Security news from the BlueTeamSec community for Sunday the 6th of September 2026 โ quite a busy one, with sixteen stories to get through.
Datadog have written up a password-spraying campaign that targeted AWS root user accounts across more than a hundred and fifty organisations between July and August. Attackers used residential proxies and pre-compiled lists of root account email addresses to conduct automated login attempts. We covered related AWS detection guidance and credential leak findings at the end of August, so this adds useful operational detail to that thread.
Elastic have published detection guidance for fileless execution on Linux using the memfd_create system call. Attackers are increasingly using this technique to run malicious payloads entirely in memory, bypassing traditional disk-based security controls โ it's been observed in cryptominers, rootkits, and supply chain attacks. One for anyone building Linux detection rules.
Thinkst have released Agent Provocateur, a canary token designed to detect and manipulate autonomous AI agents conducting network reconnaissance. The tool exploits goal-oriented AI logic to force agents to reveal their presence and capabilities by engaging them in what looks like helpful interaction but is actually a defensive trap. Worth a look if you're thinking about threats from agentic systems.
BushidoToken have profiled ExfilSquad, a newly identified cybercriminal group conducting pure extortion attacks without ransomware. They've been exploiting misconfigured internet-facing assets to steal data from major UK public sector organisations โ the Department for Education, Newcastle University, and the Police National Legal Database among them โ then distributing stolen records via peer-to-peer torrents to force compliance.
Kaspersky Lab report that Toy Ghouls โ also tracked as Bearlyfy or Feral Wolf โ have moved from commodity ransomware to custom backdoors they're calling Bird Agents. Since July, the group has been targeting Russian organisations using malware that communicates via legitimate services like HiveMQ and Element messenger, and masquerades as Windows services for persistence.
AhnLab identified a Kimsuky campaign targeting South Korean users with malicious LNK files disguised as a seafood purchase request for Royal Hotel Seoul. The attack deploys PowerShell and JavaScript payloads that establish persistence via scheduled tasks and use Backblaze cloud storage as command and control infrastructure. We've seen similar delivery methods from this group before, most recently at the start of the month.
Rapid7 Labs discovered a sophisticated Linux malware framework comprising the ted backdoor and curlRAT, targeting South Korea's automotive and media sectors. The campaign is attributed with medium confidence to DPRK-aligned groups and uses compromised load balancers and trojanised Linux utilities for espionage and credential harvesting.
The BindsNET repository was compromised between the 29th of August and the 2nd of September when attackers force-pushed malicious code containing a Visual Studio Code tasks file that executed obfuscated JavaScript. The attack targeted developers using VS Code, Cursor, or VSCodium with Node.js installed, achieving persistent execution via a second-stage payload delivered through Ethereum blockchain endpoints โ which is either creative or overkill, depending on your perspective.
Microsoft Threat Intelligence identified a social engineering campaign where attackers impersonate IT support via Teams to trick employees into granting remote access. They deploy a malicious installer containing a Node.js runtime and encrypted JavaScript implant that uses long-polling for command and control, enabling reconnaissance and lateral movement to domain controllers. We saw related ScreenConnect and Teams activity earlier in the week, so this is part of a broader pattern.
A security researcher documented a method to obtain and host content on domains within the ip6.arpa namespace โ infrastructure-reserved space โ by chaining IPv6 prefix allocation, DNS delegation, and hosting services that fail to verify ownership. It's a clever abuse of lax validation in registration services, though the practical impact is mostly theoretical.
Synacktiv developed lightweight Python implementations of LDAP and SMB services using Scapy to simulate legitimate Active Directory infrastructure for offensive research. The tools enable GPO poisoning attacks by manipulating Group Policy Container attributes to redirect domain-joined Windows clients to attacker-controlled servers, achieving system-level execution. Useful technical detail if you're testing or defending against GPO-based attack vectors.
NetSPI disclosed a privilege escalation vulnerability in Azure's built-in Anyscale Platform Administrator role that allowed escalation to subscription-level Owner. The issue stemmed from missing attribute-based access control conditions on role assignment permissions and was discovered using preview ARM API versions. Microsoft remediated it on the 22nd of June. The research highlights that built-in Azure roles need the same scrutiny as custom ones โ we covered related Azure priv-esc techniques back in August.
A new open-source tool called pstrings, written in Rust, extracts readable strings from binary data at significantly higher speed than traditional utilities โ fourteen seconds versus sixty-four minutes for a five-and-a-half gigabyte file. It's designed for digital forensics and supports multiple character encodings with configurable filtering to reduce false positives.
CouchPotato is a privilege escalation tool that abuses impersonate privilege to elevate service accounts to system level on Windows. It employs evasion techniques including ETW and AMSI patching, indirect syscalls, and compile-time obfuscation to bypass endpoint detection. Another in the long line of potato exploits โ this one's technically interesting but the underlying technique is well-trodden ground.
Mythic Ornn is an LLM-driven generator that automates the creation of custom Mythic command and control framework agents, payload types, and profiles. The tool uses local Mythic documentation as a retrieval layer to generate compliant agent code, significantly lowering the barrier to producing unique, ephemeral agents at scale โ which complicates static signature-based detection. We saw related research on Mythic protocols and LLM-driven attack tooling late last month.
And finally, a write-up on how Forza Horizon 6's anti-cheat system employs aggressive anti-reverse engineering techniques including mutex hijacking and process metadata blacklisting. The game scans the entire system for tools like IDA Pro and actively sabotages them by holding critical mutexes indefinitely, preventing normal operation even when those tools aren't targeting the game itself. Overkill, but undeniably thorough.
That's everything for today from BlueTeamSec. The articles are the work of their original authors โ the analysis here was automated as always.