InfoSec Briefing - August 13, 2026

🎧 Audio Briefing

Playback Speed:

This is the security briefing for Thursday the 13th of August 2026, from the BlueTeamSec community on infosec.pub.

The National Crime Agency reported on the sentencing of a member of international criminal groups known as 'Com', who orchestrated a campaign against 117 victims worldwide. The perpetrator used Snapchat, Telegram, and Discord to groom and blackmail teenage girls, sharing material within criminal networks for status — a sobering reminder that not all threat actors are after financial gain or state intelligence.

Check Point Research have written up Operation Dream Job, where the Lazarus Group is using fake job offers on LinkedIn to target aerospace and defence sectors. Victims receive malicious packages that deploy multi-stage infection chains for persistent access and intelligence gathering — we've seen similar DPRK social engineering campaigns crop up a few times recently, including fake IT worker schemes earlier this week.

Mozilla have rotated the GPG signing key for Firefox and Thunderbird releases after discovering an unencrypted version was accidentally committed to a private GitHub repository. There's no evidence of unauthorised access, but if you're manually verifying signatures or running RPM-based systems, you'll need to update to the new key.

PKB Communications have documented a 72-hour intrusion on an Active Directory honeynet that started with ClickFix social engineering and evolved into a hands-on-keyboard attack. The threat actor moved from commodity malware to domain controller compromise and VPN credential stuffing — worth reading if you want to see how quickly commodity intrusions can escalate when someone competent gets involved.

Fabian Mosch has demonstrated a malware evasion technique that uses large language models to iteratively refine malicious code. The LLM identifies indicators of compromise and rewrites the code to appear benign, which is considerably more sophisticated than traditional polymorphism or string obfuscation — one to bear in mind if you're relying on static signatures.

And finally, AlloySecureGroup have released Horcrux, an AI agent utility that provides encrypted, resilient storage using Tahoe-LAFS. The tool uses client-side encryption and distributes file shares across storage servers, but there's a critical caveat — the state files are bearer credentials, so if they're compromised, full access is granted, and if they're lost, the data is gone for good.

That's your briefing for today. The articles are the work of their original authors — the analysis here was automated.

📰 Articles Covered

Com group member sentenced for campaign of abuse against 117 victims worldwide - National Crime Agency

The following precis summarizes the case of a "Com" group member, Swaddle, who was sentenced for an extensive international campaign of abuse.

### What Happened
Swaddle, an active member of "Com" groups, engaged in a systematic campaign of grooming, sexual abuse, and blackmail against numerous minors. He utilized social media and messaging platforms to gain victims' trust, before escalating interactions to include sexual discussions, demands for nude images, and the coercion of self-harm. Furthermore, he recorded sexual activity, shared it within criminal groups to gain status, and used personal information to blackmail victims into providing additional compromising content or inciting them to abuse others.

### Who Was Affected
The National Crime Agency (NCA) identified 117 female victims worldwide, ranging in age from 13 to 17, including eight victims based in the UK 【1】.

### Security Implications
The primary security threat highlighted by this case is the weaponization of personal information in predatory online environments. By gathering sensitive details—such as names, home addresses, and school information—perpetrators effectively hold victims hostage through threats of exposure to parents, schools, or the public. The coordinated nature of these "Com" groups, where members share content to gain notoriety, exacerbates the harm by ensuring compromising material is distributed widely, making it difficult for victims to regain control over their digital footprint 【1】.

### Technical Details
* **Platform Proliferation:** The perpetrator was active across various platforms, including Snapchat, Telegram, and Discord, utilizing multiple aliases such as 'Epstein', 'Rugen', and 'Moscow' 【1】.
* **Group Structure:** "Com" groups are characterized by international memberships that leverage diverse online infrastructure, ranging from secure messaging apps to gaming platforms, to facilitate criminal activities and share illicit content 【1】.

### What Defenders Should Know
While the number of individuals involved in these specific groups is relatively small, the harm inflicted on victims is severe and enduring. The NCA is actively coordinating a multi-agency response, focusing on understanding pathways into offending and improving prevention strategies.

Defenders, educators, and parents should utilize the following resources for safeguarding and intervention:

| Audience | Resource |
| :--- | :--- |
| **Education Professionals** | [CEOP Education (Professionals)](https://www.ceopeducation.co.uk/professionals) |
| **Parents & Carers** | [CEOP Education (Parents)](https://www.ceopeducation.co.uk/parents) |
| **Young People** | [ShoreSpace](https://www.shorespace.org.uk/) |
| **General Online Safety** | [Kids Online Safety Campaign](https://www.kidsonlinesafety.campaign.gov.uk/) |
Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Check Point Research - Check Point Research

This is a precise summary of the Operation Dream Job campaign based on the report from Check Point Research.

### **What Happened**
The Lazarus group (attributed to the DPRK) is conducting an ongoing, sophisticated cyber-espionage campaign dubbed "Operation Dream Job." Attackers leverage fake job offers—typically delivered via platforms like LinkedIn—to entice targets into downloading malicious packages or software. Once the victim interacts with these files, the attackers deploy a multi-stage infection chain designed to infiltrate defense-related organizations, achieve high-level system privileges, and maintain long-term persistence for intelligence gathering.

### **Who Is Affected**
The campaign specifically targets individuals and companies within the **aerospace, aviation, and general defense sectors**. Geographically, the attacks have been observed across Europe, India, and South America.

### **Security Implications**
This campaign demonstrates a high level of operational sophistication:
* **Privilege Escalation:** By exploiting a zero-day vulnerability, attackers can bypass security controls and gain `SYSTEM` privileges.
* **Evasion:** The use of advanced rootkits (FudModule) allows attackers to blind Endpoint Detection and Response (EDR) solutions.
* **Infrastructure Obfuscation:** By turning compromised, legitimate websites into C2 relay nodes, attackers ensure their malicious traffic closely mimics normal, trusted network traffic.

### **Technical Details**
* **Zero-Day Exploit:** The campaign utilizes **CVE-2026-68820**, a privilege escalation vulnerability in the Windows `AFD.sys` driver, to disable security software and elevate privileges.
* **Infection Vectors:**
* **DLL Sideloading:** Victims are tricked into running a package containing a legitimate PDF viewer and a malicious DLL, which executes the **MISTPEN** in-memory downloader.
* **Trojanized Software:** Attackers distribute **SecurityPDF**, a modified open-source PDF reader, which decrypts and runs a payload when opening malicious documents.
* **Key Toolset:**
* **FudModule:** A kernel-mode rootkit used to maintain persistence and evade detection.
* **MISTPEN:** A downloader that uses the Microsoft Graph API (via OneDrive) for stealthy communication.
* **Troy Backdoor:** A new, modular remote access trojan (RAT) featuring 17 distinct commands for complete system control.
* **RelayShell:** A PHP web shell deployed on compromised web servers (such as Roundcube or WordPress) to act as a stealthy C2 communication relay.

### **What Defenders Should Know**
* **Patching is Critical:** Prioritize patching systems against **CVE-2026-68820** immediately.
* **Enhance Monitoring:** Monitor network traffic for connections to known CMS-based infrastructure (e.g., Roundcube, WordPress) that may be acting as relay nodes.
* **Endpoint Hygiene:** Implement strict controls against unauthorized DLL loading and monitor PDF viewers for suspicious behavior, such as unauthorized child processes or external network connections.
* **Targeted Training:** Employees in sensitive sectors (defense, aerospace, aviation) should be specifically trained to recognize and report suspicious, unsolicited job offers received through professional networks.
Updated GPG key for signing Firefox and Thunderbird Releases – Mozilla Security Blog - Mozilla

This precis outlines the security event regarding the rotation of Mozilla’s GPG signing keys for Firefox and Thunderbird.

### Executive Summary
Mozilla has rotated the GPG signing subkey used to sign release artifacts (including Linux tarballs, checksums, and RPM packages) after discovering that an unencrypted version of the previous subkey was accidentally committed to a private GitHub repository. An internal audit indicates the exposure was limited to authorized personnel, with no evidence of unauthorized access or exploitation.

### Security Implications
While the incident was a security oversight, the risk is contained. Access to the private repository was restricted to a small group of Mozilla employees who were already authorized to manage the keys. Consequently, there is no evidence that the compromised subkey was accessed by malicious actors. Nevertheless, Mozilla has revoked the previous key as a precautionary measure to ensure the integrity of future software releases.

### Technical Details
Users managing cryptographic verification should update their systems to utilize the new key material.

| Category | Fingerprint |
| :--- | :--- |
| **New Primary GPG Fingerprint** | `14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353` |
| **New Signing Subkey Fingerprint** | `827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3` |

* **Subkey Expiration:** The new signing subkey expires on 2028-08-05.
* **Key Availability:** The new key and revocation certificates are available via standard channels, including `keys.openpgp.org` and Mozilla’s Nightly archives.

### Impact and Required Actions
Most standard users will not be affected. However, specific groups require intervention:

* **Manual GPG Verification:** Individuals or automated systems that manually verify signatures must import the new signing key and the revocation for the old key. Once the revocation is applied, artifacts signed solely with the old key will no longer be verifiable.
* **RPM-based Systems (Manual Intervention Required):**
* **Affected OS:** Fedora 42 (and older), RHEL, Rocky Linux, AlmaLinux, and openSUSE/SUSE.
* **Action:** Administrators must explicitly remove the old key before importing the new one.
* **Note:** Use the command `rpm -e --allmatches` to ensure complete removal. Simply attempting to import the new key over the old one may result in a false success report while failing to update the system trust store.
* **Automated Updates:** Fedora 43 and subsequent versions will receive the updated key automatically during the standard update process.

### Recommendations for Defenders
* **Verify Integrity:** If your infrastructure relies on GPG verification for automated deployments or package management, ensure the revocation certificate for the old key is ingested immediately.
* **Configuration Hygiene:** Mozilla has implemented additional safeguards to prevent future accidental exposure of sensitive keys in version control systems. Organizations should similarly review their CI/CD pipelines to ensure secrets and keys are never committed to repositories, regardless of their privacy level.
[Op Report] From ClickFix SpaceX1337 to Hands-on-Keyboard AD Attack - PKB Communications LLC

This report details a sophisticated 72-hour intrusion campaign observed on a Deception.Pro Active Directory (AD) honeynet, which was configured to mimic a large U.S. financial institution.

### Executive Summary
The operation illustrates a dangerous evolution in threat actor tactics: an initial, seemingly automated "commodity" malware attack (ClickFix) that seamlessly pivots into a high-intent, human-operated, Active Directory-aware attack.

### Campaign Progression
* **Initial Access (Day 1):** The attack utilized a "ClickFix" social engineering lure. Users were directed to a spoofed financial website (`dobyfinancial[.]com`), which presented a deceptive security prompt. This prompt coerced the user into executing a `Win+R` -> `Ctrl+V` -> `Enter` command sequence, which launched the **SpaceX1337 RAT**.
* **Automated Phase:** Once established, the adversary deployed a multi-layered commodity toolkit, including **NetSupport**, a **Remus-class stealer**, and **AsyncRAT** (delivered via DLL side-loading).
* **Hands-on-Keyboard (HOK) Phase (Days 1–2):** Upon discovering the compromised machine was domain-joined, the threat actor shifted from automated theft to active engagement. They utilized interactive shells, performed extensive AD reconnaissance, and moved laterally, ultimately compromising a domain controller and attempting credential-stuffing against a seeded VPN portal.

### Security Implications
The primary takeaway is the danger of underestimating "commodity" malware. What appears to be a basic crypto-stealer can serve as a "Trojan horse" for sophisticated actors seeking deep access to domain environments. The ability of the adversary to pivot rapidly from commodity malware to complex AD exploitation poses a critical risk to production infrastructures.

### Technical Details
* **Infrastructure:** The campaign relied on decimal/numeric IP loaders and Cloudflare-fronted C2 traffic (`*.trycloudflare.com`) to mask infrastructure.
* **Living-off-the-Land (LotL):** The adversary made heavy use of native binaries (e.g., `certutil`, `bitsadmin`, `csc.exe`, `schtasks`, `reg`, `winrs`) to avoid detection.
* **AD Tradecraft:** The actor focused on high-value AD targets, including:
* Enumeration of computer objects, service accounts, and Service Principal Names (SPNs) for Kerberoasting.
* Targeting LAPS (Local Administrator Password Solution) and delegation paths using `DirectorySearcher`.
* Compiling an **AdaptixC2** beacon directly on the host using `csc.exe`.

### Defensive Recommendations
Defenders should treat ClickFix lures as a severe precursor to full-scale domain compromise.

| Category | Recommended Defensive Actions |
| :--- | :--- |
| **Detection** | Alert on `RunMRU` entries containing `powershell`, `iwr`, or `curl`. Flag `csc.exe` or `cvtres.exe` executions originating from user temporary directories. Monitor for unauthorized use of `reg save` on sensitive hives. |
| **AD Security** | Instrument and monitor LDAP queries targeting sensitive attributes like `info`, `description`, `ms-Mcs-AdmPwd`, and delegation attributes. |
| **Operational** | Avoid storing sensitive secrets in standard AD attributes (e.g., `description`, `info`); instead, use these fields as canary tokens. |
| **Network** | Monitor and inspect `*.trycloudflare.com` traffic for suspicious host-header rotation. Scan for DLL side-loading in signed binaries located within user `AppData` paths. |
Fabian Mosch: The Art of Evasion - Fabian Mosch

The provided summary of Fabian Mosch's presentation covers the key points regarding modern malware evasion techniques using LLMs. Below is the structured precis based on the information provided.

### **Precis: LLM-Assisted Malware Evasion**

#### **What Happened**
Fabian Mosch demonstrates an advanced methodology for bypassing contemporary security mechanisms. Moving beyond traditional evasion (polymorphism, string encryption), he outlines a workflow using Large Language Models (LLMs) to iteratively refine malware. By feeding malware code into an LLM, the system identifies Indicators of Compromise (IOCs) and automatically modifies the code to make it appear benign. This technique allows for the creation of binaries that successfully circumvent both traditional signature-based detection and sophisticated machine learning models like Ember 2024.

#### **Who is Affected**
* **Security Vendors & Defenders:** Organizations and products relying on automated malware analysis, machine learning (ML)-based Endpoint Detection and Response (EDR), and Antivirus (AV) tools.
* **Red Teams/Pentesters:** Professionals who can utilize these workflows to stress-test security controls.
* **Threat Actors:** Adversaries capable of using similar AI-driven workflows to automate the development of stealthy, "benign-looking" malware.

#### **Security Implications**
* **Decline of Traditional Evasion:** Simple obfuscation techniques are increasingly ineffective against modern ML-based security models.
* **AI as an Offensive Force-Multiplier:** The use of LLMs allows for rapid, automated iteration to hide malicious intent, significantly complicating static analysis.
* **Shift in Detection Paradigms:** The "cat and mouse" game is evolving; as detection models improve, attackers are increasingly embedding malicious payloads within authentic-looking code, metadata, and decoy functions to lower detection scores.

#### **Technical Details**
* **Analysis Types:**
* **Passive Analysis (e.g., Ember 2024):** Evaluates binary metadata, such as import tables, export tables, and entropy.
* **Active Analysis:** Involves reversing the binary, decrypting strings, and identifying runtime patterns like Process Environment Block (PEB) walking for API resolution.
* **Refinement Strategies for Evasion:**
* **API Obfuscation:** Avoiding direct calls to sensitive Windows APIs and employing multi-point, custom API resolution.
* **Decoy Integration:** Embedding legitimate "decoy" code and authentic imports with real parameters to bypass heuristic analysis.
* **Assembly-Level Masking:** Obfuscating malicious techniques, such as PEB walking, to remain undetected during code analysis.
* **Backdooring:** Legitimate binaries can be backdoored by keeping the entry point clean and delaying payload execution until a later, post-debugged runtime point.

#### **What Defenders Should Know**
* **Metadata Limitations:** Simply adding random imports to fool passive models is no longer sufficient, as active analysis tools can better understand code context.
* **Anticipate LLM-Driven Reversal:** While not yet standard in production, automated LLM-based malware analysis by attackers is the next major hurdle. Defenders must focus on identifying the "decoy" patterns often used to mask malicious intent.
* **The Myth of Language "Silver Bullets":** Switching to languages like Rust or Nim offers only a temporary advantage. As security vendors aggregate metadata on new languages, these buffers quickly erode, necessitating a shift toward behavioral, rather than purely static, detection.
Horcrux: AI Agent Skill to build secure, resilient , recoverable storage using Tahoe-LFS - AlloySecureGroup

Based on the documentation provided for the **Horcrux** project, here is a detailed précis of the tool, its operational model, and its security considerations.

### Overview: What is Horcrux?
Horcrux is a specialized utility designed to provide durable, resilient storage for AI agents. Its primary purpose is to solve the problem of data loss that occurs when AI environments—such as sandboxes or ephemeral containers—are reset or destroyed. By leveraging Horcrux, AI agents can persist, checkpoint, and restore their state across different sessions or environments.

### Technical Details
Horcrux is built upon **Tahoe-LAFS** (Least-Authority File System), a distributed, fault-tolerant, and secure storage system.
* **Architecture**: It utilizes client-side encryption, meaning data is encrypted by the agent before it leaves the environment. It then splits files into multiple "shares" that are distributed across independent storage servers.
* **Redundancy**: It employs a **K-of-N redundancy scheme**. This allows the original file to be reconstructed as long as any *K* number of the *N* total shares are accessible, even if some storage servers fail or go offline.
* **Workflow**: Agents generate a small state file containing an "introducer address" and a "root capability." This file acts as the primary key; the agent uses this to re-access its previous work, state, and checkpoints stored within the grid.

### Security Implications
* **Bearer Secrets**: The root capability held within the state file is a sensitive bearer secret. Anyone who obtains this file effectively gains full read and write access to all data associated with it. Consequently, this state file must be secured with the same level of protection as a private cryptographic key.
* **Resilience and Limitations**: While the tool is designed for durability, it is not inherently immune to failure.
* **Single-machine configurations** offer no protection against physical disk failures.
* **Share Decay**: Without active management, storage shares can decay over time due to hardware failures.
* **Irretrievability**: There is no secondary recovery mechanism; if the state file is lost, the data stored within the grid becomes permanently inaccessible.

### What Defenders Should Know
* **Environment and Version Constraints**: The implementation is sensitive to specific versions of its dependencies. Users must strictly adhere to specific versions (e.g., `pyopenssl==24.2.1`, `cryptography<44`, `service-identity==24.2.0`) to avoid potential crashes in the networking layer of the Tahoe-LAFS implementation.
* **Maintenance Requirements**: Defenders must proactively manage the storage grid. It is necessary to run maintenance commands, such as `tahoe deep-check --repair --add-lease`, to ensure that the number of available shares does not fall below the required recovery threshold.
* **Testing and Validation**: The repository includes a `tests/verify.sh` script. Defenders are encouraged to utilize the "self-test" mode, which automates the construction of a temporary grid to validate the entire lifecycle of the data, including storage, retrieval, checkpointing, and node failure recovery.