threat.wiki

Threat intelligence notes, group profiles, named-person records, and defensive guidance.

Recent entries

Rogue ScreenConnect installations across unrelated hosts: worm-like VBS propagation via guest file transfer (Huntress, Sep 3) — Huntress' Sep 3 report on three separate-organization incidents (Aug 20/20/24) where tech-support-scam social engineering lands a rogue ScreenConnect client that spawns wscript.exe and a four-stage VBS loader chain (1.vbs–4.vbs from a RAR on C2): host profiling + EDR enumeration → Base64/XOR-0x90 catalogue (map.txt) → encrypted out.enc fetch → AES-CBC decrypt to sys_cache.zip + elevated PyTorchFix.ps1 (inline-C# Password.exe, ms-settings:/ComputerDefaults.exe UAC bypass, amsiInitFailed AMSI bypass, C:\Users-wide Defender exclusion, concealed ScreenConnect client with removed Registry Uninstall entry, WindowsServiceHost Run-Key persistence, combo.zip miner + WinRing0 svcdrv64.sys, plus UltraViewer on some hosts). The differentiator is worm-like propagation: when the host profile state is 010/011, the fourth stage mirrors all four VBS files into C:\Users\Public\Libraries\Default\Lib\Lib1, making each infected host a content-delivery node for newly connected ScreenConnect endpoints. Same-day ConnectWise advisory: guest file-transfer capability affects Cloud + On-Premise, CVE/fix "within the week", interim mitigation = disable TransferFiles/TransferFilesInSession role permissions; the RunFiles/RanFiles Process: Guest audit-log entry is the durable tell.
Impersonating IT support: human-operated Teams external-collaboration intrusion that hands off to a portable Node.js JavaScript implant and WinRM pivoting to DCs/CA (Microsoft, Sep 2) — Microsoft Security Research documents a full HOBK enterprise intrusion that abuses Teams external collaboration to impersonate IT/helpdesk (vishing layered so malicious instructions never land in chat logs), socially engineers a victim into an interactive remote session (Quick Assist / RMM), then uses in-session PowerShell to download and silently install a benign-named MSI ("devfix"/"Hotfix") from attacker cloud storage. The MSI stages a portable Node.js runtime + encrypted JavaScript implant under LocalAppData (per-user EdgeUpdate Run-key/Startup persistence; loaders use .tmp/.ini/.dat/.bin/.cfg extensions, sometimes a renamed node.exe), which randomized-HTTPS long-polls C2 and executes C2-delivered JavaScript: host/AD recon, display-adapter + AV sandbox checks, periodic Base64 desktop screenshots, rundll32 follow-on DLLs, ADSI domain enumeration, and WinRM 5985 lateral movement toward domain controllers and CAs. Recovered builds also carry dormant Ethereum smart-contract C2 URL discovery (disabled; contract stores only a URL string). Durable read: a signed, trusted Node.js runtime executing attacker JavaScript plus EdgeUpdate-named per-user persistence is the high-signal tell — this is the same "trusted interpreter as malware-delivery channel" pattern Symantec catalogued on Sep 4.
Counterfeit installers to system compromise: the Silver Fox / Yinhu fake-software campaign, per-request payload regeneration, and a TrueUpdate-abusing ~60s scheduled-task persistence loop (Microsoft, Sep 1) — Microsoft Defender Experts (moderate-confidence Silver Fox / Yinhu assessment, commodity/non-nation-state) tracks a campaign where high-fidelity vendor-clone .com.cn/.hl.cn download pages (Razer pc-razerzone[.]com[.]cn, Microsoft Edge, Kaspersky, Sejda, NetEase Youdao, DiskGenius, Baidu Pan, oCam, draw.io, SteelSeries, Sogou, Calibre, MindMaster-typosquat + others) all funnel to a small set of dedicated delivery hosts (gehie246[.]com/712down, yimxg25tiy[.]com/73inst, cc8ttkv35b[.]com/7qinst, n7b8t85zsg[.]com/ins711) and an attacker Alibaba Cloud OSS bucket. The defining behavior: the installer archive keeps the same filename but its hash changes on every download — server-side, per-request payload regeneration (two content-distinct copies of app_setup.6653004.zip written ~69s apart). Wrapper → randomized stage-one (stable SHA-256 676a2a7b… under many names) → later-stage 6d6ba2bc… (forged "Philips Speech Driver" version resource with a TODO: <Product name> placeholder — confirmed fabrication) → TrueUpdate-abusing persistent stage c6100166… in C:\ProgramData\<random>\, re-launched every ~60s by the Task Scheduler (svchost -k netsvcs -s Schedule), connecting to the Alibaba OSS bucket over TLS to fetch further payloads; it writes sweeping Defender exclusions, runs vssadmin delete shadows, and disables Windows Update (wuauserv/UsoSvc/uhssvc/WaaSMedicSvc) — the classic pre-ransomware posture. C2 on 9 IPs × 9 ports + six-character .net domains; delivery domains in shared ASN AS132839 / AS8796 pairs (treat as hunting pivots, not blocklists). Primarily China-based multinational operations and Chinese-speaking users across healthcare, manufacturing, gaming, tech, logistics, government, and education. Durable read: same-filename/changing-hash + archiver-parented randomized drop + Defender-exclusion/shadow/WinUpdate triad = the Silver Fox / Yinhu shape; correlate with Qianxin's Operation Phnom Penh MODBEACON distributor.
SiYuan kernel publish-mode security batch: 3 critical 10.0 unauthenticated SQL-execution flaws in publish mode + 9 high / 8 medium access-control bypasses across 20 GHSAs — A coordinated 20-advisory GHSA batch (Sep 3) against the self-hosted SiYuan knowledge-base kernel: the 3 critical (10.0) unauthenticated SQL-execution flaws (CVE-2026-69083 via fullTextSearchAssetContent, CVE-2026-69084 via searchEmbedBlock, CVE-2026-72811 backlink/mention search) each pass a client-supplied full SQL statement verbatim to a read-write siyuan.db handle through a statement-stacking-capable driver — so an anonymous attacker (when Publish.Auth.Enable is off) can read and write across all cleartext notebooks; the 9 high include CVE-2026-72809 (localhost-trust admin bypass via the fixed-port proxy, remotely reachable if bound to a network interface), CVE-2026-72807 (second-order SSTI→SQL via an imported malicious AV package), and CVE-2026-72801 (encrypted-notebook key-derivation material + wrapped keys disclosed to anonymous readers), with 8 medium access-control bypasses rounding out the batch; fixed in v3.8.3-alpha.1 (hardening commits 2026-07-21→07-23) — inventory self-hosted SiYuan instances, don't expose the kernel to the open internet, set Publish.Auth.Enable to true and enforce the publish-password tier, and treat any imported AV package as potentially hostile (GitHub GHSAs, Sep 3)
PostGREShell: PostgreSQL's 12-year-old logical-decoding flaw (CVE-2026-6471, 7.2) — a REPLICATION-attribute account hands CREATE_REPLICATION_SLOT the output-plugin name directly to the loader with no validation (the LOAD restriction check_restricted_library_name() is never called on the replication path), so a full filesystem path reaches dlopen()/LoadLibrary() as typed — fully remote on Windows via SMB UNC (nothing written to the target; exploit is three lines of Python), NFS-automount on Linux/macOS, local-file-write elsewhere; Cyera's PoC escalates to permanent superuser (direct pg_authid write bypassing the SQL executor) plus three overlapping persistence mechanisms (open pg_hba.conf anyone-as-anyone, shared_preload_libraries auto-reload, auto-reapply on revert); their VirusTotal hunt found 114 malicious PostgreSQL plugins already in the wild (trojans, miners, reverse shells); fixed Aug 13, 2026 via the output_plugin_libraries allowlist defaulting to pgoutput, test_decoding — any CDC/replication pipeline on wal2json/decoderbufs/non-default plugins breaks until manually allowlisted; fixed 18.6/17.11/16.15/15.19/14.24, no patch path for EOL 9.4–13 (14 EOLs Nov 12, 2026); block outbound SMB 445 / NFS 2049 from DB hosts and audit replication accounts (Cyera / THN, Sep 1–4)
"ted backdoor": Rapid7's previously-undocumented Linux espionage toolkit targeting South Korea's automotive and media sectors — a backdoor compiled into the victim's HAProxy 2.8.12 (native filter API / memory pools / event scheduler / process management) that intercepts web traffic while genuine load balancing continues, tunneling C2 as HTTP through the load balancer and bypassing HAProxy logging via raw send() on named FIFOs; alongside it: a curl-based CurlRAT (watchdog thread polls /proc/haproxy.pid hourly reporting to writeservice_info; libvirtlog.so.0 sandbox check; 10 KB system-info beacon; MD5 of hostname+IP+hardware-UUID+cron-version as the User-token header), a PAM SSH keylogger (encrypted plaintext-credential log at /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19), passive web-session capture with response-body script injection, and trojanized crond/agetty/atd/sshd/polkitd; medium-confidence DPRK APT attribution (APT37-linked hardcoded C2 list in the shared img.<name>.<tld> registration-workflow pattern incl. Naver-mimicking img.responsive.pstatic[.]autos; simple XOR + substitution-cipher tradecraft); earliest VT uploads mid-2025 on HAProxy 2.8.12-0fdb194 (Nov 22, 2024 release = earliest compilation bound) — a long-term-surveillance kit, not ransomware; the tell is a load balancer rewriting responses it should only be routing (Rapid7, Sep 4)
ulid-xyz transitive delivery chain: a cross-platform MicrosoftSystem64 remote access trojan hidden three npm dependencies deep — ioredis-xyz (a byte-for-byte copy of the real ioredis client) → redis-type-xyz (empty manifest posing as Redis OM) → ulid-xyz (typosquat of ulidx carrying the payload), armed just 19 minutes after the entry package shipped via a caret range in redis-type-xyz@1.10.6 (MAL-2026-6672/-11205/-5882); 467 KB postinstall-bundled beacon over WebSocket to Hetzner C2 on port 8010 with a deploy_binary operator-chosen second stage; persistence named MicrosoftSystem64 on all three OSes; seeded in 28 purpose-built AI/fintech/trading GitHub repos — same implant name, persistence design, C2 port, Hetzner hosting, and direct whisdev operator overlap as the js-logger-pack cluster (FAMOUS CHOLLIMA / Contagious Interview, DPRK-linked); the durable tell is the persistence name, not the package (SafeDep, Sep 1)
GPT-6 "Astra" launch: ExploitBench 100% (vs 78.5% GPT-5.6 Sol), FrontierMath Tier 4 98%, ARC-AGI-3 99.9% — released version deliberately limited to secure code review and patching, refuses PoC-exploit prompts; "OpenAI Daybreak" to roll out less restrictive safeguards in coming weeks; capability and refusal are decoupled, vendor-controlled, and reversible — treat "the model refuses this PoC" as a policy state, not a capability limit (THN / OpenAI, Sep 3)
Node.js runtime as malware-delivery channel: Symantec documents node.exe-anchored implant chains across multiple campaigns since February 2026 (Asian tech company via ClickFix → AdaptixC2/Cobalt blocked → official Node.js installer + EtherHiding; ModeloRAT/Mistic KongTuke chains; US fintech → C2Looper Rust backdoor) — the signed, trusted runtime executing attacker JavaScript plus a registry-Run persistence key defeats signature and publisher heuristics; a node.exe-anchored implant on a non-development host after first-choice C2 was blocked is the high-signal tell (Symantec via THN, Sep 4)
RMM phishing campaign spanning 46 countries: US is now the top target (45% of 601 connected cases), lures include CRA/SSA tax forms, UPS/shipping and invoices; 425 kit URLs across 240 hosts (94% single-day-lived) on Vercel/GitHub Pages/Netlify with S3/Cloudflare R2/DigitalOcean Spaces/Dropbox/GoFile payload staging — the durable tell is the shared font1.woff2 asset and secure.html → project/*.zip structure, not the disposable domain; detect on the RMM install event, not the kit (ANY.RUN via THN, Sep 4)

Sections

Ops — campaign timelines, compromise chains, and sequencing
Tools — malware, payloads, implants, and attacker infrastructure
Groups — crews, cluster names, and shared operational personas
People — publicly identified individuals or project personas when public sourcing supports it
Patterns — reusable defender heuristics
Notes — taxonomy, usage, and editorial guidance