InfoSec Briefing - July 06, 2026

🎧 Audio Briefing

Playback Speed:

Cyber security developments for Monday the 6th of July 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 21 articles to cover. All attribution is by the article authors. All article analysis is automated.

GreyNoise reports that CitrixBleed 2 exploitation began on June 23rd, a full two weeks before the public proof-of-concept was released. Targeting appears focused rather than mass scanning, with traffic originating from IP addresses geolocated in China, and the vulnerability has now been added to CISA's Known Exploited catalogue.

Kaspersky describe The Gentlemen, a ransomware-as-a-service operation that emerged earlier this year and has already broken into the top ten, targeting manufacturing, healthcare, and financial services across Brazil, China, Indonesia, Taiwan, and Thailand. The group deploys both Go-based and C-based ransomware variants using bring-your-own-driver techniques and exploits VPN and firewall appliances for initial access.

Expel published analysis of a zero-day exploit used by The Gentlemen in April this year, which relied on a vulnerable Kontron driver to disable multiple EDR solutions including Windows Defender, ESET, Palo Alto Cortex, and SentinelOne. The attack chains kernel-mode operations and bypasses modern mitigations by manipulating physical memory and hijacking kernel function pointers before deploying ransomware.

Staying with The Gentlemen briefly, Sigreturn Labs published details of a cryptographic flaw in Rhysida ransomware that allowed them to break the encryption entirely. The vulnerability stems from predictable random number generation seeded by system timestamps, and a decryption tool has been developed that works across sixteen versions of the ransomware, which has been active since May 2023.

Arctic Wolf have written up attacks by the Anubis ransomware operation, which targets high-value infrastructure through CitrixBleed 2 and stolen VPN credentials. The group uses legitimate remote management tools like ScreenConnect and Zoho Assist alongside cloudflared tunnels to evade detection whilst exfiltrating data before encryption.

Kaspersky have identified a previously unknown APT group they're calling Armored Likho, also known as Eagle Werewolf, which is conducting targeted phishing campaigns against government agencies and electric power sectors in Russia, Kazakhstan, and Brazil. The group deploys BusySnake, a new Python-based infostealer with AI-generated loaders, featuring credential theft, remote command execution, and reverse SSH tunneling with persistence via scheduled tasks.

S2 Grupo published a profile of Russian military unit 67606, the 127th Separate Reconnaissance Brigade, which is a combat-focused unit with organic psychological operations capabilities for the Black Sea Fleet. The unit employs drones and GSM-based electronic warfare tools to conduct traffic interception, communications jamming, and mass SMS delivery for information operations in the Black Sea theatre.

WatchGuard disclosed a critical race condition in Fireware OS that allows remote, unauthenticated attackers to execute arbitrary code via the LDAP authentication mechanism in Mobile VPN with IKEv2. The use-after-free flaw carries a severity score of 9.2 and affects multiple OS versions, with patches now available for most devices though T15 and T35 models running version 12.5 remain unresolved.

A researcher disclosed a high-severity stored cross-site scripting vulnerability in NEX-Forms Express WP Form Builder affecting versions up to 9.1.10. The flaw allows remote attackers to inject malicious JavaScript through public form submissions that executes in administrator contexts when viewing entries, due to insufficient input sanitisation on AJAX endpoints.

A researcher has written up Bad Epoll, a critical use-after-free vulnerability in the Linux kernel's epoll subsystem affecting version 6.4 and newer. The race condition enables highly reliable local privilege escalation to root with 99 percent exploit reliability, and is particularly significant for Android devices and Chrome sandbox escapes, though it was patched in April.

Malwarebytes report on a campaign distributing multiple malware families including HijackLoader, StealC, Remus, and Amatera Stealer through fake Google and Cloudflare verification pages. Victims are tricked into copying and executing malicious PowerShell commands that deploy sophisticated loaders using bring-your-own-driver techniques, with the campaign leveraging compromised websites and Cloudflare Pages infrastructure for payload delivery.

K7 Labs describe a Business Email Compromise campaign that impersonates senior executives to deliver malicious archives containing DLL sideloading payloads. The malware establishes persistence and specifically targets active WhatsApp Web sessions in Chromium-based browsers to facilitate session hijacking and organisational compromise.

Jamf published analysis of PamStealer, a macOS infostealer targeting Apple silicon systems by masquerading as the legitimate Maccy clipboard manager application. The malware uses AppleScript and JXA to steal credentials, browser data, wallet extensions, and clipboard content whilst establishing persistence via C2 infrastructure including Ethereum endpoints, and notably excludes users from Russia, Belarus, and Kazakhstan.

Brian Krebs reports that the FBI and IRS Criminal Investigation have seized the NetNut residential proxy service and dismantled the Popa botnet, which compromised at least two million IoT devices including Android TV boxes and smart televisions. The infrastructure was used by cybercriminals and state-sponsored groups for credential stuffing, account takeovers, advertising fraud, and DDoS attacks by routing malicious traffic through residential IP addresses.

Alex Teixeira highlights a critical blind spot where attackers compromise Microsoft Sentinel infrastructure itself to evade detection before executing broader attacks. The article provides detection engineering guidance using Sentinel's internal telemetry sources and KQL functions to monitor for tampering with detection rules, connectors, and workspace configurations, which is particularly relevant if you're running Sentinel as your primary logging platform.

Praetorian developed Knossos, an automated procedural engine that generates realistic decoy cloud infrastructure environments designed to mirror production systems. These fake environments serve as deception technology to confuse and detect threat actors by creating convincing but non-production targets.

The National Cyber Security Centre consulted professional penetration testers to identify defensive measures that significantly impede attackers targeting Critical National Infrastructure and Operational Technology environments. Key recommendations include secure-by-design principles, rigorous network segmentation between IT and OT systems, implementing clear zones of trust, and deploying Privileged Access Workstations to prevent lateral movement.

Bishop Fox researchers developed an AI-assisted pipeline to fingerprint internet-exposed software using favicon files and hash functions. This passive reconnaissance technique enables large-scale enumeration of software installations and infrastructure attribution without triggering traditional security alerts, allowing attackers and defenders alike to map global technology stacks by analysing static assets.

Security researchers released OpenUDC2, an open-source implementation of Cobalt Strike's User Defined Channel 2 protocol, enabling non-commercial C2 frameworks to use UDC2 modules. The proof-of-concept includes a modified beacon agent and listener but lacks strong encryption, and is intended for penetration testing and security research.

And finally, a researcher published tf-mythic-azure, which provides Terraform templates that automate the deployment of Mythic C2 infrastructure within Microsoft Azure environments. The tool enables red team operators to rapidly stand up multiple Mythic server instances with Azure CDN redirectors using Infrastructure as Code principles, which represents an evolution in adversary infrastructure deployment automation that defenders will need to monitor for in cloud environments.

That concludes today's briefing.

📰 Articles Covered

Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public - GreyNoise, Inc.

The following is a detailed précis of the exploitation activity surrounding CVE-2025-5777, often referred to as "CitrixBleed 2."

### What Happened
Active, targeted exploitation of CVE-2025-5777 began on June 23, 2026—approximately two weeks prior to the release of a public proof-of-concept (PoC) on July 4, 2026 【1】. GreyNoise observed that these early exploitation attempts were not indiscriminate; instead, they specifically targeted sensors configured to emulate Citrix NetScaler appliances, indicating a deliberate and focused campaign 【1】. Following the publication of detection tags and confirmation of activity with CISA, the vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) catalog 【1】.

### Who is Affected
Organizations utilizing **Citrix NetScaler** appliances are affected by this vulnerability. Early malicious activity originated from IP addresses geolocated in China 【1】.

### Technical Details & Security Implications
CVE-2025-5777 is classified as a **memory overread vulnerability** within Citrix NetScaler 【1】. Such vulnerabilities typically allow unauthorized actors to read sensitive data stored in the memory of the affected appliance, which could lead to credential theft or the exposure of session information. The fact that sophisticated threat actors exploited this flaw well before a public PoC was available highlights a significant risk for organizations that rely on early vendor patching or public exploit releases to prioritize security updates.

### What Defenders Should Know
* **Active Exploitation:** The vulnerability is currently being exploited in the wild and is listed in the CISA KEV catalog 【1】.
* **Targeted Nature:** Adversaries are actively identifying and targeting NetScaler instances, rather than engaging in mass "spray and pray" attacks 【1】.
* **Mitigation:** Defenders should prioritize patching and can use dynamic IP blocklists to suppress alerts and reduce exposure to known malicious infrastructure associated with this campaign 【1】.
The Gentlemen RaaS: rapid growth and a new ransomware variant - AO Kaspersky Lab

The "The Gentlemen" group has rapidly established itself as a significant Ransomware-as-a-Service (RaaS) threat since its emergence in early 2026. By mid-2026, the group had ascended to the top 10 most active ransomware actors, focusing their attacks on major corporations and critical infrastructure.

### What Happened
The group has operationalized a RaaS model, rapidly scaling their capabilities to conduct high-impact, multi-stage ransomware attacks. They are characterized by their agility, evidenced by the active development and deployment of multiple custom malware variants to bypass defenses and ensure successful encryption.

### Who Is Affected
The Gentlemen pursue a broad victimology across several key industries and geographic regions:
* **Industries:** Manufacturing, IT services, healthcare, construction, logistics, and financial services.
* **Target Regions:** Significant activity has been observed in Brazil, China, Indonesia, Taiwan, and Thailand.

### Technical Details
The group utilizes a sophisticated, evolving toolkit designed for persistence, evasion, and effective encryption:

* **Initial Access & Reconnaissance:** They frequently exploit vulnerabilities in internet-facing infrastructure—specifically VPNs and firewalls—or leverage weak credentials. Once inside, they perform reconnaissance using legitimate network tools like **NetScan**, **Advanced IP Scanner**, **SharpADWS**, and `netsh` for packet capture.
* **Lateral Movement & Persistence:** Deployment is often achieved via `PsExec` or custom PowerShell scripts (`deploy_gpo.ps1`) to distribute ransomware across the network via Group Policy Objects (GPO).
* **Security Evasion:** The attackers employ **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable security software, complemented by tools like **Windows Kernel Explorer** and **OpenArk64**, alongside manual registry manipulation.
* **Ransomware Implants:**
* **Go-based Ransomware:** The primary, most widespread variant. It includes custom obfuscation, anti-sandbox checks, and uses hybrid encryption (Curve25519 and XChaCha20). It uses Tox Messenger for operator communication.
* **C-based Ransomware:** A newer, developing Windows variant that utilizes AES256-GCM and RSA encryption. Unlike the Go version, this variant uses email for communication with the operators.
* **Backdoor:** A Go-based backdoor is used for remote command execution, data exfiltration, and establishing SOCKS proxies to the Command and Control (C2) server.

### Security Implications
The Gentlemen represent a persistent threat due to their operational maturity and technical adaptability. Their willingness to develop custom, platform-specific ransomware and their sophisticated approach to disabling security controls (BYOVD) indicate a high level of technical competency. Their documented growth suggests these campaigns are expected to persist, posing a continued threat to corporate security.

### What Defenders Should Know
To mitigate the risks posed by this group, defenders should focus on the following priorities:
* **Hardening & Patching:** Prioritize the patching of internet-facing hardware, particularly VPNs and firewalls, to close the primary initial access vector.
* **Detection & Monitoring:** Implement rigorous monitoring for the suspicious use of administrative and system tools, specifically PowerShell, `netsh`, and `PsExec`.
* **Driver Control:** Implement strict policies to restrict or block the loading of known vulnerable drivers to thwart BYOVD attacks.
* **Threat Intelligence:** Defenders are encouraged to utilize updated Indicators of Compromise (IoCs) and threat reporting, such as those provided by the Kaspersky Intelligence Reporting Service, to maintain awareness of the group's evolving infrastructure and tactics.
How I broke Rhysida ransomware encryption - Sigreturn Labs

The article provides an insightful technical analysis of the **Rhysida ransomware**, specifically highlighting a significant cryptographic vulnerability identified by the author shortly after the group's emergence in May 2023.

### What Happened
The author discovered that Rhysida ransomware suffered from a fundamental flaw in its random number generation (RNG) process. By utilizing a predictable system timestamp (`time(0)`) as the seed for its RNG, the ransomware generated encryption keys that could be reconstructed. The author successfully developed a decryption utility capable of bypassing the ransomware's encryption across sixteen distinct versions, enabling victim data recovery without paying a ransom.

### Who is Affected
Rhysida is a ransomware-as-a-service (RaaS) operation that has been active since May 2023. The group has primarily targeted organizations within the healthcare, education, and government sectors, with a notable focus on entities in the United States and Europe. The author emphasizes that a PowerShell variant of the ransomware is not susceptible to this specific cryptographic flaw.

### Security Implications
This vulnerability demonstrates the high risk associated with improper cryptographic implementation in malware. While ransomware developers often aim for robust, state-of-the-art encryption, fundamental errors in key management—such as using predictable seeds—can render their entire operation ineffective. However, defenders should be aware that such flaws are often quickly identified and patched by threat actors, making this specific decryption method inapplicable to newer or updated versions of the malware.

### Technical Details
* **RNG Vulnerability:** The ransomware uses `time(0)` to seed `srand`, making the output of `rand()` predictable. This allows an analyst to generate a table of potential keys and initialization vectors (IVs) based on the infection time and the victim's hardware configuration.
* **Encryption Mechanism:** Rhysida utilizes `libtomcrypt` to perform ChaCha20 encryption, generating 32-byte keys and 16-byte IVs for each file. These keys are subsequently encrypted with a hardcoded RSA public key and appended to the end of the encrypted file.
* **Optimization Strategies:** To increase efficiency, the malware uses multi-threading, dedicating one thread per logical processor. Additionally, it employs an "intermittent encryption" strategy for large files, encrypting only the first four blocks of data (up to `0x100000` bytes each) and skipping gaps to expedite the process while ensuring the system remains functional enough to display the ransom note.
* **Operational Constraints:** The malware includes hardcoded lists of excluded directories and file extensions to prevent rendering the operating system unusable.

### What Defenders Should Know
* **Prioritize Free Decryption:** Victims of older Rhysida infections should not pay the ransom. Official decryption tools are available through resources such as [nomoreransom.org](https://www.nomoreransom.org/).
* **Data Requirements for Recovery:** Successfully decrypting files requires the specific strain of the ransomware (needed to extract the RSA public key), an approximate timestamp of the infection, and the number of logical processors present on the victim's machine.
* **Limitations:** This analysis serves as a reminder that cryptographic vulnerabilities are often ephemeral. Defenders should not assume that all Rhysida infections are decryptable, as the group has likely patched this flaw in subsequent iterations. Continuous monitoring and robust backup strategies remain the most effective defenses.
From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks - Arctic Wolf

This precis outlines the threat posed by Anubis, a Ransomware-as-a-Service (RaaS) operation—formerly known as Sphinx—that has been actively targeting high-value infrastructure since early 2026.

### Executive Summary
* **What Happened:** Anubis affiliates are executing a sophisticated ransomware campaign characterized by the weaponization of legitimate administrative tools and the exploitation of critical vulnerabilities to steal data and encrypt systems.
* **Who is Affected:** Organizations relying on high-value infrastructure, specifically those utilizing domain controllers, hypervisors, and Network-Attached Storage (NAS) devices, are the primary targets.
* **Security Implications:** The operation is dangerous because it disguises malicious activity as routine IT administration. By leveraging common RMM tools and legitimate binaries, attackers evade traditional security controls and remain undetected until the final encryption stage.

### Technical Details
Anubis affiliates employ a modular, multi-stage attack pattern:

* **Initial Access:** Attackers gain entry through stolen VPN credentials or by exploiting **CitrixBleed 2 (CVE-2025-5777)**, a pre-authentication memory disclosure vulnerability in NetScaler appliances that allows for session hijacking.
* **Persistence & Movement:** Threat actors deploy a variety of Remote Monitoring and Management (RMM) tools—such as ScreenConnect, Zoho Assist, MeshAgent, and Total Software Deployment—to maintain persistent, interactive control that mimics legitimate administrative activity. They utilize Mimikatz for credential harvesting and RDP/PsExec for lateral movement.
* **Exfiltration & Evasion:** To facilitate data theft while avoiding detection, attackers establish outbound tunnels using `cloudflared` (the Cloudflare Tunnel client). Other methods include the use of authenticated proxies and SSH-based SOCKS tunneling, along with data management utilities like `rclone`, `s5cmd`, and S3 Browser.

### Defensive Guidance
Defenders are advised to adopt a proactive, chain-based detection strategy rather than relying on individual indicators:

* **Patching:** Immediately patch all Citrix NetScaler appliances against **CVE-2025-5777** and strictly follow vendor guidance to terminate all active sessions post-patch.
* **RMM Control:** Actively audit RMM tool usage. Monitor specifically for the unauthorized installation or deployment of multiple RMM agents in a short period.
* **Network Security:** Segment critical systems (NAS, hypervisors) from general endpoints, block known malicious infrastructure, and monitor for unusual outbound traffic patterns characteristic of tunneling tools like `cloudflared`.
* **Detection Focus:** Prioritize identifying the "attack chain" rather than isolated alerts. This includes monitoring for the sequence of: suspicious remote access → unauthorized RMM deployment → unusual lateral movement (RDP/SMB) → emergence of exfiltration tools.
Armored Likho's new weapon: BusySnake Stealer - "tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence)." - AO Kaspersky Lab

The provided summary covers the key aspects of the Armored Likho "BusySnake Stealer" campaign as detailed in the Securelist report. To ensure completeness, here is a breakdown of the information based on your request:

### Executive Summary: Armored Likho's BusySnake Campaign

| Category | Details |
| :--- | :--- |
| **What Happened** | Armored Likho is running a targeted phishing campaign using a new Python-based infostealer, "BusySnake," and AI-generated loaders to bypass traditional defenses. |
| **Who Is Affected** | Primary targets include government agencies and the electric power sector; identified victims are located in Russia, Kazakhstan, and Brazil. |
| **Security Implications** | The malware provides persistent access, enabling data exfiltration (credentials/cookies/files), remote command execution, and the establishment of reverse SSH tunnels. |
| **Technical Details** | Utilizes NSIS droppers/LNK files to initiate infection, with Python-based payloads obfuscated by PyArmor Pro 9.2.0; features modular capabilities including clipboard logging and in-memory script execution. |
| **Defensive Guidance** | Focus on detecting `WindowsHelper` scheduled tasks, unusual PowerShell activity (`rundll32.exe` patterns), and monitoring for unauthorized reverse SSH tunneling. |

### Technical Analysis & Defensive Measures

* **Campaign Evolution:** The use of AI-generated first-stage payloads marks a tactical shift aimed at complicating attribution and evading signature-based detection systems 【1】.
* **Malware Sophistication:** BusySnake is notable for its modular architecture, allowing attackers to tailor malicious tasks to the environment of the victim. Its persistence mechanisms—ranging from simple scheduled tasks to advanced COM object manipulation—show a clear focus on maintaining long-term access 【1】.
* **Attribution & Connectivity:** The group has evolved its toolkit from previously documented threats like AquilaRAT and Go2Tunnel, integrating these capabilities directly into the BusySnake framework. This native integration reduces the forensic footprint by minimizing the need for external dependency downloads 【1】.
* **Defensive Priorities:** Defenders should prioritize auditing the creation of new scheduled tasks and monitoring for the execution of obfuscated PowerShell scripts that launch `rundll32.exe`. Because the malware resides in memory and often fetches its modular components dynamically, behavioral analysis is more effective than file-based hashing for this specific threat 【1】.
GRU: military unit 67606 - S2 Grupo

Based on the article, here is a detailed precis regarding the Russian GRU military unit 67606.

### What Happened
The article identifies military unit 67606 (the 127th Separate Reconnaissance Brigade) as a unique, combat-focused entity within the Russian GRU intelligence structure. Unlike standard, specialized psychological operations (PSYOP) units that report to centralized commands, unit 67606 is a deep reconnaissance brigade that has been uniquely equipped with organic PSYOP capabilities. Formed in late 2014, likely as an immediate response to the annexation of Crimea, this unit operates specifically within the Black Sea Fleet and the Southern Military District to conduct regional PSYOP, a structure not replicated in other Russian naval fleets.

### Who is Affected
* **Targets of Operations:** Populations and military personnel within the Black Sea/Sevastopol theater.
* **The Russian Military Structure:** The unit operates under a dual-subordination model—operational tasking from the Black Sea Fleet/Southern Military District, and doctrinal/intelligence guidance from the GRU.
* **Defenders:** Military forces, civilian populations, and critical infrastructure operators in the region are potential targets of their specific technical capabilities.

### Technical Details
Unit 67606 is a combat-oriented reconnaissance brigade that incorporates a dedicated PSYOP battalion. Its technical profile includes:
* **Electronic Reconnaissance and UAVs:** The unit utilizes unmanned aerial vehicles (specifically the Orlan-10) to facilitate its operations.
* **GSM Capabilities:** These assets are used to conduct advanced electronic warfare, including:
* **Traffic Interception:** Impersonating base stations to intercept mobile communications.
* **Communications Jamming:** Disrupting local signal environments.
* **Mass SMS Delivery:** Targeted or mass messaging for PSYOP purposes.

### Security Implications
The primary security implication is the integration of advanced, offensive information operations capabilities into a front-line combat reconnaissance unit. By embedding these tools into a mobile, deep-reconnaissance brigade, the GRU gains the ability to conduct localized, highly responsive PSYOP and electronic interference directly at the edge of the battlefield, rather than relying solely on dedicated, centralized PSYOP units. This creates a "rara avis" (rare bird) model that complicates traditional threat assessment by blurring the lines between pure reconnaissance and active psychological and electronic warfare.

### What Defenders Should Know
* **Non-Standard Structure:** Analysts and defenders should not assume all GRU PSYOP capabilities are organized under centralized, easily identified units (like those bearing the Greek letter "Psi" in their emblems).
* **Localized Threats:** Unit 67606 serves as a reminder that combat units in high-priority operational theaters may possess high-level electronic and information warfare capabilities.
* **Technical Tactics:** Defense strategies in the region must account for threats posed by mobile base-station impersonation, SMS-based manipulation, and localized signal jamming, as these are inherent components of the 127th Brigade's mission profile.
WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP Authentication - - WatchGuard Technologies

This precis covers the critical security vulnerability identified in WatchGuard Fireware OS.

### **Overview**
A critical race condition vulnerability resulting in a **use-after-free** error exists within the LDAP authentication mechanism of WatchGuard Fireware OS, specifically affecting the Mobile User VPN with IKEv2. This flaw, tracked as **CVE-2026-13368**, has been assigned a CVSS score of **9.2** (Critical).

### **What Happened**
A remote, unauthenticated attacker can exploit this vulnerability to execute arbitrary code. The flaw is triggered when the system processes LDAP authentication requests for a Mobile VPN with IKEv2 configuration.

### **Who Is Affected**
This vulnerability impacts several branches of Fireware OS. The affected versions include:
* Fireware OS 11.0 up to 11.12.4_Update1
* Fireware OS 12.0 up to 12.12
* Fireware OS 12.5 up to 12.5.18
* Fireware OS 2025.1 up to 2026.2

### **Security Implications**
Because the exploitation allows for arbitrary code execution in the context of the `iked` process, an attacker could potentially gain unauthorized control over the affected Firebox device. Given the critical nature and high severity rating, this poses a significant risk to network integrity and confidentiality.

### **Technical Details**
* **Vulnerability Type:** Race condition leading to a use-after-free.
* **Attack Vector:** Remote, unauthenticated.
* **Target:** `iked` process.
* **Configuration Requirement:** The device must have a Mobile VPN with IKEv2 enabled that is configured to authenticate against an external LDAP server.

### **What Defenders Should Know**
Defenders must assess their environment to determine if they are running the vulnerable configurations and versions listed above. Remediation steps vary by OS branch:

| Vulnerable Version | Remediation Action |
| :--- | :--- |
| **2025.1** | Update to version **2026.2.1**. |
| **12.x** | Update to version **12.12.1**. |
| **12.5.x (T15 & T35 models)** | Currently **Unresolved**. |
| **11.x** | Device is **End of Life**; hardware should be retired or replaced. |

Administrators of T15 and T35 models currently running 12.5.x are advised to monitor official channels for further updates or consider alternative configurations to mitigate the risk until a resolution is provided 【1】.
Unauthenticated Stored XSS in NEX-Forms Express WP Form Builder (≤ 9.1.10) — CVSS 8.8 High (CVE-2026–10525) - Sai Krishna Kothapalli

The provided summary accurately captures the critical aspects of the vulnerability (CVE-2026-10525) found in the NEX-Forms Express WP Form Builder. To ensure full clarity, here is the detailed précis based on your request:

### **Overview: Unauthenticated Stored XSS**
A high-severity stored Cross-Site Scripting (XSS) vulnerability was identified in the NEX-Forms Express WP Form Builder plugin. It allows an unauthenticated remote attacker to inject malicious JavaScript into a site's database through public form submissions. This script subsequently executes within the WordPress admin dashboard whenever an administrator reviews the form entries.

### **Affected Parties**
* **Software:** NEX-Forms Express WP Form Builder (WordPress plugin).
* **Affected Versions:** All versions up to and including **9.1.10**.
* **Target:** Any website utilizing this plugin version, as the vulnerability is accessible to the public without requiring authentication or specific user privileges.

### **Technical Details**
The exploitation of this flaw relies on three primary security failures within the plugin's architecture:
1. **Insecure AJAX Endpoint:** The plugin exposes a public-facing AJAX handler (`wp_ajax_nopriv_submit_nex_form`) that lacks essential security controls, including nonces, CSRF protection, and rate limiting.
2. **Lack of Sanitization:** The use of `rest_sanitize_array()` on array-based input is insufficient, as it fails to strip or encode HTML tags. Consequently, malicious payloads (e.g., `<script>` tags) are stored directly in the database.
3. **Unsafe Output Handling:** The vulnerability is finalized when the plugin echoes these stored entries in the WordPress admin panel without proper output escaping (e.g., `esc_html()`), causing the browser to execute the attacker's script in an administrator's context.

### **Security Implications**
Because the malicious script executes when an administrator logs in and views the form submissions, the attacker effectively gains the privileges of that administrator. Potential impacts include:
* **Account Compromise:** Creation of unauthorized new administrator accounts.
* **Unauthorized Access:** Theft of admin session cookies.
* **Persistence:** Installation of malicious backdoor plugins or modification of site files.
* **Data Breach:** Full exfiltration of database contents.

### **Advice for Defenders**
* **Immediate Patching:** The primary defense is to update the NEX-Forms Express WP Form Builder plugin to the latest, patched version immediately.
* **Secure Development Practices:** Developers should ensure that all user input is properly sanitized (e.g., using `array_map('sanitize_text_field', ...)` for arrays) and that all output is escaped using WordPress-recommended functions like `esc_html()` or `esc_attr()`.
* **Hardening:** Implement rigorous nonce verification for all AJAX endpoints.
* **Monitoring & Mitigation:** Administrators should monitor form submissions for suspicious content and employ a Web Application Firewall (WAF) to filter common XSS injection patterns in incoming POST requests.
Bad Epoll: The bug missed by Mythos - Jaeyoung Chung

This precis details "Bad Epoll" (CVE-2026-46242), a critical vulnerability within the Linux kernel.

### Executive Summary: Bad Epoll (CVE-2026-46242)

Bad Epoll is a high-severity race-condition use-after-free (UAF) vulnerability discovered in the Linux kernel's `epoll` subsystem. Despite its extremely narrow race window, it enables highly reliable privilege escalation on affected systems.

| Category | Details |
| :--- | :--- |
| **Vulnerability Type** | Race-condition, Use-after-free (UAF) |
| **Introduced** | Linux Kernel v6.4 (via commit `58c9b016e128`) |
| **Fix Date** | April 24, 2026 (via commit `a6dc643c6931`) |
| **Primary Impact** | Local Privilege Escalation (to root) |

### What Happened
The vulnerability exists due to a race condition between concurrent `epoll` close operations. When these paths collide, one process frees an object while the other continues to write to it, resulting in a UAF. It remained undetected for an extended period, even after similar race conditions in the same code path were identified, primarily because the race window is only about six instructions wide and frequently evades detection by tools like KASAN.

### Who Is Affected
* **Linux Distributions:** Systems running kernel versions v6.4 or newer that have not yet integrated the fix.
* **Android Devices:** The bug is notably capable of achieving root access on Android.
* **Exemptions:** Systems running kernel v6.1-based distributions are not affected.

### Security Implications
* **Privilege Escalation:** An unprivileged user can escalate privileges to root.
* **Sandbox Escape:** The vulnerability is triggerable from within the Chrome renderer sandbox, providing a critical vector for full kernel code execution.
* **High Reliability:** The exploit achieves 99% reliability by utilizing a retry loop, effectively avoiding kernel crashes.
* **Persistence:** Because `epoll` is a core, essential kernel component, there is no "kill-switch" or configuration-based workaround available to disable the vulnerable subsystem.

### Technical Details
The exploit chain involves several sophisticated steps:
1. **Triggering the Race:** Four `epoll` objects are grouped into pairs to initiate the race condition.
2. **Conversion:** The resulting 8-byte UAF write is successfully converted into a file object UAF.
3. **Cross-Cache Attack:** The attacker uses a cross-cache technique to gain control over file contents.
4. **Arbitrary Access:** By leveraging `/proc/self/fdinfo`, the attacker gains arbitrary read access to kernel memory, facilitating the execution of a Return-Oriented Programming (ROP) chain to secure root access.

### What Defenders Should Know
* **Remediation:** There are no practical workarounds or configuration mitigations. The only effective solution is to update the kernel to include the upstream patch from commit `a6dc643c6931`.
* **Action Required:** System administrators must verify that their specific distribution has backported the fix released on April 24, 2026, and apply available security updates immediately.
Fake Google and Cloudflare verification pages spread multiple malware families - Malwarebytes

This campaign involves a widespread distribution of various malware families through deceptive, fraudulent "verification" pages that mimic legitimate services like Google and Cloudflare 【1】.

### What Happened
Attackers are deploying "ClickFix" social engineering lures, which trick users into believing they must verify their identity or fix a system error by interacting with a website. The pages prompt users to copy a malicious PowerShell command from the site and execute it in their own Windows terminal (PowerShell, Command Prompt, or Windows Terminal) 【1】.

### Who Is Affected
The campaign targets general users worldwide who are browsing the web and may be misled by urgent, fake warnings or verification prompts 【1】.

### Security Implications
A successful infection grants attackers significant control over the victim's device, enabling them to steal sensitive information (such as passwords), gain remote access, or deploy further malicious payloads. The use of advanced loaders like the undocumented ResiLoader indicates a high level of sophistication, as it utilizes techniques such as BYOD (Bring Your Own Driver) to bypass AV/EDR, UAC bypass, and persistence mechanisms before executing infostealers like StealC 【1】.

### Technical Details
* **Infrastructure:** Attackers use a mix of compromised sites, expired domain repurposing, fake service pages, and Cloudflare Pages (`.pages.dev`). Payload delivery often leverages Cloudflare R2 buckets or direct IP connections 【1】.
* **Infection Chain:** The executed PowerShell command typically downloads a script that creates a specific directory (e.g., `C:\ProgramData\Zooms`), fetches subsequent malware stages, and sometimes exfiltrates victim machine information to the attacker 【1】.
* **Malware Families:** The infrastructure has been used to distribute multiple threats, including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and a Rust-based stealer 【1】.

### What Defenders Should Know
Defenders and organizations should focus on both user education and technical controls:

| Recommendation | Strategy |
| :--- | :--- |
| **User Education** | Emphasize that legitimate services like Google and Cloudflare never ask users to run PowerShell commands to "verify" their identity or fix errors. |
| **Strict Prohibitions** | Explicitly train users never to copy/paste commands from a website unless they fully understand the script and trust the source. |
| **Behavioral Monitoring** | Implement endpoint security that alerts on or blocks sites attempting to programmatically interact with or copy content to the system clipboard—a key indicator of ClickFix activity. |
| **Official Verification** | Always verify technical troubleshooting instructions through an organization's official, verified support channels rather than following prompts on arbitrary websites. |
| **Standard Hygiene** | Ensure security software remains up-to-date to maintain effective real-time and web-based protection against evolving threats. |

【1】
PamStealer: macOS Malware Posing as Clipboard Manager App - Jamf

The summary you have provided offers a comprehensive overview of the PamStealer malware. Below is a detailed précis covering the key aspects of the threat as requested.

### **What Happened**
PamStealer is a macOS infostealer that leverages social engineering and sophisticated evasion techniques to compromise users. It masquerades as "Maccy," a popular legitimate clipboard manager, and is distributed via a deceptive domain (`maccyapp[.]com`). The malware executes a multi-stage infection process that includes a dropper and a primary stealer payload to exfiltrate sensitive user data and establish persistence.

### **Who Is Affected**
The malware specifically targets users of **Apple silicon-based systems**. Its operators have implemented geographic and environmental checks, deliberately excluding users from several regions (e.g., Russia, Belarus, Kazakhstan) and specific keyboard layouts to narrow its focus or avoid local detection.

### **Security Implications**
PamStealer poses a significant threat to user privacy and system integrity by enabling:
* **Credential Theft:** Capturing user passwords via fraudulent authorization prompts.
* **Data Exfiltration:** Stealing browser credentials, cookies, and wallet-extension databases.
* **Clipboard Surveillance:** Harvesting sensitive information frequently copied by the user.
* **System Compromise:** Gaining unauthorized access to protected areas through social-engineered "Full Disk Access" prompts.
* **Persistent C2:** Establishing communication with command-and-control (C2) servers (e.g., `avenger-sync[.]live`) and utilizing resilient infrastructure, such as Ethereum JSON-RPC endpoints.

### **Technical Details**
* **Two-Stage Attack:**
* **Stage One (Dropper):** A compiled AppleScript (`.scpt`) utilizing JavaScript for Automation (JXA). It uses native `NSURLSession` APIs to download the payload, successfully bypassing many traditional behavioral triggers associated with command-line tools like `curl`.
* **Stage Two (Stealer):** A Rust-based Mach-O binary disguised as a system process (e.g., `Finder.app`).
* **Authentication Hijacking:** The malware performs local password validation using the Pluggable Authentication Modules (PAM) API (`pam_start`, `pam_authenticate`), avoiding external processes that might trigger security alerts.
* **Persistence & Evasion:** It uses modern APIs like `SMAppService` and legacy login items. Evasion tactics include ad-hoc signing, anti-debugging checks, and a decoy error message intended to make victims believe the app is broken, prompting them to delete the initial lure while the malware remains active.

### **What Defenders Should Know**
Defenders should focus on the following indicators to detect and mitigate PamStealer:
* **Process Monitoring:** Watch for binaries disguised as system components (e.g., `Finder`) running from user-specific directories like `~/Library/Application Support/` or `~/Library/Caches/`.
* **Scripting Activity:** Monitor for unusual network requests generated by `Script Editor` or suspicious `codesign` activity targeting bundles in `Application Support`.
* **Persistence Anomalies:** Investigate unauthorized use of `SMAppService` or unexpected entries in login items.
* **Artifact Hunting:** Look for the `.Maccy` marker file and network cache files (`Cache.db`) located in `~/Library/Caches/com.apple.finder.core/`, which may contain communications with known C2 infrastructure.
* **Behavioral Indicators:** Alert on suspicious, repeated usage of `pbpaste` and unauthorized system-level prompts requesting credentials or Full Disk Access that deviate from legitimate installation patterns.
FBI Seizes NetNut Proxy Platform, Popa Botnet - Brian Krebs

The FBI, in coordination with the IRS Criminal Investigation division and various industry partners, has executed a significant operation to dismantle the **NetNut** residential proxy service and the **Popa botnet**. The following is a detailed summary of the situation based on the provided report.

### Executive Summary
Authorities seized hundreds of domains linked to NetNut, an Israeli-based proxy provider operated by Alarum Technologies, due to its deep integration with the Popa botnet. By replacing the service's homepage with a seizure banner, law enforcement successfully disrupted the infrastructure that had been commodifying access to millions of compromised devices.

### Affected Parties
The botnet is estimated to encompass at least **two million compromised devices**. The victims are primarily users of consumer-grade IoT and streaming equipment, including:
* Unofficial Android TV boxes.
* Smart TVs (specifically models from LG and Samsung).
* Other "always-on" home-network connected devices.

These devices were surreptitiously converted into proxy nodes without the knowledge or consent of their owners via software development kits (SDKs) bundled with third-party applications.

### Security Implications
The existence of this network provided a robust layer of anonymity for threat actors:
* **Malicious Obfuscation:** Cybercriminals and state-sponsored espionage groups used NetNut nodes to mask the true origin of their traffic, facilitating credential stuffing, account takeovers, advertising fraud, and large-scale data scraping.
* **Lateral Movement:** Because these devices are embedded in home networks, they serve as potential gateways. Malicious traffic passing through them can expose other sensitive devices sharing the same local network to further compromise.
* **DDoS Facilitation:** The infrastructure enabled the creation of massive DDoS botnets, as attackers could tunnel traffic through these compromised nodes to bypass firewalls and attack targets from seemingly legitimate residential IP addresses.

### Technical Details
* **Infection Vector:** The botnet relied on SDKs embedded within apps installed on consumer devices. These apps were frequently found on unofficial streaming boxes or side-loaded onto smart TVs, bypassing the security vetting processes of official app stores.
* **Operational Scale:** Google’s Threat Intelligence Group (GTIG) reported that hundreds of distinct threat actor clusters were observed utilizing NetNut exit nodes within a single week.
* **Infrastructure Strategy:** Proxy services often maintain operational resiliency by acting as resellers, purchasing capacity from competitor networks when their own internal infrastructure faces disruption.

### Guidance for Defenders and Consumers
To mitigate the risks associated with residential proxy botnets, the following practices are recommended:

| Category | Defensive Action |
| :--- | :--- |
| **Procurement** | Stick to reputable, name-brand manufacturers for IoT devices and streaming boxes. |
| **Software Management** | Only use apps from official, vetted app stores; avoid side-loading or using unofficial hardware. |
| **Network Security** | Implement network segmentation, such as using a dedicated "Guest" Wi-Fi network for untrusted or IoT devices. |
| **Remediation** | Immediately remove any device from the network if it is suspected of participating in a botnet or exhibiting abnormal traffic patterns. |
The Blind Spot in the Watchtower: Detections for When Someone Attacks Your Sentinel - Alex Teixeira

The provided summary accurately captures the core technical risks and strategic recommendations detailed in the article. To ensure a complete understanding, here is a consolidated precis covering all required aspects:

### What Happened
The article exposes a critical oversight in many Security Operations Centers (SOCs): while Microsoft Sentinel is deployed to monitor organizational environments, the SIEM itself often lacks adequate monitoring. Sophisticated attackers exploit this "blind spot" by compromising the Sentinel workspace first, effectively blinding the defenders before proceeding with their broader malicious objectives.

### Who is Affected
Organizations that rely on Microsoft Sentinel for threat detection and response are at risk, particularly those that have not implemented "self-monitoring" for their security infrastructure. If a SOC assumes its SIEM is inherently safe from tampering, it is susceptible to these techniques.

### Security Implications
Compromising the SIEM provides attackers with significant operational advantages:
* **Detection Evasion:** Attackers disable rules and automation, ensuring their primary actions do not trigger alerts.
* **Covering Tracks:** Attackers can modify data retention policies or delete logs, destroying evidence of their intrusion.
* **Persistent Access:** By manipulating permissions or connectors, attackers can maintain a foothold within the security stack itself, potentially controlling how the organization reacts to incidents.

### Technical Details
The author focuses on leveraging Sentinel’s internal telemetry to detect tampering. The following data sources are critical for building these detections:
* **`AzureActivity`:** Monitors high-level administrative changes (e.g., workspace deletions, modification of diagnostic settings).
* **`SentinelAudit`:** Provides granular tracking of changes to detection rules and workspace configurations.
* **`SentinelHealth`:** Essential for identifying if critical detection rules or connectors have been disabled or have stopped functioning.

The article emphasizes using the KQL functions `_SentinelAudit()` and `_SentinelHealth()` to maintain compatibility and access the most accurate telemetry.

### What Defenders Should Know
Defenders must transition from a "set it and forget it" mindset toward their SIEM. Key defensive strategies include:
* **Active Self-Monitoring:** Implement the nine KQL-based rules suggested in the article to alert on unauthorized configuration changes, rule disabling, or modifications to connectors.
* **Operational Hardening:**
* Utilize Azure resource "delete-locks" to prevent the accidental or malicious removal of the Sentinel workspace.
* Maintain a **Watchlist** of approved administrative and automation service principals to reduce false positives and create a "known good" baseline.
* **Defense-in-Depth for Logs:** Because a compromised account with high-level permissions might attempt to delete local logs of their activity, consider forwarding critical security alerts to a secondary, isolated destination (such as a separate tenant or external monitoring service).
* **Focus on Automation:** Prioritize the protection of Logic Apps and playbooks; disabling automated incident response is often the most effective way for an attacker to remain stealthy, as it prevents the remediation actions that would otherwise signal an ongoing incident.
Knossos: Procedurally Generated Decoy Environments - Praetorian

The summary provided accurately covers the core aspects of Praetorian's Knossos tool as outlined in their technical blog. Based on the provided information, here is the detailed precis:

### **Overview: Knossos Decoy Environments**
Knossos is an automated, procedural engine developed by Praetorian that creates realistic, fake cloud infrastructure—known as "decoy environments"—designed to mirror a customer’s actual production environment. By creating a deceptive "labyrinth," the system aims to lure attackers who have breached the perimeter into interacting with fake resources, effectively turning a compromise into a controlled intelligence-gathering opportunity.

### **Affected Entities**
* **Target Audience:** Organizations utilizing cloud infrastructure (currently AWS, with GCP and Azure support in progress) who wish to move beyond traditional detection methods toward active deception.

### **Security Implications**
* **Active Defense:** Instead of merely alerting on an intrusion, Knossos forces attackers to expend effort on valueless targets, providing security teams with granular insights into the attacker's objectives, tools, and lateral movement patterns.
* **Controlled Risk:** The system implements three layers of security to ensure decoys cannot be used as a beachhead for real attacks:
* **Network Isolation:** Decoys are housed in a separate VPC with no connectivity to production.
* **Permission Boundaries:** Tight restrictions prevent escalation beyond the decoy environment.
* **Service Control Policies (SCPs):** An additional constraint layer managed at the account level.

### **Technical Details**
* **Daedalus Orchestrator:** Analyzes the target’s production infrastructure to create a "style profile," learning nuances like naming conventions, tagging strategies, network topology, and deployment cadences.
* **Generation Pipeline:** Employs a deterministic, seven-stage process (Path Planning, Budgeting, Scaffolding, Embedding, Dressing, History, and Validation) to ensure that the decoys contain plausible "attack paths" and misconfigurations.
* **Anti-Fingerprinting:** To avoid detection by sophisticated actors, Knossos generates synthetic audit logs and employs an activity simulator that mimics realistic API usage patterns.
* **Feedback Loop:** Lures are evaluated based on interaction rates and dwell times, with that data feeding back into the system to refine and optimize future decoy generation.

### **What Defenders Should Know**
* **Efficiency vs. Scale:** Knossos bridges the gap between manual, high-effort honeypots and automated, low-fidelity decoys, providing both realism and scalability.
* **Actionable Intelligence:** The system prioritizes high-fidelity breadcrumbs, allowing teams to track attacker behavior rather than reacting to noisy, non-contextual alerts.
* **Operational Control:** Defenders can tune the "camouflage layer"—the background resources used to disguise the decoys—to balance the cost of maintaining the fake environment against the desired level of realism.
* **Auditability:** Because the generation pipeline is deterministic, security teams can recreate and audit previously deployed decoy environments to verify their configuration and security posture.
Building more resilient CNI: what industry penetration testers told us - National Cyber Security Centre (NCSC)

This article does not report on a specific security incident, but rather summarizes expert advice from industry penetration testers on how organizations can proactively harden their systems against malicious actors. The NCSC consulted these testers to determine what defensive measures make their job—and by extension, the job of a real-world attacker—significantly more difficult.

The findings focus on improving the resilience of Critical National Infrastructure (CNI) and Operational Technology (OT) environments.

### Summary of Key Findings

| Category | Details |
| :--- | :--- |
| **What happened** | The NCSC engaged with professional penetration testers to gather actionable feedback on how organizations can improve system resilience. |
| **Who is affected** | Primarily large organizations, specifically those operating CNI and OT environments where system availability is critical. |
| **Security Implications** | Poorly designed or flat networks allow attackers (and pen testers) to move laterally, potentially leading to unauthorized control of OT systems and catastrophic loss of availability. |
| **Technical Details** | Recommendations include adopting "secure by design" principles, rigorous network segmentation (VLANs, firewalls, and separate user/group management), defining clear zones of trust, and using Privileged Access Workstations (PAWs). |
| **What defenders should know** | Logging and monitoring are only effective if the organization collects relevant data and has defined, exercised incident response plans. |

### Strategic Advice for Defenders

The article highlights three foundational pillars for increasing system resilience:

* **Secure by Design:** Security should be a primary requirement from the outset. This makes it easier to patch and remediate vulnerabilities when they are inevitably discovered.
* **Effective Network Segmentation:**
* **IT/OT Separation:** There must be a clear boundary between business IT and OT control systems.
* **Traffic Control:** Focus on controlling what crosses the boundary between segments rather than just creating them. Use "cross-domain thinking" to manage data flows.
* **Hardening:** Minimize exposed connections, standardize access routes, and implement Privileged Access Workstations (PAWs) to reduce the risk of lateral movement.
* **Robust Detection and Response:**
* **Purple Teaming:** Combine red teaming (offensive) and blue teaming (defensive) to ensure vulnerabilities are thoroughly understood and effectively closed.
* **Actionable Data:** Alerts are useless unless they are investigated and addressed through formal, frequently tested incident response plans.

### Hiring Expert Testers
The NCSC strongly advises that organizations commissioning penetration tests use providers from their **CHECK scheme**. When testing OT systems specifically, it is vital to hire testers with relevant industrial experience. A tester without this specialized knowledge may not only miss critical vulnerabilities but could inadvertently cause real-world damage to sensitive operational infrastructure.
On Favicons: From Browser Icons to Attack Surface Intelligence - Bishop Fox

This article details how favicon files—typically used to display icons in browser tabs—serve as a powerful, passive, and scalable signal for fingerprinting internet-exposed software. By analyzing these static assets, researchers and attackers can map infrastructure without direct interaction.

### Overview: What Happened
The author developed an AI-assisted analysis pipeline to index and enrich favicon data across the public internet. By utilizing MurmurHash3 (MMH3) to create unique fingerprints of these images, the project maps software installations globally, allowing for the correlation of disparate domains and the tracking of technology stacks.

### Who Is Affected
* **Organizations:** Any entity with internet-exposed infrastructure, including staging environments, dev servers, or administrative interfaces, may be mapped via their favicon signatures.
* **Software Vendors:** Developers of common web applications or appliances often see their products globally enumerated through these consistent, default branding elements.
* **Security Teams:** Defenders and researchers are impacted both as targets of this reconnaissance and as beneficiaries of this intelligence for their own asset discovery.

### Security Implications
* **Passive Reconnaissance:** Favicon hashes allow for large-scale enumeration of exposed software without triggering traditional security alerts, as the process does not require active exploitation attempts.
* **Infrastructure Attribution:** Because favicons are often part of a standardized deployment package, they can link seemingly unrelated domains, staging sites, and production infrastructure back to a single owner or common software base.
* **Bypassing Access Controls:** Favicons are frequently served as static assets. They are often excluded from strict authentication flows (like SSO) or WAF filtering, making them readable even when the core application remains protected.
* **Vulnerability Tracking:** By monitoring shifts in the prevalence of specific hashes, one can track the adoption of new software, the lifecycle of a vulnerability (following a CVE), or the deployment of honeypots.

### Technical Details
* **Standardized Hashing:** The project uses the MurmurHash3 algorithm on base64-encoded image data, which is the industry standard for this type of fingerprinting.
* **AI-Assisted Pipeline:** The author created an automated agent that employs a reasoning loop to validate findings. This includes:
* **Contextual Validation:** Using `ShodanHashSearch` to group hosts by HTML-based hashes rather than relying solely on image signatures.
* **Browser Simulation:** Employing `HeadlessBrowser` to accurately capture icons from modern, JavaScript-heavy web applications.
* **Database Enrichment:** Cross-referencing findings with the National Vulnerability Database (NVD) via a `VerifyCPE` tool to map hashes to known software versions.

### What Defenders Should Know
* **Favicon Intelligence as a Defensive Tool:** Defenders can utilize these same methods to conduct their own attack surface management, identifying unauthorized or legacy assets that they may have otherwise overlooked.
* **Identifying Honeypots:** Analysts can spot potential honeypots by looking for "favicon mismatches"—instances where a specific icon is associated with multiple unrelated products or impossible server-header combinations.
* **Visibility into Shadow IT:** Monitoring favicon signatures can help identify "shadow IT"—servers or applications deployed outside the purview of the central security or IT teams.
* **Dataset Availability:** A repository detailing the methodology, dataset, and practical applications has been made available by Bishop Fox [at GitHub](https://github.com/BishopFox/Favicons/blob/main/favicons%5Ftable.md).
OpenUDC2: This is an open source implementation of the UDC2 spec used in Cobalt Strike - CodeXTF2

The provided repository, **OpenUDC2**, is an open-source implementation of the User Defined Channel 2 (UDC2) specification, a protocol originally designed for the Cobalt Strike C2 framework. It is important to clarify that this repository is not the site of a cyberattack; rather, it is a project that provides a proof-of-concept (PoC) to allow open-source C2 frameworks to leverage UDC2 modules developed by the Cobalt Strike community.

Below is a detailed précis of the project:

### What Happened
The project creators developed an open-source implementation of the UDC2 protocol, enabling compatibility between non-commercial C2 frameworks and UDC2 modules intended for Cobalt Strike. This project functions as an interoperability tool for penetration testing and security research C2 environments.

### Who Is Affected
This repository does not "affect" victims in the sense of a compromise. However, it is relevant to:
- **Security Defenders and Blue Teams:** Those monitoring network traffic for Cobalt Strike-like activity should be aware that the UDC2 protocol can now be implemented outside of the official Cobalt Strike ecosystem.
- **Red Teams/Security Researchers:** Those using open-source C2 frameworks who wish to utilize UDC2-based communication channels.

### Security Implications
- **Protocol Portability:** The primary implication is that UDC2, a protocol previously exclusive to Cobalt Strike, is now more accessible.
- **Lack of Encryption:** The developer explicitly warns that this PoC implementation **does not include strong encryption**. Any deployment of this code in a live environment without adding custom encryption protocols would expose command-and-control traffic to interception and analysis.

### Technical Details
The implementation consists of two primary components designed to mimic Cobalt Strike behavior:
- **`beacon_agent`:** A fork of the Adaptix C2 beacon, modified to support the OpenUDC2 protocol.
- **`open_udc2_listener`:** A listener component engineered to emulate the standard Cobalt Strike UDC2 listener.

### What Defenders Should Know
Defenders should not view this repository as a threat in itself, but rather as an indicator that UDC2 traffic is no longer exclusive to Cobalt Strike.
- **Traffic Analysis:** Security teams should study the official UDC2 specifications to develop detection signatures. If an organization is already tuned to detect Cobalt Strike UDC2 traffic, this project suggests that those signatures might also be triggered by other C2 frameworks implementing this open-source variant.
- **Resources for Detection:** To understand the protocol, defenders are encouraged to consult the resources provided by the developers for reference:
- [Cobalt Strike 4.12: Fix Up, Look Sharp!](https://www.cobaltstrike.com/blog/cobalt-strike-412-fix-up-look-sharp) (Official UDC2 announcement).
- [udc2-vs](https://github.com/Cobalt-Strike/udc2-vs) (Official UDC2 Beacon Object File template and specification).
- [icmp-udc2](https://github.com/Cobalt-Strike/icmp-udc2) (Official ICMP UDC2 channel implementation example).
tf-mythic-azure: Automatically deploying Mythic C2 in Azure using Terraform - qmadev

Based on the provided information from the `qmadev/tf-mythic-azure` project, here is a detailed précis of the repository.

### **What Happened**
This repository provides a set of Terraform templates designed to automate the rapid deployment and management of **Mythic C2 (Command and Control) infrastructure** within a Microsoft Azure environment. It allows cybersecurity operators to stand up multiple Mythic server instances, optionally configured with Azure CDN redirectors, using Infrastructure as Code (IaC) principles.

### **Who Is Affected**
This project is intended for use by cybersecurity operators and red teams. Defenders and security operations centers (SOCs) are "affected" in the sense that they must be aware of such tooling to monitor for and detect the automated deployment of adversary infrastructure within their Azure environments.

### **Technical Details**
* **Automation**: Uses Terraform to manage the lifecycle of C2 infrastructure in Azure.
* **Configuration**: Infrastructure is configured through a central `projects` map in `main.tf`, allowing for granular customization per project, including Mythic versions, admin credentials, C2 profiles, and agents.
* **Access Control**: By default, the Mythic web portal is restricted to `localhost`. Operators are expected to access the interface securely using SSH local port forwarding.
* **Secrets Management**: The project integrates with Azure Key Vault to securely manage and store sensitive information, such as SSH keys and Web Console passwords.

### **Security Implications**
* **Infrastructure Scaling**: The use of IaC enables the rapid, standardized, and repeatable deployment of C2 servers, which may increase the scale and complexity of managing potentially malicious infrastructure.
* **Operational Security (OPSEC)**: The security of the deployed infrastructure relies entirely on the operator's practices, specifically regarding the hardening of the Azure environment, diligent management of secrets within Key Vault, and the use of secure connection methods like SSH tunneling.

### **What Defenders Should Know**
Defenders should focus on monitoring and auditing techniques to identify the usage of such templates:
* **API Activity**: Monitor cloud provider API logs for anomalies or patterns consistent with the automated deployment of these specific Terraform configurations.
* **Resource Creation**: Look for suspicious creation of resources associated with this infrastructure, such as specific VM configurations or Azure CDN redirectors.
* **Key Vault Auditing**: Audit Azure Key Vault usage for patterns related to the storage or access of credentials linked to C2 management.
* **Behavioral Detection**: Because these tools facilitate standard, repeatable deployments, defenders can establish baselines for "normal" environment modifications and alert on deviations that match the deployment behavior of tools like `tf-mythic-azure`.
Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs - Expel

This precis details the analysis of a sophisticated "EDR killer" toolkit utilized by "The Gentlemen," a ransomware group active since mid-2025.

### **What Happened**
In an April 2026 incident, The Gentlemen group deployed a novel, zero-day Bring-Your-Own-Vulnerable-Driver (BYOVD) attack to neutralize endpoint detection and response (EDR) systems. The attackers loaded a vulnerable kernel driver (`ktapi.sys`) and used a custom exploit tool (`was.exe`) to perform a series of sophisticated kernel-mode operations, effectively disabling security software and clearing the way for subsequent ransomware deployment.

### **Who Is Affected**
Organizations running Windows systems are vulnerable, particularly those where legacy, cross-signed drivers are permitted. The exploit specifically targeted a wide range of security products, including:
* **Windows Defender**
* **ESET**
* **Palo Alto Cortex XDR**
* **SentinelOne** (various components)

### **Technical Details**
The exploit demonstrates high technical sophistication by chaining techniques to bypass modern Windows mitigations:
* **Vulnerability:** The exploit abuses a zero-day vulnerability in Kontron’s `ktapi.sys` driver, which provides direct read/write access to physical memory (`\\Device\\PhysicalMemory`).
* **Kernel Manipulation:** Because the exploit gains arbitrary physical memory read/write capabilities, it can resolve its own process’s Page Map Level 4 (PML4) to find and map kernel memory.
* **Bypassing Mitigations (SMEP/SMAP):** The toolkit avoids triggering Supervisor Mode Access/Execution Prevention (SMAP/SMEP) by leveraging `KUSER_SHARED_DATA`, a shared page existing in both kernel and user space. It overwrites kernel function pointers (specifically `NtUserFrostCrashedWindow` and `NtUserSetGestureConfig`) to redirect execution to attacker-controlled shellcode and kernel functions with full privileges.
* **EDR Termination:** By hijacking kernel functions (`PsLookupProcessByProcessId`, `ObDereferenceObject`, and `PsTerminateProcess`), the attackers can locate and terminate EDR processes even when they are running as protected processes.

### **Security Implications**
This attack illustrates the continued danger of the BYOVD technique, where attackers bypass modern OS hardening by abusing legitimate, signed—but vulnerable—drivers. The sophistication of this toolkit suggests that ransomware actors are increasingly adopting techniques from advanced game-cheat developers to maintain control over the kernel and evade state-of-the-art security suites.

### **What Defenders Should Know**
Expel recommends the following strategies to mitigate this threat:
* **Windows Defender Application Control (WDAC):** The most effective defense; it can be configured to block the loading of unapproved kernel drivers, effectively reducing the BYOVD attack surface to near zero.
* **Enable Virtualization-Based Security (VBS):** Using Core Isolation features, such as Memory Integrity, can prevent the exploit from successfully calling shellcode by enabling Kernel Control Flow Guard (kCFG).
* **Block Vulnerable Drivers:** While lists like `loldrivers.io` are useful, organizations should proactively monitor for and block known-vulnerable drivers (including `ktapi.sys`) via detection rules or policy.
* **Windows Update:** Ensure systems are running modern versions of Windows where Microsoft has disabled the grandfathering of legacy cross-signed drivers, which would automatically block drivers like the one exploited here.
Boss Scam: Don’t Trust Every “Urgent” Message from Your Boss! - "It runs in the background till it finds an active WhatsApp Web session in Chromium-based browsers" - K7 Labs

The "Boss Scam," a sophisticated variant of Business Email Compromise (BEC), exploits trust by impersonating authority figures to compromise targets. Based on the report from K7 Computing, here is a detailed precis of the threat:

### **What Happened**
Cybercriminals are orchestrating campaigns that impersonate senior management, CEOs, or trusted colleagues to trick employees into interacting with malicious files. The primary objective of these campaigns—highlighted by recent warnings from the Indian Cyber Crime Coordination Centre (I4C)—is to hijack active WhatsApp Web sessions to facilitate wider organizational compromise.

### **Who is Affected**
The campaign targets individuals within corporate and organizational environments who are likely to respond to "urgent" requests from authority figures. By exploiting these professional hierarchies, attackers aim to gain a foothold in companies, potentially leading to financial fraud or the deployment of further malware.

### **Technical Details**
The attack utilizes a multi-stage approach designed to evade traditional security measures:
* **Infection Vector:** Victims receive emails or messages containing ZIP archives. These often masquerade as communications from official entities (e.g., tax authorities or financial institutions) or colleagues.
* **DLL Sideloading:** The archive includes a legitimate, digitally signed executable bundled with a malicious DLL. When executed, the legitimate file inadvertently loads the malicious library.
* **Evasion and Persistence:** The malware uses techniques such as dynamic API resolution to bypass antivirus detection, establishes persistence via registry run entries, and employs a mutex to ensure only one instance is active.
* **Session Hijacking:** The malware scans Chromium-based browsers (Chrome, Edge) to locate active WhatsApp Web session artifacts. It harvests authentication tokens, cookies, and encryption materials, then uses the native Windows `tar.exe` utility to archive and exfiltrate this data to the attacker.

### **Security Implications**
Hijacking an authenticated WhatsApp Web session grants attackers significant capabilities:
* **Impersonation:** Attackers can send highly convincing messages to the victim’s professional contacts, increasing the likelihood of successful social engineering.
* **Data Theft:** Beyond session hijacking, the malware can scrape stored browser data, including saved credentials, payment information, and sensitive profile data.
* **Escalation:** The compromised session serves as a gateway to request fraudulent fund transfers, distribute ransomware, or install additional Remote Access Trojans (RATs) across the victim's network.

### **What Defenders Should Know**
Defenders should implement a layered security posture focused on both technology and human vigilance:
* **Verification Protocols:** Establish a "trust but verify" culture where urgent, unexpected requests—particularly those involving file attachments—are confirmed via a secondary communication channel.
* **Endpoint Hygiene:**
* Configure systems to display file extensions, which helps users identify masquerading executable files (e.g., `.exe` hidden as `.pdf`).
* Strictly restrict the execution of untrusted binaries.
* Ensure all antivirus and endpoint protection software is fully updated.
* **Credential and Session Management:** Encourage the use of Multi-Factor Authentication (MFA) and educate users to actively monitor and terminate unused browser-based messaging sessions.
* **Response Strategy:** In the event of a suspected compromise, users should immediately run a full antivirus scan, revoke all active browser session cookies, rotate saved passwords, and escalate the incident to the IT security team.