🛡️ InfoSec Blue Team Briefing

📰 Articles Covered

• PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems - Socket 🔍 Show Kagi Synopsis
  The "PolinRider" campaign, attributed to North Korean threat actors associated with the "Contagious Interview" or "Famous Chollima" cluster, represents a sophisticated expansion of supply chain attacks targeting open-source ecosystems.
  
  ### **What Happened**
  Threat actors are compromising the accounts of legitimate maintainers to inject malicious code into trusted packages. This campaign is widespread, having identified 162 malicious artifacts across 108 distinct packages. Attackers employ deceptive tactics such as rewriting Git history—using force pushes and backdated commits—to make these malicious modifications appear as mundane, older maintenance tasks, effectively bypassing casual security scrutiny.
  
  ### **Who Is Affected**
  The campaign impacts developers and organizations consuming dependencies from multiple major ecosystems:
  * **npm** (Node.js)
  * **Packagist** (PHP)
  * **Go modules** (Golang)
  * **Chrome extensions**
  
  ### **Technical Details**
  * **Infection & Obfuscation:** Malicious scripts are often hidden via whitespace obfuscation or embedded within seemingly benign files, such as `.woff2` font files.
  * **Execution Vector:** Attackers abuse development environment configurations, specifically VS Code task files (`.vscode/tasks.json`). By configuring these tasks to run automatically upon folder opening, they trigger the malicious code without explicit user action.
  * **Second-Stage Payloads:** The initial loader fetches encrypted second-stage payloads—examples include `DEV#POPPER` and `OmniStealer`—from public blockchain and RPC infrastructure (e.g., TRON, Aptos, BNB Smart Chain). The payload is then decrypted and executed using `eval()`.
  
  ### **Security Implications**
  Because this campaign targets developer environments, it poses a severe risk to the entire software development lifecycle. Compromised machines provide attackers with access to source code, internal repositories, CI/CD pipelines, and cloud credentials. Once established, these access points can be leveraged for data exfiltration, theft of browser/wallet data, and further lateral movement.
  
  ### **Advice for Defenders**
  * **Detection & Auditing:** Do not rely solely on commit history, as it may be falsified. Instead, audit repository activity logs for suspicious force pushes or unauthorized modifications to configuration files (e.g., `vite.config.js`, `config.js`) and task definitions.
  * **Endpoint Hardening:** Scan developer workstations for VS Code tasks containing `"runOn": "folderOpen"` that execute non-standard or suspicious files using `node`.
  * **Incident Response:** If exposure is suspected:
  * Perform remediation from a known-clean machine.
  * Rebuild environments using trusted, known-good lockfiles.
  * Immediately rotate all exposed secrets, including CI/CD tokens, cloud keys, and SSH credentials.
  * Preserve forensic artifacts before wiping compromised systems.
• Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool - Recorded Future 🔍 Show Kagi Synopsis
  This précis details recent findings from Recorded Future’s Insikt Group regarding the threat cluster designated **TAG-182** and its deployment of **MarkiRAT** malware.
  
  ### Executive Summary
  TAG-182 is an actor actively supporting Iranian government digital surveillance and intelligence-gathering operations. Following the stabilization of tensions in early 2026 and the restoration of Iranian internet access, the group has intensified efforts to identify and monitor perceived dissidents and anti-government networks, both within and outside of Iran.
  
  ### Who Is Affected
  * **Targets:** Primarily Iranian civilians, perceived dissidents, and those deemed "foreign collaborators."
  * **Methodology:** The group utilizes social media platforms (e.g., Instagram) to distribute deceptive lures, including fake VPN applications and "free" software download tools, to infect victims' devices.
  
  ### Security Implications
  TAG-182 is considered part of a wider ecosystem of pro-Iranian cyber-surveillance groups (including *GreenEcho*, *Ferocious Kitten*, and *Rampant Kitten*). These groups provide technical support to Iranian state entities—such as the IRGC, the Basij, and the Iranian Cyber Police (FATA)—to suppress dissent and maintain domestic control. The ongoing nature of these operations suggests a sustained, high-priority commitment by the Iranian security apparatus to digital surveillance.
  
  ### Technical Details
  MarkiRAT is a backdoor used to facilitate these surveillance activities. Key technical observations include:
  * **Infection & Staging:** Initial access typically involves downloading an archive (e.g., `YEPlayer.rar`) from malicious infrastructure. The malware exhibits deliberate staging behavior, continuing to deliver payloads even when the delivery page returns an error.
  * **Beaconing:** The malware initiates communication via `POST` requests, often using `multipart/form-data` to transmit data to malicious command-and-control (C2) domains.
  * **Persistence & Evasion:**
  * It may drop an `svehost.exe` file (masquerading as `svchost.exe`) into `AppData\Windows`.
  * It uses `attrib -h` to unhide files, simplifying manipulation for the operator.
  * It executes `taskkill /im svehost.exe /t /f` to terminate existing instances, allowing the operator to replace, update, or delete the malware.
  * **Capabilities:** The malware includes functionality for capturing and exfiltrating screenshots (`CaptureAndSendScreenshotAsync`).
  
  ### What Defenders Should Know
  Defenders should be aware of the following indicators and defensive strategies:
  * **Threat Infrastructure:** The actor makes extensive use of lookalike domains, often mimicking Google, Microsoft, Facebook, and Instagram login pages or service portals, as well as domains related to VPN and tool downloads.
  * **Detection:**
  * **YARA:** A YARA rule (`APT_IR_TAG182_MarkiRAT_2`) is available to identify the MarkiRAT backdoor by searching for specific strings, such as screenshot capture functions and directory paths (`C:\Users\Public`).
  * **SIGMA:** A SIGMA rule is provided to detect the use of `bitsadmin` by the malware to facilitate file downloads from known C2 paths (e.g., `/i.php?u=` or `/uploadx.php?u=`).
  * **Proactive Monitoring:** Organizations and security teams should monitor for the Indicators of Compromise (IoCs) provided in the source report, specifically the identified malicious domains, IP addresses, and file hashes, to mitigate the risk of compromise.
• Kibana 7.17.15, 8.11.1 Security Update (ESA-2026-53) - Improper Output Neutralization for Logs in Kibana can lead to log injection via Log Injection-Tampering-Forging - Elastic 🔍 Show Kagi Synopsis
  This security update addresses a vulnerability in Kibana regarding improper log output neutralization. Below is a detailed breakdown based on the advisory.
  
  ### **What Happened**
  Elastic has issued a security advisory (ESA-2026-53) regarding a log injection vulnerability (CVE-2026-49091) in Kibana. This issue stems from improper output neutralization, where specially crafted input supplied by an attacker is written directly to log files without being neutralized.
  
  ### **Who is Affected**
  * **7.x Versions:** All versions up to and including 7.17.14.
  * **8.x Versions:** All versions from 8.0.0 up to and including 8.11.0.
  * **Configurations:** All configurations are affected.
  * **Status for Elastic Cloud Serverless:** This vulnerability was already remediated in the Elastic Cloud Serverless offering prior to the public disclosure.
  
  ### **Security Implications**
  The vulnerability is classified as **High** severity, with a CVSSv3.1 score of **8.0**. By injecting malicious control sequences into logs, an attacker can leverage this flaw to alter the displayed log data when the logs are viewed in a terminal that interprets these control sequences. This falls under the category of Log Injection-Tampering-Forging (CAPEC-93).
  
  ### **Technical Details**
  * **Vulnerability Type:** Improper Output Neutralization for Logs (CWE-117).
  * **CVSS Vector:** `CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H`
  * This indicates the attack is network-exploitable, requires a low level of privileges, user interaction, and involves a scope change with high impacts on confidentiality, integrity, and availability.
  
  ### **What Defenders Should Know**
  * **Remediation:** The primary solution is to upgrade to **Kibana version 7.17.15 or 8.11.1**.
  * **Workarounds (if upgrade is not possible):**
  * **Self-Managed:** Restrict the viewing of Kibana log files exclusively to tools that do not interpret terminal control or escape sequences.
  * **Elastic Cloud:** The same guidance regarding the use of safe log-viewing tools applies.
  * **Detection:** Defenders should inspect their log files for the presence of unexpected terminal control or escape sequences, which serve as indicators of compromise (IOCs) for this activity.
  
  【1】
• skewrun: Active Directory time discovery protocols for red teams. Stealthy extraction via Kerberos, SMB, NTLM, and CLDAP. - JVBotelho 🔍 Show Kagi Synopsis
  Thank you for the detailed precis. The information provided outlines a sophisticated approach for attackers to maintain synchronization with target environments.
  
  If you have specific questions about these security concepts or need further analysis of the methods described in the Skewrun toolkit, please let me know.
• Don’t pay the ransom: Warning to organisations to protect themselves from ransomware attacks as more than 320 businesses affected last year - City of London Police 🔍 Show Kagi Synopsis
  The City of London Police issued a formal warning in late June 2026, urging organizations to prioritize robust cybersecurity measures and avoid paying ransom demands following a significant surge in attacks 【1】【2】.
  
  ### Overview of the Situation
  The advisory was released in response to data indicating that over 320 businesses in the region fell victim to ransomware attacks during the previous year 【1】. The primary objective of the warning is to disrupt the ransomware ecosystem by discouraging the payment of ransoms, which police emphasize only fuels further criminal activity and provides no guarantee that data will be recovered or kept private 【1】.
  
  ### Summary of Key Findings
  
  | Category | Details |
  | :--- | :--- |
  | **Who is Affected** | Primarily businesses across various sectors, with over 320 reported incidents in the last year. |
  | **Security Implications** | Operational paralysis, severe data loss, potential exposure of sensitive or proprietary information, and significant financial and reputational damage. |
  | **Why Pay is Discouraged** | Payments incentivize attackers to continue targeting victims, fund future criminal operations, and do not ensure the decryption or secure deletion of stolen data. |
  | **Key Defender Advice** | Focus on proactive prevention, such as maintaining offline backups, rigorous patch management, and robust incident response planning. |
  
  ### Technical and Defensive Insights
  While specific technical indicators for the recent wave were not detailed in the summary of the advisory, the City of London Police consistently emphasizes industry-standard best practices for ransomware resilience. Defenders are encouraged to:
  
  * **Implement Offline Backups:** Ensure critical data is backed up to secure, immutable, or off-network storage that cannot be encrypted by ransomware if the main network is compromised.
  * **Incident Response Planning:** Organizations should have a clearly defined, tested plan for responding to a breach, including pre-established communication channels with law enforcement.
  * **Vulnerability Management:** Regularly patch software and hardware to close common entry vectors used by ransomware actors.
  * **Access Controls:** Apply the principle of least privilege to limit the scope of potential infections.
  * **Reporting:** Victims are urged to report incidents immediately to relevant authorities to aid in tracking trends and developing coordinated defensive strategies.