100 results for “Windows”

VOLTA (VOLTA-AUTODOXER) is a self-deleting Windows infostealer that, after theft and live session-based enrichment, POSTs an evidence bundle to OpenRouter so an LLM can rank the victim's assets by monetization value. It falls back across a Claude, Kimi and Gemini chain when a model refuses. Talos covers the builder model, the Chrome App-Bound Encryption bypass, the volta_debug.txt artifact and countermeasures such as blocking Chrome --headless.

blog.talosintelligence.comwriteupPublished and added 31 Oct 2026🛡️ Security

Microsoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.

microsoft.comwriteupPublished and added 31 Oct 2026🛡️ Security

NIK C2 is a newly observed C2 framework with a Go-based 64-bit Windows implant that embeds an OpenAI Chat Completions client (ai_generate command), falling back to the victim's OPENAI_API_KEY. Talos details its 52+ commands, AES-256-GCM over WebSocket with HTTP fallback, credential, wallet and keystroke theft, screen-lock ransomware, AMSI bypass and anti-debug. It also lists a live C2 at 87.120.196[.]120 and total-sitevv[.]lol.

blog.talosintelligence.comwriteupPublished and added 29 Oct 2026🛡️ Security

Field note from dfir.ch on PowerShell scripts an attacker left on disk during an incident: a file-watching command runner using Invoke-Expression, a fake Windows credential prompt that validates passwords via Start-Process and logs them in cleartext, AD computer enumeration with WMI access testing, and SMB share discovery via NetShareEnum. It notes where script labels overstate what they prove and lists hunting strings for Event IDs 4104, 4103, 4688 and Sysmon 1.

dfir.chwriteupAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

Huntress analysis of an Amazon-themed ClickFix campaign that used a Google sponsored result, a fake Amazon login on Google Sites and a fake CAPTCHA to make victims run the Windows finger utility. The .plan script drives IronPython, a Cyrillic-substituted Base64 Python loader, Doina, a Node.js stage, Lumma Stealer via sRDI, and a pirated NetSupport RMM. It lists C2 domains and gives detection tips (aclk/gclid markers, blocking the Run dialog).

huntress.comwriteupPublished and added 21 Oct 2026🛡️ Security

GTIG and Mandiant report on UNC7017, which tampered with AOMEI update servers in five to ten minute windows between April and July 2026. Edited down_html.ini and Notifycfg.ini files delivered the CROSSROAD downloader and SHINYROAD PocketPy backdoor, plus Adaptix C2 and WebDAV NTLM coercion. The post covers infrastructure shifts, YARA rules, IOCs, and vendor and SOC guidance on point-in-time triage failures.

cloud.google.comwriteupAdded 29 Oct 2026, published 15 Oct 2026🛡️ Security

Microsoft Security's FORGE Lab shares results and lessons from four months of AI-agent-driven vulnerability research: 140 Windows CVEs (52 in September 2026's release), 155 internally validated reports across 23 open-source projects, and the first patch merged into the Linux kernel via the Linux Foundation's Akrites coordinated-disclosure initiative. Using their multi-model agentic scanning harness MDASH and GPT-5.5-based validation agents, the team measured automated PoC generation at an average $3.61/21.5 minutes per confirmed crash and local privilege-escalation AEG at $8.56/25.4 minutes, and argues the real bottleneck has shifted from finding bugs to validating and remediating them at matching speed. Specific disclosed CVEs include curl's CVE-2026-9545 and CVE-2026-13608, Node.js's CVE-2026-56848, and Linux kernel's CVE-2026-64563.

microsoft.comwriteupPublished and added 7 Oct 2026🛡️ Security

Huntress researchers reconstruct an Akira ransomware attack timeline using forensic artifacts collected after the Huntress agent was installed post-compromise, including Windows Registry Shellbags, Event Logs, and Akira ransomware log files. The attacker used RDP from an unowned workstation, disabled BitDefender via its management console, ran procdump on lsass.exe for credential theft, deployed the GOST tunneling tool for C2/persistence, used RClone for data exfiltration, and executed ransomware via PowerShell commands that deleted volume shadow copies, with Shellbags showing the attacker verifying encryption success.

huntress.comwriteupPublished and added 6 Oct 2026🛡️ Security

Vals.ai researchers describe using Claude Opus 5.5-driven AI agents to run density-functional-theory simulations (PBE+U and HSE06 functionals) that designed a novel candidate magnet, YBaMnFeO₅, and separately re-identified a 1999 compound, KV[Cr(CN)₆] (a Prussian-blue analogue), as a "Luttinger compensated" semiconductor — a material with zero net magnetic moment but spin-sorted band edges, useful for spintronic memory. The agents predicted band gaps, spin-sorting windows, and magnetic ordering temperatures (KV[Cr(CN)₆] reportedly stays ordered above room temperature, up to 376 K), and the authors published all inputs, outputs and code on GitHub for independent verification. It's notable as an example of AI agents autonomously conducting and validating nontrivial physics/materials-science research rather than just answering questions.

vals.aiwriteupAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

Checkmarx's research team documents MALFEX, an npm supply-chain malware campaign run by a single operator ("Murizada") publishing since August 2023, with 12 packages (8 malicious), three still live as of late September/October 2026. The campaign delivers three distinct Windows payloads: Overlord RAT (a Go-based C2 that reads its server address from encrypted Solana blockchain transactions and uses process hollowing into TapiUnattend.exe), the movinlike Node.js stealer (targeting Discord, browser credentials, Telegram, and crypto wallets, exfiltrating via Discord webhook), and a long-running downloader hidden in function-flag's postinstall script. The writeup includes full IOCs, file hashes, host artifacts, detection commands, and remediation guidance for compromised Windows hosts.

checkmarx.comwriteupAdded 7 Oct 2026, published 5 Oct 2026🛡️ Security

Huntress explains why endpoint security typically misses ClickFix (no file artifact to scan) and how its Attack Disruption engine detects it instead: matching the obfuscated command-line shape gated on the parent process always being explorer.exe for Windows+R/Run-dialog execution. The post walks through a real incident where a user pasted a caret-obfuscated finger.exe download cradle disguised with Unicode padding to hide 'push enter' social engineering text, killed in under 1.25 seconds across four spawned processes, and describes a fix for variants that use 'start' to detach the payload process from its killed parent.

huntress.comwriteupPublished and added 5 Oct 2026🛡️ Security

Walkthrough of Platypus, an open-source C2-style host management platform (github.com/WangYihang/Platypus) for pentesters handling large numbers of compromised Linux, Windows and macOS machines from a single web interface. Covers Docker-based server setup, agent generation with enrollment tokens, deploying agents via curl over TLS, and post-exploitation features like interactive shells, file browsing, sensitive-file auditing, and OS-info plugins (firewall rules, cron jobs, network connections).

hackers-arise.comwriteupAdded 7 Oct 2026, published 2 Oct 2026🛡️ Security

Socket's Threat Research team uncovered a theme-extension cluster spanning four VS Code Marketplace and six Open VSX listings, including two confirmed malicious extensions: Aurora Nocturne Night Theme (a Windows downloader that fetches and silently executes temp_batch.cmd via cmd.exe from fingercakes4sale[.]store, tied to XWorm C2 infrastructure) and Cosmic Nebula Themes, whose app.js decrypts an AES-256-CBC embedded stage and uses a Solana transaction memo as a dead-drop to resolve follow-on payload infrastructure — the same AES key, Solana address, and execution model previously documented in GlassWorm activity. Git commit identities, near-identical theme source, shared Russian-language developer comments, and brandjacking (Coca-Cola, Aurora Borealis name-squatting) link the cluster together; a Dec 14, 2025 DEV Community article is assessed as promotional infrastructure driving Open VSX installs. The post provides full IOCs (hashes, domains, Solana address, AES key/IV, GitHub accounts) and MITRE ATT&CK mappings for defenders to hunt and inventory extensions across both registries.

socket.devwriteupPublished and added 2 Oct 2026🛡️ Security

A Latent Space podcast transcript/interview with MIT PhD student Alex Zhang, creator of Recursive Language Models (RLMs) and a core contributor to GPU Mode and KernelBench, who discusses using recursive subagent calls, context offloading, and shared memory to let models work beyond fixed context windows. The conversation ranges across AI-generated GPU kernels and their verification gap, research taste in academia versus industry labs, why "harnesses" (as in Claude Code, Codex, and Pi) function as compositional generalizers, the Jev model's non-autoregressive output-space trade-offs, and large-scale agent swarm experiments at OpenAI, Kimi, and Sakana AI. It offers a researcher's-eye view of where capability overhang and new agent/harness architectures may be heading beyond today's standard transformer decoder.

latent.spacewriteupPublished and added 2 Oct 2026🧠 AI

Huntress breaks down how Microsoft Defender Antivirus (MDAV) path/extension exclusions can be abused to hide malicious binaries from scans, detailing the registry internals (HKLM...Windows Defender\Exclusions vs the GPO-driven Policies key) and the four ways to set them: PowerShell (Set/Add-MpPreference), the MSFT_MpPreference WMI class, GPO, and direct registry edits. It documents real-world abuse by GootKit (2019), WhisperGate (2022), and Muddled Libra (2024), plus an under-documented trick where setting HideExclusionsFromLocalAdmins blocks even SYSTEM from querying exclusions via PowerShell/WMI, and describes the registry-level telemetry and detections Huntress built to catch both behaviors.

huntress.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Cisco Talos details UAT-11587, a China-nexus threat cluster targeting government, defense, and policy organizations across Taiwan, India, the Philippines, Cambodia, and other Asian countries with spear-phishing and a five-stage infection chain (HTA/WSF stagers, JScript decryptors, .NET BinaryFormatter/ActivitySurrogateSelector deserialization gadgets, and DLL sideloading via the signed GatherOsState.exe) to deploy a new Rust-compiled backdoor called Antino. Antino uses Microsoft Graph/Outlook/OneDrive as a dead-drop C2 channel instead of a traditional C2 server, supports shell/PowerShell execution, file transfer, shellcode loading with a sleep-mask evasion technique, and abuses the Windows Scripted Diagnostics framework for persistence; Talos also notes possible infrastructure overlap with Symantec's "Jewelbug" cluster and Arctic Wolf's UNC6384 reporting. Includes ClamAV/Snort coverage and IOCs.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft Defender Experts document a July 2026 phishing campaign that delivers a masqueraded but legitimately signed MSP360 RMM installer (v2.5.0.67) via meeting-invite, Zoom, Adobe, and DHL-themed lures hosted on both attacker infrastructure and legitimate cloud services (S3, Cloudflare R2, Dropbox, GitLab, Supabase). After UAC-elevated installation and service persistence, the RMM.Agent.exe service launches PowerShell to silently install a ConnectWise ScreenConnect client via msiexec, which the actor then uses via RunFile to drop credential-theft and reconnaissance tools disguised as Windows/Defender/Phone Link components. A separate July intrusion used FaronicsDeployAgent.exe the same way to deploy ScreenConnect, showing the technique is not MSP360-specific; Microsoft provides IOCs, hunting queries, and mitigation guidance (Application Control, AppLocker publisher rules, ASR rules) but does not attribute the activity.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

Wiz walks through a case study of its "Blue Agent" autonomous SOC investigator tracing a compromised CI/CD service account (svc_automation) across AWS and GitHub. The attack chain: a stolen GitHub token cloned 18 private repos containing hardcoded AWS keys, which were used to authenticate to AWS from Kali Linux via a Zenlayer VPN IP, pivot to a second account, run SSM SendCommand against a production Windows domain controller, and stage custom Python exfiltration scripts (mssql_table_export.py, pg_table_export.py, billing_export2.py) in S3 to pull data from MSSQL, PostgreSQL, and billing systems. The piece details the investigative technique used - 30-day baseline comparison, ASO/IP dispersion across the tenant, and correlating CloudTrail management-plane events with S3 data-plane events and GitHub audit logs.

wiz.iowriteupPublished and added 29 Sep 2026🛡️ Security

Part 2 of a research series on ZDI-26-708, a Windows Network Connectivity Status Indicator (NCSI) flaw where a proxy configured in an unprivileged user's HKCU ends up used by the NETWORK SERVICE-owned netprofm process. The author reverse-engineers ncsi.dll and winhttp.dll with IDA/WinDbg to show the value actually arrives via a Windows Event Log subscription to Event ID 5600 (Microsoft-Windows-WinINet-Config) rather than the WNF notification initially suspected, is stored in NCSI's user-proxy state, and is later applied to a WinHttpSetOption(38) call for an active connectivity probe. It documents why option 193 (WINHTTP_OPTION_DISABLE_PROXY_AUTH_SCHEMES) fails to disable NTLM (wrong bitmask, 0x100 vs 0x04), and demonstrates cross-context NTLM proxy authentication capture/relay with impacket-ntlmrelayx toward ADCS, since the request runs under the netprofm/NETWORK SERVICE machine-account context.

pgj11.comwriteupPublished and added 28 Sep 2026🛡️ Security

A researcher reverse-engineers Windows NCSI (ncsi.dll, running under the Network List Service/netprofm as NETWORK SERVICE) to explain how a manual proxy or WPAD/PAC URL set by an unprivileged user gets applied to NCSI's active-probe HTTP request, causing the service account to NTLM-authenticate to an attacker-controlled proxy. On domain-joined hosts this cross-context proxy authentication can be captured/relayed (e.g. via ntlmrelayx) toward ADCS, Shadow Credentials, or RBCD; the finding was submitted to ZDI as ZDI-26-708 and Microsoft declined to assign a CVE, classifying it Moderate-Spoofing. Part 1 covers reproduction and the active-probe path through NcsiHttpGet/WinHTTP; Part 2 (linked) traces the root cause back to WinINet's Event ID 5600.

pgj11.comwriteupPublished and added 28 Sep 2026🛡️ Security

Huntress researcher Andrew Schwartz demonstrates a novel OAuth token-theft technique: a sideloaded AppX package registered via Add-AppxPackage -Register (requiring only Developer Mode, no admin beyond that toggle) can set ContentUriRules WindowsRuntimeAccess="all" so attacker-controlled JavaScript rendered inside the Microsoft-signed WWAHost.exe process gets full WinRT access, including the legacy WebAuthenticationBroker OAuth API. Using Microsoft Office's own client ID and the oob redirect URI, the attacker triggers a genuine login.microsoftonline.com/MFA dialog with no browser chrome, captures the auth code, and exchanges it for an access token plus a long-lived refresh token carrying the full Office delegated Graph scope set (mail, files, Teams, directory, AuditLog.Create) — validated end-to-end against a live Entra ID tenant with MFA and default Conditional Access. The post frames it as a class of vulnerable signed AppX host binaries sharing the same WinRT activation layer, and provides a Sigma rule keyed on the MSAppHost/3.0 EdgeHTML user agent reaching non-Microsoft destinations, plus Sysmon/Event ID and GPO-based mitigations (restricting Developer Mode, Conditional Access, shorter refresh-token lifetimes, CAE).

huntress.comwriteupPublished and added 23 Sep 2026🛡️ Security

Cisco Talos' CAIRN project documents CLOSEDQUORUM, a 64-bit Go Windows implant that replaces traditional C2 infrastructure with a panel of up to four commercial LLM providers (DeepSeek, Qwen, Mistral, Gemini) that vote on the implant's next action via plurality voting, with each model queried against a structured JSON decision schema constrained to inject/persist/steal/move actions. Once deployed it autonomously dumps LSASS credentials, steals browser passwords and crypto wallets (MetaMask, Exodus, Ethereum), and exfiltrates AES-256-GCM-encrypted data to an operator's Discord webhook, all without further human tasking. The post details the developer's apparent credentials-as-a-service distribution model, deterministic tie-breaking favoring DeepSeek, and provides SHA256 hashes plus a YARA detection rule for the family (formerly tracked as BALZAK).

blog.talosintelligence.comwriteupAdded 30 Sep 2026, published 22 Sep 2026🛡️ Security

Huntress details a post-incident investigation into an INC ransomware attack that hit 175+ endpoints, reconstructed from surviving EDR telemetry and Windows event logs rather than live detection. The intrusion shows a 17-day gap between initial scheduled-task persistence and RDP lateral movement (possibly an initial access broker), and a second wave using AnyDesk, a BYOVD tool (hwau.exe loading the HwAudio kernel driver) to disable security controls, and Impacket's atexec.py to deploy INC ransomware. Attackers dropped two distinct ransom notes 53 minutes apart: a standard INC-README.txt and a detailed DATALEAK_PRESS_RELEASE.txt threatening to notify media, employees and partners with a full inventory of stolen files.

huntress.comwriteupAdded 22 Sep 2026, published 21 Sep 2026🛡️ Security

Huntress analysts detail two Settra ransomware incidents (July and September) observed in customer environments, documenting the threat actor's use of the MeshAgent RMM for persistence, BYOVD via the gdrv.sys driver, and anti-forensic techniques including Windows Event Log clearing, reagentc /disable, diskpart-based recovery partition removal, and cipher.exe free-space wiping. The post includes specific IOCs — C2 IPs 45.13.122[.]7 and 193.5.65[.]114, the recurring workstation name WIN-LIVFRVQFMKO, and the RESTORE_FILES.txt ransom note — supplementing prior public reporting from MoxFive and SOCRadar on this newer ransomware variant first seen in June.

huntress.comwriteupAdded 22 Sep 2026, published 17 Sep 2026🛡️ Security

OpenSourceMalware researchers detail WeaselBiscuit, a newly discovered lightweight JavaScript infostealer found hidden in 11+ npm packages (e.g. process-tailwind, engin1, the @biz44 scope), which shares tradecraft with DPRK-linked BeaverTail/OtterCookie but strips out wallet-draining, password decryption, and remote-shell features. The writeup walks through the full infection chain - a package auto-running a detached Node loader, fetching a Base64-encoded second stage from Npoint dead-drop URLs, and beaconing to a hardcoded HTTP C2 (103.170.217.184:8787) - plus its capabilities (Chrome extension-storage theft, clipboard capture, Windows keylogging) and a campaign-cluster graph tying packages together via shared hashes and resolver URLs. Attribution to DPRK is explicitly labeled a tentative hypothesis rather than confirmed.

opensourcemalware.comwriteupPublished and added 17 Sep 2026🛡️ Security

Group-IB documents previously undocumented samples of HEAVYGRAM, a Python/PyInstaller-based Windows backdoor that uses the Telegram bot API for command-and-control, screen/audio capture, data exfiltration, and DLL side-loading, alongside the related CRUDEEXCLUDE loader that adds Windows Defender exclusions. The research corroborates and extends a March 2026 US DOJ affidavit and FBI FLASH report, attributing the malware with moderate confidence to the Handala Hack persona — assessed as a false-flag "hacktivist" front for Void Manticore (aka Storm-0842/Banished Kitten), operating on behalf of Iran's MOIS — used since Fall 2023 against Iranian dissidents, journalists, and critics of the Iranian government via Telegram-delivered, Delphi-packaged lures (fake KeePass, Telegram, Pictory apps). It details four infection-chain variants (WSF/VBS downloaders, HTA Telegram-polling scripts, Delphi droppers with embedded archives), the implant's command prefixes (@@/**/##) and attachment handlers, dual-bot C2 configurations, and provides IOCs and detection/hardening recommendations.

group-ib.comwriteupAdded 1 Oct 2026, published 17 Sep 2026🛡️ Security

SpecterOps research introduces "Pass-the-Passkey," a family of 20+ attack techniques against passkey/WebAuthn authentication, including three zero-days: Windows 11 logging complete WebAuthn assertions to an Event Log readable by unprivileged users (patched July 2026), Microsoft Entra ID historically failing to enforce WebAuthn anti-replay protections (challenge reuse, session binding, signature counters), and local malware that calls the native Windows WebAuthn API directly to phish users with a convincing native-looking passkey prompt. The write-up argues these implementation failures mirror classic credential-relay attacks like Pass-the-Hash and NTLM Relay, and recommends device-bound passkeys with attestation enforcement for high-value accounts.

specterops.iowriteupAdded 2 Oct 2026, published 16 Sep 2026🛡️ Security

Huntress SOC analysts Ryan Dowd and Jon Semon tore apart a live social-engineering campaign that began with a fake CoinDesk marketing exec DMing a researcher a Google Doc containing a container-bound Apps Script sidebar. The script ran client-side without OAuth consent, exfiltrated victim IP/geolocation/wallet presence via the Telegram API, then routed macOS users to a piped zsh/DMG AMOS stealer chain and Windows users through ClickOnce and PowerShell loaders using three stolen or fraudulent code-signing certificates (a Norwegian company, Discord, and Lenovo). The Windows chain culminated in NetSupport Manager RMM abuse, a Ledger wallet implant, and a self-generated rogue root certificate authority (spoofing Google Trust Services) installed via MsBuild.exe hollowing to silently intercept HTTPS traffic, which the authors flag as the artifact most likely to survive incident remediation short of full reimaging.

huntress.comwriteupAdded 11 Sep 2026, published 15 Sep 2026🛡️ Security

Endor Labs' live incident tracker for the Shai-Hulud 2.0 npm supply-chain worm that began around Nov 24, 2025, compromising packages from Zapier, ENS Domains, Postman and PostHog. It details the infection chain (malicious preinstall script, setup_bun.js dropper, obfuscated bun_environment.js payload), TruffleHog-style credential theft from AWS, GCP, Azure, GitHub and npm, self-replication via stolen npm and GitHub tokens, a self-hosted GitHub Actions runner backdoor abusing repository Discussions for command injection and C2, and destructive wiper behavior that shreds the user's home directory on Windows and Linux.

endorlabs.comwriteupPublished and added 11 Sep 2026🛡️ Security

Huntress analyzed a fake GTA6 game ISO (some padded to 100GB+ with junk data) distributed via SEO poisoning, gaming forums, and torrents ahead of the game's real release. The ISO's "installer" drops a Russian-language crack-themed installer that stages multiple NJRAT copies, a DCRAT implant, the Mercurial Grabber infostealer (exfiltrating browser/Discord/Roblox/Minecraft data via Discord webhooks), Chaos ransomware repurposed as a destructive wiper (with a fake "license not found" error to mask the compromise), and an unexplained Yandex Browser install. The writeup includes IOCs (C2 IPs, ngrok tunnel, hosts-file modifications, malicious Discord webhook URL) and notes current Windows Defender detects the components.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Huntress SOC details two August incidents where phishing emails led victims through a fake CAPTCHA/Adobe PDF Reader lure into a browser-in-the-browser (BiTB) page spoofing get.adobe.com, tricking them into installing a ScreenConnect client disguised as an Adobe Reader update. The installer chained to a second rogue ScreenConnect client via curl/cmd.exe, both registered as Windows services for persistence, then executed defense-evasion binaries (HideCursor.exe, HideUL.exe) to hide cursor/screen activity before Huntress disrupted the intrusions. Full IOCs (domains, ScreenConnect client IDs/relays, file hashes/paths) are included for defenders.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Proofpoint details "BlueMoon," a novel exploit kit chaining a Chrome V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape via WebAssembly metadata corruption (CVE-2026-87491), and a Windows kernel LPE (CVE-2026-85880) to break out of the browser sandbox. Within days of first use by China-aligned TA412 (28 Aug 2026), the kit was independently adopted by UNK_LateNight (delivering ShadowPad to US aerospace targets), UNK_DoubleCheck (Rust-based loader against a Vietnamese manufacturer), and UNK_QuietRacket (custom malware against Indonesia/Singapore government and finance targets). The piece analyzes exploit internals (Maglev/TurboFan JIT bug, reflective DLL loading, ALPC/WNF kernel exploitation), flags artifacts suggesting AI-assisted exploit development (debug comments, handover markdown files, v8CTF references), profiles the GemStone Chromium-extension credential-theft backdoor deployed via Secure Preferences forgery, and provides IOCs, ET rules, and a YARA rule for detection.

proofpoint.comwriteupAdded 26 Sep 2026, published 9 Sep 2026🛡️ Security

Aikido researchers found a delayed RCE in the Unreal Engine 5-based game MECCHA CHAMELEON, exploitable via a malicious Steam Workshop map. A Blueprint-exposed audio recording function allowed arbitrary file writes via path traversal, a null-byte trick stripped the auto-appended .wav extension to drop an .exe into the Windows Startup folder, and PCM audio samples were crafted byte-for-byte to smuggle a polyglot WAV/HTA payload that launches mshta.exe and runs arbitrary code on reboot. The issue was patched in the game's 4.0.0 update.

aikido.devwriteupPublished and added 3 Sep 2026🛡️ Security

Huntress researchers uncovered the operator console for "Knight Office," a Flask-based adversary-in-the-middle (AiTM) phishing kit used to steal Microsoft 365 session tokens via a DocuSign-themed, self-spoofed lure that routes victims through Monday.com redirects and a compromised Joomla site to a fake Microsoft device-code authentication page. After capturing tokens, the attacker registered a rogue device in Microsoft Entra ID and bound a Windows Hello for Business key credential to the compromised account to maintain persistent, MFA-bypassing access even after token revocation. The writeup details IOCs (IPs, .vu domains, User-Agent strings), links the campaign to hundreds of reported phishing emails since April, and gives defenders concrete hunting/response steps around callback-proxy sign-ins and newly registered WHfB credentials.

huntress.comwriteupAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Cisco Talos details UAT-10147, a Chinese-speaking cybercrime group exploiting one-day vulnerabilities in Windows/Linux web servers to deploy BadIIS, QuasarRAT, NoodleRAT, and SPECTRE implants, while also integrating agentic AI tools (PentestGPT, DeepAudit, and AI-orchestrated ysoserial workflows) to generate exploit playbooks, automate ASP.NET ViewState deserialization RCE, validate exploit success, and run reconnaissance/exfiltration end to end. Talos recovered AI-generated Python scripts and a findings log from the actor's C2 open directory showing semi-autonomous exploit refinement, OOB callback verification via webhook.site, and privilege escalation via SeImpersonatePrivilege/Potato exploits — evidence of a shift from AI-assisted scripting toward agentic offensive orchestration.

blog.talosintelligence.comwriteupAdded 24 Aug 2026, published 20 Aug 2026🛡️ Security

Huntress researchers document a phishing campaign targeting Black Hat/DEF CON attendees via X DMs impersonating a CoinDesk exec, luring victims into opening a weaponized Google Doc with a custom Google Apps Script sidebar that runs a fake "decryption" flow before delivering ClickFix-style commands or a manual "update" that drops malware. On macOS this delivers AMOS infostealer plus a LaunchDaemon-based polling backdoor with SOCKS5 proxy capability; a follow-up fake DocSend/Dropbox installer delivers a ClickOnce/NSIS loader chain on Windows that installs NetSupport RAT, a process-hollowed rogue Certificate Authority that MITMs VirusTotal traffic, and an incomplete Ledger wallet-targeting implant. The piece includes deep technical detail on the loader's C2 protocol, stolen/fraudulent code-signing certificates, and infrastructure patterns (multi-branded loader domains), plus mitigation guidance and a link to published IOCs.

huntress.comwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

Follow-up analysis showing that the RubyGems StubMaker typosquatting campaign and a separately-discovered 40-package npm typosquatting campaign (targeting chalk, commander, lodash, typescript, react, axios) are run by the same threat actor: both use install-time hooks (extconf.rb vs postinstall.js) to fetch a Rust loader from the same GitHub release, which decrypts a byte-for-byte identical Go infostealer confirmed by matching SHA-256 hashes. The stealer harvests browser credentials (bypassing Chromium app-bound encryption), crypto wallets/seed phrases, and Telegram data, exfiltrating via Gofile to a webhook at dresslee.com, and includes WSL-to-Windows sandbox escape logic. The post publishes full network/file IOCs and hashes and argues network-layer blocking (C2 IP and webhook domain) is more durable than package-name blocklisting.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

Researchers identified "StubMaker," a RubyGems typosquat campaign (brumdler, brundlef, and 15 packages typosquatting bundler/i18n/rake/activesupport) that abuses the extconf.rb native-extension hook to fake a successful build while beaconing victim OS info and, on Windows, downloading a Rust loader (main.exe) from a GitHub release. The loader decrypts an embedded 11MB Go infostealer entirely in memory, which injects an embedded DLL (abe_payload.dll) into Chromium browsers via the elevation-service COM object to defeat Application-Bound Encryption and steal passwords, cookies, payment cards, crypto wallets/seed phrases, and Telegram data, exfiltrating via Gofile and a webhook at dresslee.com. The piece also details how RubyGems.org's namespace-reclaim behavior let a different account (mod8rz41mje) take over the yanked "brumdler" name to relaunch the campaign, and includes full IOCs and hashes.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 16 Aug 2026🛡️ Security

Huntress details an Akira ransomware intrusion from August 2026 that followed the group's usual SonicWall SSL VPN → domain controller → AD enumeration → WinRAR/s5cmd exfiltration → detonation playbook, but with a new twist: the affiliate ran msconfig.exe to force a reboot into Safe Mode with Networking (MITRE T1688), which killed the Huntress agent and Windows Defender real-time protection while preserving network access, after pre-registering an AnyDesk service to survive the minimal Safe Mode driver set. The blog notes Safe Mode's constrained virtual memory appears to have caused akira.exe to crash with out-of-memory errors, accidentally sabotaging the attacker's own encryption run, and closes with detection guidance for boot-configuration changes, Safe Mode Kernel-Boot/Kernel-General event IDs, and Safe Boot registry tampering.

huntress.comwriteupAdded 3 Sep 2026, published 12 Aug 2026🛡️ Security

XBOW's autonomous AI agent chained a blind SSRF in Bing's reverse-image-search into three Critical Microsoft RCEs (CVE-2026-32194, CVE-2026-32191, CVE-2026-21536), each CVSS 9.8, by fingerprinting an ImageMagick-compatible backend through differential error responses and crafting an SVG payload that reached a shell-backed image delegate. The proof was confirmed via out-of-band callbacks showing NT AUTHORITY\SYSTEM and root execution across multiple production Bing image-processing workers on both Windows and Linux hosts. The piece walks through the full investigative trace — from ruling out XXE to fingerprinting ImageMagick coders/pseudo-protocols to constructing the pipe-based SVG exploit — and argues that ImageTragick-class bugs in "boring" image helpers remain a live, underrated attack surface.

xbow.comwriteupPublished and added 8 Aug 2026🛡️ Security

OpenSourceMalware documents WEL1DROPPER (aka Flooding Dropper), a campaign that published 788+ slopsquatted npm packages (e.g. checkout-mobile-bnpl) which execute on require() with no install script, downloading cross-platform RAT/infostealer payloads via rotating Cloudflare Workers URLs with a DNS TXT-record fallback channel. The writeup reverse-engineers the Linux (UPX-packed ELF) and macOS (universal Mach-O) second-stage payloads, detailing anti-analysis checks, LaunchAgent persistence disguised as com.apple.windowserver.helper, XOR-obfuscated C2 domains, a suspected Sliver C2 final stage, and ties the campaign to Russian financial-sector lures and the earlier Moika npm campaign.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

Huntress details a July 2026 incident where attackers exploited a classic SQL injection flaw in a public-facing Java/Tomcat application to reach an Oracle database over JDBC, then used Oracle's CREATE JAVA SOURCE statement to compile a custom post-exploitation toolkit called khunt directly as database objects. Khunt modules (KhuntCmd, KhuntHash, KhuntFS/FS2, KhuntT, KhuntUnzip) let the attacker run OS commands, dump Oracle credentials, browse the filesystem, and ultimately pivot to SYSTEM-level RCE on the underlying Windows host, where they exfiltrated SAM/SECURITY/SYSTEM registry hives. It's notable because storing malicious code as PL/SQL/Java database objects rather than OS files/processes evades traditional EDR and AV visibility.

huntress.comwriteupAdded 3 Sep 2026, published 5 Aug 2026🛡️ Security

Huntress dissects a Bank of America-themed phishing email that lures victims into downloading AccountGuardSetup.vbs, which unpacks through several layers of base64-encoded PowerShell to silently install ScreenConnect RMM with Administrator privileges. The chain uses AES-128-CBC encrypted blobs to deliver a C# UAC-bypass exploit via the ICMLuaUtil COM interface (MITRE ATT&CK T1548.002), then hides the resulting ScreenConnect service (renamed "Windows Security") from users and admins using SDDL/ACL manipulation so it can't be seen, logged, or removed.

huntress.comwriteupAdded 3 Sep 2026, published 4 Aug 2026🛡️ Security

Second installment of a reverse-engineering series examining xhunter2.sys, a Windows kernel driver, focusing on its three-layer authentication mechanism. Based on the title and URL only (page content could not be processed this pass); likely details disassembly/unpacking work to bypass or understand the driver's access-control checks, relevant to BYOVD/EDR-killer tradecraft analysis.

blacksnufkin.github.iowriteupAdded 2 Oct 2026, published 4 Aug 2026🛡️ Security

A technical writeup by security researcher BlackSnufkin describing the discovery of a live, unpatched 0day kernel-mode local privilege escalation (LPE) vulnerability in an anti-cheat driver reportedly deployed on roughly a billion Windows machines. The post likely covers the vulnerability research and exploitation process targeting the anti-cheat's kernel component. Full page content could not be verified in this pass; summary is inferred from title and URL alone.

blacksnufkin.github.iowriteupAdded 2 Oct 2026, published 4 Aug 2026🛡️ Security

In-depth OSINT/threat-intel investigation into CRPX0, a ransomware group that emerged in July 2026 with 47 listed victims (mostly healthcare, mainly US/Turkey targets), tracing its origins to a prior "Flash Token" crypto/USDT money-laundering scam service run by the same operators. The piece covers domain registration analysis (REGRU-SU abuse, reused 2021 domain), dark web/clear web leak sites, RaaS/HaaS/affiliate program offerings, ClickFix-based payload delivery targeting Windows via EXE/DLL, YouTube affiliate-panel promotion analysis (voice/locale clues suggesting China), TOX/Session ID and Bitcoin address correlation, and real IP address deanonymization, concluding with IOCs and MITRE ATT&CK mapping.

theravenfile.comwriteupAdded 3 Sep 2026, published 3 Aug 2026🛡️ Security

Chapter 0 of a 5-part series on exploiting HackSys Extreme Vulnerable Driver (HEVD) for Windows kernel privilege escalation via a stack overflow bug. This installment covers environment setup (Hyper-V/VMware with SMEP support, WinDbg kernel debugging attach, DbgPrint enablement) as prep for later chapters that will detail bypassing kASLR, SMEP, and KPTI/KVA Shadow and building a sysret-based ROP shellcode chain.

mdanilor.github.iowriteupAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

A DFIR field notes post describing how attackers abuse NSSM (Non-Sucking Service Manager) to run tools like ngrok as a Windows service, hiding the real executable behind the legitimate nssm.exe ImagePath. It walks through hunting techniques: checking Event ID 7045 service-installation logs, inspecting the service's registry Parameters subkey to reveal the true application/arguments, and confirming via live process command-line analysis (Process Explorer, Velociraptor's Windows.System.Pslist), illustrated with a second real case where nssm.exe was wrapping a "komari-agent" implant.

dfir.chwriteupAdded 3 Sep 2026, published 27 Jul 2026🛡️ Security

Xygeni details FauxUV, a cluster of PyPI packages (moon-uv, my-magic-uv-helper) that impersonate the popular Rust-based Python package manager uv but carry almost no real functionality. Instead, on Windows they launch JupyterLab with authentication disabled (empty token, bound to 0.0.0.0, XSRF checks off) and, in later versions, expose it to the internet via a Pinggy SSH reverse tunnel, turning a legitimate data-science tool into an open remote shell that inherits the installing user's credentials. The writeup traces the install-time PowerShell trigger moving from setup.py to a separate CLI tool across versions and provides IOCs and detection guidance.

xygeni.iowriteupPublished and added 18 Jul 2026🛡️ Security

Socket's Threat Research Team analyzed 11 malicious NuGet DotnetTool packages (published by account pepegit666) that impersonate game cheats/bots for titles like GTA5RP, Albion Online, and Throne and Liberty. Each package's .NET downloader resolves GitHub hosts via DNS-over-HTTPS, requests UAC elevation to resync the clock, and fetches a PyInstaller Windows payload (pepesoft.exe) from GitHub Releases/Hugging Face with dormant BitTorrent fallback code, that in turn authenticates to Google Sheets for telemetry, hardware-binds licenses, enforces a remote HWID ban-list, and, in three samples, drives Telegram bot commands that exfiltrate screenshots and modify Windows Installer registry keys on exit. The report includes full IOC lists (hashes, domains, hardcoded AWS-style keys, mutex GUID) and MITRE ATT&CK technique mappings.

socket.devwriteupPublished and added 15 Jul 2026🛡️ Security

Huntress SOC analysis of a June incident where a threat actor exploited a SQL injection flaw in an IIS/MSSQL web application to gain access, then extensively modified the environment: enabling Terminal Services, creating a rogue admin account (adminweb2$), disabling Windows Defender, deploying BadIIS malicious IIS modules (HttpFastCgiModule.dll, HttpCgiModule.dll) for SEO fraud, installing the XMRig cryptominer with nssm.exe persistence and hidden/system file attributes, and dropping additional PowerShell/batch payloads (qdcjoke1.2.ps1, c_joke1.2.ps1) via base64-encoded PowerShell and Out-of-Band Application Security Testing (OAST) exfiltration channels (oastify.com).

huntress.comwriteupAdded 3 Sep 2026, published 13 Jul 2026🛡️ Security

Huntress SOC incident writeup detailing a threat actor who exploited Adobe ColdFusion vulnerabilities (CVE-2023-26360, CVE-2023-29298, CVE-2023-29300) to drop a steganographic webshell hidden inside an image, then returned with a full defense-impairment batch script (i.bat) that disabled IIS logging, tampered with Windows Defender, killed/deleted security services (Sysmon, filebeat, SentinelOne, DrWeb, ImmunetProtect), used Image File Execution Options to freeze logging tools, deleted ModSecurity WAF module, enumerated FileZilla and multilingual local admin groups, weakened WDigest to force plaintext credentials in memory, dumped credentials via a Mimikatz kernel driver (mimidrv.sys), deleted CLSID/WScript registry keys, and cleared Windows event logs. The piece walks through each command block with attacker rationale and closes with concrete mitigation guidance for defenders.

huntress.comwriteupAdded 3 Sep 2026, published 29 Jun 2026🛡️ Security

A DFIR.ch deep-dive on stealthier alternatives to LSASS dumping for harvesting Windows cleartext credentials, covering WDigest re-enablement, PowerShell ConsoleHost_history.txt, AD user-attribute leaks, Group Policy Preferences (GPP) cPassword, and rogue Security Support Provider (SSP), Password Filter DLL, and Network Provider DLL registration. Each technique is illustrated with real incident-response case data (registry commands, malicious DLL names like kerberos_sp.dll and mimilib.dll, and exfiltrated log paths), paired with Sysmon Event ID 13/11 detection guidance and hardening recommendations (disabling custom SSPs, Protected Event Logging).

dfir.chwriteupAdded 3 Sep 2026, published 28 Jun 2026🛡️ Security

Part 6 of Huntress's "From Code to Coverage" series reverse-engineers ldapnomnom's LDAP Ping (cLDAP-style) Active Directory username enumeration technique, tracing its Go source down to the Windows Filtering Platform to test the tool's claim of generating "no Windows audit logs." Lab testing shows Event 1644 never fires for LDAP Ping (it's processed by netlogon.dll, not the ntdsa.dll LDAP engine it monitors), but netlogon.log captures every queried username including disabled-account detail attackers can't see, while Event 5156 attributes source IP for ldapnomnom's TCP connections — a gap that disappears entirely if an attacker switches to true UDP cLDAP (as demonstrated with a custom cldap_ping.py), leaving only MDI's threshold-based external ID 2437 as network-layer coverage. The piece also audits the ldeep tool's enum_users transport and provides a PowerShell correlation script joining netlogon.log and Event 5156 within a 5-second window.

huntress.comwriteupAdded 3 Sep 2026, published 24 Jun 2026🛡️ Security

Socket's research team documents a supply chain attack in which npm account "ehindero" mass-published 141 malicious versions of @mastra/* packages (including @mastra/core, 918K weekly downloads) that were byte-identical to legitimate code but added a single new dependency: the typosquatted package easy-day-js. That package's postinstall hook (setup.cjs) disables TLS validation, fetches a second-stage cross-platform Node.js implant (protocal.cjs) that installs OS-specific persistence (Windows Run key, macOS LaunchAgent, Linux systemd unit disguised as Node/NVM tooling), inventories 166 cryptocurrency wallet browser extensions, steals Chrome/Edge/Brave history, and accepts arbitrary remote tasking (Node/Shell runners) from a hardcoded C2 over a custom ICAP-style protocol. The writeup includes full IOCs, SHA-256 hashes, and remediation guidance (rotate npm/CI/SSH credentials, treat affected hosts as compromised, disable install scripts).

socket.devwriteupPublished and added 20 Jun 2026🛡️ Security

Huntress SOC incident report on an internet-facing RD Gateway/RDWeb terminal server compromised via credential reuse with no MFA, where the actor staged Gammadyne Mailer (a legitimate commercial bulk-mail tool) to send 8.9 million Boots-impersonation phishing emails direct-to-MX from the victim's clean IP, evading AV entirely. The phishing kit itself was hosted on a compromised Bolivian government domain (ipelc.gob.bo) to inherit its trust and dodge reputation blocklists, and the writeup details the log-forensics (Windows Security log gaps, Terminal Services operational logs, Chainsaw parsing, WFP Event 5157) used to reconstruct the timeline and attribute a separate opportunistic brute-force bot.

huntress.comwriteupAdded 3 Sep 2026, published 15 Jun 2026🛡️ Security

Huntress SOC dissects a multi-stage infection chain that begins with a malspam HTML attachment routed through a legitimate Google DoubleClick tracking link to evade reputation filters, before landing on a self-personalizing phishing kit and dropping a ZIP with a heavily obfuscated JScript loader. The chain cascades through PowerShell droppers into a .NET stager that performs extensive anti-analysis/anti-sandbox checks, disables Windows Defender, patches AMSI (via NtManageHotPatch on Windows 11 24H2) and ETW at the native API level, and uses RunPE process hollowing into InstallUtil.exe or MSBuild.exe to run a final loader that communicates over AES/RSA-encrypted, protobuf-serialized TCP C2 with certificate pinning. The writeup includes GPU-fingerprinting behavior, persistence via registry Run keys and randomized scheduled tasks, and concrete detection/hardening recommendations.

huntress.comwriteupAdded 3 Sep 2026, published 3 Jun 2026🛡️ Security

Huntress researcher demonstrates that Windows' search: URI handler leaks a user's Net-NTLMv2 hash via the crumb=location: parameter, exploitable via a single clicked link (e.g. in Edge) or a `start` command with no admin rights or malware needed. The bug mirrors CVE-2026-33829 (Snipping Tool's ms-screensketch: handler, patched by Microsoft in April 2026) since both trace to the same DelegateExecute CLSID (SearchExecute/CLSID_SearchMSExecute in ExplorerFrame.dll), but MSRC closed this report as Moderate severity with no CVE and no fix, citing case-by-case servicing exceptions. The post includes reproduction steps with Responder, notes prior related disclosures by Varonis (search-ms:, 2024) and Trellix (search:, 2023), and recommends mitigations like blocking outbound SMB, enforcing SMB signing, and restricting NTLM.

huntress.comwriteupAdded 3 Sep 2026, published 2 Jun 2026🛡️ Security

Huntress SOC details two Gentlemen ransomware incidents showing Windows Event Log clearing, PowerShell-based Defender tampering, and Scheduled Task persistence via a fake svchost32.exe creating a SOCKS proxy C2 connection. Ties findings to a leaked internal RaaS database revealing CVE-2024-55591 exploitation and infrastructure links to Qilin and Lazarus Group.

huntress.comwriteupAdded 3 Sep 2026, published 21 May 2026🛡️ Security

Huntress SOC breaks down how attackers disable AV/EDR: blocking agent communications via malicious/hidden Windows Firewall rules (WFP), abusing Add/Remove or CLI to uninstall EDR agents, abusing Defender AV exclusions, and Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel access and kill protected security processes. Includes real intrusion examples — a February 2026 SonicWall VPN-credential intrusion using a revoked-but-still-trusted 2006 EnCase forensic driver (exploiting a legacy Windows Driver Signature Enforcement exception) to kill 59 named security processes every second, and a March 2026 malvertising campaign (Google Ads for W-2/W-9 forms) that dropped a rogue ScreenConnect instance and used a vulnerable signed Huawei audio driver to terminate EDR/AV processes.

huntress.comwriteupAdded 3 Sep 2026, published 18 May 2026🛡️ Security