winscp

Cybersecurity researchers have disclosed details of a financially motivated data theft extortion campaign that has targeted dozens of organizations across professional, legal, and financial services in the U.S. between January and May 2026. The activity has been attributed by Google Mandiant and Google Threat Intelligence Group (GTIG) to a threat actor dubbed UNC3753, which is also known as Chatty Spider, Luna Moth, and Silent Ransom Group (SRG). "UNC3753 leverages voice phishing (vishing) and social engineering deception techniques to achieve remote access into corporate environments," researchers Chad Reams, Tufail Ahmed, Keith Knapp, Ashley Frazer, and Tyler McLellan said. "Using pretexts such as data migration or invoice-related emails, the threat actors initiate phone conversations posing as IT support and convince targets to host screen-sharing sessions and download remote monitoring and management (RMM) utilities." Upon gaining access, the threat actors have been found to either carry out direct searches to locate and exfiltrate files of interest or deceive the victim into carrying out the actions on their behalf. Stolen information includes proprietary legal agreements, personally identifiable information (PII), and financial records. In some instances, the attackers have accessed victims' systems in person, echoing an advisory issued by the U.S. Federal Bureau of Investigation (FBI) last month. These physical intrusions involve the threat actors posing as IT technicians to enter corporate offices and attempt to steal data using removable USB media. "By sending someone in-person to the victim's location to facilitate the intrusion, SRG actors exfiltrate data to an external hard drive or USB drive inserted by the threat actor into the victim's computer," the FBI said of the new escalation in UNC3753's capabilities. Google said UNC3753 shares tactical overlaps with UNC2686, a threat cluster previously known for carrying out BazarCall-style campaigns in 2021. Although the group has been observed deploying LockBit Black ransomware in the past, it has mainly focused on extortion-only operations since 2022, pressuring victims to pay up or risk getting their data published on the LEAKEDDATA data leak site. Both UNC3753 and UNC2686 are assessed to be offshoots of the now-defunct Conti ransomware gang, with early iterations of the campaigns using subscription cancellation lures as part of callback phishing attacks that aim to install remote access software on victims' machines. Beginning around March 2025, the hacking crew has impersonated internal corporate IT help desk staff to trick victims into joining a screen-sharing session on enterprise communication platforms like Zoom, Microsoft Teams, or Quick Assist under the guise of addressing a security issue helping with a corporate data migration project, effectively bypassing traditional security controls. "The threat group frequently initializes campaigns using benign, invoice-themed email lures sent from actor-controlled consumer email accounts," Google said. "These messages contain no active links or malicious attachments. Instead, they typically contain a brief, generic message. The primary purpose of these emails is to establish a pretext, raising the target's internal security concerns so they are more susceptible to follow-up voice calls." Once a session is established, the attackers attempt to establish a persistent foothold by guiding the victims to install legitimate remote desktop software like AnyDesk, Bomgar, SuperOps RMM, or Zoho Assist. Instructions to install these programs are shared via a legitimate service called "privnote[.]com," which allows users to send notes that self-destruct after being read by the recipient. UNC3753 has also been observed establishing Zoom sessions directly on targets' personal laptops to access corporate virtual desktop infrastructure (VDI) and burrow deeper into corporate file systems with the goal of enumerating local and cloud directories, crawling mapped network drives, and harvesting data from highly sensitive folders, including those related to tax filings, audits, corporate client agreements, and Social Security numbers (SSNs). In the final stage, the captured data is sent to the threat actors via WinSCP or Rclone, or to email addresses controlled by the threat actor from the target's mailbox. This is followed by the attackers sending an extortion demand in the form of an email message, typically within 30 minutes of exiting the target environment. The email messages give victims a three-day deadline to initiate ransom negotiations. They also threaten to call and email target employees and external clients directly to notify them of the data breach should they remain unresponsive, not to mention publish the entire stolen information on the data leak site. In many incidents investigated by Google's threat intelligence and incident response teams, the end-to-end operation from initial contact to data extortion is said to have occurred within a single business day. The fast-tempo operational model is exemplified by the fact that the attackers initiate data searches, staging, and theft in under an hour. "Legal services firms represent high-value targets for extortion actors. They maintain concentrated repositories of extremely sensitive client transaction files, merger and acquisition plans, client trade secrets, and corporate regulatory reports," Google said. "Threat groups recognize that legal entities are subject to heavy reputational and regulatory exposure and may be highly motivated to resolve extortion situations quietly to protect their professional standing. Threat actors recognize that targeting the human element - specifically using voice-guided social engineering-enables them to easily bypass robust technical perimeters, web security gateways, and MFA configurations." The findings coincide with a new report from Resecurity about the threat actor's use of DNS Fast Flux network infrastructure across various countries in Latin America, Eastern Europe, Central Asia, Middle East/Africa, East Asia, and the Caribbean to make its domains harder to block - business-data-leaks[.]com, the data leak site that lists close to 100 victim organizations as of June 2026 ep6pheij[.]com, which stages the stolen data per victim "By changing the DNS records and using short Time-To-Live (TTL) values, attackers make their malicious infrastructure resilient against takedowns," the cybersecurity company said. "Both domains operate on a fast-flux network backed by a botnet spread across 18 countries and 22 ISPs. The two domains share 50-60% of their bot pool, confirming a single threat actor operates both. The infrastructure contains zero datacenter or hosting IPs - every node traces back to a consumer ISP (e.g., Telecentro, Mega Cable, Vodafone) and is flagged as residential or mobile IP address."

The Silent Ransom Group extortion gang is actively targeting U.S. law firms and professional services organizations in social engineering attacks that often lead to data theft within hours of initial contact, according to a new report by cybersecurity firm Mandiant. The report follows an FBI FLASH advisory published last week warning that the Silent Ransom Group was targeting U.S. law firms in social engineering and even in-person data theft attacks, with Mandiant now providing additional technical details about how the intrusions are conducted. Mandiant says the threat group, tracked as UNC3753, Luna Moth, and Chatty Spider, targeted dozens of organizations across the legal, financial, and professional services sectors between January and May 2026. Mandiant warned that legal firms remain especially attractive targets because they store large volumes of highly sensitive client information and may feel pressured to resolve extortion incidents to avoid reputational and regulatory damage. "Legal services firms represent high-value targets for extortion actors. They maintain concentrated repositories of extremely sensitive client transaction files, merger and acquisition plans, client trade secrets, and corporate regulatory reports," explains Mandiant. "Threat groups recognize that legal entities are subject to heavy reputational and regulatory exposure and may be highly motivated to resolve extortion situations quietly to protect their professional standing." The researchers say the attacks begin with invoice-themed phishing emails from consumer email accounts. These emails do not contain malicious links or attachments and instead serve as a precursor for follow-up phone calls from attackers impersonating corporate IT staff. Conducting attacks via voice calls has been an ongoing tactic by these threat actors for years, which they previously used in BazarCall social engineering campaigns tied to Ryuk and Conti ransomware attacks. A callback phishing attack is when threat actors send benign-looking phishing emails containing alarming or IT-related lures that prompt the recipient to call them back at an enclosed phone number. In the current campaign, the Silent Ransom Group impersonates IT help desks and convinces employees to join remote support sessions via Microsoft Teams, Zoom, Quick Assist, or Microsoft Terminal Services. During these sessions, the threat actors trick the target into installing remote monitoring and management tools such as AnyDesk, Zoho Assist, Bomgar, or SuperOps, thereby granting them initial access to the corporate network. Mandiant also discovered phishing domains tied to the campaign that impersonate internal IT portals using naming patterns such as: -itdesk[.]com -it[.]com -helpdesk[.]com The researchers say the threat actors also use privnote[.]com, a self-destructing messaging service, to share installation links and commands with targets during remote support sessions. According to Mandiant, this tactic helps reduce forensic artifacts left in browser histories or corporate chat logs. Once inside a network, the group searches for sensitive legal and financial documents, including contracts, tax records, Social Security numbers, and merger or acquisition files. The attackers commonly target document management platforms and cloud storage repositories before exfiltrating the data using tools such as WinSCP or Rclone. Mandiant says the extortion operation is highly aggressive, with ransom demands often arriving within 30 minutes of the attackers leaving the victim environment. "These highly aggressive extortion letters give organizations a three-day deadline to respond and initiate ransom negotiations. If the victim organization is unresponsive, the threat actors declare they will call and email target employees and external clients directly to alert them of the data breach," reports Mandiant. "The extortion letters explicitly emphasize that the leak will compromise client trust, invite substantial regulatory fines, and suggest that external clients sue the victim organization for data mishandling." The report also references the FBI's recent advisory in which law enforcement warned that the Silent Ransom Group was targeting U.S. law firms with in-person data theft attacks. According to the FBI, attackers impersonate internal IT staff over phone calls and emails, then attempt to gain remote access or physically visit offices to "image" computers or create backups while secretly stealing files. While Mandiant said there was limited forensic evidence, the researchers believe these in-person attacks are likely linked to UNC3753 based on similarities in targeting, timelines, and operational behavior. The Silent Ransom Group has been active since at least 2022, when it was part of the Ryuk and Conti cybercrime syndicate. As previously reported by BleepingComputer, the threat actors were previously linked to BazarCall callback phishing campaigns that provided initial access in Conti and Ryuk ransomware attacks. After the Conti syndicate shut down in 2022, the group shifted to standalone data theft and extortion operations under the Silent Ransom Group branding. Researchers say the group no longer relies on traditional ransomware encryption and instead focuses entirely on data-theft extortion, in which they steal sensitive data and pressure victims into paying to prevent leaks. A separate report released this week by Resecurity found that the gang is also operating fast-flux infrastructure to hide and protect its data-leak platforms. DNS fast flux is a method where attackers constantly rotate a domain's IP addresses through a large pool of compromised devices to hide their infrastructure and make takedowns or blocking far more difficult. According to the company, the infrastructure uses residential IP addresses across multiple countries and ISPs to make takedowns more difficult. Resecurity said the group's "business-data-leaks[.]com" leak site and related infrastructure rely on residential proxy networks spread across Latin America, Eastern Europe, Central Asia, the Middle East, and Asia. The researchers also linked the infrastructure to other cybercrime-related services and domains. To defend against the attacks, both Mandiant and the FBI recommend implementing strict verification procedures for IT support interactions, limiting remote access tools, enforcing MFA, restricting USB storage devices, and training employees to recognize voice phishing attempts. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Since at least 2020, we have observed a cluster of activity targeting high-value organizations across South, Southeast and East Asia. The attacks focus on critical sectors such as aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications. Unit 42 is tracking this ongoing, previously undocumented activity as CL-UNK-1068. We designate the term UNK to clusters of activity whose affiliation with either nation-state or cybercrime activity we have not yet determined. We assess with high confidence that the attackers behind CL-UNK-1068 are a Chinese threat actor. This assessment is based on the origin of their tools, linguistic artifacts in configuration files, and their consistent, longstanding targeting of critical infrastructure in Asia. We assess with moderate-to-high confidence that the primary objective of the attackers is cyberespionage, although we cannot fully rule out the possibility of cybercriminal motivation at this time. Through a long period of close observation, we identified the specific tools and techniques that define this group. Our attribution of this activity to CL-UNK-1068 is done in accordance with Unit 42’s attribution framework. We provide a detailed analysis of the attack patterns and methods that we identified in our investigation into this cluster of activity. Palo Alto Networks customers are better protected from the threats described through the following products and services: Advanced URL Filtering and Advanced DNS Security Next-Generation Firewall (NGFW) with Advanced Threat Prevention Advanced WildFire Cortex XDR and XSIAM If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. We provide a detailed analysis of the tool set deployed by the attackers behind CL-UNK-1068 across different intrusion campaigns since 2020. While these attacks demonstrate a consistent set of techniques and procedures (TTPs), it is important to note that not every tool was used in every observed intrusion. Our analysis reveals a multi-faceted tool set that includes custom malware, modified open-source utilities and living-off-the-land binaries (LOLBINs). These provide a simple, effective way for the attackers to maintain a persistent presence within targeted environments. The CL-UNK-1068 activity cluster is characterized by cross-platform cyber capabilities, maintaining a diverse set of tools for both Windows and Linux environments. Their TTPs rely heavily on open-source utilities and malware variants popular with Chinese-speaking users, including GodZilla, AntSword, Xnote and Fast Reverse Proxy (FRP). One of the techniques we observed in these attacks is the use of legitimate Python executables to launch DLL side-loading attacks. This approach enables the attackers to stealthily load additional payloads. The initial access to environments targeted in CL-UNK-1068 activity is achieved by deploying and utilizing various web shells. We observed the attackers deploying the GodZilla web shell, and a variation of AntSword, both of which are written in a combination of English and Simplified Chinese. After gaining an initial foothold, the attackers use these web shells to move laterally to additional hosts and SQL servers. Figure 1 shows an alert that was triggered when an attacker attempted to exploit a Linux server. After gaining access to targeted environments, the attackers attempt to steal the following files from the c:\inetpub\wwwroot directory of a Windows web server: web.config .aspx .asmx .asax .dll The attackers could use this stolen information to extract credentials for lateral movement, or to discover vulnerabilities in the website's code. The alert in Figure 2 shows that the attackers archived the stolen files under the names web.rar, web1.rar and web2.rar. After moving to additional servers, the attackers continued to steal files related to the website’s configuration, such as .json files from the c:\inetpub\wwwroot directory, including the appsettings.json file. In multiple instances, the attackers used a simple but effective approach to exfiltrate files: Using WinRAR to archive the relevant files. Executing the certutil -encode command to Base64-encode the .rar archives. Executing the type command to print the Base64 content to their screen through the web shell. By encoding the archives as text and printing them to their screen, the attackers were able to exfiltrate data without actually uploading any files. The attackers likely chose this method because the shell on the host allowed them to run commands and view output, but not to directly transfer files. Figure 3 shows the alert triggered by the data exfiltration activity. In addition to stealing configuration files, the attackers stole other types of sensitive data: Browser history and web browser bookmarks Sensitive XLSX and CSV files from desktops and USER directories .bak files from MSSQL servers (database backup files) In certain instances, the attackers deployed usql, a universal command-line interface for multiple databases. The use of this interface may indicate that one of the goals of CL-UNK-1068 activity is to extract data directly from SQL servers. We analyzed the most noteworthy tools and utilities that the attackers behind CL-UNK-1068 used across multiple intrusion campaigns since 2020. A detailed analysis of additional tools and utilities used during this activity is provided in Appendix B. In attacks that we observed, the attackers behind CL-UNK-1068 frequently used DLL side-loading to execute their tool set. They deployed a legitimate Python programming language executable like python.exe or pythonw.exe alongside a malicious side-loaded DLL that served as a loader, using a name like python20.dll. The attackers also dropped an obfuscated shellcode file with a similar name, to match the legitimate executable naming convention (e.g., python or pythonw). When the legitimate python.exe is executed, it side-loads a malicious loader named python20.dll. The malicious loader reads the obfuscated shellcode, deobfuscates it in memory, and then executes it within the memory space of the legitimate Python process. The shellcode then decrypts and executes the payload in memory. The attackers used this technique to load and execute several tools as payloads, including FRP, PrintSpoofer and a custom scanner that they named ScanPortPlus. Figure 4 shows the legitimate python.exe process used to read shellcode from a file named python and execute a decrypted payload for ScanPortPlus in memory. The attackers behind CL-UNK-1068 scanned compromised networks using a custom scanner that they internally named ScanPortPlus. This custom tool is written in Go, and the threat actor compiled versions for both Windows and Linux systems. Figure 5 shows the command-line options of ScanPortPlus, which include IP address, port and vulnerability scanning. In some of the events that we observed, the attackers deployed FRP, to establish persistent access while bypassing firewalls. The attackers used versions of their own custom-compiled FRP for Windows and Linux systems, including a custom FRP that had several unique identifiers: Unique authentication token: Attackers used the authentication token frpforzhangwei (“frp for zhang wei”). Zhang Wei is a common Chinese name. Proxy naming convention: The proxy names appear to have a consistent naming convention across the versions: - Windows: 10014-win-nic-32-v - Linux: - 20012-linux-64-V - 10013-linux-64-V Unique common password: The password for the FRP is the same in all samples that the threat actor used: f*ckroot123 (profanity masked). Figure 6 highlights the identifiers that we discovered in the FRP samples. In some instances, the attackers behind CL-UNK-1068 deployed the Xnote malware on Linux servers. First discovered in 2015, Xnote is a Linux backdoor that various Chinese threat actors previously used. Xnote has several variants, each with slightly different functionality. The Xnote used by CL-UNK-1068 primarily provides distributed denial-of-service (DDoS) attack capabilities, in addition to other commands. Table 1 lists some of the capabilities of this Xnote variant. Table 1. Xnote task names and functions. Our observations reveal that in 2020, the attackers deployed a custom tool named SuperDump for reconnaissance. In the years following, we saw that the attackers transitioned to a new method of using batch scripts for reconnaissance purposes. In intrusions dating back to 2020, the attackers behind CL-UNK-1068 attempted to use a custom .NET tool that they named SuperDump. The tool’s purpose is to collect information from Windows hosts, such as: User information Host information: IP address, running processes, system information, drive information Files from desktop and document folders Installed programs Local Security Authority Subsystem Service (LSASS) process dump content Registry information: - Navicat configuration (database management tool) - WinSCP configuration - RDP configuration - Internet Explorer settings - Environment variables - PuTTY configuration - FileZila data - NetSarang Xmanager data (remote desktop software) - SSH data - PowerShell history - Microsoft\Windows\Recent registry key (recent programs) Figure 7 shows the functions in SuperDump’s code that gather information. We discovered that the use of SuperDump was later replaced by batch script files called hpp.bat and hp.bat, which also collect host information. The functionality of these batch files is detailed in the following section. In more recently observed cases, after successfully compromising an endpoint, the attackers initiate the reconnaissance phase. This involves deploying custom batch scripts to gather initial host telemetry and map the local environment. The specific naming conventions for both scripts and output files constitute a unique signature that we observed across multiple attacks over several years. We observed that in several instances, the attackers executed a batch script named hp.bat or hpp.bat, and on one occasion, a.bat. Each of these batch scripts executed multiple commands and saved the results in matching .txt files. The attackers utilized these scripts to perform host reconnaissance, gather telemetry on the local system and map other potential servers in the environment. For a detailed analysis of the scripts, output filenames and executed commands, see Appendix B. After all the output files were written to disk, attackers executed an additional rar.bat/rr.bat batch script that was responsible for archiving the result files using commands such as: rar.exe a -df host.rar *.txt rar a -df host.rar *.txt *.db rar a -df host.rar *.txt *.db *hist* *book* This section provides a comprehensive description of the various tools and methods utilized in CL-UNK-1068 activity to execute credential theft. The attackers used Mimikatz to dump passwords from memory, and a dumping tool named LsaRecorder, as Figure 8 shows. The LsaRecorder tool captures login passwords by hooking the LsaApLogonUserEx2 callback function. The LsaRecorder tool was shared on the Chinese security forum called Kanxue in 2019. Figure 9 shows the LsaRecorder command-line options, which include the ability to record a user’s logon password. The attackers behind CL-UNK-1068 attempted to use DumpIt, a free multiplatform forensics tool, in combination with the widely known Volatility framework to extract password hashes from memory. As shown in Figure 10, they used DumpIt to dump the victim machine's memory. Next, they used several Volatility modules: windows.hashdump: Extracts local user account NTLM password hashes from the SAM registry hive windows.registry.lsadump.Lsadump: Dumps LSA Secrets such as service account passwords, cached domain credentials windows.registry.cachedump.Cachedump: Dumps cached domain credentials In addition, in some instances the attackers executed DumpIt and Volatility, using batch scripts named dmp.bat and vo.bat. The sqlstudio.bin file stores saved connection info for Microsoft SQL Server Management Studio (SSMS). Attackers attempted to extract data from this file using a tool named SQL Server Management Studio Password Export Tool, deployed as ssms.exe. This tool was published on a Chinese security blog in 2015. The attackers ran the tool locally and attempted to exfiltrate the sqlstudio.bin file. They used the certutil -encode command to Base64-encode the file, and the type command to read the encoded file. Figure 11 shows this sequence of events. We assess with high confidence that CL-UNK-1068 represents activity from a threat group that communicates in Chinese. The group behind this activity cluster has been targeting high-value sectors across South, Southeast and East Asia since at least 2020. Using primarily open-source tools, community-shared malware and batch scripts, the group has successfully maintained stealthy operations while infiltrating critical organizations. This cluster of activity demonstrates versatility by operating across both Windows and Linux environments, using different versions of their tool set for each operating system. While the focus on credential theft and sensitive data exfiltration from critical infrastructure and government sectors strongly suggests an espionage motive, we cannot yet fully rule out cybercriminal intentions. We advise defenders to move beyond static indicators and focus on behavioral anomalies. Detection logic should be tuned to identify any hallmark techniques. In the case of CL-UNK-1068 activity, signs to detect include: Misuse of legitimate Python binaries for side-loading Deployment of unauthorized tunneling tools like FRP Execution of custom reconnaissance batch scripts Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: Cortex Xpanse has the ability to identify exposed VMWare vCenter Server devices on the public internet and escalate these findings to defenders. Customers can enable alerting on this risk by ensuring that they’ve enabled the VMware vCenter Attack Surface Rule. Identified findings can be viewed in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module. The Forensics feature of Cortex XDR enables analysts to perform forensic analysis by collecting all necessary artifacts and displaying them in an intuitive forensics console. This feature also enables in-depth analysis of specific endpoints, to fully understand the activities that occurred. Supported forensic artifacts include environment variables, command history, session history, network connections and file listing. Figure 12 shows the command history of a CL-UNK-1068 interactive attack on a Linux server. The new Cortex XDR Analytics Engine enhances behavioral detection for Linux through two key mechanisms: Uncommon Linux process communication to a rare external host: This detector flags command-and-control (C2) initiation. Tailored for Linux, it identifies low-prevalence or recurring outbound patterns that are used by advanced threats to maintain network connections. Uncommon attempt to discover a sensitive file: This detector identifies credential theft attempts, such as unauthorized access to /etc/hosts and /etc/ssl/private/.*. This exposes misused utilities and threat actor activity targeting user secrets. Figure 13 displays an “Uncommon attempt” alert that CL-UNK-1068 activity triggered. Other Palo Alto Networks products and services that can help include: Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block the attacks with best practices via the following Threat Prevention signature/s 94655, 91671, 91662, 86680, 81881, 81819, 81815, 81816, 81817, 81803 The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. Cortex XSIAM incorporates all Cortex XDR features, as well as additional protections. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. SHA256 hashes for shellcode loader (m.exe/l.exe) 524734501be19e9ed1bfab304b0622a2263a4f9e3db0971f3fae93f7e7369c20 SHA256 hashes for Mimikatz shellcode binary (m.bin) 26483f0886078cc9f5f9912d3ffce1301e297b435920ab1c86c9107bbdce4db2 99bd09e1c500866b2b809fd9170f1b8b7e120da21a1f2eed6165fcf81bf519b7 SHA256 hashes for LsaRecorder (ls.exe) 8a3345f0d8f1a7d78ea485ae11358cf2ae3d51cb7975524d6d67ba05a08a37ea SHA256 hashes for shellcode loader DLL (python20.dll) 6ddbfd3a96834087501f0c9415a925cafdb92cb8ff34685f138833b4795416d6 3b2b6a3ee023dfa168f257b292a28f5fbdbacb5aa2250e1efb36e650529db1b5 cfdcbc553bc7464aedfb6758b0a38acc78d9537eabe9717e60ab0d8d3b355225 SHA256 hashes for web shells d8378cf105146217e6ded438187c4ea0edcadb6cf27f5eeddda3fd80cce76d72 5c986203242e2ed25458b0606ee7be57070f6d66b7472b453d92b1b6786443bd cfcbb3014ecc560ba36103213b36fc62d6b0ef22c49067ff0d860fd7253a7c94 fb9400d763a009b3bd2b9468410e0c69ee8a4f58400e532f086cef749422210d SHA256 hashes for SQL Server Management Studio Password Export Tool (ssms.exe) c880936ba0ca153719c2cca33c1925a9480d28abc88cf4daa02f34cc8cc1c9e5 SHA256 hashes for ScanPortPlus: Windows version (sp.exe) d6ed94589b0e6a7c3e1a6052e18f3962ca78c385c78036972d5ea72c07a5772c 3e698c85660e2c012b3db7f47ca3f2b1af2b6b0e0a0d2bdb7903f91cf9d31732 0d03934eb181c2befbc5341208c4eb8f939e00382ac632216397b8210225c937 SHA256 hashes for ScanPortPlus: Linux version (sp/spp) 8d3907d56b1dd1609053cb55dd66f33499e1ea091133df76d8fe6f08f25f37b2 SHA256 hashes for FRP: Windows version (32.exe) 082a55731f972cd15e103104229a68175a8c59a52bae05daa8ed4302df7c2dec SHA256 hashes for FRP: Linux version (nginx/httpd) e1ff808321ce952384b7fff720584c48ec0fd36480d6bc9ac0d5db036102c368 cdb90179188a142d24147edcb72be8b574fac4f6833fff15a6ee803754dec0c0 f6ac9e5e76bc9daf4772c5be43c9eac1d2611caafd49fac70bbb8eebfa4781ac SHA256 hashes for CVE-2023-34048 Python Executable (vc.exe) 96f52e4666aa8df67f8d7d00a523cd25e11402108157156775603b3d9514925c e9541e8afa502e13c18734756270b10e3c07f1071283387e63c8f8b0ba591343 SHA256 hashes for srunas.exe (srunas.exe) f7c73b1ac9aff545b184ec7121f2bc706c5064dc3c17f59e9a39469031bf2ef6 SHA256 hashes for Xnote (80/iptable6) b87cee18720c176c1972cf5c74e3c09877177e0c49c34a04b910bb3c70839b71 f710dc61c2edc85841fd733a17b7977dfb889d6476c59bb3c54a5b2fd393ac13 SHA256 hashes for SuperDump (super.exe/superdump.exe) edc0287da3c6bb62a7b2fd3949be5688628fc0e893b5822bd5734a63c39f7ab1 0c7db12ec29f333bf5f53dc5c73ec446b2265fca3aad5144c3569409e15123cb SHA256 hashes for PwnKit (PwnKit.so) 8af434c2af2d901694cb27ec8639e7054f84938110a5cc4492c1bac597026d50 SHA256 hashes for PrintProgram ce20c033dcadf17d9cca325869f946efdd82ab0756fa56e262b6f573252d457c SHA256 hashes for Sliver (agent.exe) 52c817465a56ccd0fb4e914a3274a9e9a93e872583e6239bc6461e4f3e40c567 IP addresses 13.250.108[.]65 43.255.189[.]67 52.77.253[.]4 79.141.169[.]123 107.148.33[.]60 107.148.51[.]251 107.148.130[.]22 AntSwordProject, GitHub Universal Command-Line Interface for SQL Databases (usql), GitHub Fast Reverse Proxy , GitHub PrintSpoofer, GitHub Xnote Analysis, Dr.WEB Exposing Earth Berberoka, Trend Micro What are the differences and connections between CC attacks and DDoS attacks? Tencent Cloud NTP amplification DDoS attack, Cloudflare SYN flood DDoS attack, Cloudflare UDP flood DDoS attack, Cloudflare LSA_AP_LOGON_USER_EX2 Callback Function, Microsoft Learn LsaApLogonUserEx2, Kanxue Security Forum SQL Server Management Studio Password Export Tool, Alpaca House (zcgonvh) Our attribution is based on the victimology, tool set provenance and linguistic indicators found within the malware strings. In accordance with Unit 42’s attribution framework, we assess with high confidence that a threat actor communicating in Chinese is behind the CL-UNK-1068 activity that we observed. The group’s toolkit includes open-source tools and utilities shared within the Chinese security and hacking communities, including: Web shells: Authors developed both GodZilla and AntSword using a combination of English and Simplified Chinese. These web shells are derivatives of the China Chopper web shell. Community-sourced utilities: Tools such as the SQL Server Management Studio Password Export Tool and LsaRecorder were traced back to posts on Chinese security forums and blogs dating back to 2015 and 2019 respectively. Analysis of the FRP tool configuration revealed the unique authentication token frpforzhangwei. Zhang Wei is a common Chinese name. Xnote is a Linux backdoor originally discovered in 2015. According to publicly available documentation, this backdoor has only been used by Chinese threat actors since its discovery. The targeting of critical industries across South, Southeast and East Asia is consistent with common goals of China-aligned threat actors. We assess with moderate-to-high confidence that CL-UNK-1068’s primary objective is cyberespionage. This assessment stems from the actor’s post-compromise behavior — specifically, their targeted exfiltration of SQL database content and backups. The consistent targeting of critical infrastructure and government entities across South, Southeast and East Asia aligns with the interests typically associated with nation-state actors. While the victimology aligns with state interests, attackers could alternatively have monetized exfiltrated data through extortion or sold on underground markets. As such, it is possible that the threat actor behind CL-UNK-1068 is an independent cybercriminal group or a dual-use actor. The following tools and utilities have been part of CL-UNK-1068 activity across multiple campaigns since 2020. Table 2 lists the commands executed by the a.bat, hp.bat and hpp.bat host reconnaissance batch scripts, the result filenames and the purpose of each command. Table 2. Commands executed by the host reconnaissance batch scripts, the results filenames and the purpose of each command. The attackers behind CL-UNK-1068 frequently used batch scripts to perform various functions. Table 3 details some of tde scripts used. Table 3. Additional batch scripts used in CL-UNK-1068 activity. This section details the tools and utilities observed in CL-UNK-1068 activity, outlining how the attackers used these components to bypass security measures and escalate privileges. CL-UNK-1068 attackers used the open-source PrintSpoofer tool to elevate privileges. They also used a custom .NET version named PrintProgram to write a web shell with elevated privileges, as Figure 14 shows. In some intrusions, the attackers used srunas.exe to elevate privileges. This custom tool executes processes with higher privileges by copying the access token from another process, as Figure 15 shows. The attackers attempted to use a Sliver shell implant to elevate privileges. Sliver is an open-source framework that defenders can use to simulate adversarial activities. The attackers used a Sliver implant that acts as a privilege escalation shell. It attempts to find spoolsv.exe or lsass.exe and uses parent process ID spoofing to spawn cmd.exe as a child of those system processes, either with or without additional command-line arguments. Figure 16 shows a snippet of Sliver code for parent process ID spoofing. Attackers deployed PwnKit, a self-contained exploit (CVE-2021-4034) to achieve local privilege escalation on Linux systems. The attackers attempted to use a Nuitka-compiled Python executable, probably to make analysis of this tool more difficult, as Nuitka cannot be fully decompiled to Python code. This appears to be exploitation of CVE-2023-34048, a vulnerability in VMware vCenter Server that allows for remote code execution. Figure 17 shows that the tool receives two arguments: a target address and a command to execute.

A multi-stage malware loader known as OysterLoader has continued to evolve into early 2026, refining its command-and-control (C2) infrastructure and obfuscation methods. The C++-based threat, also referred to as Broomstick and CleanUp, is primarily linked to campaigns associated with the Rhysida ransomware group and has also been used to distribute commodity malware such as Vidar. First reported in June 2024, the loader is typically delivered through fraudulent websites impersonating legitimate IT tools including PuTTY and WinSCP. It arrives disguised as a signed Microsoft Installer file and unfolds across four distinct stages, each designed to hinder analysis and detection. Multi-Stage Infection Chain According to a new advisory by Sekoia Security, OysterLoader's latest infection process is structured as follows: Stage 1: A packer known as TextShell that loads obfuscated shellcode into memory Stage 2: Custom shellcode that decompresses the core payload using a modified LZMA routine Stage 3: An intermediate downloader that performs environment checks and initiates C2 contact Stage 4: The core payload, often deployed as a DLL for persistent execution In the second stage, the malware uses a bespoke LZMA decompression routine. Although the compression parameters remain standard, the header format and bitstream are modified, preventing common tools from recognizing or extracting the payload. Once decompressed, the shellcode adjusts memory protections and resolves imports dynamically. Dynamic API resolution is handled through custom hashing algorithms that vary slightly between samples. This variability complicates static detection and signature-based analysis. Updated C2 Protocol and Infrastructure OysterLoader communicates with its C2 servers over HTTP and HTTPS using spoofed headers and deceptive user-agent strings to blend with normal web traffic. Earlier versions relied on two endpoints for registration and beaconing. However, the latest iteration introduces a three-step process, beginning with an empty GET request to /api/v2/init, followed by a fingerprint submission to /api/v2/facade, and concluding with beaconing to a dynamically assigned endpoint. The malware encodes its JSON communications using a non-standard Base64 alphabet combined with a random shift value generated for each message. Recent updates allow the server to supply a new encoding alphabet during communication, further complicating traffic analysis. Multiple endpoint revisions between May 2024 and January 2026 indicate sustained development efforts. "The constant evolution in OysterLoader's code, including updated C2 endpoints and JSON fingerprinting schemas, signals the high level of activity and commitment from the threat actors," Sekoia explained. "The quality and complexity of the malware's development strongly suggest that OysterLoader will remain a significant and persistent threat in the near term."

Microsoft has disrupted a wave of Rhysida ransomware attacks in early October by revoking over 200 certificates used to sign malicious Teams installers. Vanilla Tempest, the threat group behind the attacks, used domains that mimic Microsoft Teams, such as teams-install[.]top, teams-download[.]buzz, teams-download[.]top, and teams-install[.]run, to distribute fake MSTeamsSetup.exe files that infected victims with the Oyster backdoor. These attacks were part of a late September malvertising campaign that used search engine ads and SEO poisoning to push fake Microsoft Teams installers that backdoored Windows devices with Oyster malware (also known as Broomstick and CleanUpLoader). The ads and the domains led to websites that impersonated the Microsoft Teams download site. Clicking the prominently displayed download link downloads a file named "MSTeamsSetup.exe," the same filename used by the official Teams installer. Upon execution, the malicious Teams installers launched a loader that deployed the signed Oyster malware, granting the threat actors remote access to the infected systems and allowing them to steal files, execute commands, and drop additional malicious payloads. Vanilla Tempest has been using the Oyster backdoor since June 2025, leveraging Trusted Signing alongside code signing services from SSL.com, DigiCert, and GlobalSign starting in September 2025. This malware, first spotted in mid-2023, was also used in previous Rhysida attacks to breach corporate networks and is commonly spread and WinSCP. "Vanilla Tempest, tracked by other security vendors as VICE SPIDER and Vice Society, is a financially motivated actor that focuses on deploying ransomware and exfiltrating data for extortion," Microsoft said. "The threat actor has used various ransomware payloads, including BlackCat, Quantum Locker, and Zeppelin, but more recently has been primarily deploying Rhysida ransomware." Active since at least June 2021, Vanilla Tempest has frequently attacked organizations in the education, healthcare, IT, and manufacturing sectors. While active as Vice Society, the threat actor was known to use multiple ransomware strains, including Hello Kitty/Five Hands and Zeppelin ransomware. Three years ago, in September 2022, the FBI and CISA issued a joint advisory warning that Vice Society disproportionately targeted the U.S. education sector after the cybercrime gang breached Los Angeles Unified (LAUSD), the second-largest school district in the United States. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Introduction When it comes to digital forensics, AmCache plays a vital role in identifying malicious activities in Windows systems. This artifact allows the identification of the execution of both benign and malicious software on a machine. It is managed by the operating system, and at the time of writing this article, there is no known way to modify or remove AmCache data. Thus, in an incident response scenario, it could be the key to identifying lost artifacts (e.g., ransomware that auto-deletes itself), allowing analysts to search for patterns left by the attacker, such as file names and paths. Furthermore, AmCache stores the SHA-1 hashes of executed files, which allows DFIR professionals to search public threat intelligence feeds — such as OpenTIP and VirusTotal — and generate rules for blocking this same file on other systems across the network. This article presents a comprehensive analysis of the AmCache artifact, allowing readers to better understand its inner workings. In addition, we present a new tool named “AmCache-EvilHunter“, which can be used by any professional to easily parse the Amcache.hve file and extract IOCs. The tool is also able to query the aforementioned intelligence feeds to check for malicious file detections, this level of built-in automation reduces manual effort and speeds up threat detection, which is of significant value for analysts and responders. The importance of evidence of execution Evidence of execution is fundamentally important in digital forensics and incident response, since it helps investigators reconstruct how the system was used during an intrusion. Artifacts such as Prefetch, ShimCache, and UserAssist offer clues about what was executed. AmCache is also a robust artifact for evidencing execution, preserving metadata that indicates a file’s presence and execution, even if the file has been deleted or modified. An advantage of AmCache over other Windows artifacts is that unlike them, it stores the file hash, which is immensely useful for analysts, as it can be used to hunt malicious files across the network, increasing the likelihood of fully identifying, containing, and eradicating the threat. Introduction to AmCache Application Activity Cache (AmCache) was first introduced in Windows 7 and fully leveraged in Windows 8 and beyond. Its purpose is to replace the older RecentFileCache.bcf in newer systems. Unlike its predecessor, AmCache includes valuable forensic information about program execution, executed binaries and loaded drivers. This artifact is stored as a registry hive file named Amcache.hve in the directory C:\Windows\AppCompat\Programs. The metadata stored in this file includes file paths, publisher data, compilation timestamps, file sizes, and SHA-1 hashes. It is important to highlight that the AmCache format does not depend on the operating system version, but rather on the version of the libraries (DLLs) responsible for filling the cache. In this way, even Windows systems with different patch levels could have small differences in the structure of the AmCache files. The known libraries used for filling this cache are stored under %WinDir%\System32 with the following names: aecache.dll aeevts.dll aeinv.dll aelupsvc.dll aepdu.dll aepic.dll It is worth noting that this artifact has its peculiarities and limitations. The AmCache computes the SHA-1 hash over only the first 31,457,280 bytes (≈31 MB) of each executable, so comparing its stored hash online can fail for files exceeding this size. Furthermore, Amcache.hve is not a true execution log: it records files in directories scanned by the Microsoft Compatibility Appraiser, executables and drivers copied during program execution, and GUI applications that required compatibility shimming. Only the last category reliably indicates actual execution. Items in the first two groups simply confirm file presence on the system, with no data on whether or when they ran. In the same directory, we can find additional LOG files used to ensure Amcache.hve consistency and recovery operations: C:\Windows\AppCompat\Programs\Amcache.hve.*LOG1 C:\Windows\AppCompat\Programs\Amcache.hve.*LOG2 The Amcache.hve file can be collected from a system for forensic analysis using tools like Aralez, Velociraptor, or Kape. Amcache.hve structure The Amcache.hve file is a Windows Registry hive in REGF format; it contains multiple subkeys that store distinct classes of data. A simple Python parser can be implemented to iterate through Amcache.hve and present its keys: The result of this parser when executed is: From a DFIR perspective, the keys that are of the most interest to us are InventoryApplicationFile, InventoryApplication, InventoryDriverBinary, and InventoryApplicationShortcut, which are described in detail in the following subsections. InventoryApplicationFile The InventoryApplicationFile key is essential for tracking every executable discovered on the system. Under this key, each executable is represented by its own uniquely named subkey, which stores the following main metadata: ProgramId: a unique hash generated from the binary name, version, publisher, and language, with some zeroes appended to the beginning of the hash FileID: the SHA-1 hash of the file, with four zeroes appended to the beginning of the hash LowerCaseLongPath: the full lowercase path to the executable Name: the file base name without the path information OriginalFileName: the original filename as specified in the PE header’s version resource, indicating the name assigned by the developer at build time Publisher: often used to verify if the source of the binary is legitimate. For malware, this subkey is usually empty Version: the specific build or release version of the executable BinaryType: indicates whether the executable is a 32-bit or 64-bit binary ProductName: the ProductName field from the version resource, describing the broader software product or suite to which the executable belongs LinkDate: the compilation timestamp extracted from the PE header Size: the file size in bytes IsOsComponent: a boolean flag that specifies whether the executable is a built-in OS component or a third-party application/library With some tweaks to our original Python parser, we can read the information stored within this key: We can also use tools like Registry Explorer to see the same data in a graphical way: As mentioned before, AmCache computes the SHA-1 hash over only the first 31,457,280 bytes (≈31 MB). To prove this, we did a small experiment, during which we got a binary smaller than 31 MB (Aralez) and one larger than this value (a custom version of Velociraptor). For the first case, the SHA-1 hash of the entire binary was stored in AmCache. For the second scenario, we used the dd utility to extract the first 31 MB of the Velociraptor binary: When checking the Velociraptor entry on AmCache, we found that it indeed stored the SHA-1 hash calculated only for the first 31,457,280 bytes of the binary. Interestingly enough, the Size value represented the actual size of the original file. Thus, relying only on the file hash stored on AmCache for querying threat intelligence portals may be not enough when dealing with large files. So, we need to check if the file size in the record is bigger than 31,457,280 bytes before searching threat intelligence portals. Additionally, attackers may take advantage of this characteristic to purposely generate large malicious binaries. In this way, even if investigators find that a malware was executed/present on a Windows system, the actual SHA-1 hash of the binary will still be unknown, making it difficult to track it across the network and gathering it from public databases like VirusTotal. InventoryApplicationFile – use case example: finding a deleted tool that was used Let’s suppose you are searching for a possible insider threat. The user denies having run any suspicious programs, and any suspicious software was securely erased from disk. But in the InventoryApplicationFile, you find a record of winscp.exe being present in the user’s Downloads folder. Even though the file is gone, this tells you the tool was on the machine and it was likely used to transfer files before being deleted. In our incident response practice, we have seen similar cases, where this key proved useful. InventoryApplication The InventoryApplication key records details about applications that were previously installed on the system. Unlike InventoryApplicationFile, which logs every executable encountered, InventoryApplication focuses on those with installation records. Each entry is named by its unique ProgramId, allowing straightforward linkage back to the corresponding InventoryApplicationFile key. Additionally, InventoryApplication has the following subkeys of interest: InstallDate: a date‑time string indicating when the OS first recorded or recognized the application MsiInstallDate: present only if installed via Windows Installer (MSI); shows the exact time the MSI package was applied, sourced directly from the MSI metadata UninstallString: the exact command line used to remove the application Language: numeric locale identifier set by the developer (LCID) Publisher: the name of the software publisher or vendor ManifestPath: the file path to the installation manifest used by UWP or AppX/MSIX apps With a simple change to our parser, we can check the data contained in this key: When a ProgramId appears both here and under InventoryApplicationFile, it confirms that the executable is not merely present or executed, but was formally installed. This distinction helps us separate ad-hoc copies or transient executions from installed software. The following figure shows the ProgramId of the WinRAR software under InventoryApplicationFile. When searching for the ProgramId, we find an exact match under InventoryApplication. This confirms that WinRAR was indeed installed on the system. Another interesting detail about InventoryApplication is that it contains a subkey named LastScanTime, which is stored separately from ProgramIds and holds a value representing the last time the Microsoft Compatibility Appraiser ran. This is a scheduled task that launches the compattelrunner.exe binary, and the information in this key should only be updated when that task executes. As a result, software installed since the last run of the Appraiser may not appear here. The LastScanTime value is stored in Windows FileTime format. InventoryApplication – use case example: spotting remote access software Suppose that during an incident response engagement, you find an entry for AnyDesk in the InventoryApplication key (although the application is not installed anymore). This means that the attacker likely used it for remote access and then removed it to cover their tracks. Even if wiped from disk, this key proves it was present. We have seen this scenario in real-world cases more than once. InventoryDriverBinary The InventoryDriverBinary key records every kernel-mode driver that the system has loaded, providing the essential metadata needed to spot suspicious or malicious drivers. Under this key, each driver is captured in its own uniquely named subkey and includes: FileID: the SHA-1 hash of the driver binary, with four zeroes appended to the beginning of the hash LowerCaseLongPath: the full lowercase file path to the driver on disk DigitalSignature: the code-signing certificate details. A valid, trusted signature helps confirm the driver’s authenticity LastModified: the file’s last modification timestamp from the filesystem metadata, revealing when the driver binary was most recently altered on disk Because Windows drivers run at the highest privilege level, they are frequently exploited by malware. For example, a previous study conducted by Kaspersky shows that attackers are exploiting vulnerable drivers for killing EDR processes. When dealing with a cybersecurity incident, investigators correlate each driver’s cryptographic hash, file path, signature status, and modification timestamp. That can help in verifying if the binary matches a known, signed version, detecting any tampering by spotting unexpected modification dates, and flagging unsigned or anomalously named drivers for deeper analysis. Projects like LOLDrivers help identify vulnerable drivers in use by attackers in the wild. In addition to the InventoryDriverBinary, AmCache also provides the InventoryApplicationDriver key, which keeps track of all drivers that have been installed by specific applications. It includes two entries: DriverServiceName, which identifies the name of the service linked to the installed driver; and ProgramIds, which lists the program identifiers (corresponding to the key names under InventoryApplication ) that were responsible for installing the driver. As shown in the figure below, the ProgramIds key can be used to track the associated program that uses this driver: InventoryDriverBinary – use case example: catching a bad driver If the system was compromised through the abuse of a known vulnerable or malicious driver, you can use the InventoryDriverBinary registry key to confirm its presence. Even if the driver has been removed or hidden, remnants in this key can reveal that it was once loaded, which helps identify kernel-level compromises and supporting timeline reconstruction during the investigation. This is exactly how the AV Killer malware was discovered. InventoryApplicationShortcut This key contains entries for .lnk (shortcut) files that were present in folders like each user’s Start Menu or Desktop. Within each shortcut key, the ShortcutPath provides the absolute path to the LNK file at the moment of discovery. The ShortcutTargetPath shows where the shortcut pointed. We can also search for the ProgramId entry within the InventoryApplication key using the ShortcutProgramId (similar to what we did for drivers). InventoryApplicationShortcut – use case example: confirming use of a removed app You find that a suspicious program was deleted from the computer, but the user claims they never ran it. The InventoryApplicationShortcut key shows a shortcut to that program was on their desktop and was accessed recently. With supplementary evidence, such as that from Prefetch analysis, you can confirm the execution of the software. AmCache key comparison The table below summarizes the information presented in the previous subsections, highlighting the main information about each AmCache key. AmCache-EvilHunter Undoubtedly Amcache.hve is a very important forensic artifact. However, we could not find any tool that effectively parses its contents while providing threat intelligence for the analyst. With this in mind, we developed AmCache-EvilHunter a command-line tool to parse and analyze Windows Amcache.hve registry hives, identify evidence of execution, suspicious executables, and integrate Kaspersky OpenTIP and VirusTotal lookups for enhanced threat intelligence. AmCache-EvilHunter is capable of processing the Amcache.hve file and filter records by date range (with the options --start and --end). It is also possible to search records using keywords (--search), which is useful for searching for known naming conventions adopted by attackers. The results can be saved in CSV (--csv) or JSON (--json) formats. The image below shows an example of execution of AmCache-EvilHunter with these basic options, by using the following command: The output contains all applications that were present on the machine on June 19, 2025. The last column contains information whether the file is an operating system component, or not. Analysts are often faced with a large volume of executables and artifacts. To narrow down the scope and reduce noise, the tool is able to search for known suspicious binaries with the --find-suspicious option. The patterns used by the tool include common malware names, Windows processes containing small typos (e.g., scvhost.exe), legitimate executables usually found in use during incidents, one-letter/one-digit file names (such as 1.exe, a.exe), or random hex strings. The figure below shows the results obtained by using this option; as highlighted, one svchost.exe file is part of the operating system and the other is not, making it a good candidate for collection and analysis if not deleted. Malicious files usually do not include any publisher information and are definitely not part of the default operating system. For this reason, AmCache-EvilHunter also ships with the --missing-publisher and --exclude-os options. These parameters allow for easy filtering of suspicious binaries and also allow fast threat intelligence gathering, which is crucial during an incident. Another important feature that distinguishes our tool from other proposed approaches is that AmCache-EvilHunter can query Kaspersky OpenTIP (--opentip ) and VirusTotal (--vt) for hashes it identifies. In this way, analysts can rapidly gain insights into samples to decide whether they are going to proceed with a full analysis of the artifact or not. Binaries of the tool are available on our GitHub page for both Linux and Windows systems. Conclusion Amcache.hve is a cornerstone of Windows forensics, capturing rich metadata, such as full paths, SHA-1 hashes, compilation timestamps, publisher and version details, for every executable that appears on a system. While it does not serve as a definitive execution log, its strength lies in documenting file presence and paths, making it invaluable for spotting anomalous binaries, verifying trustworthiness via hash lookups against threat‐intelligence feeds, and correlating LinkDate values with known attack campaigns. To extract its full investigative potential, analysts should merge AmCache data with other artifacts (e.g., Prefetch, ShimCache, and Windows event logs) to confirm actual execution and build accurate timelines. Comparing InventoryApplicationFile entries against InventoryApplication reveals whether a file was merely dropped or formally installed, and identifying unexpected driver records can expose stealthy rootkits and persistence mechanisms. Leveraging parsers like AmCache-EvilHunter and cross-referencing against VirusTotal or proprietary threat databases allows IOC generation and robust incident response, making AmCache analysis a fundamental DFIR skill.

The US government has warned businesses and critical infrastructure organizations to stay vigilant against wide-ranging attacks from the Interlock ransomware gang. The joint advisory from four government agencies including the FBI and the Department of Health and Human Services (HHS), highlighted the novel initial access techniques used by the cybercrime group. This includes “drive-by-download” and ClickFix social engineering techniques. The group, first identified in late September 2024, has been observed targeting various business, critical infrastructure and other organizations in North America and Europe. High-profile incidents attributed to Interlock in 2025 include Kettering Health, a major healthcare provider in western Ohio, US, and Scottish local authority West Lothian council. Its favored tactic is double extortion, in which threat actors exfiltrate data as well as encrypt it, increasing the pressure on victims to pay a ransom demand. The ransomware encryptors deployed are designed for both Windows and Linux operating systems. “These actors are opportunistic and financially motivated in nature and employ tactics to infiltrate and disrupt the victim’s ability to provide their essential services,” the advisory, published on July 22, warned. “Uncommon” Method for Initial Access The FBI has observed Interlock using a technique called drive-by-download to obtain initial access, which was described as an “uncommon method among ransomware groups.” This technique involves the compromise of legitimate websites, which automatically installs malware onto the victim’s device upon being visited. Interlock actors have also used the ClickFix social engineering technique to gain initial access. This tactic involves the use of a fake error or verification message to manipulate victims into copying and pasting a malicious script and then running it. Post-compromise, affiliates deploy various methods for discovery, credential access and lateral movement. A PowerShell script executes a series of commands designed to gather information on victim machines. Once command and control (C2) is established, a series of PowerShell commands are used to download a credential stealer and keylogger binary. These tools collect various information to help facilitate access between systems, including login information and users’ keystrokes. Remote desktop protocol (RDP) is also leveraged to facilitate lateral movement. Data is then exfiltrated via AzCopy, a legitimate tool used to copy files, and various file transfer tools, including WinSCP. Following exfiltration, Interlock launches ransomware encryptors. Encrypted files are appended with a ransom note titled !README!.txt. Interlock affiliates do not leave an initial ransom demand or payment instructions in this note, instead each victim is provided with a unique code and instructions to contact the ransomware actors via a .onion URL. When contact is made, victims are instructed to make ransom payments in Bitcoin to cryptocurrency wallet addresses provided by the actors. The actors also threaten to publish the victim’s exfiltrated data to their leak site on the Tor network unless the victim pays the ransom demand. “The actors have previously followed through on this threat,” the agencies noted. How to Defend Against Interlock Attacks The advisory set out a range of recommendations for organizations to protect against the techniques used by Interlock. These include: Reduce the risk of drive-by-download by implementing domain name system (DNS) to block users from accessing malicious sites Implement web access firewalls to mitigate and prevent unknown commands or process injection from malicious domains or websites Implement additional email security measures, including disabling hyperlinks in received emails Require all accounts with passwords to comply with National Institute of Standards and Technology (NIST) password guidance and implement multi-factor authentication (MFA) for all services Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems Maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented and secure location Segment networks to prevent the spread of ransomware