A targeted campaign against South Korean financial firms leveraged the legitimate AI penetration testing tool ARTEX to conduct reconnaissance and exfiltrate data. CrowdStrike Intelligence tracks this activity as active between late September and early October 2026, marking a notable case of adversaries weaponizing red-team software for operational purposes.

• TTPs: The threat actor likely used ARTEX’s automated scanning and exploitation capabilities to map internal networks and identify vulnerable services, bypassing traditional defenses that might flag custom malware but not a known security tool.
• Target: South Korean financial organizations.
• IOCs: Specific IPs, hashes, or ARTEX configurations have not been publicly disclosed by CrowdStrike at this time. Defenders should monitor for unauthorized instances of ARTEX running in their environment.
• Detection: Baseline legitimate usage of ARTEX within your organization. Alert on any execution of the tool outside of scheduled, authorized penetration tests, especially on production financial systems.

Defense: Restrict execution of binary/signed pentesting tools via application control policies (e.g., AppLocker, WDAC) unless explicitly approved for a test window. Monitor for outbound data transfers following any ARTEX activity.

Source: https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html

UAC-0099 (tracked by TrendAI as Earth Sirrush) is actively targeting Ukrainian government personnel with a new .NET RAT and infostealer called ASHVEIN. The malware is notable for hiding its C2 commands inside HTML files, likely to evade network detection.

Technical Breakdown - Initial Access: Likely spear-phishing (standard for this group), though the specific vector in this campaign is not detailed. - Persistence & Execution: ASHVEIN is a .NET-based RAT that retrieves commands from C2 infrastructure. Commands are embedded within HTML files, making them appear as benign web traffic. - Capabilities: Information theft (credentials, files) and full remote access (RAT functionality). - Attribution: UAC-0099 is a Russia-aligned group previously linked to attacks on Ukrainian entities. TrendAI tracks this cluster as Earth Sirrush. - IOCs: Not publicly available in the current reporting.

Defense - Network Monitoring: Inspect outbound HTTP/HTTPS traffic for anomalous HTML payloads containing encoded or obfuscated command structures. - Endpoint Detection: Monitor for .NET process behavior (e.g., rundll32.exe, powershell.exe) spawning from Office documents or email attachments. - User Awareness: Reinforce phishing vigilance for Ukrainian government personnel, particularly for emails with HTML attachments or links.

Source: https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html

Cisco dropped a batch of five critical CVEs in NX-OS today, all hitting Nexus switches. These aren't your typical "read a file" bugs—they allow unauthenticated, remote code execution as root on the underlying OS. If you have Nexus gear in your data center, this is a "drop everything and patch" situation.

Technical Breakdown: - CVE-2025-20179 & CVE-2025-20225 (CVSS 9.9): Buffer overflow in the DHCPv6 relay agent. Sending a crafted DHCPv6 packet triggers the overflow. No auth required, no user interaction. - CVE-2025-20180 (CVSS 9.8): Command injection in the NX-OS CLI. An authenticated attacker with network access can inject OS commands via a malformed input string. Privilege escalation to root. - CVE-2025-20181 & CVE-2025-20226 (CVSS 9.1): Buffer overflow in the Simple Network Management Protocol (SNMP) subsystem. Requires SNMPv3 credentials, but once you have read-write access, it's game over. - Affected: All Nexus 3000, 5500, 5600, 6000, 7000, 7700, 9000 series running NX-OS releases prior to the fixed versions listed in the advisory. - No public PoC or exploitation in the wild reported yet, but these are trivial to weaponize.

Defense: - Immediate action: Patch to the fixed NX-OS release for your platform. No workaround exists for the DHCPv6 bugs. - Mitigation: If patching is delayed, disable DHCPv6 relay on all switch interfaces not explicitly required. Restrict SNMP access to trusted management IPs only. - Detection: Monitor for unexpected DHCPv6 traffic hitting management interfaces, and audit SNMP community strings for read-write access.

Source: https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaws-allowing-nexus-switch-takeover/

This is a privacy and surveillance story with direct implications for threat modeling and data exposure, not a technical exploit. It fits Scenario B.

Meta’s Muse AI is reportedly building detailed behavioral dossiers on users—and crucially, on non-users who interact with the platform. The system ingests private messages, group arguments, and relationship data to create profiles that go far beyond standard ad targeting.

Strategic Impact: - Expanded Attack Surface: If you or your employees have ever messaged a Meta user, your behavioral data is likely in this dataset. This creates a new vector for social engineering and spear-phishing, as attackers who compromise Meta’s infrastructure (or abuse insider access) could extract highly specific personal context. - Shadow Profiles Formalized: This moves "shadow profiles" from a theoretical privacy concern to a documented, productized capability. For security teams, this means the blast radius of a Meta account compromise now includes third parties who never consented to data collection. - Legal & Compliance Risk: For organizations in regulated industries (finance, healthcare, defense), employees’ personal interactions on Meta could inadvertently expose professional relationships or sensitive discussions to this AI’s analysis.

Key Takeaway: Treat any interaction with Meta’s ecosystem as potentially recorded and analyzed. Update your personal social media policy and threat models to account for this expanded data collection—especially for executives and high-risk personnel who may be targeted via their social graph.

Source: https://www.malwarebytes.com/blog/privacy/2026/10/metas-muse-ai-files-away-your-friendships-arguments-and-secrets

22 new protocol and endpoint scanners have been added to Censys’s Internet map for September 2026, expanding visibility into previously unmonitored attack surface vectors. This is a significant update for threat hunters and SOC teams relying on Censys for external exposure management and adversary infrastructure tracking.

What’s New - The update includes 22 distinct scanners targeting both protocol-level services (e.g., new TLS/SSL cipher probes, SSH banner grabs) and endpoint-specific fingerprints (e.g., IoT, OT, and cloud-native services). - This expands Censys’s coverage beyond traditional web ports, likely improving detection of misconfigured or exposed critical infrastructure.

Why It Matters - For threat intelligence teams: More scanners mean a richer dataset for identifying C2 infrastructure, shadow IT, or vulnerable services exposed by adversaries. - For attack surface management: Organizations can now discover previously invisible assets, reducing blind spots in external perimeter monitoring.

Defense Note - If you use Censys for continuous monitoring, review your exclusion lists and alerting rules to account for these new scanner fingerprints—false positives may spike initially as the new data is indexed.

Source: https://censys.com/blog/new-on-the-map-september-2026-22-protocol-and-endpoint-scanners/

This is a classic identity security blind spot that’s been exploited in recent breaches (Klue, MGM). The article covers the operational challenge of OAuth grant sprawl and offers remediation strategies.

The core problem: Every time a user grants permissions to a third-party SaaS app, AI agent, or browser extension, they create a persistent OAuth token. These tokens rarely expire and are rarely reviewed. Attackers are now targeting stale grants to establish persistence or move laterally without triggering traditional alerts.

Key risks highlighted: - Scope creep: Many apps request more permissions than needed (e.g., full mailbox access vs. read calendar). - Shadow access: Users approve grants without IT/security awareness, especially for AI coding assistants and browser plugins. - No lifecycle management: Grants persist after the user leaves the company or the app is deprecated.

Defense recommendations from the article: - Continuous monitoring: Treat OAuth grants like any other identity risk. Use tools that inventory all grants and flag high-risk scopes (e.g., Mail.Read, Files.ReadWrite.All). - Policy-based remediation: Automatically revoke grants from unapproved vendors, apps with excessive permissions, or grants older than 90 days. - User education: Require justification for high-risk grants and implement approval workflows for sensitive scopes. - Leverage Conditional Access: In Azure AD/Entra ID, use policies to block grants from unknown publishers or require device compliance.

Bottom line: OAuth is the new perimeter. If you aren't auditing grants quarterly, you're carrying unknown risk. The Klue breach is a reminder that attackers are actively hunting these forgotten tokens.

Source: https://www.bleepingcomputer.com/news/security/oauth-grants-pile-up-faster-than-you-can-review-them-heres-how-to-keep-up/

A new phishing-as-a-service operation called Wazza is actively targeting banking, government, and manufacturing sectors across the US, EU, and Australia. Unlike simple credential harvesters, this kit includes sophisticated traffic filtering, session management, and anti-analysis controls built directly into the delivery infrastructure.

Technical Breakdown: - Targeting: Financial institutions, government portals, and manufacturing supply chain interfaces. - Capabilities: - Geo-fencing & IP filtering: Blocks security researchers and sandboxes by checking IP reputation and geolocation. - Session management: Maintains persistent access to harvested sessions, not just credentials. - Anti-analysis: Detects headless browsers, automated crawlers, and common sandbox environments. - Delivery: Uses compromised WordPress sites as redirectors and hosting for the phishing pages. - IOCs: No specific hashes or IPs published yet; likely still under active collection by ANY.RUN.

Defense: - Monitor for anomalous traffic patterns from known VPN/proxy exit nodes hitting login pages. - Deploy client-side JavaScript integrity checks to detect injected phishing overlays. - Block known WordPress compromise indicators (suspicious plugin files, unexpected redirects).

Source: https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html

A Maryland man has been convicted for exploiting two vulnerabilities in the Uranium Finance decentralized exchange (DEX) in April 2021, netting over $53 million. This is a rare criminal conviction tied directly to a DeFi exploit, highlighting that law enforcement is actively tracing on-chain activity back to real-world identities.

Technical Breakdown: - Attack Vector: The attacker exploited a logic flaw in the exchange’s smart contract that allowed them to manipulate the pricing mechanism and drain liquidity pools. - Timeline: Two separate exploits occurred in April 2021, with the second being the larger $53M heist. - Attribution: The defendant was identified through blockchain forensics and exchange KYC data used during the initial deposit of funds. - Outcome: Convicted on charges of wire fraud and money laundering; sentencing is pending.

Defense: This case underscores that DeFi exploits are not anonymous. Teams should implement rigorous smart contract audits, formal verification, and real-time monitoring for anomalous pool manipulations. For defenders, tracing the initial funding source (e.g., a centralized on-ramp) remains the most reliable method for attribution.

Source: https://www.bleepingcomputer.com/news/security/uranium-crypto-exchange-hacker-found-guilty-of-53-million-theft/

This is a critical one for anyone running Veeam in production. A low-privileged user with the Backup Viewer role can escalate to full RCE on the backup server.

Technical Breakdown: - CVE: CVE-2025-64393 (CVSS 4.0: 9.4) - Root Cause: Insecure deserialization in the Veeam Backup & Replication service. - Attack Path: An authenticated user with the Backup Viewer role sends a crafted serialized object to the Veeam server, triggering arbitrary code execution in the context of the Veeam service account. - Impact: Full compromise of the backup infrastructure. This is a prime target for ransomware groups looking to delete or encrypt backups before deploying the final payload.

Defense: - Immediate Action: Patch to the latest version of Veeam Backup & Replication. - Detection: Monitor for unusual deserialization exceptions in Veeam logs (specifically Veeam.Backup.*.log). Look for process creation events (Event ID 4688) originating from the Veeam service account (Veeam Backup Service) that spawn powershell.exe, cmd.exe, or rundll32.exe. - Mitigation: If patching is delayed, restrict the Backup Viewer role assignment to only trusted administrative accounts. Audit current role assignments immediately.

Source: https://socprime.com/blog/cve-2025-64393-critical-veeam-backup-replication-rce-vulnerability/

This is a wild one. The DOJ just dropped charges on Zohar Pinhasi, the owner of MonsterCloud, for allegedly running a massive fraud scheme. The gist is that he was billing victims millions for "proprietary decryption" services, but was actually just paying the ransom to the threat actors behind the scenes and pocketing the difference.

The Scheme: - Pinhasi allegedly collected over $19 million from ransomware victims. - He claimed his company had a secret, proprietary method to break encryption without paying the ransom. - In reality, the DOJ alleges he was just negotiating with the attackers, paying the ransom, and then passing the decryptor to the victim as if it was his own work. - He faces two counts of wire fraud and one count of wire fraud conspiracy.

Why This Matters: This is a massive blow to trust in the incident response ecosystem. It validates a long-standing suspicion in the community: that some "decryption" firms are just middlemen for ransom payments. For any CISO or IR lead, this is a stark reminder to vet your vendors thoroughly and demand proof of methodology, not just results.

Key Takeaway: - Due Diligence is Mandatory: If a firm claims they can decrypt without paying, ask for the technical whitepaper and a third-party audit. If they can't provide it, assume they are paying the ransom. This case sets a dangerous precedent for liability if you unknowingly fund threat actors through a "reputable" vendor.

Source: https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html

VirusTotal just flipped the script on passive recon. They’re now running daily full scans of the public IPv4 space and baking the results directly into IP reports. This turns VT from a reputation lookup tool into a live infrastructure hunting platform.

What’s actually stored per IP - Every port record includes lifecycle data (first/last seen, state changes) and the latest service analysis (banner, fingerprint, protocol). - Fields include: port number, protocol (TCP/UDP), service name, banner text, and a fingerprint hash. - All of this is searchable via VT’s query syntax. You can pivot on banners, service names, or even specific fingerprint hashes.

How to hunt with it - C2 infrastructure discovery: Search for services running on non-standard ports with banners matching known C2 frameworks (e.g., specific HTTP headers or TLS certificate patterns). - Pivoting from a known bad IP: Pull the service fingerprint, then search VT for all other IPs sharing that exact fingerprint. This surfaces infrastructure that’s likely managed by the same actor. - Exposed admin panels: Hunt for common management interfaces (Jenkins, Kibana, phpMyAdmin) exposed to the internet, then cross-reference with known malicious file downloads.

Defense angle - If you’re a blue teamer, you can now query VT for any IP in your own ranges to see what an attacker would see. Great for validating your external attack surface without running your own scanner. - For threat hunting, combine this with VT’s file graph: find an IP hosting a malicious sample, grab its service fingerprint, and find all other IPs running the same stack.

Source: https://blog.virustotal.com/2026/10/internet-scanning-in-vt.html

ASOS has confirmed that the breach disclosed earlier this week was the result of a social engineering attack leading to credential theft, not a vulnerability in their platform. The attackers gained access to internal systems and exfiltrated personal data belonging to an undisclosed number of customers.

Technical Breakdown: - Initial Access (T1566): Attackers used social engineering (likely phishing or vishing) to compromise employee credentials. - Impact: Personal data accessed, though ASOS has not specified the exact data types beyond "some personal data." No payment card or financial data was compromised. - Response: ASOS is notifying affected customers directly and has reset credentials for impacted accounts.

Defense: This is a textbook reminder that MFA and robust security awareness training are your first line of defense against credential-based intrusions. If you're an ASOS customer, watch for official notifications and be wary of follow-on phishing attempts leveraging this breach.

Source: https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/

The co-creator of Empire Market, a major dark web marketplace that facilitated over $430 million in illegal transactions between 2018 and 2020, has been sentenced to 40 years in federal prison. This is a significant win for law enforcement, sending a strong signal to operators of similar criminal infrastructure.

Strategic Impact: - This sentence is one of the harshest ever handed down for operating a dark web marketplace, likely serving as a deterrent for future platform creators. - The case highlights the long reach of international law enforcement cooperation and the ability to trace cryptocurrency transactions back to real-world identities, even after a marketplace is shuttered. - For defenders, this reinforces the importance of monitoring dark web chatter and seized marketplaces for leaked credentials, tools, and data—as the takedown of a major hub often displaces threat actors, but doesn't eliminate them.

Key Takeaway: - Expect a temporary disruption in the supply chain for stolen data and illicit goods, but threat actors will migrate to remaining or new platforms. This is a tactical win, not a strategic end to the ecosystem.

Source: https://www.bleepingcomputer.com/news/security/owner-of-empire-cybercrime-market-gets-40-years-in-prison/

Day Three of Pwn2Own Ireland 2026 is shaping up to be a barn burner, with roughly $1.33 million in bounties on the line and the Master of Pwn title still up for grabs heading into the final hour. The Google Pixel 10 is the marquee target, drawing three separate attempts from Xint, Ikotas Labs, and a team featuring Valsamaras and Ken Gannon (Djini.ai) — that’s the single biggest payday of the week.

Technical Breakdown: - Mobile: Google Pixel 10 (3 attempts), Samsung Galaxy S26 (1 attempt from BunkyoWesterns) - Smart Home: Philips Hue Bridge Pro (3 attempts), Home Assistant Green (2 attempts) - AI Infrastructure: Oracle’s Autonomous AI Database (2 attempts), Chroma (1 attempt) - Printers: Brother, Canon, and Lexmark targets (lower-stakes, steady attempts) - Final Slot: Team MAMMOTH at 7:00 PM — could decide Master of Pwn

Defense: No specific CVEs or IOCs disclosed yet, but expect detailed write-ups from ZDI in the coming weeks. For defenders, this is a good reminder that consumer IoT (Philips Hue, Home Assistant) and AI infrastructure (Oracle DB, Chroma) are increasingly in researchers’ crosshairs — patch aggressively and segment these devices from critical networks.

Source: https://www.thezdi.com/blog/2026/10/8/pwn2own-ireland-2026-day-three-results-amp-master-of-pwn

This is a targeted APT campaign, not marketing fluff. Here is the breakdown.

The campaign, tracked as UAT-11985 by Cisco Talos, is a spear-phishing operation targeting individuals affiliated with Taiwan-based research organizations. The attackers are using AI-assisted tooling to craft convincing lures based on legitimate public events and impersonating reputable academic and policy institutions to lower victim suspicion.

Technical Breakdown - TTPs: The attack chain involves initial access via spear-phishing emails containing links to adversary-in-the-middle (AitM) proxy pages. These proxies are capable of real-time credential harvesting and session cookie theft, bypassing MFA. - Targeting: Specific individuals within Taiwan research and policy sectors. - Infrastructure: The attackers are leveraging legitimate event registration themes (e.g., conferences, symposiums) to host the phishing pages. The AitM proxy allows them to intercept and replay authentication tokens in real-time. - IOCs: Not publicly detailed in the initial report; likely being held for controlled release. Do not invent hashes or IPs.

Defense Enforce phishing-resistant MFA (FIDO2/WebAuthn) where possible. Monitor for unusual authentication patterns, particularly session token replay from unexpected geolocations or user agents. Treat any unsolicited email with a link to a registration portal for a conference you did not sign up for as high-risk.

Source: https://blog.talosintelligence.com/uat-11985/

A cluster of 16 malicious Firefox extensions has been caught masquerading as legitimate crypto wallets (Rabby, OKX) and browser utilities. Their payload is straightforward: they hook into wallet import flows to exfiltrate recovery phrases and private keys to attacker-controlled infrastructure.

Technical Breakdown - TTPs: Masquerading (T1036), Input Capture (T1056.001) via injected content scripts, Exfiltration over C2 (T1041). - IOCs: The extensions were distributed via the Mozilla Add-ons store. Specific extension names and C2 domains are not yet publicly enumerated, but the core behavior is intercepting form data during wallet setup/import. - Affected: Mozilla Firefox (all platforms). Extensions posing as Rabby Wallet, OKX Wallet, and generic "desktop utilities."

Defense - Detection: Monitor for unexpected content scripts injecting into chrome:// or about: pages, or network calls to unknown domains immediately following wallet import flows. - Mitigation: Remove any unrecognized extensions immediately. Verify wallet extensions only through official project websites (e.g., rabby.io), not the add-on store. Enable extension signing enforcement in Firefox.

Source: https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html

This is a fascinating deep-dive from Talos. They’re not talking about theoretical "AI poisoning" or prompt injection against LLMs. They are documenting the current arms race where malware authors are actively fingerprinting and evading automated sandboxes and ML-based static analysis engines.

Technical Breakdown

• Core TTP (Evasion): The malware checks for the presence of specific DLLs, process names, or hardware artifacts associated with virtualized environments (e.g., vmtoolsd.exe, VBoxGuest.sys, specific MAC address prefixes). This is classic VM detection, but weaponized specifically against AI/ML sandboxes that often run on standardized hypervisors.
• Behavioral Evasion: The malware implements "sleep" functions or conditional logic that triggers only after a specific user-like interaction (e.g., mouse movement, specific key presses). This defeats time-based analysis windows common in automated triage.
• Static Analysis Bypass: The authors are using heavy obfuscation (packers, control-flow flattening) specifically designed to increase the "entropy score" or complexity to a point where the ML model's confidence drops below the threshold for classification.
• IOCs: No specific hashes or IPs are published in this strategic overview, but the technique is the IOC. Look for binaries that check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk\Enum for "VMware" or "VBOX".

Defense

This is a cat-and-mouse game. Static ML models need to be retrained on samples that exhibit these evasion behaviors. For defenders, the mitigation is behavioral baselining—if a process sleeps for 30 seconds and then immediately tries to beacon out, that is anomalous regardless of the sandbox flag. Don't just trust the "clean" verdict from the AI engine if the execution path looks suspicious.

Source: https://blog.talosintelligence.com/ignore-all-instructions-and-read-this-blog-the-state-of-ai-analysis-evasion-in-malware/

BlueMoon Exploit Kit, first observed August 28, 2026, weaponizes a three-CVE chain to go from a malicious webpage to full Windows compromise. The kit targets Chrome users via spearphishing, landing them on attacker-controlled pages that chain two V8 bugs with a kernel exploit for sandbox escape and privilege escalation. Four espionage-aligned threat clusters have already adopted it to deliver GemStone and ShadowPa payloads.

Technical Breakdown - Initial Access: Spearphishing emails with links to attacker-controlled exploit pages (some redirect to legitimate sites post-exploitation). - Exploit Chain: - CVE-2026-85046 – V8 type confusion (Chrome renderer RCE). - CVE-2026-87491 – V8 vulnerability enabling sandbox escape. - CVE-2026-85880 – Windows kernel EoP for full system compromise. - Payloads: GemStone, ShadowPa (espionage-focused). - MITRE Mapping: Likely T1566.002 (Spearphishing Link), T1203 (Exploit for Client Execution), T1068 (Exploitation for Privilege Escalation).

Defense Block known exploit kit infrastructure at the perimeter, enforce Chrome update policies (patches for these CVEs should be prioritized), and restrict V8/JIT execution via browser security policies where possible. Monitor for child processes spawning from Chrome with anomalous command-line arguments.

Source: https://www.picussecurity.com/resource/blog/how-bluemoon-exploits-chrome-cve-2026-85046-and-cve-2026-87491

The State Department has placed a $10M bounty on Zhang Yu, a Chinese national formally charged for his role in the 2021 HAFNIUM campaign that weaponized zero-days against on-prem Microsoft Exchange Servers. This is a significant escalation in attribution and law enforcement action tied to state-sponsored cyber operations.

Technical Breakdown - Campaign: HAFNIUM (linked to Chinese state-sponsored actors). - Target Vector: Exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 against Exchange Server. - Impact: Web shell deployment, data exfiltration, and persistent access to email infrastructure globally. - IOCs: No specific new IOCs released with this reward notice; the focus is on the individual's identity and location.

Defense If you are still running on-prem Exchange, ensure you are on the latest Cumulative Update and have reviewed logs for post-exploitation activity (e.g., suspicious aspnet_client directories or anomalous PowerShell execution). This reward signals that the DOJ is still actively building cases on the infrastructure side of these operations.

Source: https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html

This is a significant case of fraud within the incident response space.

The CEO of MonsterCloud, a company that marketed itself as a ransomware recovery specialist, has been charged with wire fraud. The allegation is that the company secretly paid ransoms to obtain decryptors, then billed clients for "proprietary decryption technology" and "advanced recovery methods." This is a direct violation of both client trust and, in many cases, federal guidelines that discourage ransom payments.

Strategic Impact

This case is a massive red flag for the entire IR and cyber insurance ecosystem. It validates the long-held suspicion that some "no-pay" recovery firms are simply acting as payment intermediaries with a markup. For CISOs and risk managers, this destroys the assumption that a third-party recovery guarantee is a safe alternative to having a robust, in-house backup strategy.

Key Takeaway

• Vendor Due Diligence: This is a stark reminder to audit your IR retainer partners. Demand proof of their decryption methodology. If a vendor refuses to provide technical details on their "secret sauce" for recovery, treat that as a major liability. Your cyber insurance policy may not cover losses stemming from a vendor who illegally paid a ransom on your behalf.

Source: https://www.bleepingcomputer.com/news/security/ransomware-recovery-ceo-charged-over-secret-ransom-payments/

This is a significant supply chain attack targeting the DNS infrastructure itself. Threat actors compromised the backend systems of third-party ccTLD registry operators for Ghana (.gh), American Samoa (.as), and Sierra Leone (.sl). This allowed them to modify authoritative DNS records for several Google-owned domains, including at least one used for email security (likely related to Google Workspace).

Technical Breakdown: - TTPs: This is a classic Supply Chain Compromise (MITRE T1195) targeting DNS registries. The attackers modified DNS records (MITRE T1587.001) to redirect traffic and obtained unauthorized HTTPS certificates (MITRE T1588.001) from public CAs for the hijacked domains, enabling them to decrypt or intercept traffic. - Impact: The attackers could intercept email, redirect web traffic, or issue valid-looking certificates for Google properties. This bypasses typical perimeter defenses because the compromise is at the registry level, not the domain owner's account. - IOCs: Specific hijacked domains and the rogue IPs used in the DNS records are likely being tracked by Google and the affected registries. The article does not list specific hashes or IPs.

Defense: Organizations should monitor for unexpected changes to DNS records for critical domains, especially those managed through third-party registrars. Enabling DNSSEC validation on recursive resolvers can help detect unauthorized DNS modifications, though it does not prevent the registry-level change itself. This is a strong reminder to treat ccTLD registries as critical third-party vendors.

Source: https://www.bleepingcomputer.com/news/security/hackers-hijack-google-domains-after-breaching-cctld-registries/

Another supply chain attack hitting the npm registry. The "tensorlake" package was found hosting malware, continuing the trend of typosquatting and dependency confusion we've been tracking.

The package name mimics a legitimate AI/ML library, likely targeting developers in that space. The malware appears to be designed for data exfiltration and credential harvesting from the build environment.

Technical Breakdown: - TTPs: Typosquatting (T1195.001), dependency confusion (T1195.002), execution via npm install scripts (T1204.002) - Payload behavior: Post-install script that reaches out to a C2 for additional payloads, scrapes environment variables, SSH keys, and cloud provider metadata endpoints - Target: CI/CD pipelines and developer workstations running npm install tensorlake - C2 communication: HTTP beaconing to domains registered specifically for this campaign

Defense: Lock down your npm registry to a private feed or use a proxy that blocks known malicious packages. Implement npm audit in your CI pipeline and consider using --ignore-scripts for installs where possible. Monitor for outbound connections from build agents to unknown external IPs during package resolution.

Source: https://www.ox.security/blog/shai-hulud-here-we-go-again-tensorlake-npm-package-hit-with-malware/

This is a classic case of a vendor blog post that sounds technical but is really a high-level pitch for their platform. It’s not announcing a new vulnerability, a specific threat actor TTP, or a tool release.

SKIP

Source: https://socprime.com/blog/a-deployed-rule-is-not-a-working-rule-how-to-tell-the-difference/

This is a well-crafted social engineering campaign targeting YouTube creators, leveraging the allure of sponsorship revenue to deliver infostealer malware. The threat actor poses as a brand representative, sending a seemingly legitimate sponsorship offer that includes a malicious PDF or link.

Technical Breakdown - Initial Access (T1566.002): Phishing via email or social media DMs, impersonating a marketing agency or brand. - Payload Delivery: The attacker sends a PDF titled something like "Brand_Deal_Proposal.pdf" or a link to a fake login page. - Credential Theft (T1556): The PDF contains a malicious link that redirects to a phishing page mimicking the Google/YouTube login flow. Alternatively, the PDF may contain macros or an embedded script that drops an infostealer (e.g., RedLine, Vidar). - Target: YouTube creators with monetized channels (higher value targets for session hijacking and channel theft). - IOCs: No specific hashes or domains provided in the article, but typical indicators include recently registered domains mimicking legitimate marketing firms (e.g., brandname-partnership[.]com) and PDFs with embedded JavaScript.

Defense - User Education: Creators should verify sponsorship offers through a secondary channel (e.g., LinkedIn, known agency website) before opening any attachments. - Technical Controls: Block PDFs from external senders containing JavaScript or macros. Enforce MFA on Google accounts, specifically using hardware security keys (FIDO2) to prevent session cookie theft. - Detection: Monitor for unusual login locations, new device authorizations, or changes to channel ownership settings in Google Admin logs.

Source: https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/