threat.wiki

Threat intelligence notes, group profiles, named-person records, and defensive guidance.

Recent entries

Langflow CVE exploitation canary timeline: two attackers, two playbooks on the same AI-stack target (VulnCheck, Aug 2026) — VulnCheck's Aug 28 post (companion to its 1H-2026 State of Exploitation report) publishes canary telemetry on Langflow: 12 Langflow CVEs now with in-the-wild exploitation evidence (11 added during 2026) and 15,000+ successful canary attempts across CVE-2026-0769 / CVE-2025-3248 / CVE-2026-5027, with hundreds of Langflow hosts still active and vulnerable on the public internet (highest concentration: US). Two financially motivated attackers ran independent playbooks on the same target in the same window: Attacker 1 (May 12–Jun 8) entered via CVE-2026-5027, deployed a Python credential harvester + SimpleHelp RAT, exfiltrated to 23.234.98[.]182:9999, and established IRC C2 to 185.117.74[.]172:6667 with cron persistence 0 * * * * /usr/bin/3WA72N.sh; Attacker 2 (Apr 22–Jun 25) entered via CVE-2025-3248, then Chisel SOCKS5 → pearl-miner XMR mining → auditd disabled (forensic blind spot from Jun 10) → CVE-2026-0769 dropping .sysd/.cache-sysd/.watchdog.sh → PocSuite3 → SSH pivot to 216.78.235[.]34 for target expansion. Durable read: same target, divergent entry CVE, objective, C2, and kit — the tell is per-operator post-exploitation behavior, not "Langflow was hit."
Sality P2P botnet disrupted: CrowdStrike P2P sinkholing operation with DOJ/FBI ends a 23-year file-infecting botnet (Aug 31, 2026) — CrowdStrike Counter Adversary Operations, with the DOJ, FBI, DoD OIG DCIS, and Shadowserver (support: Europol, Eurojust, and LE in Bulgaria/Hungary/Romania), executed an Aug 31, 2026 P2P sinkholing disruption of the Sality botnet — a polymorphic file-infecting criminal infrastructure operating since 2003 across 33,000+ machines. Sality's durability came from two properties the sinkhole turned against it: no peer authentication (any host answering the P2P handshake was accepted — so a defender could join as an indistinguishable peer) and a file-infecting protocol that cannot be code-updated (every protocol weakness has been permanent for 20 years). The operation poisoned each bot's super-peer list during its ~40-minute peer-verification cycle, purging real super peers and injecting CrowdStrike-operated sinkholes; law enforcement simultaneously took down the URL-pack payload-hosting URLs, so infected hosts can no longer receive URL packs or file packs. Two independent P2P networks (v3/v4, same codebase/operator, incompatible protocols + different RSA keys) are now isolated and beaconing to sinkholes. The operator (a single financially motivated criminal, no state attribution) had used Sality's ~8-year-primary payload EggJagger (crypto-wallet clipjacking: clipboard monitoring, BTC/ETH address swap) to steal ≥₽12.1M (~$150K; portfolio peaked ~₽147M in Jan 2025) plus ran on-demand DDoS (Arabic financial forum 2016; Ukrainian forum Feb 25 2022, day after Russia's invasion; Russian crypto exchange Sept 2023). Durable defender core: the disruption does not remove installed malware — hunt the lighthouse UDP beacon to 188.166.101[.]148, the v3/v4 URL-pack URLs (theunforgiven.p8[.]hu, painelwebradiodigital.awardspace[.]info, sgwebdesigner.free[.]fr, yonelco[.]com, pozdravizbeograda[.]com, highclass.atspace[.]com, situluimihai.3x[.]ro, v4 gatheredovertime[.]com/nb4), and CrowdStrike's two YARA rules on the embedded RSA public keys; file-infecter hygiene (shared folders, removable media, self-modifying executables) is the standing prevention (CrowdStrike, Sep 1).
Rogue ScreenConnect installations across unrelated hosts: worm-like VBS propagation via guest file transfer (Huntress, Sep 3) — Huntress' Sep 3 report on three separate-organization incidents (Aug 20/20/24) where tech-support-scam social engineering lands a rogue ScreenConnect client that spawns wscript.exe and a four-stage VBS loader chain (1.vbs–4.vbs from a RAR on C2): host profiling + EDR enumeration → Base64/XOR-0x90 catalogue (map.txt) → encrypted out.enc fetch → AES-CBC decrypt to sys_cache.zip + elevated PyTorchFix.ps1 (inline-C# Password.exe, ms-settings:/ComputerDefaults.exe UAC bypass, amsiInitFailed AMSI bypass, C:\Users-wide Defender exclusion, concealed ScreenConnect client with removed Registry Uninstall entry, WindowsServiceHost Run-Key persistence, combo.zip miner + WinRing0 svcdrv64.sys, plus UltraViewer on some hosts). The differentiator is worm-like propagation: when the host profile state is 010/011, the fourth stage mirrors all four VBS files into C:\Users\Public\Libraries\Default\Lib\Lib1, making each infected host a content-delivery node for newly connected ScreenConnect endpoints. Same-day ConnectWise advisory: guest file-transfer capability affects Cloud + On-Premise, CVE/fix "within the week", interim mitigation = disable TransferFiles/TransferFilesInSession role permissions; the RunFiles/RanFiles Process: Guest audit-log entry is the durable tell.
Impersonating IT support: human-operated Teams external-collaboration intrusion that hands off to a portable Node.js JavaScript implant and WinRM pivoting to DCs/CA (Microsoft, Sep 2) — Microsoft Security Research documents a full HOBK enterprise intrusion that abuses Teams external collaboration to impersonate IT/helpdesk (vishing layered so malicious instructions never land in chat logs), socially engineers a victim into an interactive remote session (Quick Assist / RMM), then uses in-session PowerShell to download and silently install a benign-named MSI ("devfix"/"Hotfix") from attacker cloud storage. The MSI stages a portable Node.js runtime + encrypted JavaScript implant under LocalAppData (per-user EdgeUpdate Run-key/Startup persistence; loaders use .tmp/.ini/.dat/.bin/.cfg extensions, sometimes a renamed node.exe), which randomized-HTTPS long-polls C2 and executes C2-delivered JavaScript: host/AD recon, display-adapter + AV sandbox checks, periodic Base64 desktop screenshots, rundll32 follow-on DLLs, ADSI domain enumeration, and WinRM 5985 lateral movement toward domain controllers and CAs. Recovered builds also carry dormant Ethereum smart-contract C2 URL discovery (disabled; contract stores only a URL string). Durable read: a signed, trusted Node.js runtime executing attacker JavaScript plus EdgeUpdate-named per-user persistence is the high-signal tell — this is the same "trusted interpreter as malware-delivery channel" pattern Symantec catalogued on Sep 4.
Counterfeit installers to system compromise: the Silver Fox / Yinhu fake-software campaign, per-request payload regeneration, and a TrueUpdate-abusing ~60s scheduled-task persistence loop (Microsoft, Sep 1) — Microsoft Defender Experts (moderate-confidence Silver Fox / Yinhu assessment, commodity/non-nation-state) tracks a campaign where high-fidelity vendor-clone .com.cn/.hl.cn download pages (Razer pc-razerzone[.]com[.]cn, Microsoft Edge, Kaspersky, Sejda, NetEase Youdao, DiskGenius, Baidu Pan, oCam, draw.io, SteelSeries, Sogou, Calibre, MindMaster-typosquat + others) all funnel to a small set of dedicated delivery hosts (gehie246[.]com/712down, yimxg25tiy[.]com/73inst, cc8ttkv35b[.]com/7qinst, n7b8t85zsg[.]com/ins711) and an attacker Alibaba Cloud OSS bucket. The defining behavior: the installer archive keeps the same filename but its hash changes on every download — server-side, per-request payload regeneration (two content-distinct copies of app_setup.6653004.zip written ~69s apart). Wrapper → randomized stage-one (stable SHA-256 676a2a7b… under many names) → later-stage 6d6ba2bc… (forged "Philips Speech Driver" version resource with a TODO: <Product name> placeholder — confirmed fabrication) → TrueUpdate-abusing persistent stage c6100166… in C:\ProgramData\<random>\, re-launched every ~60s by the Task Scheduler (svchost -k netsvcs -s Schedule), connecting to the Alibaba OSS bucket over TLS to fetch further payloads; it writes sweeping Defender exclusions, runs vssadmin delete shadows, and disables Windows Update (wuauserv/UsoSvc/uhssvc/WaaSMedicSvc) — the classic pre-ransomware posture. C2 on 9 IPs × 9 ports + six-character .net domains; delivery domains in shared ASN AS132839 / AS8796 pairs (treat as hunting pivots, not blocklists). Primarily China-based multinational operations and Chinese-speaking users across healthcare, manufacturing, gaming, tech, logistics, government, and education. Durable read: same-filename/changing-hash + archiver-parented randomized drop + Defender-exclusion/shadow/WinUpdate triad = the Silver Fox / Yinhu shape; correlate with Qianxin's Operation Phnom Penh MODBEACON distributor.
SiYuan kernel publish-mode security batch: 3 critical 10.0 unauthenticated SQL-execution flaws in publish mode + 9 high / 8 medium access-control bypasses across 20 GHSAs — A coordinated 20-advisory GHSA batch (Sep 3) against the self-hosted SiYuan knowledge-base kernel: the 3 critical (10.0) unauthenticated SQL-execution flaws (CVE-2026-69083 via fullTextSearchAssetContent, CVE-2026-69084 via searchEmbedBlock, CVE-2026-72811 backlink/mention search) each pass a client-supplied full SQL statement verbatim to a read-write siyuan.db handle through a statement-stacking-capable driver — so an anonymous attacker (when Publish.Auth.Enable is off) can read and write across all cleartext notebooks; the 9 high include CVE-2026-72809 (localhost-trust admin bypass via the fixed-port proxy, remotely reachable if bound to a network interface), CVE-2026-72807 (second-order SSTI→SQL via an imported malicious AV package), and CVE-2026-72801 (encrypted-notebook key-derivation material + wrapped keys disclosed to anonymous readers), with 8 medium access-control bypasses rounding out the batch; fixed in v3.8.3-alpha.1 (hardening commits 2026-07-21→07-23) — inventory self-hosted SiYuan instances, don't expose the kernel to the open internet, set Publish.Auth.Enable to true and enforce the publish-password tier, and treat any imported AV package as potentially hostile (GitHub GHSAs, Sep 3)
PostGREShell: PostgreSQL's 12-year-old logical-decoding flaw (CVE-2026-6471, 7.2) — a REPLICATION-attribute account hands CREATE_REPLICATION_SLOT the output-plugin name directly to the loader with no validation (the LOAD restriction check_restricted_library_name() is never called on the replication path), so a full filesystem path reaches dlopen()/LoadLibrary() as typed — fully remote on Windows via SMB UNC (nothing written to the target; exploit is three lines of Python), NFS-automount on Linux/macOS, local-file-write elsewhere; Cyera's PoC escalates to permanent superuser (direct pg_authid write bypassing the SQL executor) plus three overlapping persistence mechanisms (open pg_hba.conf anyone-as-anyone, shared_preload_libraries auto-reload, auto-reapply on revert); their VirusTotal hunt found 114 malicious PostgreSQL plugins already in the wild (trojans, miners, reverse shells); fixed Aug 13, 2026 via the output_plugin_libraries allowlist defaulting to pgoutput, test_decoding — any CDC/replication pipeline on wal2json/decoderbufs/non-default plugins breaks until manually allowlisted; fixed 18.6/17.11/16.15/15.19/14.24, no patch path for EOL 9.4–13 (14 EOLs Nov 12, 2026); block outbound SMB 445 / NFS 2049 from DB hosts and audit replication accounts (Cyera / THN, Sep 1–4)
"ted backdoor": Rapid7's previously-undocumented Linux espionage toolkit targeting South Korea's automotive and media sectors — a backdoor compiled into the victim's HAProxy 2.8.12 (native filter API / memory pools / event scheduler / process management) that intercepts web traffic while genuine load balancing continues, tunneling C2 as HTTP through the load balancer and bypassing HAProxy logging via raw send() on named FIFOs; alongside it: a curl-based CurlRAT (watchdog thread polls /proc/haproxy.pid hourly reporting to writeservice_info; libvirtlog.so.0 sandbox check; 10 KB system-info beacon; MD5 of hostname+IP+hardware-UUID+cron-version as the User-token header), a PAM SSH keylogger (encrypted plaintext-credential log at /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19), passive web-session capture with response-body script injection, and trojanized crond/agetty/atd/sshd/polkitd; medium-confidence DPRK APT attribution (APT37-linked hardcoded C2 list in the shared img.<name>.<tld> registration-workflow pattern incl. Naver-mimicking img.responsive.pstatic[.]autos; simple XOR + substitution-cipher tradecraft); earliest VT uploads mid-2025 on HAProxy 2.8.12-0fdb194 (Nov 22, 2024 release = earliest compilation bound) — a long-term-surveillance kit, not ransomware; the tell is a load balancer rewriting responses it should only be routing (Rapid7, Sep 4)
ulid-xyz transitive delivery chain: a cross-platform MicrosoftSystem64 remote access trojan hidden three npm dependencies deep — ioredis-xyz (a byte-for-byte copy of the real ioredis client) → redis-type-xyz (empty manifest posing as Redis OM) → ulid-xyz (typosquat of ulidx carrying the payload), armed just 19 minutes after the entry package shipped via a caret range in redis-type-xyz@1.10.6 (MAL-2026-6672/-11205/-5882); 467 KB postinstall-bundled beacon over WebSocket to Hetzner C2 on port 8010 with a deploy_binary operator-chosen second stage; persistence named MicrosoftSystem64 on all three OSes; seeded in 28 purpose-built AI/fintech/trading GitHub repos — same implant name, persistence design, C2 port, Hetzner hosting, and direct whisdev operator overlap as the js-logger-pack cluster (FAMOUS CHOLLIMA / Contagious Interview, DPRK-linked); the durable tell is the persistence name, not the package (SafeDep, Sep 1)
GPT-6 "Astra" launch: ExploitBench 100% (vs 78.5% GPT-5.6 Sol), FrontierMath Tier 4 98%, ARC-AGI-3 99.9% — released version deliberately limited to secure code review and patching, refuses PoC-exploit prompts; "OpenAI Daybreak" to roll out less restrictive safeguards in coming weeks; capability and refusal are decoupled, vendor-controlled, and reversible — treat "the model refuses this PoC" as a policy state, not a capability limit (THN / OpenAI, Sep 3)

Sections

Ops — campaign timelines, compromise chains, and sequencing
Tools — malware, payloads, implants, and attacker infrastructure
Groups — crews, cluster names, and shared operational personas
People — publicly identified individuals or project personas when public sourcing supports it
Patterns — reusable defender heuristics
Notes — taxonomy, usage, and editorial guidance