Xray-core

Reported Context (2)

One of the employees, who was a local administrator, granted Microsoft Quick Assist access, enabling the attackers to deploy Xray-core, a reverse proxy tool, and expand their access. Weekly Cybersecurity Roundup: QTYF Disruption, AI-Agent Breach, ZBT Router Backdoors
The attackers used Xray-core disguised as ChromeUpdate.exe and ConnectivityHost.exe, while the locker encrypted files in place and dropped the !!!README!!!DO_NOT_DELETE.txt ransom note. BHIS Details Aur0ra-Attributed Intrusion Using Disguised Xray-Core C2

CVE (5)

Malware (10)

People (3)

Threat Actors (6)

MITRE ATT&CK (23)

Vendors (8)

Products (10)

Tools (4)

Industries (3)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.