securonix

Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect. The campaign has been codenamed SMOKE#SCREEN by Securonix Threat Research. "The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and an HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0[.]143:8080," researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said in a report shared with The Hacker News. Successful attacks culminate with a ScreenConnect agent installed and beaconing to one of three attacker-controlled relay servers, providing the attackers with persistent remote access to compromised systems. The activity has not been attributed to any known threat actor or group. The findings add to the growing abuse of legitimate RMM tools by threat actors, as it allows them to bypass security controls and take advantage of their prevalence in enterprise environments to blend in with authorized IT tooling without the need for deploying a purpose-built remote access trojan. Securonix said its investigation commenced following the discovery of a live WsgiDAV server that served two purposes: stage malicious payloads and maintain command-and-control (C2) over existing infected machines through a ScreenConnect relay on port 8041. An analysis of the ScreenConnect relay configuration strings embedded in the MSI and EXE payloads has uncovered three distinct C2 clusters, each associated with software update, document review, and document viewer decoy binaries. The initial access vector is assessed to be spear-phishing, with the emails serving as a conduit for an obfuscated Visual Basic Script (aka VBScript) dropper that first performs a series of environment and anti-analysis checks to ensure safe execution. It also enumerates running processes, and aborts if any of the following executables are running - Wireshark (wireshark.exe) Process Monitor (procmon.exe) Oracle VM VirtualBox (vboxservice.exe) Broadcom VMware Tools (vmtoolsd.exe) Citrix XenServer (xenservice.exe) Fiddler Classic (fiddler.exe) If the environment checks pass, the script proceeds to decrypt a PowerShell command that fetches a C# payload from "207.189.11[.]170" and executes it. Alternatively, attacks have been observed using business-themed lures to trick recipients into running a VBScript that ultimately leads to ScreenConnect installation. A third sample linked to the activity is delivered as a compressed archive, from which a batch script is run to disable Windows Antimalware Scan Interface (AMSI), escalate privileges by means of a User Account Control (UAC) prompt, turn off SmartScreen protections via Registry modifications, and then remove the Zone.Identifier alternate data stream (ADS) from the downloaded MSI file before running it. "The actor's delivery strategy has also rotated across multiple trusted hosting services," Securonix said. "An early phishing page ('zoom-update.html') delivers its payload via a Dropbox shared link, bypassing domain reputation filters since Dropbox is an allow-listed platform in most corporate environments." "A compiled .NET loader ('MemoryLoader.cs') references a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com), a service designed for temporary local server exposure that is rarely monitored. The staging server itself runs cloudflared.exe, confirming that the actor uses the Cloudflare binary directly on their infrastructure to generate these ephemeral tunnels." Irrespective of the phishing lure used, all attack paths lead to the same destination: the installation of ScreenConnect client, which connects to a configured relay server and allows the operator to open a remote desktop session with the victim's machine. "What makes this campaign particularly notable for defenders is the observable arc of the actor's tradecraft," Securonix said. "From cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction sequences and then, most recently, a pivot back to stealth with anti-EDR timing and self-contained encrypted bundles, the campaign reads like a real-time arms race between attacker and defender." To counter the threat, organizations are recommended to restrict execution of untrusted MSI files, monitor when processes attempt to tamper with security products, audit legitimate use of RMM tools, check for suspicious PowerShell and "cmd.exe" processes, and enforce strict UAC settings to prevent standard users from bypassing UAC prompts for administrative tasks. Fake Xeno Roblox Cheats Deliver Java Stealer Malware The disclosure comes as Bitdefender warned of a separate campaign in which fake Xeno Executor installers promoted via gaming forums and Discord communities are used to initiate a multi-stage Java infection chain that drops an information stealer capable of credential theft, as well as stealing browser cookies, Discord, Roblox and Minecraft accounts, cryptocurrency-wallet data and payment information. The stealer, named Powercat, can also record keystrokes, access the webcam, stream the victim's desktop, manipulate files, run PowerShell commands, and grant attackers interactive control of the infected computer. "The final payload combines information theft, surveillance, persistence, remote access, file manipulation and command execution," Bitdefender researchers Janos Gergo Szeles and Silviu Stahie said. The activity is believed to have been ongoing since the start of 2026, with a surge recorded in the second half of March. Some aspects of the campaign were previously documented by ThreatLocker in late March 2026, highlighting the threat actor's use of bogus cheats for popular PC games to distribute Powercat. The so-called cheats come in the form of archives that mimic a legitimate Xeno installation using plausible file names. Victims are instructed to run a "xeno.exe," which, instead of launching the cheat, runs the first stage of the malware. The payload checks for a Java Runtime Environment, extracts one if missing, and then reads a local file ("XenoIcon.jpg") containing the keys necessary to validate its execution with the C2 server ("solthere[.]net"). Subsequently, it launches an obfuscated JAR file disguised as "decompiler.exe," which performs environment checks, registers the victim, and downloads the final malware payload. The third stage is a Java-based stealer and surveillance malware that can harvest sensitive data, collect screenshots and webcam footage, stream the victim's desktop, and monitor keyboard and mouse activity. It can also download and upload files, execute commands through PowerShell, and open an interactive shell for hands-on-keyboard access, giving the attacker full control over the host. "Personal information theft begins with the malware gathering information about potentially interesting software installed on the victim's system," Bitdefender said. "This allows the operators to adapt their strategy and prioritize which data to steal." Targeted applications include - Web browsers (Brave Browser, Chrome, Edge, Opera, Opera GX, and Vivaldi) Cryptocurrency wallets (Atomic, Cake Wallet, Exodus, Monero Wallet, SafePal, and Tron Wallet) Software development tools (Git, JetBrains tools, Microsoft Visual Studio, and Python IDLE) Game launchers (Battle.net, Epic Games Launcher, Riot Client, Rockstar Games Launcher, and Steam) VPN (ExpressVPN, Mullvad VPN, NordVPN, and Surfshark) Messengers (Discord, Snapchat, Telegram, and WhatsApp) Roblox and Minecraft installations (Feather, Lunar, Meteor, Modrinth, Prism, and the official Minecraft launcher) To target Exodus cryptocurrency wallets, the stealer checks if Exodus version 26.1.5 is installed on the system, and, if so, unpacks the "app.asar" archive and injects JavaScript code to capture valid tokens and exfiltrate them to the C2 server. "Gaming-related lures remain effective because they exploit users' interest in gaining an advantage, accessing restricted functionality, or avoiding anti-cheat detection," Bitdefender said. "The delivered malware is considerably more capable than a typical credential stealer. Its remote-access and command-execution capabilities also mean that the compromise can continue beyond the initial theft of information, which can lead to data destruction or allow operators to use the infected system in other cyber-criminal activities."

Securonix enhances Unified Defense SIEM with AI agent detection and lower data costs Securonix has announced expanded cybersecurity cost reduction, expanded Threat Analytics for Microsoft Sentinel, and new Governed AI Agent Detection and Response capabilities. The additions extend the Securonix Unified Defense SIEM platform to help enterprises and managed security providers control data costs, improve detection coverage and response, and govern risks created by enterprise AI adoption. Security teams face three pressures at once. Telemetry volumes and SIEM costs continue to rise. Threats increasingly span identity, cloud, endpoint, application, and third-party environments. Enterprises are also deploying AI assistants, autonomous workflows, and digital workers that can access sensitive systems and act on behalf of users. Security leaders must address these pressures while preserving visibility, supporting existing technology investments, and improving outcomes without proportionally increasing staff or operational complexity. Securonix is addressing those priorities through Governed AI Agent Detection and Response for monitoring human and non-human identity risk, expanded Data Pipeline Manager licensing and the now-shipping Securonix DPM agent for greater control over security data economics, and deeper Threat Analytics for Microsoft Sentinel for enterprises, MSSPs, and MDR providers. “Security operations cannot scale by continually adding more data, more tools, and more analyst effort,” said Toby Weiss, Chief Executive Officer of Securonix. “We are giving customers better control over the data they retain, stronger detection across the platforms they already use, and clear oversight of automated activity. That gives the SOC room to grow without losing control of cost, context, or risk.” Strengthen Microsoft Sentinel without replacing it Securonix has expanded Threat Analytics for Microsoft Sentinel, a lightweight, cloud-native analytics and intelligence layer designed to improve detection quality while keeping Microsoft Sentinel at the center of the SOC. Threat Analytics applies behavior-driven analytics, industry-leading UEBA, advanced correlation, entity context, dynamic risk scoring, and continuously maintained and detection content to telemetry already available in Sentinel. Securonix analyzes the data and returns enriched, higher-confidence detections directly to Sentinel for triage, investigation, and response. Analysts continue working in their existing Sentinel workflows. Customers gain broader coverage and richer behavioral context without deploying additional endpoint agents, duplicating telemetry pipelines, building new customer-side pipelines, re-platforming the SOC, or operating a second SIEM. “Sentinel customers have already made their platform choice,” said Simon Hunt, Chief Product Officer of Securonix. “We are adding depth where it counts: behavioral context, cross-source correlation, and risk-based prioritization. Analysts stay in Sentinel, while the detections reaching them carry more evidence and a clearer reason to act.” With more than 2,400 continuously maintained out-of-the-box detections, Threat Analytics helps teams identify identity attacks, insider threats, ransomware, cloud compromise, and advanced persistent threats with greater context and confidence. For MSSPs and MDR providers, the offering creates a path to differentiated managed detection services across multi-tenant environments, with faster onboarding, delivering enhanced monitoring with out-of-the box behavior-based detections and threat modeling, and streamlining content management easily across multiple customers. Threat Analytics for Microsoft Sentinel helps providers strengthen managed detection services without disrupting customer environments, replacing Microsoft Sentinel, or introducing a disconnected analyst workflow. Detect and govern risk across enterprise AI agents Securonix is introducing new Governed AI Agent Detection and Response capabilities designed to help organizations identify and respond to abnormal or risky activity involving enterprise AI assistants, autonomous workflows, and digital workers. AI agents increasingly interact with users, identities, applications, sensitive data, tools, and business processes. Security teams need visibility into what those agents are doing, which resources they are accessing, and whether their behavior changes in ways that indicate misuse, compromise, or policy violations. Securonix applies behavioral analytics across human and non-human identities to detect abnormal agent activity, suspicious human-to-agent interactions, risky tool invocation, unusual prompt behavior, unauthorized AI adoption, and potential misuse or compromise, or policy violations. The capabilities support monitoring activity across enterprise AI environments, including Microsoft Copilot and other widely used AI assistants and developer tools. Findings preserve behavioral context; investigations remain explainable; response actions can be reviewed and audited; and human analysts retain oversight of consequential decisions. “The moment an AI agent can access a mailbox, call an API, or change a business process, its behavior belongs in the security picture,” said Hunt. “Analysts need to know what it touched, why it acted, and whether that activity fits policy. We are bringing that context into the same investigation and response process teams use every day.” Control security data costs without sacrificing visibility Securonix has expanded DPM licensing across eligible SIEM environments and is now shipping the Securonix DPM agent. Together, these capabilities give enterprises and service providers greater control over how telemetry is collected, routed, retained, and analyzed. Many security data strategies force teams to choose between managing costs and preserving visibility. Securonix helps organizations align how telemetry is handled with its operational and security value. High-priority data can support real-time analytics and detection, while other telemetry remains available for investigation, threat hunting, compliance, and long-term retrieval. Analysts retain access to the data required for investigations. Security leaders gain more predictable economics. Enterprises and MSSPs can expand coverage without discarding telemetry that may later prove critical. Securonix Data Pipeline Manager can help organizations reduce SIEM data costs by 30–50% by ensuring that only security-relevant data is processed through the Analytics Pipeline, while investigation and compliance data are routed through cost-efficient pipelines. Availability Expanded DPM licensing is available for eligible SIEM environments, and the Securonix DPM agent is now shipping. Securonix Threat Analytics for Microsoft Sentinel is available for enterprise SOCs, MSSPs, and MDR providers using Microsoft Sentinel. Governed AI Agent Detection and Response capabilities are available as part of the Securonix Unified Defense SIEM platform.

Securonix has uncovered a sophisticated multi-stage malware delivery framework that uses compromised websites and social engineering to infect users with information stealers. Dubbed Veil#Drop, the framework combines JavaScript launchers and PowerShell download cradles for the deployment and execution of malware hosted on Blogspot, Google’s trusted infrastructure. The infection chain begins with a JavaScript file posing as a document, designed to launch PowerShell code and evade execution policies. The PowerShell retrieves additional payloads from attacker-controlled Blogspot pages. The Blogspot-hosted payload displays a decoy document, terminates specific processes, and decrypts embedded content. The decoded code generates additional Blogspot URLs and executes subsequent payloads directly in memory. “A second-stage loader contains XOR-encoded .NET assemblies stored as large embedded data blobs that are reconstructed and decrypted at runtime, preventing straightforward static analysis and reducing the effectiveness of signature-based detection mechanisms,” Securonix explains. The sophisticated infection chain also contains several fallback mechanisms, abusing trusted Microsoft-signed binaries for code execution and defense evasion. “The combination of compromised websites, multi-extension masquerading, trusted cloud services, XOR-obfuscated payloads, reflective .NET loading, fileless execution, and LOLBIN abuse demonstrates a deliberate effort to evade traditional antivirus solutions, reduce forensic artifacts, and maintain operational stealth throughout the infection lifecycle,” Securonix notes. In the end, the victim’s machine is infected with PureLog Stealer, a .NET-based information stealer that performs system reconnaissance and starts harvesting data from Google Chrome. Microsoft Edge, Firefox, Brave Browser, Opera, and Chromium-based browsers. The malware targets credentials, cookies, autofill data, session tokens, browsing histories, and other sensitive information stored in the browsers. It also searches for cryptocurrency wallet information on the victim’s machine. Additionally, PureLog Stealer can harvest information from messaging applications, email clients, remote access software, FTP clients, cloud storage applications, developer tools, and password managers. The malware packages the harvested information and sends it to attacker-controlled servers in an encrypted form. Given PureLog Stealer’s extensive data harvesting capabilities, a single infected workstation could lead to broader environment compromise, depending on the credentials, tokens, keys, and other secrets stored on the system. “In enterprise environments, information stealers are frequently the first stage of larger intrusion campaigns. Stolen credentials may later be used to deploy ransomware, conduct data theft operations, perform business email compromise attacks, or facilitate long-term espionage activities,” Securonix notes. Related: Critical SimpleHelp Vulnerability Exploited for Malware Delivery Related: CryptoBandits Malware Doubles as a Backdoor, Abuses Tor Related: Rokarolla Banking Trojan Targets 200 Applications Related: Infostealers Turn Millions of Devices Into Credential Theft Machines

Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. The activity has been codenamed VEIL#DROP by Securonix. It's suspected that the initial payloads are distributed either via spear-phishing or a drive-by compromise, which occurs when an unsuspecting user lands on a website (legitimate or otherwise) under the attacker's control. "The infection chain begins with a deceptively named JavaScript file masquerading as a document (e.g., transcript.pdf.js), which executes through Windows Script Host and launches PowerShell with execution policy bypasses enabled," researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee said in a report shared with The Hacker News. At a high level, the PowerShell script is responsible for retrieving a next-stage payload hosted on Blogger ("htlwub00klocate.blogspot[.]com"), allowing the attackers to bypass reputation-based defenses by abusing Google's trusted infrastructure as a stager and to blend in with legitimate web activity. The downloaded PowerShell payload acts as a conduit for loading a benign web page like Google, creating the impression that a PDF document is opened, while the infection sequence proceeds silently in the background, ultimately leading to the deployment of PureLogs Stealer, a .NET-based infostealer known for harvesting a wide array of sensitive data from compromised hosts. Akshay Gaikwad, senior security research engineer at Securonix, told The Hacker News that PureLogs Stealer refers to the same stealer that's offered under a malware-as-a-service (MaaS) model by a threat actor known as PureCoder. It's also called PureLog. The PowerShell loader also attempts to ensure unrestricted execution of follow-up PowerShell commands, terminate selected processes such as "wscript.exe" to minimize forensic trail, delete "transcript.pdf.js" to eliminate evidence of execution, and decrypt an embedded payload. "Following successful XOR decryption, the loader transitions into one of the most evasive components of the VEIL#DROP framework: dynamic stage generation combined with runtime mutation," Securonix explained. "Rather than using static indicators such as hard-coded URLs or predictable execution patterns, the malware constructs the next-stage payload location dynamically during execution." This involves building a unique blogspot[.]com URL for each execution by inserting a random number of forward slashes ("/") to the URL string so as to bypass static URL signatures, indicator-based blocking, and URL-based filtering mechanisms. In addition, the decoded script introduces runtime mutation and polymorphism by replacing placeholder values within the script with randomly generated strings and values during execution. This variability is designed to defeat script signatures and file hashes, thereby preventing reliable detection. The reconstructed script is finally executed entirely in memory without leaving any artifacts on disk. This component functions as a loader responsible for decoding and running the core malware component, which is nothing but a .NET assembly that's launched using a technique known as reflective code loading. In the event security controls and other environmental restrictions prevent it from executing the recovered .NET assemblies directly from memory, the loader incorporates a fallback execution method that relies on Microsoft-signed binaries, such as "regsvcs.exe," "installutil.exe," "msbuild.exe," and "aspnet_compiler.exe," to accomplish the same goals without attracting any attention. Because these binaries are trusted, signed by Microsoft, and are already present on the system, the living-off-the-land (LotL) approach enables the attackers to make their activity appear legitimate and fly under the radar. "One of the most notable aspects of the loader is that it does not depend on any single LOLBin," the researchers pointed out. "Instead, execution follows a cascading model, attempting each method until one succeeds." The impact of a stealer infection typically goes beyond the initially compromised endpoint, as the harvested data can act as a stepping stone to burrow deeper into the target environment, establish persistence, perform lateral movement, and even breach its cloud infrastructure. "The combination of compromised websites, multi-extension masquerading, trusted cloud services, XOR-obfuscated payloads, reflective .NET loading, fileless execution, and LOLBIN abuse demonstrates a deliberate effort to evade traditional antivirus solutions, reduce forensic artifacts, and maintain operational stealth throughout the infection lifecycle," Securonix said.

A fileless malware framework has been abusing Google's Blogspot platform to deliver the PureLog Stealer entirely in memory, letting attackers steal credentials while leaving few traces on disk. Securonix Threat Research, which named the framework Veil#Drop, said the campaign chains together compromised websites, a booby-trapped JavaScript file and PowerShell to reach its target. PureLog Stealer is a known .NET infostealer, but the multi-stage delivery route is what sets this operation apart. A Fileless Chain Built to Evade Detection The attack begun when a victim on a compromised website opened a file masquerading as a document. Because Windows hides known extensions by default, it appeared to be a PDF, but it was actually a script that Windows Script Host runs, launching PowerShell with security checks disabled. From there, PowerShell fetched its next stages directly from attacker-controlled Blogspot pages and run them in memory, without writing any files to disk. The firm said hosting the payloads on Google-owned infrastructure let the traffic blend in with normal web activity and slip past reputation-based defenses. The later stages hid their contents behind custom XOR encoding and only decoded at runtime. The researchers said the final loader rebuilt two .NET assemblies from encoded data and loaded them straight into memory using reflection, so no executable was ever dropped for antivirus to scan. To ensure the payload run even when that path is blocked, Veil#Drop falled back on trusted Microsoft-signed binaries or LOLBINs, cycling through utilities such as RegSvcs, InstallUtil and MSBuild until one succeeded. Because these binaries are legitimate parts of the .NET framework, the activity often slipped past application-control and allowlisting rules. What PureLog Steals Once running, PureLog Stealer went beyond simple credential theft, sweeping the machine for browser passwords, cookies, autofill data, cryptocurrency wallets and details of the host itself. Securonix warned that stolen session cookies can let attackers bypass multi-factor authentication (MFA) by reusing a victim's logged-in session. "In many cases, the operators behind information-stealing malware sell harvested credentials through underground marketplaces, allowing other threat actors to purchase access to compromised accounts and environments," the company explained. Securonix also urged defenders to watch for the behavior behind Veil#Drop, such as PowerShell reaching out to Blogspot or spawning .NET utilities, rather than relying solely on static indicators.

Securonix launches AI threat research agent and ThreatWatch validation tool Securonix announced the Securonix Threat Research Agent and ThreatWatch for ThreatQ, expanding how security teams research threats, validate exposure, and turn intelligence into documented action. Built on the ThreatQ platform and connected to Securonix security operations workflows, the new capabilities help teams generate role-specific intelligence, validate emerging threats against historical telemetry, and deliver explainable findings for analysts, SOC leaders, and executives. Security teams are under growing pressure to explain what is happening, why it matters, and what actions to take next. Yet manual threat research, retroactive hunting, and disconnected workflows continue to slow response and weaken confidence. With Threat Research Agent and ThreatWatch, Securonix helps organizations answer the questions that matter most during a major threat event: does this matter to us, were we exposed, and what should we do next? The Securonix Threat Research Agent helps teams turn raw intelligence into structured, role-specific findings with source attribution and supporting evidence. By combining these capabilities with source attribution and supporting evidence, Securonix is helping teams move from data overload to decision-ready intelligence in minutes. This capability is designed to improve communication across teams, strengthen executive confidence, and can reduce manual reporting effort. ThreatWatch addresses the next operational gap: proving exposure. It monitors emerging threats curated by Securonix Threat Labs, automatically generates and executes SIEM queries, and runs retroactive sweeps across historical telemetry. Human validation is applied before escalation. Findings are surfaced through ThreatQ with direct pivots into the SIEM, giving teams documented, audit-ready answers when leaders need to know whether exposure was real. Together, Securonix and ThreatQ create a more connected intelligence-to-operations workflow. ThreatQ serves as the intelligence engine and experience layer where teams curate, investigate, and preserve context, while Securonix extends that workflow with AI-driven research, exposure validation, and operational evidence from the customer environment. The result is a more connected workflow that helps teams move faster from indicators to context, from alerts to proof, and from fragmented handoffs to more defensible action. Securonix SynQ extends the workflow into the browser. Securonix SynQ lets analysts extract, validate, enrich, and curate intelligence directly from what they are reading, including blogs, reports, GitHub pages, and PDFs, then sync that work into ThreatQ investigations and workflows while surfacing relevant Securonix evidence and historical sightings. This reduces copy-and-paste research, preserves context, and helps analysts move faster from reading about a threat to operationalizing a response. “Threat intelligence only creates value when it leads to action. What we are doing here is helping teams close the gap between knowing something matters and proving whether it matters in their own environment,” said Simon Hunt, Chief Product Officer of Securonix. “That means faster research, clearer validation, and better decisions when time and confidence both matter.” By bringing together AI-powered threat research, continuous exposure validation, and human-backed confirmation, Securonix is extending ThreatQ with capabilities built for how modern security teams work. Analysts can reduce time spent searching and correlating intelligence. SOC leaders can improve consistency and escalation quality. Executives can gain clearer, risk-aligned reporting with evidence they can explain to auditors, regulators, and the board.

An active phishing campaign has been observed targeting multiple vectors since at least April 2025 with legitimate Remote Monitoring and Management (RMM) software as a way to establish persistent remote access to compromised hosts. The activity, codenamed VENOMOUS#HELPER, has impacted over 80 organizations, most of which are in the U.S., according to Securonix. It shares overlaps with clusters previously tracked by Red Canary and Sophos, the latter of which has given it the moniker STAC6405. While it's not clear who is behind the campaign, the cybersecurity company said it aligns with a financially motivated Initial Access Broker (IAB) or a ransomware precursor operation. "In this case, a customized SimpleHelp and ScreenConnect RMMs are used to bypass defenses as they are legitimately installed by the unsuspecting victim," researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee said in a report shared with The Hacker News. Setting aside the fact that the use of legitimate RMM tools can evade detection, the deployment of both SimpleHelp and ScreenConnect indicates an attempt to create a "redundant dual-channel access architecture" that enables continued operations even when either of them is detected and blocked. It all begins with a phishing email impersonating the U.S. Social Security Administration (SSA), where the recipient is instructed to verify their email address and download a purported SSA statement by clicking on a link embedded in the message. The link points to a legitimate-but-compromised Mexican business website ("gruta.com[.]mx"), indicating a deliberate strategy to evade email spam filters. The "SSA statement" is then downloaded from a second attacker-controlled domain ("server.cubatiendaalimentos.com[.]mx"), an executable that's responsible for delivering the SimpleHelp RMM tool. It's believed that the attacker gained access to a single cPanel user account on the legitimate hosting server to stage the binary. As soon as the victim opens the JWrapper-packaged Windows executable, thinking it's a document, the malware installs itself as a Windows service with Safe Mode persistence, makes sure it's running by means of a "self-healing watchdog" that automatically restarts it when killed, and periodically enumerates registered security products using the root\SecurityCenter2 WMI namespace every 67 seconds, and polls user presence every 23 seconds. To facilitate fully interactive desktop access, the SimpleHelp remote access client acquires SeDebugPrivilege via AdjustTokenPrivileges, while "elev_win.exe" – a legitimate executable file associated with the software – is used to gain SYSTEM-level privileges. This, in turn, allows the operator to read the screen, inject keystrokes, and access user-context resources. This elevated remote access is then abused to download and install ConnectWise ScreenConnect, offering a fallback communication mechanism if the SimpleHelp channel is taken down. "The deployed SimpleHelp version (5.0.1) provides a comprehensive remote administration capability set," the researchers said. "The victim organization is left in a state where the attacker can return at any time, execute commands silently in the user’s desktop session, transfer files bidirectionally, and pivot to adjacent systems, while standard antivirus and signature-based controls see nothing but legitimately signed software from a reputable U.K. vendor."

Criminal IP partners with Securonix to integrate Criminal IP’s Threat Intelligence into ThreatQ, allowing organizations to incorporate external IP intelligence into their existing workflows, helping security teams accelerate analysis and response with more actionable context. Unlike traditional intelligence feeds, Criminal IP provides visibility into how assets and infrastructure are exposed across the internet. By embedding this data into ThreatQ, organizations can incorporate real-world context into investigations without disrupting existing processes. ThreatQ centralizes and prioritizes threat data from multiple sources. With Criminal IP integrated, organizations can enrich this data with continuously updated, exposure-based intelligence, strengthening investigation and response workflows without added complexity. Automated Intelligence Enrichment at Scale Within the integrated environment, Criminal IP’s threat intelligence APIs automatically enrich incoming IP indicators in ThreatQ with contextual data such as maliciousness scoring, VPN and proxy detection, remote access exposure, open ports, and known vulnerabilities. Powered by ThreatQ’s data-driven orchestration engine, organizations can configure automated workflows that continuously evaluate incoming indicators against Criminal IP’s threat database. This ensures that threat context remains current without requiring manual analyst effort, supporting faster triage and more consistent prioritization. Integrate Criminal IP’s exposure-based threat intelligence into ThreatQ to enrich IP indicators with real-time context. Automate analysis with maliciousness scoring, VPN/proxy detection, and infrastructure insights to accelerate investigation and response within a unified workflow. Explore Criminal IP Integration Real-Time Investigation Within a Unified Workspace The integration allows analysts to access Criminal IP intelligence directly within the ThreatQ interface, enabling real-time validation of suspicious IP activity without switching tools. By combining exposure data with infrastructure-level insights, teams can assess risk more effectively within their existing workflows. Analysts can also perform on-demand Criminal IP lookups directly from indicator detail views or investigation boards, providing immediate access to additional context during active investigations. Criminal IP further enhances ThreatQ’s investigation graph by revealing relationships between IP addresses, associated infrastructure, and attack activity, helping analysts better understand connections and patterns across threats. Intelligence-Driven Prioritization and Response By integrating Criminal IP’s intelligence into ThreatQ’s scoring framework, organizations can align risk evaluation with their specific operational environment. This enables more precise prioritization and supports more effective decision-making during investigations. Enriched data can also be visualized through dashboards, providing clearer visibility into maliciousness trends, VPN usage, and risk distribution across indicators. Expanding Visibility with Exposure Intelligence The integration highlights the growing importance of exposure-based intelligence in modern threat analysis. By continuously monitoring and analyzing internet-facing assets and IP infrastructure, Criminal IP provides differentiated visibility that extends beyond traditional indicator-based approaches. “This integration enables organizations to bring IP reputation and exposure intelligence directly into the ThreatQ platform, supporting faster analysis and more effective response throughout the investigation lifecycle,” said Byungtak Kang, CEO of Criminal IP. “By integrating our intelligence into existing workflows, security teams can improve visibility and make more informed decisions without adding operational complexity.” “This collaboration strengthens the role of IP intelligence at critical points of investigation and decision-making,” said Scott Sampson, Chief Revenue Officer, Securonix. “By combining ThreatQ’s orchestration and prioritization capabilities with Criminal IP’s real-time threat data, organizations can accelerate enrichment processes, reduce manual workloads, and focus on the most relevant threats within their environment.” Through this partnership, Criminal IP and Securonix enable security teams to operationalize threat intelligence more effectively by integrating automated enrichment, workflow orchestration, and precise prioritization within the ThreatQ platform. About Criminal IP Criminal IP is a cyber threat intelligence solution operated by AI SPERA that provides decision-ready IP address and domain reputation data to security teams worldwide. By continuously scanning the global internet, Criminal IP aggregates and contextualizes threat signals across IPs, domains, URLs, and attack infrastructure, covering malicious indicators, known vulnerabilities, exposed assets, and attacker behavior. Criminal IP's mission is to give organizations real visibility into their cyber landscape and accelerate threat detection and response by delivering the intelligence needed to outsmart attackers. For more information, visit www.criminalip.io. About Securonix Securonix is transforming security operations with the industry’s first Unified Defense SIEM with Agentic AI, built to decide and act across the threat lifecycle with a human-in-the-loop philosophy. Its cloud-native platform unifies detection, investigation, and response, while enabling Sam, the AI SOC Analyst, and a productivity-based AI operating model for the SOC, so organizations can measure and govern AI by the analyst work it delivers. Helping enterprises become Breach Ready and Board Ready, Securonix delivers accountable, outcome-driven security operations at scale. Recognized as a Leader in the Gartner® Magic Quadrant™ for SIEM and a Customers’ Choice by Gartner Peer Insights™, Securonix delivers trusted security operations for global enterprises. Learn more at www.securonix.com. Sponsored and written by Criminal IP.

An ongoing phishing campaign is targeting French-speaking corporate environments with fake resumes that lead to the deployment of cryptocurrency miners and information stealers. "The campaign uses highly obfuscated VBScript files disguised as resume/CV documents, delivered through phishing emails," Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said in a report shared with The Hacker News. "Once executed, the malware deploys a multi-purpose toolkit that combines credential theft, data exfiltration, and Monero cryptocurrency mining for maximum monetization." The activity has been codenamed FAUX#ELEVATE by the cybersecurity company. The campaign is noteworthy for the abuse of legitimate services and infrastructure, such as Dropbox for staging payloads, Moroccan WordPress sites for hosting command-and-control (C2) configuration, and mail[.]ru SMTP infrastructure for exfiltrating stolen browser credentials and desktop files. This is an example of a living-off-the-land-style attack that raises the bar on how attackers can trick defense mechanisms and sneak their way into the target's system without attracting much attention. The initial dropper file is a Visual Basic Script (VBScript) that, upon opening, displays a bogus French-language error message, fooling message recipients into thinking that the file is corrupted. However, what happens behind the scenes is that the heavily obfuscated script runs a series of checks to evade sandboxes and enters into a persistent User Account Control (UAC) loop that prompts users to run it with administrator privileges. Notably, out of the script's 224,471 lines, only 266 lines contain actual executable code. The rest of the script is filled with junk comments featuring random English sentences, inflating the size of the file to 9.7MB. "The malware also uses a domain-join gate using WMI [Windows Management Instrumentation], ensuring that payloads are only delivered on enterprise machines, and standalone home systems are excluded entirely," the researchers said. As soon as the dropper obtains administrative privileges, it wastes no time disabling security controls and covering up its tracks by configuring Microsoft Defender exclusion paths for all primary drive letters (from C to I), disabling UAC via a Windows Registry change, and deleting itself. The dropper is also responsible for fetching two separate password-protected 7-Zip archives hosted on Dropbox - gmail2.7z, which contains various executables to steal data and mine cryptocurrency gmail_ma.7z, which contains utilities for persistence and cleanup Among the tools used to facilitate credential theft is a component that leverages the ChromElevator project to extract sensitive data from Chromium-based browsers by getting around app-bound encryption (ABE) protections. Some of the other tools include - mozilla.vbs, a VBScript malware for stealing Mozilla Firefox profile and credentials walls.vbs, a VBScript payload for desktop file exfiltration mservice.exe, an XMRig cryptocurrency miner that's launched after retrieving the mining configuration from a compromised Moroccan WordPress site WinRing0x64.sys, a legitimate Windows kernel driver that's used to unlock the CPU's full mining potential RuntimeHost.exe, a persistent Trojan component that modifies Windows Firewall rules and periodically communicates with a C2 server The sole browser data is exfiltrated using two separate mail[.]ru sender accounts ("[email protected]" and "[email protected]") that share the same password over SMTP to another email address operated by the threat actor ("[email protected]"). Once credential theft and exfiltration activities are complete, the attack chain initiates an aggressive cleanup of all dropped tools in a bid to minimize forensic footprint, leaving behind only the miner and trojan artifacts./p> "The FAUX#ELEVATE campaign demonstrates a well-organized, multi-stage attack operation that combines several noteworthy techniques into a single infection chain," Securonix said. "What makes this campaign particularly dangerous for enterprise security teams is the speed of execution, the full infection chain completes in approximately 25 seconds from initial VBS execution to credential exfiltration, and the selective targeting of domain-joined machines, which ensures that every compromised host provides maximum value through corporate credential theft and persistent resource hijacking."

Cybersecurity researchers have disclosed details of a multi-stage malware campaign that uses batch scripts as a pathway to deliver various encrypted remote access trojan (RATs) payloads that correspond to XWorm, AsyncRAT, and Xeno RAT. The stealthy attack chain has been codenamed VOID#GEIST by Securonix Threat Research. At a high level, the obfuscated batch script is used to deploy a second batch script, stage a legitimate embedded Python runtime, and decrypt encrypted shellcode blobs, which are executed directly in memory by injecting them into separate instances of "explorer.exe" using a technique called Early Bird Asynchronous Procedure Call (APC) injection. "Modern malware campaigns increasingly shift from standalone executables toward complex, script-based delivery frameworks that closely mimic legitimate user activity," researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee said in a technical report shared with The Hacker News. "Rather than deploying traditional PE binaries, attackers leverage modular pipelines comprising batch scripts for orchestration, PowerShell for stealthy staging, legitimate embedded runtimes for portability, and raw shellcode executed directly in memory for persistence and control." This fileless execution mechanism minimizes disk-based detection opportunities, thereby allowing the threat actors to operate within compromised systems without triggering security alerts. What's more, the approach offers an extra advantage in that these individual stages appear harmless in isolation and resemble regular administrative activity. The starting point of the attack is a batch script that's fetched from a TryCloudflare domain and distributed via phishing emails. Once launched, it deliberately avoids taking steps to escalate privileges and leverages the permission rights of the currently logged-in user to establish an initial foothold, while blending into seemingly innocuous administrative operations. The initial stage serves as a launchpad to display a decoy PDF by launching Google Chrome in full-screen. The displayed financial document or invoice serves as a visual distraction to conceal what's happening behind the scenes. This includes launching a PowerShell command to re-execute the original batch script, such as using the -WindowStyle Hidden parameter, to avoid displaying a console window. To ensure persistence across system reboots, an auxiliary batch script is placed in the Windows user's Startup directory so that it's automatically executed every time the victim logs in to the system. The absence of more intrusive persistence methods is intentional, as it reduces the forensic footprint. "Technically, this persistence method operates entirely within the current user's privilege context. It does not modify system-wide registry keys, create scheduled tasks, or install services," the researchers said. "Instead, it relies on standard user-level startup behavior, which requires no elevation and generates minimal security friction. This design choice reduces the likelihood of triggering privilege escalation prompts or registry-monitoring alerts." The next phase begins with the malware reaching out to a TryCloudflare domain to fetch additional payloads in the form of ZIP archives that contain multiple files - runn.py, a Python-based loader script responsible for decrypting and injecting encrypted shellcode payload modules into memory new.bin, an encrypted shellcode payload corresponding to XWorm xn.bin, an encrypted shellcode payload corresponding to Xeno RAT pul.bin, an encrypted shellcode payload corresponding to AsyncRAT a.json, n.json, and p.json, key files containing the decryption keys required by the Python loader to dynamically decrypt the shellcode at runtime Once the files are extracted, the attack sequence deploys a legitimate embedded Python runtime directly from python[.]org. This step offers several advantages. For starters, it eliminates any dependency on the system. As a result, the malware can continue to operate even if the infected endpoint does have Python installed. "From the attacker's perspective, the objectives of this stage are portability, reliability, and stealth," Securonix said. "By embedding a legitimate interpreter into the staging directory, the malware transforms itself into a fully self-contained execution environment capable of decrypting and injecting payload modules without relying on external system components." The main goal of the attack is to leverage the Python runtime to launch "runn.py," which then decrypts and runs the XWorm payload using Early Bird APC injection. The malware also makes use of a legitimate Microsoft binary, "AppInstallerPythonRedirector.exe," to invoke Python and launch Xeno RAT. In the last stage, the Python loader uses the same injection mechanism to launch AsyncRAT. The infection chain culminates with the malware transmitting a minimal HTTP beacon back to attacker-controlled C2 infrastructure hosted on TryCloudflare to confirm the digital break-in. It's currently not known who the targets of the attack were, and if there have been any successful compromises. "This repeated injection pattern reinforces the modular architecture of the framework. Instead of delivering a single monolithic payload, the attacker deploys components incrementally, improving flexibility and resilience," Securonix said. "From a detection standpoint, repeated process injection into explorer.exe within short time windows is a strong behavioral indicator that correlates across stages of the attack."

Securonix shifts security operations to measurable AI-driven productivity Securonix announced Sam, the AI SOC Analyst, and the Securonix Agentic Mesh, introducing a new operating model for security operations that scales analyst productivity, governs AI in production, and delivers board-ready outcomes. At a time when security operations are overwhelmed by alert volume, analyst shortages, and rising SIEM costs, Securonix is shifting the conversation from AI features and consumption metrics to measurable work delivered. With Sam and Agentic Mesh, security leaders can now quantify how much analyst work AI completes, govern every AI-assisted action, and communicate impact in operational and business terms. Sam, the AI SOC Analyst Sam is Securonix’s AI SOC Analyst. It is a governed, always-on digital teammate that expands SOC capacity without adding headcount. Sam automates Tier 1 and Tier 2 security operations work, including alert triage, investigation, correlation, and response preparation. Sam operates natively inside the Securonix Unified Defense SIEM and coordinates specialised AI agents through the Agentic Mesh. Human analysts remain in control through built-in human-in-the-loop oversight, ensuring every action is explainable, auditable, and policy-bound. Sam represents a new unit of value in security operations. Rather than measuring AI by usage or consumption, Sam enables security leaders to measure outcomes in analyst work completed. Each Sam delivers a defined pool of analyst-equivalent productivity, operates under full policy enforcement and human oversight, and reduces alert fatigue by absorbing repetitive work at machine speed. By pricing AI based on analyst productivity rather than data volume or feature sprawl, Sam enables predictable economics and board-ready ROI narratives. Sam orchestrates specialised AI agents across noise reduction, investigation enrichment, response guidance, and reporting, presenting plain-language summaries analysts can review, validate, and act on. Sam is licensed based on verified analyst-equivalent work performed by AI, with productivity tracked transparently to quantify analyst hours saved and operational throughput gained. By absorbing repetitive Tier 1 and Tier 2 investigative work, Sam allows human analysts to focus on judgment, escalation, and high-risk decision-making without adding headcount. Agentic Mesh: Governed orchestration at scale Sam operates within the Securonix Agentic Mesh, a governed orchestration layer that coordinates specialised AI agents across detection, investigation, response, and reporting. Unlike copilots or monolithic AI assistants, Agentic Mesh is designed as a system of work, not a feature. It maintains shared context, enforces enterprise policy, and ensures that every AI-assisted action is explainable, auditable, and reversible. Built using Amazon Bedrock AgentCore, Agentic Mesh operates securely within the customer environment, providing enterprise-grade isolation, resiliency, and scale. Turning AI into governed, board-ready security operations Security leaders and boards are no longer asking whether AI is being used in the SOC. They are asking whether it is governed, measurable, and trusted in production. Sam and Agentic Mesh were designed specifically to meet this requirement. Every AI-assisted action operates under policy guardrails, enforces separation of duties, and can be reviewed, approved, or reversed by analysts. AI augments human decision-making rather than replacing it. The result is a SOC that scales responsibly, maintains regulatory confidence, and produces outcomes leaders can explain to auditors, executives, and the board. Outcome-driven data economics with DPM Flex Supporting this productivity-based AI model is Data Pipeline Manager with Flex Consumption (DPM Flex), Securonix’s outcome-driven approach to SIEM data economics. DPM Flex ensures the right data fuels AI and investigations without runaway SIEM spend by routing telemetry based on analytical value rather than raw volume. This supports predictable economics as environments scale and ensures productivity gains are not offset by rising data costs. At HDFC Bank, one of the world’s largest financial institutions, Securonix is being used to operationalise agentic AI at scale while maintaining strict regulatory oversight. “In a regulated financial environment, AI must earn trust through transparency and control,” said Sameer Ratolikar, CISO at HDFC Bank. “With Securonix, we are using AI agents to reduce noise, accelerate investigations through natural-language search, and prepare response actions, all while keeping our analysts firmly in control. The result is a more productive SOC and clearer visibility into how AI is contributing to real operational outcomes.” “We built Sam and Agentic Mesh to solve two problems CISOs face every day: unscalable workloads and unprovable AI value,” said Simon Hunt, Chief Product Officer of Securonix. “By tying AI directly to analyst productivity and governing it by design, Securonix gives security leaders a practical, defensible way to scale operations that stands up to board and regulatory scrutiny.”

Securonix�̋��В�����[���́A�X�e���X���̍����U���L�����y�[���uPHALT#BLYX�v����͂����B�U�̃u���[�X�N���[����\�����Ĉ��ӂ���R�[�h�����s������\�[�V�����G���W�j�A�����O��@��p�����������������B ���̋L���͉������ł��B����o�^�i�����j����ƑS�Ă������������܂��B �@�Z�L�����e�B�x���_�[Securonix��2025�N1��5���i�č����ԁj�A�X�e���X���i�B�����j�̍����U���L�����y�[���uPHALT#BLYX�v�Ɋւ��钲�����ʂ����\�����B���̍U���L�����y�[���ł́A�U�́uCAPTCHA�v�i�l�Ԃ�bot�ʂ��邽�߂̊m�F�e�X�g�j��AWindows�Ő[���ȏ�Q�����������ۂɕ\�������u�u���[�X�N���[���v�iBlue Screen of Death�A����BSOD�j��p����B �@CAPTCHA��u���[�X�N���[�������p���邱�ƂŐl�Ԃ̐S�����I�݂ɓ˂��A���[�U�[���g�̎�ŕs���ȑ���������A�Z�L�����e�B������蔲��������_��������B �@PHALT#BLYX�́A�z�e���\��T�C�g�uBooking.com�v�̗\��L�����Z���ʒm�������A�[�i���Ƃ�j���犴�����J�n���A�i�K�I�Ƀ}���E�F�A��W�J���鑽�w�I�ȍU����F�[����������Ă���B���̍U���ł́AMicrosoft�̐��K�r���h�������c�[���uMSBuild�v�iMicrosoft Build Engine�j�����p���A�Z�L�����e�B�\�t�g�E�F�A�ɂ�錟�m���������B�ŏI�I�ɂ́A�����[�g�A�N�Z�X��lj��̃}���E�F�A�̃_�E�����[�h�Ǝ��s���\�ȃ}���E�F�A�uDCRat�v��W�I�̃V�X�e���ɓW�J����B �@����̃L�����y�[���ł́A���[�����Ă̐����z��\�������t�B�b�V���O���[�����m�F����Ă���A���B�̑g�D���ϋɓI�ɑ_���Ă��邱�Ƃ����������B �@Securonix�̒����ɂ��ƁAPHALT#BLYX�̍U���҂͐��J���O�܂ŁA�g���q�u.hta�v�̃t�@�C����p����������@���g���Ă����B���̕��@�́AWindows�ɕW�����ڂ���Ă��鐳�K�c�[���umshta.exe�v�iHTML�A�v���P�[�V�������s�c�[���j�𗘗p���āA�����[�g�̃}���E�F�A�����s����Ƃ������̂��B��@�Ƃ��Ă̓V���v�������A������������₷�����߃Z�L�����e�B���i�ɂ���Č��m����₷�������B �@���݂ł͍U����@��MSBuild�����p��������ւƈڍs���Ă���A����͐��K�̃V�X�e���c�[���𗘗p���ĕs���ȓ�����s���uLiving off the Land�v�iLoL�j��p�ւ̐헪�I�ȓ]�����Ӗ�����B���K�̃v���Z�X�𗘗p���邽�߁A�]���̃}���E�F�A��\�t�g�E�F�A�ł͕s�R�ȋ����Ƃ��Č��m����ɂ����A����Ȃ��Ă���B �@�����́ABooking.com����̌����ʒm��͂����t�B�b�V���O���[������n�܂�B���[���ɂ́u�\��L�����Z���v�̒ʒm�ƂƂ��ɁA1004.38���[���Ƃ��������z�Ȑ����z���L�ڂ���A��M�҂̕s�����������āu�ڍׂ�\���v�{�^�����N���b�N������d�g�݂��B �@���[�U�[�������N���N���b�N����ƁA���ԃ��_�C���N�g���o�R���āulow-house�m.�ncom�v�Ƃ����h���C���ɗU�������B���̃T�C�g�́ABooking.com�̃C���^�t�F�[�X�I�ɖ͕킵���U�y�[�W�ŁA�����̃��S��z�F���I���Ɉ��p���ă��[�U�[�ɐM�������������d�g�݂ɂȂ��Ă���B �@�y�[�W��ɂ́u�ǂݍ��݂Ɏ��Ԃ��������Ă��܂��v�Ƃ����U�̃u���E�U�G���[���b�Z�[�W���\������A���[�U�[�ɑ��āu�y�[�W���X�V�v�{�^���̃N���b�N�𑣂��B�{�^�����N���b�N����ƁA�u���E�U���t���X�N���[�����[�h�ɐ�ւ��AWindows�̃u���[�X�N���[����͂����U�̌x����ʂ��\�������B �@����ɂ��A�V�X�e���ɏd��ȏ�Q�����������ƃ��[�U�[�Ɍ�M�����A�����������邽�߂̎菇�Ƃ��Ĉȉ��̑�����w������B �@���[�U�[���U�T�C�g�ɃA�N�Z�X�������_�ŁA���ӂ̂���PowerShell�R�}���h���Ђ����ɃN���b�v�{�[�h�ɃR�s�[�����B��ʏ�ł́u���̎菇�����s���Ă��������v�Ƃ������w�����\������A���[�U�[���g�ɂ��̂܂܃y�[�X�g���Ď��s������悤�U������B���[�U�[���g�̎�ł��̃R�}���h�����s�����邱�ƂŁA���������ꂽ�X�N���v�g���s���u���b�N����Z�L�����e�B��������������B �@���s���ꂽPowerShell�R�}���h�́A�o�b�N�O���E���h�Ő��K�́uMSBuild.exe�v���������A�����[�g�T�[�o����uv.proj�v�Ƃ����g���q�̃v���W�F�N�g�t�@�C�����_�E�����[�h����BMSBuild�́AXML����ŋL�q���ꂽ���̃v���W�F�N�g�t�@�C�����ɖ��ߍ��܂ꂽC#�R�[�h�������I�ɃR���p�C�����A���s���������S���B�܂�AMSBuild���v���L�V�i�㗝���s�G���W���j�Ƃ��Ĉ��p���邱�ƂŁA�U���҂͕s���ȃR�[�h�����[�U�[��PC��Ő��K�v���Z�X�̈ꕔ�Ƃ��ē��삳���邱�Ƃ��\�ɂȂ�B �@�uv.proj�v�����s�����ƁA�܂��uWindows Defender�v�̖����������݂�B��̓I�ɂ́A�uC:\ProgramData�v�f�B���N�g���S�̂��X�L�������O���X�g�ɒlj����A����Ɂu.exe�v�u.ps1�v�u.proj�v�u.tmp�v�Ƃ������g���q���Ď��Ώۂ���O���R�}���h�����s����B����ɂ��A���̌�Ƀh���b�v�����}���E�F�A�{�̂����m�����̂�h���B �@�����āA�v���Z�X�̌������m�F���A�Ǘ��Ҍ��������邩�ǂ����ɉ����Ĉȉ���2�̃V�i���I�œ��삷��B �@���A���^�C���Ď������S�ɖ�����������ŁAWindows�W���̃o�b�N�O���E���h�ʐM�p�T�[�r�X�uBITS�v�iBackground Intelligent Transfer Service�j�𗘗p���ă}���E�F�A�{�̂ł���ustaxs.exe�v���_�E�����[�h����B���̌�A���[�U�[�̃X�^�[�g�A�b�v�t�H���_�ɃV���[�g�J�b�g�t�@�C���uupdate.lnk�v���쐬���ĉi�������m�ۂ��A���������̃}�[�J�[�Ƃ��āupins.dat�v���������ށB �@�W�����[�U�[�����ł�Windows Defender�̖������Ȃǂ��ł��Ȃ����߁A�uUAC�i���[�U�[�A�J�E���g����j�X�p���v�ƌĂ��S���I�U���ɐ�ւ���B�Ǘ��Ҍ�����v������_�C�A���O���J��Ԃ��\�����A���[�U�[���u�͂��v���N���b�N����܂ŁA2�b�Ԋu�ōő�3��Ď��s����B�ς킵�����烆�[�U�[������^����̂�҂�@���B �@���́uv.proj�v�t�@�C�����ɂ́A�J���҂��c�����Ǝv����u�P���������{�p�i���s�j�v��u�T�����p�~���r�{�p �������u���~�� �x�p�r�u�����u�~�p�I�i�C���X�g�[��������Ɋ������܂����I�j�v�Ƃ������L���������̃f�o�b�O�����܂܂�Ă���A���V�A�ꌗ�̍U���҂̊֗^��������������Ă���B �@�ŏI�I�ɃV�X�e����ɔz���������s�t�@�C���ustaxs.exe�v�́A�I�[�v���\�[�X�̃����[�g�A�N�Z�X�^�}���E�F�A�uAsyncRAT�v���x�[�X�ɔh�����č��ꂽ�uDCRat�v�̃J�X�^�}�C�Y�ł��B �@���̃}���E�F�A�́A�U���҂����u������s�����߂�C2�i�R�}���h���R���g���[���j�T�[�o�ƒʐM����ۂɁA�Í��������uAES-256-CBC�v�iAdvanced Encryption Standard�A256bit�L�[����CBC���[�h�j�ƁA�L�[���o�A���S���Y���uPBKDF2�v�iPassword-Based Key Derivation Function 2�j���g�p���Ă���B����ɂ��A�ʐM���e��铽���A�Z�L�����e�B���i�ɂ���͂⌟�o��������₷���Ȃ��Ă���B �@DCRat�́A�����[�����烆�[�U�[���AOS���A���s�p�X�A�Ǘ��Ҍ����̗L���A�}���E�F�A��\�t�g�E�F�A�̃��X�g�A�A�N�e�B�u�ȃE�B���h�E�̃^�C�g���Ȃǂ����W����C2�T�[�o�ɑ��M����B�T�[�o����̃R�}���h�҂���Ԃɓ�������́A�ȉ��̋@�\�����s�ł���B �@�i���I�Ɋ�����Ԃ��ێ����邽�߂ɁA�U���҂͈�ʓI�ł͂Ȃ���@�Ƃ��āu�C���^�[�l�b�g�V���[�g�J�b�g�i.url�j�t�@�C���v�����p���Ă���B�X�^�[�g�A�b�v�t�H���_���ɁuDeleteApp.url�v�Ƃ������̂̃V���[�g�J�b�g�t�@�C�����쐬���A���������A���C���X�g�[���[�ł��邩�̂悤�Ɍ��������đ��݂��B���i������j���Ă���B �@���̃V���[�g�J�b�g�t�@�C���́ufile://�v�v���g�R�����g���āA�uC:\Windows\Temp\tybd7.exe�v�ɃR�s�[���ꂽ�}���E�F�A�{�̂��w�������悤�ɐݒ肳��Ă���AWindows�̋N�����Ɏ����I�ɂ��̃t�@�C�������s�����d�g�݂��B �@�X�e���X�������߂邽�߂Ɂu�v���Z�X���v�iProcess Hollowing�j�Z�p��p���A���K�́uaspnet_compiler.exe�v�v���Z�X���Ɉ��ӂ̂���R�[�h�𒍓����Ď��s����B�ŏI�I�ȃy�C���[�h�ł���uLbpyjxefa.dll�v�́A���x�ɓ�lj����ꂽ���w�\���ƂȂ��Ă���A�}���E�F�A��\�t�g�E�F�A�̌��m������ɂ��Ă���B �@PHALT#BLYX�L�����y�[���́A�}���E�F�A�̔z�M��@���I�������Ă��邱�Ƃ������Ă���B�\�[�V�����G���W�j�A�����O��Living off the Land�U����g�ݍ��킹�邱�ƂŁA�]���̖h���������O�ɃV�X�e���[���֑����z���B �@Securonix�́A����̋��Ђɑ��鐄�������Ƃ��āA�ȉ��̑�������Ă���B �@�g�D�́A�t�@�C���x�[�X�̌��m�����łȂ��A�v���Z�X�̐e�q�W��U�镑���ُ̈�ɏœ_�Ă����w�I�Ȗh��̐����\�z���邱�Ƃ����߂���B Copyright © ITmedia, Inc. All Rights Reserved.

Fake Booking.com emails and BSODs used to infect hospitality staff Suspected Russian attackers are targeting the hospitality sector with fake Booking.com emails and a fake “Blue Screen of Death” to deliver the DCRat malware. The malware delivery campaign starts with phishing emails that feature room charge details in euros, which means that European organizations are likely targets. But, according to Securonix researchers, the attackers’ are more than capable of adapting the campaign to target other industries. The campaign The attackers are sending out emails impersonating Booking.com: The fake Booking.com email (Source: Securonix) The “See Details” button/link in the fake reservation cancellation alert directs victims to a clone of the legitimate Booking.com site. JavaScript on the site shows a pop-up window, saying that the site is taking too long to load and urging the visitor to click on a button to refresh the page. Those who do will see their browser enter full-screen mode and be presented with a fake Windows BSOD screen instructing them to “follow recovery instructions”: The fake BSOD (Source: Securonix) The provided steps make unsuspecting users open the Windows Run dialog box and paste and execute a malicious PowerShell command. The command opens a decoy Booking.com admin page in the default browser, and secretly downloads a malicious project file (.proj) and compiles and executes it with Windows’ Microsoft Build Engine (MSBuild.exe). “Threat actors use this technique to proxy execution through a trusted Windows utility,” the researchers explained. Once the project file is executed, it tries to covertly cripple Windows Defender, so it won’t notice when DCRat is finally downloaded and executed. If the machine is run in Standard User mode, the project file will trigger repeated UAC prompts asking the user to allow it Admin privileges. If already in Admin mode, DCRat is immediately downloaded and executed, and an Internet Shortcut is created in the user’s Startup folder to ensure the malware runs automatically every time the user logs in. DCRat can log keystrokes, drop additional malicious payloads, and allows persistent remote access to infected computers. ClickFix social engineering and Living off the Land techniques Securonix researchers correlated this attack activity with previous malware delivery campaigns that relied on HTML Application (.hta) files and Windows’ Microsoft HTML Application Host (mshta.exe) utility to execute the malicious payloads via embedded URLs. “While effective in its simplicity, this earlier method was prone to detection. The ‘.hta’ and associated PowerShell scripts contained straightforward execution logic, typically a direct path to the RAT, which made them easy targets for antivirus vendors and automated security controls. The shift to the current MSBuild-based chain represents a strategic pivot towards more evasive, ‘Living off the Land’ techniques to bypass these defenses,” they explained. The many variations of the ClickFix social engineering technique have proved to be very effective at tricking users into starting infection chains and evading defensive technologies. The researchers have shared indicators of compromise and hunting queries, and are advising organizations to educate employees about the ClickFix tactic, monitor MSBuild.exe and other legitimate system binaries for unusual behavior, watch for the creation of suspicious file types in %ProgramData% and Internet Shortcut files in the Startup folder, and enable PowerShell logging. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Cybersecurity researchers have disclosed details of a new campaign dubbed PHALT#BLYX that has leveraged ClickFix-style lures to display fixes for fake blue screen of death (BSoD) errors in attacks targeting the European hospitality sector. The end goal of the multi-stage campaign is to deliver a remote access trojan known as DCRat, according to cybersecurity company Securonix. The activity was detected in late December 2025. "For initial access, the threat actors utilize a fake Booking.com reservation cancellation lure to trick victims into executing malicious PowerShell commands, which silently fetch and execute remote code," researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said. The starting point of the attack chain is a phishing email impersonating Booking.com that contains a link to a fake website (e.g., "low-house[.]com"). The messages warn recipients of unexpected reservation cancellations, urging them to click the link to confirm the cancellation. The website to which the victim is redirected masquerades as Booking.com, and serves a fake CAPTCHA page that leads them to a bogus BSoD page with "recovery instructions" to open the Windows Run dialog, paste a command, and press the Enter key. In reality, this results in the execution of a PowerShell command that ultimately deploys DCRat. Specifically, this entails a multi-step process that commences with the PowerShell dropper downloading an MSBuild project file ("v.proj") from "2fa-bns[.]com", which is then executed using "MSBuild.exe" to run an embedded payload responsible for configuring Microsoft Defender Antivirus exclusions to evade detection, setting up persistence on the host in the Startup folder, and launching the RAT malware after downloads it from the same location as the MSBuild project. It's also capable of disabling the security program altogether if found to be running with administrator privileges. If it doesn't have elevated rights, the malware enters a loop that triggers a Windows User Account Control (UAC) prompt every two seconds for three times in hopes that the victim will grant it the necessary permissions out of sheer frustration. In tandem, the PowerShell code takes steps to open the legitimate Booking.com admin page in the default browser as a distraction mechanism and to give an impression to the victim that the action was legitimate. DCRat, also called DarkCrystal RAT and a variant of AsyncRAT, is an off-the-shelf .NET trojan that can harvest sensitive information and expand its functionality by means of a plugin-based architecture. It's equipped to connect to an external server, profile the infected system, and await incoming commands from the server, enabling the attackers to log keystrokes, run arbitrary commands, and deliver additional payloads like a cryptocurrency miner. The campaign is an example of how threat actors are leveraging living-off-the-land (LotL) techniques, such as abusing trusted system binaries like "MSBuild.exe," to move the attack to the next stage, establish a deeper foothold, and maintain persistence within compromised hosts. "The phishing emails notably feature room charge details in Euros, suggesting the campaign is actively targeting European organizations," Securonix said. "The use of the Russian language within the 'v.proj' MSBuild file links this activity to Russian threat factors using DCRat." "The use of a customized MSBuild project file to proxy execution, coupled with aggressive tampering of Windows Defender exclusions, demonstrates a deep understanding of modern endpoint protection mechanisms."

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Cybersecurity researchers are calling attention to a new campaign dubbed JS#SMUGGLER that has been observed leveraging compromised websites as a distribution vector for a remote access trojan named NetSupport RAT. The attack chain, analyzed by Securonix, involves three main moving parts: An obfuscated JavaScript loader injected into a website, an HTML Application (HTA) that runs encrypted PowerShell stagers using "mshta.exe," and a PowerShell payload that's designed to download and execute the main malware. "NetSupport RAT enables full attacker control over the victim host, including remote desktop access, file operations, command execution, data theft, and proxy capabilities," researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee said. There is little evidence at this stage to tie the campaign to any known threat group or country. The activity has been found to target enterprise users through compromised websites, indicative of a broad-strokes effort. The cybersecurity company described it as a multi-stage web-based malware operation that employs hidden iframes, obfuscated loaders, and layered script execution for malware deployment and remote control. In these attacks, silent redirects embedded into the infected websites act as a conduit for a heavily scrambled JavaScript loader ("phone.js") retrieved from an external domain, which then profiles the device to determine whether to serve a full-screen iframe (when visiting from a mobile phone) or load another remote second-stage script (when visiting from a desktop). The invisible iframe is designed to direct the victim to a malicious URL. The JavaScript loader incorporates a tracking mechanism to ensure that the malicious logic is fired only once and during the first visit, thereby minimizing the chances of detection. "This device-aware branching enables attackers to tailor the infection path, hide malicious activity from certain environments, and maximize their success rate by delivering platform-appropriate payloads while avoiding unnecessary exposure," the researchers said. The remote script downloaded in the first stage of the attack lays the foundation by constructing at runtime a URL from which an HTA payload is downloaded and executed using "mshta.exe." The HTA payload is another loader for a temporary PowerShell stager, which is written to disk, decrypted, and executed directly in memory to evade detection. Furthermore, the HTA file is run stealthily by disabling all visible window elements and minimizing the application at startup. Once the decrypted payload is executed, it also takes steps to remove the PowerShell stager from disk and terminates itself to avoid leaving as much forensic trail as possible. The primary goal of the decrypted PowerShell payload is to retrieve and deploy NetSupport RAT, granting the attacker complete control over the compromised host. "The sophistication and layered evasion techniques strongly indicate an actively maintained, professional-grade malware framework," Securonix said. "Defenders should deploy strong CSP enforcement, script monitoring, PowerShell logging, mshta.exe restrictions, and behavioral analytics to detect such attacks effectively." Interestingly, the domain from which the JavaScript loader is downloaded ("boriver[.]com") has been flagged on Abuse.ch as associated with SmartApeSG (aka HANEYMANEY and ZPHP), which a history of using legitimate websites compromised with JavaScript web injects to deliver NetSupport RAT since late 2024. It's currently not clear if JS#SMUGGLER is the work of the same threat actor. Beardslee, manager of threat research at Securonix, told The Hacker News that the malware's behavior was determined from dynamic analysis on the desktop side only and that the mobile side was not emulated. "Static analysis gave us the clues and indicators as to what happens when a mobile device visits an infected site, and that's where we stopped since we don't have a mobile test-bed in our lab," Beardslee added. "This is something we would like to incorporate in the future, though." CHAMELEON#NET Delivers Formbook Malware The disclosure comes weeks after the company also detailed another multi-stage malspam campaign dubbed CHAMELEON#NET that uses phishing emails to deliver Formbook, a keylogger and information stealer. The email messages are aimed at luring victims in the National Social Security Sector into downloading a seemingly harmless archive after their credentials on a bogus webmail portal designed for this purpose. "This campaign begins with a phishing email that tricks users into downloading a .BZ2 archive, initiating a multi-stage infection chain," Sangwan said. "The initial payload is a heavily obfuscated JavaScript file that acts as a dropper, leading to the execution of a complex VB.NET loader. This loader uses advanced reflection and a custom conditional XOR cipher to decrypt and execute its final payload, the Formbook RAT, entirely in memory." Specifically, the JavaScript dropper decodes and writes to disk in the %TEMP% directory two additional JavaScript files - svchost.js, which drops a .NET loader executable dubbed DarkTortilla ("QNaZg.exe"), a crypter that's often used to distribute next-stage payloads adobe.js, which drops a file named "PHat.jar," an MSI installer package that exhibits similar behavior as "svchost.js" In this campaign, the loader is configured to decrypt and execute an embedded DLL, the Formbook malware. Persistence is achieved by adding it to the Windows startup folder to ensure that it's automatically launched upon a system reboot. Alternatively, it also manages persistence through the Windows Registry. "The threat actors combine social engineering, heavy script obfuscation, and advanced .NET evasion techniques to successfully compromise targets," Securonix said. "The use of a custom decryption routine followed by reflective loading allows the final payload to be executed in a fileless manner, significantly complicating detection and forensic analysis."

Securonix DPM Flex optimizes SIEM data management Securonix announced of Data Pipeline Manager (DPM) with DPM Flex Consumption, a breakthrough in integrated SIEM data management that expands threat visibility, increases analytical coverage, and improves compliance assurance, all within the same platform and budget. For years, cost constraints have required reduced data ingestion, diminished threat visibility and weakening security posture. Data Pipeline Manager removes this tradeoff. With Data Pipeline Manager and DPM Flex Consumption, customers can strengthen threat detection, investigation, and compliance outcomes by analyzing and retaining more data for the same investment, ensuring no signal is lost and no blind spot remains. Customers don’t have to pay for a separate DPM product, with separate procurement and console. Built directly into the Securonix platform and included at no additional cost, DPM redefines SIEM data economics by allowing customers to achieve broader analytics and investigation capacity for the same daily ingest commitment. Customers purchasing 800 GB per day of ingestion under a traditional model can now realize more than 1.1 TB per day of effective data capacity with Securonix, representing a 40% increase in visibility value that directly enhances detection reach, investigation depth, and overall security posture. “Security teams shouldn’t have to choose between threat coverage and cost,” said Kash Shaikh, President and CEO of Securonix. “With Data Pipeline Manager and DPM Flex Consumption, we’ve removed that tradeoff. Customers can now scale threat visibility, strengthen compliance, and drive stronger security outcomes within the same platform and budget.” Addressing the SIEM threat visibility tradeoff The launch comes as the industry faces what Gartner calls “SIEM cost bloat,” where rising data ingestion and storage costs have forced organizations to restrict visibility. The Gartner “3 Strategies to Trim SIEM Cost Bloat” report urges buyers to “evaluate their SIEM provider’s ability to offer flexible ingestion options that align data cost with business outcomes.” Securonix Data Pipeline Manager with DPM Flex Consumption directly answers that call. Customers can purchase a single pool of entitlements that dynamically flex across three data pipeline tiers, enabling them to manage and analyze more data within the same entitlement commitment. Analytics Pipeline Tier (1.00): Real-time threat detection and correlation Investigation Pipeline Tier (0.33): Enriched contextual data for deeper analysis Basic Pipeline Tier (0.25): Long-term, compliance-driven retention This intelligent entitlement model can increase effective data capacity by 30 to 70 percent, delivering expanded visibility, improved detection precision, and stronger overall security posture. Proven threat visibility value: Expanding coverage without expanding cost and complexity Global financial institution For large banks focused on real-time fraud detection and behavioral analytics, Securonix DPM delivers a measurable visibility boost without additional cost. By weighting data toward active analytics streams in various tiers, a bank ingesting 1.5 TB per day achieves more than 2.1 TB per day of effective visibility capacity, a 40% increase in coverage within the same spend. This expansion enables broader transaction monitoring, continuous regulatory oversight, and faster detection of insider and account-based threats. Healthcare network For healthcare organizations balancing compliance and patient data protection, Securonix DPM expands visibility without additional spend. With a balanced data mix in various tiers, a network ingesting 500 GB per day achieves nearly 860 GB per day of effective capacity, a 72% increase in total coverage. The added capacity supports continuous HIPAA monitoring, faster investigation, and richer insight into clinical and operational risks. “Healthcare data is vast, regulated, and expensive to store. Securonix DPM allowed us to tier data intelligently, keeping critical threat data hot and compliance data cost-optimized. Flex Consumption gave us the transparency to prove ROI to both our SOC and finance teams,” said Richard Henderson, Director of Cybersecurity, Alberta Health Services. Managed security service provider (MSSP) For MSSPs, profitability depends on managing data growth efficiently. With Securonix DPM, providers can reduce ingestion and storage costs by up to 48%, improving margins and billing predictability. A single entitlement pool in specific tiers, eliminates idle capacity while maintaining full tenant visibility, creating a more scalable and profitable service model. With industry’s only multi-tenant SIEM platform, DPM can be offered on a per tenant basis allowing the maximum flexibility for the MSSPs. “At our scale, visibility and cost efficiency are critical,” said José Paulo Filho, CISO at ISH Tecnologia, the largest MSSP in Latin America. “DPM Flex gives us the agility to manage massive data volumes across hundreds of customers without complexity. We can scale visibility instantly while maintaining predictable cost structures. That’s a real competitive advantage for our business and our clients.” Security posture without compromise The traditional SIEM model forces organizations to sacrifice threat visibility to manage cost, often weakening security outcomes. With DPM Flex, customers can now expand threat detection coverage, retain more telemetry, and perform deeper investigations without exceeding their budget or limiting data scope. By aligning data consumption to its value, Securonix gives enterprises the analytical reach to strengthen threat detection, maintain continuous compliance, and enhance overall security posture across every environment.

A threat actor with ties to the Democratic People's Republic of Korea (aka North Korea) has been observed leveraging the EtherHiding technique to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored hacking group has embraced the method. The activity has been attributed by Google Threat Intelligence Group (GTIG) to a threat cluster it tracks as UNC5342, which is also known as CL-STA-0240 (Palo Alto Networks Unit 42), DeceptiveDevelopment (ESET), DEV#POPPER (Securonix), Famous Chollima (CrowdStrike), Gwisin Gang (DTEX), Tenacious Pungsan (Datadog), and Void Dokkaebi (Trend Micro). The attack wave is part of a long-running campaign codenamed Contagious Interview, wherein the attackers approach potential targets on LinkedIn by posing as recruiters or hiring managers, and trick them into running malicious code under the pretext of a job assessment after shifting the conversation to Telegram or Discord. The end goal of these efforts is to gain unauthorized access to developers' machines, steal sensitive data, and siphon cryptocurrency assets – consistent with North Korea's twin pursuit of cyber espionage and financial gain. Google said it has observed UNC5342 incorporating EtherHiding – a stealthy approach that involves embedding nefarious code within a smart contract on a public blockchain like BNB Smart Chain (BSC) or Ethereum – since February 2025. In doing so, the attack turns the blockchain into a decentralized dead drop resolver that's resilient to takedown efforts. Besides resilience, EtherHiding also abuses the pseudonymous nature of blockchain transactions to make it harder to trace who has deployed the smart contract. Complicating matters further, the technique is also flexible in that it allows the attacker who is in control of the smart contract to update the malicious payload at any time (albeit costing an average of $1.37 in gas fees), thereby opening the door to a wide spectrum of threats. "This development signals an escalation in the threat landscape, as nation-state threat actors are now utilizing new techniques to distribute malware that is resistant to law enforcement take-downs and can be easily modified for new campaigns," Robert Wallace, consulting leader at Mandiant, Google Cloud, said in a statement shared with The Hacker News. The infection chain triggered following the social engineering attack is a multi-stage process that's capable of targeting Windows, macOS, and Linux systems with three different malware families - An initial downloader that manifests in the form of npm packages BeaverTail, a JavaScript stealer that's responsible for exfiltrating sensitive information, such as cryptocurrency wallets, browser extension data, and credentials JADESNOW, a JavaScript downloader that interacts with Ethereum to fetch InvisibleFerret InvisibleFerret, a JavaScript variant of the Python backdoor deployed against high-value targets to allow remote control of the compromised host, as well as long-term data theft by targeting MetaMask and Phantom wallets and credentials from password managers like 1Password In a nutshell, the attack coaxes the victim to run code that executes the initial JavaScript downloader that interacts with a malicious BSC smart contract to download JADESNOW, which subsequently queries the transaction history associated with an Ethereum address to fetch the third-stage payload, in this case the JavaScript version of InvisibleFerret. The malware also attempts to install a portable Python interpreter to execute an additional credential stealer component stored at a different Ethereum address. The findings are significant because of the threat actor's use of multiple blockchains for EtherHiding activity. Wallace told The Hacker News that they have not observed DPRK actors distribute fake installers (such as those for video conferencing software like FreeConference as has happened in the past) in conjunction with utilizing smart contracts as a stager for malicious code. "EtherHiding represents a shift toward next-generation bulletproof hosting, where the inherent features of blockchain technology are repurposed for malicious ends," Google said. "This technique underscores the continuous evolution of cyber threats as attackers adapt and leverage new technologies to their advantage."

Optimize security operations through an AWS Security Hub POC April 27, 2026: This post was first published in September 2025 when the enhanced AWS Security Hub was in public preview. It has since been updated to reflect the general availability of Security Hub. This revision also provides a more detailed, step-by-step framework for planning your POC. AWS Security Hub prioritizes your critical security issues and helps you respond at scale to protect your environment. The service sharpens findings through aggregation, correlation, and enrichment of AWS native security signals into actionable insights, enabling faster and more efficient response times. You can use these capabilities to gain visibility across your cloud environment through centralized management in a unified cloud security solution. Security Hub creates a cloud-native application protection platform (CNAPP) and through the AWS free trial, you can create a comprehensive proof of concept (POC) evaluation without significant upfront investment in time or resources. In this blog post, we guide you through planning and implementation POC for Security Hub to assess the implementation, functionality, cost estimate, and value of Security Hub in your environment. We walk you through the following steps: Understand the value of Security Hub Determine success criteria for the POC Define Security Hub configuration Prepare for deployment Enable Security Hub Validate deployment Understand the value of Security Hub Figure 1 provides a visualization of how Security Hub unifies signals from multiple AWS security services, partner solutions capabilities. The signals, which are ingested by Security Hub from multiple AWS security services and curated partner solutions include: Threats: Amazon GuardDuty findings Vulnerabilities: Amazon Inspector vulnerability findings Controls: AWS Security Hub CSPM findings Configurations: Resource inventory Network exposures: Amazon Inspector network reachability findings Sensitive data: Amazon Macie findings Extended Plan: Curated partner solutions At its core, Security Hub provides four key capabilities in one unified solution: Unified security operations: Security Hub delivers a unified security operations experience, bringing your security signals into a single consolidated view and avoiding the need to switch between multiple security tools. This provides comprehensive visibility across your entire estate, including AWS, multi-cloud, and on-premises, so your security teams can efficiently detect, prioritize, and respond to potential security risks. Intelligent prioritization helps focus on what matters most: Security Hub helps you identify and prioritize critical security risks that might be missed when viewing findings in isolation. Security findings are correlated by analyzing resource relationships and signals from AWS security services and capabilities. Actionable insights guide security teams on next steps: Gain actionable insights through advanced analytics to transform correlated findings into clear, prioritized insights that highlight the most critical security risks in your environment. You can quickly understand potential impacts, visualize relationships, and identify which security issues pose the greatest risk to critical resources. Streamlined security response and automation capabilities: Security Hub enhances your security operations by enabling streamlined response capabilities. It seamlessly integrates with your existing ticketing systems to help facilitate efficient incident management. With this integrated approach your security team can: Investigate critical risks that need immediate attention from a single pane of glass Monitor security trends and attack surface across your environments Fix what really matters across the entire attack chain and path Automate responses to streamline remediation Understand the Open Cybersecurity Schema Framework Security Hub uses the Open Cybersecurity Schema Framework (OCSF) to help standardize security data and analysis and enable better integration between security tools. This standardization helps simplify how security findings are structured and analyzed across your environment. This standardized data model enables seamless integration and data exchange across your security tooling, providing normalized and consistent data formats. When implementing your Security Hub POC, make sure that you’re familiar with the OCSF specifications Security Hub uses. Additionally, confirm that any analytics or security information and event management (SIEM) tools you plan to integrate with support the OCSF data format to maximize the value of the consolidated security insights provided by Security Hub. Determine success criteria Establishing success criteria helps benchmark the outcomes of the POC with the goals of the business. Some example criteria and key performance indicators (KPI) include: Alert consolidation metrics: Determine what resources you’re currently using to correlate security events and signals to understand their relationship. Review the process and note if it’s completed outside of AWS or through a SIEM. By setting a benchmark to reduce correlation overhead you can significantly improve efficiency and accelerate security investigations and posture improvement. Response time improvements: Reducing your time to detect, investigate, and resolve security events and improve security posture is essential to streamlined security operations. Security Hub provides visualizations for potential attack paths that adversaries could use to exploit resources and helps assess the potential blast radius. - Reduced mean time to detect (MTTD) security incidents. - Reduced mean time to response (MTTR) for critical findings. - Reduced time to identify potentially affected resources in blast radius. - Increased accuracy of attack path analysis. - Number of controls implemented based on attack path insights (post investigation). Automation capabilities: Having response playbooks as part of your incident management and response plan helps ensure comprehensive investigations lead to improved security posture. Review your automation capabilities to see if portions of or entire playbooks can be automated. - Potentially increased percentage of security findings automatically routed to the correct teams by using Jira Cloud, ServiceNow, or a third-party tool. - Reduced average time from detection to ticket creation. Severity and risk classification: Review your organization’s inventory of assets to determine if it’s complete and if you can use telemetry to determine the severity level and associated risks. - Reduced time to identify critical resources and service coverage gaps affected by new vulnerabilities, threats, and misconfigurations. - Faster and more accurate severity label and risk calculation of findings. - Reduced time to identify service gap coverage. After establishing your success criteria, it’s essential to evaluate organizational readiness and potential constraints that might impact your POC implementation. Begin by conducting a comprehensive assessment of your current environment: Determine if the foundational security services (GuardDuty, Amazon Inspector, Security Hub CSPM, and Macie) are enabled across your accounts, and identify your critical workloads and if there are any excessive attack surfaces. Review your success criteria to make sure that your goals are realistic given your timeframe and potential constraints that are specific to your organization. For example: Do you have full control over the configuration of AWS services that are deployed in an organization? Do you have resources that can dedicate time to implement and test? Is this time convenient for relevant stakeholders to evaluate the service? Maximize your POC value through service activation To get the most comprehensive evaluation of the capabilities of Security Hub, coordinate the activation of underlying security services to optimize the overlapping trial periods available at no additional cost. The following is a list of the underlying security services, and their free trial length: Security Hub: 30-day trial (essential plan capabilities) GuardDuty: 30-day trial (covers most protection plans except GuardDuty Malware Protection) Security Hub CSPM: 30-day trial Macie: 30-day trial Amazon Inspector: 15-day trial Consider enabling these services simultaneously so that you have at least two weeks of overlapping coverage to evaluate the full correlation and risk prioritization capabilities of Security Hub across each service. Optionally, if you want to conduct a POC with minimal configuration because of limitations, you can enable only Security Hub CSPM and Amazon Inspector during the initial POC phase to properly assess the results and data. Note: Document your activation dates and trial expiration dates carefully. Create calendar reminders for trial end dates and schedule your key POC evaluation milestones to occur while services are active. This will help make sure that you can thoroughly assess the unified security operations capabilities of Security Hub when services are running at full capacity. If you already have one or more of these underlying services enabled, you can proceed to enable the new Security Hub. To fully use the new Security Hub capabilities, particularly the exposure findings feature, specific service dependencies must be met, both Security Hub CSPM and Amazon Inspector are essential because they provide the telemetry needed for the Security Hub correlation engine and exposure findings. The combination enables Security Hub to deliver comprehensive risk analysis and prioritization by correlating configuration risks with runtime vulnerabilities. If you have other security services already enabled (such as GuardDuty or Macie), you can maintain these existing services while enabling Security Hub, and it will automatically begin incorporating their findings into its consolidated view, enhancing your overall security posture visualization. Define your Security Hub configuration After your success criteria have been established, you’re ready to plan your configuration. Some important decisions include: Select a delegated administrator: From the AWS Organizations management account, you can set a delegated administrator for your organization. As a best practice, we recommend using the same delegated administrator across security services for consistent governance and according to our AWS Security Reference Architecture (AWS SRA). Select accounts in scope: Define accounts you want to have Security Hub enabled for. Define AWS Regions: Determine Regional restrictions or considerations. Determine AWS service integrations: In addition to the core security capabilities of posture management and vulnerability management, Security Hub integrates signals from other AWS security services such as GuardDuty and Macie. Define third-party integrations: - For ticketing, Security Hub integrates with popular service management systems such as Atlassian’s Jira Service Management Cloud and ServiceNow. - Partners who already support or intend to support the OCSF schema to receive findings from Security Hub include companies such as Arctic Wolf, CrowdStrike, DataBee, Datadog, DTEX Systems, Dynatrace, Fortinet, IBM, Netskope, Orca Security, Palo Alto Neworks, Rapid7, Securonix, SentinelOne, Sophos, Splunk, Sumo Logic, Tines, Trellix, Wiz, and Zscaler. - Service partners such as Accenture, Caylent, Deloitte, IBM, and Optiv can help you adopt Security Hub and the OCSF schema. Use the Security Hub cost estimator: Use the Security Hub Cost Estimation Tool for a pre-enablement cost estimate based on your current spend on Amazon Inspector, Security Hub CSPM, and GuardDuty. Prepare for deployment After determining your success criteria and Security Hub configuration, identify stakeholders, desired state, and timeframe. Prepare for deployment by completing: Project plan and timeline: Develop a project plan with defined success criteria, scope boundaries, key milestones, and realistic implementation timelines. Suggested timeline of events: - Before enablement: - Validate core security service configuration for GuardDuty, Amazon Inspector, Security Hub CSPM, and Macie - Request approvals for free trial from appropriate stakeholders - Day 0 – Enable the service, become comfortable with the Security Hub layout and begin training security personnel - Week 1 – Validate desired coverage of threat detection, vulnerability management, and posture management across accounts and Regions - Week 2 – Connect to IT service management (ITSM) tools and begin creating automations for critical workloads and resources - Week 3 – Execute a tabletop exercise in response to a selected exposure finding - Week 4 – Analyze trends of threats and exposures from day 1 through week 4 Before enablement: Identify stakeholders: Identify CISO, information security teams, SOC personnel, incident response teams, security engineers, finance, legal, compliance, external MSSPs, and business unit representatives. Develop a RACI matric: Create a detailed RACI chart defining roles and responsibilities across the incident response lifecycle, facilitating accountability and proper communication channels. Configure management account access: Secure authorization to delegate administrative access. For more information, see Permissions required to designate a delegated Security Hub administrator account. Set up IAM roles and permissions: Use AWS Identity and Access Management (IAM) roles to implement role-based access controls aligned with the RACI chart, including case management, escalation, and read-only roles using AWS managed policies. For more information, see AWS Managed Policies Enable Security Hub AWS security services integrate with AWS Organizations to help you centrally manage Security Hub. If you haven’t already done so, enable Security Hub CSPM and Amazon Inspector at a minimum. Also enable any other AWS security services that you want to integrate with Security Hub. Enable Security Hub for your organization from the organization management account. If setting a delegated administrator for Security Hub, see Setting a delegated administrator account in Security Hub from the management account. Note: As a best practice, we recommend using the same delegated administrator across security services for consistent governance. Sign in to the delegated administrator with an IAM policy that gives you permission to enable and disable member accounts. With this policy, you will have granular control to decide what Regions you want enabled. Configure Security Hub plans for deployment. Security Hub comes with the Essentials, Threat Analytics, and Extended plans. Configure third-party integrations to create incidents or issues for Security Hub findings. Note: After you enable Security Hub, exposure findings in your environment are created and analyzed immediately. However, it can take up to 6 hours to receive an exposure finding for a resource. Validate deployment The final step is to confirm that Security Hub is configured correctly and to evaluate the solution against your success criteria. Validate policy: Verify that you have the correct permissions to manage member accounts and Regional restrictions are configured correctly. Validate integrations: Verify that tickets with ServiceNow or Jira Cloud are working correctly by signing in to the AWS Management Console for Security hub and choosing Inventory in the navigation pane. Select Findings and verify there is a ticket ID in your finding. Assess success criteria: Determine if you achieved the success criteria that you defined at the beginning of the project. Conclusion In this post, we showed you how to plan and implement an effective Security Hub POC. You learned how to do so through phases, including defining success criteria, configuring Security Hub, and validating that Security Hub meets your business needs. Take advantage of the trial periods to maximize your testing window without incurring significant costs. Throughout the POC, maintain focus on your predefined success criteria while remaining open to unexpected benefits or challenges that might arise. Maintain open communication with your AWS account team to address any questions or concerns to help you get the most out of your Security Hub POC experience. Additional resources AWS Security Hub User Guide How to prioritize security risks using AWS Security Hub How to onboard to AWS Security Hub Streamline security response at scale with AWS Security Hub automation If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.