositos, and Santander, among others. Also targeted are Revolut and Wise. WatchGuard also said it identified another campaign in which phishing emails are used to deliver a ZIP archive hosted on Mediafire. The file contains an obfuscated Visual Basic Script that's responsible for launching an executable, which displays a message asking users to update Adobe Reader by clicking on a button embedded in the alert. Doing so triggers a series of checks aimed at avoiding detection and complicating malware analysis, before launching the final payload to steal banking information and sensitive data. Some of the tactics overlap with a prior Grandoreiro campaign detailed by Kaspersky in October 2024. "The bigger story here is not just that Grandoreiro is still active," WatchGuard said. "It is that financially motivated threat groups continue to adapt quickly, reuse legitimate services, and hide inside traffic patterns that many organizations may already trust." "By combining phishing, DLL side-loading, WebRTC-related components, cloud service abuse, and anti-analysis checks, these campaigns show how banking malware is becoming harder to spot with surface-level defenses alone." BTMOB Offers Ready-Made Campaign Tools The disclosure coincides with a report from ESET about BTMOB, an Android remote access trojan (RAT) that first emerged in February 2025 with capabilities to unlock devices, capture screenshots, log keystrokes, automate credential theft through HTML injections when certain apps are opened, and enable remote control. A subsequent iteration introduced the ability to capture Alipay PINs. "The RAT is also sold with an APK builder interface, allowing anyone to generate new payloads and adapt phishing lures for specific regions at a rapid clip - and without writing any code," ESET researcher Daniel Cunha Barbosa said. BTMOB campaigns have been mainly observed in attacks in Brazil and Latin America, but the malware's phishing-based delivery and device takeover capabilities, coupled with the ready-made app-building tooling, makes it a potent threat that poses risks well beyond the region and brings down the time and effort required to conduct a full device compromise, the Slovakian security vendor warned. The primary method through which the malware spreads is via social engineering, where users are sent links to bogus websites masquerading as streaming services, cryptocurrency mining platforms, and other trusted online services. From those sites, victims are directed to fake Google Play Store app listings that trick them into installing an Android package (APK) file containing the malware. Once installed, the malware seeks permissions to use Android's accessibility services and then leverages it to grant itself additional system access without any user interaction. BTMOB is believed to be the successor to CraxsRAT, CypherRAT, and SpySolr families. As of May 2026, the latest version of the malware (BTMOB v4.5.5) claims to offer enhanced APK protection and compatibility with the latest Google Play updates. "This update is all about speed and stability," an X profile allegedly linked to the malware posted on May 1, 2026. "We've expanded our infrastructure and refined the builder to keep you ahead of the latest mobile security patches." The Trojan is advertised by a threat actor named EVLF (@craxso) for a price tag of $700 per month. According to a YouTube video shared by the malware author on May 1, 2026, a lifetime license is worth $1,200. The complete server source code is available for $7,000, allowing customers to host the command-and-control (C2) panels on their own infrastructure. As recently as this week, the X profile also shared a link to a Medium article about "how BTMOB RAT is turning Android phones into remote-controlled weapons," and has been "evolving fast" since early 2025. "It slips in through phishing sites, grabs accessibility services, and turns your phone into a puppet," the article reads. "Hackers watch your screen live. They steal banking details. They even mine crypto in the background while you scroll Instagram." Interestingly, the article was published by an account named "CraxsRAT Main developer." The account's bio claims they are a "skilled and resourceful cybercriminal who built a profitable cybercrime enterprise by selling highly advanced RAT malware to other threat actors." The fact that BTMOB is sold under a malware-as-a-service (MaaS) model risks lowering the barrier to entry for less sophisticated threat actors. This is compounded by reports that leaked versions are already circulating on underground forums and Telegram, increasing the risk of abuse through copycats and other aspiring criminals. "Access rarely stays contained forever, and the tool can move into secondary markets through resale, barter, or sharing inside closed groups," ESET said. "Competing malware families can also copy some elements that make payload customization and campaign management easier for less skilled criminals." Italian cybersecurity company D3Lab, in an analysis of the leaked BTMOB RAT development toolkit published in December 2025, said it included the Android payload source code, its dropper, a builder environment, the operator panel for Windows, the C2 backend, and all the software dependencies required to deploy the platform. "The BTMOB leak provides a rare perspective on the inner workings of a modern Android RAT-as-a-Service ecosystem," D3Lab noted at the time. "It demonstrates that the threat actor operates not merely as a developer selling a toolkit, but as a service provider enforcing licensing, authentication, and version control over their customers."

An apparent hack-for-hire campaign likely orchestrated by a threat actor with suspected ties to the Indian government targeted journalists, activists, and government officials across the Middle East and North Africa (MENA), according to findings from Access Now, Lookout, and SMEX. Two of the targets included prominent Egyptian journalists and government critics, Mostafa Al-A'sar and Ahmed Eltantawy, who were at the receiving end of a series of spear-phishing attacks that sought to compromise their Apple and Google accounts in October 2023 and January 2024 by directing them to fake pages that tricked them into entering their credentials and two-factor authentication (2FA) codes. "The attacks were carried out from 2023 to 2024, and both targets are prominent critics of the Egyptian government who have previously faced political imprisonment; one of them was previously targeted with spyware," Access Now's Digital Security Helpline said. Also singled out as part of these efforts was an anonymous Lebanese journalist, who received phishing messages in May 2025 through the Apple Messages app and WhatsApp containing malicious links that, when clicked, tricked users into entering their account credentials as part of a supposed verification step from Apple. "The phishing campaign included persistent attacks via iMessage/Apple Messenger and WhatsApp app, [...] impersonating Apple Support," SMEX, a digital rights non-profit in the West Asia and North Africa (WANA) region, said. "While the main focus of this campaign appears to be Apple services, evidence suggests that other messaging platforms, namely Telegram and Signal, were also targeted." In the case of Al-A'sar, the spear-phishing attack aimed at compromising his Google account began with a LinkedIn message from a sock puppet persona named "Haifa Kareem," who approached him with a job opportunity. After the journalist shared their mobile number and email address with the LinkedIn user, he received an email from the latter on January 24, 2024, instructing him to join a Zoom call by clicking on a link shortened using Rebrandly. The URL is assessed to be a consent-based phishing attack that leverages Google's OAuth 2.0 to grant the attacker unauthorized access to the victim's account through a malicious web application named "en-account.info." "Unlike the previous attack, where the attacker impersonated an Apple account login and used a fake domain, this attack employs OAuth consent to leverage legitimate Google assets to deceive targets into providing their credentials," Access Now said. "If the targeted user is not logged in to Google, they are prompted to enter their credentials (username and password). More commonly, if the user is already logged in, they are prompted to grant permission to an application that the attacker controls, using a third-party sign-in feature that is familiar to most Google users." Some of the domains used in these phishing attacks are listed below - signin-apple.com-en-uk[.]co id-apple.com-en[.]io facetime.com-en[.]io secure-signal.com-en[.]io telegram.com-en[.]io verify-apple.com-ae[.]net join-facetime.com-ae[.]net android.com-ae[.]net encryption-plug-in-signal.com-ae[.]net Interestingly, the use of the domain "com-ae[.]net" overlaps with an Android spyware campaign that Slovakian cybersecurity company ESET documented in October 2025, highlighting the use of deceptive websites impersonating Signal, ToTok, and Botim to deploy ProSpy and ToSpy to unspecified targets in the U.A.E. Specifically, the domain "encryption-plug-in-signal.com-ae[.]net" was used as an initial access vector for ProSpy by claiming to be a non-existent encryption plugin for Signal.The spyware comes fitted with capabilities to exfiltrate sensitive data like contacts, SMS messages, device metadata, and local files. Neither of the Egyptian journalists' accounts was ultimately infiltrated. However, SMEX revealed that the initial attack that targeted the Lebanese journalist on May 19, 2025, completely compromised their Apple Account and resulted in the addition of a virtual device to the account to gain persistent access to the victim's data. The second wave of attacks was unsuccessful. While there is no evidence that the three journalists were targeted with spyware, the evidence shows that threat actors can use the methods and infrastructure associated with the attacks to deliver malicious payloads and exfiltrate sensitive data. "This suggests that the operation we identified may be part of a broader regional surveillance effort aimed at monitoring communications and harvesting personal data," Access Now said. Lookout, in its own analysis of these campaigns, attributed the disparate efforts to a hack-for-hire operation with ties to Bitter, a threat cluster that's assessed to be tasked with intelligence gathering efforts in the interests of the Indian government. The espionage campaign has been operational since at least 2022. Based on the phishing domains observed and ProSpy malware lures, the campaign has likely targeted victims in Bahrain, the U.A.E., Saudi Arabia, the U.K., Egypt, and potentially the U.S., or alumni of U.S. universities, indicating the attacks go beyond members of Egyptian and Lebanese civil society. "The operation features a combination of targeted spear-phishing delivered through fake social media accounts and messaging applications leveraging persistent social engineering efforts, which may result in the delivery of Android spyware depending on the target’s device," the cybersecurity company said. The campaign's links to Bitter stem from infrastructure connections between "com-ae[.]net" and "youtubepremiumapp[.]com," a domain flagged by Cyble and Meta in August 2022 as linked to Bitter in relation to an espionage effort that used fake sites mimicking trusted services like YouTube, Signal, Telegram, and WhatsApp to distribute an Android malware dubbed Dracarys. Lookout's analysis has also uncovered similarities between Dracarys and ProSpy, despite the latter being developed years later using Kotlin instead of Java. "Both families use worker logic to handle tasks, and they name the worker classes similarly. They also both use numbered C2 commands," the company added. "While ProSpy exfiltrates data to server endpoints starting with 'v3,' Dracarys exfiltrates data to server endpoints starting with 'r3.'" These connections notwithstanding, what makes the campaign unusual is that Bitter has never been attributed to espionage campaigns targeting civil society members. This has raised two possibilities: either it's the work of a hack-for-hire operation with ties to Bitter or the threat actor itself is behind it, in which case it could indicate an expansion of its targeting scope. "We do not know whether this represents an expansion of Bitter's role, or if it is an indication of overlap between Bitter and an unknown hack-for-hire group," Lookout added. "What we do know is that mobile malware continues to be a primary means of spying on civil society, whether it is purchased through a commercial surveillance vendor, outsourced to a hack-for-hire organization, or deployed directly by a nation state."

Cybersecurity researchers have discovered 36 malicious packages in the npm registry that are disguised as Strapi CMS plugins but come with different payloads to facilitate Redis and PostgreSQL exploitation, deploy reverse shells, harvest credentials, and drop a persistent implant. "Every package contains three files (package.json, index.js, postinstall.js), has no description, repository, or homepage, and uses version 3.6.8 to appear as a mature Strapi v3 community plugin," SafeDep said. All identified npm packages follow the same naming convention, starting with "strapi-plugin-" and then phrases like "cron," "database," or "server" to fool unsuspecting developers into downloading them. It's worth noting that the official Strapi plugins are scoped under "@strapi/." The packages, uploaded by four sock puppet accounts "umarbek1233," "kekylf12," "tikeqemif26," and "umar_bektembiev1" over a period of 13 hours, are listed below - strapi-plugin-cron strapi-plugin-config strapi-plugin-server strapi-plugin-database strapi-plugin-core strapi-plugin-hooks strapi-plugin-monitor strapi-plugin-events strapi-plugin-logger strapi-plugin-health strapi-plugin-sync strapi-plugin-seed strapi-plugin-locale strapi-plugin-form strapi-plugin-notify strapi-plugin-api strapi-plugin-sitemap-gen strapi-plugin-nordica-tools strapi-plugin-nordica-sync strapi-plugin-nordica-cms strapi-plugin-nordica-api strapi-plugin-nordica-recon strapi-plugin-nordica-stage strapi-plugin-nordica-vhost strapi-plugin-nordica-deep strapi-plugin-nordica-lite strapi-plugin-nordica strapi-plugin-finseven strapi-plugin-hextest strapi-plugin-cms-tools strapi-plugin-content-sync strapi-plugin-debug-tools strapi-plugin-health-check strapi-plugin-guardarian-ext strapi-plugin-advanced-uuid strapi-plugin-blurhash An analysis of the packages reveals that the malicious code is embedded within the postinstall script hook, which gets executed on "npm install" without requiring any user interaction. It runs with the same privileges as those of the installing user, meaning it abuses root access within CI/CD environments and Docker containers. The evolution of the payloads distributed as part of the campaign is as follows - Weaponize a locally accessible Redis instance for remote code execution by injecting a crontab (aka cron table) entry to download and execute a shell script from a remote server every minute. The shell script writes a PHP web shell and Node.js reverse shell via SSH to Strapi's public uploads directory. It also attempts to scan the disk for secrets (e.g., Elasticsearch and cryptocurrency wallet seed phrases) and exfiltrate a Guardarian API module. Combine Redis exploitation with Docker container escape to write shell payloads to the host outside the container. It also launches a direct Python reverse shell on port 4444 and writes a reverse shell trigger into the application’s node_modules directory via Redis. Deploy a reverse shell and write a shell downloader via Redis and execute the resulting file. Scan the system for environment variables and PostgreSQL database connection strings. An expanded credential harvester and reconnaissance payload to gather environment dumps, Strapi configurations, Redis database extraction by running INFO, DBSIZE, and KEYS commands, network topology mapping, Docker/Kubernetes secrets, cryptographic keys, and cryptocurrency wallet files. Conduct PostgreSQL database exploitation by connecting to the target's PostgreSQL database using hard-coded credentials and querying Strapi-specific tables for secrets. It also dumps matching cryptocurrency-related patterns (e.g., wallet, transaction, deposit, withdraw, hot, cold, and balance) and attempts to connect to six Guardarian databases. This indicates that the threat actor is already in possession of the data, obtained either via a prior compromise or through some other means. Deploy a persistent implant designed to maintain remote access to a specific hostname ("prod-strapi"). Facilitate credential theft by scanning hard-coded paths and spawning a persistent reverse shell. "The eight payloads show a clear narrative: the attacker started aggressively (Redis RCE, Docker escape), found those approaches weren't working, pivoted to reconnaissance and data collection, used hardcoded credentials for direct database access, and finally settled on persistent access with targeted credential theft," SafeDep said. The nature of the payloads, combined with the focus on digital assets and the use of hard-coded database credentials and hostname, raises the possibility that the campaign was a targeted attack against a cryptocurrency platform. Users who have installed any of the aforementioned packages are advised to assume compromise and rotate all credentials. The discovery coincides with the discovery of several supply chain attacks targeting the open-source ecosystem - A GitHub account named "ezmtebo" has submitted over 256 pull requests across various open-source repositories containing a credential exfiltration payload. "It steals secrets through CI logs and PR comments, injects temporary workflows to dump secret values, auto-applies labels to bypass pull_request_target gates, and runs a background /proc scanner for 10 minutes after the main script exits," SafeDep said. A hijack of "dev-protocol," a verified GitHub organization, to distribute malicious Polymarket trading bots with typosquatted npm dependencies ("ts-bign" and "levex-refa" or "big-nunber" and "lint-builder") that steal wallet private keys, exfiltrate sensitive files, and open an SSH backdoor on the victim's machine. While "levex-refa" functions as a credential stealer, "lint-builder" installs the SSH backdoor. Both "ts-bign" and "big-nunber" are designed to deliver "levex-refa" and "lint-builder," respectively, as a transitive dependency. A compromise of the popular Emacs package, "kubernetes-el/kubernetes-el," that exploited the Pwn Request vulnerability in its GitHub Actions workflow by using the pull_request_target trigger to steal the repository's GITHUB_TOKEN, exfiltrate CI/CD secrets, deface the repository, and inject destructive code to delete nearly all repository files. A compromise of the legitimate "xygeni/xygeni-action" GitHub Actions workflow using stolen maintainer credentials to plant a reverse shell backdoor. Xygeni has since implemented new security controls to address the incident. A compromise of the legitimate npm package, "mgc," by means of an account takeover to push four malicious versions (1.2.1 through 1.2.4) containing a dropper script that detects the operating system and fetches a platform-specific payload – a Python trojan for Linux and a PowerShell variant for Windows called WAVESHAPER.V2 – from a GitHub Gist. The attack shares direct overlap with the recent supply chain attack targeting Axios, which has been attributed to a North Korean threat cluster tracked as UNC1069. A malicious npm package named "express-session-js" that typosquats "express-session" and contains a dropper that retrieves a next-stage remote access trojan (RAT) from JSON Keeper to conduct data theft and persistent access by connecting to "216.126.237[.]71" using the Socket.IO library. A compromise of the legitimate PyPI package, "bittensor-wallet" (version 4.0.2), to deploy a backdoor that's triggered during a wallet decryption operation to exfiltrate wallet keys using HTTPS, DNS tunneling, and Raw TLS as exfiltration channels to either a hard-coded domain or one created using a Domain Generation Algorithm (DGA) that's rotated daily. A malicious PyPI package named "pyronut" that typosquats "pyrogram," a popular Python Telegram API framework, to embed a stealthy backdoor that's triggered every time a Telegram client starts and seize control of the Telegram session and the underlying host system. "The backdoor registers hidden Telegram message handlers that allow two hardcoded attacker-controlled accounts to execute arbitrary Python code (via the /e command and the meval library) and arbitrary shell commands (via the /shell command and subprocess) on the victim's machine," Endor Labs said. A set of three malicious Microsoft Visual Studio Code (VS Code) extensions published by "IoliteLabs" – "solidity-macos," "solidity-windows," and "solidity-linux" – that were originally dormant since 2018 but were updated on March 25, 2026, to launch a multi-stage backdoor targeting Windows and macOS systems upon launching the application to establish persistence. Collectively, the extensions had 27,500 installs prior to them being removed. Multiple versions of the "KhangNghiem/fast-draft" VS Code extension on Open VSX (0.10.89, 0.10.105, 0.10.106, and 0.10.112) that execute a GitHub-hosted downloader to deploy a second-stage Socket.IO RAT, an information stealer, a file exfiltration module, and a clipboard monitor from a GitHub repository. Interestingly, versions 0.10.88, 0.10.111, and 0.10.129-135 have been found to be clean. "That is not the release pattern you expect from a single compromised build or a maintainer who has fully switched to malicious behavior," Aikido said. "It looks more like two competing release streams sharing the same publisher identity." In a report published in February 2026, Group-IB revealed that software supply chain attacks have become "the dominant force reshaping the global cyber threat landscape," adding that threat actors are going after trusted vendors, open-source software, SaaS platforms, browser extensions, and managed service providers to gain inherited access to hundreds of downstream organizations. The supply chain threat can rapidly escalate a single localized intrusion into something that has a large-scale, cross-border impact, with attackers industrializing supply chain compromises and turning it into a "self-reinforcing" ecosystem, as it offers reach, speed, and stealth. "Package repositories such as npm and PyPI have become prime targets, stolen maintainer credentials, and automated malware worms to compromise widely used libraries – turning development pipelines into large-scale distribution channels for malicious code," Group-IB said

Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy. Fresh messes, old problems getting sharper, and research that stops feeling theoretical real fast. A few bits hit a little too close to real life, too. There’s a good mix here: weird abuse of trusted stuff, quiet infrastructure ugliness, sketchy chatter, and the usual reminder that attackers will use anything that works. Scroll on. You’ll see what I mean. ⚡ Threat of the Week Google Patches 2 Actively Exploited Chrome 0-Days — Google released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the wild. The vulnerabilities related to an out-of-bounds write vulnerability in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine (CVE-2026-3910) that could result in out-of-bounds memory access or code execution, respectively. Google did not share additional details about the flaws, but acknowledged that there exist exploits for both of them. The issues were addressed in Chrome versions 146.0.7680.75/76 for Windows and Apple macOS, and 146.0.7680.75 for Linux. Detection Starts the Clock. Response Decisions Shape the Outcome When incidents escalate, early decisions determine containment and impact. Join this SANS IR Command Roundtable to learn how experienced teams avoid investigation drift, improve coordination, and execute faster response across cloud, enterprise, and operational environments. Watch the Webcast ➝ 🔔 Top News Meta to Discontinue Instagram E2EE in May 2026 — Meta announced plans to discontinue support for end-to-end encryption (E2EE) for chats on Instagram after May 8, 2026. In a statement shared with The Hacker News, a Meta spokesperson said, "Very few people were opting in to end-to-end encrypted messaging in DMs, so we're removing this option from Instagram in the coming months. Anyone who wants to keep messaging with end-to-end encryption can easily do that on WhatsApp." Authorities Disrupt SocksEscort Service — A court-authorized international law enforcement operation dismantled a criminal proxy service named SocksEscort that enslaved thousands of residential routers worldwide into a botnet for committing large-scale fraud. "The malware allowed SocksEscort to direct internet traffic through the infected routers. SocksEscort sold this access to its customers," the U.S. Justice Department said. The main thing to note here is that SocksEscort was powered by AVrecon, a malware written in C to explicitly target MIPS and ARM architectures via known security flaws in edge network devices. The malware also featured a novel persistence mechanism that involved flashing custom firmware, which intentionally disables future updates, permanently transforming SOHO routers into SocksEscort proxy nodes to blindside corporate monitoring. UNC6426 Exploits nx npm Supply Chain Attack to Gain AWS Admin Access in 72 Hours — A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package in August 2025 to completely breach a victim's AWS environment within 72 hours. UNC6426 used the access to abuse the GitHub-to-AWS OpenID Connect (OIDC) trust and create a new administrator role in the cloud environment, Google said. Subsequently, this role was abused to exfiltrate files from the client's Amazon Web Services (AWS) Simple Storage Service (S3) buckets and perform data destruction in their production cloud environments. KadNap Enslaves Network Devices to Fuel Illegal Proxy — A takedown-resistant botnet comprising more than 14,000 routers and other network devices has been conscripted into a proxy network that anonymously ferries traffic used for cybercrime. The botnet, named KadNap, exploits known vulnerabilities in Asus routers (among others), leveraging the initial access to drop shell scripts that reach out to a peer-to-peer network based on Kademlia for decentralized control. Infected devices are being used to fuel a proxy service named Doppelganger that, for a fee, tunnels customers' internet traffic through residential IP addresses, offering a way for attackers to blend in and make it harder to differentiate malicious traffic from legitimate activity. APT28 Strikes with Sophisticated Toolkit — The Russian threat actor known as APT28 has been observed using a bespoke toolkit in recent cyber espionage campaigns targeting Ukrainian cyber assets. The primary components of the toolkit are two implants, one of which employs techniques from a malware framework the threat actor used in 2010s, while the other is a heavily modified version of the COVENANT framework for long-term spying. COVENANT is used in concert with BEARDSHELL to facilitate data exfiltration, lateral movement, and execution of PowerShell commands. Also alongside these tools is a malware named SLIMAGENT that shares overlaps with XAgent. ️🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-3909, CVE-2026-3910, CVE-2026-3913 (Google Chrome), CVE-2026-21666, CVE-2026-21667, CVE-2026-21668, CVE-2026-21672, CVE-2026-21708, CVE-2026-21669, CVE-2026-21671 (Veeam Backup & Replication), CVE-2026-27577, CVE-2026-27493, CVE-2026-27495, CVE-2026-27497 (n8n), CVE-2026-26127, CVE-2026-21262 (Microsoft Windows), CVE-2019-17571, CVE-2026-27685 (SAP), CVE-2026-3102 (ExifTool for macOS), CVE-2026-27944 (Nginx UI), CVE-2025-67826 (K7 Ultimate Security), CVE-2026-26224, CVE-2026-26225 (Intego X9), CVE-2026-29000 (pac4j-jwt), CVE-2026-23813 (HPE Aruba Networking AOS-CX), CVE-2025-12818 (PostgreSQL), CVE-2026-2413 (Ally WordPress plugin), CVE-2026-0953 (Tutor LMS Pro WordPress plugin), CVE-2026-25921 (Gogs), CVE-2026-2833, CVE-2026-2835, CVE-2026-2836 (Cloudflare Pingora), CVE-2026-24308 (Apache ZooKeeper), CVE-2026-3059, CVE-2026-3060, CVE-2026-3989 (SGLang), CVE-2026-0231 (Palo Alto Networks Cortex XDR Broker VM), CVE-2026-20040, CVE-2026-20046 (Cisco IOS XR Software), CVE-2025-65587 (graphql-upload-minimal), CVE-2026-3497 (OpenSSH), CVE-2026-26123 (Microsoft Authenticator for Android and iOS), and CVE-2025-61915 (CUPS). 🎥 Cybersecurity Webinars Stop Guessing: Automate Your Defense Against Real-World Attacks → Learn how to move beyond basic security checklists by using automation to test your defenses against real-world attacks. Experts will show you why traditional testing often fails and how to use continuous, data-driven tools to find and fix gaps in your protection. You will learn how to prove your security actually works without increasing your manual workload. Fix Your Identity Security: Closing the Gaps Before Hackers Find Them → This webinar covers a new study about why many companies are struggling to keep their user accounts and digital identities safe. Experts share findings from the Ponemon Institute on the biggest security gaps, such as disconnected apps and the new risks created by AI. You will learn simple, practical steps to fix these problems and get better control over who has access to your company's data. The Ghost in the Machine: Securing the Secret Identities of Your AI Agents → As artificial intelligence (AI) begins to act on its own, businesses face a new challenge: how to give these "AI agents" the right digital IDs. This webinar explains why current security for humans doesn't work for autonomous bots and how to build a better system to track what they do. You will learn simple, real-world steps to give AI agents secure identities and clear rules, ensuring they don't accidentally expose your private company data. 📰 Around the Cyber World Fake Google Security Check Drops Browser RAT — A web page mimicking a Google Account security page has been spotted delivering a fully featured browser-based surveillance toolkit that takes the form of a Progressive Web App (PWA). "Disguised as a routine security checkup, it walks victims through a four-step flow that grants the attacker push notification access, the device's contact list, real-time GPS location, and clipboard contents—all without installing a traditional app," Malwarebytes said. "For victims who follow every prompt, the site also delivers an Android companion package introducing a native implant that includes a custom keyboard (enabling keystroke capture), accessibility-based screen reading capabilities, and permissions consistent with call log access and microphone recording." Forbidden Hyena Delivers BlackReaperRAT — A hacktivist group known as Forbidden Hyena (aka 4B1D) has distributed RAR archives in December 2025 and January 2026 in attacks targeting Russia that led to the deployment of a previously undocumented remote access trojan called BlackReaperRAT and an updated version of the Blackout Locker ransomware, referred to as Milkyway by the threat actors. BlackReaperRAT is capable of running commands via "cmd.exe," uploading/downloading files, spawning an HTTP shell to receive commands, and spreading the malware to connected removable media. "It carries out destructive attacks against organizations across various sectors located within the Russian Federation," BI.ZONE said. "The group publishes information regarding successful attacks on its Telegram channel. It collaborates with the groups Cobalt Werewolf and Hoody Hyena." Chinese Hackers Target the Persian Gulf region with PlugX — A China-nexus threat actor, likely suspected to be Mustang Panda, has targeted countries in the Persian Gulf region. The activity took place within the first 24 hours of the ongoing conflict in the Middle East late last month. The campaign used a multi-stage attack chain that ultimately deployed a PlugX backdoor variant. "The shellcode and PlugX backdoor used obfuscation techniques such as control flow flattening (CFF) and mixed boolean arithmetic (MBA) to hinder reverse engineering," Zscaler said. "The PlugX variant in this campaign supports HTTPS for command-and-control (C2) communication and DNS-over-HTTPS (DOH) for domain resolution." Phishing Campaign Uses SEO Poisoning to Steal Data — A phishing campaign has employed SEO poisoning to direct search engine results to fake traffic ticket portals that impersonate the Government of Canada and specific provincial agencies. "The campaign lures victims to a fake 'Traffic Ticket Search Portal' under the pretense of paying outstanding traffic violations," Palo Alto Networks Unit 42 said. "Submitted data includes license plates, address, date of birth, phone/email, and credit card numbers." The phishing pages utilize a "waiting room" tactic where the victim's browser polls the server every two seconds and triggers redirects based on specific status codes. Roundcube Exploitation Toolkit Discovered — Hunt.io said it discovered a Roundcube exploitation toolkit on an internet-exposed directory on 203.161.50[.]145. It's worth noting that Russian threat actors like APT28, Winter Vivern, and TAG-70 have repeatedly targeted Roundcube vulnerabilities to breach Ukrainian organizations. "The directory included development and production XSS payloads, a Flask-based command-and-control server, CSS-injection tooling, operator bash history, and a Go-based implant deployed on a compromised Ukrainian web application," the company said, attributing it with medium to high confidence to APT28, citing overlaps with Operation RoundPress. The toolkit, dubbed Roundish, supports credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and two-factor authentication (2FA) secret extraction, mirroring a feature present in MDAEMON. One of the primary targets of the attack is mail.dmsu.gov[.]ua, a Roundcube webmail instance associated with Ukraine's State Migration Service (DMSU). Besides the possibility of a shared development lineage, Roundish introduces four new components not previously documented in APT28 webmail activity, including a CSS-based side-channel module, browser credential stealer, and a Go-based backdoor that provides persistence via cron, systemd, and SELinux. The CSS injection component is designed to progressively extract characters from Roundcube's document object model (DOM) without injecting any JavaScript into the victim's page. The technique is likely used for targeting Cross-Site Request Forgery (CSRF) tokens or email UIDs. Central to the Roundish toolkit is an XSS payload that's engineered to steal the victim's email address, harvest account credentials, redirect all incoming emails to a Proton Mail address, export mailbox data from the victim's Inbox and Sent folders, and gather the victim's complete address book. "The combination of hidden autofill credential harvesting, server-side mail forwarding persistence, bulk mailbox exfiltration, and browser credential theft reflects a modular approach designed for sustained access," Hunt.io said. "From a defensive perspective, password resets alone are not sufficient in cases like this. Mail forwarding rules, Sieve filters, and multi-factor authentication secrets must be audited and reset." Phishing Campaign Targeting AWS Console Credentials — An active adversary-in-the-middle (AiTM) phishing campaign is using fake security alert emails to steal AWS Console credentials, per Datadog. "The phishing kit proxies authentication to the legitimate AWS sign-in endpoint in real time, validating credentials before redirecting victims and likely capturing one-time password (OTP) codes," the company said. "This campaign does not exploit AWS vulnerabilities or abuse AWS infrastructure." Post-compromise console access has been observed within 20 minutes of credential submission. These efforts originated from Mullvad VPN infrastructure. Malicious npm Packages Deliver Cipher stealer — Two new malicious npm packages, bluelite-bot-manager and test-logsmodule-v-zisko, were found to deliver via Dropbox a Windows executable designed to siphon sensitive data, including Discord totems, credentials from Chrome, Edge, Opera, Brave, and Yandex browsers, and seed files from cryptocurrency wallet apps like Exodus. from compromised hosts using a stealer named Cipher stealer. "The stealer also uses an embedded Python script and a secondary payload downloaded from GitHub," JFrog said. GIBCRYPTO Ransomware Detailed — A new ransomware called GIBCRYPTO comes with the ability to capture keystrokes and corrupt the Master Boot Record (MBR) so that any attempt to restart the system will cause the system to run into an error. The ransomware uses the Salsa20 algorithm for encryption. It's suspected to be part of Snake Keylogger, indicating the malware authors' attempts to diversify beyond information theft. The development comes as Sygnia highlighted SafePay's OneDrive-based data exfiltration technique during a ransomware attack after breaching a victim by leveraging a FortiGate firewall flaw and a misconfigured administrative account. "SafePay gained initial access by exploiting a firewall misconfiguration, which enabled them to obtain local administrative credentials," the company said. "They rapidly escalated discovery and enumeration activities to identify high-value targets for lateral movement, demonstrating a structured and methodical approach to mapping the environment. Within a matter of hours, SafePay escalated to domain administrator access." The attack culminated in the deployment of ransomware, encrypting more than 60 servers. Fraudulent Account Registration Activity Originating from Vietnam — A sprawling cybercrime ecosystem based in Vietnam has been linked to a cluster of fraudulent account registration activity on platforms like LinkedIn, Instagram, Facebook, and TikTok. In these attacks, attributed to O-UNC-036, the threat actors rely on disposable email addresses in order to execute SMS pumping attacks, also called International Revenue Sharing Fraud (IRSF). "In this scheme, malicious actors automate the creation of puppet accounts in a targeted service provider," Okta said. "Fraudsters use these account registrations to trigger SMS messages to premium rate phone numbers and profit from charges incurred. This activity can prove costly for service providers who use SMS to verify registration information in customer accounts or to send multi-factor authentication (MFA) security codes." O-UNC-036 has also been linked to a cybercrime-as–a-service (CaaS) ecosystem that provides paid infrastructure and services to facilitate online fraud. The web-based storefronts are hosted in Vietnam and specialize in the sales of web-based accounts. Hijacked AppsFlyer SDK Distributes Crypto Clipper — The AppsFlyer Web SDK was briefly hijacked to serve malicious code to steal cryptocurrency in a supply chain attack. The clipper malware payload came with capabilities to intercept cryptocurrency wallet addresses entered on websites and replace them with attacker-controlled addresses to divert funds to the threat actor. "The AppsFlyer Web SDK was observed serving obfuscated malicious JavaScript instead of the legitimate SDK from websdk.appsflyer[.]com," Profero said. "The malicious payload appears to have been designed for stealth and compatibility, preserving legitimate SDK functionality while adding hidden browser hooks and wallet-hijacking logic." The incident has since been resolved by AppsFlyer. Operation CamelClone Targets Government and Defense Entities — A new cyber espionage campaign dubbed Operation CamelClone has targeted governments and defense entities in Algeria, Mongolia, Ukraine, and Kuwait using malicious ZIP archives that contain a Windows shortcut (LNK) file, which, when executed, delivers a JavaScript loader named HOPPINGANT. The loader then delivers additional payloads for establishing C2 and exfiltrating data to the MEGA cloud storage service. "One interesting aspect of this campaign is that the threat actor does not rely on traditional command-and-control infrastructure," Seqrite Labs said. "Instead, the payloads are hosted on a public file-sharing service, filebulldogs[.]com, while stolen data is uploaded to MEGA storage using the legitimate tool Rclone." The activity has not been attributed to any known threat group. How Threat Actors Exfiltrate Credentials Using Telegram Bots — Threat actors are abusing the Telegram Bot API to exfiltrate data via text messages or arbitrary file uploads, highlighting how legitimate services can be weaponized to evade detection. Agent Tesla Keylogger is by far the most prominent example of a malware family that uses Telegram for C2. "In general, Telegram C2s appear to be most popular among information stealers, possibly due to Telegram's technically legitimate nature and because information stealers typically only need to exfiltrate data passively rather than provide complex communications beyond simple message or file transfers," Cofense said. Microsoft Launches Copilot Health — Microsoft has become the latest company after OpenAI and Anthropic to launch a dedicated "secure space" called Copilot Health that integrates medical records, biometric data from wearables, and lab test results to give personalized advice in the U.S. "Copilot Health brings together your health records, wearable data, and health history into one place, then applies intelligence to turn them into a coherent story," the company said. Like OpenAI and Anthropic, Microsoft emphasized that Copilot Health isn't meant to replace professional medical care. Rogue AI Agents Can Work Together to Engage in Offensive Behaviors — According to a new report from artificial intelligence (AI) security company Irregular, agents can work together to hack into systems, escalate privileges, disable endpoint protection, and steal sensitive data while evading pattern-matching defenses. What's notable is that the experiment did not rely on adversarial prompting or deliberately unsafe system design. "In one case, an agent convinced another agent to carry out an offensive action, a form of inter-agent collusion that emerged with no external manipulation," Irregular said. "This scenario demonstrates two compounding risks: inter-agent persuasion can erode safety boundaries, and agents can independently develop techniques to circumvent security controls. When an agent is given access to tools or data, particularly but not exclusively shell or code access, the threat model should assume that the agent will use them, and that it will do so in unexpected and possibly malicious ways." 🔧 Cybersecurity Tools Dev Machine Guard → It is a free, open-source tool that scans your computer to show you exactly what developer tools and scripts are running. It creates a simple list of your AI coding assistants, code editor extensions, and software packages to help you find anything suspicious or outdated. It is a single script that works in seconds to give you better visibility into the security of your local coding environment. Trajan → It is an automated security tool designed to find hidden vulnerabilities in "service meshes," which are the systems that manage how different parts of a large software application talk to each other. Because these systems are complex, it is easy for engineers to make small mistakes in the settings that allow hackers to bypass security or steal data. Trajan works by scanning these configurations to spot those specific errors and helping developers fix them before they can be exploited. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion There’s a lot packed in here, and not in a neat way. Some of it is the usual recycled chaos, some of it feels a little more deliberate, and some of it has that nasty “this is going to show up everywhere by next week” energy. Anyway — enough throat-clearing. Here’s the stuff worth your attention.

L’Open Source Intelligence (OSINT) è emersa, negli ultimi anni, come una delle discipline più affascinanti, ma anche più insidiose, nel panorama dell’informazione e della sicurezza. La sua essenza è straordinariamente semplice: estrarre e analizzare dati da fonti pubbliche che si tratti di un post su X, di un bilancio depositato in Camera di Commercio, o di un articolo scientifico per trasformarli in intelligence concreta e utilizzabile. Quella che un tempo era una tecnica appannaggio esclusivo di agenzie governative, oggi è uno strumento quotidiano per investigatori, giornalisti, analisti di threat intelligence e, inevitabilmente, anche per malintenzionati. Ed è proprio questa democratizzazione che ci costringe a porci una domanda fondamentale: dove finisce la ricerca legittima e dove inizia l’illecito? L’Open Source Intelligence (OSINT) si configura come un’arma a doppio taglio nell’era digitale: un lato è l’illuminazione, l’altro è l’ombra. Se da una parte ha permesso a organizzazioni non governative e a giornalisti d’inchiesta di portare alla luce crimini di guerra o corruzioni sistemiche, dall’altra ha fornito una metodologia incredibilmente potente a chiunque voglia nuocere. L’accessibilità e l’efficacia degli strumenti attuali, spesso automatizzati e basati su algoritmi di intelligenza artificiale, amplificano esponenzialmente il dilemma originario. L’analista OSINT non è più solo un investigatore paziente che spulcia archivi cartacei o vecchi siti web, ma è un operatore che, con pochi script o tool commerciali, è in grado di mappare intere reti sociali o infrastrutture aziendali in tempi brevissimi. Il terreno su cui si muove l’OSINT è per sua natura scivoloso. La definizione stessa, “dati da fonti aperte“, suggerisce che tutto sia lecito, purché sia pubblico. Ma la realtà è molto più sfumata. In Italia, e in Europa in generale, il primo ostacolo è il GDPR. Non basta che un dato sia visibile a tutti per poterlo raccogliere, archiviare e analizzare sistematicamente. Questa rapidità e onnipotenza percepita è il cuore del problema legale, specialmente in Europa. La normativa sulla protezione dei dati, il GDPR, è stata concepita per bilanciare l’innovazione tecnologica con la tutela dei diritti fondamentali degli individui. E qui si annida la trappola per l’analista OSINT non professionale. Molti sono convinti che, se un dato è “pubblicato”, l’individuo ne abbia implicitamente acconsentito alla rielaborazione. Ma il diritto europeo non funziona così. Quando si aggregano informazioni sparse – magari unendo un nome utente di Telegram, la foto di un profilo LinkedIn e l’indirizzo di casa trovato su un vecchio registro catastale – si sta effettuando un vero e proprio trattamento di dati personali. La pubblicazione volontaria di un selfie su Instagram non è un via libera alla sua indicizzazione, archiviazione a lungo termine, e successiva associazione a informazioni sensibili tratte da altre fonti per la creazione di un “profilo di rischio”. L’aggregazione di dati è l’azione che trasforma l’OSINF in OSINT, e contemporaneamente, l’azione che più facilmente viola il GDPR. Pensiamo all’utilizzo delle e-mail e dei username recuperati. Un conto è notare che l’utente A ha lo stesso username su Twitter e su un forum di discussione tecnica. Un altro, ben diverso, è raccogliere sistematicamente migliaia di queste correlazioni, associarle a indirizzi IP, metadati e schemi di comportamento, e costruire un database ricercabile. In questo caso, l’attività sfocia in un vero e proprio trattamento su larga scala che non solo richiede una base giuridica solida (quasi sempre assente per il curioso o il freelance senza mandato), ma spesso imporrebbe anche l’obbligo di una Valutazione di Impatto sulla Protezione dei Dati (DPIA). Questo trattamento richiede una base giuridica (consenso, legittimo interesse, obbligo legale) che spesso, nel contesto di una ricerca OSINT non autorizzata, semplicemente non esiste. L’analista potrebbe agire in perfetta buona fede, convinto di non star facendo nulla di male, ma la semplice creazione di un dossier dettagliato su una persona, attingendo solo a fonti aperte, può già configurare una violazione normativa. L’analista improvvisato è quasi sempre inconsapevole di queste procedure, trasformando la sua “ricerca” in un potenziale illecito amministrativo con multe salatissime. Il confine si fa ancora più netto quando la curiosità spinge il ricercatore a “dare una sbirciatina oltre il cancello”. L’OSINT dovrebbe limitarsi alla superficie del web, senza sfondare porte. Il confine si fa ancora più spinoso sul piano penale, come accennato con l’accesso abusivo. È fondamentale sottolineare che il diritto penale, in questo contesto, non valuta l’intenzione benevola, ma il fatto oggettivo dell’intrusione. Ma in un mondo dove le protezioni a volte sono banali, la tentazione è forte. Se un analista sfrutta un bug di configurazione di un sito, o indovina una password debole per accedere a un’area riservata – anche se non protetta da sistemi di sicurezza complessi – sta commettendo un accesso abusivo a sistema informatico o telematico. Non è importante quanto sia stata facile l’intrusione, ma il fatto che non fosse autorizzata. L’utilizzo di sub-domain enumeration tools che tentano di accedere a cartelle nascoste non è OSINT; l’utilizzo di strumenti per la ricerca di credenziali esposte o database non protetti non è ricerca legittima, ma un’attività pre-offensiva che può facilmente degenerare in reato. Anche un semplice port scanning o la verifica di versioni di software esposte, se eseguiti con l’intento di trovare vulnerabilità da sfruttare, possono essere interpretati come azioni preparatorie all’accesso abusivo. Allo stesso modo, l’utilizzo aggressivo di scraper automatizzati per rastrellare milioni di record violando i Termini di Servizio di una piattaforma, o aggirando deliberate limitazioni tecniche, ci porta in una zona grigia che è a un passo dal trasformarsi in illegalità, specialmente se l’obiettivo è la successiva monetizzazione o il data mining massivo di informazioni sensibili. L’OSINT agisce sulla superficie esposta e sui dati volontariamente o inconsapevolmente lasciati pubblici, ma si ferma dove inizia la necessità di forzare o aggirare qualsiasi tipo di barriera tecnica, anche la più banale come un file robots.txt ignorato intenzionalmente. Ma i limiti della ricerca non sono soltanto giuridici. C’è un codice, spesso non scritto, che definisce l’etica dell’OSINT. Oltre la legge, persiste l’ineludibile questione etica, che funge da “norma interna” del professionista. La distinzione cruciale è tra “ciò che puoi fare” e “ciò che dovresti fare”. Pensiamo al social engineering: se un analista crea un profilo fittizio (sock puppet) per stringere amicizia virtuale con l’obiettivo e spingerlo a rivelare dettagli che altrimenti terrebbe privati, l’azione è tecnicamente legale finché non sfocia in truffa o minaccia. L’uso di profili fittizi (sock puppets), ad esempio, è spesso dibattuto. Sebbene possa non essere illegale creare un alter ego virtuale, l’atto di ingannare un individuo per stabilire un rapporto di fiducia al fine di estorcergli informazioni private viola il principio di trasparenza e minaccia la fiducia digitale generale. Tuttavia, è universalmente considerata una prassi non etica e manipolativa. Sfruttare la debolezza emotiva o la scarsa consapevolezza digitale di un individuo per estorcergli informazioni tradisce lo spirito di trasparenza su cui l’OSINT dovrebbe basarsi. Un analista etico dovrebbe sempre cercare il dato con la sua vera identità professionale o, se necessario, tramite fonti neutrali, evitando la manipolazione psicologica. Il fine ultimo dell’OSINT professionale non è raccogliere il gossip o l’informazione compromettente, ma ottenere un quadro informativo che sia accurato, verificabile e contestualizzato. Il professionista responsabile non cerca solo il dato, ma anche la sua validazione e il suo contesto. C’è un abisso tra l’OSINT (Intelligence) e l’OSINF (Information). Questa distinzione tra OSINT e OSINF è cruciale. Un analista etico sa che un’informazione decontestualizzata o non verificata può distruggere la reputazione di una persona o, in contesti geopolitici, mettere in pericolo vite. L’analista etico non si limita a trovare un tweet incendiario; verifica l’autenticità dell’account, analizza i metadati della foto, incrocia la dichiarazione con i dati geopolitici noti e valuta la sua rilevanza nel contesto investigativo. Il “martello pneumatico” dell’informazione decontestualizzata distrugge reputazioni, alimenta fake news e può persino mettere in pericolo l’incolumità fisica delle persone, in particolare in contesti di doxing o vendetta online. L’OSINT, quando ben eseguita, è un processo metodologico rigoroso che mira alla validazione e alla contestualizzazione del dato, trasformando il rumore in segnale. In sintesi, l’OSINT è uno strumento chirurgico, non un martello pneumatico. La linea rossa non è un confine fisico tracciato sulla sabbia, ma una bussola interna che guida l’analista. In definitiva, l’analista responsabile deve adottare una mentalità di minimizzazione del dato e di proporzionalità dell’azione. Deve operare con la consapevolezza che ogni ricerca, anche la più innocua, può avere ripercussioni sulla privacy e sui diritti altrui. Prima di avviare una ricerca intrusiva o di aggregare informazioni personali, deve porsi la domanda: è strettamente necessario questo livello di dettaglio per raggiungere il mio obiettivo legittimo? Se l’obiettivo è la threat intelligence difensiva (es. identificare un attacco phishing in corso), l’azione è proporzionata. Se l’obiettivo è la semplice curiosità o l’indagine su un ex-partner senza un mandato legale o una giustificazione etica cogente, l’azione è sproporzionata e abusiva. Ignorare i principi di proporzionalità, minimizzazione del dato e rispetto della legge non è solo un rischio legale: significa minare la credibilità e l’integrità dell’intera disciplina, trasformando uno strumento di conoscenza in un mezzo di sorveglianza e violazione. La legittimità dell’OSINT, quindi, non risiede solo nella legalità delle sue fonti, ma nella legittimità del suo scopo e nella riserva etica con cui lo si persegue. L’etica, in questo campo, non è un optional, ma la precondizione per la legittimità stessa del lavoro svolto. Ignorare questa bussola etica interna significa condannare l’OSINT a diventare, agli occhi della legge e della società, una forma sofisticata di sorveglianza non autorizzata. Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

A malicious campaign targeting developers through npm and GitHub repositories has been uncovered, featuring an unusual method of using Ethereum smart contracts to conceal command-and-control (C2) infrastructure. The campaign first came to light in early July when ReversingLabs researcher Karlo Zanki discovered a package named “colortoolsv2” on npm. The package was quickly removed, but attackers attempted to continue the operation by publishing a duplicate package, “mimelib2.” Both packages deployed a second-stage malware payload through blockchain infrastructure. What’s New in This Campaign While malicious npm downloaders appear regularly, these typically contain URLs or scripts embedded in the package itself. In contrast, colortoolsv2 and mimelib2 leveraged Ethereum smart contracts to store and deliver the URLs used for fetching the second-stage malware. This tactic made detection significantly harder, as the malicious infrastructure was hidden within the blockchain code rather than inside the package files. “Downloaders are [...] published weekly, [but] this use of smart contracts to load malicious commands is something we haven’t seen previously,” RL researchers said. “It highlights the fast evolution of detection evasion strategies by malicious actors who are trolling open source repositories and developers.” GitHub Repositories Disguised as Trading Tools ReversingLabs investigators also found that the npm packages were tied to a broader campaign across GitHub. Fake repositories, presented as cryptocurrency trading bots, appeared well-established with thousands of commits, multiple maintainers and active watchers. However, much of this activity was fabricated. According to ReversingLabs, stars and watchers came from accounts created in July, each with minimal activity. Additionally, Puppet accounts acted as maintainers to inflate legitimacy, and forks and commits were used to create the illusion of popularity. The most prominent example was a repository named “solana-trading-bot-v2,” which bundled the malicious npm package. Although it appeared to be a serious project, closer inspection revealed the network of fake accounts supporting it. Growing Threats to Open Source The discovery adds to a growing list of software supply chain attacks targeting crypto-focused developers. According to ReversingLabs’s 2025 Software Supply Chain Security report, there were 23 such campaigns in 2024, including a compromise of the PyPI package ultralytics in December that delivered a coin miner. These incidents highlight the evolving tactics of attackers exploiting both open-source repositories and blockchain technology. ReversingLabs researchers warned that developers must carefully vet libraries and maintainers, looking beyond surface metrics such as stars or downloads. The report concluded that vigilance and stronger package assessment tools are essential to protecting digital assets and development environments.

A threat actor has been observed “patching” a vulnerability post exploitation, likely in a bid to lock out other adversaries and secure exclusive access. The novel tactic was detected by Red Canary researchers in a cluster of activity targeting a flaw in Apache ActiveMQ, an open-source message broker, to gain persistent access on cloud-based Linux systems. The critical vulnerability, CVE-2023-46604, allows for remote code execution (RCE) in Linux systems due to inadequate validation of throwable class types in OpenWire commands. It was publicly disclosed in October 2023, with software updates issued to fix the bug. Nearly two years after disclosure, the flaw is still widely targeted for malware deployment enabling attacks ranging from ransomware to cryptomining. In a recent attack observed by Red Canary researchers, after gaining unrestricted access to a system, the threat actors downloaded two ActiveMQ JAR files, using them to replace the existing JAR files in the vulnerable version. This constitutes a legitimate patch for CVE-2023-46604. In addition to shutting out competing threat actors, the researchers believe the attacker did the fix to reduce detection via common methods such as vulnerability scanners. Additionally, the attackers reduce the likelihood of being spotted by defenders due to another adversary being detected when attempting to exploit the vulnerability. “Patching the vulnerability does not disrupt their operations as they already established other persistence mechanisms for continued access,” the Red Canary researchers noted in the August 19 report. “The patching of the vulnerability to prevent competition underscores how prevalent exploitation can be,” they added. New Downloader Targets Cloud Linux Systems After gaining initial access, the attackers were observed carrying out malicious activity on a handful of vulnerable cloud-based Linux endpoints, which included the use of a previously unknown downloader named ‘DripDropper’. Follow-on adversary command and control (C2) tools varied by endpoint, and included Sliver and Cloudflare tunnels. In one instance, after installing the Sliver implant, the threat actor modified the existing sshd configuration file to enable root login. This enabled them remote access with the highest level of privilege. sshd is the OpenSSH server process, listening to incoming connections using the protocol and handles user authentication, encryption, terminal connections, file transfers and tunneling. Under a new session started by sshd, the adversary downloaded DripDropper, an encrypted PyInstaller executable and linkable format file. It communicates with an adversary-controlled Dropbox account using a hardcoded bearer token. This communication results in the creation of two malicious files, which undertake a range of actions including process monitoring, contacting the Dropbox account for further instructions and preparing the system for additional persistent access by altering the default login shell for user accounts. Finally, a fix was applied to CVE-2023-46604 to further secure long-term access. How to Protect Webservers in Cloud-Based Linux Systems The Red Canary researchers said the targeting of sshd in the observed attack highlights the risks of vulnerable webservers in cloud-based Linux systems. They set out a series of recommendations to enhance security against such threats: Enforce policy-based controls for web services such as sshd, leveraging tools like Ansible and Puppet to automatically heal misconfigurations adversaries make quickly Configure web services to run as non-root account to minimize the potential impact from compromise Enforce mandatory authentication Patch and secure vulnerable services using CISA’s Known Exploited Vulnerabilities (KEV) catalog Restrict network exposure by configuring ingress rules to trusted IP addresses or VPNs for internal services Implement a policy of least privilege for public-facing services

Summary In September 2024, we detected malicious activity targeting financial (trading and brokerage) firms through the distribution of malicious .scr (screen saver) files disguised as financial documents via Skype messenger. The threat actor deployed a newly identified Remote Access Trojan (RAT) named GodRAT, which is based on the Gh0st RAT codebase. To evade detection, the attackers used steganography to embed shellcode within image files. This shellcode downloads GodRAT from a Command-and-Control (C2) server. GodRAT supports additional plugins. Once installed, attackers utilized the FileManager plugin to explore the victim’s systems and deployed browser password stealers to extract credentials. In addition to GodRAT, they also used AsyncRAT as a secondary implant to maintain extended access. GodRAT is very similar to the AwesomePuppet, another Gh0st RAT-based backdoor, which we reported in 2023, both in its code and distribution method. This suggests that it is probably an evolution of AwesomePuppet, which is in turn likely connected to the Winnti APT. As of this blog’s publication, the attack remains active, with the most recent detection observed on August 12, 2025. Below is a timeline of attacks based on detections of GodRAT shellcode injector executables. In addition to malicious .scr (screen saver) files, attackers also used .pif (Program Information File) files masquerading as financial documents. Technical details Malware implants Shellcode loaders We identified the use of two types of shellcode loaders, both of which execute the shellcode by injecting it into their own process. The first embeds the shellcode bytes directly into the loader binary, and the second reads the shellcode from an image file. A GodRAT shellcode injector file named “2024-08-01_2024-12-31Data.scr” (MD5 d09fd377d8566b9d7a5880649a0192b4) is an executable that XOR-decodes embedded shellcode using the following hardcoded key: “OSEDBIU#IUSBDGKJS@SIHUDVNSO*SKJBKSDS#SFDBNXFCB”. A new section is then created in the memory of an executable process, where the decoded shellcode is copied. Then the new section is mapped into the process memory and a thread is spawned to execute the shellcode. Another file, “2024-11-15_23.45.45 .scr” (MD5 e723258b75fee6fbd8095f0a2ae7e53c), serves as a self-extracting executable containing several embedded files as shown in the image below. Among these is “SDL2.dll” (MD5 512778f0de31fcce281d87f00affa4a8), which is a loader. The loader “SDL2.dll” is loaded by the legitimate executable Valve.exe (MD5 d6d6ddf71c2a46b4735c20ec16270ab6). Both the loader and Valve.exe are signed with an expired digital certificate. The certificate details are as follows: Serial Number: 084caf4df499141d404b7199aa2c2131 Issuer Common Name: DigiCert SHA2 Assured ID Code Signing CA Validity: Not Before: Friday, September 25, 2015 at 5:30:00 AM; Not After: Wednesday, October 3, 2018 at 5:30:00 PM Subject: Valve The loader “SDL2.dll” extracts shellcode bytes hidden within an image file “2024-11-15_23.45.45.jpg”. The image file represents some sort of financial details as shown below. The loader allocates memory, copies the extracted shellcode bytes, and spawns a thread to execute it. We’ve also identified similar loaders that extracted shellcode from an image file named “2024-12-10_05.59.18.18.jpg”. One such loader (MD5 58f54b88f2009864db7e7a5d1610d27d) creates a registry load point entry at “HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyStartupApp” that points to the legitimate executable Valve.exe. Shellcode functionality The shellcode begins by searching for the string “godinfo,” which is immediately followed by configuration data that is decoded using the single-byte XOR key 0x63. The decoded configuration contains the following details: C2 IP address, port, and module command line string. The shellcode connects to the C2 server and transmits the string “GETGOD.” The C2 server responds with data representing the next (second) stage of the shellcode. This second-stage shellcode includes bootstrap code, a UPX-packed GodRAT DLL and configuration data. However, after downloading the second-stage shellcode, the first stage shellcode overwrites the configuration data in the second stage with its own configuration data. A new thread is then created to execute the second-stage shellcode. The bootstrap code injects the GodRAT DLL into memory and subsequently invokes the DLL’s entry point and its exported function “run.” The entire next-stage shellcode is passed as an argument to the “run” function. GodRAT The GodRAT DLL has the internal name ONLINE.dll and exports only one method: “run”. It checks the command line parameters and performs the following operations: If the number of command line arguments is one, it copies the command line from the configuration data, which was “C:\Windows\System32\curl.exe” in the analyzed sample. Then it appends the argument “-Puppet” to the command line and creates a new process with the command line “C:\Windows\System32\curl.exe -Puppet”. The parameter “-Puppet” was used in AwesomePuppet RAT in a similar way. If this fails, GodRAT tries to create a process with the hardcoded command “%systemroot%\system2\cmd.exe -Puppet”. If successful, it suspends the process, allocates memory, and writes the shellcode buffer (passed as a parameter to the exported function “run”) to the allocated memory. A thread is then created to execute the shellcode, and the current process exits. This is done to execute GodRAT inside the curl.exe or cmd.exe process. If the number of command line arguments is greater than one, it checks if the second argument is “-Puppet.” If true, it proceeds with the RAT’s functionality; otherwise, it acts as if the number of command line arguments is one, as described in the previous case. The RAT establishes a TCP connection to the C2 server on the port from the configuration blob. It collects the following victim information: OS information, local hostname, malware process name and process ID, user account name associated with malware process, installed antivirus software and whether a capture driver is present. A capture driver is probably needed for capturing pictures, but we haven’t observed such behavior in the analyzed sample. The collected data is zlib (deflate) compressed and then appended with a 15-byte header. Afterward, it is XOR-encoded three times per byte. The final data sent to the C2 server includes a 15-byte header followed by the compressed data blob. The header consists of the following fields: magic bytes (\x74\x78\x20) , total size (compressed data size + header size), decompressed data size, and a fixed DWORD (1 for incoming data and 2 for outgoing data). The data received from the C2 is only XOR-decoded, again three times per byte. This received data includes a 15-byte header followed by the command data. The RAT can perform the following operations based on the received command data: Inject a received plugin DLL into memory and call its exported method “PluginMe”, passing the C2 hostname and port as arguments. It supports different plugins, but we only saw deployment of the FileManager plugin Close the socket and terminate the RAT process Download a file from a provided URL and launch it using the CreateProcessA API, using the default desktop (WinSta0\Default) Open a given URL using the shell command for opening Internet Explorer (e.g. “C:\Program Files\Internet Explorer\iexplore.exe” %1) Same as above but specify the default desktop (WinSta0\Default) Create the file “%AppData%\config.ini”, create a section named “config” inside this file, and, create in that section a key called “NoteName” with the string provided from the C2 as its value GodRAT FileManager plugin The FileManager plugin DLL has the internal name FILE.dll and exports a single method called PluginMe. This plugin gathers the following victim information: details about logical drives (including drive letter, drive type, total bytes, available free bytes, file system name, and volume name), the desktop path of the currently logged-on user, and whether the user is operating under the SYSTEM account. The plugin can perform the following operations based on the commands it receives: List files and folders at a specified location, collecting details like type (file or folder), name, size, and last write time Write data to an existing file at a specified offset Read data from a file at a specified offset Delete a file at a specified path Recursively delete files at a specified path Check for the existence of a specified file. If the file exists, send its size; otherwise, create a file for writing. Create a directory at a specified path Move an existing file or directory, including its children Open a specified application with its window visible using the ShellExecuteA API Open a specified application with its window hidden using the ShellExecuteA API Execute a specified command line with a hidden window using cmd.exe Search for files at a specified location, collecting absolute file paths, sizes, and last write times Stop a file search operation Execute 7zip by writing hard-coded 7zip executable bytes to “%AppData%\7z.exe” (MD5 eb8d53f9276d67afafb393a5b16e7c61) and “%AppData%\7z.dll” (MD5 e055aa2b77890647bdf5878b534fba2c), and then runs “%AppData%\7z.exe” with parameters provided by the C2. The utility is used to unzip dropped files. Second-stage payload The attackers deployed the following second-stage implants using GodRAT’s FileManager plugin: Chrome password stealer The stealer is placed at “%ALLUSERSPROFILE%\google\chrome.exe” (MD5 31385291c01bb25d635d098f91708905). It looks for Chrome database files with login data for accessed websites, including URLs and usernames used for authentication, as well as user passwords. The collected data is saved in the file “google.txt” within the module’s directory. The stealer searches for the following files: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data – an SQLite database with login and stats tables. This can be used to extract URLs and usernames used for authentication. Passwords are encrypted and not visible. %LOCALAPPDATA%\Google\Chrome\User Data\Local State – a file that contains the encryption key needed to decrypt stored passwords. MS Edge password stealer The stealer is placed at “%ALLUSERSPROFILE%\google\msedge.exe” (MD5 cdd5c08b43238c47087a5d914d61c943). The collected data is stored in the file “edge.txt” in the module’s directory. The module attempts to extract passwords using the following database and file: %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data – the “Login Data” SQLite database stores Edge logins in the “logins” table. %LOCALAPPDATA%\Microsoft\Edge\User Data\Local State – this file contains the encryption key used to decrypt saved passwords. AsyncRAT The DLL file (MD5 605f25606bb925d61ccc47f0150db674) is an injector and is placed at “%LOCALAPPDATA%\bugreport\LoggerCollector.dll” or “%ALLUSERSPROFILE%\bugreport\LoggerCollector.dll”. It verifies that the module name matches “bugreport_.exe”. The loader then XOR-decodes embedded shellcode using the key “EG9RUOFIBVODSLFJBXLSVWKJENQWBIVUKDSZADVXBWEADSXZCXBVADZXVZXZXCBWES”. After decoding, it subtracts the second key “IUDSY86BVUIQNOEWSUFHGV87QCI3WEVBRSFUKIHVJQW7E8RBUYCBQO3WEIQWEXCSSA” from each shellcode byte. A new memory section is created, the XOR-decoded shellcode is copied into it, and then the section is mapped into the current process memory. A thread is started to execute the code in this section. The shellcode is used to reflectively inject the C# AsyncRAT binary. Before injection, it patches the AMSI scanning functions (AmsiScanBuffer, AmsiScanString) and the EtwEventWrite function to bypass security checks. AsyncRAT includes an embedded certificate with the following properties: Serial Number: df:2d:51:bf:e8:ec:0c:dc:d9:9a:3e:e8:57:1b:d9 Issuer: CN = marke Validity: Not Before: Sep 4 18:59:09 2024 GMT; Not After: Dec 31 23:59:59 9999 GMT Subject: CN = marke GodRAT client source and builder We discovered the source code for the GodRAT client on a popular online malware scanner. It had been uploaded in July 2024. The file is named “GodRAT V3.5___dll.rar” (MD5 04bf56c6491c5a455efea7dbf94145f1). This archive also includes the GodRAT builder (MD5 5f7087039cb42090003cc9dbb493215e), which allows users to generate either an executable file or a DLL. If an executable is chosen, users can pick a legitimate executable name from a list (svchost.exe, cmd.exe, cscript.exe, curl.exe, wscript.exe, QQMusic.exe and QQScLauncher.exe) to inject the code into. When saving the final payload, the user can choose the file type (.exe, .com, .bat, .scr and .pif). The source code is based on Gh0st RAT, as indicated by the fact that the auto-generated UID in “GodRAT.h” file matches that of “gh0st.h”, which suggests that GodRAT was originally just a renamed version of Gh0st RAT. Conclusions The rare command line parameter “puppet,” along with code similarities to Gh0st RAT and shared artifacts such as the fingerprint header, indicate that GodRAT shares a common origin with AwesomePuppet RAT, which we described in a private report in 2023. This RAT is also based on the Gh0st RAT source code and is likely connected with Winnty APT activities. Based on these findings, we are highly confident that GodRAT is an evolution of AwesomePuppet. There are some differences, however. For example, the C2 packet of GodRAT uses the “direction” field, which was not utilized in AwesomePuppet. Old implant codebases, such as Gh0st RAT, which are nearly two decades old, continue to be used today. These are often customized and rebuilt to target a wide range of victims. These old implants are known to have been used by various threat actors for a long time, and the GodRAT discovery demonstrates that legacy codebases like Gh0st RAT can still maintain a long lifespan in the cybersecurity landscape. Indicator of Compromise File hashes cf7100bbb5ceb587f04a1f42939e24ab d09fd377d8566b9d7a5880649a0192b4 GodRAT Shellcode Injector e723258b75fee6fbd8095f0a2ae7e53c GodRAT Self Extracting Executable a6352b2c4a3e00de9e84295c8d505dad 6c12ec3795b082ec8d5e294e6a5d6d01 bb23d0e061a8535f4cb8c6d724839883 160a80a754fd14679e5a7b5fc4aed672 2750d4d40902d123a80d24f0d0acc454 441b35ee7c366d4644dca741f51eb729 318f5bf9894ac424fd4faf4ba857155e GodRAT Shellcode Injector 512778f0de31fcce281d87f00affa4a8 GodRAT Shellcode Injector 6cad01ca86e8cd5339ff1e8fff4c8558 GodRAT Shellcode Injector 58f54b88f2009864db7e7a5d1610d27d GodRAT Shellcode Injector 64dfcdd8f511f4c71d19f5a58139f2c0 GodRAT FileManager Plugin(n) 8008375eec7550d6d8e0eaf24389cf81 GodRAT 04bf56c6491c5a455efea7dbf94145f1 GodRAT source code 5f7087039cb42090003cc9dbb493215e GodRAT Builder 31385291c01bb25d635d098f91708905 Chrome Password Stealer cdd5c08b43238c47087a5d914d61c943 MSEdge Password Stealer 605f25606bb925d61ccc47f0150db674 Async RAT Injector (n) 961188d6903866496c954f03ecff2a72 Async RAT Injector 4ecd2cf02bdf19cdbc5507e85a32c657 Async RAT 17e71cd415272a6469386f95366d3b64 Async RAT File paths C:\users\[username]\downloads\2023-2024clientlist＆.scr C:\users\[username]\downloads\2024-11-15_23.45.45 .scr C:\Users\[username]\Downloads\2024-08-01_2024-12-31Data.scr C:\Users\[username]\ C:\Users\[username]\Downloads\2024-2025Top&Data.scr C:\Users\[username]\Downloads\2025TopClineData&1.scr C:\Users\[username]\Downloads\Corporate customer transaction &volume.pif C:\telegram desktop\Company self-media account application qualifications&.zip C:\Users\[username]\Downloads\个人信息资料&.pdf.pif %ALLUSERSPROFILE%\bugreport\360Safe2.exe %ALLUSERSPROFILE%\google\chrome.exe %ALLUSERSPROFILE%\google\msedge.exe %LOCALAPPDATA%\valve\valve\SDL2.dll %LOCALAPPDATA%\bugreport\LoggerCollector.dll %ALLUSERSPROFILE%\bugreport\LoggerCollector.dll %LOCALAPPDATA%\bugreport\bugreport_.exe Domains and IPs 103[.]237[.]92[.]191 GodRAT C2 118[.]99[.]3[.]33 GodRAT С2 118[.]107[.]46[.]174 GodRAT C2 154[.]91[.]183[.]174 GodRAT C2 wuwu6[.]cfd AsyncRAT C2 156[.]241[.]134[.]49 AsyncRAT C2 https://holoohg.oss-cn-hongkong.aliyuncs[.]com/HG.txt URL containing AsyncRAT C2 address bytes 47[.]238[.]124[.]68 AsyncRAT C2