| DATE |
|
NAME |
INFO |
CATEGORIE |
WEB |
|
30.9.26 |
 |
No MDM for Linux? A 68-line Elastic workflow keeps every
endpoint's config current |
Elastic InfoSec runs Linux endpoint management through Elastic Defend with a
scheduled workflow that gets Cursor and Codex config onto new laptops without
piling up duplicate actions on offline hosts, and it works for other config too.
Our mobile device management (MDM) covers macOS and Windows but
not Linux.
|
OS |
ELASTIC |
|
30.9.26 |
 |
PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and
AdaptixC2 via CVE-2026-82078 and CVE-2026-81578 |
On
August 31, 2026, eSentire's
Threat Response Unit (TRU)
detected exploitation of zero-day vulnerabilities disclosed in our security
advisory,
PaperCut Discloses Zero-Day Vulnerabilities (CVE-2026-82078
and CVE-2026-81578), published on September 3,
2026 affecting a customer in the
Education industry. In
the intrusion, threat actors exploited an internet-facing print server running a
vulnerable version of PaperCut MF to load an in-memory Java loader, which in
turn deployed a web shell. |
Vulnerebility |
eSentire |
|
29.9.26 |
 |
Threat Actors Use Google Ads To Target Ledger Users |
In August 2026, Zscaler ThreatLabz analyzed a phishing campaign that used
fraudulent Google ads to target Ledger hardware wallet users. The ads redirected
users through Google Cloud Storage and Vercel to a Google Sites page containing
a phishing page impersonating Ledger in an iframe. During our analysis, the
Vercel redirect appeared to change every 15-20 minutes.
|
Phishing |
Zscaler |
|
29.9.26 |
 |
Russian and Allied Government Systems Compromised in
Targeted Campaigns |
Russian and Allied Government Systems Compromised in Targeted Campaigns
Three exposed operator workspaces reveal confirmed access to Russian and
Kyrgyz government systems, a Syrian Customs C2 inventory, stolen data
and wider targeting of Russian state and industrial organisations. |
APT |
Ctrl-Alt-Intel |
|
29.9.26 |
|
Quarantined isn't contained: Agentic phishing response with Elastic and Sublime |
The native
Sublime Security integration sends email detections into Elastic Security, where
phishing incident response can tie a quarantined email to what happens next on
the endpoint and pull the threat from every mailbox it reached.
|
Phishing |
ELASTIC |
|
26.9.26 |
 |
Protection Highlight: The Image That Isn't — Stopping SVG-Borne Attacks |
Multiple attackers have moved their
first stage into image files. One format of choice is SVG, which email
policy treats as harmless on its extension alone. But SVG is made up of
XML, not pixels, making the browser parse and execute it. A single file
can carry <script>, paint a convincing full-screen login page, and pass
filters written for executables and archives. That combination has put
SVG among the top three most common malicious attachment types. |
Hack |
BROADCOM |
|
26.9.26 |
|
One URL, Three Different Tricks |
Yesterday, we received a phishing email
with an interesting link. At first sight, it looks like garbage, but
every piece of it has been carefully crafted to confuse basic security
controls. Here is the defanged link: |
Hack |
SANS |
|
26.9.26 |
 |
A Closer Look at Malware From the Macfinger ClickFix Campaign |
My previous post on Macfinger ClickFix
was two days ago, and this campaign remains active. The more I look into
the malware delivered by this campaign, the more I believe it is not a
variant of Atomic macOS (AMOS) Stealer as originally reported. There are
too many differences between what I've documented with recent AMOS
Stealer activity and what I'm now seeing with this malware. The data
collection and method of exfiltration is different between these two
malware families. |
MALWARE TRAFFICS |
MALWARE TRAFFIC |
|
24.9.26 |
 |
Macfinger ClickFix campaign |
I've found several legitimate websites
with injected script for a campaign using the ClickFix social
engineering technique. This particular ClickFix campaign was documented
earlier this month on the Ransom-ISAC Blog, but it doesn't appear to
have a nickname yet. Since this campaign is targeting macOS environments
through a fingerprinting process, I'm calling it the "Macfinger
ClickFix" campaign. No, this is not related to the MacFinger utility
from decades ago. |
CyberCrime |
SANS |
|
24.9.26 |
 |
MacSync under the microscope: new delivery methods and a
new payload |
MacSync is a relatively young, rapidly
evolving family of crypto/info stealers. First advertised on the dark
web in 2025 as Mac.c, the stealer was later renamed to MacSync by its
creators. The initial versions were implemented as AppleScripts and
closely resembled the AMOS stealer family, but over time, MacSync
developed distinctive features of its own, including a backdoor module. |
Virus |
SECURELIST |
|
22.9.26 |
|
LausivLoader analysis, or how to pass data between
malware stages |
At the end of August, a malspam message was caught in the
quarantine of a mail gateway operated by one of my customers. The
message was not especially remarkable – it asked the recipient to review
some attached requirements and provide a price quotation for a fiber
optic system and appeared to impersonate an employee of a legitimate
company. |
Virus |
SANS |
|
22.9.26 |
|
HTTP QUERY Method: The Grey Zone Between GET And POST. |
In
June 2026 the IETF published RFC 10008, defining a new HTTP method: "QUERY".
The HTTP protocol faced already by changes (HTTP/2, HTTP/3) but it’s the
first new standard HTTP verb since "PATCH" in 2010!This
new method sits between “GET” and “POST” and can be resumed like this: “QUERY
is a GET with a body”. It's safe and idempotent: the request is
processed without state change and can be automatically repeated or
restarted without concern for partial state changes. |
Hack |
SANS |
|
22.9.26 |
|
TerminalFix: PNG Steganography |
Microsoft Security
Research published an interesting blog post "TerminalFix
campaign deploys a reverse tunnel through multistage intrusion"
about a malware campaign. The aspect that I want to take a closer look
at, is the fact that the threat actors used PNG files with steganography.
I reached out to the researchers and they kindly shared the IOCs for the
PNG files with me. |
CyberCrime |
SANS |
|
22.9.26 |
|
Cloud Threat Emulation on Autopilot: Context is
Everything |
Cloud threat emulation is more than detonation. A plan-first
methodology for cloud detection engineering: scope, victim model,
telemetry, coverage, cleanup. Learn how to properly leverage AI to
automate your emulations.
Cloud threat emulation needs more than detonation |
Hack |
ELASTIC |
|
22.9.26 |
|
Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation |
Vidar is an information stealer that was first
observed in 2018. Across its iterations, Vidar has
continued to improve its string obfuscation to make
detection and analysis more difficult by changing
deobfuscation algorithms, constants, and primitives.
From May through early September 2026, Zscaler
ThreatLabz tracked Vidar’s string obfuscation as it
evolved from basic XOR to ChaCha20, and more
recently, to a custom virtual machine (VM), which is
executed via a lightweight bytecode interpreter that
is combined with a custom stream cipher that changes
with each build. |
Virus |
Zscaler |
|
21.9.26 |
|
Exvicy: A copycat of the ErrTraffic malware distribution
framework |
This article details how TDR pivoted from a forum advertisement to identify
confirmed operator infrastructure, analyzes the Exvicy infection chain, and
provides code evidence establishing that this emerging MaaS is a direct copycat
of the adopted ErrTraffic framework. |
Virus |
SEKOIA |
|
21.9.26 |
 |
One SOC, 100 projects: running centralized alert triage
on Elastic Security Serverless |
We linked one
Elastic Security project to 100 others and ran the full prebuilt detection
catalog from the origin, with all the ingest landing in the linked projects. It
held up, and where it deliberately does not reach is the interesting part.
|
Security |
ELASTIC |
|
21.9.26 |
|
2026-09-14 (MONDAY): BACKDOOR USING SCREENCONNECT FROM
MALICIOUS EMAIL |
Zip files are password-protected. Of note,
this site has a new password scheme. For the password, see the "about" page
of this website. |
MALWARE TRAFFICS |
MALWARE TRAFFIC |
|
21.9.26 |
|
2026-09-15 (TUESDAY): SMARTAPESG CLICKFIX TO UNIDENTIFIED
RAT TO MESHAGENT |
Zip files are password-protected. Of note,
this site has a new password scheme. For the password, see the "about" page
of this website. |
MALWARE TRAFFICS |
MALWARE TRAFFIC |
|
21.9.26 |
 |
Group Policy hijacked: PAYLOAD ransomware
weaponizes Active Directory GPO |
In April 2026, we at Kaspersky’s Global
Emergency Response Team (GERT) responded to a security incident at a
manufacturing organization in the Middle East. The threat actor obtained
domain admin-equivalent control of the organization’s Active Directory
environment and authored a malicious Group Policy Object (GPO) named
PAYLOAD, linking it at the domain root. |
Ransom |
SECURELIST |
|
19.9.26 |
|
Handala Threat Group Tactics, Targets, and Attack
Timeline |
Handala is an Iranian-linked
hacktivist group active since late 2023, operating under a pro-Palestinian
agenda and targeting Israeli, U.S., and regional infrastructure. |
APT |
PICUS |
|
17.9.26 |
 |
MacOS 27 - First Boot |
I have not done this type of diary in a
while: What traffic will you see from a system on boot, before a user
logs in? I just took a quick look at macOS 27 "Golden Gate" to see what
traffic you should expect. Here are some of the highlights.. |
OS |
SANS |
|
17.9.26 |
|
Scans Targeting Hospitality Applications |
Earlier today, I noted an odd request showing
up in our "First Seen" report.. |
Security |
SANS |
|
17.9.26 |
|
The Odyssey and trojans again: MovieReaper attacks users
in multiple countries via compromised torrents |
Torrent trackers have long been abused
for distributing malicious software, disguised as popular films, games,
and other content. Our previous research has shown that cybercriminals
repeatedly turn torrents as an initial infection vector, using
trojanized cracks and installers to reach a large number of users. |
Virus |
SECURELIST |
|
17.9.26 |
|
The extension you never installed: KREMLIN forges Chrome's own
integrity checks to steal banking sessions |
Elastic Security Labs tracked this
malicious browser extension across seven campaigns and 15 months, through
Brazilian bank lures and the Ethereum smart contracts that hold its C2
configuration. |
Virus |
ELASTIC |
|
17.9.26 |
|
Mythic C2 Activity at Internet Scale |
Mythic is an open-source collaborative
C2 framework which is actively maintained on GitHub. It provides a
plugin-based architecture supporting multiple agent types, transport
profiles, and an operator-facing web UI. |
CyberCrime |
CENSYS |
|
16.9.26 |
|
NightEagle targets
Russian companies |
Over the past year, our Global Emergency
Response Team (GERT) has investigated several incidents involving the
NightEagle group (APT-Q-95). This group has been active since at least
2023 and originally focused on organizations in Asia, as we reported
previously. We have now identified attacks by the group targeting
businesses in Russia. This post examines both known and new tools
NightEagle used in its latest campaign. |
APT |
SECURELIST |
|
15.9.26 |
|
Apple Updates Everything |
Today, Apple released its annual update
across all its operating systems. With that, Apple not only released new
features but also patched 261 different vulnerabilities. This is the
most vulnerabilities Apple has ever patched, but the increase is not as
significant as other vendors' "post-AI" patch releases. |
OS |
SANS |
|
15.9.26 |
|
Analysis of a Low-Detection Linux Implant with Hands-On
Intrusion Capabilities |
UPDATE: After reviewing related
infra found by
@500mk500 and a related sample by
@malwrhunterteam, I found quite a few similarities with the Adaptix Agent
using the adaptix_gopher protocol. In early July 2026,
MalwareHunterTeam shared an interesting ELF named
gregbfdah.png with minimal detection in VirusTotal. The ELF was uploaded
to VirusTotal on 2026-06-16 and it still has very low detection.
|
OS |
DMDUMP |
|
14.9.26 |
|
Linux Detection Engineering - Local Privilege Escalation |
Seven of the thirteen Linux privilege escalation CVEs we tracked
in 2026 turned out to be the same copy-on-write bug pointed at different kernel
interfaces. We ran the public proof-of-concept for eleven exploits and two
misconfigurations, and noted which rules fired.Local privilege escalation (LPE)
is the step that turns a foothold into full control of a host. An attacker who
lands as an unprivileged user rarely stops there. They want root, and Linux
keeps offering new ways to get it. |
OS |
ELASTIC |
|
11.9.26 |
|
ATOMIC MACOS (AMOS) STEALER
INFECTION |
Zip
files are password-protected. Of note, this site has a new password scheme.
For the password, see the "about" page of this website. |
MALWARE TRAFFICS |
MALWARE TRAFFIC |
|
11.9.26 |
|
XWORM INFECTION |
Zip
files are password-protected. Of note, this site has a new password scheme.
For the password, see the "about" page of this website. |
MALWARE TRAFFICS |
MALWARE TRAFFIC |
|
10.9.26 |
|
Scans for Proxmox Servers |
About a week ago, Proxmox published an advisory revealing a
vulnerability in older versions of Proxmox VE, its flagship Virtual Environment
product. The vulnerability only affects version 7, which has not been supported
for a couple of years now. |
Vulnerebility |
SANS |
|
10.9.26 |
|
Redtail Payload Analysis |
Following a RedTail Linux Payload
from DShield to Dynamic Analysis
During monitoring of my DShield honeypot, I observed an attacker
uploading a collection of Linux executables targeting several processor
architectures. The files included ARM, ARM64, i686, RISC-V and x86-64 variants
named as part of a RedTail deployment package.
|
OS |
SANS |
|
9.9.26 |
 |
September 2026
Microsoft Patch Tuesday |
This month, Microsoft
released patches for a record-breaking 973 vulnerabilities, including
113 rated critical. It is by far the largest Patch Tuesday to date, well
ahead of the previous high of 664 set in July 2026. Two vulnerabilities
are listed as exploited in the wild, while none were publicly disclosed
before Patch Tuesday. Notable fixes include Windows privilege escalation
and critical RCEs in Skype for Business, MSMQ and RRAS. |
OS |
SANS |
|
5.9.26 |
|
ESSENTIAL MACOS STEALER INFECTION
|
Zip
files are password-protected. Of note, this site has a new password scheme.
For the password, see the "about" page of this website. |
MALWARE TRAFFICS |
MALWARE TRAFFIC |
|
4.9.26 |
|
Angry
Birds: Toy Ghouls’ new toys |
We continue tracking the
activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a
financially motivated group that has been targeting Russian organizations since
2025. The attackers initially relied
exclusively on tools pulled from public GitHub repositories along with leaked
Babuk and LockBit ransomware builders, later shifting to their
own custom ransomware, GenieLocker. In early July 2026, we observed the
group using a custom backdoor for the first time. |
APT |
SECURELIST |
|
3.9.26 |
|
Honeypot-Omaha and batch.py [Guest Diary] |
Honeypot-Omaha is a DShied
Sensor located at the Internet Storm Center (ISC) that is set up as a decoy for
the original target and deployed over the internet. It is a flawed and very
vulnerable system that was intentionally designed to attract threat actors with
malicious intents. I view it as a massive log aggregator that collects data that
an analyst like myself can then analyse, hypothesize, synthesize and then
generate a cohesive and coherent report. |
Security |
SANS |
|
3.9.26
|
 |
Guildma (Astaroth) malware infection from Brazilian Portuguese email |
On Monday
2026-08-31, I used a link from a malicious Brazilian Portuguese email to infect
a Windows host in my lab. This was a Guildma
(Astaroth) malware infection.The link from the email is
geofenced for Brazil, meaning that it would only deliver the malware if I
checked it from a Brazil-based IP address. |
Spam |
SANS |
|
2.9.26 |
|
Fire Ant Evolves: From Hypervisors to Trusted Infrastructure |
First
reported in 2025, Fire Ant remained active into 2026. Explore how the threat
actor expanded beyond hypervisors into trusted infrastructure, compromising
routers, authentication systems, and Linux management hosts to maintain
covert access, collect credentials and traffic, and reach connected high-value
environments. |
APT |
SYGNIA |
|
1.9.26 |
 |
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and
Africa with a new malware set |
While monitoring Mirage Kitten activity, we uncovered a
previously undocumented malware family that we dubbed NodeRabbit. We identified
the first sample on a system in Afghanistan. Further threat hunting revealed two
additional, more advanced, variants: one on a system in Egypt and another on a
system in Ethiopia. |
Virus |
SECURELIST |