InfoSec Briefing - November 05, 2026

🎧 Audio Briefing

Playback Speed:

This is the security briefing for Thursday the 5th of November 2026, drawn from the BlueTeamSec community on infosec.pub. Six stories to get through today.

ESET Research have written up Gorbag, a Russian-linked espionage group targeting Ukrainian law enforcement, government, and defence organisations. They're using spearphishing and a WinRAR vulnerability to deploy infostealers and reverse shells, exfiltrating credentials and VPN configs via Telegram. Aligns with what we've been seeing from Russian-attributed groups targeting critical infrastructure in the region over the past few weeks.

Matt Kirkland has a quietly brilliant piece on ClockTail, a ClickFix social engineering kit that displays fake Cloudflare verification pages to trick users into running commands via Windows Run. The catch: analysis of 245 compromised hosts found that 243 were misconfigured with an unfilled variable, so victims ended up pasting harmless HTML instead of malware. The infrastructure's still live, though, so that could change.

OPSSHIELD have disclosed a supply chain compromise affecting the CPGuard security software update channel. Malicious updates were pushed to versions 5.88.12 through 5.88.19, exfiltrating shadow files, SSH credentials, and database configs from around 32 servers, with backdoors installed for persistence. We covered a similar incident involving Bash update mechanisms at the start of the month.

Google and partners have disrupted the XCPE botnet, which compromised over 1.3 million Android IoT devices including set-top boxes and telehealth equipment. The malware was pre-installed in firmware by manufacturer Videostrong Technology, who sold access to criminal affiliates for proxy networks and ad fraud. Worth flagging given the scale and the fact that the infection was baked into the supply chain from the outset. We saw a related Hugging Face malware campaign return after takedown earlier in the week.

The Department of Homeland Security issued an order on the 30th of October to exclude and remove all Acronis products from federal civilian executive branch IT systems. The decision is based on supply chain risk concerns related to the elevated privileges that Acronis data protection software requires, which could present unacceptable risk if compromised. Acronis has appeared in our coverage before, particularly around exploitation of Gitea flaws in September.

And finally, Arcanum have released SpikeStrip, an experimental defensive tool that injects fake vulnerabilities and misleading comments into HTML and JavaScript source code to deceive AI-driven automated scanners. The idea is to confuse tools like ARTEX with fabricated leads referencing bogus SQL injection flaws and historical CVEs. One for defenders dealing with agentic reconnaissance frameworks, which we've been tracking closely since late October.

That's all for today. Attribution sits with the original article authors — the analysis here was automated.

📰 Articles Covered

Gorbag: Orcs at the border harvesting intelligence from Ukraine - ESET

The activity attributed to the threat group identified as "Gorbag" represents a sustained and focused cyberespionage campaign targeting Ukrainian entities. ESET Research has detailed this operation, highlighting how the group achieves significant intelligence collection through a combination of straightforward tools and evolving delivery methods.

### Overview of Operations
Gorbag is a threat actor engaged in intelligence harvesting within Ukraine. The campaign is characterized by its high degree of alignment with Russian strategic priorities, focusing on sectors critical to the Ukrainian state and its defense efforts.

### Affected Targets
The group exclusively targets Ukrainian organizations. The primary sectors impacted include:
* **Law Enforcement and Justice:** Entities responsible for legal and judicial processes.
* **Governmental:** Local administrations, particularly those located near the front line.
* **Defense Sector:** Military-related organizations.
* **Logistics:** Key transportation hubs involved in the movement of foreign military aid.

### Technical Details
Gorbag employs a streamlined toolset designed to facilitate rapid exfiltration while minimizing the group's digital footprint.

* **Initial Access:**
* **2025:** Relied heavily on spearphishing, utilizing malicious attachments such as macro-enabled Excel spreadsheets.
* **2026:** Shifted to weaponized RAR archives, exploiting a WinRAR path traversal vulnerability (CVE-2025-8088).
* **Key Tooling:**
* **Prime ReverseShell:** Used early in the campaign (through February 2025). It famously included a deceptive comment attempting to mask its function as a prime number generator to evade security analysis.
* **BeautyStealer:** The group’s primary exfiltration tool, a C++ infostealer (versions 0.9–2.0). It targets browser-based credentials (cookies, passwords) and scans file systems for sensitive information including VPN configurations, electronic signature keys, and a wide array of documents (e.g., `.docx`, `.pdf`, `.kdbx`, `.pfx`, `.ovpn`).
* **Exfiltration:** Data is archived locally and exfiltrated via Telegram’s API or a custom FastAPI-based C&C server.

### Security Implications
The Gorbag operation serves as a reminder that highly effective espionage does not require advanced, complex malware. By focusing on reliable delivery mechanisms and specific, high-value data targets, the group achieves long-term access and intelligence theft. Their ability to adapt their delivery strategy—from macros to path traversal exploits—shows a commitment to maintaining access in a contested environment.

### Guidance for Defenders
To mitigate the threat posed by Gorbag, security teams should implement the following defensive measures:
* **Patching & Updates:** Prioritize remediation of known vulnerabilities used for initial access, such as the WinRAR path traversal flaw (CVE-2025-8088).
* **Endpoint Security:** Implement strict policies against macro-enabled documents and monitor for the execution of unauthorized PowerShell scripts or suspicious child processes from archiving software.
* **Data Monitoring:** Configure alerting for unauthorized access to or collection of the specific file extensions targeted by BeautyStealer (e.g., VPN configs, password database files, and office documents), especially on endpoints within sensitive government or defense environments.
* **Threat Intelligence:** Utilize the Indicators of Compromise (IoCs) and malware samples provided by ESET in their dedicated [GitHub repository](https://github.com/eset/malware-ioc/tree/master/gorbag) to proactively hunt for traces of this activity in your environment.
ClockTail: a ClickFix kit that never filled in its command | Ohey - Matt Kirkland

This report provides a summary of the "ClockTail" research findings regarding a widespread ClickFix campaign discovered in late 2026.

### What Happened
ClockTail is a "ClickFix" campaign that deceives users by displaying a fake Cloudflare verification page. The lure instructs visitors to copy a malicious command and paste it into their Windows "Run" box.

However, in 243 out of 245 cases analyzed, the kit was improperly configured. Instead of copying a functional malicious command, the script failed to find the intended command file. As a result, the script fetched the host's own webpage and copied the entirety of that site's HTML (approximately 317 KB) to the user's clipboard. If a user followed the instructions, they would paste the website's raw HTML into the Windows Run box rather than executing a malicious payload. Only one observed instance (on `oneai[.]icu`) was correctly configured with a valid command path.

### Who Is Affected
The campaign impacted 245 hosts identified between July 28 and November 3, 2026, with 103 of those still active as of the latter date. The infrastructure utilized a variety of compromised domains, including sites related to:
* Cooking, Grilling, and Recipes
* Betting and Lottery
* AI and Crypto services

A specific Google account (`jovevkystaxsilverv@gmail.com`) appears in the header of the saved Google Merchant Center page template used across these hosts, indicating a common origin or shared toolkit.

### Security Implications
While the majority of the observed builds were "broken" and failed to execute malicious code, the underlying infrastructure is dangerous.
* **ClickFix Mechanism:** The primary threat is the social engineering tactic itself. The campaign leverages a trusted appearance (Cloudflare) to trick users into performing high-risk actions (using the Windows Run command).
* **Potential for Scaling:** Because the infrastructure exists and has been deployed across hundreds of sites, the operators can easily push "fixed" configurations to these hosts at any time, turning the current "harmless" HTML-copying lures into functional, high-impact attack vectors.

### Technical Details
* **The Flaw:** The kits used a placeholder variable `{{WINR}}` for the command file path. Builders failed to replace this, causing the browser to send requests for a file named `{{WINR}}` plus a 13-digit timestamp (e.g., `/%7B%7BWINR%7D%7D1791011808213`).
* **Response:** The server returned the host's own webpage content with a success code, which the browser's script then treated as the command to be copied.
* **IOCs:** The report highlights specific paths and behaviors, including the use of `images/CF-Logo.png` and `verification-failed.html`, as well as requests for the malformed `{{WINR}}` path.

### What Defenders Should Know
Defenders should monitor network logs and endpoint activity for signs of this campaign:

| Indicator Type | Details |
| :--- | :--- |
| **Network Request** | Requests to `/{{WINR}}` followed by a 13-digit timestamp. |
| **Command Request** | Any request to `/cmd_8f92b_secret.txt?t=` (seen in the functional build). |
| **File Paths** | Attempts to load `images/CF-Logo.png` or `verification-failed.html`. |
| **Infrastructure** | Block/monitor traffic to the 245 known host domains and IPs identified in the research (e.g., `grillcrafts[.]com`, `oneai[.]icu`, `tradehero-ai[.]com`). |

Security teams should treat any site exhibiting the "Cloudflare verification" behavior that involves copying clipboard content as a critical incident, regardless of whether the current payload appears to be non-malicious HTML.
cPGuard security advisory: Update channel compromise - OPSSHIELD

Following the compromise of the CPGuard update channel, here is a detailed precis of the incident based on the documentation provided by OPSSHIELD.

### Executive Summary
The update channel for the CPGuard security software was compromised, allowing attackers to deliver a malicious update to servers running specific versions of the product. This attack resulted in the unauthorized exfiltration of sensitive system data from approximately 32 servers, with the potential for further persistent access via installed backdoors.

### What Happened & Technical Details
Between versions **5.88.12 and 5.88.19**, the CPGuard update mechanism was manipulated to deploy a malicious payload. Upon execution, this script performed the following actions:
* **Data Exfiltration:** The script gathered sensitive system files, including `/etc/shadow`, `/etc/passwd`, root `my.cnf` (MariaDB/MySQL configurations), root shell history, and SSH credentials (`authorized_keys`, `known_hosts`).
* **Staging:** Collected data was bundled into an archive at `/var/tmp/.cpg91511/loot.tgz` for exfiltration.
* **Persistence:** The attackers installed a backdoor script located at `/var/tmp/.cpg91511_sh` to maintain future access to the compromised systems.

### Who is Affected
Organizations running CPGuard versions **5.88.12 through 5.88.19** are considered affected. OPSSHIELD has confirmed that at least 32 servers had data successfully retrieved by the attackers; however, investigations into the full scope are ongoing.

### Security Implications
* **Credential Exposure:** Even though passwords in `/etc/shadow` are hashed, they remain vulnerable to offline cracking attempts, necessitating immediate password rotation.
* **Lateral Movement:** The exposure of root SSH keys and shell history (which may contain plaintext secrets) grants the attacker significant potential for lateral movement within a network or access to cloud/external infrastructure (e.g., S3 keys or API tokens).
* **System Integrity:** The presence of a backdoor (`.cpg91511_sh`) signifies that the affected servers should no longer be trusted until remediated.

### Recommended Actions for Defenders
If your server was running a vulnerable version (5.88.12–5.88.19), you must treat it as compromised and take the following steps immediately:

| Action Category | Specific Tasks |
| :--- | :--- |
| **Patching** | Update CPGuard to **version 5.88.25 or later** using `cpgcli update --start` and verify using `cpgcli --version`. |
| **Credential Rotation** | Reset passwords for root and all local Linux accounts. Rotate database passwords, S3 access keys, and any other secrets identified in root's shell history. |
| **SSH Security** | Replace all SSH private keys found in `/root/.ssh` and remove the associated old public keys from all authorized systems. |
| **Cleanup/Review** | Inspect `/var/tmp/` for the mentioned artifacts (`.cpg91511/` directory and `.cpg91511_sh` file) to confirm removal. |

While a full server rebuild is not currently required as a blanket recommendation, administrators should maintain high vigilance. If you have concerns regarding the residual integrity of your server, it is advised to contact OPSSHIELD support directly.
Shutting the Door on the XCPE Botnet - Google

This precis details the disruption of the "XCPE" botnet, a malicious operation identified by Google and industry partners that highlights critical risks within the supply chain for Android-based IoT devices.

### What Happened
Google and industry partners dismantled the XCPE backdoor, which had successfully compromised over 1.3 million devices. The operation was attributed with high confidence to Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). Videostrong intentionally pre-installed malicious, persistent software into the firmware of various devices, which they then monetized by selling access to criminal affiliates.

### Who Is Affected
The botnet primarily impacted **Android TV set-top boxes**. However, the investigation also uncovered infections on a variety of other Android-based IoT devices, including:
* Telehealth devices
* Karaoke machines
* Digital signage devices

### Security Implications
This incident represents a severe breach of trust, as manufacturers leveraged their own devices to distribute malware. The backdoor allowed criminal actors to remotely control compromised devices without user knowledge or consent, enabling:
* **Residential Proxy Networks:** Converting devices into exit nodes to route malicious or obfuscated network traffic.
* **Ad Fraud:** Utilizing devices to generate fraudulent ad impressions and clicks.
* **Data Exfiltration:** Unauthorized access to information through or on the devices.
* **Multi-tenant Malware Loading:** Serving as a platform for secondary malicious payloads, including additional backdoors.

### Technical Details
The XCPE malware utilized a modular, three-stage architecture designed for persistence and evasion:

1. **Primary Backdoor (`x.cpe` / `com.oemservice`):** Preloaded in the firmware with `android.uid.system` privileges, it ensured persistence by automatically reinstalling itself upon reboot if removed. It acted as the primary C2 communicator.
2. **Loader and Execution Engine (`com.abc.nexus`):** Introduced to evade security scans, this engine offloaded the execution of modules from the primary backdoor. It utilized native anti-analysis utilities to thwart sandboxing.
3. **Monetization Modules:** These modules, developed by third-party affiliates, performed the actual malicious tasks (e.g., ad-fraud or proxying). They were deployed as native ELF daemons, embedded SDKs, or secondary APKs.

**Command and Control (C2):**
The botnet employed a two-stage C2 process. It initially used HTTP POST requests to fetch dynamic configurations and geolocation data, followed by a persistent connection via the **MQTT** protocol to receive commands for file operations, shell command execution, screen captures, and network reconnaissance.

### What Defenders Should Know
Defenders should focus on identifying and blocking the infrastructure associated with the XCPE botnet and its various affiliate modules. Google has already initiated legal action to take down the associated C2 domains and servers.

Defenders are encouraged to:
* **Monitor Infrastructure:** Use the provided Indicators of Compromise (IOCs)—including specific C2 domains, subdomains, and IP addresses—to scan for and block traffic.
* **Inspect for Malicious Packages:** Monitor for the presence of the identified malicious packages (e.g., `x.cpe`, `com.abc.nexus`, `com.oemservice`) and their associated hashes.
* **Review Supply Chain Risk:** This incident underscores the importance of verifying the integrity of pre-installed firmware and software, particularly in Android-based IoT ecosystems.
Notice of Order Regarding Exclusion and Removal of Acronis Products From Federal Civilian Executive Branch Information Technology Systems and Procurements - Department of Homeland Security

This precis summarizes the Department of Homeland Security (DHS) order regarding the removal and exclusion of Acronis products from the federal civilian executive branch.

### **What Happened**
On October 30, 2026, the DHS published a notice announcing the Secretary of Homeland Security’s issuance of an order to exclude and remove information technology (IT) products and services developed by Acronis AG, Acronis, Inc., Acronis SCS, and all affiliated entities from all federal civilian executive branch systems and future procurements 【1】【3】. This action was taken under the authority of the Federal Acquisition Supply Chain Security Act (FASCSA) of 2018 【1】.

### **Who Is Affected**
* **Federal Agencies:** The order applies to all federal civilian executive branch agencies. It explicitly excludes national security systems and secure compartmented information systems from the mandatory removal scope 【2】.
* **The Vendor:** Acronis AG and its affiliated entities, including those supplying covered articles directly or indirectly to federal civilian agencies 【1】.

### **Security Implications and Technical Details**
While the Federal Register notice itself primarily focuses on the legal basis of the order, public reporting indicates that the decision stems from a risk assessment concerning the nature of the software:
* **Privileged Access:** The DHS risk assessment specifically identifies that Acronis products possess "elevated permissions" within the systems they occupy 【4】.
* **Supply Chain Risk:** As a cybersecurity and data protection provider, Acronis tools operate with deep, often kernel-level or administrative-level access, which—if compromised—could provide an adversary with significant control over sensitive data or system operations. The FASC (Federal Acquisition Security Council) recommendation process evaluated these factors as presenting an unacceptable risk to the federal supply chain.

### **What Defenders Should Know**
* **Compliance Timeline:** The order requires the removal of existing "covered articles" from federal civilian systems. Agencies are subject to requirements to identify and purge these technologies according to the timelines mandated by the FASC/DHS order 【2】.
* **Scope of "Covered Articles":** Defenders should audit their environments for all software, hardware, and services sourced from Acronis or its affiliates, not just primary backup software, as the order covers any IT products "directly or indirectly supplied" by them 【1】.
* **Documentation:** For specific details on the justification and the full text of the order, the DHS has pointed to the supporting documentation available in the public docket at [regulations.gov](https://www.regulations.gov) under **DHS Docket Number DHS-2026-0694** 【3】.
SpikeStrip: Reversible HTML and JavaScript prompt decoys with opaque per-insertion keys. - Arcanum

SpikeStrip is an experimental defensive utility developed to explore the concept of "AI deception." By injecting reversible "prompt decoys" into source code, it aims to divert or confuse AI-driven automated analysis tools (such as ARTEX) that scan code for vulnerabilities.

Below is a detailed précis of the tool based on the provided documentation.

### Overview: What Happened?
SpikeStrip was created as a research tool to generate "honeypot" code artifacts. It programmatically injects fake comments and data into HTML and JavaScript files to present deceptive leads to automated scanners. This is a proactive measure intended to test and develop defenses against the increasing capability of AI agents to perform automated reconnaissance on source code.

### Who Is Affected?
* **AI/Automated Scanners:** AI-driven vulnerability scanners and automated agents that parse source code and rely on comments, hints, or patterns are the primary targets of these decoys.
* **Developers/Organizations:** Those who deploy this tool must be aware that it modifies source code integrity. It is intended for those experimenting with AI-resistant security postures, not as a standard security control.

### Security Implications
* **Fabricated Leads:** The tool injects "fake" vulnerabilities, such as simulated SSRF, SQL injection, or path traversal, and references historical CVEs (e.g., Log4Shell). These do not create actual security holes in the application but are designed to lead automated tools into "dead ends."
* **Integrity Concerns:** Because SpikeStrip modifies source code, it alters file bytes. This may break Subresource Integrity (SRI) hashes or other integrity-checking mechanisms. Developers must ensure that hashing and signing processes occur *after* the decoys have been injected and finalized.
* **Exposure Risks:** Injected comments are visible in the browser's "View Source" or when fetching script files. If the application reflects or processes these comments unexpectedly, there is a minor risk of unintended information disclosure.

### Technical Details
* **Supported File Types:** `.html`, `.htm`, `.js`, `.mjs`, and `.cjs`.
* **Injection Mechanism:** Uses a private manifest to track insertions, allowing for the reversal (removal) of decoys.
* **Identification:** Injects comments containing unique 12-character hex keys to differentiate them from legitimate code.
* **Limitations:**
* Skips files larger than 2 MB.
* Does not inject into raw text, template strings, or attributes.
* It is not a "magic bullet"—it will not affect scanners that ignore comments or agents that successfully isolate and ignore untrusted/injected content.

### What Defenders Should Know
* **Not a Replacement for Security:** SpikeStrip is an experimental decoy mechanism and does not replace standard security practices like input validation, patching, or secure coding.
* **Manual Review Required:** Users should review all generated decoys to ensure they do not inadvertently overlap with real, valid application routes or parameters.
* **Workflow Integration:** If used, the tool must be integrated into the build pipeline *before* final artifact generation to ensure that integrity hashes, signing, and metadata updates account for the injected comments.
* **Technical Prerequisite:** The tool requires Node.js 20+ to run.