ThreatsDay Roundup: 296,000-Device IoT Botnet, 100+ Water Systems Targeted, SharePoint Flaws Probed
Summary
This ThreatsDay roundup covers Dysphoria’s nearly 296,000 compromised IoT devices, attacks targeting 100+ exposed U.S. water systems, SharePoint flaw probing, and new phishing, malware, botnet, and AI-agent threats.
Key points
- ReliaQuest said an employee entered credentials and approved an MFA push after a fake SSO page and impersonation calls. The attacker briefly accessed an identity dashboard in view-only mode; the company reported no access to applications, systems, or customer data.
- The Dysphoria botnet has compromised nearly 296,000 IoT devices. Researchers said it appears intended for DDoS attacks and has recently gained residential proxy functionality.
- CISA said July attacks attributed to Iranian threat actors targeted more than 100 internet-exposed U.S. water and wastewater systems. The targeted PLCs were connected directly to cellular modems.
- Aeternum moved its C2 infrastructure to the Polygon blockchain, using smart contracts to distribute commands. ToxNetV2 uses an LLM in its controller workflow, but higher-impact actions require operator approval.
- A stored XSS flaw in Microsoft Purview could expose compliance reviewers’ tokens and enable account takeover; Microsoft has issued a service-side fix.
- Defused Cyber observed probing of SharePoint flaws CVE-2026-55040 and CVE-2026-63520 against honeypots; it reported no code execution.
- Reco reported that 80% of AI tools it assessed lacked IT oversight, while 62% of 500 published agent tools and MCP servers could both read local data and reach the internet. The Deadbugz campaign also used an MCP server that revealed secret-seeking instructions after three ordinary tool calls.
Article Details
- Event Type
- Weekly cybersecurity threat bulletin covering social engineering, malware and botnet activity, exposed systems, and vulnerability exploitation.
- Impact
- ReliaQuest reported that an employee’s credentials and approved MFA push gave an attacker brief, view-only access to its identity dashboard; the company said no applications, systems, or customer data were accessed. The bulletin also reports nearly 296,000 devices compromised by the Dysphoria botnet and more than 100 internet-exposed U.S. water and wastewater systems targeted. SharePoint flaws were probed against honeypots, with no code execution observed there. A Microsoft Purview vulnerability could expose reviewer tokens and enable account takeover; Microsoft issued a service-side fix. The HP ThinPro disk-encryption bypass vulnerability remains unpatched.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | reliaquest[.]claims | Reported among domains used in a ShinyHunters campaign following the company[.]claims pattern; the source does not attribute ReliaQuest’s separate social-engineering incident to ShinyHunters. |
| IPV4 | 144[.]172[.]96[.]13 | IP address of attacker-controlled open directories where the Miraak post-exploitation framework was exposed, according to Blackpoint Cyber. |
MITRE ATT&CK
T1056.001 · KeyloggingPackClient plugins can log keystrokes.T1059.001 · PowerShellA malware delivery chain used PowerShell.T1059.003 · Windows Command ShellA malware delivery chain used cmd.exe.T1059.007 · JavaScriptMalicious JavaScript was described executing in an authenticated Purview reviewer’s browser.T1078 · Valid AccountsThe attacker used the employee’s entered password and approved push to obtain a brief session on the identity dashboard.T1105 · Ingress Tool TransferSeveral reported RATs and loaders download additional modules or payloads from operator infrastructure.T1113 · Screen CaptureRATs and stealers described in the article capture victim screens.T1190 · Exploit Public-Facing ApplicationThreat actors probed SharePoint flaws to obtain remote code execution; no code execution was observed on the reported honeypots.T1498 · Network Denial of ServiceDysphoria’s primary function was reported as apparently supporting DDoS attacks.T1539 · Steal Web Session CookieReported stealers collect session cookies from browsers.T1555.003 · Credentials from Web BrowsersReported stealers collect browser-stored credentials and passwords.T1566.002 · Spearphishing LinkPhishing links and lures were reported as delivery methods for malware and credential theft.T1573 · Encrypted ChannelThe JWR framework uses an AES-CTR-encrypted WebSocket, and ToxNetV2 uses encrypted peer-to-peer command-and-control.T1621 · Multi-Factor Authentication Request GenerationThe targeted employee approved an MFA push notification, giving the attacker a brief session.T1656 · ImpersonationAn attacker impersonated a ReliaQuest security employee during calls to direct teammates to a fake SSO page.
CVE
CVE-2026-55040Defused Cyber has warned that threat actors are exploiting two Microsoft SharePoint flaws – CVE-2026-55040 (an authentication bypass flaw in the JWT token validation pipeline) and CVE-2026-63520 (an improper inputCVE-2026-63520flaws – CVE-2026-55040 (an authentication bypass flaw in the JWT token validation pipeline) and CVE-2026-63520 (an improper input validation in Microsoft Office SharePoint that allows code execution) – to obtain
People
Threat Actors
AndroidKitKatIdentified as a Russian-speaking actor selling the Octagon Android fraud bot as malware-as-a-service.ShinyHuntersThe source says the group listed ReliaQuest on its dark web portal and was associated with a campaign using company[.]claims-pattern domains. ReliaQuest did not attribute the separate social-engineering incident to the group.TA4922Identified as a Chinese-speaking threat actor using the PackClient RAT and C2 framework in campaigns impersonating tax authorities.
Malware
AeternumFrom ReliaQuest and Microsoft Purview to ShinyHunters, Aeternum, ToxNetV2, and PackClient, attackers keep using trust, urgency, and weak visibility to gain access and expand control.Amatera Stealerserver from which it should retrieve additional malware.” This ultimately leads to the deployment of Amatera Stealer and other malware.CNCMachineRMSNew stealers and RATs, including Phantom Stealer, Vanta Stealer, Salat Stealer, and CNCMachineRMS, targeted credentials and remote access.DysphoriaBotnets and loaders like Dysphoria, Aeternum, and ToxNetV2 used blockchain, AI, and decentralized C2 methods.OctagonCybersecurity researchers have disclosed Octagon, a previously undocumented Android on-device fraud bot sold as malware-as-a-service (MaaS) by the Russian-speaking actor AndroidKitKat.PackClientFrom ReliaQuest and Microsoft Purview to ShinyHunters, Aeternum, ToxNetV2, and PackClient, attackers keep using trust, urgency, and weak visibility to gain access and expand control.PavinLoaderchecks that employ ClickFix lures and bogus software download campaigns are being used to deliver PavinLoader (aka RenPy Loader and RenEngine Loader), indicating the tool is being offered as a loader-as-a-servicePhantomStealerNew stealers and RATs, including Phantom Stealer, Vanta Stealer, Salat Stealer, and CNCMachineRMS, targeted credentials and remote access.ToxNetV2From ReliaQuest and Microsoft Purview to ShinyHunters, Aeternum, ToxNetV2, and PackClient, attackers keep using trust, urgency, and weak visibility to gain access and expand control.Vanta StealerNew stealers and RATs, including Phantom Stealer, Vanta Stealer, Salat Stealer, and CNCMachineRMS, targeted credentials and remote access.
Vendors
HPA zero-day boot-chain vulnerability in HP ThinPro 8 and 9 could allow physical attackers to bypass Trusted Platform Module (TPM) full-disk encryption and extract LUKS keys securing the device’s root partition.MicrosoftFrom ReliaQuest and Microsoft Purview to ShinyHunters, Aeternum, ToxNetV2, and PackClient, attackers keep using trust, urgency, and weak visibility to gain access and expand control.NvidiaThe controller communicates with NVIDIA NIM using the z-ai/glm-5.2 model, becoming a part of a feedback loop that determines how its capabilities can be put to use on a given machine based on information about the
Products
HP ThinPro 8A zero-day boot-chain vulnerability in HP ThinPro 8 and 9 could allow physical attackers to bypass Trusted Platform Module (TPM) full-disk encryption and extract LUKS keys securing the device’s root partition.Microsoft PurviewFrom ReliaQuest and Microsoft Purview to ShinyHunters, Aeternum, ToxNetV2, and PackClient, attackers keep using trust, urgency, and weak visibility to gain access and expand control.Microsoft SharePointMicrosoft, CISA, and researchers warned that exposed systems, SharePoint flaws, and ungoverned AI tools are widening attack opportunities.NVIDIA NIMThe controller communicates with NVIDIA NIM using the z-ai/glm-5.2 model, becoming a part of a feedback loop that determines how its capabilities can be put to use on a given machine based on information about theWindows 11Microsoft has begun piloting new privacy controls that will let Windows 11 users choose which desktop applications can access their camera, microphone, and precise location.
Tools
JWRAn undocumented phishing framework, internally branded “JWR” by its developer, is designed to convincingly impersonate checkout and login pages across major payment and shopping platforms.MiraakA modular post-exploitation framework called Miraak has been found exposed in attacker-controlled open directories (“144.172.96[.]13”).The Outsiderto the actor’s server once a session ends.” The JWR phishing framework is assessed to be a variant of The Outsider phishing-as-a-service (PhaaS) platform, based on several similarities in the client engine scripts and