N4D Mesh Controller is an active Linux malware campaign that exploits exposed MCP servers and other internet-facing services to steal credentials, move laterally, persist, and maintain command-and-control. Datadog Security Research confirmed a newer loader-to-agent chain, rotated infrastructure, and direct runtime evidence that the 33.8-go-titan agent enumerates MCP tools, invokes execute_command, and reports results back to its controller. #N4D #MCP #33.8-go-titan #cdnorigin.net #209.99.186.235
Category: Threat Research
A coordinated supply chain attack compromised legitimate Rust crates maintained by David Roundy and injected a malicious proc-macro1 dependency that executed cross-platform malware during Cargo builds. The attack deployed a stage-1 loader and stage-2 backdoor across Linux, macOS, and Windows, with network activity tied to 23[.]254[.]165[.]112 and related fallback domains. #arrayref #internment #append-only-vec #proc-macro1 #RustSec #Socket #DavidRoundy
In August 2026, forty npm typosquatting packages were used as couriers to deliver a Windows payload from a GitHub account named bebraz1, with a WSL-aware install script bridging from a developer’s Linux shell to the Windows host underneath. The delivered Rust-based wrapper unpacked an encrypted in-memory stealer that targeted cryptocurrency wallets, Chromium browser credentials, and Telegram sessions, then attempted to exfiltrate data through upload.gofile.io after fingerprinting the victim via api.ipify.org. #bebraz1 #main.exe #gofile.io #api.ipify.org #WSL
Google Threat Intelligence Group detailed three suspected Russian espionage clusters—UNC6293, UNC7005, and UNC5976—that abuse legitimate authentication flows such as app passwords, device code linking, OAuth, and messaging-app linking to steal access across academia, defense, governments, and think tanks. The report also ties UNC7005 to malware delivery and infrastructure overlaps involving VIDAR, ATOMIC, ENGINELIGHT, CHERRYPIE, and HEADRUSH, while connecting UNC6293 and UNC7005 to ICE RELIC. #UNC6293 #UNC7005 #UNC5976 #ICE_RELIC #VIDAR #ATOMIC #ENGINELIGHT #CHERRYPIE #HEADRUSH
This research reverse engineers Windows Defender’s BTR.sys boot-time remediation driver and shows how its encrypted transaction format can be abused to perform arbitrary file and registry operations from Ring 0. The paper also introduces BTR_CLI, demonstrates EDR/AV bypass and boot-time neutralization against Microsoft Defender, and highlights the defensive implications of a signed built-in LOLDriver. #BTR.sys #BTR_CLI #MicrosoftDefender #MsMpEng.exe #WdFilter.sys #WdBoot.sys #WdNisDrv.sys #Mimikatz #mimidrv.sys #MSRC
ShieldBreak is a Windows proof of concept from Nightmare-Eclipse that chains Cloud Files, Object Manager manipulation, Defender APIs, and a timing race to achieve local privilege escalation on fully patched Windows systems. It ultimately writes an attacker-controlled DLL to C:WindowsSystem32phoneinfo.dll and triggers SYSTEM code execution through the Windows Error Reporting QueueReporting task. #NightmareEclipse #ShieldBreak #phoneinfo.dll #MpClient.dll #QueueReporting
The article compares how three coding agents performed in default and plan modes while building a document portal, measuring security, architecture, and code quality across six iterations. The biggest recurring flaw was critical IDOR across document routes, while the most severe single failure was Composer 2.5 plan mode’s hardcoded JWT secret that could enable authentication forgery and admin impersonation. #Sonnet5 #Composer25 #GPT55 #IDOR
Grandoreiro remains active in Latin America, with recent campaigns using Duplicate Files Finder DLL sideloading, heavy anti-analysis checks, and encrypted C2 communications to evade detection. Telemetry from June 2026 shows Mexico as the primary hotspot, while the campaign also uses spoofed filenames, decoy documents, and a broad blacklist of tools, hosts, and virtualized environments. #Grandoreiro #DuplicateFilesFinder #ip-api.com #nhlfan.net
CloudSEK found an exposed directory belonging to a Chinese-speaking operator who used AI coding agents, Telegram, and a self-hosted LLM proxy to run autonomous intrusions against WordPress sites, crypto/DeFi targets, and wallet-bearing phishing databases. The operator also built a blockchain-based DeadDropC2 concept and deployed a disguised Monero miner, while leaving behind over 12,000 WordPress backdoors, harvested credentials, and large sets of wallet keys and seed phrases. #WordPress #DeadDropC2 #Monero #Telegram #ClaudeCode #Codex #Hermes #pi #ZhipuGLM
Socket Threat Research identified 77 Firefox extension identities linked to the “Offside Wallet Theft Factory,” with 40 confirmed malicious extensions that steal wallet secrets or credentials and 37 deceptive sports-score shells that appear to support the same publishing pipeline. The campaign impersonates OKX, Rabby Wallet, TronLink, and other Web3 products using Supabase-controlled loaders, Cloudflare Workers, hardcoded C2 infrastructure, and version repurposing across Firefox IDs. #Firefox #Supabase #CloudflareWorkers #RabbyWallet #OKX #TronLink
In late July 2026, eSentire TRU reported ErrTraffic-generated ClickFix campaigns that delivered the Cruciferra loader, which abused the signed vulnerable driver DCRCVDrv.sys to kill AV/EDR processes from the kernel. The campaigns used compromised WordPress sites, blockchain-based dead-drop C2 infrastructure, and fake CAPTCHA/BSOD lures to trick victims into running malicious PowerShell while deploying Remus through side-loading and process hollowing. #Cruciferra #ErrTraffic #DCRCVDrvsys #Remus #MocoMsys #ServiceModelRegexe
A network of 41 websites impersonated popular games and Windows software to funnel visitors toward installing Download Studio, using deceptive click handling, affiliate redirects, and convincing fake download pages. The campaign included genuine-looking links, valid signatures, and prior abuse history tied to Download Studio’s updater, including FakeMBAM distribution by Avast-reported attackers….
This article describes BOFScale, which runs a modified Tailscale daemon and client entirely in-memory to tunnel TS2021 control traffic and DERP relay traffic over standard WebSockets through CloudFront or Fastly. It also shows how the stack uses Headscale, SOCKS5 port forwarding, and userspace networking to support covert access, routing, and NTLM relay operations while reducing disk, service, and child-process artifacts. #BOFScale #Tailscale #Headscale #CloudFront #Fastly #DERP #TS2021
NSA, CISA, FBI, DOE, and EPA warn of an active threat targeting Internet-exposed Siemens S7 Series PLCs with AI-generated exploitation scripts, insecure credentials, and Snap7-based tooling disguised as legitimate monitoring software. The advisory urges immediate hardening, patching, segmentation, and monitoring to protect critical infrastructure sectors and prevent disruption, safety incidents, and…
Rapid7 uncovered Operation ASTERIX, a cryptocurrency fraud campaign that used exposed infrastructure to stage phishing panels, vishing tools, fake wallet apps, and Telegram exfiltration while heavily relying on AI coding assistants during development. The operator also tried to bypass model safety controls with a custom jailbreak prompt after one AI model resisted parts of the workflow. #OperationASTERIX #TrezorSuite #LedgerLive #Exodus #Asterisk #Crypto.com #Kraken