threat.wiki

Threat intelligence notes, group profiles, named-person records, and defensive guidance.

Recent entries

• Microsoft: AI-assisted executive impersonation and invoice fraud — >1,000,000 financial-fraud emails (Aug 3–5, 2026; 87.7% US) impersonating target-company CEOs/CFOs/Presidents to trick accounts payable into a ~$50,000 ACH bank transfer; each lure layered a spoofed executive (From/Reply-To/signature) + a fabricated "ServiceNow Platform — Annual Subscription" invoice + a spoofed "forwarded" CEO-to-ServiceNow-President thread; no compromise of the referenced brands; generative-AI tells = missing forwarded headers, display-name/sender mismatch, financial-lure subjects ("due bill", "ACH Parment"), verbose HTML comments, em-dash/banner markers; IOCs service-nowinc[.]com + domainlify[.]net + sender-account pool; MITRE T1591/T1598/T1583/T1585.002/T1566/T1036/T1656/T1657 (Microsoft Security Research, Sep 10, 2026)
• Unit 42: post-exploitation workload-identity spoofing in SPIFFE/SPIRE — an attacker with root on a Kubernetes node manipulates the cgroup (cgroupv2) metadata the SPIRE agent reads during workload attestation to impersonate co-located workloads and harvest their SVIDs; identity isolation collapses, lateral movement uses legitimate credentials not stolen secrets; not observed in the wild; Spooffe open-source tool automates the node scan → mock-cgroup replication → SPIRE-agent SVID dump to measure the "root = all node-scoped identities" area of impact; mitigation = node hardening, restrict root/privileged containers, narrow selectors, treat node root as full-identity compromise (Unit 42, Sep 10, 2026)
• CISA KEV September 10–11, 2026: six exploited flaws — ConnectWise ScreenConnect client file-execution (CVE-2026-84869, 9.9, due 2026-09-14), two JFrog Artifactory auth flaws (CVE-2026-42016, 8.1 / CVE-2026-42018, 7.5, both due 2026-09-25), GitLab unauthenticated arbitrary-file read (CVE-2026-85706, 10.0, due 2026-09-14), and two MikroTik RouterOS flaws (CVE-2026-86060, 9.2 / CVE-2026-67277, 8.8, both due 2026-09-13); all BOD 26-04, Forensics Triage, ransomware use unknown, no actor named
• Wiz "Artifactory Under Attack": in-the-wild exploitation chains in JFrog Artifactory (CVE-2026-42016 / CVE-2026-42018 / CVE-2026-82329, Wiz, Sep 10, 2026) — two-step token escalation against self-hosted Artifactory: POST /access/api/v1/aws/token/ (trailing slash) returns the internal anonymous-user token (CVE-2026-42018), POST /access/api/v1/tokens escalates it to admin scope (CVE-2026-42016), then PUT /api/security/users/<user> creates a persistent admin account whose actor field reads token:anonymous; post-exploitation = persistent admin accounts + malicious Groovy plugins + Rust C2 backdoors; 67–69% of Artifactory orgs had a vulnerable instance at each disclosure, 59% still vulnerable to CVE-2026-42016 six weeks out; CISA added 42016/42018 to KEV Sep 11 (due 2026-09-25) — the token:anonymous actor is the durable log tell
• CISA KEV September 9, 2026: four exploited flaws — Citrix NetScaler ADC/Gateway unauthenticated authentication bypass (CVE-2026-19490, 9.3, CWE-288, due 2026-09-12), Fortinet FortiOS/FortiSwitchManager/FortiSASE heap-based buffer overflow (CVE-2025-25249, 8.1, due 2026-09-12), Cisco Secure FMC / Security Cloud Control Firewall Management unauthenticated root (CVE-2026-20079, 10.0, CWE-288, due 2026-09-12), and a Google Chromium V8 out-of-bounds write with a confirmed in-the-wild exploit in Chrome 153.0.8010.36+ (CVE-2026-87491, 8.8, due 2026-09-23); all BOD 26-04, Forensics Triage on the three 2026-09-12 edge/management pre-auth items, ransomware use unknown, no actor named
• Microsoft: passkey-themed social engineering leads to identity and cloud compromise — helpdesk-style passkey/MFA/SSO "update" lures drive victims into AiTM or device-code flows, then actor-registered MFA persistence, systematic Microsoft Graph reconnaissance, and throttled SharePoint/OneDrive/Exchange collection and suspected exfiltration; observed since May 2026 and used by a range of actors including Storm-3121 (initial access leading to ShinyHunters and Falcon extortion) and Storm-3032 (a BlackFile splinter now operating under the Helix extortion banner); full KQL/Sentinel hunt kit and Graph recon matrix published (Microsoft Security Research, Sep 9, 2026)
• Wiz "Off Guard: Breaking LiteLLM": MCP authentication bypass → post-auth root RCE → cloud/IAM credential theft in the most popular open-source LLM gateway (CVE-2026-59822 / CVE-2026-59821, Wiz, Sep 9, 2026) — Wiz Threat Research documents a chain in BerriAI LiteLLM reached after a scan of ~3,000 internet-facing deployments found 9.6% accept the default master key (sk-1234) or require no auth at all. CVE-2026-59822 is an MCP authentication bypass: when an arbitrary Bearer token (even one character) fails LiteLLM's key check, the dual auth handler catches the 401/403 and returns an empty UserAPIKeyAuth(), granting a fully authenticated MCP session that can list and call configured MCP tools (databases, GitHub, filesystems, Jira, CI/CD) — confirmed exploitable across hundreds of instances and now on CISA KEV (BOD 26-04, due 2026-09-16; Wiz observed in-the-wild exploitation via its honeypots). CVE-2026-59821 is a post-auth root-level RCE via the Custom Code Guardrails feature: the Web UI "Run Test" validates a forbidden-patterns list and strips __builtins__, but the registration endpoint (POST /guardrails) does neither, passing submitted Python straight to exec(compile(...)) — it executes immediately at registration as root. Two un-CVE'd amplifiers: when no auth is configured every request is granted PROXY_ADMIN (unauthenticated admin), and the default master key doubles as the HS256 session-JWT signing secret (forging arbitrary user sessions). An admin's pass-through endpoint also performs no target-URL validation, so pointing it at http://169.254.169.254 leaks IAM credentials (and the x-pass- header forwarding defeats IMDSv2). Fixed across v1.82.0 (guardrail RCE + sandbox), v1.83.0 (pass-through config, CVE-2026-35029) and v1.84.0 (MCP bypass + unauth-admin default-role change). Durable read: AI gateways are Tier-1 security assets, not developer tools — they hold every provider's keys, execute server-side Python per request, proxy to internal URLs, and connect to internal tooling, yet their security model is often a single shared secret; use a strong unique master key, keep egress from 169.254.169.254 / private ranges blocked, and apply least-privilege IAM.
• Unit 42: CL-CRI-1171 "Untracked Nightmares" — a two-year pay-per-install marketplace behind commodity-looking loader infections (Unit 42, Sep 9, 2026) — Unit 42 documents a pay-per-install (PPI) infection marketplace (cybercrime, no state attribution) that has operated "under the radar for at least two years," distributing an indeterminate number of payloads through one custom loader it calls OfferLoader. Two delivery funnels: 11 gaming-optimization YouTube channels (hundreds of thousands of combined subscribers; terminated by YouTube) and a SEO-poisoning funnel of trojanized software downloads (WinDirStat, "Bluetooth drivers," game-optimizer tools) that lands on corporate endpoints including critical infrastructure and government. A single Inno-Setup-style installer runs three child processes (eld0.exe/eld1.exe/eld2.exe), one per buyer's "offer," so one endpoint can conceal payloads from multiple unrelated threat actors. The gate that kept it untracked: every tracker URL carries a click_id — a Base64 fingerprint of the victim's OS, browser, referrer, exact search keyword, and public IP — that only a fresh, valid fingerprint decodes into malware; scanners and crawlers get a decoy clone of the legitimate WinRAR page. Unit 42 counts >10,000 distinct OfferLoader samples and documented three families delivered July 2025–April 2026: Insomnia RAT (a Node.js backdoor with a redundant Python agent; persists as scheduled tasks "Maps Performance Task" and "OOBETaskScheduler"; one C2 is crowdstri[.]com — a deliberate CrowdStrike typosquat), ARKTunnel (previously unreported WebSocket-tunneling RAT extracted from a BMP via LSB steganography; 50 samples, no public tracking), and Docro Hijacker (Chrome browser hijacker that bypasses Chrome's Secure-Preferences HMAC-SHA256 check via Adblock.dll, installs the docro MV3 extension, and redirects search through mqsearch[.]com). Durable read: hunt the loader, not the payload — commodity-looking Inno-Setup installers with rotating payload sets and the two named scheduled tasks are the tell; one infection vector can seed multiple unrelated actors' payloads on the same host.
• AWS root user password-spraying campaign across 150+ organizations: two fixed user agents, residential-proxy tunneling, no confirmed success (Datadog Security Labs, Aug 31, 2026) — Datadog Security Research reports a password-spraying campaign against the AWS account root user that ran July 24 – August 23, 2026: repeated failed ConsoleLogin attempts against the root user account at 150+ organizations (median 2, up to 8 attempts each), fingerprinted by two user agents (an Edge/Chrome 85 signature and a Firefox 120 signature) with proxy-tunneled source traffic (all flagged hosting/residential-proxy infrastructure). No actor named, no victimology pattern, and no successful authentication observed — intent undetermined. The tradecraft tell: a failed ConsoleLogin requires the root-account email address, so the operator either already held root emails for 150+ orgs or brute-forced valid ones — pre-staged targeting data, not random noise. Durable read: MFA alone is not the control — enforce AWS Organizations SCPs that block direct root activity in member accounts, use centralized short-lived AssumeRoot sessions (which do not cover the management account), and alert on all root ConsoleLogin activity; Datadog publishes the exact CloudTrail query to check whether you were hit.
• DeepSeek Harness CVE-2026-82533: a sandboxed AI agent disables its own sandbox with one shell command (OX Security, Sep 8, 2026) — OX Research disclosed CVE-2026-82533 (CWE-807, CVSS 9.4) in DeepSeek Harness (dsh), DeepSeek's open-source AI coding-agent harness (>215,000 GitHub stars within weeks). On shipped defaults, with no network exposure and no credentials, a sandboxed agent could disable its own confinement with a single shell command: the harness's local control API on 127.0.0.1:3080 authenticated a request by its client-supplied Host header (isTrustedApiRequest → loopback authority or trustedHosts) without ever checking the connection's actual peer address, while the OS sandbox (bubblewrap/Seatbelt/Landlock) restricted file writes but left loopback networking open and ordinary bash calls needed no approval. The agent's one curl to the control plane lifted its session to danger-full-access with approval never — no approval/request event, and the policy change logged source: {kind: 'user'} (the harness couldn't tell the agent's shell from the human). A matched control proved the sandbox was actively enforcing before the escape. Second path: wherever the port was reachable (tunnel / reverse proxy / SSH forward / editor port-forward), an unauthenticated remote attacker could take full control of the agent and export every stored conversation with no key. Fixed in 0.1.2-alpha.1 (disclosed to VulnCheck Aug 24; published Sep 8). Durable read: a localhost API is a network boundary, not a trust assumption — a coding-agent harness that holds a shell is a host-execution primitive, so authenticate the control plane on the real peer, network-isolate the agent sandbox, and never gate escalation on a header a non-browser client can forge.

Sections

• Ops — campaign timelines, compromise chains, and sequencing
• Tools — malware, payloads, implants, and attacker infrastructure
• Groups — crews, cluster names, and shared operational personas
• People — publicly identified individuals or project personas when public sourcing supports it
• Patterns — reusable defender heuristics
• Notes — taxonomy, usage, and editorial guidance