100 results for “Windows”

VOLTA (VOLTA-AUTODOXER) is a self-deleting Windows infostealer that, after theft and live session-based enrichment, POSTs an evidence bundle to OpenRouter so an LLM can rank the victim's assets by monetization value. It falls back across a Claude, Kimi and Gemini chain when a model refuses. Talos covers the builder model, the Chrome App-Bound Encryption bypass, the volta_debug.txt artifact and countermeasures such as blocking Chrome --headless.

blog.talosintelligence.comwriteupPublished and added 31 Oct 2026🛡️ Security

Microsoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.

microsoft.comwriteupPublished and added 31 Oct 2026🛡️ Security

NIK C2 is a newly observed C2 framework with a Go-based 64-bit Windows implant that embeds an OpenAI Chat Completions client (ai_generate command), falling back to the victim's OPENAI_API_KEY. Talos details its 52+ commands, AES-256-GCM over WebSocket with HTTP fallback, credential, wallet and keystroke theft, screen-lock ransomware, AMSI bypass and anti-debug. It also lists a live C2 at 87.120.196[.]120 and total-sitevv[.]lol.

blog.talosintelligence.comwriteupPublished and added 29 Oct 2026🛡️ Security

Field note from dfir.ch on PowerShell scripts an attacker left on disk during an incident: a file-watching command runner using Invoke-Expression, a fake Windows credential prompt that validates passwords via Start-Process and logs them in cleartext, AD computer enumeration with WMI access testing, and SMB share discovery via NetShareEnum. It notes where script labels overstate what they prove and lists hunting strings for Event IDs 4104, 4103, 4688 and Sysmon 1.

dfir.chwriteupAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

Huntress analysis of an Amazon-themed ClickFix campaign that used a Google sponsored result, a fake Amazon login on Google Sites and a fake CAPTCHA to make victims run the Windows finger utility. The .plan script drives IronPython, a Cyrillic-substituted Base64 Python loader, Doina, a Node.js stage, Lumma Stealer via sRDI, and a pirated NetSupport RMM. It lists C2 domains and gives detection tips (aclk/gclid markers, blocking the Run dialog).

huntress.comwriteupPublished and added 21 Oct 2026🛡️ Security

GTIG and Mandiant report on UNC7017, which tampered with AOMEI update servers in five to ten minute windows between April and July 2026. Edited down_html.ini and Notifycfg.ini files delivered the CROSSROAD downloader and SHINYROAD PocketPy backdoor, plus Adaptix C2 and WebDAV NTLM coercion. The post covers infrastructure shifts, YARA rules, IOCs, and vendor and SOC guidance on point-in-time triage failures.

cloud.google.comwriteupAdded 29 Oct 2026, published 15 Oct 2026🛡️ Security

Microsoft Security's FORGE Lab shares results and lessons from four months of AI-agent-driven vulnerability research: 140 Windows CVEs (52 in September 2026's release), 155 internally validated reports across 23 open-source projects, and the first patch merged into the Linux kernel via the Linux Foundation's Akrites coordinated-disclosure initiative. Using their multi-model agentic scanning harness MDASH and GPT-5.5-based validation agents, the team measured automated PoC generation at an average $3.61/21.5 minutes per confirmed crash and local privilege-escalation AEG at $8.56/25.4 minutes, and argues the real bottleneck has shifted from finding bugs to validating and remediating them at matching speed. Specific disclosed CVEs include curl's CVE-2026-9545 and CVE-2026-13608, Node.js's CVE-2026-56848, and Linux kernel's CVE-2026-64563.

microsoft.comwriteupPublished and added 7 Oct 2026🛡️ Security

Huntress researchers reconstruct an Akira ransomware attack timeline using forensic artifacts collected after the Huntress agent was installed post-compromise, including Windows Registry Shellbags, Event Logs, and Akira ransomware log files. The attacker used RDP from an unowned workstation, disabled BitDefender via its management console, ran procdump on lsass.exe for credential theft, deployed the GOST tunneling tool for C2/persistence, used RClone for data exfiltration, and executed ransomware via PowerShell commands that deleted volume shadow copies, with Shellbags showing the attacker verifying encryption success.

huntress.comwriteupPublished and added 6 Oct 2026🛡️ Security

Vals.ai researchers describe using Claude Opus 5.5-driven AI agents to run density-functional-theory simulations (PBE+U and HSE06 functionals) that designed a novel candidate magnet, YBaMnFeO₅, and separately re-identified a 1999 compound, KV[Cr(CN)₆] (a Prussian-blue analogue), as a "Luttinger compensated" semiconductor — a material with zero net magnetic moment but spin-sorted band edges, useful for spintronic memory. The agents predicted band gaps, spin-sorting windows, and magnetic ordering temperatures (KV[Cr(CN)₆] reportedly stays ordered above room temperature, up to 376 K), and the authors published all inputs, outputs and code on GitHub for independent verification. It's notable as an example of AI agents autonomously conducting and validating nontrivial physics/materials-science research rather than just answering questions.

vals.aiwriteupAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

Checkmarx's research team documents MALFEX, an npm supply-chain malware campaign run by a single operator ("Murizada") publishing since August 2023, with 12 packages (8 malicious), three still live as of late September/October 2026. The campaign delivers three distinct Windows payloads: Overlord RAT (a Go-based C2 that reads its server address from encrypted Solana blockchain transactions and uses process hollowing into TapiUnattend.exe), the movinlike Node.js stealer (targeting Discord, browser credentials, Telegram, and crypto wallets, exfiltrating via Discord webhook), and a long-running downloader hidden in function-flag's postinstall script. The writeup includes full IOCs, file hashes, host artifacts, detection commands, and remediation guidance for compromised Windows hosts.

checkmarx.comwriteupAdded 7 Oct 2026, published 5 Oct 2026🛡️ Security

Huntress explains why endpoint security typically misses ClickFix (no file artifact to scan) and how its Attack Disruption engine detects it instead: matching the obfuscated command-line shape gated on the parent process always being explorer.exe for Windows+R/Run-dialog execution. The post walks through a real incident where a user pasted a caret-obfuscated finger.exe download cradle disguised with Unicode padding to hide 'push enter' social engineering text, killed in under 1.25 seconds across four spawned processes, and describes a fix for variants that use 'start' to detach the payload process from its killed parent.

huntress.comwriteupPublished and added 5 Oct 2026🛡️ Security

Walkthrough of Platypus, an open-source C2-style host management platform (github.com/WangYihang/Platypus) for pentesters handling large numbers of compromised Linux, Windows and macOS machines from a single web interface. Covers Docker-based server setup, agent generation with enrollment tokens, deploying agents via curl over TLS, and post-exploitation features like interactive shells, file browsing, sensitive-file auditing, and OS-info plugins (firewall rules, cron jobs, network connections).

hackers-arise.comwriteupAdded 7 Oct 2026, published 2 Oct 2026🛡️ Security

Socket's Threat Research team uncovered a theme-extension cluster spanning four VS Code Marketplace and six Open VSX listings, including two confirmed malicious extensions: Aurora Nocturne Night Theme (a Windows downloader that fetches and silently executes temp_batch.cmd via cmd.exe from fingercakes4sale[.]store, tied to XWorm C2 infrastructure) and Cosmic Nebula Themes, whose app.js decrypts an AES-256-CBC embedded stage and uses a Solana transaction memo as a dead-drop to resolve follow-on payload infrastructure — the same AES key, Solana address, and execution model previously documented in GlassWorm activity. Git commit identities, near-identical theme source, shared Russian-language developer comments, and brandjacking (Coca-Cola, Aurora Borealis name-squatting) link the cluster together; a Dec 14, 2025 DEV Community article is assessed as promotional infrastructure driving Open VSX installs. The post provides full IOCs (hashes, domains, Solana address, AES key/IV, GitHub accounts) and MITRE ATT&CK mappings for defenders to hunt and inventory extensions across both registries.

socket.devwriteupPublished and added 2 Oct 2026🛡️ Security

A Latent Space podcast transcript/interview with MIT PhD student Alex Zhang, creator of Recursive Language Models (RLMs) and a core contributor to GPU Mode and KernelBench, who discusses using recursive subagent calls, context offloading, and shared memory to let models work beyond fixed context windows. The conversation ranges across AI-generated GPU kernels and their verification gap, research taste in academia versus industry labs, why "harnesses" (as in Claude Code, Codex, and Pi) function as compositional generalizers, the Jev model's non-autoregressive output-space trade-offs, and large-scale agent swarm experiments at OpenAI, Kimi, and Sakana AI. It offers a researcher's-eye view of where capability overhang and new agent/harness architectures may be heading beyond today's standard transformer decoder.

latent.spacewriteupPublished and added 2 Oct 2026🧠 AI

Huntress breaks down how Microsoft Defender Antivirus (MDAV) path/extension exclusions can be abused to hide malicious binaries from scans, detailing the registry internals (HKLM...Windows Defender\Exclusions vs the GPO-driven Policies key) and the four ways to set them: PowerShell (Set/Add-MpPreference), the MSFT_MpPreference WMI class, GPO, and direct registry edits. It documents real-world abuse by GootKit (2019), WhisperGate (2022), and Muddled Libra (2024), plus an under-documented trick where setting HideExclusionsFromLocalAdmins blocks even SYSTEM from querying exclusions via PowerShell/WMI, and describes the registry-level telemetry and detections Huntress built to catch both behaviors.

huntress.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Cisco Talos details UAT-11587, a China-nexus threat cluster targeting government, defense, and policy organizations across Taiwan, India, the Philippines, Cambodia, and other Asian countries with spear-phishing and a five-stage infection chain (HTA/WSF stagers, JScript decryptors, .NET BinaryFormatter/ActivitySurrogateSelector deserialization gadgets, and DLL sideloading via the signed GatherOsState.exe) to deploy a new Rust-compiled backdoor called Antino. Antino uses Microsoft Graph/Outlook/OneDrive as a dead-drop C2 channel instead of a traditional C2 server, supports shell/PowerShell execution, file transfer, shellcode loading with a sleep-mask evasion technique, and abuses the Windows Scripted Diagnostics framework for persistence; Talos also notes possible infrastructure overlap with Symantec's "Jewelbug" cluster and Arctic Wolf's UNC6384 reporting. Includes ClamAV/Snort coverage and IOCs.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft Defender Experts document a July 2026 phishing campaign that delivers a masqueraded but legitimately signed MSP360 RMM installer (v2.5.0.67) via meeting-invite, Zoom, Adobe, and DHL-themed lures hosted on both attacker infrastructure and legitimate cloud services (S3, Cloudflare R2, Dropbox, GitLab, Supabase). After UAC-elevated installation and service persistence, the RMM.Agent.exe service launches PowerShell to silently install a ConnectWise ScreenConnect client via msiexec, which the actor then uses via RunFile to drop credential-theft and reconnaissance tools disguised as Windows/Defender/Phone Link components. A separate July intrusion used FaronicsDeployAgent.exe the same way to deploy ScreenConnect, showing the technique is not MSP360-specific; Microsoft provides IOCs, hunting queries, and mitigation guidance (Application Control, AppLocker publisher rules, ASR rules) but does not attribute the activity.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

Wiz walks through a case study of its "Blue Agent" autonomous SOC investigator tracing a compromised CI/CD service account (svc_automation) across AWS and GitHub. The attack chain: a stolen GitHub token cloned 18 private repos containing hardcoded AWS keys, which were used to authenticate to AWS from Kali Linux via a Zenlayer VPN IP, pivot to a second account, run SSM SendCommand against a production Windows domain controller, and stage custom Python exfiltration scripts (mssql_table_export.py, pg_table_export.py, billing_export2.py) in S3 to pull data from MSSQL, PostgreSQL, and billing systems. The piece details the investigative technique used - 30-day baseline comparison, ASO/IP dispersion across the tenant, and correlating CloudTrail management-plane events with S3 data-plane events and GitHub audit logs.

wiz.iowriteupPublished and added 29 Sep 2026🛡️ Security

Part 2 of a research series on ZDI-26-708, a Windows Network Connectivity Status Indicator (NCSI) flaw where a proxy configured in an unprivileged user's HKCU ends up used by the NETWORK SERVICE-owned netprofm process. The author reverse-engineers ncsi.dll and winhttp.dll with IDA/WinDbg to show the value actually arrives via a Windows Event Log subscription to Event ID 5600 (Microsoft-Windows-WinINet-Config) rather than the WNF notification initially suspected, is stored in NCSI's user-proxy state, and is later applied to a WinHttpSetOption(38) call for an active connectivity probe. It documents why option 193 (WINHTTP_OPTION_DISABLE_PROXY_AUTH_SCHEMES) fails to disable NTLM (wrong bitmask, 0x100 vs 0x04), and demonstrates cross-context NTLM proxy authentication capture/relay with impacket-ntlmrelayx toward ADCS, since the request runs under the netprofm/NETWORK SERVICE machine-account context.

pgj11.comwriteupPublished and added 28 Sep 2026🛡️ Security

A researcher reverse-engineers Windows NCSI (ncsi.dll, running under the Network List Service/netprofm as NETWORK SERVICE) to explain how a manual proxy or WPAD/PAC URL set by an unprivileged user gets applied to NCSI's active-probe HTTP request, causing the service account to NTLM-authenticate to an attacker-controlled proxy. On domain-joined hosts this cross-context proxy authentication can be captured/relayed (e.g. via ntlmrelayx) toward ADCS, Shadow Credentials, or RBCD; the finding was submitted to ZDI as ZDI-26-708 and Microsoft declined to assign a CVE, classifying it Moderate-Spoofing. Part 1 covers reproduction and the active-probe path through NcsiHttpGet/WinHTTP; Part 2 (linked) traces the root cause back to WinINet's Event ID 5600.

pgj11.comwriteupPublished and added 28 Sep 2026🛡️ Security

Huntress researcher Andrew Schwartz demonstrates a novel OAuth token-theft technique: a sideloaded AppX package registered via Add-AppxPackage -Register (requiring only Developer Mode, no admin beyond that toggle) can set ContentUriRules WindowsRuntimeAccess="all" so attacker-controlled JavaScript rendered inside the Microsoft-signed WWAHost.exe process gets full WinRT access, including the legacy WebAuthenticationBroker OAuth API. Using Microsoft Office's own client ID and the oob redirect URI, the attacker triggers a genuine login.microsoftonline.com/MFA dialog with no browser chrome, captures the auth code, and exchanges it for an access token plus a long-lived refresh token carrying the full Office delegated Graph scope set (mail, files, Teams, directory, AuditLog.Create) — validated end-to-end against a live Entra ID tenant with MFA and default Conditional Access. The post frames it as a class of vulnerable signed AppX host binaries sharing the same WinRT activation layer, and provides a Sigma rule keyed on the MSAppHost/3.0 EdgeHTML user agent reaching non-Microsoft destinations, plus Sysmon/Event ID and GPO-based mitigations (restricting Developer Mode, Conditional Access, shorter refresh-token lifetimes, CAE).

huntress.comwriteupPublished and added 23 Sep 2026🛡️ Security

Cisco Talos' CAIRN project documents CLOSEDQUORUM, a 64-bit Go Windows implant that replaces traditional C2 infrastructure with a panel of up to four commercial LLM providers (DeepSeek, Qwen, Mistral, Gemini) that vote on the implant's next action via plurality voting, with each model queried against a structured JSON decision schema constrained to inject/persist/steal/move actions. Once deployed it autonomously dumps LSASS credentials, steals browser passwords and crypto wallets (MetaMask, Exodus, Ethereum), and exfiltrates AES-256-GCM-encrypted data to an operator's Discord webhook, all without further human tasking. The post details the developer's apparent credentials-as-a-service distribution model, deterministic tie-breaking favoring DeepSeek, and provides SHA256 hashes plus a YARA detection rule for the family (formerly tracked as BALZAK).

blog.talosintelligence.comwriteupAdded 30 Sep 2026, published 22 Sep 2026🛡️ Security

Huntress details a post-incident investigation into an INC ransomware attack that hit 175+ endpoints, reconstructed from surviving EDR telemetry and Windows event logs rather than live detection. The intrusion shows a 17-day gap between initial scheduled-task persistence and RDP lateral movement (possibly an initial access broker), and a second wave using AnyDesk, a BYOVD tool (hwau.exe loading the HwAudio kernel driver) to disable security controls, and Impacket's atexec.py to deploy INC ransomware. Attackers dropped two distinct ransom notes 53 minutes apart: a standard INC-README.txt and a detailed DATALEAK_PRESS_RELEASE.txt threatening to notify media, employees and partners with a full inventory of stolen files.

huntress.comwriteupAdded 22 Sep 2026, published 21 Sep 2026🛡️ Security

Huntress analysts detail two Settra ransomware incidents (July and September) observed in customer environments, documenting the threat actor's use of the MeshAgent RMM for persistence, BYOVD via the gdrv.sys driver, and anti-forensic techniques including Windows Event Log clearing, reagentc /disable, diskpart-based recovery partition removal, and cipher.exe free-space wiping. The post includes specific IOCs — C2 IPs 45.13.122[.]7 and 193.5.65[.]114, the recurring workstation name WIN-LIVFRVQFMKO, and the RESTORE_FILES.txt ransom note — supplementing prior public reporting from MoxFive and SOCRadar on this newer ransomware variant first seen in June.

huntress.comwriteupAdded 22 Sep 2026, published 17 Sep 2026🛡️ Security

OpenSourceMalware researchers detail WeaselBiscuit, a newly discovered lightweight JavaScript infostealer found hidden in 11+ npm packages (e.g. process-tailwind, engin1, the @biz44 scope), which shares tradecraft with DPRK-linked BeaverTail/OtterCookie but strips out wallet-draining, password decryption, and remote-shell features. The writeup walks through the full infection chain - a package auto-running a detached Node loader, fetching a Base64-encoded second stage from Npoint dead-drop URLs, and beaconing to a hardcoded HTTP C2 (103.170.217.184:8787) - plus its capabilities (Chrome extension-storage theft, clipboard capture, Windows keylogging) and a campaign-cluster graph tying packages together via shared hashes and resolver URLs. Attribution to DPRK is explicitly labeled a tentative hypothesis rather than confirmed.

opensourcemalware.comwriteupPublished and added 17 Sep 2026🛡️ Security

Group-IB documents previously undocumented samples of HEAVYGRAM, a Python/PyInstaller-based Windows backdoor that uses the Telegram bot API for command-and-control, screen/audio capture, data exfiltration, and DLL side-loading, alongside the related CRUDEEXCLUDE loader that adds Windows Defender exclusions. The research corroborates and extends a March 2026 US DOJ affidavit and FBI FLASH report, attributing the malware with moderate confidence to the Handala Hack persona — assessed as a false-flag "hacktivist" front for Void Manticore (aka Storm-0842/Banished Kitten), operating on behalf of Iran's MOIS — used since Fall 2023 against Iranian dissidents, journalists, and critics of the Iranian government via Telegram-delivered, Delphi-packaged lures (fake KeePass, Telegram, Pictory apps). It details four infection-chain variants (WSF/VBS downloaders, HTA Telegram-polling scripts, Delphi droppers with embedded archives), the implant's command prefixes (@@/**/##) and attachment handlers, dual-bot C2 configurations, and provides IOCs and detection/hardening recommendations.

group-ib.comwriteupAdded 1 Oct 2026, published 17 Sep 2026🛡️ Security

SpecterOps research introduces "Pass-the-Passkey," a family of 20+ attack techniques against passkey/WebAuthn authentication, including three zero-days: Windows 11 logging complete WebAuthn assertions to an Event Log readable by unprivileged users (patched July 2026), Microsoft Entra ID historically failing to enforce WebAuthn anti-replay protections (challenge reuse, session binding, signature counters), and local malware that calls the native Windows WebAuthn API directly to phish users with a convincing native-looking passkey prompt. The write-up argues these implementation failures mirror classic credential-relay attacks like Pass-the-Hash and NTLM Relay, and recommends device-bound passkeys with attestation enforcement for high-value accounts.

specterops.iowriteupAdded 2 Oct 2026, published 16 Sep 2026🛡️ Security

Huntress SOC analysts Ryan Dowd and Jon Semon tore apart a live social-engineering campaign that began with a fake CoinDesk marketing exec DMing a researcher a Google Doc containing a container-bound Apps Script sidebar. The script ran client-side without OAuth consent, exfiltrated victim IP/geolocation/wallet presence via the Telegram API, then routed macOS users to a piped zsh/DMG AMOS stealer chain and Windows users through ClickOnce and PowerShell loaders using three stolen or fraudulent code-signing certificates (a Norwegian company, Discord, and Lenovo). The Windows chain culminated in NetSupport Manager RMM abuse, a Ledger wallet implant, and a self-generated rogue root certificate authority (spoofing Google Trust Services) installed via MsBuild.exe hollowing to silently intercept HTTPS traffic, which the authors flag as the artifact most likely to survive incident remediation short of full reimaging.

huntress.comwriteupAdded 11 Sep 2026, published 15 Sep 2026🛡️ Security

Endor Labs' live incident tracker for the Shai-Hulud 2.0 npm supply-chain worm that began around Nov 24, 2025, compromising packages from Zapier, ENS Domains, Postman and PostHog. It details the infection chain (malicious preinstall script, setup_bun.js dropper, obfuscated bun_environment.js payload), TruffleHog-style credential theft from AWS, GCP, Azure, GitHub and npm, self-replication via stolen npm and GitHub tokens, a self-hosted GitHub Actions runner backdoor abusing repository Discussions for command injection and C2, and destructive wiper behavior that shreds the user's home directory on Windows and Linux.

endorlabs.comwriteupPublished and added 11 Sep 2026🛡️ Security

Huntress analyzed a fake GTA6 game ISO (some padded to 100GB+ with junk data) distributed via SEO poisoning, gaming forums, and torrents ahead of the game's real release. The ISO's "installer" drops a Russian-language crack-themed installer that stages multiple NJRAT copies, a DCRAT implant, the Mercurial Grabber infostealer (exfiltrating browser/Discord/Roblox/Minecraft data via Discord webhooks), Chaos ransomware repurposed as a destructive wiper (with a fake "license not found" error to mask the compromise), and an unexplained Yandex Browser install. The writeup includes IOCs (C2 IPs, ngrok tunnel, hosts-file modifications, malicious Discord webhook URL) and notes current Windows Defender detects the components.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Huntress SOC details two August incidents where phishing emails led victims through a fake CAPTCHA/Adobe PDF Reader lure into a browser-in-the-browser (BiTB) page spoofing get.adobe.com, tricking them into installing a ScreenConnect client disguised as an Adobe Reader update. The installer chained to a second rogue ScreenConnect client via curl/cmd.exe, both registered as Windows services for persistence, then executed defense-evasion binaries (HideCursor.exe, HideUL.exe) to hide cursor/screen activity before Huntress disrupted the intrusions. Full IOCs (domains, ScreenConnect client IDs/relays, file hashes/paths) are included for defenders.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Proofpoint details "BlueMoon," a novel exploit kit chaining a Chrome V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape via WebAssembly metadata corruption (CVE-2026-87491), and a Windows kernel LPE (CVE-2026-85880) to break out of the browser sandbox. Within days of first use by China-aligned TA412 (28 Aug 2026), the kit was independently adopted by UNK_LateNight (delivering ShadowPad to US aerospace targets), UNK_DoubleCheck (Rust-based loader against a Vietnamese manufacturer), and UNK_QuietRacket (custom malware against Indonesia/Singapore government and finance targets). The piece analyzes exploit internals (Maglev/TurboFan JIT bug, reflective DLL loading, ALPC/WNF kernel exploitation), flags artifacts suggesting AI-assisted exploit development (debug comments, handover markdown files, v8CTF references), profiles the GemStone Chromium-extension credential-theft backdoor deployed via Secure Preferences forgery, and provides IOCs, ET rules, and a YARA rule for detection.

proofpoint.comwriteupAdded 26 Sep 2026, published 9 Sep 2026🛡️ Security

Aikido researchers found a delayed RCE in the Unreal Engine 5-based game MECCHA CHAMELEON, exploitable via a malicious Steam Workshop map. A Blueprint-exposed audio recording function allowed arbitrary file writes via path traversal, a null-byte trick stripped the auto-appended .wav extension to drop an .exe into the Windows Startup folder, and PCM audio samples were crafted byte-for-byte to smuggle a polyglot WAV/HTA payload that launches mshta.exe and runs arbitrary code on reboot. The issue was patched in the game's 4.0.0 update.

aikido.devwriteupPublished and added 3 Sep 2026🛡️ Security

Huntress researchers uncovered the operator console for "Knight Office," a Flask-based adversary-in-the-middle (AiTM) phishing kit used to steal Microsoft 365 session tokens via a DocuSign-themed, self-spoofed lure that routes victims through Monday.com redirects and a compromised Joomla site to a fake Microsoft device-code authentication page. After capturing tokens, the attacker registered a rogue device in Microsoft Entra ID and bound a Windows Hello for Business key credential to the compromised account to maintain persistent, MFA-bypassing access even after token revocation. The writeup details IOCs (IPs, .vu domains, User-Agent strings), links the campaign to hundreds of reported phishing emails since April, and gives defenders concrete hunting/response steps around callback-proxy sign-ins and newly registered WHfB credentials.

huntress.comwriteupAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Cisco Talos details UAT-10147, a Chinese-speaking cybercrime group exploiting one-day vulnerabilities in Windows/Linux web servers to deploy BadIIS, QuasarRAT, NoodleRAT, and SPECTRE implants, while also integrating agentic AI tools (PentestGPT, DeepAudit, and AI-orchestrated ysoserial workflows) to generate exploit playbooks, automate ASP.NET ViewState deserialization RCE, validate exploit success, and run reconnaissance/exfiltration end to end. Talos recovered AI-generated Python scripts and a findings log from the actor's C2 open directory showing semi-autonomous exploit refinement, OOB callback verification via webhook.site, and privilege escalation via SeImpersonatePrivilege/Potato exploits — evidence of a shift from AI-assisted scripting toward agentic offensive orchestration.

blog.talosintelligence.comwriteupAdded 24 Aug 2026, published 20 Aug 2026🛡️ Security

Huntress researchers document a phishing campaign targeting Black Hat/DEF CON attendees via X DMs impersonating a CoinDesk exec, luring victims into opening a weaponized Google Doc with a custom Google Apps Script sidebar that runs a fake "decryption" flow before delivering ClickFix-style commands or a manual "update" that drops malware. On macOS this delivers AMOS infostealer plus a LaunchDaemon-based polling backdoor with SOCKS5 proxy capability; a follow-up fake DocSend/Dropbox installer delivers a ClickOnce/NSIS loader chain on Windows that installs NetSupport RAT, a process-hollowed rogue Certificate Authority that MITMs VirusTotal traffic, and an incomplete Ledger wallet-targeting implant. The piece includes deep technical detail on the loader's C2 protocol, stolen/fraudulent code-signing certificates, and infrastructure patterns (multi-branded loader domains), plus mitigation guidance and a link to published IOCs.

huntress.comwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

Follow-up analysis showing that the RubyGems StubMaker typosquatting campaign and a separately-discovered 40-package npm typosquatting campaign (targeting chalk, commander, lodash, typescript, react, axios) are run by the same threat actor: both use install-time hooks (extconf.rb vs postinstall.js) to fetch a Rust loader from the same GitHub release, which decrypts a byte-for-byte identical Go infostealer confirmed by matching SHA-256 hashes. The stealer harvests browser credentials (bypassing Chromium app-bound encryption), crypto wallets/seed phrases, and Telegram data, exfiltrating via Gofile to a webhook at dresslee.com, and includes WSL-to-Windows sandbox escape logic. The post publishes full network/file IOCs and hashes and argues network-layer blocking (C2 IP and webhook domain) is more durable than package-name blocklisting.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

Researchers identified "StubMaker," a RubyGems typosquat campaign (brumdler, brundlef, and 15 packages typosquatting bundler/i18n/rake/activesupport) that abuses the extconf.rb native-extension hook to fake a successful build while beaconing victim OS info and, on Windows, downloading a Rust loader (main.exe) from a GitHub release. The loader decrypts an embedded 11MB Go infostealer entirely in memory, which injects an embedded DLL (abe_payload.dll) into Chromium browsers via the elevation-service COM object to defeat Application-Bound Encryption and steal passwords, cookies, payment cards, crypto wallets/seed phrases, and Telegram data, exfiltrating via Gofile and a webhook at dresslee.com. The piece also details how RubyGems.org's namespace-reclaim behavior let a different account (mod8rz41mje) take over the yanked "brumdler" name to relaunch the campaign, and includes full IOCs and hashes.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 16 Aug 2026🛡️ Security

Huntress details an Akira ransomware intrusion from August 2026 that followed the group's usual SonicWall SSL VPN → domain controller → AD enumeration → WinRAR/s5cmd exfiltration → detonation playbook, but with a new twist: the affiliate ran msconfig.exe to force a reboot into Safe Mode with Networking (MITRE T1688), which killed the Huntress agent and Windows Defender real-time protection while preserving network access, after pre-registering an AnyDesk service to survive the minimal Safe Mode driver set. The blog notes Safe Mode's constrained virtual memory appears to have caused akira.exe to crash with out-of-memory errors, accidentally sabotaging the attacker's own encryption run, and closes with detection guidance for boot-configuration changes, Safe Mode Kernel-Boot/Kernel-General event IDs, and Safe Boot registry tampering.

huntress.comwriteupAdded 3 Sep 2026, published 12 Aug 2026🛡️ Security

XBOW's autonomous AI agent chained a blind SSRF in Bing's reverse-image-search into three Critical Microsoft RCEs (CVE-2026-32194, CVE-2026-32191, CVE-2026-21536), each CVSS 9.8, by fingerprinting an ImageMagick-compatible backend through differential error responses and crafting an SVG payload that reached a shell-backed image delegate. The proof was confirmed via out-of-band callbacks showing NT AUTHORITY\SYSTEM and root execution across multiple production Bing image-processing workers on both Windows and Linux hosts. The piece walks through the full investigative trace — from ruling out XXE to fingerprinting ImageMagick coders/pseudo-protocols to constructing the pipe-based SVG exploit — and argues that ImageTragick-class bugs in "boring" image helpers remain a live, underrated attack surface.

xbow.comwriteupPublished and added 8 Aug 2026🛡️ Security

OpenSourceMalware documents WEL1DROPPER (aka Flooding Dropper), a campaign that published 788+ slopsquatted npm packages (e.g. checkout-mobile-bnpl) which execute on require() with no install script, downloading cross-platform RAT/infostealer payloads via rotating Cloudflare Workers URLs with a DNS TXT-record fallback channel. The writeup reverse-engineers the Linux (UPX-packed ELF) and macOS (universal Mach-O) second-stage payloads, detailing anti-analysis checks, LaunchAgent persistence disguised as com.apple.windowserver.helper, XOR-obfuscated C2 domains, a suspected Sliver C2 final stage, and ties the campaign to Russian financial-sector lures and the earlier Moika npm campaign.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

Huntress details a July 2026 incident where attackers exploited a classic SQL injection flaw in a public-facing Java/Tomcat application to reach an Oracle database over JDBC, then used Oracle's CREATE JAVA SOURCE statement to compile a custom post-exploitation toolkit called khunt directly as database objects. Khunt modules (KhuntCmd, KhuntHash, KhuntFS/FS2, KhuntT, KhuntUnzip) let the attacker run OS commands, dump Oracle credentials, browse the filesystem, and ultimately pivot to SYSTEM-level RCE on the underlying Windows host, where they exfiltrated SAM/SECURITY/SYSTEM registry hives. It's notable because storing malicious code as PL/SQL/Java database objects rather than OS files/processes evades traditional EDR and AV visibility.

huntress.comwriteupAdded 3 Sep 2026, published 5 Aug 2026🛡️ Security

Huntress dissects a Bank of America-themed phishing email that lures victims into downloading AccountGuardSetup.vbs, which unpacks through several layers of base64-encoded PowerShell to silently install ScreenConnect RMM with Administrator privileges. The chain uses AES-128-CBC encrypted blobs to deliver a C# UAC-bypass exploit via the ICMLuaUtil COM interface (MITRE ATT&CK T1548.002), then hides the resulting ScreenConnect service (renamed "Windows Security") from users and admins using SDDL/ACL manipulation so it can't be seen, logged, or removed.

huntress.comwriteupAdded 3 Sep 2026, published 4 Aug 2026🛡️ Security

Second installment of a reverse-engineering series examining xhunter2.sys, a Windows kernel driver, focusing on its three-layer authentication mechanism. Based on the title and URL only (page content could not be processed this pass); likely details disassembly/unpacking work to bypass or understand the driver's access-control checks, relevant to BYOVD/EDR-killer tradecraft analysis.

blacksnufkin.github.iowriteupAdded 2 Oct 2026, published 4 Aug 2026🛡️ Security

A technical writeup by security researcher BlackSnufkin describing the discovery of a live, unpatched 0day kernel-mode local privilege escalation (LPE) vulnerability in an anti-cheat driver reportedly deployed on roughly a billion Windows machines. The post likely covers the vulnerability research and exploitation process targeting the anti-cheat's kernel component. Full page content could not be verified in this pass; summary is inferred from title and URL alone.

blacksnufkin.github.iowriteupAdded 2 Oct 2026, published 4 Aug 2026🛡️ Security

In-depth OSINT/threat-intel investigation into CRPX0, a ransomware group that emerged in July 2026 with 47 listed victims (mostly healthcare, mainly US/Turkey targets), tracing its origins to a prior "Flash Token" crypto/USDT money-laundering scam service run by the same operators. The piece covers domain registration analysis (REGRU-SU abuse, reused 2021 domain), dark web/clear web leak sites, RaaS/HaaS/affiliate program offerings, ClickFix-based payload delivery targeting Windows via EXE/DLL, YouTube affiliate-panel promotion analysis (voice/locale clues suggesting China), TOX/Session ID and Bitcoin address correlation, and real IP address deanonymization, concluding with IOCs and MITRE ATT&CK mapping.

theravenfile.comwriteupAdded 3 Sep 2026, published 3 Aug 2026🛡️ Security

Chapter 0 of a 5-part series on exploiting HackSys Extreme Vulnerable Driver (HEVD) for Windows kernel privilege escalation via a stack overflow bug. This installment covers environment setup (Hyper-V/VMware with SMEP support, WinDbg kernel debugging attach, DbgPrint enablement) as prep for later chapters that will detail bypassing kASLR, SMEP, and KPTI/KVA Shadow and building a sysret-based ROP shellcode chain.

mdanilor.github.iowriteupAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

A DFIR field notes post describing how attackers abuse NSSM (Non-Sucking Service Manager) to run tools like ngrok as a Windows service, hiding the real executable behind the legitimate nssm.exe ImagePath. It walks through hunting techniques: checking Event ID 7045 service-installation logs, inspecting the service's registry Parameters subkey to reveal the true application/arguments, and confirming via live process command-line analysis (Process Explorer, Velociraptor's Windows.System.Pslist), illustrated with a second real case where nssm.exe was wrapping a "komari-agent" implant.

dfir.chwriteupAdded 3 Sep 2026, published 27 Jul 2026🛡️ Security

Xygeni details FauxUV, a cluster of PyPI packages (moon-uv, my-magic-uv-helper) that impersonate the popular Rust-based Python package manager uv but carry almost no real functionality. Instead, on Windows they launch JupyterLab with authentication disabled (empty token, bound to 0.0.0.0, XSRF checks off) and, in later versions, expose it to the internet via a Pinggy SSH reverse tunnel, turning a legitimate data-science tool into an open remote shell that inherits the installing user's credentials. The writeup traces the install-time PowerShell trigger moving from setup.py to a separate CLI tool across versions and provides IOCs and detection guidance.

xygeni.iowriteupPublished and added 18 Jul 2026🛡️ Security

Socket's Threat Research Team analyzed 11 malicious NuGet DotnetTool packages (published by account pepegit666) that impersonate game cheats/bots for titles like GTA5RP, Albion Online, and Throne and Liberty. Each package's .NET downloader resolves GitHub hosts via DNS-over-HTTPS, requests UAC elevation to resync the clock, and fetches a PyInstaller Windows payload (pepesoft.exe) from GitHub Releases/Hugging Face with dormant BitTorrent fallback code, that in turn authenticates to Google Sheets for telemetry, hardware-binds licenses, enforces a remote HWID ban-list, and, in three samples, drives Telegram bot commands that exfiltrate screenshots and modify Windows Installer registry keys on exit. The report includes full IOC lists (hashes, domains, hardcoded AWS-style keys, mutex GUID) and MITRE ATT&CK technique mappings.

socket.devwriteupPublished and added 15 Jul 2026🛡️ Security

Huntress SOC analysis of a June incident where a threat actor exploited a SQL injection flaw in an IIS/MSSQL web application to gain access, then extensively modified the environment: enabling Terminal Services, creating a rogue admin account (adminweb2$), disabling Windows Defender, deploying BadIIS malicious IIS modules (HttpFastCgiModule.dll, HttpCgiModule.dll) for SEO fraud, installing the XMRig cryptominer with nssm.exe persistence and hidden/system file attributes, and dropping additional PowerShell/batch payloads (qdcjoke1.2.ps1, c_joke1.2.ps1) via base64-encoded PowerShell and Out-of-Band Application Security Testing (OAST) exfiltration channels (oastify.com).

huntress.comwriteupAdded 3 Sep 2026, published 13 Jul 2026🛡️ Security

Huntress SOC incident writeup detailing a threat actor who exploited Adobe ColdFusion vulnerabilities (CVE-2023-26360, CVE-2023-29298, CVE-2023-29300) to drop a steganographic webshell hidden inside an image, then returned with a full defense-impairment batch script (i.bat) that disabled IIS logging, tampered with Windows Defender, killed/deleted security services (Sysmon, filebeat, SentinelOne, DrWeb, ImmunetProtect), used Image File Execution Options to freeze logging tools, deleted ModSecurity WAF module, enumerated FileZilla and multilingual local admin groups, weakened WDigest to force plaintext credentials in memory, dumped credentials via a Mimikatz kernel driver (mimidrv.sys), deleted CLSID/WScript registry keys, and cleared Windows event logs. The piece walks through each command block with attacker rationale and closes with concrete mitigation guidance for defenders.

huntress.comwriteupAdded 3 Sep 2026, published 29 Jun 2026🛡️ Security

A DFIR.ch deep-dive on stealthier alternatives to LSASS dumping for harvesting Windows cleartext credentials, covering WDigest re-enablement, PowerShell ConsoleHost_history.txt, AD user-attribute leaks, Group Policy Preferences (GPP) cPassword, and rogue Security Support Provider (SSP), Password Filter DLL, and Network Provider DLL registration. Each technique is illustrated with real incident-response case data (registry commands, malicious DLL names like kerberos_sp.dll and mimilib.dll, and exfiltrated log paths), paired with Sysmon Event ID 13/11 detection guidance and hardening recommendations (disabling custom SSPs, Protected Event Logging).

dfir.chwriteupAdded 3 Sep 2026, published 28 Jun 2026🛡️ Security

Part 6 of Huntress's "From Code to Coverage" series reverse-engineers ldapnomnom's LDAP Ping (cLDAP-style) Active Directory username enumeration technique, tracing its Go source down to the Windows Filtering Platform to test the tool's claim of generating "no Windows audit logs." Lab testing shows Event 1644 never fires for LDAP Ping (it's processed by netlogon.dll, not the ntdsa.dll LDAP engine it monitors), but netlogon.log captures every queried username including disabled-account detail attackers can't see, while Event 5156 attributes source IP for ldapnomnom's TCP connections — a gap that disappears entirely if an attacker switches to true UDP cLDAP (as demonstrated with a custom cldap_ping.py), leaving only MDI's threshold-based external ID 2437 as network-layer coverage. The piece also audits the ldeep tool's enum_users transport and provides a PowerShell correlation script joining netlogon.log and Event 5156 within a 5-second window.

huntress.comwriteupAdded 3 Sep 2026, published 24 Jun 2026🛡️ Security

Socket's research team documents a supply chain attack in which npm account "ehindero" mass-published 141 malicious versions of @mastra/* packages (including @mastra/core, 918K weekly downloads) that were byte-identical to legitimate code but added a single new dependency: the typosquatted package easy-day-js. That package's postinstall hook (setup.cjs) disables TLS validation, fetches a second-stage cross-platform Node.js implant (protocal.cjs) that installs OS-specific persistence (Windows Run key, macOS LaunchAgent, Linux systemd unit disguised as Node/NVM tooling), inventories 166 cryptocurrency wallet browser extensions, steals Chrome/Edge/Brave history, and accepts arbitrary remote tasking (Node/Shell runners) from a hardcoded C2 over a custom ICAP-style protocol. The writeup includes full IOCs, SHA-256 hashes, and remediation guidance (rotate npm/CI/SSH credentials, treat affected hosts as compromised, disable install scripts).

socket.devwriteupPublished and added 20 Jun 2026🛡️ Security

Huntress SOC incident report on an internet-facing RD Gateway/RDWeb terminal server compromised via credential reuse with no MFA, where the actor staged Gammadyne Mailer (a legitimate commercial bulk-mail tool) to send 8.9 million Boots-impersonation phishing emails direct-to-MX from the victim's clean IP, evading AV entirely. The phishing kit itself was hosted on a compromised Bolivian government domain (ipelc.gob.bo) to inherit its trust and dodge reputation blocklists, and the writeup details the log-forensics (Windows Security log gaps, Terminal Services operational logs, Chainsaw parsing, WFP Event 5157) used to reconstruct the timeline and attribute a separate opportunistic brute-force bot.

huntress.comwriteupAdded 3 Sep 2026, published 15 Jun 2026🛡️ Security

Huntress SOC dissects a multi-stage infection chain that begins with a malspam HTML attachment routed through a legitimate Google DoubleClick tracking link to evade reputation filters, before landing on a self-personalizing phishing kit and dropping a ZIP with a heavily obfuscated JScript loader. The chain cascades through PowerShell droppers into a .NET stager that performs extensive anti-analysis/anti-sandbox checks, disables Windows Defender, patches AMSI (via NtManageHotPatch on Windows 11 24H2) and ETW at the native API level, and uses RunPE process hollowing into InstallUtil.exe or MSBuild.exe to run a final loader that communicates over AES/RSA-encrypted, protobuf-serialized TCP C2 with certificate pinning. The writeup includes GPU-fingerprinting behavior, persistence via registry Run keys and randomized scheduled tasks, and concrete detection/hardening recommendations.

huntress.comwriteupAdded 3 Sep 2026, published 3 Jun 2026🛡️ Security

Huntress researcher demonstrates that Windows' search: URI handler leaks a user's Net-NTLMv2 hash via the crumb=location: parameter, exploitable via a single clicked link (e.g. in Edge) or a `start` command with no admin rights or malware needed. The bug mirrors CVE-2026-33829 (Snipping Tool's ms-screensketch: handler, patched by Microsoft in April 2026) since both trace to the same DelegateExecute CLSID (SearchExecute/CLSID_SearchMSExecute in ExplorerFrame.dll), but MSRC closed this report as Moderate severity with no CVE and no fix, citing case-by-case servicing exceptions. The post includes reproduction steps with Responder, notes prior related disclosures by Varonis (search-ms:, 2024) and Trellix (search:, 2023), and recommends mitigations like blocking outbound SMB, enforcing SMB signing, and restricting NTLM.

huntress.comwriteupAdded 3 Sep 2026, published 2 Jun 2026🛡️ Security

Huntress SOC details two Gentlemen ransomware incidents showing Windows Event Log clearing, PowerShell-based Defender tampering, and Scheduled Task persistence via a fake svchost32.exe creating a SOCKS proxy C2 connection. Ties findings to a leaked internal RaaS database revealing CVE-2024-55591 exploitation and infrastructure links to Qilin and Lazarus Group.

huntress.comwriteupAdded 3 Sep 2026, published 21 May 2026🛡️ Security

Huntress SOC breaks down how attackers disable AV/EDR: blocking agent communications via malicious/hidden Windows Firewall rules (WFP), abusing Add/Remove or CLI to uninstall EDR agents, abusing Defender AV exclusions, and Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel access and kill protected security processes. Includes real intrusion examples — a February 2026 SonicWall VPN-credential intrusion using a revoked-but-still-trusted 2006 EnCase forensic driver (exploiting a legacy Windows Driver Signature Enforcement exception) to kill 59 named security processes every second, and a March 2026 malvertising campaign (Google Ads for W-2/W-9 forms) that dropped a rogue ScreenConnect instance and used a vulnerable signed Huawei audio driver to terminate EDR/AV processes.

huntress.comwriteupAdded 3 Sep 2026, published 18 May 2026🛡️ Security

A researcher details an autonomous vulnerability-hunting system built with Claude Code and 8 custom MCP servers (300+ tools) across a 5-VM Proxmox lab, using a "hallucination bin" validation pipeline (findings must pass PoC/exploitability/low-priv gates before promotion) and a RAG-backed knowledge loop that learns from prior campaigns. Concrete outputs include two new Go standard library CVEs (CVE-2026-33809 TIFF OOM, CVE-2026-33812 SFNT/GPOS OOM), a four-stage Windows OEM management-agent chain (named-pipe auth bypass → SSRF via WCF → catalog injection → SYSTEM code execution via BYOVD), and two macOS app-distributor findings (browser/quarantine DB exfiltration and a leaked debug RSA key enabling Sparkle update-signature bypass). Also covers a self-built token-cost/ROI tracker (TokenBurn) and a bounty-program ROI-scoring model for target selection.

blog.zsec.ukwriteupAdded 3 Sep 2026, published 13 May 2026🛡️ Security

Huntress documents a malspam campaign, active since February 27, that uses fake "service agreement" document lures behind a CloudFlare CAPTCHA to trick targets into installing Tiflux, a lesser-known Brazil-based commercial RMM, before pivoting to UltraVNC, Splashtop, and ScreenConnect for persistent remote access. The Tiflux installer bundles suspicious extras beyond the legitimate agent: a decade-old UltraVNC build with hardcoded plaintext-recoverable passwords, an expired UltraVNC code-signing cert, registry files that stage a hidden TightVNC service (enabled even in Safe Mode) and a passwordless PuTTY SSH key to a peopleone[.]com[.]br server, registry tweaks that suppress Windows Secure Attention Sequence consent prompts, and a known vulnerable HwRwDrv.sys driver linked to privilege escalation with a revoked signing certificate. Huntress frames this as another entry in the ongoing "LOLRMM" pattern of attackers abusing legitimate commercial RMM tools for stealthy access and persistence.

huntress.comwriteupAdded 3 Sep 2026, published 7 May 2026🛡️ Security

Huntress and Akamai researchers detail "dMSA Ouroboros," a technique where a low-privileged domain user with CreateChild on any OU/container plus WriteProperty on a target account creates a delegated Managed Service Account (dMSA), plants a Shadow Credential via msDS-KeyCredentialLink for PKINIT auth, and writes the dMSA's own SID into msDS-GroupMSAMembership so it authorizes itself via S4U2Self to continuously extract the superseded account's NT hash. The resulting loop survives password rotation, survives deletion of the original attacker account, and can lock Domain Admins out of remediation, with deletion of the dMSA object being the only effective fix; the post also proposes BloodHound detection edges and Microsoft declined to service it as a CVE, classifying it as persistence rather than privilege escalation.

huntress.comwriteupAdded 3 Sep 2026, published 4 May 2026🛡️ Security

Huntress details a live intrusion where an attacker used stolen SSLVPN credentials, Impacket's smbexec.py (a customized fork with randomized artifact names) for lateral movement and registry-hive dumping, then enabled RDP via reg/netsh changes to interactively install the open-source "Komari" monitoring agent as a SYSTEM-level service named "Windows Update Service" via NSSM. Unlike other abused RMM/monitoring tools (Velociraptor, SimpleHelp, ScreenConnect, AnyDesk, Nezha, Atera), Komari ships arbitrary command exec, an interactive PTY reverse shell, and distributed ping/port-scanning enabled by default over a WebSocket that blends in as normal HTTPS traffic — turning a legitimate 4.3k-star GitHub monitoring tool into an out-of-the-box botnet-style C2 with no weaponization required.

huntress.comwriteupAdded 3 Sep 2026, published 30 Apr 2026🛡️ Security

Huntress documents Dragon Boss Solutions LLC, a code-signed adware/PUP vendor whose off-the-shelf Advanced Installer update mechanism was configured to poll an unregistered domain (chromsterabrowser[.]com) for updates, meaning anyone who registered it for $10 could push arbitrary payloads with SYSTEM privileges to every infected host. The deployed payload, ClockRemoval.ps1, kills AV processes via WMI event subscriptions and a 100ms polling loop, disables AV services, poisons the hosts file against AV update domains, and carves out Windows Defender exclusions for future payload staging. Huntress registered the domain first, sinkholed it, and observed 23,565 unique infected hosts across 124 countries within 24 hours, including universities, OT/critical infrastructure networks, government entities, and Fortune 500 companies.

huntress.comwriteupAdded 3 Sep 2026, published 14 Apr 2026🛡️ Security

Huntress researchers solve the long-standing 'ADWS attribution problem' where tools like SOAPy abuse Active Directory Web Services to hide the attacker's real source IP behind localhost ([::1]) in LDAP diagnostic logging (Event 1644). By correlating Windows Filtering Platform Event 5156 (which captures the real inbound source IP on port 9389 before ADWS proxies to loopback) with Event 1138 (ADWS session) and Event 1644 (LDAP query) using a stable ~60-80ms timestamp window, they demonstrate reliable attribution even when port-based correlation fails due to log rollover. The post includes a released PowerShell script (Get-ADWSAttribution.ps1) and addresses the false-positive concern of RSAT tools also using ADWS via pattern detection on suspicious 1644 query attributes.

huntress.comwriteupAdded 3 Sep 2026, published 9 Apr 2026🛡️ Security

Huntress's rapid-response analysis of the March 2026 compromise of the axios npm package, in which an attacker took over maintainer jasonsaayman's npm account and published backdoored axios releases (5.14.1, 4.2.1) depending on a phantom package plain-crypto-js whose postinstall script dropped a cross-platform RAT to macOS, Windows, and Linux. The writeup details the obfuscated dropper (setup.js), platform-specific payloads (wt.exe EDR-evasion trick on Windows, com.apple.act.mond on macOS, /tmp/ld.py on Linux), the shared C2 protocol at sfrclak[.]com, and evidence tying the campaign to DPRK-linked actors (UNC1069/BlueNoroff), plus remediation and hardening guidance.

huntress.comwriteupAdded 3 Sep 2026, published 31 Mar 2026🛡️ Security

Huntress SOC details two related incidents where threat actors used PsExec for privilege escalation, a scheduled task ("Recovery Diagnostics") to run base64-encoded PowerShell that configured a renamed copy of restic (winupdate.exe) pointed at a Wasabi S3 bucket, then disabled/removed VIPRE Business Agent and Windows Defender before deploying INC ransomware. A second, near-identical prior incident on 9 February reused the same AWS access keys and used HRSword to disable Acronis security tooling, and the same TTPs were independently documented by the Cyber Centaurs team on 22 January 2026. The post highlights detection gaps (incomplete agent deployment, no SIEM) and notes RestartManager API telemetry (also seen with Akira) as a ransomware-encryption indicator.

huntress.comwriteupAdded 3 Sep 2026, published 12 Mar 2026🛡️ Security

Huntress details how low-skill threat actors daisy-chain legitimate RMM tools (ScreenConnect, Action1, HeartbeatRM, AnyDesk, Atera, etc.) via invitation and Social Security themed lures, LLM-generated infostealer scripts, and multi-fallback browser download tricks hosted on GitHub repos (VH851, Drasticc) to gain and disguise persistent access. It also documents firsthand observation of an actor who signed up to Huntress itself, revealing their toolchain (DeepSeek, Email Extractor, Proxy SwitchyOmega, 9Proxy, CertifyTheWeb, Sordum Hide from Uninstall List, and a fake Windows Security PIN harvesting binary pin.exe) and victim data such as W-9 forms and SSNs collected via Telegram based exfiltration.

huntress.comwriteupAdded 3 Sep 2026, published 11 Mar 2026🛡️ Security

Huntress investigated malicious GitHub repositories impersonating OpenClaw installers (Feb 2-10, 2026) that were surfaced as the top Bing AI search result for "OpenClaw Windows." The Windows installer deployed a new packer dubbed Stealth Packer alongside Vidar and PureLogs infostealers and GhostSocks — a BlackBasta-linked SOCKS backconnect proxy malware that routes attacker traffic through the victim's machine to bypass MFA and anti-fraud checks — while a parallel macOS campaign delivered a signed Mach-O AMOS stealer variant via a fake "puppeteerrr/dmg" repo, later detected by an Apple XProtect update. The blog includes full technical teardown, GitHub account/organisation abuse patterns, and IOCs.

huntress.comwriteupAdded 3 Sep 2026, published 4 Mar 2026🛡️ Security

Deep technical dive into the Windows LNK (shortcut) binary file format by researcher Wietze Beukema, explaining how attackers abuse ambiguities between what Windows Explorer's Properties dialog displays and what actually executes. Covers the in-the-wild CVE-2025-9491 command-line padding trick plus four newly documented variants exploiting EnvironmentVariableDataBlock, LinkTargetIDList and LinkInfo fields to spoof targets and hide command-line arguments, and releases the open-source lnk-it-up toolkit (lnk-generator and lnk-tester) for building and detecting these malicious LNKs.

wietzebeukema.nlwriteupAdded 2 Oct 2026, published 12 Feb 2026🛡️ Security

Huntress details active exploitation of SolarWinds Web Help Desk deserialization vulnerabilities (CVE-2025-26399, plus CVE-2025-40551 which is in CISA KEV, and CVE-2025-40536) across three customer intrusions, tracing an attack chain from wrapper.exe/java.exe spawning silent MSI installs of Zoho Assist, through Velociraptor abused as a C2 framework, a Cloudflare Workers/mooo.com HTTP-406-triggered C2 failover mechanism, Get-ComputerInfo exfiltration to an attacker-run Elastic Cloud instance, Windows Defender/Firewall disabling via registry edits, and QEMU-based SSH backdoor persistence via a "TPMProfiler" scheduled task. It provides mitigation guidance (patch to WHD 2026.1, remove admin interface from the internet, reset credentials) and links to Sigma detection rules.

huntress.comwriteupAdded 3 Sep 2026, published 8 Feb 2026🛡️ Security

A technical deep dive into the Windows Projected File System (ProjFS), explaining how it virtualizes/projects files via a minifilter driver and reparse point tags (IO_REPARSE_TAG_PROJFS and IO_REPARSE_TAG_PROJFS_TOMBSTONE) rather than being a true file system. It details the provider API, file operation notifications (create, delete, read, rename), and hints at both offensive and defensive use cases such as canary files for detecting unauthorized file access.

huntress.comwriteupAdded 3 Sep 2026, published 5 Feb 2026🛡️ Security

Huntress details a February 2026 intrusion beginning with compromised SonicWall SSLVPN credentials, where the attacker deployed an EDR killer that decodes and drops a legitimate but revoked 2006-era EnCase forensic driver (EnPortv.sys, service name OemHwUpd) to terminate 59 different EDR/AV processes from kernel mode via a single IOCTL (KillProc). The write-up explains the driver's novel wordlist-substitution-cipher payload encoding (evading entropy and string-based detection), FNV-1a process-name hashing for fast target matching, timestomping/persistence tricks, and why Windows Driver Signature Enforcement still trusts the expired/revoked certificate due to pre-2015 signing and timestamp exceptions. It closes with concrete mitigations: MFA on VPN, HVCI/Memory Integrity, WDAC vulnerable-driver blocklist rules, and the ASR rule blocking vulnerable signed drivers.

huntress.comwriteupAdded 3 Sep 2026, published 4 Feb 2026🛡️ Security

A pentest writeup explaining why remote logons with a shared local administrator account (e.g. from a gold image) fail against tools like psexec/smbexec/WinRM due to UAC's LocalAccountTokenFilterPolicy registry key, and how attackers can still succeed either by flipping that key, abusing the RID 500 Administrator account (governed by the separate FilterAdministratorToken key, which is unfiltered by default), or by using protocols not subject to UAC token filtering such as SSH and RDP. The author demonstrates the failure and bypass end-to-end using nxc (NetExec) and Impacket against a Windows 11 target from Kali Linux, and notes LAPS as an effective mitigation for RID 500 abuse.

bencteux.frwriteupAdded 3 Sep 2026, published 31 Jan 2026🛡️ Security

Huntress dissects a KongTuke campaign built around NexShield, a malicious Chrome extension impersonating uBlock Origin Lite that induces a deliberate browser DoS/crash and then displays a fake "CrashFix" repair prompt to trick users into pasting a malicious PowerShell command via the Windows Run dialog. The command abuses finger.exe as a LOLBin to fetch and execute layered, obfuscated PowerShell that profiles the victim (domain-joined vs standalone, AV, VM checks), uses weekly-rotating DGA domains, an AMSI patch bypass, and a two-layer AES+XOR encrypted .NET loader ("GateKeeper") with anti-sandbox fingerprinting, ultimately dropping ModeloRAT — a newly documented, RC4-encrypted Python RAT reserved for domain-joined corporate hosts — while non-domain targets currently only receive a "TEST PAYLOAD" response. The post includes full IOCs and YARA rules for GateKeeper, MintsLoader, and ModeloRAT.

huntress.comwriteupAdded 3 Sep 2026, published 16 Jan 2026🛡️ Security

Part two of a Huntress detection-engineering series showing that Windows Event 1644 logs LDAP filters from Active Directory's LDAP Service Layer with inconsistent, undocumented whitespace around bitwise operators, causing naive Sigma rules for Impacket tools like findDelegation.py to fire only ~30% of the time. The author walks through iterating from exact-string matches to whitespace-tolerant, case-insensitive regex (e.g. `.*userAccountControl\s*&\s*524288.*`), a pre-filter-then-regex pattern for SIEM performance, and a final production Sigma rule combining userAccountControl bitwise checks, requested-attribute lists, and source-IP filtering to reliably catch RBCD/delegation abuse.

huntress.comwriteupAdded 3 Sep 2026, published 30 Dec 2025🛡️ Security

Huntress DFIR writeup analyzing three related intrusions (Nov 6, 17, 25) that all began with command execution via IIS's w3wp.exe against custom login/web pages, followed by attempts to deploy a Golang trojan (agent.exe, identified in one case as SparkRAT) using certutil.exe as a LOLBin downloader. Using EDR telemetry, Sysmon, and IIS/web logs, the analysts trace repeated failures — Windows Defender blocks, failed service starts for a "WindowsUpdate" persistence service, mistyped/unsuccessful executions — and show how the same actor adapted between incidents by proactively adding Windows Defender exclusions and later deploying a renamed GotoHTTP RMM tool, illustrating that real intrusions are messier and more iterative than the "sophisticated playbook" narrative suggests.

huntress.comwriteupAdded 3 Sep 2026, published 22 Dec 2025🛡️ Security

Huntress documents a multi-stage ClickFix campaign (fake "Human Verification" and fake Windows Update lures) that copies an mshta command to the clipboard, which chains through obfuscated PowerShell and reflectively-loaded .NET assemblies to a custom steganographic loader. The loader extracts Donut-packed shellcode encoded in the pixel data of an AES-encrypted PNG (via a red-channel XOR scheme) and injects it into explorer.exe, ultimately deploying LummaC2 or Rhadamanthys infostealers; the writeup includes deobfuscation walkthroughs (dnSpy), a Python re-implementation of the stego algorithm, IOCs, and mitigation guidance (disabling the Run box, RunMRU auditing).

huntress.comwriteupAdded 3 Sep 2026, published 24 Nov 2025🛡️ Security

A Huntress blog post (part one of a series) describing how Velociraptor, a DFIR/endpoint forensics and hunting tool, can be misused alongside WSUS (Windows Server Update Services) for offensive purposes, such as living-off-the-land style abuse or lateral movement. The fetched content only contained site navigation, not the article body, so specific technical details (exploitation steps, payloads, detection guidance) could not be confirmed.

huntress.comwriteupAdded 3 Sep 2026, published 20 Nov 2025🛡️ Security

Deep technical teardown of the Entra ID (Azure AD) Broker's LocalState cache on Windows 11, reverse-engineering the file naming scheme derived from identity material, the AES-GCM/DPAPI-wrapped Packer::V3 format inside AAD.Core.dll, and the JSON/binary serialization of AuthenticationContext objects used for PRT and per-application authority files. The author shows how to decrypt cached PRT and authority token files, derive the TPM-bound PRT session key via NCryptKeyDerivation (replicating mimikatz's dpapi::cloudapkd), and extract cached access/refresh tokens and JWTs — giving an attacker with local SYSTEM context a path to long-lived, MFA-bypassing cloud access and rich identity reconnaissance data. Companion extraction code is released as AADBrokerDecrypt on GitHub.

winternl.comwriteupAdded 2 Oct 2026, published 30 Sep 2025🛡️ Security

Huntress researcher explores using Windows Performance Monitor (PerfMon) and its underlying ETW Active Directory Diagnostics trace as an alternate Kerberos telemetry source for detecting Kerberoasting, AS-REP Roasting, and the lesser-known 'Roasting from the AS' technique, going beyond standard Event IDs 4768/4769. The post demonstrates attacks with Rubeus against a lab AD domain, shows how mass TGS/AS request spikes and LDAP serviceprincipalname queries appear in PerfMon counters, and also touches on detecting obfuscated LDAP queries via Charlie Clark's PowerView fork.

huntress.comwriteupAdded 3 Sep 2026, published 23 Jan 2025🛡️ Security

A DFIR.ch lab writeup that tests BC-Security's ScriptBlock Smuggling technique, which abuses PowerShell's ScriptBlockAst to make malicious code execute while a spoofed benign-looking script gets written to the Script Block log (Event 4104), bypassing AMSI without reflection or memory patching. The author shows that while the 4104 log is indeed spoofed, PowerShell Module Logging (Event 4103) still captures the real executed code, and Windows Defender/AMSI flagged the test payload as Trojan:PowerShell/ScriptSmug.A, meaning defenders retain multiple detection opportunities. It also references an AtomicRedTeam test for the technique and notes in-the-wild adoption to deliver Vidar-Stealer.

dfir.chwriteupAdded 3 Sep 2026, published 13 Sep 2024🛡️ Security

dfir.ch analyzes a malicious LNK file (schedule.lnk) served from an open directory that downloads a next-stage payload (Erlianaw.exe) over WebDAV via rundll32.exe and davclnt.dll. The post highlights a lesser-known DFIR artifact: WebDAV file transfers cache a copy of the retrieved executable in C:\Windows\...\AppData\Local\Temp\TfsStore\Tfs_DAV\{GUID}.exe, which can be matched against VirusTotal hashes to recover the delivered payload even without the original download, and references CVE-2024-21412 regarding companion .url files that can reveal the source URL.

dfir.chwriteupAdded 3 Sep 2026, published 8 Aug 2024🛡️ Security

A DFIR analysis by dfir.ch dissecting a real-world phishing campaign that abuses the Windows "search-ms" URI protocol handler embedded in an HTML attachment ("Booking_Confirmation.html") to trigger a WebDAV connection via rundll32/davclnt.dll, present a spoofed Explorer search result, and lure the victim into executing an LNK file. The LNK launches a headless conhost.exe pulling an obfuscated batch script (new.bat) over a trycloudflare.com tunnel, which drops a decoy PDF, downloads a full Python interpreter (FTSP.zip) and additional scripts, and ultimately performs shellcode injection. The post also documents Sysmon process-create telemetry and the HKCU WordWheelQuery registry key as forensic artifacts of the search-ms query.

dfir.chwriteupAdded 3 Sep 2026, published 4 Aug 2024🛡️ Security

A reverse-engineering walkthrough of qwinsta.exe showing it uses the undocumented WinStation API (winsta.dll) — WinStationOpenServerW, WinStationEnumerateW, WinStationQueryInformationW — rather than the documented Terminal Services (WTS) API used in harmj0y's prior PowerShell approach. The author demonstrates that remote session enumeration via these APIs succeeds against a target host even when Remote Desktop is disabled, and provides C++ code to load winsta.dll, resolve the undocumented function pointers via GetProcAddress, and parse the resulting byte-array structures to extract usernames and session state.

0xv1n.github.iowriteupAdded 3 Sep 2026, published 14 Jul 2024🛡️ Security

A detection engineering methodology post arguing that UEBA/behavior detections should be built around defining undesirable 'states/conditions' rather than chasing mutable 'activity', citing Florian Roth's detection engineering framework. It walks through a worked example: detecting Shadow Credentials attacks (anomalous additions to the AD msDS-KeyCredentialLink attribute) by correlating Windows Event ID 5136 (directory service object modified) with Event ID 4624 (logon) and Microsoft Defender XDR's DeviceNetworkInfo table to flag KCL writes originating from IPs never associated with the target computer, complete with a full KQL query.

attackthesoc.comwriteupAdded 3 Sep 2026, published 7 Jul 2024🛡️ Security

DFIR.ch shows how to abuse ClamAV's scanning temp-file behavior (clamscan --leave-temps --tempdir=) to extract embedded AutoIT scripts from a compiled .exe, using SimpleLapsGui.exe (flagged by multiple AV vendors) as the example. The recovered autoit.001 script and PowerShell payload are validated against output from the dedicated Python tool autoit-ripper, giving analysts two independent, Windows-binary-free methods for automating AutoIT script extraction during malware/PUA triage.

dfir.chwriteupAdded 3 Sep 2026, published 9 Jun 2024🛡️ Security

A DFIR researcher analyzes a PowerShell "cleaner" script discovered in an open directory (flagged by Fox_threatintel) and uploaded to VirusTotal, which threat actors use to erase traces of legitimate RMM tools like Atera and Splashtop after gaining access to a victim machine. The script sets the SystemComponent registry flag to hide the software from Apps & Features, deletes Start Menu/ProgramData installer folders (also targeting AnyDesk), and renames the Splashtop Windows Firewall rule to masquerade as a "Cast to Device" service. The author tests the script on a live machine and shows the anti-forensic tricks are shallow — toggling SystemComponent back to 0 restores visibility and other forensic artifacts still reveal the software.

dfir.chwriteupAdded 3 Sep 2026, published 10 May 2024🛡️ Security

A pentesting-focused writeup explaining how Windows Explorer restrictions NoDrives, NoViewOnDrive, and NoNetConnectDisconnect are configured via registry keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, and demonstrating multiple practical bypasses (explicit path typing, autocomplete, Run box, Microsoft Edge, cmd.exe/PowerShell, loopback network drive mapping). The author notes these are purely visual restrictions enforced by explorer.exe and are trivially circumvented by any non-Explorer GUI or CLI program, making them insufficient as a security control in kiosk or restricted-desktop environments.

bencteux.frwriteupAdded 3 Sep 2026, published 8 Apr 2024🛡️ Security