The Raven File

8 posts in the catalog

Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.

theravenfile.comwriteup

CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD

An incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.

Citrix NetScalerPHPPython+2

CVE-2026-88771CVE-2026-88772CVE-2026-88773+10

Threat Intel, Malware & RE· 2026-10-06T09:48:17+00:00

theravenfile.comwriteup

SETTRA RANSOMWARE

A continuously-updated threat-intel profile of the Settra ransomware group, which emerged June 2026 and has listed 64+ victims across the US, Germany, UK and Canada while avoiding healthcare targets. The analysis covers Settra's Tor-hosted data leak site (protected by Techaro's Anubis anti-bot proof-of-work with EdDSA-signed JWT challenge cookies), its use of multiple rotating onion file servers for leak distribution, extensive AI-assisted victim profiling (bank details, termination letters, financials), likely use of RClone for TB-scale exfiltration, and a walkthrough of its TOX-based and web-based negotiation panel including observed ransom demand negotiation from $900k down to $500k.

TornginxAnubis+1

SettraTITAN Ransomware GroupPLAY Ransomware Group+2

Threat Intel· 2026-09-14T06:06:56+00:00

theravenfile.comwriteup

VEEAM UNDER FIRE: Understanding CVE-2026–44963 & Ransomware Group Exploit Claims

Analysis of CVE-2026-44963, a critical (CVSS 9.4) unsafe-deserialization RCE in Veeam Backup & Replication 12.x rooted in BinaryFormatter/.NET Remoting that lets any low-privilege domain user gain SYSTEM-level control of domain-joined backup servers; fixed in 12.3.2.4854. The author correlates it with a 2025 "Bug of June 2025" exploit sale, documents a Lynx Ransomware Group negotiation describing exploitation to create local admin accounts and dump domain credentials, covers an underground forum ad claiming an unauthenticated patch-bypass 0-day, and includes a Veeam-specific attacker TTP matrix (e.g. CVE-2023-27532 credential harvesting) plus defense recommendations.

Veeam Backup & Replication.NET

CVE-2026-44963CVE-2024-40711CVE-2023-27532+8

Threat Intel, AppSec, Offensive Security· 2026-08-20T06:26:16+00:00

theravenfile.comwriteup

MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker

Deep-dive intelligence report on Majinahanashi, a Japanese-themed ransomware group that emerged in August 2026, covering its Tor data-leak site (math-captcha gated, non-vanity domain), victimology (15 victims across Europe/Asia/Latin America, avoiding US/English-speaking countries), and technical analysis of its C/C++ locker sample. The malware uses AES-256 with RSA-wrapped per-file keys, appends the .MAJIN extension, deletes shadow copies/USN journals/event logs via vssadmin/bcdedit/fsutil, hijacks the desktop wallpaper, and uses WFP-based network filtering plus I/O priority manipulation to suppress EDR/backup traffic (targeting CrowdStrike, SentinelOne, Defender, Veeam, etc.). The article includes a full YARA detection rule, the ransom note text, BTC/qTOX/email contact IOCs, and threat-actor profiling ("THE DOCTOR CAME" persona) plus links to Mimikatz and Advanced IP Scanner usage.

YARAnginxFlask+4

MajinahanashiTHE DOCTOR CAMEYurei+4

Threat Intel, Malware & RE, Blue Team & Detection· 2026-08-14T17:50:45+00:00

theravenfile.comwriteup

CRPX0 — SCAMMER TURNED RANSOMWARE OPERATOR

In-depth OSINT/threat-intel investigation into CRPX0, a ransomware group that emerged in July 2026 with 47 listed victims (mostly healthcare, mainly US/Turkey targets), tracing its origins to a prior "Flash Token" crypto/USDT money-laundering scam service run by the same operators. The piece covers domain registration analysis (REGRU-SU abuse, reused 2021 domain), dark web/clear web leak sites, RaaS/HaaS/affiliate program offerings, ClickFix-based payload delivery targeting Windows via EXE/DLL, YouTube affiliate-panel promotion analysis (voice/locale clues suggesting China), TOX/Session ID and Bitcoin address correlation, and real IP address deanonymization, concluding with IOCs and MITRE ATT&CK mapping.

TorBitcoinTelegram

CRPX0INC ransomwareAPT73+2

Threat Intel, OSINT· 2026-08-03T12:35:32+00:00

theravenfile.comwriteup

INC RANSOMWARE: THREAT INTELLIGENCE

A researcher deanonymizes INC ransomware's Tor negotiation panel (incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion) to a real IP (178.20.41.208, Russia, nginx/Yii PHP backend) running on unusual port 1002, then reverse-engineers the panel's bundled React/Redux/Socket.io JavaScript to map its API endpoints, socket events, JWT-based auth, and leak/ransom-tracking features. The piece also correlates nine clearweb domains and ~170 IPs used by the group over 2023–2025 (65% Russia-hosted, CDN rotation patterns, Cloudflare fronting on one domain) and analyzes 108 ransomware builder samples to infer RaaS versioning, a 2024 forum sale, and links to spin-off groups Lynx and Sinobi.

ReactReduxSocket.IO+3

INC ransomwareLynxSinobi+4

Threat Intel, OSINT· 2026-07-24T18:00:06+00:00

theravenfile.comwriteup

KUDANKULAM NUCLEAR POWER PLANT LEAK: AN ACCIDENTAL DISCLOSURE

An OSINT investigator analyzes a WorldLeaks ransomware group data leak of Reliance Infrastructure (hosted by third-party vendor Yotta), which exposed 14.3GB / ~19,000 files related to India's Kudankulam Nuclear Power Plant (KNPP) — including RFC drawings, PPS fencing designs, HVAC/fire specs, and vendor/employee records. The piece profiles WorldLeaks (a Hive/Hunters International spin-off), lists MD5/SHA-256 hashes for its RustyRocket exfiltration tool, and discusses supply-chain vendor risk, industrial espionage by nation-state actors (Lazarus/DPRK, China), and insider credential trading as threats to critical nuclear infrastructure.

RustyRocketRDP

WorldLeaksHunters InternationalHive+8

Threat Intel, OSINT· 2026-07-17T14:18:53+00:00

theravenfile.comwriteup

DECODING GRIXBA — A PLAY RANSOMWARE SCANNER

A side-by-side reverse-engineering analysis of four Grixba samples (v1 through v3, Sept 2022 to Nov 2024), the custom .NET infostealer/network scanner built by the Play ransomware group to map security tools, credentials, and remote-management software before encryption. The piece traces the binary growth from 164KB to 727KB (adding XOR-encrypted inf_g.dll, SQLite-based ExportData.db output, forged SentinelOne PE metadata, and PIA VPN C2) then its deliberate regression to 118KB to shed public IOCs, backed by MITRE ATT&CK sandbox findings, a shared mutex fingerprint, a weakness scorecard per version, and a full SHA-256/IP/onion IOC table.

.NETSQLiteWMI+3

PlayGrixbaJumpy Pisces (Andariel)+3

Malware & RE, Threat Intel· 2026-06-08T10:09:42+00:00