Dr Petri ph retweeted
Ping me if you want to run a compromise assessment after a day without EDR visibility
Dr Petri ph retweeted
My teammate @FarghlyMal shared two of the CopperLoader samples listed here back in September. Follow our researchers and @nextronresearch to catch findings like these early
teapaw.org/FarghlyMal/status/2103…
We spent a year tracking CopperDragon’s Sparrow Framework - used by Chinese nexus APTs around the 🌍
🔎 Watering-hole attacks on government websites
🕵️ Passive backdoors and rootkit capabilities
📡 Espionage targeting major telecom operators
Read More ->
research.checkpoint.com/2026…
Dr Petri ph retweeted
Your core Linux authentication could be compromised without a single alert. We've identified malicious PAM modules that are completely invisible on VirusTotal and bypass advanced LLM-based reverse engineering by altering just one line of source code.
Observed capabilities:
Universal bypass via the hardcoded password. .gnu.version_r, carefully chosen to avoid detection.
Targeted root access via password zZ,s=EB6f#91Lh@[ (observed in Yemen).
Achieved via minimal source code modification to pam_unix with a one-liner poisoning.
1/2
Dr Petri ph retweeted
Our generic YARA rules detected every stage of Gorbag's toolchain well before ESET’s analysis was published this week.
Here's the timeline:
July 2025: BeautyStealer detected.
September 2025: Prime ReverseShell detected.
February 2026: Weaponized LNKs detected just one day after their first submission.
These detections didn't just identify known malware. They also helped us uncover additional samples and expand the picture of Gorbag's activity beyond what was covered in the ESET report.
Gorbag has been targeting Ukrainian law enforcement, justice, defense, and local government institutions near the frontline since February 2025.
The activity involves BeautyStealer, a C++ browser stealer, and Prime ReverseShell, a PowerShell reverse shell packaged with PS2EXE. Initial access relies on spearphishing and weaponized RAR archives exploiting CVE-2025-8088.
Analysis and IOCs:
github.com/NextronSystems/io…
Dr Petri ph retweeted
We identified a DLL sideloading chain that hides its first stage in the certificate table of a genuine, Microsoft-signed sllauncher.exe (Silverlight launcher). The signature appears intact, and a fake oledlg.dll pulls the payload out of the signed EXE.
The chain ends in a modular implant. On its own it only profiles the host, reports installed AV and operator-chosen running processes, and loads PE plugins on demand. Everything else is left to plugins the operator sends, likely to keep the implant small.
The lures are generic invoice and payment-themed documents aimed at Western businesses.
Full analysis + IOCs: github.com/NextronSystems/io…
Dr Petri ph retweeted
We did some additional pivoting and found packages from this cluster dating back to October 25, 2026. Most have already been removed from npm:
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected] (still live)
They share obfuscated payloads and, in several cases, identical cross-platform VM-detection binaries.
We also observed credential harvesting, AWS/Bedrock and invoice reconnaissance, along with cron, SSH-key and curl PATH-shim capabilities. The 127.0.0.1:8873 endpoint may be a local relay or controller.
Interesting malware payload in [email protected]. Customized js-obfuscator around a worm payload that contains crypto dead drops overlapping with the html-to-gutenberg addresses (PolinRider). There's also what seems to be some astroturfing mentions of the package name across x and youtube.
Only, the crypto dead drops seem to use a local IP address and don't actually download the next stage. Unsure whether this is DPRK testing in public or misguided adversary emulation but block cdn.node-js[.]dev either way
Dr Petri ph retweeted
@cursor_ai updated the IOCs on Oct 30, 2026, at 11:30 a.m. PT. They corrected one incorrect hash (as mentioned before) and now state that both versions 2.1.312 and 2.1.313, distributed through Cursor's extension marketplace, contain the malicious payload.
Dr Petri ph retweeted
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this
We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates.
I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast.
I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood.
#ARTEX #Cairn
nextron-systems.com/2026/10/…
🤖 Made with AI
Dr Petri ph retweeted
Seven national blue teams used THOR APT Scanner at Locked Shields 2026, the world’s largest live-fire cyber defence exercise.
We didn’t ask for flowers. We asked how it held up, and what would make their life easier.
Their strongest ask: easier integration with LLM-assisted analysis. Which is exactly where THOR v11 will shine (stay tuned!).
Read the full feedback here:
nextron-systems.com/2026/09/…
#LockedShields @NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE)
Dr Petri ph retweeted
So what we’re really saying is: we Europeans, while our governments fucked it up with some of the highest industrial energy prices, heavy regulation, dependence on foreign AI chips, and far less hyperscale AI compute, still managed to make an absurd amount out of the compute we have.
72% of the intelligence with 3.8% of the GPUs.
Just to show how talented @MistralAI team is: this shows the "intelligence per GPU" ratio.
- Mistral 4: 3,800 Grace Blackwell (published) 🇫🇷
- GPT-6 Astra: 100,000+ Grace Blackwell (published)
- Grok 4.7: ~200,000 GPUs (estimate)
- Claude Opus 5.5: ~500,000 Trainium2 (estimate)
Proud!
Dr Petri ph retweeted
For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems.
The new THOR Preview signature set currently includes:
- EXPL_CVE_2026_88772_POC_Sep26
Detects artifacts related to the public CVE-2026-88772 PoC
- LOG_SUSP_EXPL_CVE_2026_88771_Sep26
Detects potential CVE-2026-88771 exploitation traces in NetScaler logs
- WEBSHELL_CSS_PassThrough_Sep26
Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise
We also released a new IOC set:
- NetScaler ADC suspicious file artifacts
It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories.
The Preview signatures are already available with:
./thor-util update --sigdev
We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers.
Details:
nextron-systems.com/2026/09/…
And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:
nextron-systems.com/2023/07/…
Dr Petri ph retweeted
🚨 Supply-chain alert affecting PyPI and npm packages from the MemOS project @MemOS_dev.
Detected by our THOR Thunderstorm-based artifact scanning pipeline:
- PyPI: [email protected]
- npm: [at]memtensor/[email protected]
Both packages contain hidden, platform-specific malicious Golang binaries in .sckit directory that are launched silently during normal use.
MemoryOS triggers the binary when logging initializes. The OpenClaw plugin launches it at gateway startup and while processing user prompts. The binaries receive the host environment. The npm variant also receives prompt text.
Embedded configurations specify home inventory, local runtime state, and communication with hard-coded remote endpoints. This creates potential exposure of developer credentials, tokens, configuration, and agent data.
We will provide more information as our investigation progresses.
Technical details and IOCs:
gist.github.com/marius-benth…
Dr Petri ph retweeted
A few things I’d like journalists to keep in mind before writing about Anthropic’s latest reports. Some of the posts going around make these incidents sound very different from what Anthropic actually describes.
1.
“Escaped the sandbox”: In the four evaluation incidents, internet access was possible because of a misconfiguration. That does not demonstrate a VM or container escape. My first question would be what was actually enforcing the isolation.
2.
“Fooled the safety monitor”: This was another LLM reviewing transcripts after the fact. It accepted Claude’s explanation that the environment was simulated. It wasn’t a firewall or network sensor being evaded.
3.
Those 15 systems that installed the PyPI malware? Anthropic believes they were security vendors deliberately analyzing new packages. One scanner leaked credentials, which Claude then used to access a live database. I’d have a few questions about that analysis environment…
Anthropic includes these details. Please keep them in the story
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
Dr Petri ph retweeted
We identified a Rust-based ELF RAT with no existing detection on VirusTotal.
The agent is configured entirely through command-line arguments rather than a static configuration blob.
Observed required flags include:
C2 connectivity: --callback, --beacon, --secret
Tunneling: --socks_port, --local_fwd, --remote_fwd
Persistence and monitoring: --watchdog_pid
Evasion: --jitter, --stealth
Key Capabilities:
- Command Execution: Implements remote shell capabilities
- Pivoting: Integrated SOCKS proxying and port forwarding logic.
- Credential Access: Targets zshrc, ssh/config, and Brave browser data
- Environmental Discovery: Reads hosts and services file, and resolv.conf for network mapping.
Use our THOR Scanner to detect the threat in your environment.
IOCs: github.com/NextronSystems/io…
Dr Petri ph retweeted
We detected fresh samples related to the ongoing #OceanLotus (APT-C-00 / APT32) campaign.
The samples use a custom XOR-cipher shellcode loader that decrypts and executes shellcode directly from memory. The loader has been observed in recent disc-image (ISO/IMG) delivery chains and continues to show low detection rates across antivirus engines.
Check our rules on Valhalla to find all recently detected samples:
valhalla.nextron-systems.com…
valhalla.nextron-systems.com…
valhalla.nextron-systems.com…
New samples:
74236629c068cf2e5de53eabec9a93eb0efe7de38abc721dc5bca5d040f2ba20
07429b8ad51ef42911c152921a392911c083a175ee28e817a1f9283c3c38911b
2ec75dc4d5bff995ec58c211edaedfec150c4c02c6d6b3820b9e960dfeceb3e9
2cb31d6f254f736381ce61e68e0d93bafd8ae073c23671c0748d026702d10f7d
e7de0f35607a4251237adab2128510007ea25fc00a500749940e054f067ac75d
Dr Petri ph retweeted
We found a heavily obfuscated, WHQL-signed malicious kernel driver with very low detections on VirusTotal.
PlugPlayService.sys - MD5: a26abe238cc339da81f4853ab16e1a6a
The driver provides arbitrary memory access and directly accesses RAID devices. It also makes heavy use of control-flow obfuscation, with similarities to techniques recently documented in our blog post on RegPhantom.
Samples similar to PlugPlayService.sys have also been observed dropped by xigmapper. While investigating, We identified 9 additional xigmapper UEFI samples, all with no AV detection. xigmapper executes before the OS, disables SMEP/WP and patches ntoskrnl.exe in memory via egg hunting.
Of particular interest: zenither.efi - MD5: 924c410a520e6dc9aa1118474d9eb354
This specific xigmapper sample has been observed deploying kernel drivers similar to PlugPlayService.sys.
Full xigmapper UEFI sample set + IOCs:
github.com/NextronSystems/io…
Blog post on RegPhantom
nextron-systems.com/2026/03/…
Dr Petri ph retweeted
The REDSHELL payload is now disguised as "math.mjs", replacing the previously used .dat and .bin extensions. Our artifact scanner detected it in the npm package "hydration-vli-ui" (v1.0.0), triggering two additional YARA rules designed to flag executables masquerading as script files.
Follow-up on REDSHELL: we found a newer ELF in three npm packages "hydration-dim-kit", "hydration-dim-ui" and "hydration-ui-dim". It retains the same C2/exfil infrastructure mentioned in our previous tweet but uses a new campaign/beacon ID: a2f65d7abc878ec3c0f2fd1ae67b9db766c3ba357fdfb30fdb1805d07d1ab3bf
Just uploaded to VT:
virustotal.com/gui/file/1caf…
Dr Petri ph retweeted
We identified malicious DOC samples with technical and thematic similarities to recent #CloudAtlas activity described by Positive Technologies.
The campaign targeted Russian and Iraqi victims through phishing emails delivering Microsoft Office documents using malicious template injection. The samples we identified include document-themed filenames such as "Виды_помощи_Форма.doc" and "О_конкурсе_Человек_Дела_–_2026.doc".
The similarities are particularly notable because the reported CloudAtlas campaign combines several distinctive techniques in the same infection chain: malicious Office documents, HTA and multi-stage VBS execution, WMI usage, registry-based persistence, and payload retrieval through oEmbed requests to legitimate WordPress sites rather than direct connections to malicious infrastructure.
The reported chain begins with a malicious Office document that retrieves an HTA dropper, which extracts "WebCachea54.vbs", "WebCachea54.jfm", and "WebCachea54tmp0.vbs". The VBS stages decode additional scripts, collect host information, and use an oEmbed-based delivery chain to retrieve and XOR-decode the next-stage payload.
The final stages deploy CloudAtlas tools including VBShower and PowerCloud, which use Google Sheets for C2 and data exfiltration. A separate VBS component also removes HTA and cache artifacts to clean up traces of the infection.
Report: habr.com/ru/companies/pt/art…
Samples:
653520c24e3ad044c00503e3debccefaac3a6fdf76c5ca40b47b937fdbd389a7 (Виды_помощи_Форма.doc)
8be68dea337a1e7ab1224a10c3c6ca640d55292d135194a5e5ec9454b3bda906
47adb40e9ee04ee3a50e099fecd488f6eaf78a6e3abb9653d346cc5ae4648126 (О_конкурсе_Человек_Дела_–_2026.doc)
Dr Petri ph retweeted
Follow-up on REDSHELL: we found a newer ELF in three npm packages "hydration-dim-kit", "hydration-dim-ui" and "hydration-ui-dim". It retains the same C2/exfil infrastructure mentioned in our previous tweet but uses a new campaign/beacon ID: a2f65d7abc878ec3c0f2fd1ae67b9db766c3ba357fdfb30fdb1805d07d1ab3bf
Just uploaded to VT:
virustotal.com/gui/file/1caf…
🚨 Our artifact scanner found a malicious ELF in npm package "streak-metricazbd". Importing it attempts to launch "REDSHELL", a low-detection Linux RAT with credential theft, remote execution and persistence.
C2: 217[.]60[.]77[.]63
Exfil: litterbox[.]catbox[.]moe
VT: virustotal.com/gui/file/4537…
