Cyber security developments for Saturday the 18th of July 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 18 articles to cover. All attribution is by the article authors. All article analysis is automated.
Genians have written up Operation Capsule Vault, a spear-phishing campaign by APT37 targeting academic and research professionals in Seoul back in June. The attackers used ISO files containing malicious PIF executables to deploy RokRAT malware with persistence via process injection, and command-and-control through Dropbox, pCloud, and Yandex. One for those tracking North Korean-aligned threat activity.
Symantec's Threat Hunter Team disclosed a remarkable bit of persistence—Chinese-linked actors maintained access to a Taiwanese high-tech manufacturing subsidiary for thirteen years using kernel-mode rootkit Backdoor.Daxin alongside a newly identified backdoor called Stupig. Detection in May revealed malware compile timestamps going back to around 2013, with initial access likely through a legacy single sign-on portal running end-of-life Java. Quite the long game.
The Organised Crime and Corruption Reporting Project published an investigation revealing that NSO Group co-founder Shalev Hulio travelled to Panama in December 2013 using an Israeli diplomatic passport, shortly after selling Pegasus spyware to the Panamanian government. The findings challenge NSO's claims of operational independence and suggest the firm may operate as an extension of Israeli state intelligence. Worth reading for the geopolitical context around commercial spyware.
And staying with Pegasus, The Guardian reports that a whistleblower from Morocco's intelligence service has revealed extensive use of NSO Group's spyware between 2017 and 2021. Targets included the Spanish Prime Minister, Defence and Interior Ministers, journalists, human rights defenders, and counter-terrorism officers collaborating with Morocco. The spyware was allegedly provided by the UAE, with NSO representatives training operatives in Rabat.
A researcher going by GossiTheDog has published detection queries for LegacyHive, a post-exploitation technique that allows attackers to exfiltrate Windows registry hives by staging files in GUID-formatted directories and manipulating shell folder registry keys to point to virtual device paths. The article provides KQL hunting queries to spot behavioural indicators including registry file staging and abnormal loading of offreg.dll. Useful if you're building detection coverage for Windows credential theft.
The UK Department for Science, Innovation and Technology has published version 1.1 of the Telecommunications Security Code of Practice, updating guidance for large and medium-sized public telecoms providers. The revision refines security standards and addresses emerging risks since the 2022 version, reinforcing risk-based approaches under the Telecommunications Security Act. Relevant if you're working in UK telecoms regulation or compliance.
CISA, NSA, JPCERT, and the Dutch and UK cyber centres have jointly released international guidance on establishing Coordinated Vulnerability Disclosure programmes. The document provides strategic and operational frameworks for organisations to enable external security researchers to safely report vulnerabilities before they're exploited. This is proactive guidance rather than incident response, and adds useful context if you're standing up or refining a disclosure programme.
Wiz have detailed a supply chain attack on the AsyncAPI open-source project, where threat actors exploited insecure GitHub Actions configuration to publish malicious versions of multiple npm packages. The multi-stage malware exfiltrated browser credentials, SSH keys, cloud credentials, GitHub tokens, and cryptocurrency wallets, whilst establishing persistence on infected developer machines and CI pipelines. One to flag if you're managing open-source dependencies or CI/CD security.
The BBC reports that two teenagers have been sentenced to five years and six months in prison after conducting a sixteen-hour cyber attack on Transport for London that they live-streamed online. They used social engineering to trick a help-desk worker into resetting credentials, then stole personal data from millions of customers, disrupted 148 systems, and caused £29 million in direct costs plus £10 million in lost revenue. Social engineering remains a remarkably effective vector.
A researcher has released COMLoaderAstharot, a proof-of-concept COM hijacking technique targeting a CLSID used by Google Chrome and Microsoft Edge. The technique leverages loader callbacks and the Windows HTTP API for network communication to evade antivirus detection, providing a reliable persistence and code execution mechanism that's reportedly remained stable for six months. Useful context for red teamers and detection engineers alike.
Tiziano Marra has demonstrated an advanced call stack spoofing technique that bypasses endpoint detection and Intel's Control-flow Enforcement Technology hardware protections. The method uses Windows Thread Pool, enum callback trampolining, and indirect syscalls to execute sensitive system calls whilst maintaining legitimate-appearing stack frames backed by signed modules. This one's worth reading if you're developing or testing endpoint security controls.
A developer has published details on rsnap, a post-exploitation tool that leverages an undocumented Windows API to extract registry hives for offline analysis. The technique requires backup privileges and enables attackers to conduct enumeration off-host to evade detection, targeting credential harvesting from system hives and persistence discovery. Red teamers will find this interesting; defenders might want to monitor for unusual use of that API.
A researcher has released UnwindRaven, a Windows offensive research framework that constructs fully synthetic call stacks for newly spawned threads to evade endpoint detection. The tool targets stack-walking debuggers and kernel-level monitoring by making malicious threads appear legitimate. Designed for red teaming and advanced security research to bypass traditional monitoring heuristics.
SpecterOps researcher Logan Goins has demonstrated an NTLM relay attack that bypasses traditional network boundaries by coercing authentication to internet-facing attacker infrastructure, then tunnelling it back to relay into internal networks. The methodology targets Active Directory environments with insufficient relay protections, particularly certificate services web enrolment endpoints lacking extended protection and systems without enforced LDAP signing. This one adds useful context to NTLM relay defence strategies.
A technical repository has been published documenting Windows process injection techniques ranging from fundamental methods to advanced evasion tactics including module stomping, syscall manipulation, and manipulation of process environment blocks. The resource is designed for security professionals, red teamers, and malware analysts to understand injection tradecraft used to evade endpoint detection and execute code within trusted processes.
DOCOMO Business have written up a campaign from early 2026 distributing fake 7-Zip installers via unofficial websites. The attackers deployed legitimate software alongside malicious proxy tools that transform infected home computers into commercial residential proxy nodes. Similar campaigns targeting VPN services and social media tools route malicious traffic through victims' residential IP addresses, effectively implicating them in cyberattacks and fraud. Worth flagging to end users who might download utilities from unofficial sources.
A researcher has released BingusLdr, a sophisticated DLL loader built on the Crystal Palace framework that employs advanced evasion techniques to bypass modern endpoint security controls. It uses hardware-compatible stack spoofing, protected API resolution, and heap and image masking to evade detection by endpoint detection systems and memory scanners. Represents advanced post-exploitation tradecraft for maintaining stealthy code execution.
And finally, Kirchware has developed a modular Position Independent Code implant framework that allows custom modules to be compiled into shellcode at build time. The framework uses dynamic dispatch, base address capture via register reservation, and a context structure to maintain position independence without requiring memory regions with read, write, and execute permissions. Advanced offensive tradecraft for creating evasive shellcode implants.
That concludes today's briefing.