Category: Threat Research

NetSPI found a high-risk pfBlockerNG flaw on pfSense that could let a crafted DNS reply poison logs and trigger stored XSS in the webConfigurator, ultimately leading to remote code execution as root. Netgate rapidly shipped a fix after disclosure, and the issue was later assigned a CVE following validation by NetSPI. #pfBlockerNG #pfSense #Netgate #NetSPI #webConfigurator #CVE

Intelligence Center 3.9 adds broader LLM connectivity, including Azure, Claude models, and Mistral, while expanding support for MITRE ATT&CK v19.1 to keep threat mappings aligned with the latest framework changes. The release also delivers workflow improvements such as faster attachment spotting, clearer vendor integration pricing, and more flexible date and time defaults. #IntelligenceCenter #MITREATT&CKv19.1 #Azure #Claude #Mistral

CSuite is a multi-stage phishing and remote-access operation that combines credential theft, Microsoft 365 session hijacking, and delivery of legitimate management tools to compromise both identities and endpoints. The campaign heavily targets US organizations and uses trusted brands like Adobe, DocuSign, Zoom, SharePoint, and Microsoft 365, with shared infrastructure linking the…

Zscaler ThreatLabz tracked Vidar’s string obfuscation as it evolved from XOR and ChaCha20 into a per-build virtual machine and custom stream cipher designed to frustrate static analysis. The report details how these changes affect deobfuscation, shows example VM opcodes and ARX/ChaCha-based cipher logic, and includes Zscaler detections for Vidar. #Vidar #Zscaler #ThreatLabz

Cloud threat emulation in AWS, Azure, SaaS, and identity environments requires a plan-first lifecycle that models the victim, identity, permissions, telemetry, and cleanup rather than simply detonating API calls. The article argues that useful detection engineering depends on realistic footholds, verified logs, controlled labs, and coverage analysis against exercises using tools like Stratus Red Team, Atomic Red Team, CloudGoat, ROADTools, Splunk ATT&CK Range, and CTID-style plans. #StratusRedTeam #AtomicRedTeam #CloudGoat #ROADTools #SplunkATTCKRange #CTID #AWS #Azure #Entra #M365

ASEC reports that Larva-25012 resumed distributing Proxyware in the second half of 2026 by exploiting already infected systems, with recent cases involving DigitalPulse, SOAX, Appsalt, and IPRoyal. The campaign uses DPLoader, PowerShell downloaders, scheduled tasks, and loader/DLL sideloading to install Proxyware and disable defenses on systems in Korea. #Larva-25012 #DPLoader #DigitalPulse…

GTIG reported on three Russian threat groups—UNC6293, UNC7005, and UNC5976—while the analysis identified 33 network IoCs and uncovered risky subdomains, typosquatting domains, and malicious infrastructure linked to the campaign. Additional DNS and WHOIS investigation revealed victim-related IP communications, email-connected domains, and weaponized domains such as dsapdlqpwd[.]icu. #UNC6293 #UNC7005 #UNC5976 #globsecnet #wa-connectnet #miov2iaiaoubqosiqoiajwowiwjsoonline #dsapdlqpwdicu

South Asian manufacturing is under sustained pressure from ransomware groups and nation-state actors that are exploiting IT/OT convergence, vendor access, and legacy industrial systems to disrupt operations and steal intellectual property. The assessment highlights active threats such as thegentlemen, worldleaks, dragonforce, APT41, Lazarus Group, and APT36/Transparent Tribe, with India and SAARC manufacturers urged to strengthen identity security, OT segmentation, and supply-chain defenses. #APT41 #LazarusGroup #APT36 #TransparentTribe #thegentlemen #worldleaks #dragonforce

AWSCompromisedKeyQuarantine is an AWS managed policy that automatically quarantines publicly exposed IAM access keys and has evolved from v1 to v3 to deny more high-risk actions as cloud attack tactics changed. The article also explains how GitHub secret scanning, push protection, and validity checks interact with AWS to detect exposed credentials…

Sekoia TDR uncovered Exvicy, a ClickFix Malware-as-a-Service framework advertised on Exploit.IN by the threat actor @Exvicy and used to impersonate Cloudflare Turnstile verification pages on compromised WordPress sites. The investigation linked Exvicy to active operator infrastructure, PowerShell downloaders, and code reuse from ErrTraffic, indicating Exvicy is a copycat framework built from the same client-side codebase. #Exvicy #ErrTraffic #Exploit.IN #CloudflareTurnstile #WordPress

Kaspersky GERT investigated a 2026 incident where attackers hijacked Active Directory Group Policy to deploy PAYLOAD ransomware effects across a Middle East manufacturing organization without dropping a Windows encryptor. The activity included domain-root GPO abuse, SYSVOL staging, firewall disabling, data exfiltration, and publication of stolen data on the dark web. #PAYLOAD #FortiGate #ActiveDirectory #SYSVOL

Elastic Cloud Serverless Cross-project search (CPS) lets one Elastic Security origin project run detection, triage, investigation, and response workflows across linked projects while keeping each tenant’s data isolated. In testing, a single origin handled about 2,100 prebuilt detection rules across 100 linked projects, with ES|QL guidance, operational limits, and clear boundaries on what CPS can and cannot do. #ElasticCloudServerless #ElasticSecurity #CrossProjectSearch #ES|QL

SentinelOne found a second victim of TraderTraitor’s macOS backdoors, showing that the DPRK-linked group also targeted an IT services company through fake job interview lures and weaponized Terraform repositories. The report details how FLATROOF and ROOFDECK were delivered, how ROOFDECK used Nostr-based dead drops and signed commands for C2, and how the campaign relied on typosquatted provider domains and malicious lock files. #TraderTraitor #FLATROOF #ROOFDECK #LayerZero #KelpDAO #Nostr

Datadog Security Research identified two unauthenticated credential-harvesting platforms, Loot and UltraVault, that inventory, validate, and operationalize stolen secrets, including AWS and AI service credentials. The activity shows AI-assisted attack workflows, active re-probing of credentials, and exploitation chains tied to vulnerabilities such as react2shell, wp2shell, xss2shell, and joomla2shell. #Datadog #Loot #UltraVault #AmazonBedrock #Anthropic #OpenAI #AWS #CVE-2025-55182 #CVE-2026-63030 #CVE-2026-60137 #CVE-2026-64638 #CVE-2026-48907