We have started posting sample preprocessing analyses of threat reports from our Report Hub, showcasing results from one of the first stages of our multi-stage engine. If you have any suggestions for tweet format improvement, please send us a message

#threatreport #MediumCompleteness ovhcloud-cli security incident - October 19th, 2026 | 19-10-2026 Source: github.com/ovh/ovhcloud-cli/… Key details below ↓ 💀Threats: Glassworm, 🎯Victims: Ovhcloud, Cloud service customers, Developer environments 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1005, T1041, T1074.001, T1078, T1119, T1195.002, T1543.001, T1552.001, T1552.004, T1560, ... 🧨IOCs: - Domain: 4 - Url: 2 - Coin: 2 - IP: 1 - Hash: 5 💽Software: Claude, Docker, Kubernetes 🪙Crypto: solana 🔢Algorithms: md5, sha1 🔠Functions: RPC 💻Platforms: amd64 #threatreport: On October 19, 2026, the OVHcloud CLI GitHub repository was compromised through malicious replacement of release binaries. The attack began with the Darwin binary for version 0.15.0 at 14:47 UTC+2, expanded to all v0.15.0 binaries by 14:57, and subsequently affected binaries from versions 0.11.0 through 0.15.0 by 15:30. The malicious files were removed at 16:21 after a customer report triggered an investigation. OVHcloud later published clean version 0.16.0 with a signed tag and configured releases in immutable mode. The compromised binaries were rebuilt versions of the legitimate Go CLI containing stripped malicious code from an injected `envchecker` module. The malware targeted developer and cloud credentials, configuration files, SSH keys, infrastructure-as-code credentials, and local data from development tools and AI assistants. Targeted resources included VS Code, Cursor, Continue, Sourcegraph Cody, OpenCode, Hermes, and Claude data; AWS, Google Cloud, and Azure credentials; Docker, Kubernetes, NPM, DigitalOcean, Terraform, and `.netrc` configurations; and global Git settings. Each execution created a temporary directory with an `envchecker-` prefixed name containing copied files and credential data generated through local commands. The directory and its contents were not deleted, providing a potential forensic indicator of exposure. The malware then archived the collected data and exfiltrated it through Solana RPC requests using randomly selected endpoints. The compromise was attributed to a developer account that had been used to replace release binaries. Investigators determined that the account had likely been compromised months earlier after the developer installed the `color-picker-universal` version 2.8.91 extension on a personal MacBook. The extension was associated with a Solana wallet linked to the Glassworm threat actor and installed a persistent Node.js service through a macOS plist, communicating with an external IP address. Users were advised not to execute affected binaries and to compare their MD5 hashes with the published indicators.

#threatreport #LowCompleteness PHP2Shell: observed exploitation attempts, 22–24 October 2026 | 24-10-2026 Source: gist.github.com/0x4D31/6b1e7… Key details below ↓ 💀Threats: P2pshell_vuln, Androxgh0st, 🎯Victims: Drupal, Portal, Wordpress 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1190, T1499.004, T1595.002 🧨IOCs: - IP: 63 - Hash: 8 - File: 4 💽Software: PHP2Shell, WordPress, Drupal, Joomla, Roundcube, Ubuntu, Linux 🔢Algorithms: sha256 📜Programming Languages: php #threatreport: Between 22 October 22:45 and 24 October 01:28 UTC, multiple sources conducted PHP2Shell-related probing against web applications presented as Drupal, WordPress, and portal services. These application labels do not establish vulnerabilities in the underlying CMS products. Activity included large multipart bodies, serializer probes, chunked uploads, nested-file submissions, p2s_v2 markers, scanner-style controls, and rapid or partial POST requests. The B1-style leak-stage activity produced ten complete crash-associated bodies. Sources included 178.249.214.6, 89.167.27.27, 103.151.173.212, and 45.14.71.20, with the latter generating a `zend_mm_heap corrupted` allocator abort from an incomplete request. Reused large-body variants had declared lengths of approximately 12.7 MB, 15.7 MB, and 16.8 MB across different /24 networks, indicating shared tooling or payload reuse, but not proving a common operator, botnet, or evasion strategy. One source also generated scanner-style controls, demonstrating that individual IPs were not restricted to one request family. A separate core/serializer wave matched request-building markers from a known PHP2Shell implementation. Requests containing a `session.serialize_handler` field did not prove server-side configuration changes. This source set was not linked to observed crashes. Streams from 188.253.121.0/24 used chunked transfer and numbered `g0000...` fields padded with long runs of `x`, suggesting a distinct activity cluster, although incomplete uploads prevented determining how much data PHP processed. Additional probes caused out-of-memory events. p2s_v2 requests from 27.100.38.10 and 46.144.20.186 included `recon0xdeadbeef` and `?c=echo%20p2s_v2_alive`; these markers did not demonstrate command execution. Nested-file probes, a 300,067-byte `$_FILES` body, Assetnote-style controls, and rapid 1 MiB POSTs also generated OOMs. Shellflow- and census-labelled requests were observed, but labels were treated only as self-identification. Runtime telemetry showed no Apache-spawned commands, outbound `tcp_connect` events, or successful PHP2Shell markers in 4,216 decoded responses. Permission-hook events referenced temporary PHP paths but did not prove file writes or webshell installation. Execution within existing processes or activity outside the capture window cannot be excluded.

#threatreport #MediumCompleteness PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution | 22-10-2026 Source: arcticwolf.com/resources/blo… Key details below ↓ 💀Threats: Potassium, Udpflood_technique, Icmpflood_technique, Ackflood_technique, Httpflood_technique, 🎯Victims: Php installations 🔓CVEs: CVE-2026-109618 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) CVE-2026-109619 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027, T1033, T1059.004, T1082, T1105, T1140, T1190 🧨IOCs: - IP: 3 - Url: 4 - File: 1 - Domain: 2 - Hash: 2 💽Software: PHP2Shell, PHP-FPM, LiteSpeed, fivem, Minecraft, curl, Unix, OpenAI, Linux 🪙Crypto: ethereum 🔢Algorithms: base64 📜Programming Languages: php, java 💻Platforms: x86, arm #threatreport: On October 21, 2026, PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities collectively referred to as PHP2Shell. Both have a CVSS v4.0 score of 9.2 and can enable unauthenticated remote code execution with the privileges of the PHP worker process. CVE-2026-109618 involves memory corruption when an out-of-memory condition interrupts processing while internal request data is only partially initialized. CVE-2026-109619 involves stale request-owned global state remaining accessible after its backing memory has been freed. The vulnerabilities affect PHP web deployments, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed, and products embedding PHP. Apache mod_php is considered particularly exposed because exploitation has reportedly been demonstrated through a single unauthenticated request before application code executes. Organizations should upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, apply vendor backports where necessary, and restart affected PHP workers. Following disclosure, widespread scanning and exploitation attempts targeted PHP’s session upload-progress functionality. Activity included controlled session identifiers, repetitive multipart uploads, inert PHP canaries, unique response markers, attempts to poison session data, and local-file-inclusion chains intended to determine whether injected PHP was evaluated. Other requests attempted to execute the Unix `id` command and return the PHP process account, representing active RCE validation, although request contents alone do not confirm successful execution. Likely weaponized activity associated with IP address 92.118.112.100 attempted to execute `id`, print confirmation markers, change to `/tmp`, and retrieve additional files with `wget`. Related requests repeated command sequences across padded multipart fields, potentially to improve exploit reliability. Payload-hosting infrastructure was associated with Potassium, a Mirai-derived botnet family, although available telemetry did not prove that the observed PHP2Shell requests downloaded or executed the identified binaries. Potassium samples for ARM and x86 shared encryption material, indicating a common builder. They also contained inactive support for resolving command-and-control addresses through Ethereum Name Service records, using public Ethereum RPC endpoints and multiple text-record keys. Some observed activity instead reused older session-poisoning, local-file-inclusion, or unsafe-deserialization techniques, which may not exploit the underlying PHP2Shell memory flaws.

#threatreport #LowCompleteness 2026-10-24-confirmed-rce.md | 25-10-2026 Source: github.com/0x4D31/honeypot-d… Key details below ↓ 🎯Victims: Php honeypots 🔓CVEs: CVE-2026-109618 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) CVE-2026-109619 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) 📚TTPs: ⚔️Tactics: 1 🛠️Technics: 0 🤖LLM extracted TTPs:` T1033, T1059.004, T1082, T1190 🧨IOCs: - IP: 14 - Hash: 19 - Url: 1 - File: 1 💽Software: PHP2Shell, curl, url 🔢Algorithms: sha256 🔠Functions: Set-Cookie 📜Programming Languages: php #threatreport: The report confirms exploitation of three PHP 8.4.26 honeypots running under single-worker Apache mod_php, with 35 execution-stage HTTP requests correlated to Apache-parented `/bin/sh` processes running as UID 33. The activity affected T1, T2, and T3 and originated from two source-address clusters, 15.204.59.70 and 162.35.99.94. These clusters are treated as infrastructure groupings rather than evidence of two distinct threat actors. The attack used a four-stage multipart HTTP chain associated with the PHP upload-progress/session disclosure vulnerability CVE-2026-109618. The stages involved memory exhaustion, oversized `PHPSESSID`-based memory disclosure, additional memory pressure, and a target-adjusted execution request. The first three decoded request bodies were byte-identical across successful chains from both source clusters and all three targets, while the final 451,384-byte body varied according to leaked address values and the shell command. This behavior is consistent with leak-guided ASLR adjustment and the publicly documented HTTP-only exploit family, rather than a newly identified exploitation primitive. Apache recorded 52 disclosure-sized cookies, each approximately 819,200 bytes, containing repeated pointer-like 64-bit values. Packet captures confirmed 51 complete, acknowledged disclosure responses. The leaked addresses differed between targets, while corresponding values in the final payload maintained the expected relative offset, supporting per-target memory-layout adjustment. PHP errors occurred during request startup in `Unknown on line 0`, indicating exploitation of the PHP engine rather than a specific CMS or application. The decisive execution evidence was provided by Tetragon process telemetry, which recorded `/usr/sbin/apache2` directly spawning `/bin/sh` after complete B2 requests. Observed commands invoked `id`, PHP CLI, `curl`, and `wget`, including callbacks to attacker-controlled ports and proof URLs containing `id -un`, `hostname`, and `uname -m` output. Several workers subsequently crashed with segmentation faults. Additional addresses generated exploit-shaped traffic or PHP errors, but lacked disclosure cookies and Apache-parent shell events and therefore remain unconfirmed attempts rather than confirmed RCE.

#threatreport #LowCompleteness Weekly Threat Infrastructure Investigation(Week43) | 25-10-2026 Source: disconinja.hatenablog.com/en… Key details below ↓ 💀Threats: Cobalt_strike_tool, Supershell, Mythic_c2_tool, Sliver_c2_tool, Havoc, Empire_loader, Nimplant, Cairn, Artex_tool, Dumplings_rat, Arjun_rat, Natalism, 🏭Industry: Telco 🌐Geo: Hong kong, Saudi, Guangdong, China, Mauritius, Japan, Asia 🧨IOCs: - IP: 169 🗂️Win API: LTD #threatreport: During the reporting period of October 19–25, 2026, the investigation identified 169 publicly exposed command-and-control (C2) servers distributed across the global internet. The activity was analyzed through internet-facing infrastructure data collected using Censys search capabilities, with the focus placed on locating systems associated with adversary-controlled C2 frameworks. The monitored infrastructure included multiple commonly used post-exploitation and remote access frameworks: Cobalt Strike, SuperShell, Mythic, Sliver, Havoc, Empire, and NimPlant. These platforms can support command execution, payload delivery, persistence, and remote control of compromised systems, although the report does not provide framework-specific server counts, victim information, or evidence confirming active compromise. The findings indicate that C2 infrastructure remains broadly distributed and exposed to internet reconnaissance. Publicly reachable servers associated with these frameworks may provide threat actors with operational access to compromised environments and can also create opportunities for defenders to detect, track, or disrupt adversary infrastructure. The report’s results represent infrastructure observed during the specified week and should be treated as a time-bound snapshot rather than a complete measurement of all global C2 activity.

#threatreport #MediumCompleteness RFRx003: previously unknown backdoor observed in attacks against IT companies | 22-10-2026 Source: rt-solar.ru/solar-4rays/blog… Key details below ↓ 💀Threats: Rfrx003, 🎯Victims: Information technology companies 📚TTPs: ⚔️Tactics: 10 🛠️Technics: 20 🧨IOCs: - File: 2 - Url: 1 - Hash: 9 - Domain: 3 💽Software: curl, Linux, Systemd, Unix 🔢Algorithms: base64, md5, sha1, sha256 🗂️Win API: gethostname #threatreport: In summer 2026, previously unknown attackers compromised an organization’s perimeter-facing service by exploiting a recently disclosed remote code execution vulnerability. The exploit enabled system-level code execution and was followed by privilege escalation. The attackers remained in the environment for several months and used Linux persistence mechanisms, including `/etc/systemd/system/timesync.service`, a service designed to resemble `systemd-timesyncd`. The RFRx003 backdoor was placed at `/etc/time`. RFRx003 is a custom Linux backdoor designed primarily for internal pivoting and covert lateral movement. It uses Mongoose and supports HTTPS and WSS transport channels. Its command-and-control messages use a binary protocol with an eight-byte header, and the primary HTTP endpoint observed was `/api/v1/gateway`. The backdoor supports reconnaissance, file upload and download, SOCKS5 tunneling, and interactive shell access through a pseudo-terminal. It can establish a secondary WebSocket connection for interactive operations and introduces a 10-second delay before opening that channel when using HTTPS. The implant launches an interactive Bash shell through a PTY and sets `HISTFILE` to an empty value to prevent command history from being written. Its SOCKS5 implementation supports IPv4 addresses and domain names; domain resolution uses the hardcoded Google Public DNS resolver at `8.8.8.8`. File uploads use `/api/v1/upload` with a `Range` parameter for resumable transfers, while downloads use an endpoint resembling a legitimate avatar request. Additional tools supported persistence, privilege escalation, and payload delivery. A SUID-enabled Bash executable named `/usr/bin/zdumd` allowed local users to obtain root privileges. The `/usr/bin/pkgmgr` shell-script dropper used `curl` to download a payload named `package.json` from attacker infrastructure, saved it under `/dev/shm`, made it executable, and launched it. The dropper was executed through `/var/spool/cron/crontabs/root`. Multiple RFRx003 copies were later placed at different paths and used to create SOCKS5 proxy tunnels for lateral movement, ultimately enabling theft of data from employee mailboxes.

#threatreport #MediumCompleteness OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found | 24-10-2026 Source: stepsecurity.io/blog/ovhclou… Key details below ↓ 🧑‍💻Actors/Campaigns: Hassenbf Forcememo 💀Threats: Glassworm, Dead_drop_technique, Hermes, 🎯Victims: Ovhcloud, Software developers, Cloud service users 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1001.003, T1005, T1027, T1027.013, T1059.007, T1071.001, T1074.001, T1078, T1082, T1102.001, ... 🧨IOCs: - File: 3 - IP: 1 - Url: 1 - Hash: 6 - Coin: 1 💽Software: Linux, Claude, Docker, Kubernetes, curl, macOS 🪙Crypto: solana 🔢Algorithms: base64, aes-256-cbc, aes, sha256, md5 🔠Functions: getSignaturesForAddress 🗂️Win API: GOARCH 📜Programming Languages: javascript 💻Platforms: arm #threatreport: On October 19, 2026, an attacker using the compromised GitHub account HassenBF replaced binaries on existing OVHcloud CLI releases v0.11.0 through v0.15.0. The attacker did not modify source code, tags, or CI workflows; instead, locally built binaries were uploaded directly to the releases, followed by replacement of `checksums.txt` so the published hashes matched the malicious files. The activity lasted approximately 94 minutes, and roughly 250 downloads occurred before the assets were removed. The malicious binaries were built from commit `5ead8ef`, a non-release October 13 main-branch commit, using local `go build` flags `-ldflags="-s -w"` and omitting the normal version ldflag. This caused `ovhcloud version` to display `undefined` and the attacker’s commit hash, while `ovhcloud upgrade` identified the binary as a development build. The payload targeted AI-agent credential stores, cloud and container credentials, Terraform, NPM, SSH keys, `.netrc`, `.gitconfig`, Docker and Kubernetes configuration, and related secrets. Collected data was staged in persistent `/tmp/envchecker-*` directories and exfiltrated as an archive to `https://45.32.148.174/upload` using Solana-RPC-shaped JSON requests. Initial account compromise was attributed to the GlassWorm malware delivered through a malicious VS Code extension installed in October 2025. The recovered loader used variation-selector encoded JavaScript containing an AES-256-CBC wrapper. It implemented regional and timing checks, polled Solana transactions for command data, fetched an encrypted second-stage payload, and executed it in a Node.js VM with unrestricted `require` access. The Solana dead drop was inactive during analysis but could potentially be reactivated through a new transaction memo. Direct downloads and affected installation methods included macOS, Linux x86_64, Windows x86_64, manual downloads, and `ovhcloud upgrade`. Linux arm64 users relying solely on `install.sh` were not exposed because the script requested an `aarch64` asset while releases used `Linux_arm64`; however, arm64 users using upgrades or manual downloads could be affected. Homebrew installations were protected by pinned hashes and rejected the swapped binaries. Affected systems should be treated as compromised. All accessible credentials and tokens should be revoked and rotated from a separate machine, suspicious staging directories removed, and the host rebuilt if integrity cannot be established. Reinstallation should use the clean, attested v0.16.0 release.

#threatreport #LowCompleteness How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943 and CVE-2026-111944) | 24-10-2026 Source: blog.qualys.com/product-tech… Key details below ↓ 🎯Victims: Website security, Tls certificate services, Code signing certificate services 🌐Geo: Indian 🔓CVEs: CVE-2026-111943 \[[Vulners](vulners.com/cve/CVE-2026-111…)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown CVE-2026-111944 \[[Vulners](vulners.com/cve/CVE-2026-111…)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown 🤖LLM extracted TTPs:` T1649 🧨IOCs: - File: 3 💽Software: Chrome 🔢Algorithms: ecc, sha256 ⚙️Win Services: bits 💻Platforms: apple #threatreport: A certificate authority incident disclosed on October 17, 2026, affected eight eMudhra intermediate CA certificates due to a flaw in their key-generation process. The weakness could enable recovery of private keys, allowing attackers to create fraudulent TLS or code-signing certificates. Six affected intermediates were used for TLS and two for code signing. The issue is tracked as CVE-2026-111943 and CVE-2026-111944. The affected intermediates have been revoked, and major platform vendors have taken blocking or distrust actions. Chrome, Mozilla, and Apple blocked the impacted TLS certificates, while Microsoft blocked the two code-signing certificates. Google removed the emSign ECC Root CA - G3 from the Chrome Root Store, and Mozilla removed trust in the root that signed the intermediates. eMudhra stated that only one affected intermediate had been used in production and that none of the eight had issued certificates to websites or end users. It also reported that its root private keys and other intermediate CAs were not affected. Go runtimes are also relevant to remediation. Go versions 1.27.3 and 1.26.10 reject certificate chains containing the compromised keys. Qualys QID 5019897 detects affected Go versions through SwCA scanning, provided systems have current detection signatures. Additional vendor-specific vulnerability checks may identify related operating-system updates. After replacement, organizations should apply required operating-system updates, upgrade Go runtimes, verify that certificate revocation checking is enabled and current, and continue monitoring until scans confirm that affected certificates and vulnerable runtimes have been removed.

#threatreport #MediumCompleteness Infostealer riding the AI Train | 23-10-2026 Source: research.checkpoint.com/2026… Key details below ↓ 💀Threats: Aokigaharastealer, Kamidere, Stygian, 🎯Victims: Ai services, Software development, Cloud computing, Cryptocurrency, Gaming, Communications 🏭Industry: Entertainment 🤖LLM extracted TTPs:` T1005, T1012, T1027, T1027.007, T1027.013, T1041, T1057, T1071.001, T1082, T1113, ... 🧨IOCs: - File: 10 - Path: 1 - Hash: 151 - Domain: 7 - IP: 1 💽Software: Claude, ChatGPT, Codex, Mozilla Firefox, Firefox, Discord, Telegram, Steam, Roblox, Minecraft, ... 📲Wallets: exodus_wallet, electrum, zcash, jaxx, coinomi, wassabi, dashcore, daedalus, tokenpocket, metamask, ... 🪙Crypto: ethereum, dogecoin, litecoin, bitcoin, monero, binance 🔢Algorithms: sha1, aes, sha256, aes-cbc, curve25519, aes-gcm, zip, aes-256-gcm, aes-256-cbc 🔠Functions: bytearray 🗂️Win API: Arc YARA: Found #threatreport: Aokigahara is a newly observed Windows infostealer that may be related to earlier malware tracked as Kamidere or Stygian. It combines conventional theft capabilities with dedicated collection routines for AI applications, developer tools, and cloud environments. The malware captures screenshots, clipboard contents, browser credentials and cookies, cryptocurrency wallet data, files, and data from messaging and gaming applications. It also targets password managers, VPN clients, FTP/SFTP clients, email applications, and browser wallet extensions. A separate clipper component can manipulate clipboard contents. The malware’s distinctive `aisessions` module collects authentication files, session data, and configuration information from Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other AI-related tools. It also targets Git credential files, SSH private keys, AWS, Azure, and Google Cloud credentials and configuration data, as well as single sign-on information. Stolen sessions or credentials could provide access to paid AI services, private conversations, uploaded files, source code, and cloud or development environments. Aokigahara uses anti-analysis techniques including language and keyboard-layout checks, virtualization and sandbox detection, process-count monitoring, suspicious username and hostname checks, hardware and display fingerprinting, cursor-movement checks, hashed dynamic API resolution, and control-flow flattening. Its configuration is AES-256-CBC encrypted, with the key derived from a fixed seed and the initialization vector stored in the `.stgcfg` section. The configuration contains C&C URLs, an X25519 public key, build identifier, gate token, module bitmask, anti-analysis flags, certificate-pinning settings, and fallback URLs. Communication uses a `/gate` endpoint family. The stealer establishes sessions through `/handshake`, uploads each collected module as an AES-GCM-encrypted ZIP archive to `/chunk`, and signals completion through `/complete`. It generates an X25519 key pair, derives an AES-GCM key from the shared secret using SHA-256 and the string `aokigahara`, and includes chunk identifiers in HTTP headers. The malware appears to remain under active development, including changes to its HTTP User-Agent.

#threatreport #HighCompleteness CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure | 23-10-2026 Source: cyfirma.com/research/cyfirma… Key details below ↓ 🧑‍💻Actors/Campaigns: Minjun Lazarus (🧠motivation: cyber_espionage) Bluenoroff Andariel Kimsuky 💀Threats: Mirai, Watering_hole_technique, Wannacry, Credential_harvesting_technique, 🎯Victims: Government agencies, Banks and financial institutions, Manufacturing, Logistics, Shipping, Airports and aviation, Online transaction and trading platforms, Trading companies, Construction 🏭Industry: Financial, Logistic, Transport, Government, Aerospace, E-commerce 🌐Geo: Saudi arabia, Taiwan, Korea, Korean, Bangladesh, India, United states, Japan, Usa, North korea, Thailand, Indonesia, South korea, Australia, Singapore 🔓CVEs: CVE-2026-109619 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) CVE-2026-109618 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) 📚TTPs: ⚔️Tactics: 8 🛠️Technics: 17 🧨IOCs: - File: 5 - IP: 43 - Url: 1 - Hash: 3 💽Software: PHP2Shell, , WordPress, Drupal, Laravel, Cloudflare, OpenAI, PHP-FPM, LiteSpeed, cPanel, ... 🔢Algorithms: md5, sha256 🔠Functions: Set-Cookie 📜Programming Languages: perl, swift, php, python 💻Platforms: arm YARA: Found #threatreport: The report describes the suspected “June 2026 Minjun” campaign, attributed with moderate confidence to a Korean-speaking DPRK/Lazarus-linked operator targeting internet-facing PHP infrastructure. The campaign is in reconnaissance and weaponization, with intended targets including government, financial, manufacturing, logistics, shipping, aviation, trading, and construction organizations across multiple countries. Operators reportedly plan to identify vulnerable systems through passive banner and version collection, prioritize targets by sector and geography, and avoid noisy active scanning. No specific launch date or confirmed mass compromise has been attributed to the campaign. The attack centers on two unauthenticated remote-code-execution vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Both result from request-abort handling that leaves PHP worker state partially initialized, stale, or pointing to freed memory. CVE-2026-109618 involves out-of-memory corruption, while CVE-2026-109619 involves stale global state and use-after-free conditions, including through the PHP session upload-progress feature. Exploitation can occur through crafted multipart/form-data requests before application code executes, making Apache mod_php in its default prefork configuration particularly vulnerable. PHP-FPM and other PHP deployments may also be affected. Public exploit research reportedly demonstrates reliable x86-64 exploitation for certain PHP 8.4 versions with ASLR enabled, although some proof-of-concept files are fake or malware-laced. Global scanning and exploitation attempts have been observed, including 17 suspected source IPs associated with web-shell activity and upload-progress session poisoning; these addresses are not independently linked to the suspected DPRK campaign. Post-exploitation activity may include PHP or web-server processes spawning shells, interpreters, download utilities, or commands from temporary directories; creation of PHP web shells; poisoned PHP session files; modifications to `.user.ini` or `.htaccess`; persistence through cron jobs or SSH keys; and outbound connections to unusual infrastructure or I2P. Recommended defensive priorities are immediate patching to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restarting PHP workers after updates, isolating systems that cannot be patched, and hunting for related activity from 17 October 2026 onward.

#threatreport #MediumCompleteness Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor | 23-10-2026 Source: slowmist.medium.com/threat-i… Key details below ↓ 💀Threats: Supply_chain_technique, 🎯Victims: Web3 developers, Cryptocurrency users 🏭Industry: Government 🤖LLM extracted TTPs:` T1005, T1027, T1033, T1036, T1041, T1059, T1059.001, T1059.004, T1059.007, T1071.001, ... 🧨IOCs: - Url: 29 - File: 12 - Command: 1 - Domain: 4 - IP: 1 - Hash: 3 💽Software: SlowMist, vscode, macOS, Linux, Node.js, curl, Chrome, Opera, Opera GX, Vivaldi, ... 📲Wallets: metamask, tronlink, rabby 🪙Crypto: binance 🔢Algorithms: aes-gcm, md5, sha256, base64 🔠Functions: unref, decryptPassword 🗂️Win API: SG 📜Programming Languages: python, powershell, javascript, solidity 💻Platforms: cross-platform #threatreport: The GitHub repository **sol-live**, presented as a Solidity interview-practice project, contains malicious VS Code workspace configurations in `.vscode/settings.json`. The file uses extensive whitespace and a `files.exclude` rule for `**/.vscode` to conceal the configuration. Custom terminal profiles named `zsh`, `bash`, and `powershell` execute a hidden download-and-run chain. On macOS and Linux, users must actively select the malicious terminal profile; the command runs in the background with `nohup`, suppresses output, checks for Node.js and npm, and installs Node.js through the official `nvm` installer if required. Windows is configured to launch PowerShell by default in a hidden window, but malformed quoting may prevent the generated JavaScript from executing, so Windows exploitation remains unconfirmed. The downloaded loader installs or uses `socket.io-client`, `sql.js`, `form-data`, and `axios`, then launches three detached Node.js child processes. These processes are designed for browser and wallet data theft, file discovery and exfiltration, and interactive remote control. The code records process information in temporary files but contains no confirmed persistence mechanisms such as scheduled tasks, login items, or services. The browser theft component targets Chromium-based browsers including Chrome, Edge, Brave, Opera, Vivaldi, Yandex, and Kiwi. It reads browser login and autofill databases, wallet-extension storage associated with extensions such as MetaMask, Phantom, TronLink, and Rabby, and Brave LevelDB data. On macOS, it also copies `~/Library/Keychains/login.keychain-db`. Password values were observed being retained as encrypted Base64 data; successful plaintext decryption was not confirmed. The file-stealing component scans priority locations such as Desktop, Documents, Downloads, cloud drives, projects, and development directories, uploading eligible files up to 5 MiB. It also searches home directories and, on Windows, all drives for filenames associated with seed phrases, private keys, wallets, `.env` files, databases, documents, and screenshots. The remote-control component provides shell sessions and monitors clipboard contents every second. Detected clipboard changes are sent to `172.86.112.107:8087/api/log`. Analysis was based on archived code and retained responses; no malicious sample was executed and no victim compromise or exfiltration was confirmed.

#threatreport #HighCompleteness MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration | 22-10-2026 Source: welivesecurity.com/en/eset-r… Key details below ↓ 🧑‍💻Actors/Campaigns: Earth_sirrush (🧠motivation: cyber_espionage) Sandworm Ember_bear Gamaredon Turla Invisimole 💀Threats: Mythicratatoskr, Spear-phishing_technique, Matchwok, Matchboil, Sdelete_tool, Lonepage, Eternal_petya, Supply_chain_technique, Olympic_destroyer, Industoyer2, Revsocks_tool, Go-socks5_tool, Trojan-proxy, Quasar_rat, 🎯Victims: Grain logistics, Governmental organizations, Financial institutions, Media, Energy companies, Strategic organizations, Olympic organizers, Accounting software 🏭Industry: Energy, Logistic 🌐Geo: Russian, Ukraine, Russia, Russian federation, Ukrainian 📚TTPs: ⚔️Tactics: 7 🛠️Technics: 15 🧨IOCs: - File: 3 - Url: 28 - Path: 15 - Hash: 12 💽Software: Linux, OpenSSH, WinRAR, Active Directory, Windows service, macOS 🔢Algorithms: ed25519, base64, aes 📜Programming Languages: powershell 💻Platforms: x86 #threatreport: On July 16, 2025, Russia-aligned group UAC-0099 gained access to a Ukrainian grain logistics company through a spearphishing email containing a malicious attachment. The intrusion executed a scheduled task named `pdfopentask`, which ran a PowerShell payload from `%TEMP%\temporarydoc.txt`. This led to deployment of MATCHBOIL, a downloader that installed the MATCHWOK backdoor. MATCHWOK was persisted through the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key using the value `UpdateMonitor`. On July 17, UAC-0099 deployed MythicRatatoskr, a previously undocumented Go-based backdoor. Additional samples were later transferred to other systems through an OpenSSH SFTP server. MythicRatatoskr was installed as a Windows service named `ieupdate`. The malware can collect usernames, hostnames, and local network information; execute commands; navigate the filesystem; upload and download files; capture screenshots; and establish proxy connections. It likely enabled deployment of a separate Go-based SOCKS5 tool, internally named `bindProxy`, which listens on `127.0.0.1:33690`. Together, the tools supported forward and reverse proxying through the compromised environment. MythicRatatoskr communicates with its command-and-control server through the Yggdrasil decentralized mesh network rather than directly over the conventional internet. It embeds a base64-encoded list of 32 public Yggdrasil peers, randomly selecting three to join the network. Each execution generates a new Ed25519 key pair and therefore a new Yggdrasil IPv6 address. The malware communicates with its C&C server over HTTPS on port 443, using task polling, result submission, check-in, and file retrieval functions. Its configuration is stored as AES-256-CFB-encrypted JSON using a hardcoded key, while embedded defaults allow operation without a pre-existing configuration. Unix-style hidden configuration paths and unused testing paths indicate that Linux or other Unix variants may exist. Approximately two months later, on September 17, Sandworm used access within the organization to conduct a destructive operation. The attackers deployed SDelete through Active Directory Group Policy to wipe data, matching previously observed Sandworm tactics. The activity indicates that UAC-0099 may function as an initial access provider for Sandworm, although it remains unclear which group primarily operated MythicRatatoskr.

#threatreport #MediumCompleteness ConnectWise Breach Storm-0940 Probed 2,250 M365 Tenants With ARTEX AI | 23-10-2026 Source: secureblink.com/threat-feeds… Key details below ↓ 🧑‍💻Actors/Campaigns: Storm-0940 (🧠motivation: financially_motivated) Scarlett_ransomware 💀Threats: Artex_tool, Supply_chain_technique, Password_spray_technique, 🎯Victims: Microsoft 365 tenants, Financial services, Aerospace and defense, Energy, Government, Legal, Semiconductors, Think tanks, Policy organizations, National security organizations, ... 🏭Industry: Energy, Aerospace, Semiconductor_industry, Government 🌐Geo: Japanese, South korea, Korean, China 🔓CVEs: CVE-2026-109619 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) CVE-2026-109618 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 10 🧨IOCs: - IP: 2 - File: 1 💽Software: Microsoft 365, SharePoint, Office 365, LastPass, PHP2Shell 📜Programming Languages: python, php 💻Platforms: intel #threatreport: Microsoft attributed the ConnectWise Cloud Backup breach to China-aligned threat actor Storm-0940. The compromise affected a multi-tenant Microsoft 365 backup application formerly known as SkyKick. Customer tenants had consented to a service principal with broad access to email, files, Teams, directory data and other Microsoft 365 resources. Between October 10 and 21, the actor attempted access to more than 2,250 tenants, generating up to 2,900 sign-in attempts per minute. Microsoft recorded approximately 151,000 failed user sign-ins against 327 accounts, while Huntress identified unauthorized application sign-ins in at least 162 tenants, later reported as 173. After gaining access through the application identity, the actor conducted Microsoft Graph reconnaissance, modified application credentials, and attempted to alter users, groups and privileged roles. In at least one tenant, the actor read secrets from multiple Azure Key Vaults, enumerated keys and performed a key-unwrapping operation. Huntress observed persistence through newly created client secrets and privilege escalation. One compromised Teams Cloud Management application added itself to Global Administrator, while scripts added secrets to other registered applications. Several of the secrets were configured to remain valid until 2028, potentially preserving access after the original vendor credential was revoked. Microsoft said Storm-0940 used the ARTEX multi-agent framework to automate reconnaissance, password spraying and OAuth abuse. The framework is described as an open-source Go-based system capable of conducting penetration-test activities with limited human input, although public evidence directly linking individual activity to ARTEX remains limited. The observed tenant traversal and application changes also showed characteristics of conventional scripting. Storm-0940 has historically used password spraying, exploitation of internet-facing services and OAuth application credentials to maintain access and collect mail and files. Separately, Scarlettgroup claimed it had obtained data from 5,926 Rajasthan Police mailboxes, including 8.63 million emails and 70,301 identity records. Police were investigating, but the claims were not independently verified. Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, were reported as enabling unauthenticated remote code execution on web servers. Both were assigned a CVSS score of 9.2, with more than 22 million potentially exposed instances.

#threatreport #MediumCompleteness Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) | 21-10-2026 Source: sophos.com/en-us/blog/proof-… Key details below ↓ 💀Threats: Mirai, Potassium, Supply_chain_technique, 🎯Victims: Php installations, Php powered systems 🔓CVEs: CVE-2026-109619 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) CVE-2026-109618 \[[Vulners](vulners.com/cve/CVE-2026-109…)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - php (<8.2.35, <8.3.36, <8.4.27, <8.5.12) 🤖LLM extracted TTPs:` T1027, T1071.001, T1105, T1190, T1498 🧨IOCs: - IP: 4 - Domain: 3 - Url: 1 - Hash: 1 💽Software: PHP2Shell, Linux 🔢Algorithms: sha256, sha1, md5 📜Programming Languages: php #threatreport: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are critical flaws rated CVSS 9.2. PHP stated that all installations serving web requests are potentially at risk and released updates on October 21, 2026. Public proof-of-concept exploit code is available, and exploitation viability has been confirmed, although successful remote code execution depends on the PHP version, deployment architecture, and configuration. Sophos telemetry identified scanning and a small number of failed exploitation attempts, but the latest assessment found no evidence of successful compromise attributable to these vulnerabilities. Earlier reporting of successful exploitation was corrected. The observed activity originated from 45.198.224.169 and used HTTP characteristics including a scanning-related User-Agent, a multipart boundary, and a distinctive POST request pattern. Sophos countermeasures prevented delivery of the follow-on payload. The intended payload appears to be an updated Mirai-derived botnet variant known as Potassium. The sample includes downloader, network-disruption, and DDoS capabilities. It resolves an encrypted, hard-coded command-and-control address, connects to 134.199.154.64 over TCP, and sends an HTTP request. It expects an HTTP 200 response and verifies that the retrieved content begins with the ELF magic bytes `7F 45 4C 46`, indicating a Linux executable. Its resolver supports IPv4 and hostname lookups, with fallback use of public DNS servers including 8.8.8.8, 1.1.1.1, and 1.0.0.1. In the observed execution pattern, a payload was written to `/tmp/nfs` and launched as `./nfs php`. Defenders should patch affected PHP installations, with updating identified as the only complete remediation. Where immediate patching is not possible, internet-facing PHP services should be isolated or protected with network-layer authentication. Monitoring should focus on unusual PHP-service network sessions, unexpected or misspelled process names, suspicious low-volume inbound connections, and execution of binaries from temporary directories.

#threatreport #LowCompleteness M365 Token Spray and Replay Campaign Compromises Business Email Accounts | 22-10-2026 Source: huntress.com/blog/token-repl… Key details below ↓ 💀Threats: Aitm_technique, Bec_technique, Password_spray_technique, Device_code_phishing_technique, Spear-phishing_technique, 🎯Victims: Microsoft 365 accounts, Business email accounts, Affected organizations 🌐Geo: Germany, German 📚TTPs: ⚔️Tactics: 5 🛠️Technics: 7 🧨IOCs: - IP: 11 - Domain: 0 - Url: 0 - Hash: 0 - Email: 0 - BrowserExtension: 0 💽Software: Microsoft 365, Microsoft Entra, Microsoft Office, SharePoint, macOS, Outlook, Office 365 💻Platforms: apple #threatreport: Between July 14 and September 22, 2026, a threat actor conducted a Microsoft 365 token-spraying and replay campaign affecting 79 organizations. Huntress identified 497 successful sign-ins among more than 200,000 failed attempts. The attacker primarily replayed authentication tokens stolen through adversary-in-the-middle (AiTM) phishing relays, device-code phishing, and social engineering. Because the tokens were issued after successful MFA, they enabled access without requiring the attacker to complete MFA again. The stolen sessions were replayed from infrastructure associated with German hosting provider 1337 Services GmbH, primarily the 193.26.115.0/24 range. The actor rotated among multiple addresses, including 193.26.115.221, .199, .16, .21, .72, and .210, complicating IP-based blocking. In some cases, the replay occurred within minutes of the victim completing MFA. The campaign used several access methods, including Microsoft Office and Authentication Broker clients, OAuth2:Token requests targeting Microsoft Graph, SharePoint Online access, device registration, and automated Node.js or browser-based sessions. Post-compromise activity included registering at least 48 unauthorized Entra devices, often using names such as DESKTOP- followed by eight hexadecimal characters. The attackers also removed and replaced victims’ MFA methods, created new enterprise application access, and established hidden inbox rules. These rules frequently moved or deleted messages, marked mail as read, or filtered payroll and banking-related communications. Some rules were created through the Outlook REST API from VPN or rented hosting providers. In at least one case, a compromised mailbox sent a payroll-related message to an external recipient; another account sent spam to hundreds of recipients. Containment requires revoking the user’s sessions and resetting the password, since password resets alone may not invalidate active tokens or remove attacker-registered devices and MFA methods. Defenders should audit Entra devices, MFA changes, inbox rules, OAuth2:Token and device-registration activity, and suspicious enterprise applications. Conditional Access should require MFA or block access across users, cloud applications, and client types, while device-code authentication should be restricted with authentication-flow policies.

#threatreport #LowCompleteness New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack | 23-10-2026 Source: socket.dev/blog/litellm-atta… Key details below ↓ 💀Threats: Supply_chain_technique, 🎯Victims: Litellm, Pypi, Docker 📚TTPs: ⚔️Tactics: 1 🛠️Technics: 0 🤖LLM extracted TTPs:` T1059.004, T1071.001, T1074.001, T1078, T1132.001, T1195.002, T1528, T1539, T1552.001, T1567, ... 🧨IOCs: - File: 1 - Url: 2 💽Software: LiteLLM, Docker, curl, AWS Bedrock, PostgreSQL, Redis 🔢Algorithms: base64 #threatreport: An attacker gained access to LiteLLM’s GitHub organization at least 11 days before the October 21, 2026 supply-chain attack that published malicious PyPI and Docker artifacts. Two malicious GitHub Actions workflows were added as `.github/workflows/cache.yml` under the commit subject `ci: bump cache config`. Commit `b69bc36` was pushed on October 10 from branch `ci-tmp-a351cc`, and commit `1a6e3c1` was pushed on October 12 from branch `ci-tmp-4d8517`. Both workflows executed successfully, after which their branches were deleted. The workflows were designed to steal GitHub, repository, organization, and environment secrets. The October 10 workflow read six organization-level secrets, including `GH_TOKEN`, Linear and LiteLLM API keys, a GitHub App ID and private key, and a Together AI API key. It wrote the values to a temporary file, base64-encoded the contents, and exfiltrated them with `curl` to a webhook.site endpoint. The command used `|| true` to suppress errors, allowing the workflow to report success even if transmission failed. The October 12 workflow expanded collection across six jobs. Five jobs bound GitHub Environments to access additional secret scopes, while another collected organization and repository secrets. Targeted data included cloud and model-provider API credentials, GitGuardian access, Linear session cookies, PostgreSQL connection details and credentials, Redis credentials, a Tavily API key, and an internal notification webhook URL. Each job sent encoded data to a webhook.site collector using identifying HTTP headers. Repository activity records attribute the branch creation, pushes, and deletions to the `ishaan-berri` account, although the commits were unsigned and the available evidence does not establish whether the account itself, an access token, SSH key, or OAuth grant was compromised. LiteLLM reported that an unrevoked Agent Platform master key, accidentally exposed in May, was used to obtain a GitHub organization owner token. The organization linked the `GH_TOKEN` stolen by the October 10 workflow to approval of the later malicious release. The full duration of access, the number of additional workflows, successful data receipt, and subsequent use of stolen credentials remain unconfirmed.