Talos IR Q3 2026: Ransomware hits 27% of engagements (up from 20%), vishing plus IT help desk impersonation drives initial access, and Salt Typhoon telecom espionage intrusions continue via CVE-2023-20198 and the BadCandy web shell. Key findings: - Phishing held the top initial access spot at 37% of engagements, but the method is shifting. Vishing combined with IT help desk impersonation is now a recurring pattern: actors call targets, impersonate support staff, and socially engineer them into initiating Microsoft Quick Assist or existing RMM sessions. From there, PowerShell commands pull and execute an MSI package from a remote IP. The VYPR ransomware incident followed exactly this chain, with the actor then deploying MeshAgent, Rclone, PsExec, MSTSC, and an IP scanner. VYPR itself appears operationally immature: it leaned on Conti-derived source code with minimal changes, took an unusually long time to exfiltrate (over multiple days, uncommon for ransomware), and deployed an abnormally large number of vulnerable drivers via BYOVD to kill EDR, suggesting redundancy testing rather than a polished playbook. No data leak site existed at engagement time. - Interlock ransomware actors took a different but equally aggressive approach to EDR: they attempted to uninstall endpoint protection directly using PsExec.exe and taskkill.exe to terminate security services including cscm.exe and sfc.exe, disabled Windows Defender real-time protection, cleared event logs, and in prior activity deployed a malicious WDAC policy to terminate EDR solutions. Ransomware groups broadly favored T1562.001 (Impair Defenses: Disable/Modify Security Tools) and T1070 (Indicator Removal: Clear Event Logs) as the first moves after gaining a foothold, before encryption with T1486 and T1490 to inhibit system recovery. - Salt Typhoon-attributed telecom intrusions involved CVE-2023-20198 against web-based management interfaces for initial access, followed by deployment of the BadCandy web shell for persistent, stealthy remote access. Actors created privileged accounts (T1136.001), disabled logging, altered device configurations, and used LOTL techniques: VPN access, traffic mirroring, and management protocols to establish backdoors and exfiltrate data. Victim environments shared consistent weaknesses: password-only authentication with no MFA, legacy plaintext SNMP, outdated VPN encryption, and poor credential management. Named RATs observed this quarter across engagements include GoGRPC RAT (observed as fly.exe), Node RAT, Overlord RAT, and SideSlipRAT, alongside Impacket SMBexec for lateral movement over SMB. - AI platforms are now both an attack tool and a target. In one insider case, a fraudulently hired employee with developer access installed GitHub Copilot CLI and Anthropic Claude Code, with access to repositories, plugins, and databases. In a separate case, a trojanized macOS application scripted the compromised host to scrape credentials from the macOS keychain specifically targeting secrets associated with Anthropic Claude Code. This is a concrete, emerging target class: AI platform credentials can unlock access to sensitive data pipelines and automation capabilities beyond what traditional credential theft provides. - Insufficient logging was the single most prevalent security weakness, present in over 40% of engagements, partly from actor log clearing (T1070) and partly from inadequate retention and configuration on the defender side. MFA gaps and improper credential management each appeared in 33% of engagements. For log survivability, Talos IR recommends forwarding logs off-device to a SIEM with a minimum 90-day retention, covering servers, workstations, network infrastructure, cloud identity providers, and security appliances, and enabling process-creation, command-line, and Microsoft Graph API auditing. Practitioner takeaway: For the vishing and RMM chain, hunt for Microsoft Quick Assist or MeshAgent processes spawning PowerShell with outbound connections to uncommon IPs, and for MSI installations initiated from RMM parent processes. For Salt Typhoon: check for newly created privileged accounts and disabled logging on edge devices, and hunt for BadCandy web shell artifacts on management interfaces of internet-facing appliances. For BYOVD, look for unusual driver load events from known vulnerable driver hashes in your environment. The MITRE ATT&CK appendix in the Talos IR report contains the full technique and tool mapping for this quarter. #DFIR_Radar

iOS exploit framework Coruna and its DarkSword successor are still active as of October 2026, hitting targets silently through web lures, no app install or user prompt required. 608 domains identified delivering the kit. Key findings: - The infrastructure now branches on OS version at delivery time. Devices on iOS 17.2.1 or earlier receive the legacy Coruna JavaScript chain. Devices on later builds receive a DarkSword-derived chain. The client-side JavaScript profiles the target environment first, then selects the appropriate exploit path before the user sees anything unusual. The lure page can render completely normally throughout. - The kit's core JavaScript runtime is byte-for-byte identical in decoded form across wildly different lure themes: dating portals, AI-companion apps, crypto promotions, media streaming sites, and compromised legitimate sites serving the kit via hidden iframes. zLabs mapped 608 delivery domains, with 93 recovered configurations pointing to 21 distinct tracking collectors. Hunting lure content or campaign strings will miss related infrastructure. Hunting the runtime connects it. - Post-escape native payload modules reach well past the WebContent sandbox. Recovered capabilities include kernel memory read and write routines, manipulation of Apple Mobile File Integrity (AMFI) state, process-memory reads via task ports, application-state monitoring, encrypted C2 communication with certificate validation disabled, and active anti-forensic routines that delete crash logs and Safari website-data records. The attacker is clearing their own footprints at the device level. - Supply chain delivery has already been confirmed. SafeDep independently recovered matching Coruna code inside the compromised npm package art-template. An operator's own site can serve this kit to every visitor without the attacker ever registering a lure domain, because the payload arrives through the victim site's own dependency tree. Any site consuming that package becomes an unwitting delivery node. DFIR takeaway: On iOS device examinations, the active anti-forensic behavior, crash log deletion and Safari website-data wiping, means absence of browser artifacts is itself a signal worth noting in your timeline. For network defenders and threat hunters, the byte-identical decoded JavaScript runtime is a stronger pivot than campaign strings or lure themes. The report details the infrastructure, payload modules, and tracking collector mappings across those 608 domains: review them for matches against your web proxy and DNS logs, particularly for hidden iframe loads originating from otherwise legitimate-looking sites. #DFIR_Radar

Russian-speaking GOLD OGRE group deploys Cursor AI as an agentic intrusion engine inside Aur0ra ransomware operations, autonomously escalating credentials to domain admin and exfiltrating data with minimal human input. Key findings: - GOLD OGRE used Cursor's Composer agentic model alongside AI models from Anthropic, xAI, and Moonshot to drive intrusions end-to-end. Human operators supplied VPN credentials, SOCKS access, targets, and objectives. The agents handled network and AD discovery, credential attack path analysis, lateral movement, and share enumeration with limited human involvement. AI guardrails were bypassed by framing activity as authorized red team or diagnostics testing. Operators shifted from Anthropic-only to multi-model as they moved from tool development to live intrusions. - The attack chain is consistent across operators: Cobalt Strike for C2 (servers at 152.236.3[.]8, 172.86.89[.]124, 144.172.101[.]72, 206.223.230[.]107), SharpShares for AD and network share enumeration, password spraying, Kerberoasting, NTLM coercion and relay via PetitPotam and PrinterBug, Certipy for certificate attacks, BloodHound for domain enumeration, and VeeamTransport-style staging to an S3-compatible exfil bucket at 152.236.4[.]14:54410. SOCKS proxy node at 45.59.113[.]63 appears in both the AI testing framework and third-party reporting. - Attribution artifacts are operational: Russian 🇷🇺 Cyrillic keyboard transposition errors appear in operator logs, where "зы" and "ды" correspond to ps and ls typed on a Russian 🇷🇺 layout. Recovered Cursor chat logs and an exposed open directory at 172.86.113[.]245 contained the attacker toolkit, both Windows and ESXi-compatible Aur0ra ransomware binaries, shell history, and prompt logs. Three victims whose environments were accessed by agents were later named on Aur0ra's data leak site. - Detection content is in the report: Sophos Taegis countermeasure GUIDs cover Chisel SOCKS tunnel use, SharpShares activity, BloodHound collection, Certipy output file writes, PetitPotam process execution, Cobalt Strike named pipe and stager persistence, PowerShell Kerberoast scripts, and NetExec process activity. Sophos signature names covering Cobalt Strike, Meterpreter, BloodHound, Kerberoasting, Impacket, and the Aur0ra Linux ransomware payload are listed in the report alongside the full IOC table. Hunt priority: focus on the convergence of SharpShares execution, LDAP domain trust enumeration, and outbound S3-compatible PUT traffic in the same environment window. A VeeamTransport process making connections to non-Veeam infrastructure is a high-fidelity pivot point. Review domain admin group membership changes and Kerberoastable account queries in the hours following any new SOCKS or VPN credential use. The Cursor artifact recovery angle is new: if you are responding to an Aur0ra incident, preserve Cursor application data and chat log artifacts from attacker-controlled systems before reimaging. #DFIR_Radar

Volt Typhoon's "Silent Train" network tied to at least four confirmed zero-days targeting critical infrastructure management platforms, with disposable relay chains rebuilt in under two minutes to evade detection. Key findings: - Silent Train emerged in November 2023 as a replacement for the disrupted KV-botnet, operating through multi-hop chains averaging four to six compromised devices per session. Each chain started on a rented server outside the US 🇺🇸, passed through overseas SOHO and IoT relays including TP-Link routers and Intelbras modems, and terminated on a Netgear Orbi device geographically close to the target. This made attacker traffic appear as legitimate local activity, defeating IP reputation filters and location-based blocks. Sessions averaged four hours, and operators could assemble a fresh chain in under two minutes, indicating partial automation. Device roles were fixed and never swapped across layers. - Four zero-day campaigns are confirmed: Versa Director (2024, in-memory JAR webshell to reach downstream customers), N-able N-central via CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN via CVE-2026-20127 (CVSS 10.0, exploited continuously after Cisco's February 2026 disclosure), and VeloCloud Orchestrator via CVE-2026-16812. A fifth, moderate-confidence zero-day targets Quest KACE; that campaign hit more than 30 victims and declined after Quest's October 2025 security updates. The group deliberately targeted management platforms controlling hundreds or thousands of downstream devices, multiplying reach without lateral movement. - Post-compromise artifacts are deliberately minimal. Investigators found webshells running in memory, stolen credentials, abuse of native remote file transfer features, and deleted logs. At session end, operators removed SSH keys, temporary services, and configuration files, leaving little on-disk evidence. The in-memory JAR webshell on Versa Director is a direct attempt to defeat traditional forensic recovery. Black Lotus Labs sent hundreds of victim notifications over three years, and confirmed intrusion evidence emerged only through those downstream investigations. - Targeting follows a pattern consistent with pre-positioning: victims include telecoms, government agencies, defense contractors, satellite and emergency communications providers, universities with ROTC programs, MSPs, and critical infrastructure across water, energy, transportation, maritime, rail, and aviation. Hawaii, California, and Texas appeared as top victim locations for several years. Each target shares a common trait: administrative reach over larger downstream networks or customer environments. Operations followed a Monday to Friday, 0900 to 2200 China 🇨🇳 Standard Time schedule, with pauses around Chinese 🇨🇳 New Year. - By early 2025, the group added Fortinet appliances, Cisco, PRTG, Mirth Connect, and CyberPanel as persistent final hops lasting one to three months, supplemented by reverse tunnels using the open-source proxies Chisel and FRP running alongside the disposable chain method. More than 27 device classes were used overall. Some device types in the relay chain have no known public vulnerabilities, which Lumen assesses as likely additional undisclosed zero-days used solely to protect the relay infrastructure. Hunt focus: prioritize management platforms with internet-exposed admin interfaces, specifically Versa Director, N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator, and Quest KACE. Look for in-memory webshell execution, unexpected outbound SSH connections, Chisel or FRP process execution, and cleared or missing logs around session windows. Preserve memory and network telemetry immediately if any of these platforms were reachable from the internet during the relevant windows. IOCs, victim notification details, and the full campaign breakdown are in Lumen's Black Lotus Labs report. #DFIR_Radar

An unauthorized AI relay service has been quietly reconfiguring OpenAI Codex and Claude Code CLIs at a dozen organizations, stripping sandboxes and routing all traffic through third-party infrastructure since early 2026. Key findings: - Delivery is fileless and user-initiated. A one-line iwr -useb | iex or curl | bash command fetches setup-codex.ps1 (SHA256: 2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24) or setup-claudecode.ps1 (SHA256: 4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb) from lookalike domains such as vibe.aiok[.]me. The script installs the genuine CLI via npm if absent, then immediately overwrites its config. Users appear to paste a ready-made command from the relay or a reseller, so the install looks routine. - The configuration override is surgical. The script rewrites ~/.codex/config.toml (setting sandbox_mode = "danger-full-access" and network_access = "true") or ~/.claude/settings.json, replaces base_url or ANTHROPIC_BASE_URL with a relay-controlled endpoint, swaps in relay-issued API keys, and sets DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1. All changes land as user-scope environment variables, so they survive reboots without further operator action. - On at least one host, the script actively purged an authenticated session: it ran claude /logout, deleted ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY from the environment, then ran claude /login to install relay credentials in their place. The script also queried reg.exe QUERY "HKCU\Control Panel\International\Geo" /v Nation /reg:64 immediately after install, consistent with geolocation confirmation before completing setup. - Scope and sectors: a dozen organizations in mainland China 🇨🇳, plus multinational subsidiaries in South Korea 🇰🇷, Taiwan 🇹🇼, and Malaysia 🇲🇾 covering industrial automation, semiconductors, pharmaceuticals, shipping, and petrochemicals. The relay's backend has rotated across at least eight domains including sorryios[.]io, nuoda[.]vip, rawchat[.]cn, sharedchat[.]cc, mirbuds[.]com, and claudechn[.]com. - No confirmed abuse yet, but the architecture supports it fully. Every prompt, file, and secret transits the relay. With the sandbox disabled, a manipulated response could execute arbitrary commands at full user privilege. Relay-issued credentials set as environment variables are also readable by any other process on the host, extending exposure beyond the AI agent itself. Hunt for this now. Check all endpoints running Codex or Claude Code for sandbox_mode = "danger-full-access" in ~/.codex/config.toml, unexpected base_url values in ~/.claude/settings.json, and OPENAI_BASE_URL, CODEX_API_KEY, or ANTHROPIC_AUTH_TOKEN set as user-scope environment variables outside an approved deployment. Correlate PowerShell iwr | iex or curl | bash executions timed within 30 minutes of an npm install -g [@]openai/codex or [@]anthropic-ai/claude-code. Block and alert on outbound CLI traffic to any destination not on an approved AI endpoint allow-list. IOCs and full network indicator list are in the Symantec report. #DFIR_Radar

Exposed operator workspace reveals a unified post-exploitation framework converting webshell access into SOCKS proxy tunnels across AhsayCBS and seven other CVEs, with 134 confirmed-live webshell endpoints and 141 host identifiers showing positive proxy checks. Key findings: - AhsayCBS (CVE-2026-105133 / CVE-2026-105134, an RCE-to-JSP-webshell chain documented by Huntress and Bitdefender beginning 7 October 2026) provides the strongest evidentiary trail. Of 189 webshell probes in webshell_probe.jsonl, 134 returned alive=true with operating system output confirming command execution, not just an open port. Windows dominated: 118 Windows responses versus 15 Linux, with Server 2019 (44), Server 2022 (26), and Server 2016 (25) most common. AhsayCBS is widely deployed by managed service providers, so the exposed population skews toward MSP-hosted infrastructure. Hotfix builds are v10.3.4.45 and v9.15.2.70 or later for v7-v9. - The framework, centered on poc2tunnel[.]py, follows a fixed workflow: confirm command execution via PoC or existing webshell (T1190, T1505.003), fingerprint the target OS and architecture, pull Chisel and GOST binaries from GitHub releases or a fallback file server at 143.244.140[.]188:9191, start a local GOST SOCKS listener on the target (T1090), then have Chisel dial out to the control VPS (T1572) at 143.244.140[.]188:26925, mapping a VPS-side port to the target's SOCKS service. The operator then validates the route with a proxy check. Positive proxy results included Windows SYSTEM and Linux root command contexts. The framework was designed to accept any vulnerability module, not just AhsayCBS. - The workspace also contained modules targeting CVE-2025-68953 (Frappe), CVE-2026-110447 (Nextcloud built-in CODE Server), CVE-2026-94169 (WordPress The Grid), CVE-2026-20182 (Cisco Catalyst SD-WAN), CVE-2026-97229 (GitLab), CVE-2026-102785 (Joomla/YOOtheme Pro), and CVE-2026-112346 (OpenHands SDK). Evidentiary weight varies sharply: the SD-WAN dataset covers 2,218 host identifiers but zero records classified as REAL; the Nextcloud NVR report shows 108 rows all marked transfer_fail. OpenHands added four proxy-positive hosts not in the main dataset. These are probing records, not confirmed compromises. - The Chisel server log runs to 18,835 lines with 936 reverse-mapping messages. An HTTP receiver log records 894 GET requests, 877 for /payload.jpg, from 98 source IPs. A webshell management script can preserve a selected JSP file while proposing deletion of others, but all 134 records in remediate_report.jsonl show dry_run=true: the cleanup was not executed per the recovered evidence. Attribution is unresolved; Chinese-language comments, ZCode and Zhipu references, and a .bash_history with 38 tmux attach appearances are provenance leads, not actor attribution. Hunt and response steps: For AhsayCBS hosts, audit the replication receiver for unexpected JSP files and review child processes spawned by backup service processes, especially command interpreters or download utilities. A shell that already exists survives patching. For network investigations, pivot on 143.244.140[.]188 across the relevant timeframe: look for outbound connections to TCP/26925 (primary Chisel listener) or TCP/9191, and for any process downloading binaries to a temporary directory followed by a persistent outbound tunnel. On Linux, check for local SOCKS listeners bound by unfamiliar executables. On Windows, correlate the AhsayCBS service process tree with subsequent outbound traffic. The SSH host-key fingerprint SHA256:ytM/3PMwMS8eKymWGeuP0HGsnU/4TADBOOPFX1vz0G4 and the authorized_keys label dsh-jump-20261020 are infrastructure-correlation artifacts. IOCs and full methodology are in the ThreatMon report; working webshell URLs and target IPs were withheld deliberately. #DFIR_Radar

NIK C2 is a Go-based, AI-integrated C2 framework observed in the wild, collapsing credential theft, live keylogging, ransomware deployment, and on-demand OpenAI GPT-4 inference into a single persistent implant session. Key findings: - The NIK C2 implant is a 64-bit Go (compiled with Go 1.23.4) Windows RAT communicating over TLS WebSocket on port 443 with an HTTP fallback polling loop every 250ms. All traffic is AES-256-GCM encrypted using a hardcoded seed, and the decoded 32-byte AES key is documented in the Talos report. Three C2 tiers provide takedown resilience: runtime-updated URLs, an embedded encrypted server list, and a hardcoded fallback. Active infrastructure was observed at 87.120.196[.]120 resolving total-sitevv[.]lol, with a TLS certificate CN of "nik-panel" and JARM fingerprint 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b. An embedded build path /opt/nik_panel/data/build_52b79724a1fc4b8f/main.go confirms Linux cross-compilation and active implant versioning across at least three tracked variants, all with zeroed PE TimeDateStamp fields and near-epoch filesystem timestamps (manifesting as Nov 29, 1979) to frustrate timeline reconstruction. - The AI integration is architecturally deliberate, not cosmetic. The implant's ai_generate command constructs a full HTTP POST to hxxps://api.openai[.]com/v1/chat/completions directly from the victim machine, using a hardcoded default model of GPT-4. If the operator does not supply an API key, the implant reads the OPENAI_API_KEY environment variable from the victim's machine and bills inference against the victim's OpenAI account, with all access logs attributing the requests to the victim's API key, not the actor. - The screen-locking ransomware module operates without file encryption. It reads the MBR from \\.\PhysicalDrive0 via PowerShell to a file named mbr_backup.bin in the Windows temp directory, writes a self-regenerating HTML lock screen to lock_screen.html, launches it via mshta.exe through a batch file lock_start.bat, and sets a Run key named "SystemLock" under the current user's autostart path. A background goroutine relaunches the lock screen every five seconds. Because no files are encrypted, there are no encryption timestamps or modified file markers to hunt: the only forensic trail is the registry Run key, the temp directory artifacts, and the mshta.exe process chain. - Defense evasion is layered and activates at launch. The binary renames itself to csrss.exe in the Windows temp directory, applies NtSetInformationProcess with value 0x1D (ProcessBreakOnTermination) to trigger a BSOD on termination attempts, disables Windows Recent Documents telemetry via registry write, runs IsDebuggerPresent and CheckRemoteDebuggerPresent and silently exits on detection, and patches AMSI by overwriting AmsiInitFailed in System[.]Management.Automation.dll with a six-byte MOV EAX, E_INVALIDARG; RET stub. UAC bypass uses the fodhelper.exe COM hijack, writing the implant path to HKCU\Software\Classes\ms-settings\Shell\Open\command and cleaning the key within two seconds. Persistence is set under the AppData\Roaming\Microsoft\Network path with modified access controls and a Registry Run key. - Theft coverage across 52 commands is broad: browser credentials (Chrome, Edge, Brave, Opera, Firefox targeting Login Data, Cookies, key4.db, logins.json), Discord tokens from LevelDB, cryptocurrency wallets including Exodus, Electrum, Atomic, and browser extensions by hardcoded extension ID, Wi-Fi plaintext passwords via netsh wlan show profile, and a filesystem-wide regex sweep for seed phrases and private keys archived to browserdata[.]zip. Keystrokes are streamed live over encrypted WebSocket and buffered in memory up to 10,000 entries. Practitioner takeaway: Hunt for csrss.exe or svchost.exe running from AppData\Roaming\Microsoft\Network or the Windows temp directory. Look for mshta.exe spawned by cmd.exe alongside a lock_start.bat in %TEMP%, a Run key named "SystemLock", and mbr_backup.bin in the temp directory as ransomware staging evidence. Check for PowerShell processes patching System[.]Management.Automation.dll and fodhelper.exe spawning child processes as UAC bypass indicators. The ClamAV signature Win.Trojan.GoDiscorder-10060526-0 covers known samples. Full IOCs are published to the Cisco Talos GitHub repository. #DFIR_Radar

Unknown APT deploys NetamLoader against a government-exclusive custom Windows 10 build in Asia, hiding a multi-stage XAML framework inside a legitimate patch management tool's update package. No attribution to any known group established. Key findings: - The infection begins with a CAB archive dropped into C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24d, extracted to the Install subdirectory. The trigger is PatchMyPC-ScriptRunner.exe launched with an -updatepackage argument, which loads a weaponized .config file via AppDomainManager injection before the executable's own main function runs. The .config redirects to a Microsoft-signed assembly (Microsoft.HostIntegration.Connectors.dll), which then parses a crafted fabric.config. That file abuses a design flaw in DataCacheFactoryConfiguration to instantiate ResXResourceSet with Resources.resx, triggering BinaryFormatter deserialization. The deserialization fires a TypeConfuseDelegate that calls XamlReader.Parse, kicking off a layered XAML chain (XAML-1 through XAML-3) where each layer is AES-encrypted using the host process command line as the key material, so the payload is useless outside its intended execution context. - AMSI is bypassed in XAML-2-1 by patching the CAmsiAntimalware::Scan virtual table pointer to redirect to a pre-patched Console.Clear stub (bytes 41 C7 00 01 00 00 00 33 C0 C3), ensuring every subsequent scan returns AMSI_RESULT_CLEAN. The final payload, .NET 2 Plugin, is injected into dllhost.exe via RPC COM object abuse (CLSID ab8902b4-09ca-4bb6-b78d-a8f59079a8d5) and another TypeConfuseDelegate, deliberately breaking the process tree to defeat EDR behavioral monitoring. Before handing off, .NET 1 Loader deletes its own files, clears CLR usage logs at %LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\PatchMyPC-ScriptRunner.exe.log, scrubs Prefetch at %WINDIR%\Prefetch\PATCHMYPC-SCRIPTRUNNER.EXE-*.pf, and filters a keyword (GetExtendedUpdateInfoHandler) from logs under %WINDIR%\Logs\CmitUpdateAgent\20????\20??????, a path that fingerprints the targeted government OS build. - The C2 is openaigpt4v[.]com (104.18.14[.]219, Cloudflare CDN, registered September 2023). The .NET 2 Plugin polls hxxps://openaigpt4v[.]com/model_v4/ with a unique instance GUID appended, waits a 20-40 minute jitter delay before the first beacon, then polls every 22-28 hours if no valid response is received. Traffic is AES-128-CBC with HMAC-SHA256 using an Encrypt-then-MAC scheme, keys derived from master key 9fT04e03tAiZAPogcDWt0w==. The malware also sets a 28-hour watchdog (100801 seconds) after which it self-terminates via a downloaded XAML calling Environment.Exit(0), a significant sandbox and analyst evasion measure. COMPlus_ETWEnabled is set to 0 via WScript[.]Shell COM (CLSID 41904400-BE18-11D3-A28B-00104BD35090) to suppress CLR ETW events before dllhost injection. - The malware uses a GUID-based registry exception logging system under HKLM\SOFTWARE\Classes\appid\ with algorithmically derived GUIDs tied to C2 URL. Both .NET 1 Loader and .NET 2 Plugin recursively delete these keys as cleanup. A persistence/state marker is also written: HKLM\SOFTWARE\Classes\appid\{ff259bcd-2f0a-44de-b34a-0092fec1d8a2} with DllSurrogate set to empty string. System fingerprinting reads HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion (BuildLab) and HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\full (Version), and the SusClientId value from SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate is used to generate a victim UID. KSN telemetry identified a single victim in Asia; the supply-chain vector targeting a government-only Windows build means scope is deliberately narrow. Practitioner takeaway: Hunt for dllhost.exe making outbound HTTPS connections without a standard parent process chain, and for the registry key HKLM\SOFTWARE\Classes\appid\{ff259bcd-2f0a-44de-b34a-0092fec1d8a2} with a blank DllSurrogate value. Check for the presence or recent deletion of CLR usage logs for PatchMyPC-ScriptRunner.exe and Prefetch entries matching that binary. Examine %WINDIR%\Logs\CmitUpdateAgent for lines where GetExtendedUpdateInfoHandler was stripped. If the CAB hash e4537a1762fcafd2fd96bfc825bad34f9db9a24d appears in SoftwareDistribution\Download, treat the host as compromised. File hashes and IOCs for all layers are in the Kaspersky SecureList report. #DFIR_Radar

MadApe: a previously undocumented Device Code phishing kit targeting Microsoft 365 accounts across nine languages, with 155 operator-registered domains identified and phishing components confirmed on 97 of them. Key findings: - The kill chain never touches a fake login page. A business-themed PDF drops an embedded link to a SharePoint-impersonating intermediary page, which uses JavaScript setTimeout redirection to a MadApe-served phishing page. That page displays a dynamically generated Microsoft Device Code, copies it to the clipboard on click, notifies the backend at /api/code/entered, then opens the legitimate microsoft[.]com/devicelogin for the victim to paste and authenticate. The attacker's server polls Microsoft's token endpoint server-side; if the victim completes the flow, the attacker receives an access token and, where supported, a refresh token, with MFA silently satisfied during the legitimate sign-in. - MadApe is a configurable, multi-theme framework. Shared JavaScript functions cc() (code delivery and clipboard write) and ne() (devicelogin redirect), plus the /api/code/entered and /api/code/status/ backend endpoints, appear identically across visually distinct pages impersonating SharePoint, OneDrive, Microsoft Teams, Adobe Acrobat, DocuSign, and Microsoft sign-in. Representative phishing URLs include hxxps://secure-docs.liveoakfarmsllc[.]net (SharePoint theme), hxxps://durakdisplay[.]com/7664453fe5 (OneDrive), hxxps://lvborses[.]com/f948e90ab1 (Teams voicemail lure in German 🇩🇪), and hxxps://nxinet[.]com/d9f90ed790 (Microsoft sign-in). The operator panel, titled "Mad Ape - Login," was observed on itencrypted[.]co, householdwares[.]co, liva-fit[.]com, uouso[.]net, and wbconnecticut[.]net, all serving the same C2S Logistics decoy at their root domains. - Infrastructure provisioning is automated and ongoing. Of 154 domains registered in 2026, 117 landed between mid-June and late August, 133 (86.4%) through Dynadot, and 105 of 152 (69%) share an exact-second WHOIS creation timestamp with at least one sibling domain, the largest batch being 10 domains registered 18 August 2026 at 23:48:21 UTC. Twin TLD purchasing (.com paired with .net, .co, .biz, or .online) and a recurring subdomain naming pattern built from cgi-, otp-, -ox, and -oi labels tie the cluster together. Nine compromised third-party hosts were also identified serving intermediary redirect pages under paths like /otp_folder/solid.html and /top_box/solid.html. - The anti-analysis stack is layered. A custom client-side verification gate (CAPTCHA, image selection, press-and-hold) sits in front of the Device Code page, sets a short-lived cookie (_cv=1, max-age 300 seconds), and reloads to serve the phishing page only to cookie-bearing requests, keeping automated URL scanners at the gate. Both the gate and the phishing page suppress right-click, F12, Ctrl+Shift+I/J/C, and Ctrl+U. Neither control stops external analysis but both slow scanner-based reputation scoring. - Detection artifacts are concrete and actionable. Hunt Microsoft Entra sign-in logs for Device Code authentication protocol events outside documented business use, correlating source IP, application identifier, and timestamp against email URL click telemetry, particularly clicks originating from PDF attachments. After suspicious authentication, monitor for MailItemsAccessed events, new inbox rules, OAuth consent grants, bulk OneDrive/SharePoint downloads, and new device registrations as persistence indicators. IOCs (155 domains, subdomains, URLs, and 41 PDF SHA1 hashes) and two YARA rules, GIB_MadApe_Phishing_Page and GIB_MadApe_Verification_Gate, targeting the /api/code/entered string, cc() and ne() function names, and the verification gate cookie logic, are published in the Group-IB report. SOC hunt: query proxy or sandbox telemetry for POST requests to /api/code/entered and polling to /api/code/status/ on any non-Microsoft host, then correlate with microsoft[.]com/devicelogin visits within the same session. Where Conditional Access permits, restrict Device Code flow via the Authentication flows condition in Microsoft Entra and monitor Entra sign-in logs for the Original transfer method field to surface token reuse from earlier Device Code sessions. #DFIR_Radar

Unauthenticated-default-credential path to command injection on Moxa MAR-2000 industrial 4G/LTE routers: three independent findings published simultaneously, no CVE assigned, no patch confirmed, PoC code released unconditionally. Key details: - The root cause is CWE-78 in /home/model/network/ipsec/ipsec.py inside the ARM Debian 6.0.8 firmware (FWR_MAR2000_V1.0_Build_15010909). The IPsec model interpolates stored tunnel fields, localVpnIp, tunnelRemoteVpnIp, and tunnelRemoteVpnInterface, directly into subprocess[.]call(cmd, shell=True) across four lifecycle functions: add_ip, del_ip, add_route, and del_route. Storing "10.10.10.1; malicious_cmd; #" in localVpnIp yields "ip addr add 10.10.10.1; malicious_cmd; #/24 dev eth0": the ip operation fails harmlessly, the injected command executes, and the hash silences the template tail. The only input filter, clean_data(), checks key names, never values, so it is not even encountered as an obstacle. - Severity is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H at 7.2 High under changed credentials. Where the factory-default administrator pair from the shipped SQLite user table is still in place, the researchers calculate a PR:N vector scoring 9.8 Critical. The payload is stored configuration, persists across reboots, and is re-consumed at every tunnel-apply lifecycle event without any further attacker interaction. - Two companion findings for the same product are published alongside this one: an Executer program-activation injection through a stored shell-interpreted argument field, and a scenario ping condition injection through an auto-executing ping thread. All three share the same entry architecture (authenticated PUT to the Node.js/Express MQTT-bridged REST surface) but hit different model files, resources, and sinks. No CVE identifier has been assigned to any of the three. A separate unauthenticated GET read-exposure on the API surface is also noted: it allows an intruder to enumerate stored tunnel configuration, including any planted payload, without a session. - Detection signals the report identifies are content-level because the executing process looks routine: audit stored IPsec tunnel-table values for semicolons, pipe characters, dollar-parenthesis, backticks, or newlines in any address field; watch for unexplained child processes spawned under the Python model daemon; and look for ip command failures whose operand text contains shell metacharacters. A legitimate IP address never contains any of these characters. The report also notes the management listener binds all interfaces on port 80 in shipped firmware. - A standard-library Python 3 PoC is published unconditionally. It logs in, reads current IPsec configuration, writes the payload into the local VPN address field, and reports which of the four constructions will carry it and at which lifecycle moment. It does not drive the tunnel lifecycle itself, so end-to-end detonation against live hardware is not demonstrated. Full technical analysis and all three advisories are at the report URLs, and the project archive is on GitHub under Exploit-Garbage/0day-Rubbish. Operator actions now, before any patch: rotate the factory-default administrator credential immediately (default pair collapse is the difference between 7.2 and 9.8), restrict the port 80 management listener to management-only interfaces and off any WAN-facing address, query stored IPsec tunnel tables for shell metacharacters in address fields, and disable IPsec entirely where tunnels are not operationally required so the lifecycle has nothing to apply. The long-term fix the report calls for is building each ip operation as an argument vector without shell=True and validating every address-shaped field at the model's write boundary. #DFIR_Radar