In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2377 articles
Microsoft analyzed compromised LiteLLM 1.107.0 packages that used Python startup hooks to collect credentials and attempt encrypted exfiltration. A separate Unix loader could fetch code, but second-stage execution was unconfirmed.
SOCRadar describes exposed infrastructure used in AI-assisted intrusions attributed to a Russian-speaking operator linked to INC and The Gentlemen ransomware affiliates. Records show 62 organizations were targeted; four were listed on the groups’ leak sites.
Check Point Research details Aokigahara, an infostealer targeting AI sessions, developer secrets and cloud credentials alongside traditional account data. The analysis describes anti-analysis checks and encrypted C2 uploads; operators’ monetization remains unconfirmed.
A signed MSI posing as PeaZip 11.4.0 contains the genuine 11.3.0 installer plus a fake msimg32.dll that persists via a scheduled task and polls a server for replacement code. Sandboxes received 404/403 responses; stage two was not observed.
Analysis of a fake Teams MSI found an EV-signed installer that deploys a DLL-side-loading chain through genuine calibre, waits 62 seconds, and unpacks BabaDeda and a CNCMachineRMS RAT. Offline testing did not confirm persistence or C2 activity.
ESET says UAC-0099 used the previously undocumented MythicRatatoskr backdoor, communicating over the Yggdrasil mesh network, before handing access to Sandworm, which wiped a Ukrainian logistics company's data using SDelete via Active Directory Group Policy.
The article identifies CVE-2026-111497 in PyPI Brotli releases through 1.2.0 and brotlicffi releases bundling the 1.2.0 decoder. Fixes are Brotli 1.2.1 and brotlicffi 1.2.1.0; package advisory coverage was absent at publication.
Varonis Threat Labs describes how predictable Dataflow staging buckets and a swapped Python session pickle could enable cross-tenant code execution. Google says global fixes add bucket-ownership checks and SHA-256 artifact verification.
StealthMole traces NamasteLSD's original darknet operation to its 2021 store seizure and finds later sites reused its branding. A lookalike altered payment details, consistent with phishing; no post-seizure site was verified with the original PGP key.
CrowdStrike describes three flaws behind PHP2Shell, explains why reliable exploitation may require targeting specific PHP deployments, and says it has seen no successful exploitation in the wild. It recommends patching and hardening PHP environments.
CYFIRMA reports that Korean-speaking operators are preparing targeted PHP2Shell attacks against internet-facing PHP systems. Its Lazarus link assessment remains moderate-confidence, with no confirmed mass successful exploitation attributed to the actors.
Arctic Wolf reports widespread scanning and attempted command execution after disclosure of PHP2Shell CVE-2026-109618 and CVE-2026-109619, and links payload-hosting infrastructure to Potassium. Telemetry did not confirm successful exploitation at scale.
Securonix analyzed TRUST#GRAFT, a JavaScript loader that can use an already authenticated WordPress admin browser to upload a PHP backdoor with hidden must-use-plugin persistence; the initial delivery vector remains unconfirmed.
SOCRadar researchers found lab-tested PHP2Shell RCE tooling and website-screening scripts on an exposed operator server. About 20 sites were checked; 11 probes found no exploit preconditions or evidence of shell access.
Wiz describes automated attacks against IT and software vendors that probed identity providers, Microsoft 365 integrations, and customer data. Most attempts failed; the activity used coordinated password spraying and adapted to blocked IPs and rate limits.
Analysis found a signed PuTTY.msi that installs genuine PuTTY alongside a re-signed Node.js loader. After a five-minute delay, it fetches an encrypted in-memory stage from Cloudflare Workers; the stage's purpose remains unknown.
Kaspersky researchers detail BlackX, a BlackLotus-like UEFI bootkit used against diplomatic agencies in Central Asia. It exploits Baton Drop despite installed patches when certificate revocation is not activated; attribution to APT41 is medium confidence.
Varonis Threat Labs reverse-engineered Stadia, a remote-access trojan from the StealC seller. The sample combines StealC 3.5 credential theft with remote-control modules and uses hidden scheduled-task persistence and encrypted-over-HTTP command traffic.
PHP2Shell comprises two CVEs covering four bugs. Crafted multipart uploads can trigger out-of-memory failures and stale pointers, enabling memory disclosure and demonstrated unauthenticated RCE. The article details affected PHP releases, detection clues and patches.
Huntress reports a 10-week Microsoft 365 token-replay campaign affecting 79 organizations, with at least 497 successful sign-ins. Attackers stole sessions through AiTM relays and other methods, then registered rogue devices, changed MFA and hid emails.
Hunt.io traced PHP2Shell scanning and staged exploit tooling after details of two critical PHP RCE flaws leaked before patches shipped. It found no confirmed compromises; turning the bugs into code execution reportedly remains difficult.
Zscaler details a September 2026 SEO poisoning campaign using fake Chocolatey and Microsoft Activation Scripts sites to deliver Armorsteal, a Python malware family with remote-access, surveillance, and information-stealing modules.
Zimperium uses Android intrusion logs to reconstruct RatHat’s attack chain, including Wireless Debugging abuse, privileged shell staging, persistence, and C2 activity. The logs support user-controlled forensic sharing and enterprise analysis.
ESET describes a Ukrainian intrusion in which UAC-0099 deployed the Yggdrasil-enabled MythicRatatoskr backdoor before access was handed to Sandworm, which later wiped data using SDelete.
