InfoSec Briefing - September 19, 2026

🎧 Audio Briefing

Playback Speed:

Security news from the BlueTeamSec community for Saturday the 19th of September 2026. I'm Tess.

I'm Sebastian. Australia's Cyber Security Centre has put out an advisory on WaterPlum, the North Korean group behind those fake recruitment campaigns targeting IT workers. They're going after developers in AI, crypto, and Web3, posing as employers and getting victims to run malicious code during fabricated technical interviews. One for anyone hiring remotely or working in those sectors.

ESET have written up SparroWocky, a new modular backdoor from the China-aligned group FamousSparrow. It replaced their previous implant last year and has been turning up at government targets across Latin America — Argentina, Ecuador, Guatemala, and several others. Advanced anti-analysis features and a habit of integrating open-source offensive tools once they're in.

NCC Group have documented a pair of denial-of-service attacks against WPA3, exploiting how the authentication protocol forces access points to do expensive cryptographic work before they even know who's connecting. The Cookie Guzzler variant is still viable, vendor fixes have been patchy, and the exploit tooling is now bundled into frameworks like airgeddon. Worth flagging if you're running WPA3 in any kind of high-density environment.

And finally, a researcher has published technical documentation and reverse engineering work on Microsoft's new Windows Endpoint Security Platform, which is appearing in Windows 11 Insider builds. It's a shift away from the old minifilter model towards in-kernel decision-making, so security vendors building endpoint products will need to understand this architecture sooner rather than later.

That's everything for today from BlueTeamSec. The articles are the work of their original authors — the analysis here was automated.

📰 Articles Covered

Beware the SparroWock: The backdoor that bites, the commands that catch - ESET

The ESET research article details the emergence of **SparroWocky**, a modular C++ backdoor developed by the China-aligned APT group **FamousSparrow**. Since August 2025, it has become the group's primary espionage tool, replacing their earlier implant, SparrowDoor 【1】.

### Summary of Findings

| Category | Details |
| :--- | :--- |
| **What Happened** | FamousSparrow transitioned to using the more sophisticated SparroWocky backdoor, integrating advanced anti-analysis techniques and open-source offensive tools. |
| **Who is Affected** | Primarily high-profile governmental entities across Latin America, specifically in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. |
| **Security Implications** | The shift highlights the group's increased technical sophistication, particularly in stealth and the ability to execute diverse post-exploitation tasks via integrated red-teaming frameworks. |

### Technical Details
SparroWocky is designed for stealth and high-level evasion within Windows environments:
* **Deployment:** Utilizes a "trident loader" involving DLL side-loading, where a legitimate executable is used to load a malicious, patched DLL that decrypts and maps the backdoor into memory.
* **Anti-Analysis & Stealth:**
* Employs **SilentMoonwalk/StackMoonwalk** to forge call stacks, effectively blinding security monitoring tools.
* Uses custom API hashing for dynamic function resolution and patches `AnimateWindow` to hide thread start addresses.
* Can camouflage its host processes by forging structures in the PEB (Process Environment Block) to mimic standard Windows behavior.
* **Functionality:** Beyond standard file management and command execution, it integrates tools like **Mbed TLS** for secure C&C (encrypted with RC4) and a modified **COFF Loader** to execute Beacon Object Files (BOFs).

### Guidance for Defenders
Defenders should prioritize the following actions to detect and mitigate potential compromises:
* **Detection Vectors:** Monitor for suspicious DLL side-loading activity and inspect files for the specific 4-byte magic header `0x11328712`, typically found in `.dat` payload files.
* **IoCs and Tools:** ESET has released Indicators of Compromise (IoCs), including hashes for the loaders/backdoors and known C&C server IPs, as well as a decryption script for the payload files available on the [ESET Malware IoC GitHub repository](https://github.com/eset/malware-ioc/tree/master/famoussparrow/) 【1】.
WPA3 Denial of Service: SAE Resource Exhaustion - NCC Group

The following precis details the findings regarding Denial of Service (DoS) vulnerabilities in WPA3-SAE, as documented by NCC Group.

### What Happened
Despite WPA3's improvements over WPA2, the Simultaneous Authentication of Equals (SAE) protocol introduces a distinct DoS attack surface. Because SAE requires the Access Point (AP) to perform significant cryptographic processing and maintain authentication state *before* a peer is fully authenticated, an attacker can force the AP to expend excessive resources. This article revisits early research like "Dragon Drain" and highlights "Cookie Guzzler," an attack that specifically weaponizes the protocol's own anti-clogging mechanism against it.

### Who is Affected
* **Infrastructure:** Wi-Fi access points (APs) and wireless stacks that handle SAE handshakes.
* **Vulnerability Distribution:**
* **Dragon Drain:** Most actively maintained, modern equipment has been patched over the years to prevent this. However, it remains a "useful indicator of implementation quality"—if a device is still vulnerable to this early attack, it signals poor maintenance or incomplete firmware updates.
* **Cookie Guzzler:** This attack has received less industry remediation. It remains a relevant threat to many devices, as public awareness and vendor-provided patches are less mature than those for Dragon Drain.

### Security Implications
These attacks are **not password-recovery attacks**; the attacker does not need to crack the network password. The objective is availability degradation. Successfully exploiting these vulnerabilities causes the AP to become overwhelmed by crafted authentication traffic, leading to effects ranging from intermittent connectivity loss to complete disconnection of legitimate clients.

The security context has shifted: these attacks have moved from academic papers into the reach of practical, automated tooling (e.g., via the `airgeddon` framework), significantly lowering the barrier to exploitation.

### Technical Details
* **SAE Asymmetry:** SAE authentication consists of a "Commit" and a "Confirm" exchange. The AP must commit resources to a peer before it knows if the peer is legitimate.
* **Dragon Drain:** Injects forged SAE Commit messages to force the AP into expensive cryptographic processing.
* **Cookie Guzzler:** Abuses the **Anti-Clogging Mechanism (ACM)**. By reusing mathematically valid (but password-incorrect) Scalar and Finite Field Element values from a previous SAE attempt, the attacker creates "valid enough" Commit frames. These frames bypass basic malformation checks and force the AP's defensive state machine to process and hold state for the attack, turning the defense into an exploit primitive.

### What Defenders Should Know
* **Updates are Essential but Incomplete:** While keeping firmware updated is critical to mitigate known flaws like Dragon Drain, it may not be sufficient against newer or less-remediated techniques like Cookie Guzzler.
* **Hardware Limitations are Not Mitigations:** While high-performance hardware may sustain an attack for longer before failing, increased CPU capacity does not fix the underlying vulnerability.
* **Redefine Threat Assessment:** Security testers and defenders should stop asking only if an attacker can authenticate without a password. The critical question for availability is: *"How much work can an attacker force the AP to perform before proving they know the password?"*
* **Monitor Tooling:** The existence of accessible plugins for security auditing frameworks (like `airgeddon`) means these vulnerabilities are now trivial to test. Defenders should use these tools to proactively audit their own wireless infrastructure.
wesp-research: Technical documentation, reverse engineering research, and tools for the Windows Endpoint Security Platform (WESP). - marcosd4h

The Windows Endpoint Security Platform (WESP, or ESP) represents a significant architectural shift in how Windows handles endpoint security. Introduced in Windows 11 Insider Preview builds (25H2, builds 10.0.29641 to 10.0.29667), WESP transitions the operating system from traditional, synchronous minifilter round-trips to an in-kernel decision-making model 【1】.

### What Happened
Microsoft has implemented WESP to improve system stability and performance in security monitoring. By shifting security logic from user-mode services into the kernel, WESP removes the need for constant, synchronous communication between the kernel and user space for every security event 【1】.

### Who Is Affected
* **Users/Developers:** Primarily those running Windows 11 Insider Preview builds 10.0.29641 to 10.0.29667 【1】.
* **Security Vendors:** Organizations developing Endpoint Detection and Response (EDR) or security products will need to adapt to this new, asymmetric architecture to maintain visibility and enforcement capabilities on future Windows versions 【1】.

### Security Implications
* **Performance and Stability:** Traditional designs often suffer from latency spikes, deadlock risks (especially during paging operations), and potential system hangs if the security service crashes. WESP aims to mitigate these by moving evaluation into the kernel 【1】.
* **Enforcement:** Security policies are now evaluated using pre-compiled binary decision graphs directly in the kernel during pre-operation callbacks, allowing for immediate blocking before operations reach the filesystem or process manager 【1】.

### Technical Details
WESP operates through three distinct planes:
* **Control Plane:** Manages sessions and rule sets via the `\EspFilterPort`. It authenticates security agents and transmits compiled rules into the kernel 【1】.
* **Data Plane:** Intercepts 47 different event types across five kernel subsystems (Process, Object, Configuration, Filter, and Transaction Managers). It evaluates rules in-kernel and returns blocking statuses (e.g., `STATUS_ACCESS_DENIED`) as necessary 【1】.
* **Telemetry Plane:** Uses memory-budgeted kernel queues for asynchronous, non-blocking event reporting to user-mode listeners, ensuring that telemetry collection does not stall monitored applications 【1】.

### What Defenders Should Know
Defenders and researchers can utilize the `esptool` C++20 research harness (provided in the repository) to gain familiarity with the platform:
* **Policy Testing:** You can deploy XML-based rules to test blocking capabilities, such as preventing specific file paths or process executions 【1】.
* **Lifecycle Management:** Rules can be set as `transient` (removed upon client disconnect) or `persistent` (retained across restarts), which is critical for understanding both operational workflows and tamper resistance 【1】.
* **Visibility:** Defenders can use WESP to inspect kernel object handles and runtime identity metadata for entities like processes, threads, registry keys, and tokens 【1】.
North Korean "WaterPlum," commonly referred to as “Contagious Interview,” cyber actor group targeting IT professionals - Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC)

The information provided in your summary effectively covers the key aspects of the advisory regarding the North Korean cyber actor group **WaterPlum** (also known as **Contagious Interview**).

To ensure a comprehensive precis based on the source material, I have supplemented your summary with additional technical details and strategic defensive considerations from the full advisory.

### Updated Precis: WaterPlum (Contagious Interview) Advisory

#### What Happened and Who is Affected
WaterPlum is a North Korean state-sponsored actor group linked to the 313 General Bureau. They target global IT professionals—specifically developers in AI, cryptocurrency, and Web3—through recruitment platforms and social media. By masquerading as employers, they induce victims to execute malicious code under the guise of technical interviews or troubleshooting. Beyond individual victims, they operate "laptop farms" to help North Korean IT workers secure legitimate employment, thereby generating revenue for the regime while masking their true location and identity.

#### Security Implications
The primary risks extend well beyond initial cryptocurrency theft:
* **Corporate Compromise:** Infiltration often serves as a foothold for lateral movement, facilitating long-term espionage and intellectual property theft.
* **Identity Fraud:** Stolen identities are repurposed to facilitate further malicious employment schemes.
* **Operational Security (OPSEC) Erosion:** Access to corporate networks allows for the exfiltration of sensitive communications and strategic business data.

#### Technical Details
The group demonstrates sophisticated use of development-focused toolchains for initial access and persistence:
* **Execution Vectors:** Malware is frequently delivered via malicious npm packages or trojanized VS Code projects.
* **Malware Families:**
* **BeaverTail:** A JavaScript-based downloader/infostealer.
* **InvisibleFerret:** A Python-based backdoor used for reconnaissance and data exfiltration.
* **OtterCookie / OtterCandy:** RATs/stealers designed to compromise web browser cookies and session data.
* **StoatWaffle:** A Node.js malware family that leverages the VS Code "trusted workspace" feature to execute malicious tasks automatically upon project loading.

#### What Defenders Should Know
Defenders, including hiring managers and security teams, should implement the following strategies:

| Focus Area | Mitigation Strategy |
| :--- | :--- |
| **Recruitment** | Conduct rigorous background checks and identity verification. Be suspicious of candidates using VPNs to mask IP locations or those avoiding video/in-person verification. |
| **Development Environments** | Strictly enforce the use of **Restricted Mode** in VS Code. Manually inspect configuration files (e.g., `.vscode/tasks.json` and `.vscode/settings.json`) for unauthorized or obfuscated scripts before opening any project. |
| **Endpoint Security** | Utilize EDR solutions to monitor for suspicious process spawns originating from dev tools. Isolate all "sandbox" or test environments from the primary corporate network. |
| **Incident Response** | If an infection is suspected: Disconnect the device immediately. Treat all stored credentials and local data as compromised. Perform a hardware-level wipe or replace the machine entirely; do not attempt to "clean" the OS. |
| **Access Control** | Enforce the principle of least privilege, ensuring contractors or new hires only have access to the specific repositories necessary for their initial tasks. |

***

*Source: [North Korean WaterPlum (commonly referred to as Contagious Interview) cyber actor group targeting IT professionals](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/north-korean-waterplum-commonly-referred-to-as-contagious-interview-cyber-actor-group-targeting-it-professionals)*