Security news from the BlueTeamSec community for Sunday the 9th of August 2026. A busy one, with eighteen stories covering everything from espionage platforms and ransomware sentencing to AI agent abuse and some genuinely inventive offensive techniques.
Arctic Wolf Networks have published research on LightSpy, a Chinese state-linked espionage platform that's turned up across thirteen countries. It's being used as a commercial spyware product by military, government, and business entities, with capabilities including data exfiltration, location tracking, and remote device wiping. The distributed infrastructure spans a hundred and seventeen servers, and it can be deployed on network routers as well as endpoints.
The U.S. Attorney's Office for the Eastern District of Virginia announced that Maksim Silnikau, a forty-year-old Belarusian national, was sentenced to sixteen years in prison for running the Ransom Cartel ransomware operation. Between 2021 and 2023, he recruited co-conspirators through cybercrime forums and provided them with encryption software and stolen credentials to conduct double-extortion attacks against at least eighteen companies globally.
Google have written up UNC6671, previously known as the BlackFile extortion group, who faked retirement in May but continued operating under multiple rebrands including Redact, Pink, Helix, and Falcon. They extorted roughly ten point seven million dollars between January and May this year, targeting financial services, legal, and healthcare sectors with ransom demands in the one to three million range. The shift is towards high-value targets involved in sensitive merger and acquisition work or litigation.
News1 reported that a South Korean data recovery company CEO was sentenced to prison for a four-year extortion scheme involving collusion with ransomware operators. The hackers provided real-time infection data, including file extensions, to the recovery firm, which then ran targeted search engine adverts appearing when victims searched for solutions. The firm charged exorbitant fees for recovery services whilst maintaining the criminal partnership, which is either breathtakingly cynical or just efficient marketing, depending on your perspective.
The U.S. Department of Justice announced that Canadian national Connor Riley Moucka pleaded guilty to hacking a U.S.-based cloud storage provider between February and October 2024. Using stolen credentials, he accessed data from at least a hundred and sixty-five client organisations, stealing billions of records affecting over a hundred million individuals, including financial data, call records, and government ID numbers. The attackers then extorted victims by threatening to publicly disclose the stolen data.
Elastic researchers identified malicious abuse of AI coding agents, specifically Claude Code, on macOS developer endpoints in July. Attackers leveraged the trusted coding assistant as a parent process to conduct reconnaissance, establish reverse tunnels via localhost dot run, Cloudflare Quick Tunnels, and ngrok, exfiltrate credentials over HTTP, and establish persistence through launch agents. This follows the Hugging Face intrusion we covered earlier, and it's another example of coding agents being used as a living-off-the-land binary.
PromptArmor discovered vulnerabilities in Atlassian Rovo, an AI agent framework for Jira and Confluence, that enable data exfiltration through indirect prompt injection attacks. The flaws stem from insecure URL retrieval tools and Markdown rendering that allow attackers to manipulate the AI agent into sending sensitive internal data to external servers without user interaction. Disabling web search does not mitigate the risk, which is worth flagging if you're running Rovo in production.
Semperis researchers discovered two critical Active Directory privilege escalation vulnerabilities. KerberLoss enables denial of service and authentication downgrade to NTLM by exploiting service principal name uniqueness constraints, whilst ResetNightmare allows full domain takeover by manipulating user principal name attributes to impersonate Domain Admins. Both exploit invisible, unfilterable characters in Active Directory object attributes to bypass uniqueness verification checks.
VulnCheck researchers discovered ENDLESSDOORS, a persistent undocumented backdoor embedded in firmware of multiple ZBT router models. The backdoor is based on a legacy remote-control tool from 2015 called 'rctl' and provides unauthenticated root-level access whilst bypassing NAT and firewalls through outbound command-and-control connections. Not the first time we've seen embedded backdoors in networking kit, but this one's been sitting there for quite a while.
Forescout reported that beginning in late July, threat actors conducted coordinated cyberattacks against U.S. water and wastewater utilities across at least twelve states. Attackers exploited internet-facing Rockwell Automation and Allen-Bradley programmable logic controllers via unauthenticated EtherNet/IP protocol on port 44818 to remotely reconfigure controllers, causing operational impacts including pressure loss, flooding, and control system shutdowns. This follows CISA and FBI disclosures on Iranian targeting of critical infrastructure we covered earlier this month.
A proof-of-concept called EkkoNtProtect demonstrates an advanced sleep obfuscation technique that evades detection by using internal ntdll trampoline functions to call system calls directly. This method creates call stacks composed exclusively of ntdll frames, bypassing security solutions like Elastic that detect anomalous non-ntdll frames during syscalls. The technique has been observed in malware frameworks such as Havoc's Demon, so it's one for blue teams tracking evasion trends.
Dirk-jan Mollema discovered a technique to abuse Windows Hello for Business cryptographic keys from a compromised low-privileged user session to authenticate to Microsoft Entra ID without requiring PIN or biometrics. The technique leverages the CNG interface to sign arbitrary data and perform web authentication, enabling attackers to establish persistence by registering attacker-controlled devices and obtaining Primary Refresh Tokens whilst bypassing Conditional Access policies.
SpecterOps researchers demonstrate how adversaries with administrative access to Windows Server Update Services can weaponise the patch management infrastructure by manipulating the SUSDB SQL database to deploy unauthorised payloads. The technique exploits the trust model where updates execute with high privileges, creating a self-healing backdoor that persists through the update enforcement mechanism. Part two of a series, and particularly relevant if you're running WSUS in enterprise environments.
Detect dot f-y-i published a technical guide for detecting malicious mailbox forwarding rules in Microsoft 365 environments used by attackers for persistence. The article details KQL hunting queries using CloudAppEvents and UnifiedAuditLog tables to identify suspicious New-InboxRule, Set-InboxRule, and Set-Mailbox operations, with an emphasis on contextual detection strategies including filtering for external domains and composite alerting for high-value targets.
Elastic introduced AlertZero, an agentic AI framework for automating SOC alert triage and investigation. The system uses AI agents to filter false positives, correlate alerts, construct attack narratives, and propose new detection rules whilst maintaining human oversight. It supports flexible deployment models including air-gapped environments with private language models, which addresses one of the more common objections to AI-assisted SOC workflows.
ANIMO is a C-plus-plus-based command-and-control framework designed for red team operations targeting Azure AD, Microsoft 365, and Azure cloud environments. The platform provides a centralised interface for managing multiple Azure PowerShell and CLI sessions, automating post-exploitation tasks, token manipulation, and enumeration activities. One for red teams working in cloud-heavy environments.
SOCKSRelayd is a specialised NTLM relay attack tool that introduces persistence mechanisms by decoupling relay state from process memory. The tool maintains authenticated SMB sessions through a background SessionBank daemon with keepalive packets and stores NTLM authentication packages on disk, allowing relayed sessions to survive shell termination or disconnection. This extends the attack window and complicates detection by enabling attackers to maintain access even through network reconnections.
And finally, WinGuard is an open-source, user-mode Windows threat detection tool developed in C-plus-plus that emulates endpoint detection and response techniques. Designed as an educational and research project, it monitors and logs suspicious system activities on Windows PCs using lightweight detection methods. Worth a look if you're interested in how EDR functionality works under the hood.
That's all for today. The articles are the work of their original authors — the analysis here was automated. Back tomorrow.