Security news from the BlueTeamSec community for Monday the 24th of August 2026. It's a busy one, with twenty-one stories — we've got everything from supply chain attacks on Rust crates to malware targeting car head units, so let's get into it.
Datadog Security Research have written up the N4D Mesh Controller campaign — threat actors are exploiting unauthenticated Model Context Protocol servers to deploy a UPX-packed Go agent that does reconnaissance, lateral movement, and credential theft. This follows the MCP supply-chain campaign we covered just ten days ago, so if you're running exposed MCP infrastructure connected to AI or LLM stacks, flag this one.
Kaspersky discovered the first Android malware targeting automotive head units — it's attributed to the MoYu Group, who are linked to the BADBOX botnet. The malware hijacks a firmware update mechanism in DoFun Android-based head units and turns your car into a proxy botnet node that also runs ad fraud. Properly grim if you've got aftermarket Android units in fleet vehicles.
An investigation into NoSugarTech — a Chinese security company led by a researcher who goes by Only_Guest — reveals ties to state-aligned cyber operations through connections to Sichuan Silence and the Double Helix Research Institute. The company was implicated in the i-SOON leak data earlier this year, showing its role supplying vulnerability research and exploits to contractors involved in espionage and influence operations. Worth reading if you're tracking Chinese APT supply chains.
ENKI WhiteHat have a detailed write-up on Kimsuky's spear-phishing campaigns in early 2026 targeting organisations in South Korea and Japan. The North Korean group abused legitimate remote admin tools like Chrome Remote Desktop and AnyDesk for persistence, deployed a malicious Chrome extension to harvest Gmail, and exfiltrated data from Outlook and Thunderbird clients — all while staying under the radar with living-off-the-land techniques.
Aikido and the Rust Security Response Team both reported on a supply chain attack targeting three popular Rust crates — arrayref, append-only-vec, and internment. Attackers, likely linked to the DPRK-affiliated Sapphire Sleet group, injected a malicious typosquat dependency that deployed cross-platform infostealer malware during build processes. It harvests browser credentials, crypto wallets, and establishes persistent backdoor access on developer machines. The Rust team yanked the malicious versions within about ninety minutes, but if your CI/CD pulled these between August twentieth and the mitigation, worth auditing what got built.
CISA have issued an alert on active exploitation of internet-exposed Siemens SIMATIC S7 PLCs across critical infrastructure sectors. Attackers are leveraging AI-assisted tools and open-source libraries like snap7 to gain unauthorised access, extract configurations, and potentially manipulate industrial processes via the S7comm protocol on TCP port 102. CISA covered the same threat on the twenty-first, so this is the follow-up with additional hunting guidance.
eSentire TRU identified two MaaS platforms — ErrTraffic and Cruciferra — that are being actively used to deploy infostealers while killing EDR and antivirus processes. ErrTraffic uses compromised WordPress sites with ClickFix lures and Polygon blockchain for C2, whilst Cruciferra employs a bring-your-own-vulnerable-driver attack to terminate a hundred and forty-five security processes before deploying the Remus stealer. Both use process hollowing and DLL side-loading to inject into Microsoft-signed binaries. One for detection engineers looking at BYOVD patterns.
Expel have written up SynkLoader, a sophisticated modular malware family discovered in August. It's distributed via Microsoft Teams phishing campaigns and uses a multi-language execution chain — Python, C#, PowerShell — with in-memory operations and custom ChaCha20 encryption for C2. Modules include a credential-harvesting fake lock screen called PhishLocker, a system profiler, backconnect proxy, and RAT capabilities. The Active Directory profiling suggests it's being used by ransomware groups or initial access brokers.
A security researcher discovered that Windows 11 intentionally disables Supervisor Mode Access Prevention during standard system calls because full SMAP enforcement would cause twenty to forty percent performance regressions. Microsoft executes a 'stac' instruction in the system call path to turn it off, which means SMAP can't be relied upon as a security boundary against kernel-mode attackers on Windows. Properly deflating if you were counting on it.
NCC Group analysed CVE-2025-22226, an out-of-bounds read vulnerability in VMware's Host Guest File System affecting Workstation, ESXi, and Cloud Foundation. An attacker in a guest VM can leak memory pointers from the VMX process by sending a malformed payload during drag-and-drop session creation. VMware have released patches for affected versions.
Researchers published NachoMDM, a technique that weaponises Windows MDM enrollment to achieve UAC bypass and SYSTEM-level code execution. By tricking local administrators into navigating to a malicious ms-device-enrollment URI, attackers can enroll devices into rogue MDM servers and silently deploy malicious MSI packages with SYSTEM privileges. This affects Windows devices with local admin users that aren't already enrolled in authorised MDM solutions.
A proof-of-concept tool called mora-hwbp demonstrates hardware breakpoint-based function hooking using x86 debug registers to bypass Windows security instrumentation including AMSI, WLDP, and ETW. The technique avoids memory modification entirely by leveraging CPU debugging features and Vectored Exception Handlers, making it stealthy against traditional EDR detection methods that rely on identifying patched code.
Security researchers discovered a vulnerability in Google Chrome Enterprise MSI installers that allows attackers to modify signed binaries post-signing by altering 'tag' data within the certificate blob. The modified installer maintains a valid Authenticode signature, bypassing SmartScreen, AppLocker, and WDAC, then enrolls browsers into attacker-controlled enterprise tenants for remote code execution via policy enforcement. Properly sneaky abuse of a trusted mechanism.
Matt Green released a VQL artifact for detecting persistence mechanisms that abuse Chromium-based browser extensions and Native Messaging Hosts on Windows. The tool hunts for techniques like SilentChrome, where attackers leverage legitimate browser extension capabilities to maintain stealthy access, execute arbitrary code, and bridge the browser sandbox to the underlying OS.
An open-source EDR project for Linux called neEDRe has been released, built using the Aya Rust eBPF library. It monitors process execution behaviour with current focus on detecting suspicious executions from paths like /tmp, running as a systemd service with logging to standard Linux audit channels. It requires Linux kernel 5.8 or later and root privileges — limited scope compared to enterprise solutions, but useful if you're building your own telemetry stack.
Researchers conducted interviews with twenty SOC practitioners to evaluate LLM integration in security operations. The study found that whilst LLMs are useful for low-stakes tasks like log summarisation, practitioners remain sceptical of using them for high-stakes decision-making due to hallucinations, opaque reasoning, and the risk of propagating incorrect information into incident reports and detection strategies. Worth a read if you're evaluating where to deploy AI tooling in your SOC.
Christopher Domas released hexcymatix, a research tool that automates the identification of hidden structural patterns within binary files by analysing and visualising repeated byte sequences. It enables reverse engineers and malware analysts to discover similar data regions — structs, compressed data, protocol payloads — without writing formal parsers, which should accelerate binary analysis workflows.
XPEViewer is an open-source Portable Executable file viewer and editor for Windows, Linux, and macOS, used by security professionals for static analysis and malware research. It integrates disassembly, YARA scanning, file signature identification, and hash calculation for examining binaries without execution. This is a legitimate defensive and analysis tool rather than a security incident.
The Whispergate project released a Command and Control profile for the Mythic framework that enables covert peer-to-peer communication between compromised hosts using the Link Layer Discovery Protocol at Layer 2. The tool embeds malicious traffic within Organizationally Specific TLVs of LLDP frames, allowing attackers to perform lateral movement within broadcast domains whilst evading Layer 3 network monitoring and security controls. It requires a bridge agent for communication back to the Mythic server and works on Linux and Windows systems with appropriate network access.
And that's your briefing for today. Attribution goes to the original authors — the analysis here was automated. We'll be back tomorrow.