Threat Research

Elastic Security 9.5 introduces Alert Zero tools that help SOC teams reduce alert fatigue by automating triage, correlating related alerts, and embedding investigations into existing workflows while keeping analysts in control. The update centers on Security alert analysis, Attack Discovery, and Elastic Workflows, with support for custom models, inspectable agent reasoning, and approved detection-gap remediation. #ElasticSecurity #AttackDiscovery #ElasticWorkflows #ESQL #VirusTotal

XCSSET v40 is a heavily updated macOS malware family that uses memory-resident execution, polymorphism, and supply-chain infection through poisoned Xcode projects to target developers. It also adds browser hijacking, Telegram trojanizing, defense evasion, and a rotating C2 infrastructure across domains, IPs, and endpoints. #XCSSET #Xcode #GoogleChrome #Telegram #Apple…

Google Threat Intelligence Group (GTIG) reports a sharp rise in open source software supply chain compromise in 2025 and early 2026, including major campaigns tied to UNC6780, MIDNIGHT NEPTUNE, and UNC4899. The article also outlines detailed mitigation guidance for protecting ecosystems such as PyPI, npm, Docker Hub, GitHub Actions, and developer pipelines from package poisoning, credential theft, and workflow abuse. #UNC6780 #MIDNIGHTNEPTUNE #UNC4899 #axios #PyPI #npm #DockerHub #GitHubActions

The article explains how Kaspersky Anti Targeted Attack (KATA) uses Network Anomaly Detection to identify Kerberoasting and DNS tunneling by spotting deviations from normal Kerberos and DNS behavior rather than relying on signatures. It also shows how prebuilt NAD rules, variables, and SQL-based logic help reduce false positives and surface actionable alerts for attacks that blend into legitimate network traffic. #KATA #Kerberoasting #DNStunneling #Kerberos #DNS

Sekoia researchers analyzed a new ErrTraffic ClickFix campaign that targeted WordPress servers, used fake AI tool lures, and hid C&C infrastructure in blockchain-based networks. Their DNS and WHOIS investigation uncovered 71 domains, multiple malicious IPs, typosquatting clusters, and possible links to the LenAI MaaS operator and the Aeternum botnet. #ErrTraffic #ClickFix #LenAI #Aeternum

CERT-AGID identified a phishing campaign that impersonates “Il Portale dell’Automobilista” through the typosquatted domain illportaledelautomobilista[.]org, which appears prominently in Google search results. The fake site steals personal and driver-license data such as codice fiscale, numero patente, and expiration date, while CERT-AGID has requested takedown actions and alerted Google and the Ministry of Infrastructure and Transport. #CERTAGID #IlPortaledellAutomobilista #MinisterodelleInfrastruttureeDeiTrasporti #illportaledelautomobilistaorg

The article explains that operational scripts on customer endpoints should be governed like production software, whether they are cloned, hand-written, or AI-generated. It highlights two scaling models—template reuse and AI-assisted authoring—showing that Acronis built-in scripts are heavily cloned while AI-generated scripts are increasingly common in some markets, requiring different governance controls for each. #Acronis #NISTSP800-53 #CISControlsv8 #OWASP #ENISA

The article describes OctLurk, SilkLurk, and LurkProxy, three closely related implants used since January 2025 against government and other organizations across Central Asia and the Syrian Arab Republic, with victim-specific loaders and heavy obfuscation. The same campaign also included credential theft, keylogging, browser password theft, network scanning, remote access, and the later deployment of PlugX, while infrastructure overlap and shared artifacts suggest a Chinese-speaking threat actor. #OctLurk #SilkLurk #LurkProxy #PlugX

AtlasRAT is a modular Windows RAT delivered through a four-stage in-memory loader chain, beginning with a Delphi executable disguised as AGE Flash Player and ending in TLS-based, ChaCha20-encrypted command-and-control with plugin execution, offline keylogging, and DLL injection into WeChat processes. Analysis suggests a builder-based malware framework with multiple versions and branches,…

Attackers are spreading fake Income Tax Department penalty notices and refund lures through WhatsApp, SMS, email, and lookalike websites to trick taxpayers into opening malicious files or entering credentials. The campaigns deliver malware such as ITD_Tax_Notice.exe and use disposable domains, fake Office Memorandums, and cloud-hosted second-stage payloads to steal data and enable remote access. #IncomeTaxDepartment #ITD_Tax_Notice.exe #ipwho.is #AlibabaCloud

GenieLocker is a custom ransomware family used by Toy Ghouls against Russian organizations, especially in manufacturing, with Windows, Linux, and ESXi variants active since March 2026. The group used stolen OpenVPN credentials for entry, deployed tools like Mimikatz and PsExec, and encrypted systems without evidence of data theft or double extortion. #GenieLocker #ToyGhouls #Bearlyfy #Labubu #Laboo.boo #Mimikatz #PsExec #OpenVPN

Astaroth (aka Guildma) operators added a WhatsApp Web spambot in Q4 2025, shifting from email-based distribution to automated messaging that turns infected victims into unwilling propagators of the malware. The analysis shows strong code overlap with the Vareg (aka WATER SACI, Eternidade) spambot and confirms Brazil-focused targeting through contact filtering, Portuguese…

AhnLab reports that a state-sponsored group abused vulnerabilities in Korean financial security software from 2025 through the first half of 2026 to deliver backdoors via watering hole and spear-phishing attacks, while many compromised Korean websites were used as infection points. The analysis also finds overlap with Gunra ransomware incidents and names…

CERT-AGID identified a new sextortion campaign circulating internationally since April 2026 and observed for the first time in Italy, with scammers impersonating ShinyHunters. The emails claim to have compromising material and demand $2,000 in Bitcoin within 48 hours, but ShinyHunters denied any involvement. #ShinyHunters #CERTAGID

Two beta npm releases in the @joyfill namespace were found to contain an import-time JavaScript implant that uses blockchain transactions on Tron, Aptos, and BNB Smart Chain to resolve hidden payloads, with one branch leading to a 77 KB Node.js remote-access trojan. The compromised packages were @joyfill/layouts and @joyfill/components, and the recovered code overlaps with the PolinRider loader and DEV#POPPER family while also dropping related infrastructure for a Python infostealer linked to OmniStealer. #Joyfill #PolinRider #DEVPOPPER #OmniStealer

TA488 launched a July 2026 campaign exploiting CVE-2026-42897 in Outlook Web Access to deliver the browser-based implant OWAReaper against government, telecommunications, finance, hospitality, and aerospace targets. OWAReaper provides stealthy persistence, credential theft, command execution, and exfiltration through HTTPS or DNS, using infrastructure such as acocdn[.]com, asecdns[.]com, dnsrecursive[.]eu, and tdndns[.]com. #TA488 #OWAReaper…

ASEC found Larva-26009 targeting MS-SQL servers to deploy VShell, GotoHTTP, SoftEther, and XMRig, using remote control and proxy tools to maintain access and mine cryptocurrency. The attack also involved web shells, credential theft attempts, privilege escalation utilities, and cloud-based infrastructure to obscure command-and-control activity. #Larva26009 #VShell #GotoHTTP #SoftEther #XMRig…

The Advanced Search update adds network filters, letting users query CIDR blocks in IP-related fields and constrain results by ASN or CIDR with the new WITH network option. The YARA interface now emphasizes newly observed indicators and total indicator counts, replacing the old total-matches-per-day chart to give analysts better visibility into rule impact. #CIDR #ASN #YARA

Unknown threat actors used a multi-package npm campaign to impersonate Alibaba private packages and deliver a staged downloader that ultimately deployed a targeted RAT against developers using Alibaba Group tools. The final payload enabled data theft, remote command execution, lateral movement through DingTalk, and platform-specific persistence across macOS, Windows, and Linux. #lib-mtop #aone-cli #DingTalk #AlibabaGroup

Threat actors are increasingly discussing and selling indirect prompt injection (IDPI) tools on underground forums, with generators for email, PDF, calendar invite, and webpage attack content. The activity suggests near-future abuse of hidden prompts in mail, documents, calendar invites, and malvertising to manipulate AI agents and exfiltrate data. #IndirectPromptInjection #TycoonPhaaS #OWASP…