threat.wiki

Threat intelligence notes, group profiles, named-person records, and defensive guidance.

Recent entries

• SiYuan kernel publish-mode security batch: 3 critical 10.0 unauthenticated SQL-execution flaws in publish mode + 9 high / 8 medium access-control bypasses across 20 GHSAs — A coordinated 20-advisory GHSA batch (Sep 3) against the self-hosted SiYuan knowledge-base kernel: the 3 critical (10.0) unauthenticated SQL-execution flaws (CVE-2026-69083 via fullTextSearchAssetContent, CVE-2026-69084 via searchEmbedBlock, CVE-2026-72811 backlink/mention search) each pass a client-supplied full SQL statement verbatim to a read-write siyuan.db handle through a statement-stacking-capable driver — so an anonymous attacker (when Publish.Auth.Enable is off) can read and write across all cleartext notebooks; the 9 high include CVE-2026-72809 (localhost-trust admin bypass via the fixed-port proxy, remotely reachable if bound to a network interface), CVE-2026-72807 (second-order SSTI→SQL via an imported malicious AV package), and CVE-2026-72801 (encrypted-notebook key-derivation material + wrapped keys disclosed to anonymous readers), with 8 medium access-control bypasses rounding out the batch; fixed in v3.8.3-alpha.1 (hardening commits 2026-07-21→07-23) — inventory self-hosted SiYuan instances, don't expose the kernel to the open internet, set Publish.Auth.Enable to true and enforce the publish-password tier, and treat any imported AV package as potentially hostile (GitHub GHSAs, Sep 3)
• PostGREShell: PostgreSQL's 12-year-old logical-decoding flaw (CVE-2026-6471, 7.2) — a REPLICATION-attribute account hands CREATE_REPLICATION_SLOT the output-plugin name directly to the loader with no validation (the LOAD restriction check_restricted_library_name() is never called on the replication path), so a full filesystem path reaches dlopen()/LoadLibrary() as typed — fully remote on Windows via SMB UNC (nothing written to the target; exploit is three lines of Python), NFS-automount on Linux/macOS, local-file-write elsewhere; Cyera's PoC escalates to permanent superuser (direct pg_authid write bypassing the SQL executor) plus three overlapping persistence mechanisms (open pg_hba.conf anyone-as-anyone, shared_preload_libraries auto-reload, auto-reapply on revert); their VirusTotal hunt found 114 malicious PostgreSQL plugins already in the wild (trojans, miners, reverse shells); fixed Aug 13, 2026 via the output_plugin_libraries allowlist defaulting to pgoutput, test_decoding — any CDC/replication pipeline on wal2json/decoderbufs/non-default plugins breaks until manually allowlisted; fixed 18.6/17.11/16.15/15.19/14.24, no patch path for EOL 9.4–13 (14 EOLs Nov 12, 2026); block outbound SMB 445 / NFS 2049 from DB hosts and audit replication accounts (Cyera / THN, Sep 1–4)
• "ted backdoor": Rapid7's previously-undocumented Linux espionage toolkit targeting South Korea's automotive and media sectors — a backdoor compiled into the victim's HAProxy 2.8.12 (native filter API / memory pools / event scheduler / process management) that intercepts web traffic while genuine load balancing continues, tunneling C2 as HTTP through the load balancer and bypassing HAProxy logging via raw send() on named FIFOs; alongside it: a curl-based CurlRAT (watchdog thread polls /proc/haproxy.pid hourly reporting to writeservice_info; libvirtlog.so.0 sandbox check; 10 KB system-info beacon; MD5 of hostname+IP+hardware-UUID+cron-version as the User-token header), a PAM SSH keylogger (encrypted plaintext-credential log at /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19), passive web-session capture with response-body script injection, and trojanized crond/agetty/atd/sshd/polkitd; medium-confidence DPRK APT attribution (APT37-linked hardcoded C2 list in the shared img.<name>.<tld> registration-workflow pattern incl. Naver-mimicking img.responsive.pstatic[.]autos; simple XOR + substitution-cipher tradecraft); earliest VT uploads mid-2025 on HAProxy 2.8.12-0fdb194 (Nov 22, 2024 release = earliest compilation bound) — a long-term-surveillance kit, not ransomware; the tell is a load balancer rewriting responses it should only be routing (Rapid7, Sep 4)
• ulid-xyz transitive delivery chain: a cross-platform MicrosoftSystem64 remote access trojan hidden three npm dependencies deep — ioredis-xyz (a byte-for-byte copy of the real ioredis client) → redis-type-xyz (empty manifest posing as Redis OM) → ulid-xyz (typosquat of ulidx carrying the payload), armed just 19 minutes after the entry package shipped via a caret range in redis-type-xyz@1.10.6 (MAL-2026-6672/-11205/-5882); 467 KB postinstall-bundled beacon over WebSocket to Hetzner C2 on port 8010 with a deploy_binary operator-chosen second stage; persistence named MicrosoftSystem64 on all three OSes; seeded in 28 purpose-built AI/fintech/trading GitHub repos — same implant name, persistence design, C2 port, Hetzner hosting, and direct whisdev operator overlap as the js-logger-pack cluster (FAMOUS CHOLLIMA / Contagious Interview, DPRK-linked); the durable tell is the persistence name, not the package (SafeDep, Sep 1)
• GPT-6 "Astra" launch: ExploitBench 100% (vs 78.5% GPT-5.6 Sol), FrontierMath Tier 4 98%, ARC-AGI-3 99.9% — released version deliberately limited to secure code review and patching, refuses PoC-exploit prompts; "OpenAI Daybreak" to roll out less restrictive safeguards in coming weeks; capability and refusal are decoupled, vendor-controlled, and reversible — treat "the model refuses this PoC" as a policy state, not a capability limit (THN / OpenAI, Sep 3)
• Node.js runtime as malware-delivery channel: Symantec documents node.exe-anchored implant chains across multiple campaigns since February 2026 (Asian tech company via ClickFix → AdaptixC2/Cobalt blocked → official Node.js installer + EtherHiding; ModeloRAT/Mistic KongTuke chains; US fintech → C2Looper Rust backdoor) — the signed, trusted runtime executing attacker JavaScript plus a registry-Run persistence key defeats signature and publisher heuristics; a node.exe-anchored implant on a non-development host after first-choice C2 was blocked is the high-signal tell (Symantec via THN, Sep 4)
• RMM phishing campaign spanning 46 countries: US is now the top target (45% of 601 connected cases), lures include CRA/SSA tax forms, UPS/shipping and invoices; 425 kit URLs across 240 hosts (94% single-day-lived) on Vercel/GitHub Pages/Netlify with S3/Cloudflare R2/DigitalOcean Spaces/Dropbox/GoFile payload staging — the durable tell is the shared font1.woff2 asset and secure.html → project/*.zip structure, not the disposable domain; detect on the RMM install event, not the kit (ANY.RUN via THN, Sep 4)
• BraZetsu / Exilware: Group-IB's high-confidence attribution of a Python-based Windows IAB master toolkit to the Brazilian actor Exilware — five in-wild versions since Feb 2, 2026, heavy logged generative-AI triage and target prioritization, CNAB/CNABHunter corporate-remittance-fraud overlap, Ousaban delivery-domain reuse, and fueling the "Infected Marketplace" (Banco de Infects / infect[.]online) access-as-a-service platform (~$5.80 initial deposit) where buyers remotely deploy their own payloads on purchased hosts — initial access as replenishable inventory (Group-IB, Sep 3)
• Cisco Nexus 9000 CVE-2026-20212 (CVSS 9.8): unauthenticated remote root RCE on 10 Silicon One-based switches — a service bound to an unrestricted IP exposes TCP 43210/43211 in the default L3 VRF, 45 NX-OS releases 10.3(1)–10.6(3s) affected with no public fixed-release table (Software Checker only); iACL block + Live Protect stopgaps; same window ships an IOS XR hardening release bundling 7 umbrella CVEs (two 9.8) with no workaround — read the advisory, not the CVE count (THN / Cisco, Sep 2–3)
• Unit 42: two LLM-orchestrated LATAM intrusion campaigns with exposed AI backends — CL-CRI-1131 (Mexican transportation/gov/water utilities; LotL batch-script SAM/NTDS dumps with visible LLM trial-and-error; exfil pivot 62.171.185[.]97 → m-doxa-*.duckdns[.]org multi-SAN cert revealing target list apodo/geo/intel/vacunas; internet-exposed NextChat LLM UI on 178.128.87[.]160:3000) and CL-CRI-1163 (Brazilian financial; resume-themed phishing → homebrewed RATs → SockTz v1–v9 installed in a 2-hour window; open staging dir at 167.148.195[.]53 exposing hundreds of LLM-tell scripts *_output/exploit_creative.py/exploit_careful.py); overlapping SOCKS5 relay infra corroborates Trend's SHADOW-AETHER and CloudSEK's "Operation Escaneo" — treat the LLM itself as attack infrastructure and hunt exposed NextChat/staging (Unit 42, Sep 3)

Sections

• Ops — campaign timelines, compromise chains, and sequencing
• Tools — malware, payloads, implants, and attacker infrastructure
• Groups — crews, cluster names, and shared operational personas
• People — publicly identified individuals or project personas when public sourcing supports it
• Patterns — reusable defender heuristics
• Notes — taxonomy, usage, and editorial guidance