Google Threat Intelligence Group (GTIG) reports that PRC‑nexus threat actor APT24 has run a three‑year espionage campaign delivering a heavily obfuscated first‑stage downloader named BADAUDIO—often using strategic web compromises, supply‑chain compromise of a Taiwanese marketing firm, and targeted phishing to deploy AES‑encrypted payloads such as Cobalt Strike Beacon. The report details BADAUDIO’s control‑flow flattening, DLL sideloading execution chain, fingerprinting‑based targeting, extensive infrastructure churn, and provides IOCs and YARA rules for detection. #BADAUDIO #APT24 #CobaltStrikeBeacon #twisinbeth.com

Read More
Detecting CVE-2024-1086: The decade-old Linux kernel vulnerability that’s being actively exploited in ransomware campaigns

CVE-2024-1086 is a decade-old use-after-free vulnerability in the Linux kernel’s netfilter (nftables) component that allows attackers to gain root privileges and is being actively exploited in ransomware campaigns. Public PoC availability and default-enabled features like unprivileged user namespaces have expanded the attack surface, putting legacy and cloud Linux systems at high risk. #CVE-2024-1086 #nftables

Read More
Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads

Acronis TRU tracked a global malvertising and SEO-driven campaign named “TamperedChef” that distributes digitally signed fake installers which persist via scheduled tasks and execute heavily obfuscated JavaScript backdoors with remote code execution and HTTPS-based C2. The operators use U.S.-registered shell companies to acquire and rotate code-signing certificates, short-lived domain registrations, and malvertising/SEO to hide infrastructure and quickly recover after takedowns. #TamperedChef #Obfuscator_io

Read More
Analysis of ShadowPad Attack Exploiting WSUS Remote Code Execution Vulnerability (CVE-2025-59287)

AhnLab ASC and SentinelOne reporting show CVE-2025-59287 in WSUS was exploited to deliver ShadowPad by chaining PowerCat for shell access and using certutil/curl to fetch and decode payloads. Observed artifacts include ETDApix.dll sideloading with ETDCtrlHelper.exe, tmp file configs for persistence, and C2 at 163.61.102[.]245; remediation: apply Microsoft update and restrict WSUS…

Read More
PlushDaemon compromises network devices for adversary-in-the-middle attacks

ESET analyzed PlushDaemon’s use of a MIPS32 network implant named EdgeStepper that forwards DNS queries to attacker-controlled nodes to hijack legitimate software updates and deliver downloaders that deploy the SlowStepper backdoor. The report also details LittleDaemon and DaemonicLogistics — two Windows downloaders used in the update-hijacking chain — and provides IoCs including files, domains, and IPs. #EdgeStepper #SlowStepper

Read More
Dark Web Profile: Sarcoma Ransomware

Sarcoma is a fast-emerging ransomware group (late 2024) that combines data theft with encryption and aggressive double-extortion tactics, targeting mid-market and larger organizations—especially in manufacturing, technology and construction—primarily in the United States, Italy and Canada. The group operates a controlled RaaS-style model, targets Windows, Linux and ESXi environments, and uses techniques including credential theft, zero-day exploits, anti-recovery steps and public leak pressure. #Sarcoma #ChaCha20

Read More
Emulating the Destructive Sandworm Adversary

Sandworm (also tracked as APT44, Seashell Blizzard, and Voodoo Bear) conducted intrusions against Ukrainian organizations using exploited web services and a custom webshell called LocalOlive, then relied on living-off-the-land techniques to conduct reconnaissance, persistence, and credential theft. The campaign and associated emulation highlight specific TTPs—including LSASS dumping, scheduled task persistence, and…

Read More