InfoSec Briefing - May 30, 2026

🎧 Audio Briefing

Playback Speed:

Cyber security developments for Saturday the 30th of May 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 11 articles to cover. All attribution is by the article authors. All article analysis is automated.

WithSecure are tracking GREYVIBE, a Russia-nexus espionage group that's been systematically using ChatGPT, Google Gemini, and other generative AI tools since August 2025 to speed up their attacks on Ukrainian military and government targets. They're using AI across the full attack lifecycle — phishing content, fake websites, CAPTCHA pages — essentially outsourcing the grunt work to language models.

A 39-year-old Albanian national known as 'Venom' has been arrested in Athens and extradited to France after selling VenomRAT malware at least 36 times between 2021 and 2025 through a malware-as-a-service operation. Worth noting this was a joint effort involving Australian authorities, the FBI, and Greek cybercrime units — shows cross-jurisdictional cooperation can still land these operators.

The NSA has released Zero Trust Implementation Guidelines — a phased framework covering discovery and implementation organised around the usual pillars of least privilege, continuous verification, and granular access. This is strategic guidance for organisations planning the transition rather than anything incident-driven.

A Romanian national, Catalin Dragomir, has been sentenced to 56 months for operating as an initial access broker — he gained unauthorised access to an Oregon state government network and others, then tried to sell that access with stolen personal data as proof of compromise. Total losses across victims exceeded a quarter of a million dollars.

Law firm Wiley Rein is facing a class action after Chinese government-affiliated hackers maintained access to Microsoft 365 email accounts for nearly 12 months — July 2024 to June 2025 — via phishing. The breach exposed sensitive client data including social security numbers and financial records, with victims not notified until March this year.

Dutch police and the NCSC have dismantled a botnet comprising at least 17 million infected devices globally — computers, routers, IoT kit — seizing 200 command-and-control servers hosted in the Netherlands. The infrastructure was being used for the usual buffet of attacks, fraud, spam, and DDoS operations.

Carnegie Mellon have disclosed nine critical vulnerabilities in Casdoor versions 2.362.0 and earlier — authentication bypass, account takeover, privilege escalation — stemming from broken SAML assertion validation, MFA bypass in social login flows, and poor token management. No patch available yet from the development team.

And another vulnerability disclosure, this one from Adversa AI — they've found 'SymJack', an architectural flaw in six major AI coding agents including Claude Code, Gemini CLI, and GitHub Copilot CLI. Attackers can use symlink redirection to bypass human approval prompts and achieve remote code execution, particularly nasty in CI/CD environments running in auto-approval mode.

Researchers have developed FROST, a browser-based side-channel attack that uses the Origin Private File System API to fingerprint user activity by measuring SSD latency contention. Works on Chrome, Firefox, and Safari across Linux and macOS, allowing malicious sites to determine which sites you visit and which applications you launch — no permissions needed. Can also exfiltrate data at nearly 900 bits per second.

Sonatype have uncovered a campaign of 176 malicious npm packages exploiting dependency confusion — attackers published packages with version 99.99.99 to supersede legitimate internal dependencies, then used post-install scripts to exfiltrate credentials, environment variables, and CI/CD secrets from developer systems and build pipelines.

And finally, Florian Roth has built a custom benchmark for evaluating large language models on their ability to triage THOR forensic scanner findings. It measures critical miss rate, threat capture rate, and false review load — basically testing whether an LLM can make high-stakes security decisions in SOC environments, which general-purpose benchmarks don't really cover. Useful if you're looking to deploy LLMs for alert triage.

That concludes today's briefing.

📰 Articles Covered

GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations - WithSecure

The following precis details the activities of the threat actor group identified by WithSecure as "GREYVIBE," based on their research.

### **Overview: What Happened**
Since at least August 2025, WithSecure has tracked a persistent cyber-espionage campaign dubbed "GREYVIBE." The group conducts intelligence-gathering operations that align with Russian state interests, specifically targeting entities involved in or related to the ongoing Russia-Ukraine war 【1】【1】.

### **Who Is Affected**
The campaign is broad in scope, impacting a diverse range of victims across Ukraine and international entities with ties to the region. Targeted sectors include:
* **Military and Government:** High-value targets for intelligence gathering.
* **Civilian and Business:** Broader targeting to facilitate access or gather peripheral information.

### **Security Implications**
GREYVIBE is assessed as a low-to-moderately sophisticated actor. While their tradecraft shows repeated operational security (OPSEC) failures, their integration of generative AI (GenAI) and large language models (LLMs) represents a significant evolution in how such groups operate. This integration allows them to bridge technical capability gaps, accelerate their operational tempo, and obfuscate their activities by reducing reliance on historically reused code patterns that are often used for attribution 【1】【1】.

### **Technical Details**
The group employs a variety of attack vectors and tools, with evidence suggesting they are Russian-speaking and operate within the Moscow time zone 【1】【1】.

* **Attack Vectors:** The group utilizes spear-phishing, fake CAPTCHA pages, and fraudulent websites (such as fake Ukrainian adult clubs) to deliver malware 【1】.
* **AI Integration:** GREYVIBE systematically uses platforms like Ideogram AI, ChatGPT, and Google Gemini across the entire attack lifecycle 【1】. This includes:
* **Lure Development:** Creating images and lure sites (e.g., PrincessClub, PhantomClick).
* **Resource Development:** Writing obfuscation and loader scripts (e.g., `LOOKVALJS`, `DAYLIGHT`, `TEASOUP`) and full-stack development of command-and-control infrastructure like `LegionRelay`.
* **Post-Compromise:** Generating commands and scripts for tools like `PhantomRelay` and `LegionRelay` 【1】.
* **Ecosystem Ties:** Despite their alignment with state interests, indicators suggest the group may have ties to the broader cybercrime ecosystem, potentially employing current or former cybercriminal actors 【1】.

### **What Defenders Should Know**
* **AI-Assisted Threats:** Defenders should be aware that threat actors are increasingly using LLMs to lower the barrier to entry for sophisticated attacks. This can lead to more rapid development of custom malware and lures.
* **Operational Patterns:** Because the group uses AI to generate unique code, traditional signature-based detection may be less effective. Defenders should focus on behavioral analysis and monitoring for the specific tools identified, such as `LegionRelay` and `PhantomRelay`.
* **Resources:** WithSecure has provided a comprehensive list of Indicators of Compromise (IoCs) and associated YARA rules, which are available on their GitHub repository for security teams to implement in their detection stacks 【1】.
Malware seller hunted across three continents - Nees Kathimerines Ekdoseis Single-Member S.A.

Following the international investigation and subsequent arrest of the individual known as "Venom," here is a detailed precis of the case:

### What Happened
A 39-year-old Albanian national, operating under the alias "Venom," was arrested in the Nikaia district of Athens on November 3, 2025, following a multi-year, multi-continental investigation 【1】. The suspect was extradited to France in mid-May 2026 to face charges related to offenses committed in northern France between 2021 and 2025 【1】. The operation involved a coordinated effort between Australian authorities, the FBI, and Greek cybercrime units 【1】.

### Who Is Affected
The primary victims are individuals and organizations targeted by users of the "VenomRAT" malware between 2021 and 2025 【1】. Court documents indicate that the malware was sold at least 36 times, facilitating unauthorized access and data theft for those who purchased the software 【1】.

### Security Implications
The case highlights the persistent threat of Remote Access Trojans (RATs) distributed via subscription-based models, often referred to as "Malware-as-a-Service" (MaaS) 【1】. By lowering the barrier to entry for cybercriminals, such tools enable even non-expert actors to conduct sophisticated data exfiltration and remote surveillance operations 【1】.

### Technical Details
* **Malware Type:** VenomRAT, a Remote Access Trojan designed to provide full remote control over compromised systems and facilitate data theft 【1】.
* **Distribution:** The malware was sold through a subscription model, which was analyzed by the FBI after they purchased a subscription in June 2023 【1】.
* **Attribution/Tracking:** Investigators identified the suspect by mapping his digital footprint, including social media accounts, Greek mobile numbers, and cryptocurrency transactions 【1】.

### What Defenders Should Know
* **Subscription Threats:** Defenders should remain vigilant against malware distributed via subscription models, as these tools are frequently updated and widely available to various threat actors 【1】.
* **Detection:** Organizations should focus on identifying indicators of compromise (IoCs) associated with RATs, such as unauthorized remote connections, unusual outbound traffic, and suspicious file execution patterns 【1】.
* **Operational Security:** The investigation underscores the importance of tracking financial trails (cryptocurrency) and digital metadata, which remain critical components in de-anonymizing cybercriminals 【1】.
Zero Trust Implementation Guidelines - National Security Agency

The NSA’s Zero Trust Implementation Guidelines (ZIGs) do not describe a specific security incident or breach, but rather serve as a strategic framework and set of resources designed to help organizations transition to a Zero Trust architecture 【1】.

### Overview of the Zero Trust Framework
Zero Trust is defined as a collection of concepts aimed at minimizing uncertainty in access decisions within information systems, specifically operating under the assumption that a network is already compromised 【1】. Because the framework assumes that a breach is inevitable or has already occurred, it shifts security from traditional perimeter-based defenses to a model of constant monitoring and continuous verification 【1】.

### Key Components and Implementation
The NSA provides this guidance to help defenders implement granular access controls that automatically contain potential damage 【1】. The ZIGs are structured into several distinct phases and categories:

* **Primer:** Provides foundational direction and guidance for using the ZIGs.
* **Phased Approach:** The guidance is broken down into a **Discovery Phase**, **Phase One**, and **Phase Two**, each detailing specific capabilities and activities for implementation.
* **Pillars:** Organizes Zero Trust capabilities and activities by specific security pillars.
* **Cybersecurity Information Sheets (CSIs):** Offers targeted technical guidance and best practices for specific Zero Trust implementations.

### Implications for Defenders
For organizations and security professionals, the ZIGs emphasize that Zero Trust is not a single product but a strategic approach to security 【1】. Defenders should focus on:
* **Least Privilege:** Enforcing accurate, per-request access decisions to ensure only authorized entities can access specific resources 【1】.
* **Continuous Verification:** Moving away from static trust to a model that constantly monitors for anomalous or malicious activity 【1】.
* **Granular Enforcement:** Making access control decisions as granular as possible to limit the blast radius of any potential security incident 【1】.
Romanian National Sentenced for Selling Access to Networks of Oregon State Government Office and Other U.S. Victims - U.S. Department of Justice

This case details the criminal activities of Catalin Dragomir, a Romanian national who specialized in gaining and selling unauthorized access to protected computer networks in the United States 【1】.

### Executive Summary
* **What Happened:** In June 2021, Dragomir gained unauthorized access to a computer within an Oregon state government office network. He subsequently attempted to sell this network access to a prospective buyer, providing samples of stolen Personal Identifying Information (PII) as proof of his access. Beyond this specific incident, he engaged in a broader scheme of compromising numerous other U.S.-based victims, resulting in total financial losses exceeding $250,000 【1】.
* **Who is Affected:** The primary victim identified was an Oregon state government office. Additionally, numerous other unnamed victims across the United States were impacted by his broader network intrusion activities 【1】.
* **Legal Outcome:** Dragomir was arrested in Romania in November 2024, extradited to the U.S. in January 2025, and pleaded guilty to one count of obtaining information from a protected computer and one count of aggravated identity theft. He was sentenced to 56 months in federal prison 【1】.

### Security Implications
The case underscores the significant risks posed by "Initial Access Brokers" (IABs)—threat actors who specialize in breaching networks and selling that access to other criminals, such as ransomware operators. By compromising government infrastructure and exfiltrating PII, Dragomir demonstrated how easily sensitive public sector data can be leveraged for illicit profit. The sale of network access creates a dangerous downstream effect, as the purchaser of such access often proceeds to conduct more destructive activities, such as data encryption, extortion, or further credential theft.

### Technical Details & Defender Takeaways
While specific technical indicators (such as the exact exploit or vulnerability used) were not detailed in the public release, the nature of the crime provides clear guidance for defenders:

* **Focus on Initial Access:** The core of this threat was the unauthorized access to a "protected computer." Defenders should prioritize hardening entry points, including robust multi-factor authentication (MFA) for all remote access, VPNs, and cloud services.
* **PII Protection:** The fact that the attacker used PII samples to "prove" the value of his access highlights the importance of data loss prevention (DLP) strategies. Sensitive PII should be encrypted at rest and access to databases containing such information should be strictly audited and restricted.
* **Network Segmentation:** To limit the impact of a single compromised workstation, organizations should implement strict network segmentation. This prevents an attacker who gains access to one machine from easily pivoting to other critical systems or databases.
* **Monitoring and Auditing:** The ability to detect unauthorized access early is critical. Defenders should maintain comprehensive logs of network activity and implement behavioral analytics to identify anomalous patterns, such as unauthorized data staging or unusual outbound traffic, which often precede the sale of access.
Law firm Wiley Rein hit with class action over data breach tied to Chinese hackers - Thomson Reuters

This precis outlines the details of the class-action lawsuit filed against the law firm Wiley Rein regarding a significant data breach.

### **What Happened**
Wiley Rein, a prominent U.S. law firm, is facing a proposed class-action lawsuit alleging that it failed to adequately protect sensitive personal data from hackers believed to be affiliated with the Chinese government 【1】. The breach involved unauthorized access to Microsoft 365 email accounts belonging to firm personnel, which persisted for nearly a year—from July 2024 to June 2025—before the firm detected the intrusion 【1】. Notification to victims did not commence until March 6, 2026 【1】.

### **Who Is Affected**
The breach impacts individuals whose sensitive information was held by the firm, often without their direct knowledge or relationship with Wiley Rein. The named plaintiff, for example, stated he was unaware of how the firm obtained his data, though he believes it was acquired through the firm's representation of a client 【1】. The stolen data includes:
* Names and addresses
* Dates of birth
* Financial account numbers
* Medical information
* Full or partial Social Security numbers 【1】

### **Security Implications**
This incident highlights the heightened risk profile of law firms, which are increasingly targeted by sophisticated state-linked and criminal actors due to the vast, sensitive troves of client data they maintain 【1】. The extended dwell time—nearly 12 months—demonstrates a critical failure in detection capabilities, allowing attackers prolonged access to sensitive communications and data.

### **Technical Details**
The lawsuit alleges that the initial entry point for the attackers was a phishing email 【1】. Furthermore, the complaint contends that the firm failed to implement fundamental cybersecurity safeguards, specifically citing the absence of multi-factor authentication (MFA) and inadequate staff training as primary contributing factors to the success of the breach 【1】.

### **What Defenders Should Know**
* **Prioritize Identity Security:** The reliance on phishing to compromise email accounts underscores the necessity of robust MFA, ideally using phishing-resistant methods (such as FIDO2/WebAuthn), rather than relying solely on legacy or easily bypassed MFA.
* **Enhance Detection & Response:** The long dwell time indicates a need for improved monitoring of cloud environments (like Microsoft 365) to detect anomalous login patterns, unauthorized mailbox access, or data exfiltration attempts in real-time.
* **Address Third-Party Data Risks:** Organizations must be aware of the data they ingest from clients and ensure that this "indirectly held" data is subject to the same rigorous security controls as internal data.
* **Continuous Training:** Human-centric defenses remain critical; regular, high-quality security awareness training is essential to help staff identify and report sophisticated phishing attempts.
Gezamenlijke actie politie en NCSC legt groot botnetwerk plat | Joint police and NCSC NL operation shuts down large bot network - Nationaal Cyber Security Centrum

Following a successful collaboration between the Dutch police and the National Cyber Security Centre (NCSC), a massive botnet infrastructure has been dismantled 【1】.

### What Happened
A security researcher alerted the NCSC to a malicious network, prompting a joint investigation with the police 【1】. The investigation revealed that the botnet's command-and-control infrastructure was hosted on 200 servers located in the Netherlands 【1】. Authorities subsequently seized these servers, and the hosting provider took the infrastructure offline due to its use for criminal purposes 【1】.

### Who Is Affected
The botnet comprised at least 17 million infected devices globally, including computers, tablets, smartphones, routers, and smart devices (such as security cameras) 【1】. Owners of these devices were likely unaware that their hardware had been compromised and was being used for illicit activities 【1】.

### Security Implications
Botnets allow criminals to remotely control vast numbers of devices to conduct large-scale illegal operations 【1】. The primary threats posed by this network included:
* **Cyberattacks:** Launching coordinated attacks against targets 【1】.
* **Fraud and Spam:** Facilitating online fraud and the distribution of phishing emails and spam 【1】.
* **Disruption:** Overwhelming websites with massive amounts of traffic to cause outages 【1】.

### Technical Details
Devices become part of a botnet when they are accessible to malicious actors, typically through vulnerabilities that allow the installation of malware 【1】. Once infected, these devices can be remotely commanded by the botnet's infrastructure—in this case, the 200 servers identified in the Netherlands—to perform tasks without the owner's knowledge 【1】.

### What Defenders Should Know
To protect devices from being recruited into such networks, the NCSC recommends the following defensive measures:
* **Patch Management:** Keep operating systems, routers, and applications updated to address known vulnerabilities 【1】.
* **Visibility:** Maintain awareness of all "edge devices" (smart/connected devices) present on your network 【1】.
* **Access Control:** Use strong, unique passwords and enable multi-factor authentication (MFA) wherever possible 【1】.
* **Secure Configuration:** Change default passwords on routers and smart devices immediately, and secure Wi-Fi networks using WPA2 or WPA3 【1】.
* **Safe Practices:** Only install software from trusted sources and avoid clicking suspicious links or attachments 【1】.
* **Monitoring:** Use antivirus or security software and regularly audit which devices are connected to your network 【1】.
Casdoor contains multiple authentication bypass and access management vulnerabilities - Carnegie Mellon University

This precis outlines the critical identity and access management vulnerabilities identified in Casdoor versions 2.362.0 and earlier, as documented by CERT/CC 【1】.

### Overview
Casdoor versions 2.362.0 and earlier are affected by a series of severe vulnerabilities (CVE-2026-9090 through CVE-2026-9098) that enable broad authentication bypass, account takeover, and privilege escalation 【1】. These flaws stem from fundamental weaknesses in how the platform processes SAML assertions, manages account bindings, and handles token exchanges 【1】.

### Affected Parties
Users and organizations deploying Casdoor versions 2.362.0 and earlier are affected 【1】.

### Security Implications
Exploitation of these vulnerabilities allows attackers to impersonate arbitrary users—including administrators—bypass multifactor authentication (MFA), and achieve persistent unauthorized access 【1】. Furthermore, the flaws enable cross-organizational privilege escalation and prevent administrators from reliably revoking compromised tokens or terminating active sessions 【1】.

### Technical Details
The vulnerabilities are categorized by their impact on authentication, account security, and token management:

| Category | CVEs | Technical Root Cause |
| :--- | :--- | :--- |
| **SAML Processing** | 9090, 9093, 9095, 9096, 9098 | Improper validation of signing certificates, audience restrictions, time bounds, and lack of replay protection or correlation to `AuthnRequests` 【1】. |
| **MFA & Binding** | 9091, 9092 | Logic flaws in social-login flows that bypass MFA checks and account takeover risks due to unverified email claims 【1】. |
| **Token Management** | 9094, 9097 | Failure to verify user-organization membership during token exchange and absence of token revocation checks 【1】. |

### Guidance for Defenders
As of the report date, no patch is available from the Casdoor team 【1】. Defenders are advised to take the following mitigating actions:
* **Restrict Identity Providers:** Limit the use of Identity Providers (IdPs) strictly to those that are trusted 【1】.
* **Reinforce High-Privilege Accounts:** Implement additional, downstream MFA for high-privilege accounts to mitigate the risk of authentication bypass 【1】.
* **Monitor Activity:** Closely monitor logs for unusual SAML assertion or token exchange activity 【1】.
* **Governance:** Implement stricter identity governance controls and utilize external validation tools to enforce application boundaries 【1】.
The approval prompt is lying: a critical coding agent security flaw - A symlink-hijack RCE in six AI coding agents - Adversa AI

The article details "SymJack," an architectural vulnerability affecting major AI coding agents that allows attackers to achieve Remote Code Execution (RCE) by exploiting the human-in-the-loop approval process 【1】【1】.

### What Happened
Attackers can booby-trap a code repository with a malicious instruction file (e.g., `CLAUDE.md`) and a symbolic link (symlink) 【1】【1】. When an AI agent processes the repository, it follows the instructions to perform a seemingly benign file operation (like copying a media file). Because the destination is a symlink pointing to the agent's own configuration files, the agent unknowingly overwrites its own settings with a malicious payload, leading to RCE upon the next restart 【1】【1】.

### Who Is Affected
The vulnerability is architectural and affects multiple AI coding assistants, including:
* Claude Code
* Gemini CLI / Antigravity CLI
* Cursor Agent CLI
* GitHub Copilot CLI
* Grok Build
* OpenAI Codex CLI 【1】

### Security Implications
* **Bypassing Human Approval:** The primary security control—human approval—is defeated because the approval prompt inspects the command text rather than the actual filesystem effect 【1】【1】.
* **CI/CD Risks:** In CI environments, where agents often run in non-interactive modes with auto-approval, the attack can execute without any human intervention, potentially exposing sensitive credentials, signing materials, and cloud tokens 【1】.

### Technical Details
The attack relies on three components:
1. **Trusted Instructions:** The agent reads project-specific instruction files (e.g., `CLAUDE.md`) and treats them as trusted guidance 【1】.
2. **Disguised Writes:** By using raw shell commands (like `cp`) instead of native file-writing tools, the agent bypasses internal guardrails that would otherwise flag sensitive paths 【1】.
3. **Symlink Redirection:** The destination of the copy is a symlink pointing to the agent's configuration. The kernel follows this link, writing the attacker's payload (a malicious MCP server definition) into the configuration file 【1】.

### What Defenders Should Know
* **Remediation:** Agents must resolve symlinks to their canonical targets before any permission decision and treat shell file operations as first-class writes 【1】.
* **Monitoring:** Defenders should alert on processes where an AI agent writes to configuration directories or MCP files and subsequently launches an interpreter 【1】.
* **Incident Response:** Any host that has run an AI coding agent against an untrusted repository should be treated as compromised; rotate all reachable credentials, SSH keys, and cloud tokens immediately 【1】.
FROST: Fingerprinting Remotely using OPFS-based SSD Timing - Hannes Weissteiner

The article "FROST: Fingerprinting Remotely using OPFS-based SSD Timing" details a novel remote side-channel attack that exploits the **Origin Private File System (OPFS)** API in web browsers to monitor user activity without requiring native code execution or user interaction.

### What Happened
Researchers developed **FROST** (Fingerprinting Remotely using OPFS-based SSD Timing), a drive-by attack that allows a malicious website to monitor a victim's system activity by measuring SSD contention. By creating a large file within the browser's sandboxed OPFS, the attacker bypasses the operating system's page cache, forcing the OS to perform actual disk I/O. The attacker then measures the latency of these I/O operations to infer system-level activity.

### Who Is Affected
* **Users:** Anyone browsing the web using modern browsers (Chrome, Firefox, Safari) that support the OPFS API.
* **Systems:** Both Linux and macOS systems were confirmed to be vulnerable. The attack is particularly effective on consumer devices that typically use a single internal SSD.

### Security Implications
* **Privacy Leakage:** The attack can accurately fingerprint which websites a user visits and which applications they launch.
* **Covert Channels:** It can be used to establish a covert channel for data exfiltration, achieving capacities of ~661 bit/s on Linux and ~891 bit/s on macOS.
* **Sandbox Bypass:** Unlike many sophisticated attacks, FROST does not require bypassing browser sandbox protections or exploiting vulnerabilities; it exploits legitimate, intended browser functionality.

### Technical Details
* **Mechanism:** The attack exploits SSD contention—the measurable latency difference in I/O operations caused by other processes accessing the same disk.
* **OPFS Exploitation:** OPFS provides a sandboxed, origin-scoped file system that does not require user permission to access. By creating a file larger than the system's available memory, the attacker effectively evades the OS page cache, ensuring that I/O operations hit the physical SSD.
* **Measurement:** Attackers use high-resolution timers (enabled via strict Cross-Origin Opener/Embedder Policies) to measure the latency of random 4 kB reads.
* **Classification:** A Convolutional Neural Network (CNN) is trained on these latency traces to classify and identify specific user activities (e.g., launching an app or visiting a specific website).

### What Defenders Should Know
* **Mitigation Challenges:** Defending against FROST is difficult because it relies on standard, legitimate browser features.
* **Potential Defenses:**
* **Storage Limits:** Restricting the maximum size of OPFS files (e.g., to 1 GB) could prevent the page cache evasion necessary for the attack.
* **User Permissions:** Requiring explicit user permission before allowing a website to use the OPFS could mitigate the threat, though it may negatively impact the usability of web applications.
* **Monitoring:** Browsers could implement tracking to notify users when large amounts of data are saved to the OPFS across multiple origins in a short time.
* **Responsible Disclosure:** The authors disclosed these findings to Google, Mozilla, and Apple. As of the paper's publication, vendors generally did not consider fingerprinting a security vulnerability or had not yet implemented mitigations.
Inside a 176-Package npm Campaign Built to Beat Your Internal Dependencies - Sonatype

This precis outlines the findings from Sonatype’s investigation into a malicious npm package campaign designed to exploit internal dependency resolution processes 【1】.

### What Happened
Researchers uncovered a coordinated campaign involving 176 malicious npm packages 【1】. Many of these packages were published with the version number `99.99.99` to ensure they would be prioritized by package managers over legitimate, lower-versioned internal dependencies 【1】.

### Who Is Affected
Organizations that use internal or private npm packages are the primary targets of this campaign 【1】. Any developer or CI/CD environment that inadvertently installed these packages is considered potentially compromised 【1】.

### Technical Details
* **Dependency Confusion:** Attackers deduce the names of an organization's internal packages and publish similarly named packages to the public npm registry with high version numbers to win the "resolution race" 【1】.
* **Execution:** The packages contain embedded `postinstall` scripts that execute automatically as soon as the package is installed 【1】.
* **Data Exfiltration:** Once executed, the malware attempts to collect and exfiltrate sensitive information, including usernames, hostnames, OS/architecture details, environment variables, CI/CD secrets, and authentication tokens 【1】.

### Security Implications
The campaign highlights the inherent risks in the implicit trust developers place in package authors, dependency chains, and install scripts 【1】. Because the malware executes automatically upon installation, it can compromise a host before a developer is even aware of the malicious dependency 【1】. Simply removing the malicious dependency is insufficient, as the host may already be compromised 【1】.

### What Defenders Should Know
If an organization determines that these packages were installed, they should take the following actions 【1】:

| Action | Description |
| :--- | :--- |
| **Identify & Audit** | Locate all systems where the packages were installed and audit for secondary payload persistence 【1】. |
| **Rotate Credentials** | Immediately rotate all exposed credentials, tokens, CI/CD secrets, and environment variables 【1】. |
| **Investigate** | Analyze outbound network connections from affected hosts for signs of exfiltration 【1】. |
| **Prevent Future Attacks** | Verify internal package namespace protections and reconfirm npm registry resolution order and scope configurations 【1】. |
Why I Built My Own LLM Benchmark for THOR Finding Triage - Florian Roth

The provided summary accurately captures the essence of the article regarding Florian Roth's development of a specialized LLM benchmark for triaging THOR forensic scanner findings.

To ensure you have the complete picture, here is a synthesis of the key takeaways for security professionals:

### Strategic Context
The fundamental problem identified is that general-purpose LLM benchmarks (like MMLU or GSM8K) fail to measure the specific, high-stakes decision-making required in a Security Operations Center (SOC). By building a domain-specific benchmark, the author shifts the focus from general "reasoning" to **operational utility**—specifically, the ability to correctly classify security alerts without the crutch of external tools or RAG (Retrieval-Augmented Generation) 【1】.

### Key Operational Metrics
Defenders should note that the benchmark evaluates models using a custom scoring system that prioritizes the **asymmetric consequences** of triage errors:
* **Critical Miss Rate:** The percentage of True Positives (actual threats) misclassified as False Positives. This is the most dangerous failure mode, as it leads to security blind spots.
* **Threat Capture Rate:** The percentage of actual threats correctly identified.
* **False Review Load:** The percentage of False Positives labeled as True Positives, which directly impacts analyst burnout and alert fatigue.

### Guidance for Defenders
* **Risk-Based Selection:** Organizations must define their own risk tolerance. A model that is conservative (minimizing critical misses) will inevitably increase the "False Review Load," requiring more human intervention. Conversely, a model optimized for efficiency may miss subtle threats.
* **Operational Baseline:** This benchmark serves as a "map" to filter out models that are fundamentally incapable of the task, but it is not a substitute for testing with your organization's specific forensic data and environment.
* **Data Integrity:** To maintain the validity of the benchmark, the author has intentionally kept the raw test data private. This prevents "benchmark contamination," where models might be trained on the test set, leading to artificially inflated performance scores.

### Resources
For those looking to implement or review these findings, the following resources are maintained by Nextron Labs:
* **Benchmark Results:** [THOR Findings Triage Benchmarks](https://nextron-labs.github.io/thor-ai-benchmarks/)
* **Technical Implementation:** [Benchmark GitHub Repository](https://github.com/Nextron-Labs/thor-ai-benchmarks)