Threat Research

N4D Mesh Controller is an active Linux malware campaign that exploits exposed MCP servers and other internet-facing services to steal credentials, move laterally, persist, and maintain command-and-control. Datadog Security Research confirmed a newer loader-to-agent chain, rotated infrastructure, and direct runtime evidence that the 33.8-go-titan agent enumerates MCP tools, invokes execute_command, and reports results back to its controller. #N4D #MCP #33.8-go-titan #cdnorigin.net #209.99.186.235

A coordinated supply chain attack compromised legitimate Rust crates maintained by David Roundy and injected a malicious proc-macro1 dependency that executed cross-platform malware during Cargo builds. The attack deployed a stage-1 loader and stage-2 backdoor across Linux, macOS, and Windows, with network activity tied to 23[.]254[.]165[.]112 and related fallback domains. #arrayref #internment #append-only-vec #proc-macro1 #RustSec #Socket #DavidRoundy

In August 2026, forty npm typosquatting packages were used as couriers to deliver a Windows payload from a GitHub account named bebraz1, with a WSL-aware install script bridging from a developer’s Linux shell to the Windows host underneath. The delivered Rust-based wrapper unpacked an encrypted in-memory stealer that targeted cryptocurrency wallets, Chromium browser credentials, and Telegram sessions, then attempted to exfiltrate data through upload.gofile.io after fingerprinting the victim via api.ipify.org. #bebraz1 #main.exe #gofile.io #api.ipify.org #WSL

Google Threat Intelligence Group detailed three suspected Russian espionage clusters—UNC6293, UNC7005, and UNC5976—that abuse legitimate authentication flows such as app passwords, device code linking, OAuth, and messaging-app linking to steal access across academia, defense, governments, and think tanks. The report also ties UNC7005 to malware delivery and infrastructure overlaps involving VIDAR, ATOMIC, ENGINELIGHT, CHERRYPIE, and HEADRUSH, while connecting UNC6293 and UNC7005 to ICE RELIC. #UNC6293 #UNC7005 #UNC5976 #ICE_RELIC #VIDAR #ATOMIC #ENGINELIGHT #CHERRYPIE #HEADRUSH

This research reverse engineers Windows Defender’s BTR.sys boot-time remediation driver and shows how its encrypted transaction format can be abused to perform arbitrary file and registry operations from Ring 0. The paper also introduces BTR_CLI, demonstrates EDR/AV bypass and boot-time neutralization against Microsoft Defender, and highlights the defensive implications of a signed built-in LOLDriver. #BTR.sys #BTR_CLI #MicrosoftDefender #MsMpEng.exe #WdFilter.sys #WdBoot.sys #WdNisDrv.sys #Mimikatz #mimidrv.sys #MSRC

ShieldBreak is a Windows proof of concept from Nightmare-Eclipse that chains Cloud Files, Object Manager manipulation, Defender APIs, and a timing race to achieve local privilege escalation on fully patched Windows systems. It ultimately writes an attacker-controlled DLL to C:WindowsSystem32phoneinfo.dll and triggers SYSTEM code execution through the Windows Error Reporting QueueReporting task. #NightmareEclipse #ShieldBreak #phoneinfo.dll #MpClient.dll #QueueReporting

The article compares how three coding agents performed in default and plan modes while building a document portal, measuring security, architecture, and code quality across six iterations. The biggest recurring flaw was critical IDOR across document routes, while the most severe single failure was Composer 2.5 plan mode’s hardcoded JWT secret that could enable authentication forgery and admin impersonation. #Sonnet5 #Composer25 #GPT55 #IDOR

Grandoreiro remains active in Latin America, with recent campaigns using Duplicate Files Finder DLL sideloading, heavy anti-analysis checks, and encrypted C2 communications to evade detection. Telemetry from June 2026 shows Mexico as the primary hotspot, while the campaign also uses spoofed filenames, decoy documents, and a broad blacklist of tools, hosts, and virtualized environments. #Grandoreiro #DuplicateFilesFinder #ip-api.com #nhlfan.net

CloudSEK found an exposed directory belonging to a Chinese-speaking operator who used AI coding agents, Telegram, and a self-hosted LLM proxy to run autonomous intrusions against WordPress sites, crypto/DeFi targets, and wallet-bearing phishing databases. The operator also built a blockchain-based DeadDropC2 concept and deployed a disguised Monero miner, while leaving behind over 12,000 WordPress backdoors, harvested credentials, and large sets of wallet keys and seed phrases. #WordPress #DeadDropC2 #Monero #Telegram #ClaudeCode #Codex #Hermes #pi #ZhipuGLM

Socket Threat Research identified 77 Firefox extension identities linked to the “Offside Wallet Theft Factory,” with 40 confirmed malicious extensions that steal wallet secrets or credentials and 37 deceptive sports-score shells that appear to support the same publishing pipeline. The campaign impersonates OKX, Rabby Wallet, TronLink, and other Web3 products using Supabase-controlled loaders, Cloudflare Workers, hardcoded C2 infrastructure, and version repurposing across Firefox IDs. #Firefox #Supabase #CloudflareWorkers #RabbyWallet #OKX #TronLink

In late July 2026, eSentire TRU reported ErrTraffic-generated ClickFix campaigns that delivered the Cruciferra loader, which abused the signed vulnerable driver DCRCVDrv.sys to kill AV/EDR processes from the kernel. The campaigns used compromised WordPress sites, blockchain-based dead-drop C2 infrastructure, and fake CAPTCHA/BSOD lures to trick victims into running malicious PowerShell while deploying Remus through side-loading and process hollowing. #Cruciferra #ErrTraffic #DCRCVDrvsys #Remus #MocoMsys #ServiceModelRegexe

A network of 41 websites impersonated popular games and Windows software to funnel visitors toward installing Download Studio, using deceptive click handling, affiliate redirects, and convincing fake download pages. The campaign included genuine-looking links, valid signatures, and prior abuse history tied to Download Studio’s updater, including FakeMBAM distribution by Avast-reported attackers….

This article describes BOFScale, which runs a modified Tailscale daemon and client entirely in-memory to tunnel TS2021 control traffic and DERP relay traffic over standard WebSockets through CloudFront or Fastly. It also shows how the stack uses Headscale, SOCKS5 port forwarding, and userspace networking to support covert access, routing, and NTLM relay operations while reducing disk, service, and child-process artifacts. #BOFScale #Tailscale #Headscale #CloudFront #Fastly #DERP #TS2021

NSA, CISA, FBI, DOE, and EPA warn of an active threat targeting Internet-exposed Siemens S7 Series PLCs with AI-generated exploitation scripts, insecure credentials, and Snap7-based tooling disguised as legitimate monitoring software. The advisory urges immediate hardening, patching, segmentation, and monitoring to protect critical infrastructure sectors and prevent disruption, safety incidents, and…

Rapid7 uncovered Operation ASTERIX, a cryptocurrency fraud campaign that used exposed infrastructure to stage phishing panels, vishing tools, fake wallet apps, and Telegram exfiltration while heavily relying on AI coding assistants during development. The operator also tried to bypass model safety controls with a custom jailbreak prompt after one AI model resisted parts of the workflow. #OperationASTERIX #TrezorSuite #LedgerLive #Exodus #Asterisk #Crypto.com #Kraken

Gen Threat Labs identified WordlistLoader, a new loader used in ClearFake campaigns to deliver Amatera Stealer through fake CAPTCHA and ClickFix-style infection chains. The report also details major Amatera changes through version 4.3.3-alpha1, including stronger obfuscation, WoW64/Heaven’s Gate syscall hardening, x64 syscall trampolines, and a redesigned Application-Bound Encryption bypass. #WordlistLoader #AmateraStealer #ClearFake #FakeCaptchas #ClickFix #HeavensGate #WoW64 #PoolParty

Scammers are using fake AML wallet-checking sites that mimic legitimate services like AMLBot to trick users into connecting wallets and approving malicious transactions. The scheme relies on fake progress screens, fabricated fees, and misleading “Clean, Low Risk” results to steal crypto or gain access to token permissions. #AMLBot #AML Check #Browser…

Microsoft Threat Intelligence uncovered a multistage intrusion campaign targeting hospitality and hotel organizations in Europe and Asia, especially Japan, using photo-themed ZIP archives and fake image shortcut files to launch an attack chain with PowerShell, a Node.js implant, persistence, and C&C activity. The campaign also abused Calendly and Google redirect links for phishing and yielded extensive IoCs, including domains, IPs, and related artifacts linked to infrastructure such as photo-26653[.]cfd and zloapobikahy23[.]bond. #Microsoft #Calendly #Google #Nodejs #PowerShell #photo-26653cfd #zloapobikahy23bond

StopAndProtect is a large-scale operation that combines file encryption, data theft, and multiple spreading and control components while abusing thousands of hacked WordPress sites for infrastructure. OPSEC failures exposed victim logs, screenshots, source code, and evidence that the campaign affected thousands of IPs across regions, with most activity seen in the US, Russia, and India. #StopAndProtect #WordPress #ClickFix #SilentEncryptor #SilentDataCollector

This article explains how malware uses blockchain dead drop resolvers to fetch command-and-control pointers at runtime from smart contracts on EVM chains, Solana, and TON instead of hardcoding them. It highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns. #ChainDrop #TroyDen #DeadLock #CLEARSHORT #JADESNOW #GlassWorm #SalatStealer #TONResolver #Ethereum #Polygon #BNBSmartChain #Solana #TON