标签：#threatintel

Water OT Attack Targeting Public PLCs: Locking Out Operators via Password and IP Changes 1. Basic Information Article Title : CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs Source : CISA Publication Date : 2026-07-30 Severity : Emergency Original Link : https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs Related Malware : None Threat Actor : Actors targeting public PLCs (This alert does not attribute the activity to a specific group) CVE : None Products & Environment : Water/Wastewater OT, PLC, Rockwell Automation MicroLogix 1400, cellular modem, VPN/gateway Related Sources BleepingComputer Report CISA AA26-097A (Updated 2026-07-22) 2. Summary An attack that disrupts water operations by changing management settings on PLCs directly exposed to the Internet, locking out operators with new passwords, and disconnecting devices by changing IP addresses. 3. Attack Flow Tampering with Public PLC Settings Attackers search for PLCs exposed to the Internet or unknown cellular modems. They access default/weak credentials or exposed management interfaces. They change the PLC password and lock out legitimate operators. They change network configurations like the PLC IP address and disconnect it from remote monitoring and control. Water supply equipment stops or malfunctions while facilities shift to manual operation and local recovery. 4. Attacker Position and Execution Points Attacker: Connects directly to the PLC/OT management surface from the Internet. Execution Points: PLC firmware/configuration interface, cellular modem, remote access gateway. Impact Scope: Water and wastewater treatment control equipment and monitoring stations. 5. Visibility for Victims and Administrators Victims and Users Cannot connect to the PLC from the operator console, passwords fail, IP addresses change, and assets disappear. Physical operational anomalies such as p

DeepSeek and Hermes: An Autonomous Attack Platform for Reconnaissance, PoC Acquisition, and Target Selection 1. Basic Information Article Title : Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks Publisher : Unit 42 Publication Date : 2026-07-30 Severity : High Original Source : https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ Related Malware : Hermes Agent, FofaMap MCP, Nuclei Threat Group : knaithe / KnYuan (Chinese-speaking threat actor) CVEs : CVE-2026-33017, CVE-2026-21858, CVE-2025-68613, CVE-2026-3055, CVE-2026-39987, CVE-2026-34486, CVE-2026-33824 Products & Environments : Langflow, n8n, Citrix NetScaler, Marimo, Apache Tomcat, Windows IKE Related Sources BleepingComputer Coverage 2. Executive Summary Given a single goal via Telegram, the Hermes/DeepSeek combination autonomously executed FOFA enumeration, PoC acquisition, success condition evaluation, and even switched to a different product after a failure. 3. Attack Flow Autonomous Langflow to n8n Pivot The operator gave an initial task to Hermes via Telegram. DeepSeek enumerated 84 Langflow instances on FOFA and downloaded the CVE-2026-33017 PoC from GitHub. It identified one instance as a vulnerable version, but the attack failed because it lacked auto_login or a public flow ID. It compared the public exposure scale of 10 product groups with GitHub PoC star counts and CVSS scores, then autonomously pivoted to n8n. It analyzed the chain of CVE-2026-21858 (file read) and CVE-2025-68613 (RCE). It found 3 vulnerable versions, but the attack failed because the unauthenticated file-upload form was missing. Parallel Manual Campaign The attacker enumerated public devices using FOFA and a custom scanner. They read NetScaler memory for 3 organizations using CVE-2026-3055 and searched for the NSC_AAAC cookie. They confirmed command execution on 11 Marimo notebooks using CVE-2026-39987. They attempted reverse shells against Tomcat and IKE VPN. 4. Attacker Infrastru

STAC4749: Chaos Ransomware in Under 17 Hours via Teams IT Support Scam 1. Basic Information Article Name : Chaos in Teams vishing Publisher : Sophos Publication Date : 2026-07-28 (Detailed report by target site BleepingComputer on 2026-07-30) Original Source : https://www.sophos.com/en-us/blog/chaos-in-teams-vishing Related Source : https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/ Related Entities : STAC4749, Chaos ransomware, Quick Assist, RemSupp, DWAgent, AnyDesk, PyInstaller backdoor, reverse SOCKS proxy Severity : High 2. Executive Summary An attacker uses an external Teams account to pose as IT support and tricks the user into allowing remote control. The attacker then deploys PowerShell, a custom loader, multiple RMM tools, and a SOCKS tunnel. This leads from lateral movement to simultaneous encryption in less than 17 hours at the shortest. 3. Attack Flow An external Teams account with an IT-like .top domain starts a chat and a call. The attacker poses as IT support and establishes a remote session using Quick Assist or RemSupp. The attacker runs PowerShell to download a loader from an external server and executes it in AppData\Roaming or similar folders. The loader collects device information, sets persistence via Run keys, and connects to the C2 server. A PyArmor-obfuscated PyInstaller backdoor runs shell commands, loads extra Python modules, and stages collected data. The attacker installs DWAgent and AnyDesk as backup access, enables RDP, and tries to move laterally. The sc5.exe reverse SOCKS proxy relays internal network traffic. The attacker steals data in at least one case, and then encrypts multiple devices with Chaos almost at the same time. 4. Attacker Locations and Execution Sites Initial contact occurs via an external Microsoft 365 tenant. Operations run through legitimate remote support tools on the victim device. Subsequent activities happen on Windows devices and the internal netwo

GTIG: 2026 OSS Supply Chain Compromise, Credential Theft, and Self-Propagation 1. Basic Information Article Title : Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise Publisher : Google Threat Intelligence Group / Mandiant Publication Date : 2026-07-30 Original URL : https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise/ Related Sources : TeamPCP, axios, and WAVESHAPER.V2 investigations within the article Related Entities : UNC6780/TeamPCP, SANDCLOCK, MIDNIGHT NEPTUNE/UNC1069, WAVESHAPER.V2, npm, PyPI, Docker Hub, GitHub Actions, axios Severity : High 2. Executive Summary Attackers are stealing credentials from developers, maintainers, and CI/CD pipelines to tamper with legitimate packages. This attack model is growing on a large scale: it steals cloud secrets from user environments, self-propagates to other packages, and leads to ransomware or extortion. 3. Attack Flow UNC6780 / TeamPCP Attackers gain write permissions by abusing GitHub Actions pull_request_target , compromising maintainer accounts, or publishing malicious packages. They inject malicious code into legitimate and spoofed packages on PyPI, npm, and Docker Hub. Users execute the code during installation on their development devices or in CI/CD pipelines. Tools like SANDCLOCK steal credentials for the cloud, CI/CD, and package registries. Attackers tamper with other packages owned by the victim to spread like a worm. They pivot from AI software into wider enterprise networks. They monetize the stolen credentials by selling them or partnering with ransomware and data extortion groups. axios / MIDNIGHT NEPTUNE Attackers compromise maintainer accounts using social engineering. They add malicious dependencies to the legitimate axios package and publish a new version. Dependency resolution spreads the package to many users and downstream packages. A dropper deploys the WAVESHAPER.V2 backdoor. 4. Attacker Position and Execution Locati

TA488 OWAReaper: A "Half-Click" Attack that Adds Persistence Inside OWA Just by Opening an Email 1. Basic Information Article Name : Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit Publisher : Proofpoint Threat Insight Publication Date : 2026-07-29 Original Source : https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit Related Source : https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/ Related Entities : TA488, Void Blizzard, Laundry Bear, OWAReaper, ZimReaper, CVE-2026-42897, Microsoft Exchange Outlook Web Access Severity : Emergency Target Period : 2026-07-30T08:10:34+09:00 to 2026-07-31T08:06:06+09:00 2. One-Line Summary This is an attack where viewing a crafted email in OWA runs JavaScript, leaves no file on the device, achieves persistence in both the browser and Exchange, and steals saved credentials, OAuth tokens, and mailbox permissions. 3. Attack Flow A compromised account sends a normal informational email with no URLs or attachments. The victim opens the email in the OWA reading pane. CVE-2026-42897 triggers an onload event, and reconstructs Base64 JavaScript from image fragments in the email body. OWAReaper runs in the OWA browser context and deletes the malicious parts from the original email. It collects browser autofill IDs and passwords using an invisible DOM input field. It hides its encrypted self inside OWA settings to run again when OWA syncs and restores. It steals OAuth tokens via a privileged Outlook add-in. It gives Owner permissions to the Default principal on all mail folders, allowing continuous access from another authenticated account in the same organization. It embeds an iframe into the IndexedDB offline mail cache to reinfect it. It receives commands from GitHub commit messages or attacker emails, and sends data through multiple paths. 4. Attacker Position and Execution L

KindaRails2Shell (CVE-2026-66066): Arbitrary File Read and RCE via Active Storage Uploads 1. Basic Information Article Title : Alert on Vulnerability in Ruby on Rails Active Storage Leading to Remote Code Execution Publisher : JPCERT/CC Publication & Update Date : 2026-07-30 Original Article : https://www.jpcert.or.jp/at/2026/at260021.html Related Sources : https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm Related Entities : CVE-2026-66066, KindaRails2Shell, Ruby on Rails, Active Storage, libvips, ruby-vips Severity : Critical 2. One-Sentence Summary This is a vulnerability that combines Active Storage direct uploads and variant processing by libvips, allowing attackers to upload a crafted file without authentication, read files and credentials on the server, and potentially execute code under the Rails process permissions depending on the conditions. 3. Attack Flow The attacker discovers or guesses that the target Rails app uses Active Storage. The attacker registers a crafted file to the unauthenticated direct upload feature. The attacker triggers variant processing, which is handled by the vulnerable Active Storage and default builds of libvips. The attacker reads arbitrary files on the server. The attacker retrieves Rails secrets, cloud credentials, database credentials, and other sensitive data. The attacker may achieve remote code execution by using the retrieved secrets or the processing chain. The attacker may move laterally to databases, storage, cloud environments, or CI/CD pipelines as a next step (Inference). 4. Attacker Position and Execution Location The attacker uploads files from the external network via HTTP. The processing happens on the Rails application server and the libvips process. Remote code execution runs with the OS permissions of the Rails or variant processing service. 5. What Victims and Administrators See Even without a user-facing upload screen, apps can be vulnerable if Active Storage is enabled. Administrators m

Cisco Talos IR Q2 2026: Observed Attack Chains of M365 Token Compromise and RMM-Disguised Ransomware 1. Basic Information Article Title : IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains Publisher : Cisco Talos Blog Publication Date : July 28, 2026 Original Article : https://blog.talosintelligence.com/ir-trends-q2-2026/ Related Sources : ARToken technical analysis and Talos IR observations within the article Related Entities : UAT-11764, ARToken, EvilTokens, Sinobi, Warlock/Storm-2603, MeshAgent/MeshCentral, Zoho Assist, Microsoft 365, SharePoint, OneDrive, RDP, WinRM, rclone Severity : High 2. Executive Summary Talos IR identified real-world attack chains from recent incidents. The first chain steals M365 tokens using QR code PDFs and OAuth device-code phishing, then self-propagates through inbox rules, SharePoint, and mass internal emails. The second chain uses modified and abused legitimate RMM tools to achieve SYSTEM persistence, lateral movement, and domain-wide ransomware deployment via GPO. 3. Attack Flows Chain A: UAT-11764 QR Phishing The attacker sends targeted PDFs from a compromised M365 account. The victim scans the PDF's QR code using a mobile device. Credentials are stolen on a fake M365 login page. The attacker signs in to the Microsoft account. Inbox rules are created to hide warnings and replies. Malicious documents are placed in SharePoint. The attacker uses contacts to resend phishing emails internally and externally. Chain B: M365 Token Compromise via ARToken Lures pretending to be trusted vendors are presented. The user is redirected to the Microsoft OAuth device authorization flow. The user approves the attacker's device code on a legitimate Microsoft screen. Access tokens are obtained without stealing passwords, bypassing MFA. ARToken manages tokens using over 80 APIs. Persistence is achieved via PRT, followed by email/BEC, inbox rule manipulation, and OneDrive/SharePoint management and exfiltration. Toke

Fastjson 1.x CVE-2026-16723: Unauthenticated RCE Targeting Default Spring Boot Fat-Jars 1. Basic Information Article Title : Unpatched Fastjson Vulnerability Exploited in Attacks Publisher : SecurityWeek Publication Date : July 28, 2026 Original Source : https://www.securityweek.com/unpatched-fastjson-vulnerability-exploited-in-attacks/ Related Sources : Alibaba Security Advisory: https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83 Imperva: https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/ FearsOff Technical Analysis: https://fearsoff.org/research/fastjson-1-2-83-rce Related Entities : CVE-2026-16723, Fastjson 1.2.68 to 1.2.83, Spring Boot executable fat-jar, Alibaba, Imperva, ThreatBook Severity : Critical 2. Summary This is an actively exploited vulnerability in end-of-life Fastjson 1.x used within Spring Boot fat-jars. If an attacker sends a crafted JSON request without authentication, it can reach remote code execution (RCE) with Java process permissions via external resource lookups, even when AutoType is not explicitly enabled. 3. Attack Flow The attacker scans for publicly exposed JSON-receiving endpoints. The attacker sends a crafted JSON payload containing @type . Fastjson 1.x type resolution logic treats the @JSONType annotation as a trust signal. The application bypasses AutoType restrictions and triggers a lookup to an attacker-controlled resource. Vulnerable Spring Boot fat-jar configurations reach the code execution path without external gadgets. Arbitrary code runs with the execution permissions of the Java application user. Inference : The attack may proceed to drop webshells, search for credentials, access cloud metadata, and deploy lateral movement tools. 4. Attacker Position and Execution Location The attacker sends HTTP(S) requests from the internet or an accessible internal network. The vulnerability is processed by

ELECOM Wireless LAN Devices JVN#56870912: OS Command Injection in Management Screen and Configuration Restoration 1. Basic Information Article Title : Multiple Vulnerabilities in ELECOM Wireless LAN Routers and Access Points (July 2026) Source : JVN Publication Date : July 28, 2026 Original URL : https://jvn.jp/jp/JVN56870912/index.html Related Source : ELECOM Notice (Linked from JVN) Related Entities : CVE-2026-44387 (Reflected XSS) CVE-2026-59764 (Management Screen OS Command Injection) CVE-2026-61376 (Configuration Restoration OS Command Injection) WAB-M1775-PS, WAB-S1775, WAB-M2133, WAB-I1750-PS, WAB-S1167-PS, WRC-X3000GS3-B, WRC-X3000GS3A-B Severity : Medium 2. Executive Summary An attacker with administrator privileges can pass crafted inputs to the management screen or configuration restoration function of ELECOM wireless routers and access points, leading to arbitrary OS command execution on the device. A separate XSS vulnerability can serve as a stepping stone to target management sessions via users on an adjacent network. 3. Attack Flow Chain A: Attacker Already Has Administrator Credentials The attacker reaches the management screen. The attacker logs in as an administrator. The attacker sends vulnerable configuration input for CVE-2026-59764 or crafted configuration restoration data for CVE-2026-61376. Arbitrary commands execute on the device OS. Inference : Modify DNS, forwarding, administrator settings, and firmware-related settings to use the device for traffic monitoring or as a foothold for internal intrusion. Chain B: Reflected XSS An attacker on the same or an adjacent network prepares a crafted URL. The attacker tricks a user who can access the management screen into opening the URL. A script executes in the management screen origin via CVE-2026-44387. Inference : If a management session exists, it may chain into unintended management actions. 4. Attacker Position and Execution Location XSS requires adjacent network reachability and user interact

vBulletin CVE-2026-61511: Unauthenticated RCE via Public AJAX Template to eval() 1. Basic Information Article Title : vBulletin fixes critical pre-auth RCE flaw with public exploit Publisher : BleepingComputer Publication Date : July 28, 2026 Original URL : https://www.bleepingcomputer.com/news/security/vbulletin-fixes-critical-pre-auth-rce-flaw-with-public-exploit/ Related Sources : NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61511 Researcher Technical Analysis: https://karmainsecurity.com/ SSD Secure Disclosure: https://ssd-disclosure.com/ Related Entities : CVE-2026-61511, vBulletin 5.x/6.x, vB5_Template_Runtime::runMaths() , ajax/render/pagenav , phpfuck Severity : High 2. Executive Summary Sending a crafted pagenav[pagenumber] to vBulletin's public AJAX template rendering bypasses the weak validation of the math function runMaths() using phpfuck. It reaches PHP's eval() without authentication to execute arbitrary code. A public PoC with a known fix exists, and scanning activity is expected to increase. 3. Attack Flow The attacker searches for public sites running vBulletin 5.x/6.x. They send a request to a public template rendering endpoint like ajax/render/pagenav . They insert a PHP expression into pagenav[pagenumber] to bypass math validation. Template execution reaches vB5_Template_Runtime::runMaths() . The input goes to PHP eval() , executing arbitrary PHP code. OS commands start under the PHP/web server user permissions. Inference : Leads to web shell installation, database credential theft, forum database exfiltration, defacement, and persistence. 4. Attacker Position and Execution Location The attacker sends HTTP(S) requests from the internet without authentication. The vulnerable processing happens inside the vBulletin template runtime. PHP code runs with Web/PHP-FPM/Apache user permissions. 5. Visibility for Victims and Administrators No user action or login is needed. Web access logs may show ajax/render/pagenav and an unusual pagenumber parameter

IPMI/BMC Authentication Hash Leak: Stealing Out-of-Band Server Management via Offline Cracking 1. Basic Information Article Title : Over 24,000 exposed server BMCs leak password hash via decades-old flaw Publisher : BleepingComputer Publication Date : July 28, 2026 Original Source : https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/ Related Sources : Lava research (linked in original), CVE-2013-4786 Related Entities : CVE-2013-4786, IPMI 2.0, BMC, Supermicro, HPE iLO 4, UDP/623, GPU/AI servers Severity : High 2. Executive Summary Attackers can send an authentication request to exposed IPMI/BMC interfaces on the internet and receive a password-derived response. They can crack this response offline using GPUs to gain server management privileges that sit below the operating system. A recent scan found 24,650 devices leaking authentication material, with 2,340 using weak, dictionary-based administrator passwords. 3. Attack Flow Scan the internet for IPMI 2.0 services on UDP/623. Start an RMCP+/RAKP authentication handshake with the BMC. Obtain the password-derived authentication response without credentials. Perform offline cracking using dictionaries, default ADMIN users, and vendor-generated password rules. Log in to the BMC using the recovered password. Control power, virtual media, firmware, and low-level settings. Reuse the same credentials on other management interfaces. Inference : Use virtual media or boot settings to compromise the OS, establish persistence, and move laterally across the management network. 4. Attacker Position and Execution Location Attackers connect to UDP/623 from the internet or a reachable management network. Hash cracking happens on the attacker's GPU/CPU, avoiding failed login alerts on the target system. Post-compromise actions run on the BMC processor, which is independent of the OS. 5. Visibility for Victims and Administrators The OS, EDR, and host logs may not show

Dysphoria: A 200k-Device Botnet Using Blockchain Name Resolution and Infected Device Relays 1. Basic Information Article Title : New Dysphoria DDoS botnet spreads to 200k devices worldwide Publisher : BleepingComputer Publication Date : 2026-07-27 Original Source : https://www.bleepingcomputer.com/news/security/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide/ Primary Source : https://blog.xlab.qianxin.com/dysphoria/ Related Entities : Dysphoria, jackskid, fbot, ENS, SNS, UPnP, Telnet, SSH, IoT/embedded Linux Related CVEs : CVE-2013-3307, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-35733, CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, and others Severity : High Main IOCs : burrberry.eth , ukranianhorseriding.eth , 24carnforth2merseyside.sol , login.trees4sale.net , c2.saintpetersburgresident.ru 2. Summary This is a large-scale Linux botnet. It breaks into devices using weak Telnet/SSH passwords and various IoT RCE vulnerabilities. It gets multi-stage C2 servers from ENS/SNS records. It turns infected devices into relay nodes or DDoS bots by opening 155 ports using UPnP. 3. Attack Flow Infection and DDoS Chain Attackers compromise routers, gateways, and cameras using weak Telnet/SSH credentials or known RCE vulnerabilities. The malware runs a Linux binary. It hides its process name as libdalvikengine.so . It decrypts strings using modified RC4 (with added LCG/LFSR). It reads TXT and custom records from ENS/SNS, converts fake IPv6 formats, and gets distributor node IP addresses. It gets a list of infected device relays from http://<node>:9000/nodes?key=meowmeowmeow . It connects to the C2 server using a fixed 78-byte login and heartbeat. It executes DDoS commands that include duration, attack type, target, and flag. Relay-Only Chain A relay variant without DDoS features searches for UPnP-enabled gateways. It creates 155 port forwards on the WAN side and listens on its own device. It

Public Wi‑Fi DNS Poisoning: Hijacking Microsoft 365 Sessions of Business Travelers 1. Basic Information Article Title : Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials Source : SecurityWeek Publication Date : 2026-07-27 Original Article : https://www.securityweek.com/hacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials/ Primary Source : https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/ Related Entities : Microsoft 365, Entra ID device-code flow, DNS poisoning, AiTM, WPAD, captive portal, FrostArmada, APT28 (attribution unconfirmed) Severity : High IOCs : 38.146.28.75 , 31.57.243.154 , 104.194.159.150 , m365-owa.com , owa-ms365.com , ms365-device.com , ms365-live.com 2. Executive Summary This attack compromises Wi-Fi gateways at locations like hotels to forge DNS responses. It does not send phishing emails. Instead, it tricks users into visiting fake Microsoft pages, using WPAD proxies, and entering device-code authentication. This allows attackers to steal MFA-authenticated Microsoft 365 sessions. 3. Attack Flow Chain A: DNS Redirection and Credential Theft Attackers gain administrative access to captive portal gateways in hotels or conference centers. Hypothesis (Primary source confidence: Low to Medium) : Public SSH/SNMP/Web management interfaces and weak, reused administrator credentials are used for initial access. The gateway returns fake responses for DHCP-assigned DNS or passing DNS, resolving normal domains to attacker IPs. Users are redirected to fake Microsoft pages to collect credentials and OAuth information. Attackers log into Microsoft 365 using the stolen credentials and tokens. Chain B: WPAD The gateway controls wpad name resolution or DHCP option 252. The device downloads the attacker's PAC file. Windows app and browser traffic pass through the attacker's proxy. Investigations observed attempts, but successful execution is unconfirmed. Chain C: Device-Code Flow The fake page sh

FortiOS CVE-2025-68686: Bypass of Symlink Persistence Mitigation for Already Compromised Devices 1. Basic Information Article Name : CISA Adds Two Known Exploited Vulnerabilities to Catalog Source : CISA Publication Date : July 27, 2026 Original Link : https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog Related Sources : https://fortiguard.fortinet.com/psirt/FG-IR-25-934 https://nvd.nist.gov/vuln/detail/CVE-2025-68686 Related Entities : CVE-2025-68686, FortiOS, SSL-VPN, symlink persistence, CISA KEV Severity : Critical 2. Summary This is an actively exploited vulnerability. An attacker who has already compromised the FortiOS file system via another vulnerability can use a crafted HTTP request to bypass symlink persistence mitigations. This allows access to sensitive files through the SSL-VPN web interface even after an upgrade. 3. Attack Flow An attacker compromises FortiOS down to the file system level using another vulnerability or path. The attacker places a symlink pointing to out-of-bounds system files into the SSL-VPN related area. An administrator applies standard patches or firmware updates, but the malicious symlink or its recreation path remains. The attacker bypasses the mitigation using a crafted HTTP request via CVE-2025-68686. The attacker may read sensitive files such as configurations, credentials, and keys from the SSL-VPN web interface. The attacker may use the stolen information to continue VPN authentication, administrative access, and internal intrusion. 4. Attacker Position and Execution Location Initial compromise and symlink placement happen on the FortiGate/FortiOS device. Mitigation bypass and file reading occur externally via the SSL-VPN HTTP(S) interface. This CVE alone does not provide initial file system access to uncompromised devices. 5. Visibility for Victims and Administrators The device may look updated, but unauthorized symlinks can remain. Crafted HTTP requests to the SSL-VPN w

Certighost CVE-2026-54121: Low-Privilege Users Impersonate a DC via AD CS 1. Basic Information Article Title : New Certighost PoC exploit lets attackers hijack Windows domains Source : BleepingComputer Published Date : 2026-07-27 Original Article : https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/ Primary Source : https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 Related Entities : CVE-2026-54121, Certighost, Microsoft AD CS, Enterprise CA, PKINIT, Kerberos, DCSync, Impacket Severity : High 2. One-Sentence Summary A public PoC allows a low-privilege domain user to point AD CS "chase" references to an attacker host, trick the CA into trusting fake LDAP/LSA responses to get a Domain Controller certificate, and then take over the entire domain using PKINIT and DCSync. 3. Attack Flow An attacker connects to LDAP with a low-privilege domain account and lists CAs, DCs, and Domain SIDs/GUIDs. The attacker uses the default ms-DS-MachineAccountQuota=10 setting to create a computer account and register an SPN. The attacker starts fake LDAP and LSA services on their host. The attacker specifies their host in the certificate request's cdc (Client DC) field and the target DC in the rmd (Remote Domain) field. The CA connects to the attacker-specified cdc via SMB/LDAP to chase the reference. The attacker's service relays the CA's authentication challenge to the real DC and returns the target DC's objectSid and dNSHostName . The vulnerable CA treats the returned data as authoritative and issues a certificate containing the target DC's SID and DNS name. The attacker uses PKINIT to get a Kerberos TGT as the DC and saves it to a .ccache file. The attacker performs a DCSync using the DC account's replication rights to steal secrets, including krbtgt . 4. Attacker Position and Execution Location The attacker needs a host inside the domain with valid authentication that can reach the CA, DC, and SMB/LDAP ports. T

MedusaHVNC: Remote Control of Logged-in Browsers on Hidden Windows Desktops 1. Basic Information Article Title : MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection Publisher : SecurityWeek Publication Date : 2026-07-27 Original Article : https://www.securityweek.com/medusahvnc-malware-uses-hidden-windows-desktops-to-evade-detection/ Primary Source : https://www.blackfog.com/medusahvnc-a-hidden-desktop/ Related Entities : MedusaHVNC, MaaS, HVNC, JScript, AutoIt, charmap.exe , ChaCha20, Chrome/Edge/Firefox Severity : High IOCs : 51.89.204.28:4444 , %TEMP%\Nx2981Okkr2\ , AFLlvOscPj.bat , zorsxklxfehdoals 2. Executive Summary This is a RAT that uses JScript, AutoIt, charmap.exe injection, and multi-layer decryption to open logged-in browsers on a hidden Windows desktop invisible to the user. It controls existing cookies and sessions using the victim device's original IP address. 3. Attack Flow wscript.exe runs an obfuscated JScript file and waits for 7,584 milliseconds. It extracts the AutoIt execution system, configuration, and encrypted payload to %TEMP%\Nx2981Okkr2\ . It places AFLlvOscPj.bat in the Startup folder for persistence. AutoIt decrypts the payload using single-byte XOR 0xAE . It starts the legitimate C:\Windows\System32\charmap.exe and injects the loader into it. It decrypts the final x64 PE file using 16-byte repeating XOR and ChaCha20. It makes a custom TCP connection to 51.89.204.28:4444 . It creates another hidden desktop and launches Chrome, Edge, or Firefox. It captures screens using BitBlt and PrintWindow , sends inputs using SendInput , and moves data using the Clipboard API. It uses cookies and sessions from existing browser profiles to control user accounts. 4. Attacker Position and Execution Location The attacker uses a MaaS operation panel and C2 server. The loader and HVNC run on the Windows device, and the browser runs on a separate desktop invisible to the user, but on the same device, IP, and profile. The initial delivery ve

VeloCloud Orchestrator CVE-2026-16812: Unauthenticated OS Command Injection Actively Exploited 1. Basic Information Article Title : Arista patches VeloCloud Orchestrator zero-day exploited in attacks Source : BleepingComputer (Primary Source: Arista Security Advisory 0144) Publication Date : 2026-07-27 Original URL : https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/ Related Sources : https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog Related Entities : CVE-2026-16812, CWE-78, VeloCloud Orchestrator (VCO) On-Premises, VeloCloud Edge, CISA KEV Severity : Critical IOCs : 8.19.75.217 , 206.72.242.124 , 206.72.242.162 2. Summary This is a CVSS 10.0 vulnerability. It allows an unauthenticated attacker to access the Web UI of an internet-reachable on-premises VCO. The attacker can execute OS commands through internal-only functions. Active exploitation has been confirmed. 3. Attack Flow An attacker searches for a VCO Web interface. The attacker sends a crafted request without authentication to reach internal-only functions. The attacker executes commands on the VCO host via OS command injection. The attacker may access configurations, device lists, credentials, certificates, keys, and databases. The attacker proceeds to create files, export databases, create archives, perform outbound communications, and change management configurations. Inference : The attacker can abuse the authentication and configuration paths to Edge devices managed by the VCO, expanding the impact to the entire SD-WAN. 4. Attacker Position and Execution Location The attacker is an external host with network access to the VCO Web UI. The initial request targets the web layer. Commands execute on the on-premises VCO host. Hosted and Dedicated VCOs are already patched. VeloCloud Gateways

Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence 1. Basic Information Article Title : Steam forum ClickFix attacks infect gamers with XMRig cryptominers Publisher : BleepingComputer Publication Date : July 25, 2026, 18:37 EST / July 26, 2026, 07:37 JST Original Source : https://www.bleepingcomputer.com/news/security/steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers/ Related Information Sources : At the time of publication, no alternative primary sources providing a detailed analysis of this campaign were identified. Related Malware, Threat Groups, CVEs, and Products : XMRig ClickFix PowerShell Microsoft Defender Windows Firewall Windows Task Scheduler Steam Discussion Forums Unknown Threat Group No CVE Related IOCs : Domain: msfconfig[.]icu URL: https://msfconfig[.]icu:443/tmp/system.txt Directory: C:\Windows\Background Executable: C:\Windows\Background\system.exe Scheduled Task: XMRig-[computer name] Defender Exclusion: C:\Windows\Background Severity : Medium Reason for Selection : The attack chain is highly specific and realistic: a ClickFix scenario where a user pastes a command into an administrator PowerShell, progressing from disabled certificate validation, Defender exclusions, Firewall allowances, and XMRig retrieval, to a SYSTEM-privileged Scheduled Task. Such behavior can easily translate to enterprise settings where employees copy commands from forums or generative AI responses. 2. Executive Summary Attackers reply to Steam technical support threads disguised as "repair methods," instructing users to run administrator PowerShell commands. Upon execution, the script adds Microsoft Defender exclusions and Firewall rules on the victim's machine, downloads XMRig, and establishes persistence via a SYSTEM-privileged Scheduled Task in a classic ClickFix attack. 3. Attack Flow Chain A: XMRig Infection via Steam Forums The attacker creates a randomized Steam account. They search for existing threads discussing game crash

Originally published on satyamrastogi.com Seqrite Labs identifies multi-stage DcRAT campaign impersonating India's Income Tax Department. Attackers exploit tax professional workflows to deliver remote access trojans capable of data exfiltration and lateral movement. Operation DragonReturn: DcRAT Deployment via Fake ITR Utilities Executive Summary A China-nexus threat cluster is actively exploiting the predictable workflows of Indian tax professionals, corporate finance teams, and individual taxpayers through phishing campaigns distributing DcRAT (Dark Crystal Remote Access Trojan). Operation DragonReturn, as tracked by Seqrite Labs, demonstrates sophisticated understanding of Indian taxation cycles and organizational structures - critical operational intelligence required for high-success-rate social engineering. From an attacker's perspective, this campaign is methodologically sound: it targets a specific, predictable event (tax filing deadlines), uses trusted entity impersonation (Income Tax Department), and deploys a mature RAT with established evasion capabilities. The selection of DcRAT indicates access to commodity malware-as-a-service (MaaS) infrastructure, likely from Chinese underground forums where such tools are actively monetized and continuously updated. Attack Vector Analysis This operation chains multiple MITRE ATT&CK techniques into a cohesive infection chain: Initial Compromise: Spear-Phishing with Pretexting Attackers execute T1566.002 (Phishing - Spearphishing Attachment) by crafting emails impersonating legitimate Indian Income Tax Department communications. The social engineering layer leverages T1598.003 (Phishing - Spearphishing Link) with URLs pointing to malicious tax filing utilities. Pretexting is enhanced through T1589.001 (Gather Victim Identity Information - Credentials) , as attackers likely harvested tax professional contact lists from public records, LinkedIn OSINT, or previous data breaches. The timing of campaigns around Indian fis

Originally published on satyamrastogi.com Three malicious npm packages masquerading as PostCSS tools delivered Windows RAT payloads. Analysis of supply chain attack mechanics, payload delivery chains, and detection gaps in dependency management. Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT Executive Summary This is a textbook supply chain attack leveraging npm's trust model. Three packages published in June 2026 - aes-decode-runner-pro , postcss-minify-selector , and postcss-minify-selector-parser - delivered Windows RAT payloads to developers. The attack demonstrates why automated dependency management without behavioral validation is a critical vulnerability. What makes this particularly effective: PostCSS is a legitimate, widely-used build tool. Developers hunting for PostCSS plugins via search or copy-pasting dependency names from tutorials become easy prey. The attacker didn't need zero-days, social engineering sophistication, or exploit kits. Just npm account registration and package uploads. This follows the exact pattern we've seen in credential theft campaigns prioritizing convenience over complexity . Low barrier to entry, high payoff. Attack Vector Analysis MITRE ATT&CK Framework Mapping This attack chains multiple techniques: T1195.001: Compromise Third-Party Software Supply Chain - Malicious package publication on npm registry T1566.002: Phishing - Spearphishing Link - Package discovery and recommendation (implicit trust) T1059.003: Command and Scripting Interpreter - Windows Command Shell - RAT payload execution T1105: Ingress Tool Transfer - Initial RAT download mechanism T1571: Non-Standard Port - C2 communication channels (typical) Kill Chain Breakdown Stage 1: Reconnaissance & Naming Attacker identifies PostCSS as high-value target (builds present in thousands of projects) Creates names that blend legitimacy with search results: postcss-minify-selector exploits incomplete package searches The aes-decode-runner-pro variant sug