Category: Threat Research

CrowdStrike identified PhantomRaven, a JavaScript information stealer distributed through malicious npm packages and likely written with help from a large language model, with the operator posing as a bug bounty hunter to target organizations and potential rewards. The campaign used typosquatted packages, attacker-controlled domains, and automated exfiltration of system and CI/CD…

eSentire TRU uncovered GhostCode, an active device code phishing campaign delivered through web contact forms and disguised business outreach, which abused Microsoft device code authorization to steal tokens, register devices, and obtain a Primary Refresh Token in under 78 seconds. The campaign used layered HTML obfuscation, WeTransfer-hosted lures, compromised or lookalike infrastructure, residential proxy rotation, and Microsoft/Cloudflare trust signals to bypass detection and complete post-compromise access. #GhostCode #GHOSTnet #EvilTokens #Storm2372 #MicrosoftAuthBroker #CloudflareTurnstile #WeTransfer #Salesforce #BJsWholesaleClub

FortiGuard Labs identified Evooo1Bot, a previously undocumented Linux botnet that repurposes Mirai’s DDoS engine while adding encrypted C2, credential theft, SOCKS relay, SSH brute forcing, and a multi-vulnerability exploit framework. Active since July 2026, it targets Internet-facing devices through a loader hosted at 91.92.40[.]118 and uses campaigns against products from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, D-Link, Telesquare, Hikvision, and others. #Evooo1Bot #Mirai #FortiGuardLabs #Alcatel #NETGEAR #Tenda #MitsubishiElectric #DLink #Telesquare #Hikvision

Tajin Group is a Chinese-speaking threat group that uses Telegram-based guarantee marketplaces, Fragment Market, and multiple payment gateways to run phishing, carding, money laundering, and cash-out operations across many countries. The group has shifted from Dabai Guarantee to Xinbi Guarantee, while buying Telegram usernames and anonymous numbers to improve OPSEC and expand its financial crime services. #TajinGroup #DabaiGuarantee #XinbiGuarantee #FragmentMarket #CCAvenue #Geidea #NGenius #Selfridges #ChowTaiFookJewelleryHongKong

Elastic Security Labs tracked REF9334, a Brazilian banking malware operation using the KREMLIN toolkit to deliver malicious browser extensions, credential theft, and staged loaders through JavaScript, Node.js, RunPE, and Ethereum-based infrastructure. The campaign targeted Brazilian banking users and financial institutions, and Threat Command temporarily disrupted more than 1,500 infections by registering the network canary domain used by the malware. #REF9334 #KREMLIN #ThreatCommand #Ethereum #SentinelOne

Attackers are abusing stolen AWS IAM credentials to hijack Amazon Bedrock model access through AWS Marketplace, a technique known as LLMjacking, and monetize the victim account’s inference charges. FortiGuard Labs observed a long-lived AdministratorAccess key used to create a new IAM user, subscribe to foundation models, and invoke them, while FortiCNAPP maps defenses across the full attack chain. #AWS #AmazonBedrock #FortiCNAPP #FortiGuardLabs #LLMjacking

Acronis TRU uncovered Red Heron, a Chinese-speaking threat actor that rapidly weaponized CVE-2026-60004 against internet-facing Gitea servers to steal source code, collect credentials, and gain deeper access into victim environments. The exposed staging server revealed JITTERLY and the embedded SIXZUT rootkit, showing a campaign that moved from repository theft to persistence and lateral movement across systems like Proxmox, Synology NAS, and compromised Gitea instances. #RedHeron #CVE-2026-60004 #Gitea #JITTERLY #SIXZUT #Proxmox #Synology

The article explains how to correlate Kubernetes audit logs with Elastic Defend for Containers data to investigate suspicious service account activity, pod creation, and attempted container escape behavior. It highlights two main join methods—pod caller identity and service account plus objectRef pod names—using an EKS lab scenario that includes a breakout pod, nsenter, chroot, and decoded exec requestURIs. #ElasticDefendforContainers #Kubernetes #EKS #nsenter #chroot

The article describes a layered Linux privilege escalation detection framework that combines general root-transition logic with technique-specific rules for SUID abuse, unshare, Python-driven exploits, and kernel page-cache corruption. It also reviews 2026 Linux LPE cases such as Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, pedit COW, DirtyClone, CIFSwitch, OVSwrap, and CVE-2026-46333, showing how Elastic Defend and Auditd can catch them in practice. #CopyFail #DirtyFrag #Fragnesia #DirtyDecrypt #peditCOW #DirtyClone #CIFSwitch #OVSwrap #CVE-2026-46333

The SquawkDoor backdoor uses browser-waiting and a one-time POST to /register-ip as anti-analysis and execution confirmation, then connects to its command-and-control server over TLS with a custom SQD1 protocol. After the handshake, it collects basic host information and awaits further commands from the C2 server. #SquawkDoor #register-ip #SQD1

DragonDoll uses hybrid encryption with AES-256-CBC for data and RSA-OAEP for key exchange, then sends extensive device information after registration. Its NetworkUtils and bgs components support C2 messaging, overlay file retrieval for ENABLE_INJECT, and persistent Socket.IO-based handling of incoming connections. #DragonDoll #NetworkUtils #bgs #Socket.IO

FortiGuard Labs observed a Casbaneiro campaign targeting Windows users in Latin America through phishing emails and PDF lures themed as fake invoices and legal notices. The attack used a multi-stage chain with HTA and AutoIt loaders, stealthy environment checks, and selective C2 behavior to steal data and evade analysis. #Casbaneiro #FortiGuardLabs #MicrosoftWindows #MicrosoftOutlook

The article explains how Microsoft Defender Attack Surface Reduction (ASR) rules can block suspicious Windows behaviors such as WMI-based process creation, persistence, copied system tools, and malicious Office activity, while also logging configuration changes. It also shows how Wazuh collects ASR telemetry and uses custom rules to detect and visualize blocked…

CYFIRMA reports a multi-domain campaign that impersonates the Indian Income Tax Department to lure victims into downloading a malicious VHDX file that delivers a loader and DLL payload. The operation uses ten disposable .shop domains, process injection into Runtimebroke.exe, and an attempted connection to xvcbvgfr.com, with infrastructure and artifacts tied to Common_Offline_Utility_ITR-1_to_4_AY2026-07-27.vhdx, Common_Offline_Utility_ITR-1_to_4_AY2026-27.exe, and tedutil.dll. #IncomeTaxDepartment #Runtimebroke.exe #tedutil.dll #xvcbvgfr.com