Security news from the BlueTeamSec community for Monday the 21st of September 2026. It's a busy one, with thirty stories — we'll start with threat intelligence and work through the rest from there.
CrowdStrike have documented PhantomRaven, an information stealer written entirely by a large language model and distributed through typosquatted npm packages. The malware targets developer environments to harvest credentials, which the actor then uses to fraudulently submit bug reports to bounty programmes and collect payouts — at least nine organisations have been affected since late 2022.
Socket have written up PolinRider, a supply-chain attack where North Korean actors compromised a GitHub account and injected malicious code into a Laravel package with over seven hundred thousand downloads. The technique includes Git history manipulation and IDE auto-execution via a hidden tasks file — worth flagging if you're tracking DPRK supply-chain tactics.
Silent Push exposed North Korean IT workers using Discord servers to recruit proxies in the West and Latin America, who handle job interviews whilst the actual work is performed remotely from Pyongyang. Sixty-five percent of salaries are routed back via cryptocurrency, and the arrangement creates obvious insider risks around data exfiltration and IP theft.
Two reports from NTT Security Japan cover WaterPlum, a sophisticated group deploying multiple malware families including OtterCookie and StoatWaffle in targeted attacks. The actor demonstrates persistent refinement of their toolset, focusing on credential theft and long-term access — one for threat intelligence teams tracking advanced espionage activity.
Hunt Intelligence identified SilkParasite, a unified espionage infrastructure active since mid-2022 targeting energy and government entities across Central Asia. The operation deploys SpiceRAT and related malware against Turkmen gas infrastructure and regional ministries, with TLS certificates suggesting links to Chinese state interests.
ESET have documented SparroWocky, a modular backdoor used by the FamousSparrow group in espionage campaigns against Latin American governments. The malware features runtime code patching and DLL side-loading via what the researchers call a trident loader strategy — adds useful context if you're tracking this actor.
Group-IB reported on HEAVYGRAM, a surveillance backdoor attributed to Handala Hack that uses Telegram as command-and-control infrastructure. The malware deploys via trojanised software and leverages Telegram's encryption for resilience — particularly relevant if you're monitoring Middle Eastern threat activity.
The FBI and international partners seized domains tied to NightmareStresser, a long-running booter service linked to hundreds of thousands of DDoS attacks worldwide. The action is part of Operation PowerOFF, targeting the infrastructure that enables low-skill actors to launch volumetric attacks against institutions and gaming platforms.
Kaspersky documented MovieReaper, a modular crimeware framework distributed through compromised torrent files, particularly for popular films. The malware uses the Solana blockchain as a resilient C2 distribution layer and deploys a file manager module with extensive exfiltration capabilities — notable for the blockchain abuse angle.
Elastic have analysed KREMLIN, a Brazilian banking malware operation deploying malicious browser extensions to compromise financial accounts. The campaign has infected over fifteen hundred victims, almost all in Brazil, and uses Ethereum smart contracts for dynamic C2 infrastructure — which is either impressively resilient or needlessly complicated, depending on your perspective.
Onto tooling. Security researchers analysed the IPC protocol used by Claude Code for local cross-session messaging, which relies on named pipes and session key authentication. Multi-user environments face higher risk, as the security model depends entirely on OS-level access controls and the integrity of session key files.
A panel discussion at RECON 2026 explored how AI is transforming reverse engineering and vulnerability research. The experts highlighted AI as a force multiplier for tasks like patch diffing, but emphasised human judgment remains critical for complex security analysis — useful background if you're evaluating AI tooling for your own workflows.
Researchers released NTLMScout, a reconnaissance tool that exploits information leakage in NTLM authentication to map internal Active Directory environments without credentials. The tool extracts NetBIOS names, forest structures, and internal IPs from NTLM challenge messages across multiple services — one for red teams and those auditing external NTLM exposure.
OpenSourceMalware documented WeaselBiscuit, a campaign using compromised and typosquatted npm packages to deliver an infostealer. The malware operates entirely in memory, fetching payloads from Npoint hosting and targeting browser-based wallet data — particularly relevant for organisations with developer environments pulling from public registries.
A technical guide from a security researcher covers dynamic analysis of Windows kernel-level rootkits without source code or debug symbols. The methodology focuses on identifying the driver entry function by setting breakpoints on kernel functions during the OS loading process — useful if you're working in malware analysis or incident response involving kernel threats.
Three proof-of-concept tools demonstrate reflective loading techniques for Windows. The first is a minimal PE mapper that loads DLLs directly from memory, bypassing LoadLibrary to evade API monitoring. The second covers implementing hot-swappable plugin systems in C++ using the same approach. Both are aimed at red teamers, though defenders will want to understand the techniques for detection engineering.
A Windows userland tool called ALPC-Enumerator enumerates Advanced Local Procedure Call ports, including those protected by Protected Process Light mechanisms that standard security tools can't access. The tool dynamically resolves object-type indexes and uses fallback mechanisms to bypass access-denied errors — worth a look if you're investigating inter-process communication abuse.
A technical guide demonstrates development of Beacon Object Files for Dark-Agent, a macOS command-and-control payload running on the Mythic framework. The technique enables in-memory execution of modular tools on Apple Silicon, bypassing file-based detection by executing within existing beacon processes.
Onto offensive tooling. Researchers released ResetSpy, which exploits Microsoft's Self-Service Password Reset portal to enumerate Entra ID accounts and identify registered authentication methods. Administrator accounts are particularly vulnerable, as they're always SSPR-enabled regardless of tenant policy — flag this if you're auditing external identity exposure.
Security researchers discovered that WerEnc.dll, a Microsoft-signed Windows Error Reporting library, can be weaponised as an attacker-controlled encryption primitive. By patching the hardcoded RSA public key in memory before encryption operations, attackers can leverage trusted system binaries for strong encryption whilst evading security controls that flag custom cryptographic implementations.
A tool called adnullenum automates reconnaissance of Active Directory environments through unauthenticated SMB null sessions. It queries SAMR and LSARPC named pipes without credentials, targeting organisations with permissive AD configurations that allow anonymous SMB — one for penetration testers and those auditing legacy network shares.
Onto vulnerabilities. Datadog disclosed a high-severity flaw in Vector's logstash source component that allows unauthenticated attackers to crash the observability pipeline with a specially crafted payload exploiting stack exhaustion. All versions from 0.15.0 to 0.57.0 are affected — upgrade to 0.57.0 or implement network isolation as mitigation.
Aftermath Labs disclosed denial-of-service vulnerabilities in Discord Desktop discovered through binary instrumentation and fuzzing. Malformed WebM files cause renderer crashes via a Vorbis decoder miscalculation, whilst crafted M4A files trigger memory exhaustion up to six-point-six gigabytes through MP4 sample table manipulation.
Check Point disclosed a critical vulnerability in Security Management and Log Servers that allows unauthenticated remote code execution with root privileges. The flaw exists in the authentication flow affecting standalone Manager-Gateway deployments, though no active exploitation has been reported — patches are available via LivePatch.
On the defence side, GitHub released a new security feature called cache-mode for GitHub Actions that enables least-privilege access control to the actions cache. Developers can now explicitly configure cache access levels to mitigate cache poisoning risks and prevent untrusted workflows from overwriting valid entries with malicious dependencies.
The Sysmon Modular project has been redesigned with a native Go-based toolkit to replace legacy script-based management of Microsoft Sysmon configurations. The new modular approach enables programmatic management of endpoint telemetry and includes modules targeting modern threats like AI agents and security control tampering — worth evaluating if you're maintaining Sysmon at scale.
And finally, JPCERT have issued a Call for Papers for JSAC2027, a technical security conference focused on malware analysis, forensics, incident response, and threat intelligence. Submissions are open for those working in security research and analysis.
That's all for today. The articles are the work of their original authors — the analysis here was automated. We'll be back with the next briefing soon.