114,000 OSS artifacts per day. Around 4,618 reach LLM triage. Roughly 100 reach an analyst. In our latest blog post, @marius_benthin explains how we combine THOR Thunderstorm with LLM triage to monitor ten package registries and extension marketplaces without sending the complete feed to a model. - THOR Thunderstorm ⚡️ scans the full feed using deterministic detection logic - Only artifacts with THOR findings enter LLM triage 🤖 - The initial LLM stage costs an average of $2.88 per day - Suspicious or inconclusive cases reach an analyst - RuneAI is available on demand for deeper analysis of selected files The article covers the architecture, operating numbers, limitations and a real malicious VS Code extension detected by the pipeline. nextron-systems.com/2026/06/…

A reminder of how cool THOR Thunderstorm and its collectors are ⚡ Some systems will never run a security agent: ESXi hosts, network appliances, routers, industrial and out-of-support systems. They are still part of your attack surface. The trick: don't bring the scanner to the machine. Bring the machine's files to the scanner. - A collector (one Go binary, or one script in Bash, POSIX sh, Python, Perl, PowerShell or Batch) copies selected files to your own THOR Thunderstorm. The originals stay where they are. - You decide what leaves: recent files, a size limit, selected types. Preview it with a dry run first. - THOR does the heavy lifting on your server: YARA rules, your own signatures, IOCs, Sigma rules and forensic parsers. - Findings land in a log, in syslog or in your SIEM. Run it every night with cron or Ansible and ship only what changed. No agent. Often a shell and a network connection are enough. 93 seconds, no sound, video below (The findings in the film are illustrative) Collectors: github.com/NextronSystems/th… The written version: github.com/NextronSystems/th… #DFIR #ThreatHunting #IncidentResponse #YARA #Sigma

#APT28 is using weaponized Office documents to deliver the Covenant Grunt backdoor. We detected a cluster of seven malicious .docm and .xls files between July 8 and July 14, with some having AV detection ratios as low as 5/62 at the time of first submission. Our THOR APT Scanner's YARA rules caught what traditional engines missed. The documents use obfuscated VBA macros that assemble strings at runtime to evade static analysis, perform XOR-encoded host reconnaissance, and drop a 64-bit Covenant Grunt loader DLL disguised as a log file. The campaign uses Russian-language lures like "Прайс.xls" (Price List) and business-themed filenames like "accounts.xls", consistent with APT28 targeting patterns. Network analysis shows Dropbox being used as C2 infrastructure. This activity aligns with Zscaler's reporting on Operation NeuSploit (CVE-2026-21509). Analysis & IOCs: github.com/NextronSystems/io…

Our research team identified a second downloader variant linked to the WebSockets backdoor campaign recently analyzed by @dmpdump. While the original downloader was written in native C++, this new variant uses C# (.NET 8). Same seven payload files, same NVIDIA-themed disguise, but a very different implementation: no obfuscation, plaintext strings, and extensive retry logic designed to handle hours of unreliable connectivity. An interesting detail: it ships as a 14 MB self-contained .NET single-file executable. Open it in IDA and you'll mainly see the native .NET runtime host rather than the actual downloader logic. We've developed three new YARA detection rules covering both downloader variants and the WebSockets backdoor, and added them to our THOR scanners. You can explore the rules' matches on VirusTotal through our Valhalla pages: valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… Full technical analysis, decompiled source and IOCs: github.com/NextronSystems/io…

An Iranian threat actor is still running a GitHub-based loader with low detection rate on VirusTotal, six weeks after first submission. We went hunting after reading Unit 42's Blinder Tunnel report and found a new variant with infrastructure changes not covered in prior reporting: a Cloudflare Workers relay, a new GitHub account, and credential-rotation instructions hidden inside HTML comments on Microsoft/vscode issues, encrypted per-victim so only the targeted host can read them. The loader was delivered via an Inno Setup installer themed as a Dubai Airport careers IT assessment, targeting Iraq. Technical analysis + decompiled source + IOCs: github.com/NextronSystems/io…

Seven national blue teams used THOR APT Scanner at Locked Shields 2026, the world’s largest live-fire cyber defence exercise. We didn’t ask for flowers. We asked how it held up, and what would make their life easier. Their strongest ask: easier integration with LLM-assisted analysis. Which is exactly where THOR v11 will shine (stay tuned!). Read the full feedback here: nextron-systems.com/2026/09/… #LockedShields @NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE)

We’ve continued working on the recent Citrix #NetScaler exploitation around CVE-2026-88771 and CVE-2026-88772 and significantly expanded the THOR detection coverage. We’re now at 21 new rules covering different parts of the exploitation and post-exploitation activity. New coverage includes: - CVE-2026-88771 exploitation and encoded variants - NetScaler webshell droppers and encoded webshell payloads - Perl bind shells and suspicious Perl execution - hidden payload downloads - suspicious chmod operations on /bin/sh - EPA bypass and authentication policy manipulation - creation of privileged users - Platypus C2 agents and bootstrap scripts - SLAPSHOT / WHIPSHOT related artifacts - NetScaler persistence and C2-header based webshell indicators - CVE-2026-88772 PoC artifacts This comes on top of the generic THOR rules that already detected many of the recovered artifacts before we had campaign-specific signatures. As new samples, reports and information from partners and customers become available, we keep adding more precise coverage. For scanning NetScaler appliances, there are two practical approaches: SSHFS + THOR for ad-hoc incident response and THOR Thunderstorm collectors for recurring compromise assessments. The infographic below shows the difference. If you scanned your NetScaler systems a few days ago, update your signatures and scan again. The coverage today is considerably broader than it was immediately after disclosure. nextron-systems.com/2026/10/…

We examined artifacts left behind by attackers during the recent Citrix #NetScaler compromises. Many were already covered by existing generic THOR rules, including rules we've shipped for years. One script matched SUSP_Linux_Downloader_Jul20_1. That rule dates back to 2020, more than six years ago(!). The script also matched SUSP_Bash_Jul26. The recovered webshells matched these existing generic rules: - SUSP_WEBSHELL_PHP_Encoded_Jun21_1 - SUSP_Eval_Base64_Indicators_Feb22_1 - EXT_WEBSHELL_PHP_Generic_Eval - EXT_WEBSHELL_PHP_OBFUSC_3 - EXT_WEBSHELL_PHP_Generic - EXT_WEBSHELL_PHP_Gzinflated - EXT_WEBSHELL_PHP_Dynamic_Big Some of those webshell rules are in THOR Lite, too (EXT_*) This is POST-EXPLOITATION DETECTION. We didn't need to know which zero-day got the attacker in to recognize what they left behind. A scan could have flagged these artifacts from day one, before the exploited vulnerabilities were public. The rules were already there. Scan your edge devices regularly. Daily, where practical. Use THOR via SSHFS or scheduled file collection for THOR Thunderstorm. Don't wait for the next advisory to start looking Why THOR detects what others miss nextron-systems.com/2025/06/…

Our THOR Thunderstorm-based artifact scanning pipeline detected a malicious, newly published npm package: dotenv-async v1.0.0. Presented as an environment-configuration toolkit, it contains a Windows downloader that executes at import time and is concealed in JPEG metadata. Because environment-configuration packages are typically loaded during application startup, simply importing the package is enough to trigger the malicious chain. The downloaded winhost.exe is an unsigned NSIS installer that deploys an obfuscated Electron infostealer. It targets browser passwords, cookies, and payment data, Discord and Telegram sessions, documents, and cryptocurrency wallets and seed phrases. The malware establishes persistence as: %LOCALAPPDATA%\Microsoft\Windows\0\svchost.exe It also connects to a WebSocket gateway that provides an interactive CMD/PowerShell backdoor. Additional payloads are retrieved on demand: /browser: encrypted shellcode injected into dllhost.exe to extract browser credentials and cookies (browser.h) /update: a PowerShell loader that retrieves /jack, a native clipboard hijacker exporting StartClipjack, RunClipjackLoop, and StopClipjack. Collected data is staged in %TEMP%, compressed, uploaded to a separate TryCloudflare endpoint, and then deleted. We confirmed this multistage behavior in the analyzed artifacts. We are not attributing this activity to a specific actor, nor are we claiming that a legitimate maintainer was compromised. Domains: hardwood-studio-obviously-briefing[.]trycloudflare[.]com manufacturers-arrested-acre-foods[.]trycloudflare[.]com campus-petite-timothy-gulf[.]trycloudflare[.]com SHA-256: 2a001e4ef9933701b3d93e1a7e1e7ef67d481fac5febc96f951beabe68022322 (winhost.exe) 196f6b820aaf094b8728a11699e4e91cea464623ab0c3acebdde3d1adab59fb6 (embedded Electron executable) 79121c5d9ddfafd532c30b9c20644b9a45fadadee9163eb2e5678e4efceb4312 (browser.h shellcode) 4a439412a37048f7c4e18c5a6b6763258e6358aa77693802dccc9d9d506ebc44 (ret.ps1 Clipjack PowerShell loader)

Our THOR Thunderstorm-based artifact scanning pipeline detected a new malicious PyPI package called "beautifyText" with no detections on VT. It contains a cross-platform backdoor and claims to provide harmless text-formatting utilities for terminals, logs, and CLI output. Installing and importing the package appears routine, but beautifyText/__init__.py silently loads _compat.py. That module launches a detached process and connects to an obfuscated command-and-control server. Moreover, it registers the host, reports system and user information, polls for tasks, executes arbitrary shell commands, reads files for exfiltration, and writes attacker-supplied files. C2: bleodw[.]wisp[.]uno PyPI: pypi.org/project/beautifyTex… virustotal.com/gui/file/1702…

For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems. The new THOR Preview signature set currently includes: - EXPL_CVE_2026_88772_POC_Sep26 Detects artifacts related to the public CVE-2026-88772 PoC - LOG_SUSP_EXPL_CVE_2026_88771_Sep26 Detects potential CVE-2026-88771 exploitation traces in NetScaler logs - WEBSHELL_CSS_PassThrough_Sep26 Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise We also released a new IOC set: - NetScaler ADC suspicious file artifacts It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories. The Preview signatures are already available with: ./thor-util update --sigdev We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers. Details: nextron-systems.com/2026/09/… And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here: nextron-systems.com/2023/07/…

More npm packages from this campaign, using the same install script: express-javascript@5.2.1 exprdd@5.2.1 exptred@5.2.1 exptrdd@5.2.1 exprrdd@5.2.1 exptredd@5.2.1 xeprews@5.2.1

We found a Ukraine-targeted campaign using two very different lures: an “air raid alert” document aimed broadly at Ukrainian users, and a military-specific unit property inventory. Both lead to a Telegram-controlled VBScript RAT capable of credential theft, screenshots, command execution and targeted file collection. The second lure pushes the campaign back to at least 26 August 2026. What stands out is the collection focus: CAD, BIM, GIS, LiDAR and weather-model data, combined with per-host tasking and date-based file harvesting. Full technical analysis + IOCs: github.com/NextronSystems/io…

Our THOR Thunderstorm-based artifact scanning pipeline identified a coordinated npm campaign hiding malicious behavior inside packages presented as runtime, process, layout, and image utilities. When imported, the packages launch a hidden Node.js process that retrieves and executes code from the JSON storage "npoint". The payload collects system and network details, steals Chrome extension data, monitors the clipboard, and can activate a Windows keylogger. IOCs: api.npoint[.]io/24c25d5f5fcbb0992a4f api.npoint[.]io/33e8d008c334b060adad api.npoint[.]io/641d37178a880b1e8b8f api.npoint[.]io/ddae72efbb6714fae922 api.npoint[.]io/37c0a0c68bf7a94ed731 103.170.217[.]184:8787 Packages: process-mite@1.1.79 process-lhpm@1.1.79 process-tailwind@1.1.99 [at]biz44/process-runtime-utils@1.1.10 [at]vibecheck-polid/process-runtime-utils@1.1.12 @biz44/runtime-utils@1.1.11 swnwall@1.2.10 [at]railone/image-utils@1.1.10

We identified a Rust-based ELF RAT with no existing detection on VirusTotal. The agent is configured entirely through command-line arguments rather than a static configuration blob. Observed required flags include: C2 connectivity: --callback, --beacon, --secret Tunneling: --socks_port, --local_fwd, --remote_fwd Persistence and monitoring: --watchdog_pid Evasion: --jitter, --stealth Key Capabilities: - Command Execution: Implements remote shell capabilities - Pivoting: Integrated SOCKS proxying and port forwarding logic. - Credential Access: Targets zshrc, ssh/config, and Brave browser data - Environmental Discovery: Reads hosts and services file, and resolv.conf for network mapping. Use our THOR Scanner to detect the threat in your environment. IOCs: github.com/NextronSystems/io…

We detected fresh samples related to the ongoing #OceanLotus (APT-C-00 / APT32) campaign. The samples use a custom XOR-cipher shellcode loader that decrypts and executes shellcode directly from memory. The loader has been observed in recent disc-image (ISO/IMG) delivery chains and continues to show low detection rates across antivirus engines. Check our rules on Valhalla to find all recently detected samples: valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… New samples: 74236629c068cf2e5de53eabec9a93eb0efe7de38abc721dc5bca5d040f2ba20 07429b8ad51ef42911c152921a392911c083a175ee28e817a1f9283c3c38911b 2ec75dc4d5bff995ec58c211edaedfec150c4c02c6d6b3820b9e960dfeceb3e9 2cb31d6f254f736381ce61e68e0d93bafd8ae073c23671c0748d026702d10f7d e7de0f35607a4251237adab2128510007ea25fc00a500749940e054f067ac75d

A malicious MCP package on npm illustrates how supply chain attacks can hijack the agent's workflow. Here, the malware intercepts the wallet's private key and ships it to an attacker-controlled server. h/t Tamir Isaschar @cyb3rops @marius_benthin knostic.ai/blog/when-auto-si…

We found a heavily obfuscated, WHQL-signed malicious kernel driver with very low detections on VirusTotal. PlugPlayService.sys - MD5: a26abe238cc339da81f4853ab16e1a6a The driver provides arbitrary memory access and directly accesses RAID devices. It also makes heavy use of control-flow obfuscation, with similarities to techniques recently documented in our blog post on RegPhantom. Samples similar to PlugPlayService.sys have also been observed dropped by xigmapper. While investigating, We identified 9 additional xigmapper UEFI samples, all with no AV detection. xigmapper executes before the OS, disables SMEP/WP and patches ntoskrnl.exe in memory via egg hunting. Of particular interest: zenither.efi - MD5: 924c410a520e6dc9aa1118474d9eb354 This specific xigmapper sample has been observed deploying kernel drivers similar to PlugPlayService.sys. Full xigmapper UEFI sample set + IOCs: github.com/NextronSystems/io… Blog post on RegPhantom nextron-systems.com/2026/03/…