128 results for “Persistence”

Microsoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.

microsoft.comwriteupPublished and added 31 Oct 2026🛡️ Security

A malicious version 2.1.313 of Anthropic's Claude Code extension was served from Cursor's marketplace for about 11 hours on 29 October 2026, reaching up to 5,000 developers. A JavaScript loader prepended to extension.js added an attacker SSH key, a reverse tunnel and macOS/Windows persistence, and reported to 134.209.82[.]225. Coding errors likely blocked SSH access on many hosts. Cursor removed it and rotated keys; victims should look for an 'svc-telemetry' SSH key.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

Analysis of a trojanized anthropic.claude-code 2.1.313 extension (darwin-arm64), found on Open VSX, with a 66-line loader prepended to extension.js. It adds an svc-telemetry key to authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, sets persistence (LaunchAgent, cron, scheduled task) and sends host recon over HTTP port 8099. Includes IOCs, hashes and response steps; no further payload download was found.

opensourcemalware.comwriteupPublished and added 30 Oct 2026🛡️ Security

The Claude Code VS Code extension anthropic.claude-code 2.1.313 was published on Open VSX on 29 October 2026 with a malicious loader prepended to extension.js. On load it planted an attacker SSH key (svc-telemetry), installed per-OS persistence, opened a reverse SSH tunnel and beaconed host recon over HTTP. Cursor reports at most 5,000 users received it in an 11-hour window. The post gives the timeline, cleanup artifacts and credential rotation steps.

stepsecurity.iowriteupPublished and added 30 Oct 2026🛡️ Security

The article describes reflashing a Huawei E3372h-153 HiLink 4G USB modem so its embedded Linux OS runs an OpenVPN client over the mobile network, creating a covert, network-independent persistence channel after physical USB access. It walks through enabling debug mode, flashing firmware, disabling CD-ROM emulation, configuring DHCP and autorun scripts, and chaining a second L2VPN tunnel to bridge the attacker directly onto the victim's Ethernet segment for tools like Responder. Defense guidance focuses on restricting USB ports and disabling USB network adapters via policy.

hackers-arise.comwriteupPublished and added 28 Oct 2026🛡️ Security

Huntress investigation of incidents in September and October 2025 where a compromised camera management application (CMS.exe) was the initial access vector. Attackers dropped rs.win32.exe, a reverse shell, and sideloaded modified zlib DLLs (IPHLPAPI.DLL, samcli.dll) via the legitimate Microsoft WpcMon.exe in AppData, with Run key persistence and beaconing to 144.172.116[.]37. Includes detection pivots and hardening advice.

huntress.comwriteupAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Storm-0940, a China-linked APT, used the open source AI penetration testing framework Artex to automate a mid-October 2026 campaign against ConnectWise customers, per Microsoft. Artex drove reconnaissance, password spraying and OAuth application abuse at more than 2,900 attempts per minute, with sign-in attempts against over 2,250 tenants. Attackers modified application credentials for persistence, and Microsoft advises correlating service principal sign-ins with Graph activity.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

SARIA (Selective Admission and Reload for Inference Acceleration) is a KV caching system that jointly manages DRAM and SSD for multi-turn LLM agents. It persists only blocks likely to be reused beyond DRAM residency, promotes SSD-hit blocks into DRAM for same-session reuse, and paces DRAM reads with a transfer coordinator. Built on LMCache MP, it cuts SSD writes by 57.1 to 58.9% versus full duplicate caching and mean TTFT by 42.3 to 79.7% versus DRAM-only caching.

arxiv.orgpaperAdded 23 Oct 2026, published 22 Oct 2026🧠 AI

Huntress documents abuse of ConnectWise Cloud Backup (formerly SkyKick) vendor app credentials, used on October 15 from 144.172.64[.]128 to obtain Microsoft Graph tokens in at least 162 customer M365 tenants via client assertion. In one tenant, a ConnectWise Cloud Management Teams app self-assigned Global Administrator and added client secrets to an MSP management app and Huntress's own app, a persistence technique. The post lists application IDs, Entra sign-in and audit-log checks, user-agent indicators (kiota-dotnet vs Python-urllib/3.12, curl/7.88.1), and mitigation steps such as disabling (not deleting) the enterprise apps and reviewing added credentials.

huntress.comwriteupAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

CVE-2026-102764 is an arbitrary file upload in BeyondTrust Remote Support (formerly Bomgar) caused by internal appliance components not validating message origin. Mandiant found it exploited as a zero-day in late August 2026. BeyondTrust disclosed it on 15 October 2026 and CISA added it to KEV on 16 October 2026. The FAQ covers the web shell, root escalation, credential theft, persistence, patching and compromise checks.

watchtowr.comadvisoryAdded 30 Oct 2026, published 16 Oct 2026🛡️ Security

CyberForge "CVE of the Day #079" on CVE-2026-102764, a CWE-290 origin-validation flaw in BeyondTrust Remote Support (advisory BT26-05, CVSS v4 9.3) that allows appliance file operations. It summarises Mandiant/GTIG's exploited intrusion chain (SAWFLY web shell, BARECLAW backdoor, root escalation, persistence) and gives an investigation trail: patch-state verification (BT26-05-RS), evidence preservation, hunting leads with SHA-256 hashes and YARA rules, permission/session correlation, and remediation including clean redeployment and credential rotation. It separates vendor facts from the intrusion's observed behaviour and notes that KEV and EPSS have no entries.

x.comthreadAdded 18 Oct 2026, published 16 Oct 2026🛡️ Security

Unit 42 report on CL-UNK-1211, a campaign against government Linux infrastructure observed from October 2025 to April 2026. Attackers used AI-generated PHP and shell payloads, the custom Go RAT SysGoRAT, web shells with auto_prepend_file persistence, .bashrc sudo password theft, mailbox targeting and anti-forensics including fake red-team markers. It lists TTPs, detections and IOCs including a CVE-2025-55182 scanner.

unit42.paloaltonetworks.comarticleAdded 30 Oct 2026, published 15 Oct 2026🛡️ Security

The paper fine-tunes a pretrained CNN wind-field super-resolution model with differentiable topology-inspired auxiliary losses on speed, gradient magnitude, soft high-speed level sets and local maxima. It also uses fixed-pair supervision at ground-truth persistence-pair endpoints located offline with the Topology ToolKit. A 16-configuration loss study on a fixed 168-field benchmark finds that gradient supervision gives the strongest persistence-diagram improvement, while fixed-pair supervision gives the most consistent joint improvement in persistence-diagram and merge-tree distances. The combined objective cuts bottleneck, W2,∞ and W2,2 distances by 31%, 25% and 27% relative to the pretrained CNN, at a cost of about half of standard fine-tuning's PSNR gain. It also shows that pointwise metrics and topological distances rank CNN and GAN models differently.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus actor, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 in August 2026, per Mandiant incident response. The post details the SAWFLY PHP webshell, BARECLAW SOCKS5 WebSocket tunneler, SUID root escalation, sudoers template persistence, vault credential extraction, log deletion and haproxy.conf changes. It adds YARA rules, detection ideas and patch-first remediation (BT26-05).

cloud.google.comwriteupAdded 29 Oct 2026, published 15 Oct 2026🛡️ Security

Unit 42 case study of an intrusion at a European bank that began through a third-party-managed VPN gateway lacking strict authentication. The attacker used compromised credentials, ran noisy network scans, brute-forced administrator accounts and scraped internal documentation. A WSUS remote code execution attempt on the configuration management server was stopped by Cortex XDR, and threat hunting found no persistence.

unit42.paloaltonetworks.comarticleAdded 30 Oct 2026, published 13 Oct 2026🛡️ Security

Joint FBI/CISA/NSA and allied-agency advisory on China-linked actors enabled by Integrity Technology Group (overlapping with Flax Typhoon, Ethereal Panda, Red Juliett). It details their TTPs: open-source scanners and the MicroScan exploit-script app, an XSS credential-harvesting payload dropping live700_v1.exe, EBurst password spraying against Exchange/O365, SoftEther VPN persistence, DCSync via DC.exe, and email theft via the Curlc4.txt PHP bot and the office-cli utility. It also provides IOCs, MITRE ATT&CK mappings, CVEs, incident response steps, and mitigations.

cisa.govadvisoryAdded 9 Oct 2026🛡️ Security

Alert summarizing Socket Threat Research's disclosure that a malicious version of the Tensorlake npm SDK (an AI-agent infrastructure package) was published with a preinstall hook delivering Shai-Hulud/ChainDrop credential-stealing malware. The payload targets GitHub, npm, AWS, Kubernetes and Vault credentials, persists via a gh-token-monitor mechanism, and spreads through compromised publishing accounts. It lists IOCs (lib/setup.mjs, lib/Math_Symbol.js) and warns to remove the persistence before revoking stolen GitHub tokens, since revocation triggers a destructive routine. Socket detected the release about 11 minutes after publication.

x.comadvisoryAdded 11 Oct 2026, published 9 Oct 2026🛡️ Security

Huntress reports in-the-wild exploitation of two unpatched AhsayCBS vulnerabilities (CVE-2026-105133 and CVE-2026-105134) affecting all versions up to and including the latest 10.3.4. Attackers chain an authentication bypass with OS command injection via the Replication Receiver API to gain unauthenticated RCE with System privileges, drop JSP webshells, deploy XMRig cryptominers disguised as Microsoft Edge, achieve persistence using a modified NSSM binary as a fake Microsoft Edge Update service, and load the vulnerable WinRing0x64.sys driver for kernel-level miner access (BYOVD). At least five organizations were targeted as of October 8; Huntress recommends restricting management-interface access until a patch is released.

securityweek.comarticlePublished and added 9 Oct 2026🛡️ Security

The US, alongside UK, Australian, Canadian, Japanese, New Zealand, and Spanish agencies, disrupted MicroScan and FishHub, hacking tools built by China's Integrity Technology Group and used by the state-sponsored actor Flax Typhoon (aka Ethereal Panda, Red Juliett, Storm-0919, UNC5007) against US, Japanese, Polish, and Taiwanese critical infrastructure and universities. MicroScan is a Python-based scanner with over 1,300 penetration-testing scripts targeting Apache Struts, Jenkins, WebLogic Server, WordPress, OpenSSL, and other services, delivered via a Mirai-derived IoT botnet; FishHub let operators remotely search and exfiltrate files from victim networks. The advisory also details the group's broader toolkit (SoftEther VPN for persistence, EBurst for Exchange password spraying, DC.ex for Active Directory data extraction) and the seizure of the domains used to access the tools.

securityweek.comarticlePublished and added 9 Oct 2026🛡️ Security

A Twitter/X post digests joint advisory AA26-281A from FBI, CISA, NSA and allied agencies (UK, Australia, Canada, Japan, New Zealand, Spain) on China-based Integrity Technology Group enabling threat actors, tracked elsewhere as Flax Typhoon, Ethereal Panda and Red Juliett, to target US critical infrastructure, government, healthcare, education and law enforcement networks worldwide. The actors chain open-source scanners, large botnets, XSS, password spraying against Microsoft Exchange, VPN persistence and credential-harvesting scripts. CISA added five exploited CVEs (ISC BIND, Apache Struts, ProFTPD, ONLYOFFICE Docs, Strapi) to its KEV catalog with an Oct 11 federal remediation deadline, and STIX IOCs accompany the advisory.

x.comthreadPublished and added 8 Oct 2026🛡️ Security

The FortiBleed campaign targets internet-exposed Fortinet FortiGate firewalls and SSL VPN appliances using stolen credentials and brute force. SOCRadar confirms about 86,644 compromised devices in 194 countries. A joint FBI and US Secret Service advisory says attackers change passwords and delete accounts to lock victims out and keep persistence, and lists hardening steps such as phishing-resistant MFA and credential resets.

securityweek.comarticlePublished and added 8 Oct 2026🛡️ Security

StepSecurity details how tensorlake@0.5.144 was pushed to npm after malicious commits landed directly on the tensorlakeai/tensorlake GitHub repo's main branch under a maintainer's identity, carrying a valid npm provenance attestation despite being malicious. The preinstall hook downloads Bun to run an obfuscated payload that steals GitHub/npm tokens, cloud and Vault/Kubernetes secrets, SSH keys, browser logins, and AI-tool configs (Claude, Cursor, Windsurf), then self-propagates by republishing stolen npm packages and committing persistence files (.claude/settings.json, .vscode/tasks.json) to reachable repos. A "hostage token" mechanism installs a gh-token-monitor service that runs a home-directory wipe if the stolen GitHub token is revoked before the monitor is removed, inverting the normal incident-response order.

stepsecurity.iowriteupPublished and added 8 Oct 2026🛡️ Security

Huntress researchers reconstruct an Akira ransomware attack timeline using forensic artifacts collected after the Huntress agent was installed post-compromise, including Windows Registry Shellbags, Event Logs, and Akira ransomware log files. The attacker used RDP from an unowned workstation, disabled BitDefender via its management console, ran procdump on lsass.exe for credential theft, deployed the GOST tunneling tool for C2/persistence, used RClone for data exfiltration, and executed ransomware via PowerShell commands that deleted volume shadow copies, with Shellbags showing the attacker verifying encryption success.

huntress.comwriteupPublished and added 6 Oct 2026🛡️ Security

An incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.

theravenfile.comwriteupPublished and added 6 Oct 2026🛡️ Security

Explains PEP 829's new .start files in Python 3.15, which let a package register package.module:callable entries in site-packages that execute automatically every time an interpreter starts, before any user code runs. The author walks through a reproducible lab showing code execution via a .start file, contrasts it with the older executable-import .pth file technique it replaces, and gives forensic hunting commands (using python -S to avoid triggering the mechanism during investigation) to locate and audit .start files on disk.

dfir.chwriteupAdded 6 Oct 2026, published 4 Oct 2026🛡️ Security

GitHub release notes for Sigma r2026-07-01, the open-source detection-rule repository, adding 20 new rules (e.g. LSASS crash via Netlogon buffer overflow CVE-2026-41089, TanStack supply-chain attack indicators for Windows/Linux, RedTail cryptominer user-agent detection, AF_ALG kernel crypto API exploit indicator) and updating/fixing dozens of existing rules for ARM64 binary variants, file-sharing domain IOCs, and WMI-based reconnaissance/persistence detection. It's a routine but substantive update to a widely-used blue-team detection content pack.

github.comrepoAdded 3 Oct 2026🛡️ Security

Unit 42 threat brief on CVE-2026-88771 (unauthenticated command injection) and CVE-2026-88772 (DTLS memory overflow) in NetScaler ADC and Gateway, both CVSS v4.0 9.5 and exploited as zero-days from August 2026. It details version fingerprinting, .deb and PHP web shells, a three-stage log-poisoning chain through ns_monuploadd_err.pl, httpd.conf persistence, IOCs, and 50,277 exposed instances as of 27 September 2026.

unit42.paloaltonetworks.comadvisoryAdded 30 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft Threat Intelligence tracked in-the-wild exploitation of CVE-2026-73570, an unauthenticated OS command-injection vulnerability in Zimbra Collaboration Suite's SNMP notification path (swatchdog-to-snmptrap), triggerable via a crafted SMTP request when the optional zimbra-snmp package is enabled. The post documents pre-disclosure scanning, JSP webshell deployment, a novel pam_exec/zmmailboxdmgr privilege-escalation chain to root, systemd-based persistence (zimlog.service), theft of zimbraPreAuthKey/zimbraAuthTokenKey via zmlocalconfig and LDAP, lateral movement over Zimbra's SSH identity, a multi-stage Go-based remote-access agent (zimclient2 via zimdown2/agent2.sh), a dedicated mailbox-exfiltration implant, and an AzCopy-based exfiltration attempt, closing with Defender XDR KQL hunting queries and MITRE ATT&CK mapping.

microsoft.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Cisco Talos details UAT-11587, a China-nexus threat cluster targeting government, defense, and policy organizations across Taiwan, India, the Philippines, Cambodia, and other Asian countries with spear-phishing and a five-stage infection chain (HTA/WSF stagers, JScript decryptors, .NET BinaryFormatter/ActivitySurrogateSelector deserialization gadgets, and DLL sideloading via the signed GatherOsState.exe) to deploy a new Rust-compiled backdoor called Antino. Antino uses Microsoft Graph/Outlook/OneDrive as a dead-drop C2 channel instead of a traditional C2 server, supports shell/PowerShell execution, file transfer, shellcode loading with a sleep-mask evasion technique, and abuses the Windows Scripted Diagnostics framework for persistence; Talos also notes possible infrastructure overlap with Symantec's "Jewelbug" cluster and Arctic Wolf's UNC6384 reporting. Includes ClamAV/Snort coverage and IOCs.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft Defender Experts document a July 2026 phishing campaign that delivers a masqueraded but legitimately signed MSP360 RMM installer (v2.5.0.67) via meeting-invite, Zoom, Adobe, and DHL-themed lures hosted on both attacker infrastructure and legitimate cloud services (S3, Cloudflare R2, Dropbox, GitLab, Supabase). After UAC-elevated installation and service persistence, the RMM.Agent.exe service launches PowerShell to silently install a ConnectWise ScreenConnect client via msiexec, which the actor then uses via RunFile to drop credential-theft and reconnaissance tools disguised as Windows/Defender/Phone Link components. A separate July intrusion used FaronicsDeployAgent.exe the same way to deploy ScreenConnect, showing the technique is not MSP360-specific; Microsoft provides IOCs, hunting queries, and mitigation guidance (Application Control, AppLocker publisher rules, ASR rules) but does not attribute the activity.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security