Sotwe logo Sotwe logo

Top Tweets for #highcompleteness

rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Tortoiseshell: New Toolset and Operational Infrastructure Exposed | 26-08-2026 Source: https://t.co/DJ3Yfj7FC2 Key details below ↓ 🧑‍💻Actors/Campaigns: Tortoiseshell (🧠motivation: cyber_espionage, cyber_criminal) Irgc (🧠motivation: cyber_espionage) 💀Threats: Supply_chain_technique, Watering_hole_technique, Twostroke, Dllsearchorder_hijacking_technique, 🎯Victims: Defence, Aerospace, It services, Military, Government 🏭Industry: Government, Aerospace, Military 🌐Geo: United states, France, Iran, Middle east, Albania, Turkey, Belarus, Iranian, Israel 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1001, T1027, T1036, T1036.005, T1059, T1071.001, T1082, T1132, T1140, T1572, ... 🧨IOCs: - IP: 27 - File: 2 - Path: 2 - Domain: 58 - Hash: 2 💽Software: Windows Terminal, WinHttp 🔢Algorithms: md5, sha1 🗂️Win API: GetComputerNameExW #threatreport: Tortoiseshell, also tracked as Mirage Kitten, UNC1549, and Nimbus Manticore, is an Iranian-linked threat actor active since at least 2018. The group has targeted defence, aerospace, military, government-adjacent organisations, and IT service providers in the Middle East, the United States, and Europe. Reported techniques include supply-chain compromises, watering-hole attacks, fake recruitment websites, and custom backdoors. Recent infrastructure and tooling indicate continued activity involving targets in countries such as the United Kingdom, France, Albania, Belarus, Israel, Turkey, and Gulf Cooperation Council states. Researchers identified a reverse SSH tunnelling utility associated with the known C2 address 172.86.98.113. The tool masquerades as the Windows Terminal Server SDK library, `wtsapi32.dll`, while forward-exporting legitimate functions from the original DLL. When executed, it connects to the operator’s server over SSH on TCP port 443 and creates a reverse tunnel. Traffic sent to port 1081 on the C2 server is forwarded into the compromised network, allowing operators to reach internal systems while bypassing inbound firewall restrictions. A second sample is a C++ backdoor related to the TWOSTROKE family. It also masquerades as `wtsapi32.dll` and appears designed for DLL search-order hijacking. The malware dynamically resolves APIs, stores encrypted strings that are decrypted at runtime, and uses WinHTTP to communicate with its C2 infrastructure over HTTPS. It generates a victim identifier from the host’s fully qualified domain name, applies XOR encoding with the key `Pn`, hex-encodes the result, and reverses part of the output. The backdoor supports multiple hardcoded C2 servers, sends the identifier through an HTTP POST request, retrieves commands, and dispatches handlers based on command fields separated by `@##@`. Its capabilities include shell or file-command execution, file upload and exfiltration, and host reconnaissance. Infrastructure pivoting also linked the domain `https://t.co/WqmDSSOqGn` to IP address `185.253.116.81`. Historical DNS data showed that domains including `https://t.co/6AIkpENpb2` used the same servers previously associated with `https://t.co/jsmCBRXVxm`.
rst_cloud's tweet photo. #threatreport #HighCompleteness Tortoiseshell: New Toolset and Operational Infrastructure Exposed | 26-08-2026 Source: https://t.co/DJ3Yfj7FC2 Key details below ↓ 🧑‍💻Actors/Campaigns: Tortoiseshell (🧠motivation: cyber_espionage, cyber_criminal) Irgc (🧠motivation: cyber_espionage) 💀Threats: Supply_chain_technique, Watering_hole_technique, Twostroke, Dllsearchorder_hijacking_technique, 🎯Victims: Defence, Aerospace, It services, Military, Government 🏭Industry: Government, Aerospace, Military 🌐Geo: United states, France, Iran, Middle east, Albania, Turkey, Belarus, Iranian, Israel 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1001, T1027, T1036, T1036.005, T1059, T1071.001, T1082, T1132, T1140, T1572, ... 🧨IOCs: - IP: 27 - File: 2 - Path: 2 - Domain: 58 - Hash: 2 💽Software: Windows Terminal, WinHttp 🔢Algorithms: md5, sha1 🗂️Win API: GetComputerNameExW #threatreport: Tortoiseshell, also tracked as Mirage Kitten, UNC1549, and Nimbus Manticore, is an Iranian-linked threat actor active since at least 2018. The group has targeted defence, aerospace, military, government-adjacent organisations, and IT service providers in the Middle East, the United States, and Europe. Reported techniques include supply-chain compromises, watering-hole attacks, fake recruitment websites, and custom backdoors. Recent infrastructure and tooling indicate continued activity involving targets in countries such as the United Kingdom, France, Albania, Belarus, Israel, Turkey, and Gulf Cooperation Council states. Researchers identified a reverse SSH tunnelling utility associated with the known C2 address 172.86.98.113. The tool masquerades as the Windows Terminal Server SDK library, `wtsapi32.dll`, while forward-exporting legitimate functions from the original DLL. When executed, it connects to the operator’s server over SSH on TCP port 443 and creates a reverse tunnel. Traffic sent to port 1081 on the C2 server is forwarded into the compromised network, allowing operators to reach internal systems while bypassing inbound firewall restrictions. A second sample is a C++ backdoor related to the TWOSTROKE family. It also masquerades as `wtsapi32.dll` and appears designed for DLL search-order hijacking. The malware dynamically resolves APIs, stores encrypted strings that are decrypted at runtime, and uses WinHTTP to communicate with its C2 infrastructure over HTTPS. It generates a victim identifier from the host’s fully qualified domain name, applies XOR encoding with the key `Pn`, hex-encodes the result, and reverses part of the output. The backdoor supports multiple hardcoded C2 servers, sends the identifier through an HTTP POST request, retrieves commands, and dispatches handlers based on command fields separated by `@##@`. Its capabilities include shell or file-command execution, file upload and exfiltration, and host reconnaissance. Infrastructure pivoting also linked the domain `https://t.co/WqmDSSOqGn` to IP address `185.253.116.81`. Historical DNS data showed that domains including `https://t.co/6AIkpENpb2` used the same servers previously associated with `https://t.co/jsmCBRXVxm`.
1
0
0
0
15
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Cambodia-focused cluster uses multistage infection chain with localized lures | 26-08-2026 Source: https://t.co/3RgYONmgAG Key details below ↓ 🧑‍💻Actors/Campaigns: Silver_fox 💀Threats: Dll_sideloading_technique, Process_injection_technique, Byovd_technique, Spark_rat, Valleyrat, Winos, 🎯Victims: Cambodian individuals and organizations 🏭Industry: Healthcare, Government 🌐Geo: Asia, Asian, Chinese, China, Cambodian, Cambodia 🔓CVEs: CVE-2026-36425 \[[Vulners](https://t.co/Hy6XN2qfb7)] - CVSS V3.1: *6.5*, - Vulners: Exploitation: Unknown 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027.013, T1036.007, T1053.005, T1055, T1057, T1112, T1134.001, T1140, T1211, T1518.001, ... 🧨IOCs: - Domain: 2 - File: 23 - Command: 2 - Hash: 28 💽Software: twitter, Huorong, winlogon, Windows Service, Microsoft Defender 🔢Algorithms: md5, aes-ctr 🔠Functions: __debugbreak, TaskHandler 🗂️Win API: OpenProcessToken, NtCreateFile, NtReadFile, SeDebugPrivilege, TerminateProcess ⚙️Win Services: MsMpEng, BrokerInfrastructure, EventLog 💻Platforms: cross-platform #threatreport: A Cambodia-focused cyber campaign uses localized lures delivered in compressed archives, including Cambodian government notices, COVID-19 materials, dental records, real estate documents, and promotional offers. The observed sample was an Inno Setup executable disguised as a COVID-19 government notice. When executed, it created hidden staging directories under `C:\Drivers`, dropped multiple components, and used the signed Tencent executable `F7u00ex.exe` to sideload the malicious DLL `WfoY.qf`. The loader employs anti-analysis and defense-evasion techniques, including a vectored exception handler triggered through `__debugbreak()`, checks for Huorong and 360 Security processes, and token manipulation to impersonate the SYSTEM token from `winlogon.exe`. Encrypted payloads are embedded in PNG-formatted files, with data extracted from PNG `IDAT` chunks and decrypted at runtime. Decrypted shellcode is injected into `vssvc.exe`, with reinjection performed if the monitored process terminates or restarts. Additional stages are injected into `ctfmon.exe` and `svchost.exe`. The malware establishes persistence through a Windows service and a scheduled task named `TaskHandler`. It patches AMSI and ETW, adds Microsoft Defender exclusions for selected processes and directories, and uses both kernel- and user-mode methods to terminate security software. The kernel-mode technique installs `ardrv.sys`, a vulnerable OPSWAT AppRemover driver affected by CVE-2026-36425. Its vulnerable IOCTL permits process termination without adequate privilege validation, enabling the malware to stop components associated with Microsoft Defender, 360 Total Security, Huorong Internet Security, and Tencent PC Manager. A separate payload enables `SeDebugPrivilege` and uses `TerminateProcess` for user-mode termination. The final payload is SparkRAT, which is reflectively loaded into a legitimate Windows process. Its configuration specifies `https://t.co/bf8C0dLxTI` as the primary command-and-control server and `https://t.co/E81GussHjj` as a backup endpoint. The activity shares tradecraft with SilverFox campaigns, but no infrastructure, code reuse, or other definitive attribution evidence was identified. It is assessed as an unattributed cluster with possible Chinese-language development or deployment links, with low confidence.
rst_cloud's tweet photo. #threatreport #HighCompleteness Cambodia-focused cluster uses multistage infection chain with localized lures | 26-08-2026 Source: https://t.co/3RgYONmgAG Key details below ↓ 🧑‍💻Actors/Campaigns: Silver_fox 💀Threats: Dll_sideloading_technique, Process_injection_technique, Byovd_technique, Spark_rat, Valleyrat, Winos, 🎯Victims: Cambodian individuals and organizations 🏭Industry: Healthcare, Government 🌐Geo: Asia, Asian, Chinese, China, Cambodian, Cambodia 🔓CVEs: CVE-2026-36425 \[[Vulners](https://t.co/Hy6XN2qfb7)] - CVSS V3.1: *6.5*, - Vulners: Exploitation: Unknown 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027.013, T1036.007, T1053.005, T1055, T1057, T1112, T1134.001, T1140, T1211, T1518.001, ... 🧨IOCs: - Domain: 2 - File: 23 - Command: 2 - Hash: 28 💽Software: twitter, Huorong, winlogon, Windows Service, Microsoft Defender 🔢Algorithms: md5, aes-ctr 🔠Functions: __debugbreak, TaskHandler 🗂️Win API: OpenProcessToken, NtCreateFile, NtReadFile, SeDebugPrivilege, TerminateProcess ⚙️Win Services: MsMpEng, BrokerInfrastructure, EventLog 💻Platforms: cross-platform #threatreport: A Cambodia-focused cyber campaign uses localized lures delivered in compressed archives, including Cambodian government notices, COVID-19 materials, dental records, real estate documents, and promotional offers. The observed sample was an Inno Setup executable disguised as a COVID-19 government notice. When executed, it created hidden staging directories under `C:\Drivers`, dropped multiple components, and used the signed Tencent executable `F7u00ex.exe` to sideload the malicious DLL `WfoY.qf`. The loader employs anti-analysis and defense-evasion techniques, including a vectored exception handler triggered through `__debugbreak()`, checks for Huorong and 360 Security processes, and token manipulation to impersonate the SYSTEM token from `winlogon.exe`. Encrypted payloads are embedded in PNG-formatted files, with data extracted from PNG `IDAT` chunks and decrypted at runtime. Decrypted shellcode is injected into `vssvc.exe`, with reinjection performed if the monitored process terminates or restarts. Additional stages are injected into `ctfmon.exe` and `svchost.exe`. The malware establishes persistence through a Windows service and a scheduled task named `TaskHandler`. It patches AMSI and ETW, adds Microsoft Defender exclusions for selected processes and directories, and uses both kernel- and user-mode methods to terminate security software. The kernel-mode technique installs `ardrv.sys`, a vulnerable OPSWAT AppRemover driver affected by CVE-2026-36425. Its vulnerable IOCTL permits process termination without adequate privilege validation, enabling the malware to stop components associated with Microsoft Defender, 360 Total Security, Huorong Internet Security, and Tencent PC Manager. A separate payload enables `SeDebugPrivilege` and uses `TerminateProcess` for user-mode termination. The final payload is SparkRAT, which is reflectively loaded into a legitimate Windows process. Its configuration specifies `https://t.co/bf8C0dLxTI` as the primary command-and-control server and `https://t.co/E81GussHjj` as a backup endpoint. The activity shares tradecraft with SilverFox campaigns, but no infrastructure, code reuse, or other definitive attribution evidence was identified. It is assessed as an unattributed cluster with possible Chinese-language development or deployment links, with low confidence.
1
0
0
0
32
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Infostealers highlight malware-as-a-service trend | 26-08-2026 Source: https://t.co/8UORrrDN98 Key details below ↓ 💀Threats: Aurastealer, Acr_stealer, Remus, Lumma_stealer, Amatera_stealer, Clickfix_technique, Etherhiding_technique, Seo_poisoning_technique, Gcleaner, Offloader, Vmprotect_tool, Clearfake, 🎯Victims: Healthcare, Financial services, Government, Managed service providers, Technology, Gaming communities, Individuals 🏭Industry: Healthcare, Entertainment, Government 🌐Geo: Russian 🤖LLM extracted TTPs:` T1005, T1027, T1055, T1059.007, T1070.004, T1105, T1115, T1497.001, T1518.001, T1539, ... 🧨IOCs: - Hash: 111 - Domain: 30 - Url: 13 🪙Crypto: ethereum 📜Programming Languages: golang, javascript YARA: Found #threatreport: Infostealer malware-as-a-service (MaaS) is lowering the barrier for attackers by providing subscription, lifetime-license, and affiliate-based access to malware. These stealers commonly target browser credentials, personal information, cryptocurrency wallets, session tokens, cookies, clipboard contents, documents, recordings, and application data. Operators use the stolen information for account compromise, data theft, extortion, and other fraud. Many families also implement anti-analysis measures, including antivirus, sandbox, and virtual-machine detection, process injection, self-deletion, and termination when analysis environments are detected. The report highlights AuraStealer, ACRStealer/Amatera, and Remus Stealer, all of which were active during mid-2026 and associated with Russian-language or CIS cybercrime ecosystems. Between June 1 and August 18, researchers observed 26 AuraStealer samples, 397 ACRStealer samples, 81 Amatera samples, and 606 Remus Stealer samples. All three families can steal browser credentials and cryptocurrency wallet data and are distributed through social-engineering campaigns. AuraStealer, first observed in 2025, is distributed through techniques including ClickFix and malicious short-form videos. During summer 2026, it adopted virtualization, increasing typical file sizes from approximately 500–700 KB to about 10 MB while complicating reverse engineering. ACRStealer is an older family that was substantially upgraded after a 2022 rebrand. Amatera appeared after ACRStealer halted new affiliate onboarding in 2024, but the two families share code, infrastructure, and functionality and remain difficult to distinguish. Remus Stealer emerged in early 2026 and appears to be a 64-bit LummaStealer variant. It shares Lumma characteristics such as string obfuscation, application-bound encryption override techniques, and control-panel design. Remus differs by using Etherhiding, which stores or retrieves command-and-control domain information through Ethereum smart contracts, complicating detection and blocking. It is distributed through malvertising, SEO poisoning, fake CAPTCHA pages, ClickFix, fake downloads, and search redirection. Loaders including Ameday, Gcleaner, and OffLoader deliver Remus, with VMProtect or Go-based delivery stages. ClearFake and ClickFix campaigns may use JavaScript to place malicious commands in the clipboard or execute them after user interaction. Threat actors also use fake software websites, social-media content, and poisoned search results to persuade victims to install the malware.
rst_cloud's tweet photo. #threatreport #HighCompleteness Infostealers highlight malware-as-a-service trend | 26-08-2026 Source: https://t.co/8UORrrDN98 Key details below ↓ 💀Threats: Aurastealer, Acr_stealer, Remus, Lumma_stealer, Amatera_stealer, Clickfix_technique, Etherhiding_technique, Seo_poisoning_technique, Gcleaner, Offloader, Vmprotect_tool, Clearfake, 🎯Victims: Healthcare, Financial services, Government, Managed service providers, Technology, Gaming communities, Individuals 🏭Industry: Healthcare, Entertainment, Government 🌐Geo: Russian 🤖LLM extracted TTPs:` T1005, T1027, T1055, T1059.007, T1070.004, T1105, T1115, T1497.001, T1518.001, T1539, ... 🧨IOCs: - Hash: 111 - Domain: 30 - Url: 13 🪙Crypto: ethereum 📜Programming Languages: golang, javascript YARA: Found #threatreport: Infostealer malware-as-a-service (MaaS) is lowering the barrier for attackers by providing subscription, lifetime-license, and affiliate-based access to malware. These stealers commonly target browser credentials, personal information, cryptocurrency wallets, session tokens, cookies, clipboard contents, documents, recordings, and application data. Operators use the stolen information for account compromise, data theft, extortion, and other fraud. Many families also implement anti-analysis measures, including antivirus, sandbox, and virtual-machine detection, process injection, self-deletion, and termination when analysis environments are detected. The report highlights AuraStealer, ACRStealer/Amatera, and Remus Stealer, all of which were active during mid-2026 and associated with Russian-language or CIS cybercrime ecosystems. Between June 1 and August 18, researchers observed 26 AuraStealer samples, 397 ACRStealer samples, 81 Amatera samples, and 606 Remus Stealer samples. All three families can steal browser credentials and cryptocurrency wallet data and are distributed through social-engineering campaigns. AuraStealer, first observed in 2025, is distributed through techniques including ClickFix and malicious short-form videos. During summer 2026, it adopted virtualization, increasing typical file sizes from approximately 500–700 KB to about 10 MB while complicating reverse engineering. ACRStealer is an older family that was substantially upgraded after a 2022 rebrand. Amatera appeared after ACRStealer halted new affiliate onboarding in 2024, but the two families share code, infrastructure, and functionality and remain difficult to distinguish. Remus Stealer emerged in early 2026 and appears to be a 64-bit LummaStealer variant. It shares Lumma characteristics such as string obfuscation, application-bound encryption override techniques, and control-panel design. Remus differs by using Etherhiding, which stores or retrieves command-and-control domain information through Ethereum smart contracts, complicating detection and blocking. It is distributed through malvertising, SEO poisoning, fake CAPTCHA pages, ClickFix, fake downloads, and search redirection. Loaders including Ameday, Gcleaner, and OffLoader deliver Remus, with VMProtect or Go-based delivery stages. ClearFake and ClickFix campaigns may use JavaScript to place malicious commands in the clipboard or execute them after user interaction. Threat actors also use fake software websites, social-media content, and poisoned search results to persuade victims to install the malware.
0
0
1
1
85
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Dark Caracal Reloaded: New Malware, Same Hunting Grounds | 26-08-2026 Source: https://t.co/JAvk9TxPE4 Key details below ↓ 🧑‍💻Actors/Campaigns: Darkcaracal (🧠motivation: financially_motivated, cyber_espionage) 💀Threats: Asiogate, Gocaracal, Full_spectrum, Bandok, Dead_drop_technique, 🎯Victims: Communications sector, Governments, Businesses, Journalists, Activists 🏭Industry: Government, Financial 🌐Geo: Latam, Venezuela, Colombia, Brazil, Uruguay, Latin american, El salvador, Lebanon, Ecuador, Latin america, Chile 📚TTPs: ⚔️Tactics: 1 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027, T1033, T1055, T1056.001, T1057, T1059, T1070.004, T1082, T1083, T1090.001, ... 🧨IOCs: - Domain: 7 - Hash: 6 - File: 10 - IP: 29 - Coin: 5 - Path: 2 💽Software: WebRTC, Chrome, Firefox 📲Wallets: mainnet 🪙Crypto: ethereum 🔢Algorithms: base64, aes-gcm 🗂️Win API: MAN, arc 📜Programming Languages: golang, delphi, solidity 💻Platforms: x64 YARA: Found #threatreport: In June 2026, Dark Caracal allegedly conducted a targeted intrusion against a communications organization in Venezuela. The campaign retained the group’s established delivery methods, including Spanish-language financial and tax-themed lures, weaponized SVG files containing Base64-encoded shortened URLs, redirectors, document-themed domains, and Delphi-based loaders. The SVG delivery chain redirected victims to attacker-controlled infrastructure that provided a 7-Zip archive containing a previously undocumented Go-based implant named GoCaracal. Analysis of 249 related samples identified two GoCaracal profiles built from a shared modular framework. The lightweight profile is designed to establish an initial foothold and deliver additional payloads. It uses AES-GCM-encrypted custom packet communications, collects host information such as the username, hostname, operating system, uptime, active window, and security software, and supports file retrieval and execution, URL downloads, interactive shell access, shellcode loading, and process injection. The extended profile provides sustained access and intelligence-collection capabilities. It includes 34 command handlers for system and process discovery, drive and directory enumeration, recursive file searches, command execution, self-updating, file manipulation, browser-cookie and login-database theft, keylogging, targeted file collection, WebRTC desktop access, concealed VNC functionality, Chrome-profile cloning, and SOCKS5 proxying. It also contains persistence-related functionality involving registry hives and a concealed https://t.co/EAeOsuKDQT file associated with a Run-key workflow. GoCaracal’s extended build can use Ethereum as a fallback mechanism for C2 resolution. After repeated failures to contact its configured C2 server, it queries Ethereum storage through a public JSON-RPC endpoint using `eth_getStorageAt`. A smart contract stores a mutable replacement C2 value, allowing operators to change infrastructure without redeploying the malware. Related contracts were tested on Ethereum Sepolia and later used on mainnet, with transaction history showing updates to public IP addresses. The intrusion also deployed an updated Bandook variant alongside GoCaracal. Bandook retained credential-stealing capabilities for Chrome, Brave, and Firefox but used randomized command identifiers and obfuscated plugin names to hinder analysis. The evidence indicates GoCaracal currently complements rather than replaces Bandook. Related infrastructure targeted Latin American organizations and included separate hosting patterns for GoCaracal and Bandook C2 servers, suggesting a more compartmentalized Dark Caracal toolkit.
rst_cloud's tweet photo. #threatreport #HighCompleteness Dark Caracal Reloaded: New Malware, Same Hunting Grounds | 26-08-2026 Source: https://t.co/JAvk9TxPE4 Key details below ↓ 🧑‍💻Actors/Campaigns: Darkcaracal (🧠motivation: financially_motivated, cyber_espionage) 💀Threats: Asiogate, Gocaracal, Full_spectrum, Bandok, Dead_drop_technique, 🎯Victims: Communications sector, Governments, Businesses, Journalists, Activists 🏭Industry: Government, Financial 🌐Geo: Latam, Venezuela, Colombia, Brazil, Uruguay, Latin american, El salvador, Lebanon, Ecuador, Latin america, Chile 📚TTPs: ⚔️Tactics: 1 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027, T1033, T1055, T1056.001, T1057, T1059, T1070.004, T1082, T1083, T1090.001, ... 🧨IOCs: - Domain: 7 - Hash: 6 - File: 10 - IP: 29 - Coin: 5 - Path: 2 💽Software: WebRTC, Chrome, Firefox 📲Wallets: mainnet 🪙Crypto: ethereum 🔢Algorithms: base64, aes-gcm 🗂️Win API: MAN, arc 📜Programming Languages: golang, delphi, solidity 💻Platforms: x64 YARA: Found #threatreport: In June 2026, Dark Caracal allegedly conducted a targeted intrusion against a communications organization in Venezuela. The campaign retained the group’s established delivery methods, including Spanish-language financial and tax-themed lures, weaponized SVG files containing Base64-encoded shortened URLs, redirectors, document-themed domains, and Delphi-based loaders. The SVG delivery chain redirected victims to attacker-controlled infrastructure that provided a 7-Zip archive containing a previously undocumented Go-based implant named GoCaracal. Analysis of 249 related samples identified two GoCaracal profiles built from a shared modular framework. The lightweight profile is designed to establish an initial foothold and deliver additional payloads. It uses AES-GCM-encrypted custom packet communications, collects host information such as the username, hostname, operating system, uptime, active window, and security software, and supports file retrieval and execution, URL downloads, interactive shell access, shellcode loading, and process injection. The extended profile provides sustained access and intelligence-collection capabilities. It includes 34 command handlers for system and process discovery, drive and directory enumeration, recursive file searches, command execution, self-updating, file manipulation, browser-cookie and login-database theft, keylogging, targeted file collection, WebRTC desktop access, concealed VNC functionality, Chrome-profile cloning, and SOCKS5 proxying. It also contains persistence-related functionality involving registry hives and a concealed https://t.co/EAeOsuKDQT file associated with a Run-key workflow. GoCaracal’s extended build can use Ethereum as a fallback mechanism for C2 resolution. After repeated failures to contact its configured C2 server, it queries Ethereum storage through a public JSON-RPC endpoint using `eth_getStorageAt`. A smart contract stores a mutable replacement C2 value, allowing operators to change infrastructure without redeploying the malware. Related contracts were tested on Ethereum Sepolia and later used on mainnet, with transaction history showing updates to public IP addresses. The intrusion also deployed an updated Bandook variant alongside GoCaracal. Bandook retained credential-stealing capabilities for Chrome, Brave, and Firefox but used randomized command identifiers and obfuscated plugin names to hinder analysis. The evidence indicates GoCaracal currently complements rather than replaces Bandook. Related infrastructure targeted Latin American organizations and included separate hosting patterns for GoCaracal and Bandook C2 servers, suggesting a more compartmentalized Dark Caracal toolkit.
1
0
0
1
68
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Email Bombing and Quick Assist: A New Ransomware Playbook | 25-08-2026 Source: https://t.co/OBhsHf32r3 Key details below ↓ 🧑‍💻Actors/Campaigns: Blackbasta Unc6692 💀Threats: Email_bombing_technique, Microsoft_quick_assist_tool, Xray_tool, Dll_sideloading_technique, Kerberoasting_technique, Blackbasta, Ngrok_tool, Chisel_tool, Cobalt_strike_tool, Winrm_tool, Credential_harvesting_technique, Anydesk_tool, Edgecution, Bec_technique, 🎯Victims: Organizations 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 0 🧨IOCs: - File: 18 - Registry: 4 - Url: 6 - IP: 1 - Domain: 6 - Path: 3 - Hash: 8 💽Software: Microsoft Teams, Windows security, Active Directory, credential dialog, PaperCut, curl, Windows SMB, chrome, Dropbox, Azure App Service, ... 🔢Algorithms: sha256, rc4 🔠Functions: IT-support, Teams 🗂️Win API: DialogBoxIndirectParamW, GetDlgItemTextA, NetUserEnum, NetWkstaGetInfo, NetApiBufferFree, GetAdaptersAddresses 📜Programming Languages: powershell 💻Platforms: amd64 #threatreport: Attackers used email bombing as a social-engineering precursor rather than a malware-delivery method. At least 10 employees received up to approximately 3,000 legitimate automated registration, verification, deployment, and inquiry messages per day after their addresses were submitted to unrelated public services. About 36 hours later, selected victims were contacted through Microsoft Teams by external identities impersonating internal IT personnel. The identities combined a familiar employee name and the victim organization’s domain string within a helpdesk-themed external domain. During a successful voice-guided interaction, the victim launched Microsoft Quick Assist and granted remote control. Because the user had local administrator privileges, the attacker could stage tooling and establish persistence. Two redundant Xray/VLESS reverse tunnels were deployed while the session remained active. One used DLL side-loading through a Microsoft-signed `wkspbroker.exe` executed from a user-writable AppData location. The other used a renamed legitimate Xray-core binary, `ConnectivityHost.exe`, launched from AppData and persisted through `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`. Both used REALITY with `https://t.co/KrHlX1lfCZ` as the TLS `serverName`, allowing outbound traffic to resemble legitimate TLS connections. The attacker then executed `UpdateReadiness.ps1` with PowerShell execution-policy bypass to identify VPN software and collect endpoints, usernames, gateways, and related configuration data. A fake Windows security-update workflow launched a local credential prompt disguised with PaperCut and Microsoft RuntimeBroker-related metadata. The victim entered domain credentials while still being guided by the caller. Local tooling validated and collected the credentials and discovery artifacts, which were uploaded through a Microsoft Dev Tunnel using `curl` or PowerShell web requests. After Quick Assist ended, the reverse tunnel continued providing internal network access. The attacker performed reconnaissance over SMB, LDAP, Kerberos, and RPC; enumerated file shares and domain services; requested RC4-backed Kerberos service tickets for offline Kerberoasting; and attempted NTLM relay against Active Directory Certificate Services Web Enrollment. Although the certificate relay failed, the activity established a ransomware-ready foothold involving valid credentials, persistence, and network pivoting. The report does not attribute the intrusion to a specific actor, but the sequence is consistent with publicly documented ransomware initial-access operations.
rst_cloud's tweet photo. #threatreport #HighCompleteness Email Bombing and Quick Assist: A New Ransomware Playbook | 25-08-2026 Source: https://t.co/OBhsHf32r3 Key details below ↓ 🧑‍💻Actors/Campaigns: Blackbasta Unc6692 💀Threats: Email_bombing_technique, Microsoft_quick_assist_tool, Xray_tool, Dll_sideloading_technique, Kerberoasting_technique, Blackbasta, Ngrok_tool, Chisel_tool, Cobalt_strike_tool, Winrm_tool, Credential_harvesting_technique, Anydesk_tool, Edgecution, Bec_technique, 🎯Victims: Organizations 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 0 🧨IOCs: - File: 18 - Registry: 4 - Url: 6 - IP: 1 - Domain: 6 - Path: 3 - Hash: 8 💽Software: Microsoft Teams, Windows security, Active Directory, credential dialog, PaperCut, curl, Windows SMB, chrome, Dropbox, Azure App Service, ... 🔢Algorithms: sha256, rc4 🔠Functions: IT-support, Teams 🗂️Win API: DialogBoxIndirectParamW, GetDlgItemTextA, NetUserEnum, NetWkstaGetInfo, NetApiBufferFree, GetAdaptersAddresses 📜Programming Languages: powershell 💻Platforms: amd64 #threatreport: Attackers used email bombing as a social-engineering precursor rather than a malware-delivery method. At least 10 employees received up to approximately 3,000 legitimate automated registration, verification, deployment, and inquiry messages per day after their addresses were submitted to unrelated public services. About 36 hours later, selected victims were contacted through Microsoft Teams by external identities impersonating internal IT personnel. The identities combined a familiar employee name and the victim organization’s domain string within a helpdesk-themed external domain. During a successful voice-guided interaction, the victim launched Microsoft Quick Assist and granted remote control. Because the user had local administrator privileges, the attacker could stage tooling and establish persistence. Two redundant Xray/VLESS reverse tunnels were deployed while the session remained active. One used DLL side-loading through a Microsoft-signed `wkspbroker.exe` executed from a user-writable AppData location. The other used a renamed legitimate Xray-core binary, `ConnectivityHost.exe`, launched from AppData and persisted through `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`. Both used REALITY with `https://t.co/KrHlX1lfCZ` as the TLS `serverName`, allowing outbound traffic to resemble legitimate TLS connections. The attacker then executed `UpdateReadiness.ps1` with PowerShell execution-policy bypass to identify VPN software and collect endpoints, usernames, gateways, and related configuration data. A fake Windows security-update workflow launched a local credential prompt disguised with PaperCut and Microsoft RuntimeBroker-related metadata. The victim entered domain credentials while still being guided by the caller. Local tooling validated and collected the credentials and discovery artifacts, which were uploaded through a Microsoft Dev Tunnel using `curl` or PowerShell web requests. After Quick Assist ended, the reverse tunnel continued providing internal network access. The attacker performed reconnaissance over SMB, LDAP, Kerberos, and RPC; enumerated file shares and domain services; requested RC4-backed Kerberos service tickets for offline Kerberoasting; and attempted NTLM relay against Active Directory Certificate Services Web Enrollment. Although the certificate relay failed, the activity established a ransomware-ready foothold involving valid credentials, persistence, and network pivoting. The report does not attribute the intrusion to a specific actor, but the sequence is consistent with publicly documented ransomware initial-access operations.
0
0
0
0
73
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Cato CTRL™ Threat Research: Vishing and Microsoft Teams Used to Deliver PhantomBackdoor | 18-03-2026 Source: https://t.co/8qGl7lOeCF Key details below ↓ 🧑‍💻Actors/Campaigns: Phantomcaptcha 💀Threats: Phantombackdoor, Spear-phishing_technique, Clickfix_technique, 🎯Victims: Consumer services, Non governmental organizations, Government entities, Italy, Ukraine 🏭Industry: Government, Ngo 🌐Geo: Ukraine, Italy 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027, T1059.001, T1071.001, T1132.001, T1204, T1566.003, T1566.004, T1656 🧨IOCs: - Domain: 2 - IP: 2 - Hash: 2 💽Software: icrosoft Teams Us, Microsoft Teams 🔢Algorithms: base64, xor, sha256 📜Programming Languages: powershell #threatreport: Cato CTRL investigated a vishing campaign targeting an Italy-based consumer services organization that used Microsoft Teams to deliver PhantomBackdoor. The threat actor reportedly impersonated helpdesk personnel, sent a Teams meeting invitation, and used the session—potentially including screen sharing—to guide the victim through execution of malicious commands. This replaced conventional phishing with a trusted collaboration-platform interaction. After the Teams engagement, the victim’s system executed a staged PowerShell payload chain. The initial PowerShell was obfuscated and, after deobfuscation, performed system reconnaissance and collected device information. The collected data was XOR-encrypted using the hardcoded key `YUkdzDWUQuuwkbhzJGE0hwHxiha9VCnC`, Base64-encoded, and transmitted to the attacker’s command-and-control infrastructure. A subsequent stage loaded a payload directly into memory, reducing on-disk artifacts and complicating file-based detection and forensic analysis. The final stage established an interactive WebSocket-based command-and-control connection to `ws://maxsolutions243.com:80`. This behavior overlaps with previously reported PhantomBackdoor activity associated with spearphishing campaigns targeting Ukraine-related NGOs and government entities, although the incident described here used vishing and Microsoft Teams and affected an Italy-based organization. The observed attack chain consisted of helpdesk impersonation, Teams-based social engineering, PowerShell execution, staged payload delivery, reconnaissance, encoded data transmission, in-memory payload loading, and WebSocket C2. Defensive measures include restricting external Teams access to approved tenants and trusted domains, limiting screen sharing and remote control for external participants, monitoring for the sequence of a Teams session followed by PowerShell and outbound downloads, and detecting obfuscated PowerShell and suspicious WebSocket communications. Organizations should also apply least-privilege controls and application enforcement to limit PowerShell and other in-memory execution by standard users.
rst_cloud's tweet photo. #threatreport #HighCompleteness Cato CTRL™ Threat Research: Vishing and Microsoft Teams Used to Deliver PhantomBackdoor | 18-03-2026 Source: https://t.co/8qGl7lOeCF Key details below ↓ 🧑‍💻Actors/Campaigns: Phantomcaptcha 💀Threats: Phantombackdoor, Spear-phishing_technique, Clickfix_technique, 🎯Victims: Consumer services, Non governmental organizations, Government entities, Italy, Ukraine 🏭Industry: Government, Ngo 🌐Geo: Ukraine, Italy 📚TTPs: ⚔️Tactics: 2 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027, T1059.001, T1071.001, T1132.001, T1204, T1566.003, T1566.004, T1656 🧨IOCs: - Domain: 2 - IP: 2 - Hash: 2 💽Software: icrosoft Teams Us, Microsoft Teams 🔢Algorithms: base64, xor, sha256 📜Programming Languages: powershell #threatreport: Cato CTRL investigated a vishing campaign targeting an Italy-based consumer services organization that used Microsoft Teams to deliver PhantomBackdoor. The threat actor reportedly impersonated helpdesk personnel, sent a Teams meeting invitation, and used the session—potentially including screen sharing—to guide the victim through execution of malicious commands. This replaced conventional phishing with a trusted collaboration-platform interaction. After the Teams engagement, the victim’s system executed a staged PowerShell payload chain. The initial PowerShell was obfuscated and, after deobfuscation, performed system reconnaissance and collected device information. The collected data was XOR-encrypted using the hardcoded key `YUkdzDWUQuuwkbhzJGE0hwHxiha9VCnC`, Base64-encoded, and transmitted to the attacker’s command-and-control infrastructure. A subsequent stage loaded a payload directly into memory, reducing on-disk artifacts and complicating file-based detection and forensic analysis. The final stage established an interactive WebSocket-based command-and-control connection to `ws://maxsolutions243.com:80`. This behavior overlaps with previously reported PhantomBackdoor activity associated with spearphishing campaigns targeting Ukraine-related NGOs and government entities, although the incident described here used vishing and Microsoft Teams and affected an Italy-based organization. The observed attack chain consisted of helpdesk impersonation, Teams-based social engineering, PowerShell execution, staged payload delivery, reconnaissance, encoded data transmission, in-memory payload loading, and WebSocket C2. Defensive measures include restricting external Teams access to approved tenants and trusted domains, limiting screen sharing and remote control for external participants, monitoring for the sequence of a Teams session followed by PowerShell and outbound downloads, and detecting obfuscated PowerShell and suspicious WebSocket communications. Organizations should also apply least-privilege controls and application enforcement to limit PowerShell and other in-memory execution by standard users.
1
0
0
0
68
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness How Play Achieves Encryption | 25-08-2026 Source: https://t.co/okO8YvJdsG Key details below ↓ 🧑‍💻Actors/Campaigns: Andariel 💀Threats: Playcrypt, Win32/genransom.sa!rsm, Systembc, Conti, Blackcat, Mimikatz_tool, Credential_dumping_technique, Edr-killer, Byovd_technique, Akira_ransomware, Cobalt_strike_tool, 🎯Victims: Healthcare, Critical infrastructure, Manufacturing, Education 🏭Industry: Education, Critical_infrastructure, Healthcare, Financial 🌐Geo: North korea, America, Dprk 📚TTPs: ⚔️Tactics: 7 🛠️Technics: 13 🧨IOCs: - File: 29 - Hash: 7 - IP: 2 - Domain: 2 💽Software: Windows Defender, WinSCP, Hyper-V, PsExec, WinRAR, Windows Security 🔢Algorithms: sha1, sha256 🔠Functions: ReadMe 📜Programming Languages: powershell #threatreport: Play, also known as PlayCrypt, has operated since June 2022 and conducts double-extortion ransomware attacks against organizations in North and South America and Europe, particularly in healthcare, critical infrastructure, manufacturing, and education. The group gains access through externally facing remote-access technologies; in the described incident, the initial intrusion occurred through a compromised SonicWall VPN. Attacker-controlled systems named WINNITHERLANDS and kali appeared in authentication artifacts, with activity beginning approximately two and a half months before encryption. After establishing access, the attackers deployed SystemBC as a proxy-based command-and-control backdoor. SystemBC used an encrypted SOCKS5 tunnel and was staged as DLL files, including 4.dll and svhost.dll, in the Windows Tasks directory. Additional payloads and scripts were placed in low-monitoring locations such as C:\PerfLogs and C:\Windows\Temp. The attackers used Mimikatz from a user Temp directory to obtain credentials, enumerated Hyper-V infrastructure and network shares, and moved laterally with PsExec. PsExec, PsExec64, and GoGo.exe were distributed through the domain SYSVOL share, enabling broad deployment across domain-joined systems. Before encryption, the attackers exfiltrated sensitive files using WinSCP and archived them with WinRAR. Staged data included financial, human resources, client, banking, and corporate documents. WinSCP and WinRAR were primarily placed in C:\PerfLogs, which was also used for other tools and ransomware components. Data theft provided leverage independent of the subsequent encryption. For defense evasion, Play used SentinelCleaner.exe, the victim’s legitimate SentinelOne removal utility, rather than a kernel-level BYOVD technique. The attackers also cleared Windows Security event logs, generating Event ID 1102, to hinder forensic reconstruction. The Play encryptor was executed under multiple filenames, including mmm.exe, IHDpr3.exe, 8gh2dA.exe, and hi.exe, all sharing the SHA-256 hash c597377f3cd349a07d46483e130952a566c4bda73d9771b54b7ce8a9901c4c76. Encrypted files received the .PLAY extension, while a crash dump and a Windows Defender ransomware detection indicated that encryption and EDR removal did not complete successfully on every host.
rst_cloud's tweet photo. #threatreport #HighCompleteness How Play Achieves Encryption | 25-08-2026 Source: https://t.co/okO8YvJdsG Key details below ↓ 🧑‍💻Actors/Campaigns: Andariel 💀Threats: Playcrypt, Win32/genransom.sa!rsm, Systembc, Conti, Blackcat, Mimikatz_tool, Credential_dumping_technique, Edr-killer, Byovd_technique, Akira_ransomware, Cobalt_strike_tool, 🎯Victims: Healthcare, Critical infrastructure, Manufacturing, Education 🏭Industry: Education, Critical_infrastructure, Healthcare, Financial 🌐Geo: North korea, America, Dprk 📚TTPs: ⚔️Tactics: 7 🛠️Technics: 13 🧨IOCs: - File: 29 - Hash: 7 - IP: 2 - Domain: 2 💽Software: Windows Defender, WinSCP, Hyper-V, PsExec, WinRAR, Windows Security 🔢Algorithms: sha1, sha256 🔠Functions: ReadMe 📜Programming Languages: powershell #threatreport: Play, also known as PlayCrypt, has operated since June 2022 and conducts double-extortion ransomware attacks against organizations in North and South America and Europe, particularly in healthcare, critical infrastructure, manufacturing, and education. The group gains access through externally facing remote-access technologies; in the described incident, the initial intrusion occurred through a compromised SonicWall VPN. Attacker-controlled systems named WINNITHERLANDS and kali appeared in authentication artifacts, with activity beginning approximately two and a half months before encryption. After establishing access, the attackers deployed SystemBC as a proxy-based command-and-control backdoor. SystemBC used an encrypted SOCKS5 tunnel and was staged as DLL files, including 4.dll and svhost.dll, in the Windows Tasks directory. Additional payloads and scripts were placed in low-monitoring locations such as C:\PerfLogs and C:\Windows\Temp. The attackers used Mimikatz from a user Temp directory to obtain credentials, enumerated Hyper-V infrastructure and network shares, and moved laterally with PsExec. PsExec, PsExec64, and GoGo.exe were distributed through the domain SYSVOL share, enabling broad deployment across domain-joined systems. Before encryption, the attackers exfiltrated sensitive files using WinSCP and archived them with WinRAR. Staged data included financial, human resources, client, banking, and corporate documents. WinSCP and WinRAR were primarily placed in C:\PerfLogs, which was also used for other tools and ransomware components. Data theft provided leverage independent of the subsequent encryption. For defense evasion, Play used SentinelCleaner.exe, the victim’s legitimate SentinelOne removal utility, rather than a kernel-level BYOVD technique. The attackers also cleared Windows Security event logs, generating Event ID 1102, to hinder forensic reconstruction. The Play encryptor was executed under multiple filenames, including mmm.exe, IHDpr3.exe, 8gh2dA.exe, and hi.exe, all sharing the SHA-256 hash c597377f3cd349a07d46483e130952a566c4bda73d9771b54b7ce8a9901c4c76. Encrypted files received the .PLAY extension, while a crash dump and a Windows Defender ransomware detection indicated that encryption and EDR removal did not complete successfully on every host.
0
0
0
0
107
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain | 25-08-2026 Source: https://t.co/96ELMY8ZBQ Key details below ↓ 💀Threats: Supply_chain_technique, Anonymouskit, Checkm8_tool, Credential_harvesting_technique, Painel_rescue_unlocker, Spear-phishing_technique, 🎯Victims: Apple device owners, Government organizations, Education organizations 🏭Industry: Government, Education, E-commerce, Telco 🌐Geo: India, Zimbabwe, African, Mozambique, Italy, Irish, Canada, Spanish, Brazilian, Malta, United kingdom, Nigeria, Indonesia, South africa, German, French, Indonesian, Ethiopia, Kenya, France, Spain, Brazil, Portuguese, Algeria, Portugal, Argentina, Chile 📚TTPs: ⚔️Tactics: 8 🛠️Technics: 13 🧨IOCs: - Domain: 29 - Email: 8 - File: 1 - IP: 4 - Url: 1 - Hash: 5 💽Software: WhatsApp, Gmail, Telegram, gpt-4o, gpt-4, macOS 🔢Algorithms: sha256 🔠Functions: AI, send_email, send_sms, start_send_whatsapp, start_call, start_ai_call, FindMy, get_sms_server_api, check_phone_number, This, ... 📜Programming Languages: php 💻Platforms: apple #threatreport: AnonyMousKIT is a credit-metered, five-channel phishing-as-a-service platform targeting owners of stolen Apple devices. Its purpose is to harvest device passcodes, Apple ID credentials, and real-time two-factor authentication codes so criminals can remove Activation Lock and resell the hardware. Operators enter stolen-device details, including internal Apple model identifiers and Find My status, then launch coordinated lures through email, SMS, WhatsApp, recorded audio, and AI-generated voice calls. The phishing pages use Apple-themed branding, anti-bot filtering, localization, and device-tracking visuals showing the handset’s alleged location and status. Credential collection occurs sequentially: the victim is prompted for a four- or six-digit passcode, Apple ID credentials, and 2FA codes. Captured information is sent to operator panels and Telegram webhooks. Email campaigns used lookalike sender names such as Apple Support and Find My, free Gmail or iCloud relay accounts, 35 lure domains, 51 subject lines, and 13 HTML templates. Of 6,092 recorded messages across 30 backends, 603 were delivered; 97.7% of AnonyMousKIT’s delivered emails were relayed through one Gmail account. The platform also supports SMS gateway validation and spoofed sender IDs, while WhatsApp uses business API instances and delivery tracking. Its AI voice capability employed commercial voice agents posing as “Alice from Apple Support,” dynamically inserting victim and device details into social-engineering scripts. More than 200 calls were recorded, approximately 90% targeting Brazil, at a reported total cost of $19.24. AnonyMousKIT is part of a broader reseller ecosystem based on a shared CakePHP codebase. Infrastructure analysis linked 506 domains and 168 storefront brands, including at least 30 distinct backend installations. Developer test activity, shared SMTP accounts, launch timing, and operator overlap connected multiple storefronts to common administrators or resellers rather than independent services. The ecosystem included at least 689 WhatsApp operator accounts and 1,721 sequential account IDs, although most provisioned accounts appeared inactive. A coding error involving bare relative file paths exposed email and WhatsApp logs through unauthenticated HTTP requests. The exposed data covered more than 120,000 email-log lines and 166,000 WhatsApp-log lines, with equivalent exposure affecting other deployments. Most targeted devices used A12 or newer chips, making the included checkm8-based jailbreak utilities ineffective; these tools functioned primarily as bait to attract subscribers to the credential-harvesting services.
rst_cloud's tweet photo. #threatreport #HighCompleteness Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain | 25-08-2026 Source: https://t.co/96ELMY8ZBQ Key details below ↓ 💀Threats: Supply_chain_technique, Anonymouskit, Checkm8_tool, Credential_harvesting_technique, Painel_rescue_unlocker, Spear-phishing_technique, 🎯Victims: Apple device owners, Government organizations, Education organizations 🏭Industry: Government, Education, E-commerce, Telco 🌐Geo: India, Zimbabwe, African, Mozambique, Italy, Irish, Canada, Spanish, Brazilian, Malta, United kingdom, Nigeria, Indonesia, South africa, German, French, Indonesian, Ethiopia, Kenya, France, Spain, Brazil, Portuguese, Algeria, Portugal, Argentina, Chile 📚TTPs: ⚔️Tactics: 8 🛠️Technics: 13 🧨IOCs: - Domain: 29 - Email: 8 - File: 1 - IP: 4 - Url: 1 - Hash: 5 💽Software: WhatsApp, Gmail, Telegram, gpt-4o, gpt-4, macOS 🔢Algorithms: sha256 🔠Functions: AI, send_email, send_sms, start_send_whatsapp, start_call, start_ai_call, FindMy, get_sms_server_api, check_phone_number, This, ... 📜Programming Languages: php 💻Platforms: apple #threatreport: AnonyMousKIT is a credit-metered, five-channel phishing-as-a-service platform targeting owners of stolen Apple devices. Its purpose is to harvest device passcodes, Apple ID credentials, and real-time two-factor authentication codes so criminals can remove Activation Lock and resell the hardware. Operators enter stolen-device details, including internal Apple model identifiers and Find My status, then launch coordinated lures through email, SMS, WhatsApp, recorded audio, and AI-generated voice calls. The phishing pages use Apple-themed branding, anti-bot filtering, localization, and device-tracking visuals showing the handset’s alleged location and status. Credential collection occurs sequentially: the victim is prompted for a four- or six-digit passcode, Apple ID credentials, and 2FA codes. Captured information is sent to operator panels and Telegram webhooks. Email campaigns used lookalike sender names such as Apple Support and Find My, free Gmail or iCloud relay accounts, 35 lure domains, 51 subject lines, and 13 HTML templates. Of 6,092 recorded messages across 30 backends, 603 were delivered; 97.7% of AnonyMousKIT’s delivered emails were relayed through one Gmail account. The platform also supports SMS gateway validation and spoofed sender IDs, while WhatsApp uses business API instances and delivery tracking. Its AI voice capability employed commercial voice agents posing as “Alice from Apple Support,” dynamically inserting victim and device details into social-engineering scripts. More than 200 calls were recorded, approximately 90% targeting Brazil, at a reported total cost of $19.24. AnonyMousKIT is part of a broader reseller ecosystem based on a shared CakePHP codebase. Infrastructure analysis linked 506 domains and 168 storefront brands, including at least 30 distinct backend installations. Developer test activity, shared SMTP accounts, launch timing, and operator overlap connected multiple storefronts to common administrators or resellers rather than independent services. The ecosystem included at least 689 WhatsApp operator accounts and 1,721 sequential account IDs, although most provisioned accounts appeared inactive. A coding error involving bare relative file paths exposed email and WhatsApp logs through unauthenticated HTTP requests. The exposed data covered more than 120,000 email-log lines and 166,000 WhatsApp-log lines, with equivalent exposure affecting other deployments. Most targeted devices used A12 or newer chips, making the included checkm8-based jailbreak utilities ineffective; these tools functioned primarily as bait to attract subscribers to the credential-harvesting services.
1
2
0
0
257
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness [Op Report] From PDF Phish to XLoader: A ScreenConnect Hands-on-Keyboard Intrusion | 25-08-2026 Source: https://t.co/fNimaa2ox4 Key details below ↓ 💀Threats: Formbook, Screenconnect_tool, 🎯Victims: Wealth management 🏭Industry: Financial 🌐Geo: America, United states 📚TTPs: ⚔️Tactics: 5 🛠️Technics: 13 🧨IOCs: - File: 11 - IP: 92 - Url: 1 - Domain: 65 - Hash: 9 - Email: 0 - BrowserExtension: 0 💽Software: Active Directory, chrome, curl, Android, Linux 🔢Algorithms: sha256 🗂️Win API: EXE 💻Platforms: x86 #threatreport: Over approximately 54 hours from August 6–8, 2026, an intrusion began with a PDF-themed phishing lure that led a user to execute `Project_docs_file.bat` from the browser Downloads directory. The batch script performed host reconnaissance, including session and directory enumeration, tested connectivity to an external C2 server on TCP port 8040, and downloaded a ScreenConnect MSI using `curl` over HTTP to a bare IP address and non-standard port. The activity corresponded to phishing, user execution, Windows command shell execution, and ingress tool transfer techniques. The MSI silently installed ScreenConnect as a persistent service. The operator configured two independent relay instances to separate C2 endpoints, providing redundant remote access. ScreenConnect’s file-execution capability was then used for hands-on-keyboard activity, with `ScreenConnect.WindowsClient.exe` spawning additional tools. One downloaded payload, `bin.exe`, was retrieved through Chrome and copied to `C:\Program Files (x86)\CouchDB\Uvhvxmv.exe`, retaining the same SHA-256 hash for persistence. The payload was identified as XLoader/FormBook. It was injected into signed Windows binaries, including `ROUTE.EXE` in `C:\Windows\SysWOW64` and `autochk.exe`. YARA detections confirmed FormBook in the affected processes. The malware established automated command and control using 19,284 HTTP GET check-ins and more than 256 POST submissions across 63 domains. Communications used short, four-character URI paths, such as `/inzm/` and `/l3kf/`, and a spoofed Android user agent. The domain infrastructure included legitimate-domain decoys intended to complicate analysis. XLoader conducted browser and form-grabbing activity targeting financial and payment services, including Fidelity, Chase, Bank of America, Schwab, Vanguard, PayPal, E*TRADE, Citi, Capital One, and American Express. Collected data was staged and exfiltrated through Sendspace, including API uploads to `https://t.co/3bumnwNxj7` and `https://t.co/zLEeCvv7IC`. The operation combined ScreenConnect-based interactive access with automated FormBook credential theft and exfiltration in a single intrusion chain.
rst_cloud's tweet photo. #threatreport #HighCompleteness [Op Report] From PDF Phish to XLoader: A ScreenConnect Hands-on-Keyboard Intrusion | 25-08-2026 Source: https://t.co/fNimaa2ox4 Key details below ↓ 💀Threats: Formbook, Screenconnect_tool, 🎯Victims: Wealth management 🏭Industry: Financial 🌐Geo: America, United states 📚TTPs: ⚔️Tactics: 5 🛠️Technics: 13 🧨IOCs: - File: 11 - IP: 92 - Url: 1 - Domain: 65 - Hash: 9 - Email: 0 - BrowserExtension: 0 💽Software: Active Directory, chrome, curl, Android, Linux 🔢Algorithms: sha256 🗂️Win API: EXE 💻Platforms: x86 #threatreport: Over approximately 54 hours from August 6–8, 2026, an intrusion began with a PDF-themed phishing lure that led a user to execute `Project_docs_file.bat` from the browser Downloads directory. The batch script performed host reconnaissance, including session and directory enumeration, tested connectivity to an external C2 server on TCP port 8040, and downloaded a ScreenConnect MSI using `curl` over HTTP to a bare IP address and non-standard port. The activity corresponded to phishing, user execution, Windows command shell execution, and ingress tool transfer techniques. The MSI silently installed ScreenConnect as a persistent service. The operator configured two independent relay instances to separate C2 endpoints, providing redundant remote access. ScreenConnect’s file-execution capability was then used for hands-on-keyboard activity, with `ScreenConnect.WindowsClient.exe` spawning additional tools. One downloaded payload, `bin.exe`, was retrieved through Chrome and copied to `C:\Program Files (x86)\CouchDB\Uvhvxmv.exe`, retaining the same SHA-256 hash for persistence. The payload was identified as XLoader/FormBook. It was injected into signed Windows binaries, including `ROUTE.EXE` in `C:\Windows\SysWOW64` and `autochk.exe`. YARA detections confirmed FormBook in the affected processes. The malware established automated command and control using 19,284 HTTP GET check-ins and more than 256 POST submissions across 63 domains. Communications used short, four-character URI paths, such as `/inzm/` and `/l3kf/`, and a spoofed Android user agent. The domain infrastructure included legitimate-domain decoys intended to complicate analysis. XLoader conducted browser and form-grabbing activity targeting financial and payment services, including Fidelity, Chase, Bank of America, Schwab, Vanguard, PayPal, E*TRADE, Citi, Capital One, and American Express. Collected data was staged and exfiltrated through Sendspace, including API uploads to `https://t.co/3bumnwNxj7` and `https://t.co/zLEeCvv7IC`. The operation combined ScreenConnect-based interactive access with automated FormBook credential theft and exfiltration in a single intrusion chain.
0
3
1
1
155
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign | 25-08-2026 Source: https://t.co/mpG3hymKef Key details below ↓ 💀Threats: Lolbin_technique, Gotoresolve_tool, Logmein_tool, Itarian_tool, Screenconnect_tool, Fingerprintjs_tool, Spear-phishing_technique, 🎯Victims: Education, Technology, Government, Banking, Manufacturing, Finance 🏭Industry: Government, Financial, Transport, Logistic, Education 🌐Geo: Canadian, America, Canada, United states 📚TTPs: ⚔️Tactics: 5 🛠️Technics: 10 🧨IOCs: - File: 4 - Domain: 35 - Url: 1 - IP: 1 - Hash: 3 💽Software: WordPress, Cloudflare R2, Dropbox, Telegram, Unix 🔢Algorithms: zip, sha256 🗂️Win API: RUN, EXE 📜Programming Languages: powershell, visual_basic 💻Platforms: arm, intel #threatreport: A phishing campaign initially themed around Canadian Revenue Agency T4 tax documents is part of a broader remote-access operation active across 46 countries, with the United States accounting for approximately 45% of observed activity. The campaign uses interchangeable lures involving tax notices, Social Security Administration documents, invoices, VAT alerts, Adobe PDFs, and shipping communications. Canada represents a larger share of the T4-themed activity, while North America accounts for 61% of the broader campaign. The attack begins with an email containing a link to a disposable Vercel-hosted page that impersonates a legitimate document service. After the victim enters an access code, the page delivers a password-protected ZIP archive containing a VBS script. The script uses FileSystemObject to launch PowerShell. PowerShell bypasses the user profile, delays execution with a sleep command, writes binary data to a stream, and downloads and installs an MSI package containing legitimate remote monitoring and management software. The attackers abuse signed RMM products to obtain interactive, hands-on-keyboard access rather than deploying a conventional malware family. Observed products include GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian. Because the RMM component changes between campaign arms, product-specific detections and antivirus classifications may miss the activity. Detection should instead identify unauthorized RMM installations, suspicious VBS-to-PowerShell execution, archive delivery, and RMM installers originating from newly created Vercel applications, free-hosting domains, compromised WordPress sites, or untrusted cloud storage. The delivery pages use browser and victim filtering, including FingerprintJS, hCaptcha, geolocation and IP checks, Green Spinner gating, and in some cases Telegram-based reporting. RMM installers are staged through Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, Gofile, Dropbox, compromised infrastructure, and raw IP addresses. The recurring web-kit artifacts, including the `img/font1.woff2` font, stable page structure, rapidly generated links, and rotating domains and lures, provide stronger clustering opportunities than the interchangeable RMM payloads.
rst_cloud's tweet photo. #threatreport #HighCompleteness A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign | 25-08-2026 Source: https://t.co/mpG3hymKef Key details below ↓ 💀Threats: Lolbin_technique, Gotoresolve_tool, Logmein_tool, Itarian_tool, Screenconnect_tool, Fingerprintjs_tool, Spear-phishing_technique, 🎯Victims: Education, Technology, Government, Banking, Manufacturing, Finance 🏭Industry: Government, Financial, Transport, Logistic, Education 🌐Geo: Canadian, America, Canada, United states 📚TTPs: ⚔️Tactics: 5 🛠️Technics: 10 🧨IOCs: - File: 4 - Domain: 35 - Url: 1 - IP: 1 - Hash: 3 💽Software: WordPress, Cloudflare R2, Dropbox, Telegram, Unix 🔢Algorithms: zip, sha256 🗂️Win API: RUN, EXE 📜Programming Languages: powershell, visual_basic 💻Platforms: arm, intel #threatreport: A phishing campaign initially themed around Canadian Revenue Agency T4 tax documents is part of a broader remote-access operation active across 46 countries, with the United States accounting for approximately 45% of observed activity. The campaign uses interchangeable lures involving tax notices, Social Security Administration documents, invoices, VAT alerts, Adobe PDFs, and shipping communications. Canada represents a larger share of the T4-themed activity, while North America accounts for 61% of the broader campaign. The attack begins with an email containing a link to a disposable Vercel-hosted page that impersonates a legitimate document service. After the victim enters an access code, the page delivers a password-protected ZIP archive containing a VBS script. The script uses FileSystemObject to launch PowerShell. PowerShell bypasses the user profile, delays execution with a sleep command, writes binary data to a stream, and downloads and installs an MSI package containing legitimate remote monitoring and management software. The attackers abuse signed RMM products to obtain interactive, hands-on-keyboard access rather than deploying a conventional malware family. Observed products include GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian. Because the RMM component changes between campaign arms, product-specific detections and antivirus classifications may miss the activity. Detection should instead identify unauthorized RMM installations, suspicious VBS-to-PowerShell execution, archive delivery, and RMM installers originating from newly created Vercel applications, free-hosting domains, compromised WordPress sites, or untrusted cloud storage. The delivery pages use browser and victim filtering, including FingerprintJS, hCaptcha, geolocation and IP checks, Green Spinner gating, and in some cases Telegram-based reporting. RMM installers are staged through Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, Gofile, Dropbox, compromised infrastructure, and raw IP addresses. The recurring web-kit artifacts, including the `img/font1.woff2` font, stable page structure, rapidly generated links, and rotating domains and lures, provide stronger clustering opportunities than the interchangeable RMM payloads.
1
1
0
0
398
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure | 18-08-2026 Source: https://t.co/DlPA6Gdc6o Key details below ↓ 🧑‍💻Actors/Campaigns: Dragonforce Chaos_raas Stac4749 💀Threats: Twinloot, Pyarmor_tool, Dead_drop_technique, Turnt, Zipslip_technique, Winrm_tool, Msarat, Credential_harvesting_technique, Dll_sideloading_technique, Byovd_technique, Chaos_ransomware, 🎯Victims: Microsoft 365 users, Microsoft teams users 🏭Industry: Financial, Transport 🌐Geo: Canada, Usa, America 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 0 🧨IOCs: - File: 13 - Domain: 5 - Url: 1 - Command: 2 - IP: 1 💽Software: Graph API, WebRTC, Microsoft Teams, Azure Blob, Azure AD, MSSQL, Microsoft Edge, Chrome, Windows lock screen, Windows authentication, ... 🪙Crypto: ethereum 🔢Algorithms: aes-256-gcm, sha256, zip 🔠Functions: fetch, Graph, TaskCache, NetAPI, Teams 🗂️Win API: RegLoadAppKeyW, ockfile, e, GetUserNameExW, BlockInput, MAN, DAT, NetServerEnum, etGroupGetUsers, a, sEnumerateDomainTrustsW 📜Programming Languages: python, powershell, golang #threatreport: TWINLOOT is a modular Python implant identified in a July 2026 campaign. It is protected with PyArmor 9.2.5 and delivered with a validly signed Python 3.12.9 embeddable runtime. A stage-0 loader launches the payload through `pythonw.exe`, extracts an embedded dependency archive, enforces single-instance execution, and loads approximately 120 protected modules. Analysts recovered 115 modules and decrypted an embedded AES-256-GCM configuration, exposing the implant’s command set and infrastructure. The implant uses Microsoft cloud services for command and control. It polls a SharePoint Online drive through Microsoft Graph every 15 seconds for commands, results, credential data, and exfiltrated reconnaissance information. Graph traffic can be issued through a headless Microsoft Edge instance controlled via the Chrome DevTools Protocol; requests are executed as same-origin browser `fetch()` calls, causing network activity to appear to originate from `msedge.exe` rather than Python. Configuration is refreshed from an Azure Blob Storage endpoint every 300 seconds. Interactive access uses a reverse SOCKS5 tunnel over either direct TLS/WebSocket communications or WebRTC DataChannels relayed through Microsoft Teams TURN infrastructure. The tunnel supports up to 128 concurrent TCP streams and enables access to internal services such as SMB, RDP, WinRM, and MSSQL. TWINLOOT can display a pixel-faithful Windows lock-screen imitation using Tkinter, with an HTML fallback. It does not validate passwords; entered values are encrypted and uploaded to SharePoint, while the victim receives misleading password-error messages. The implant supports system and domain reconnaissance, screenshots, tunnel control, configuration reloads, arbitrary shell command execution, and lateral-network pivoting. Four operator-triggered persistence mechanisms are included. These include TaskCache manipulation that can hide scheduled tasks and forging an `https://t.co/EAeOsuKDQT` mandatory-profile hive without administrative privileges. The latter uses `offreg.dll` and `RegLoadAppKeyW` to modify a hive offline, avoiding normal registry modification events. Initial access was achieved through Teams-based social engineering in which a user was persuaded to execute a PowerShell command that downloaded the staged runtime and payload.
rst_cloud's tweet photo. #threatreport #HighCompleteness Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure | 18-08-2026 Source: https://t.co/DlPA6Gdc6o Key details below ↓ 🧑‍💻Actors/Campaigns: Dragonforce Chaos_raas Stac4749 💀Threats: Twinloot, Pyarmor_tool, Dead_drop_technique, Turnt, Zipslip_technique, Winrm_tool, Msarat, Credential_harvesting_technique, Dll_sideloading_technique, Byovd_technique, Chaos_ransomware, 🎯Victims: Microsoft 365 users, Microsoft teams users 🏭Industry: Financial, Transport 🌐Geo: Canada, Usa, America 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 0 🧨IOCs: - File: 13 - Domain: 5 - Url: 1 - Command: 2 - IP: 1 💽Software: Graph API, WebRTC, Microsoft Teams, Azure Blob, Azure AD, MSSQL, Microsoft Edge, Chrome, Windows lock screen, Windows authentication, ... 🪙Crypto: ethereum 🔢Algorithms: aes-256-gcm, sha256, zip 🔠Functions: fetch, Graph, TaskCache, NetAPI, Teams 🗂️Win API: RegLoadAppKeyW, ockfile, e, GetUserNameExW, BlockInput, MAN, DAT, NetServerEnum, etGroupGetUsers, a, sEnumerateDomainTrustsW 📜Programming Languages: python, powershell, golang #threatreport: TWINLOOT is a modular Python implant identified in a July 2026 campaign. It is protected with PyArmor 9.2.5 and delivered with a validly signed Python 3.12.9 embeddable runtime. A stage-0 loader launches the payload through `pythonw.exe`, extracts an embedded dependency archive, enforces single-instance execution, and loads approximately 120 protected modules. Analysts recovered 115 modules and decrypted an embedded AES-256-GCM configuration, exposing the implant’s command set and infrastructure. The implant uses Microsoft cloud services for command and control. It polls a SharePoint Online drive through Microsoft Graph every 15 seconds for commands, results, credential data, and exfiltrated reconnaissance information. Graph traffic can be issued through a headless Microsoft Edge instance controlled via the Chrome DevTools Protocol; requests are executed as same-origin browser `fetch()` calls, causing network activity to appear to originate from `msedge.exe` rather than Python. Configuration is refreshed from an Azure Blob Storage endpoint every 300 seconds. Interactive access uses a reverse SOCKS5 tunnel over either direct TLS/WebSocket communications or WebRTC DataChannels relayed through Microsoft Teams TURN infrastructure. The tunnel supports up to 128 concurrent TCP streams and enables access to internal services such as SMB, RDP, WinRM, and MSSQL. TWINLOOT can display a pixel-faithful Windows lock-screen imitation using Tkinter, with an HTML fallback. It does not validate passwords; entered values are encrypted and uploaded to SharePoint, while the victim receives misleading password-error messages. The implant supports system and domain reconnaissance, screenshots, tunnel control, configuration reloads, arbitrary shell command execution, and lateral-network pivoting. Four operator-triggered persistence mechanisms are included. These include TaskCache manipulation that can hide scheduled tasks and forging an `https://t.co/EAeOsuKDQT` mandatory-profile hive without administrative privileges. The latter uses `offreg.dll` and `RegLoadAppKeyW` to modify a hive offline, avoiding normal registry modification events. Initial access was achieved through Teams-based social engineering in which a user was persuaded to execute a PowerShell command that downloaded the staged runtime and payload.
1
0
0
0
115
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Tracking PavinLoader across ClickFix and fake download campaigns | 24-08-2026 Source: https://t.co/W1V4QZz1z0 Key details below ↓ 💀Threats: Clickfix_technique, Etherhiding_technique, Amatera_stealer, Gollopdevest, Junk_code_technique, Heavens_gate_technique, Hijackloader, Dead_drop_technique, 🏭Industry: Financial 🌐Geo: Belarusian, Russian, Ukrainian 📚TTPs: ⚔️Tactics: 1 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027, T1027.007, T1027.009, T1027.013, T1027.016, T1036, T1059.003, T1071.001, T1071.004, T1082, ... 🧨IOCs: - File: 23 - Command: 3 - Path: 1 - Coin: 2 - Hash: 11 - IP: 3 - Domain: 14 - Url: 1 💽Software: RenPy, Dropbox, xen, virtualbox, qemu 🪙Crypto: binance 🔢Algorithms: xor, base64, sha256, hmac 🔠Functions: GetDelegateForFunctionPointer, OpenMutex 🗂️Win API: CreateEventW, GetTickCount, WaitForSingleObject, AmsiScanString, NtQueryInformationProcess, NtSetInformationThread, VirtualProtect, EtwEventWrite, GetCurrentThread, NtQueryInformationThread, ... 📜Programming Languages: powershell 💻Platforms: x86 #threatreport: PavinLoader is a multi-stage malware loader used in malicious RenPy campaigns, ClickFix attacks, and fake software-download campaigns. Initial delivery methods vary, including fake CAPTCHA pages that instruct victims to execute commands, trojanized games, and installers for apparently legitimate software. Across campaigns, the infection chains commonly abuse legitimate Windows tools and files such as MSBuild, `.csproj` projects, BAT scripts, Inno Setup or MSI installers, and trojanized .NET DLLs. The loader’s .NET components are heavily obfuscated using control-flow flattening, custom bytecode, indirect calls through `calli` and `ldftn`, encrypted strings, API hashing, delegates, redundant methods, and junk code. PavinLoader commonly begins with a trojanized legitimate DLL, including Nancy, DotNetZip, Renci.SshNet, or OpenXML libraries. These DLLs decrypt embedded resources, resolve APIs, alter network settings, disable TLS certificate validation, configure the system proxy, perform anti-forensics, and conduct timing-based anti-analysis checks. They then extract and execute the next stage from a resource or from data embedded between markers in a BAT or `.csproj` file. Extracted data may be decoded using XOR with a 32-byte key. A central component, the EtherHiding Loader, retrieves the command-and-control domain through an Ethereum JSON-RPC request to `https://t.co/r3i3Mtpk1F`. The resulting domain is used to download XOR-encoded payloads, often stored in JSON under `cache.content`. C2 paths commonly follow an `assets/{random-word}.json` pattern, and domains frequently use `.lat`, `.icu`, `.shop`, or `.cfd` top-level domains. Subsequent stages include an anti-analysis DLL and a PE loader. The anti-analysis component checks keyboard-layout languages, locale and region codes, hosting providers, hardware identifiers, BIOS and ACPI strings, and virtualization artifacts associated with VMware, VirtualBox, QEMU, Hyper-V, Xen, and other environments. The PE loader can execute payloads such as Amatera Stealer, which performs API hashing, anti-debugging, opaque-predicate obfuscation, Heaven’s Gate execution, DNS-over-HTTPS resolution, and raw socket communication. Additional payloads, including HijackLoader and other malware, may also be downloaded from the C2 infrastructure.
rst_cloud's tweet photo. #threatreport #HighCompleteness Tracking PavinLoader across ClickFix and fake download campaigns | 24-08-2026 Source: https://t.co/W1V4QZz1z0 Key details below ↓ 💀Threats: Clickfix_technique, Etherhiding_technique, Amatera_stealer, Gollopdevest, Junk_code_technique, Heavens_gate_technique, Hijackloader, Dead_drop_technique, 🏭Industry: Financial 🌐Geo: Belarusian, Russian, Ukrainian 📚TTPs: ⚔️Tactics: 1 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027, T1027.007, T1027.009, T1027.013, T1027.016, T1036, T1059.003, T1071.001, T1071.004, T1082, ... 🧨IOCs: - File: 23 - Command: 3 - Path: 1 - Coin: 2 - Hash: 11 - IP: 3 - Domain: 14 - Url: 1 💽Software: RenPy, Dropbox, xen, virtualbox, qemu 🪙Crypto: binance 🔢Algorithms: xor, base64, sha256, hmac 🔠Functions: GetDelegateForFunctionPointer, OpenMutex 🗂️Win API: CreateEventW, GetTickCount, WaitForSingleObject, AmsiScanString, NtQueryInformationProcess, NtSetInformationThread, VirtualProtect, EtwEventWrite, GetCurrentThread, NtQueryInformationThread, ... 📜Programming Languages: powershell 💻Platforms: x86 #threatreport: PavinLoader is a multi-stage malware loader used in malicious RenPy campaigns, ClickFix attacks, and fake software-download campaigns. Initial delivery methods vary, including fake CAPTCHA pages that instruct victims to execute commands, trojanized games, and installers for apparently legitimate software. Across campaigns, the infection chains commonly abuse legitimate Windows tools and files such as MSBuild, `.csproj` projects, BAT scripts, Inno Setup or MSI installers, and trojanized .NET DLLs. The loader’s .NET components are heavily obfuscated using control-flow flattening, custom bytecode, indirect calls through `calli` and `ldftn`, encrypted strings, API hashing, delegates, redundant methods, and junk code. PavinLoader commonly begins with a trojanized legitimate DLL, including Nancy, DotNetZip, Renci.SshNet, or OpenXML libraries. These DLLs decrypt embedded resources, resolve APIs, alter network settings, disable TLS certificate validation, configure the system proxy, perform anti-forensics, and conduct timing-based anti-analysis checks. They then extract and execute the next stage from a resource or from data embedded between markers in a BAT or `.csproj` file. Extracted data may be decoded using XOR with a 32-byte key. A central component, the EtherHiding Loader, retrieves the command-and-control domain through an Ethereum JSON-RPC request to `https://t.co/r3i3Mtpk1F`. The resulting domain is used to download XOR-encoded payloads, often stored in JSON under `cache.content`. C2 paths commonly follow an `assets/{random-word}.json` pattern, and domains frequently use `.lat`, `.icu`, `.shop`, or `.cfd` top-level domains. Subsequent stages include an anti-analysis DLL and a PE loader. The anti-analysis component checks keyboard-layout languages, locale and region codes, hosting providers, hardware identifiers, BIOS and ACPI strings, and virtualization artifacts associated with VMware, VirtualBox, QEMU, Hyper-V, Xen, and other environments. The PE loader can execute payloads such as Amatera Stealer, which performs API hashing, anti-debugging, opaque-predicate obfuscation, Heaven’s Gate execution, DNS-over-HTTPS resolution, and raw socket communication. Additional payloads, including HijackLoader and other malware, may also be downloaded from the C2 infrastructure.
0
1
0
0
99
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Ten Minutes to Containment: How Agentic MXDR Scoped a Fake Claude Desktop Intrusion | 24-08-2026 Source: https://t.co/Vg6aIdDnuP Key details below ↓ 🧑‍💻Actors/Campaigns: Fakeagent 💀Threats: Dll_sideloading_technique, Sectop_rat, Vmprotect_tool, Etherhiding_technique, Spear-phishing_technique, 🏭Industry: Financial 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 9 🧨IOCs: - File: 21 - Command: 3 - Domain: 1 - IP: 1 - Url: 1 💽Software: Claude, Microsoft Defender, Chromium, Microsoft Edge, Docker, Anthropic, JetBrains, claude-code, chrome, firefox, ... 🪙Crypto: ethereum 🔢Algorithms: sha256 ⚙️Win Services: powerpnt 📜Programming Languages: powershell, java 💻Platforms: x86 #threatreport: The intrusion involved the FakeAgent malvertising campaign, which distributes SectopRAT through trojanized Claude desktop installers. Victims searching for the Claude application were directed through sponsored advertisements to legitimate-looking Claude Artifact pages hosted on https://t.co/tu0Qd6scdL. These pages initiated downloads of a malicious `ClaudeDesktop.exe`, helping the campaign evade reputation-based filtering and increase user trust. The malware chain used DLL sideloading and masquerading. The fake Claude executable launched a secondary `DockerDesktop.exe` from a randomized, user-writable AppData Roaming directory. A legitimate signed JetBrains `jcef_helper.exe` component was abused to load a malicious, VMProtect-packed `libcef.dll` from a non-standard location. The binary’s internal Java Chromium Embedded Framework metadata was inconsistent with its displayed Claude application name, providing an indicator of impersonation. The installer also performed defense evasion by spawning PowerShell commands that used `Add-MpPreference -ExclusionPath` to add user-profile or staging directories to Microsoft Defender exclusions. Persistence was established with `schtasks.exe`, creating a task named `MicrosoftEdgeUpdate` configured to run at user logon with the highest privileges. Despite its legitimate-looking name, the task executed `DockerDesktop.exe` from a user-writable AppData path. The activity was attributed to SectopRAT based on the execution sequence, loader behavior, and alignment with publicly reported FakeAgent infrastructure. The malware uses EtherHiding to retrieve encrypted C2 parameters from Ethereum blockchain transaction data rather than relying solely on conventional attacker-controlled domains. Connections to public blockchain RPC nodes may therefore represent configuration retrieval instead of normal command-and-control traffic. Recommended detection opportunities include monitoring scheduled tasks that execute from AppData or Downloads, especially updater-named tasks configured with elevated privileges; detecting Defender exclusions created near newly downloaded software; identifying `libcef.dll` loads from non-standard directories; investigating mismatches between executable names and internal metadata; and monitoring blockchain RPC connections originating from newly executed installer processes. Containment required endpoint isolation, session-token revocation, credential resets, removal of exclusions and scheduled tasks, reimaging, and retrospective identity-access review.
rst_cloud's tweet photo. #threatreport #HighCompleteness Ten Minutes to Containment: How Agentic MXDR Scoped a Fake Claude Desktop Intrusion | 24-08-2026 Source: https://t.co/Vg6aIdDnuP Key details below ↓ 🧑‍💻Actors/Campaigns: Fakeagent 💀Threats: Dll_sideloading_technique, Sectop_rat, Vmprotect_tool, Etherhiding_technique, Spear-phishing_technique, 🏭Industry: Financial 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 9 🧨IOCs: - File: 21 - Command: 3 - Domain: 1 - IP: 1 - Url: 1 💽Software: Claude, Microsoft Defender, Chromium, Microsoft Edge, Docker, Anthropic, JetBrains, claude-code, chrome, firefox, ... 🪙Crypto: ethereum 🔢Algorithms: sha256 ⚙️Win Services: powerpnt 📜Programming Languages: powershell, java 💻Platforms: x86 #threatreport: The intrusion involved the FakeAgent malvertising campaign, which distributes SectopRAT through trojanized Claude desktop installers. Victims searching for the Claude application were directed through sponsored advertisements to legitimate-looking Claude Artifact pages hosted on https://t.co/tu0Qd6scdL. These pages initiated downloads of a malicious `ClaudeDesktop.exe`, helping the campaign evade reputation-based filtering and increase user trust. The malware chain used DLL sideloading and masquerading. The fake Claude executable launched a secondary `DockerDesktop.exe` from a randomized, user-writable AppData Roaming directory. A legitimate signed JetBrains `jcef_helper.exe` component was abused to load a malicious, VMProtect-packed `libcef.dll` from a non-standard location. The binary’s internal Java Chromium Embedded Framework metadata was inconsistent with its displayed Claude application name, providing an indicator of impersonation. The installer also performed defense evasion by spawning PowerShell commands that used `Add-MpPreference -ExclusionPath` to add user-profile or staging directories to Microsoft Defender exclusions. Persistence was established with `schtasks.exe`, creating a task named `MicrosoftEdgeUpdate` configured to run at user logon with the highest privileges. Despite its legitimate-looking name, the task executed `DockerDesktop.exe` from a user-writable AppData path. The activity was attributed to SectopRAT based on the execution sequence, loader behavior, and alignment with publicly reported FakeAgent infrastructure. The malware uses EtherHiding to retrieve encrypted C2 parameters from Ethereum blockchain transaction data rather than relying solely on conventional attacker-controlled domains. Connections to public blockchain RPC nodes may therefore represent configuration retrieval instead of normal command-and-control traffic. Recommended detection opportunities include monitoring scheduled tasks that execute from AppData or Downloads, especially updater-named tasks configured with elevated privileges; detecting Defender exclusions created near newly downloaded software; identifying `libcef.dll` loads from non-standard directories; investigating mismatches between executable names and internal metadata; and monitoring blockchain RPC connections originating from newly executed installer processes. Containment required endpoint isolation, session-token revocation, credential resets, removal of exclusions and scheduled tasks, reimaging, and retrospective identity-access review.
0
0
0
0
109
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness From fake interview to signed ClickOnce: inside a three-payload Windows chain | 13-08-2026 Source: https://t.co/g8Ll44ys0w Key details below ↓ 💀Threats: Clickonce_tool, Hvnc_tool, Needle_craas_tool, Odyssey_stealer, Traffer_technique, Goloader, Svcstealer, Donut, Antivm_technique, Shadow_copies_delete_technique, Clickfix_technique, Rhadamanthys, Credential_stealing_technique, 🎯Victims: Cryptocurrency organization 🏭Industry: Financial, E-commerce 🌐Geo: Dprk, Republic of korea, North korean, Norwegian, Norway, Russia 📚TTPs: ⚔️Tactics: 6 🛠️Technics: 0 🧨IOCs: - File: 33 - Url: 6 - Domain: 9 - IP: 2 - Hash: 7 - Path: 1 - Registry: 6 💽Software: macOS, Windows registry, Dropbox, Telegram, Process Explorer, Chromium, Chrome, Vivaldi, Opera, Firefox, ... 📲Wallets: metamask, rabby, keplr, coinbase, mainnet 🪙Crypto: ethereum 🔢Algorithms: zip, aes-256-gcm, 3des, lznt1, sha1, xor, sha256, aes, chaskey, aes-256, hmac 🔠Functions: setApprovalForAll, Non-browser 🗂️Win API: NtCreateThreadEx 📜Programming Languages: php, rust 💻Platforms: x64 #threatreport: The campaign used a targeted fake Web3 recruitment process to compromise an employee of a cryptocurrency organization. An attacker contacted the victim through LinkedIn, arranged interviews using Calendly, and delivered a malicious technical assessment disguised as a Google Sheet. A Google Apps Script web application profiled the visitor’s IP address, geolocation, browser, operating system, and installed wallet extensions, while reporting activity to attacker-controlled Telegram chats. Windows users were directed to a signed ClickOnce application, `GapiUpdate.application`, hosted through `gapidriver[.]com`. ClickOnce launched the chain through `rundll32.exe` and `dfsvc.exe`, installing per-user components under `%LOCALAPPDATA%\Apps\2.0`. `GapiUpdate.exe` and `GapiUpdate.dll` displayed a legitimate Google Workspace page using WebView2 while retrieving authenticated configuration. The stager checked for security and analysis tools, then downloaded a password-protected Dropbox archive named `Razo.rar`. The archive contained three 64-bit PE files disguised as PNG images. These were renamed to random executables and launched approximately one minute apart. Each wrapper used layered in-memory loading involving an overlay, the authenticated “Vortex” container, position-independent shellcode, and a modified Donut loader. The recovered payloads were two credential stealers and a Go-based remote access trojan. NeedleStealer targeted Chromium and Firefox credentials, cookies, tokens, wallet extensions, desktop wallets, Telegram sessions, screenshots, and system information. It included support for Chromium App-Bound Encryption, browser-process interaction, DPAPI, and live-browser collection. The Rust stealer targeted browser passwords, cookies, sessions, autofill data, cryptocurrency wallets, Telegram, Discord, Steam, VPN and FTP credentials, SSH material, KeePass databases, screenshots, and developer or cloud configuration files such as `.env`, AWS, Docker, Kubernetes, GitHub CLI, Terraform, Vercel, Netlify, Cursor, Claude, and Visual Studio Code data. The Go RAT provided interactive shell access, process control, file upload and download, in-memory execution, reverse proxying, keylogging, wallet collection, visible VNC, hidden VNC, and persistence through scheduled tasks or registry autoruns. Its communications used encrypted raw TCP, including infrastructure at `91.219.238.169:5556`. The activity shares infrastructure and delivery characteristics with the GAPI_Update and fake Google Workspace ecosystem, including overlap in a code-signing certificate and one loader hash. However, the evidence does not establish a single operator; the campaign may involve a shared delivery service, affiliate, or malware-as-a-service ecosystem with possible DPRK-associated tradecraft.
rst_cloud's tweet photo. #threatreport #HighCompleteness From fake interview to signed ClickOnce: inside a three-payload Windows chain | 13-08-2026 Source: https://t.co/g8Ll44ys0w Key details below ↓ 💀Threats: Clickonce_tool, Hvnc_tool, Needle_craas_tool, Odyssey_stealer, Traffer_technique, Goloader, Svcstealer, Donut, Antivm_technique, Shadow_copies_delete_technique, Clickfix_technique, Rhadamanthys, Credential_stealing_technique, 🎯Victims: Cryptocurrency organization 🏭Industry: Financial, E-commerce 🌐Geo: Dprk, Republic of korea, North korean, Norwegian, Norway, Russia 📚TTPs: ⚔️Tactics: 6 🛠️Technics: 0 🧨IOCs: - File: 33 - Url: 6 - Domain: 9 - IP: 2 - Hash: 7 - Path: 1 - Registry: 6 💽Software: macOS, Windows registry, Dropbox, Telegram, Process Explorer, Chromium, Chrome, Vivaldi, Opera, Firefox, ... 📲Wallets: metamask, rabby, keplr, coinbase, mainnet 🪙Crypto: ethereum 🔢Algorithms: zip, aes-256-gcm, 3des, lznt1, sha1, xor, sha256, aes, chaskey, aes-256, hmac 🔠Functions: setApprovalForAll, Non-browser 🗂️Win API: NtCreateThreadEx 📜Programming Languages: php, rust 💻Platforms: x64 #threatreport: The campaign used a targeted fake Web3 recruitment process to compromise an employee of a cryptocurrency organization. An attacker contacted the victim through LinkedIn, arranged interviews using Calendly, and delivered a malicious technical assessment disguised as a Google Sheet. A Google Apps Script web application profiled the visitor’s IP address, geolocation, browser, operating system, and installed wallet extensions, while reporting activity to attacker-controlled Telegram chats. Windows users were directed to a signed ClickOnce application, `GapiUpdate.application`, hosted through `gapidriver[.]com`. ClickOnce launched the chain through `rundll32.exe` and `dfsvc.exe`, installing per-user components under `%LOCALAPPDATA%\Apps\2.0`. `GapiUpdate.exe` and `GapiUpdate.dll` displayed a legitimate Google Workspace page using WebView2 while retrieving authenticated configuration. The stager checked for security and analysis tools, then downloaded a password-protected Dropbox archive named `Razo.rar`. The archive contained three 64-bit PE files disguised as PNG images. These were renamed to random executables and launched approximately one minute apart. Each wrapper used layered in-memory loading involving an overlay, the authenticated “Vortex” container, position-independent shellcode, and a modified Donut loader. The recovered payloads were two credential stealers and a Go-based remote access trojan. NeedleStealer targeted Chromium and Firefox credentials, cookies, tokens, wallet extensions, desktop wallets, Telegram sessions, screenshots, and system information. It included support for Chromium App-Bound Encryption, browser-process interaction, DPAPI, and live-browser collection. The Rust stealer targeted browser passwords, cookies, sessions, autofill data, cryptocurrency wallets, Telegram, Discord, Steam, VPN and FTP credentials, SSH material, KeePass databases, screenshots, and developer or cloud configuration files such as `.env`, AWS, Docker, Kubernetes, GitHub CLI, Terraform, Vercel, Netlify, Cursor, Claude, and Visual Studio Code data. The Go RAT provided interactive shell access, process control, file upload and download, in-memory execution, reverse proxying, keylogging, wallet collection, visible VNC, hidden VNC, and persistence through scheduled tasks or registry autoruns. Its communications used encrypted raw TCP, including infrastructure at `91.219.238.169:5556`. The activity shares infrastructure and delivery characteristics with the GAPI_Update and fake Google Workspace ecosystem, including overlap in a code-signing certificate and one loader hash. However, the evidence does not establish a single operator; the campaign may involve a shared delivery service, affiliate, or malware-as-a-service ecosystem with possible DPRK-associated tradecraft.
1
4
2
1
330
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness A ClickFix cluster: Observed activity from recent ClickFix campaigns | 24-08-2026 Source: https://t.co/7fJHxuxSdk Key details below ↓ 🧑‍💻Actors/Campaigns: Vice_society 💀Threats: Clickfix_technique, Dll_sideloading_technique, Nltest_tool, Supper_backdoor, Lorem_ipsum_loader, Lorem_ipsum, Dead_drop_technique, 🏭Industry: Financial 📚TTPs: ⚔️Tactics: 3 🛠️Technics: 10 🧨IOCs: - File: 16 - Url: 4 - Command: 2 - Domain: 11 - IP: 10 - Hash: 8 💽Software: WordPress, Bitwarden, Active Directory 🔢Algorithms: sha256, zip 🗂️Win API: olygon bl ⚙️Win Services: WebClient, bits 📜Programming Languages: python, powershell, javascript #threatreport: Between June and July 2026, a ClickFix cluster used three delivery methods to establish footholds: remotely hosted MSI packages, NodeJS JavaScript, and Python-based payloads. In one campaign, victims were contacted by phone and directed to compromised WordPress sites hosting ClickFix lures. The lures copied commands into the clipboard, relying on users to execute them through Windows Run or similar interfaces. The MSI campaign delivered legitimate applications, including 3D PDF Maker Smart, Bitwarden VPN, and ESET Sysinspector, which were used to sideload malicious DLLs. PowerShell executed `dsregcmd.exe /status` for host discovery, likely to determine device registration status. After a six-day dwell period, a loader placed a renamed Microsoft .NET ClickOnce utility, `NET Runtime Optimization Service.exe`, and a malicious `mscoree.dll` in a hidden, system-marked ProgramData subdirectory. DLL sideloading then triggered further PowerShell execution and discovery activity. A second campaign used NodeJS to execute `update.js` from ProgramData. The script downloaded and ran a PowerShell loader that installed the same ClickOnce utility and malicious DLL combination. The third campaign used a compromised WordPress site with JavaScript that filtered visitors by operating system and crawler status, gathered system information, and used Polygon blockchain `eth_call` requests to retrieve payload-hosting domains. It then presented localized social-engineering prompts and copied a malicious PowerShell command to the clipboard. That command downloaded a ZIP archive containing Python 3.5 and `https://t.co/9VVgsp8gIu`, which unpacked an executable, DLL, and batch file into ProgramData. Across the campaigns, operators hid malware directories with `attrib.exe`, established persistence through scheduled tasks or Run keys, and used legitimate Windows binaries for DLL sideloading. Command-and-control domains were decoded from dead drops in Digital Point user profiles, with data sent by POST requests to `/api/init/{guid}` inside JFIF files. Post-compromise activity included Active Directory account discovery using ADSI searches for users with descriptions. The techniques and infrastructure overlap with the Lorem Ipsum malware family and activity associated with the Supper backdoor and Vanilla Tempest.
rst_cloud's tweet photo. #threatreport #HighCompleteness A ClickFix cluster: Observed activity from recent ClickFix campaigns | 24-08-2026 Source: https://t.co/7fJHxuxSdk Key details below ↓ 🧑‍💻Actors/Campaigns: Vice_society 💀Threats: Clickfix_technique, Dll_sideloading_technique, Nltest_tool, Supper_backdoor, Lorem_ipsum_loader, Lorem_ipsum, Dead_drop_technique, 🏭Industry: Financial 📚TTPs: ⚔️Tactics: 3 🛠️Technics: 10 🧨IOCs: - File: 16 - Url: 4 - Command: 2 - Domain: 11 - IP: 10 - Hash: 8 💽Software: WordPress, Bitwarden, Active Directory 🔢Algorithms: sha256, zip 🗂️Win API: olygon bl ⚙️Win Services: WebClient, bits 📜Programming Languages: python, powershell, javascript #threatreport: Between June and July 2026, a ClickFix cluster used three delivery methods to establish footholds: remotely hosted MSI packages, NodeJS JavaScript, and Python-based payloads. In one campaign, victims were contacted by phone and directed to compromised WordPress sites hosting ClickFix lures. The lures copied commands into the clipboard, relying on users to execute them through Windows Run or similar interfaces. The MSI campaign delivered legitimate applications, including 3D PDF Maker Smart, Bitwarden VPN, and ESET Sysinspector, which were used to sideload malicious DLLs. PowerShell executed `dsregcmd.exe /status` for host discovery, likely to determine device registration status. After a six-day dwell period, a loader placed a renamed Microsoft .NET ClickOnce utility, `NET Runtime Optimization Service.exe`, and a malicious `mscoree.dll` in a hidden, system-marked ProgramData subdirectory. DLL sideloading then triggered further PowerShell execution and discovery activity. A second campaign used NodeJS to execute `update.js` from ProgramData. The script downloaded and ran a PowerShell loader that installed the same ClickOnce utility and malicious DLL combination. The third campaign used a compromised WordPress site with JavaScript that filtered visitors by operating system and crawler status, gathered system information, and used Polygon blockchain `eth_call` requests to retrieve payload-hosting domains. It then presented localized social-engineering prompts and copied a malicious PowerShell command to the clipboard. That command downloaded a ZIP archive containing Python 3.5 and `https://t.co/9VVgsp8gIu`, which unpacked an executable, DLL, and batch file into ProgramData. Across the campaigns, operators hid malware directories with `attrib.exe`, established persistence through scheduled tasks or Run keys, and used legitimate Windows binaries for DLL sideloading. Command-and-control domains were decoded from dead drops in Digital Point user profiles, with data sent by POST requests to `/api/init/{guid}` inside JFIF files. Post-compromise activity included Active Directory account discovery using ADSI searches for users with descriptions. The techniques and infrastructure overlap with the Lorem Ipsum malware family and activity associated with the Supper backdoor and Vanilla Tempest.
1
0
1
0
137
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness When Agents Go Rogue: The OpenClaw Supply Chain Crisis | 19-08-2026 Source: https://t.co/xTXjL4cvZC Key details below ↓ 🧑‍💻Actors/Campaigns: Clawhavoc 💀Threats: Supply_chain_technique, Clickfix_technique, Nova_stealer, Typosquatting_technique, Amos_stealer, Clipboard_hijacking_technique, Netcat_tool, Lolbin_technique, Polymorphism_technique, 🎯Victims: Openclaw users, Web3 developers, Ai developers, Cryptocurrency users 🏭Industry: Retail 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 7 🧨IOCs: - File: 13 - IP: 2 - Command: 1 - Path: 1 - Hash: 2 💽Software: OpenClaw, ClawHub, Clawdbot, Moltbot, macOS, curl, Slack, Node.js, process explorer, Chrome, ... 📲Wallets: metamask, electrum 🔢Algorithms: base64, zip, sha256, xor 🔠Functions: Set-Clipboard, Get-Clipboard 📜Programming Languages: powershell 💻Platforms: cross-platform, apple, arm, intel #threatreport: OpenClaw is an open-source agentic AI framework that connects large language models to operating-system resources, including local files, messaging platforms, the clipboard, and unsandboxed terminal commands. The report describes vulnerabilities and active exploitation affecting releases before version 2026.1.29 and ClawHub registry snapshots from March–May 2026. Its primary risks arise from broad command execution, weak isolation, plaintext credential storage, and implicit trust in LLM-generated tool requests. The ClawHavoc supply-chain campaign poisoned the ClawHub skill registry with more than 350 malicious or typosquatted skills. Packages impersonated tools such as `clawhub-cli` and targeted crypto, developer, and social-media use cases. Malicious `SKILL.md` files used ClickFix-style social engineering to instruct users to install a fake authentication utility, often named AuthTool, or manually execute a Base64-encoded command. That command downloaded and executed a Mach-O universal binary, NovaStealer v2, from `91.92.242.30` on macOS systems. NovaStealer v2, described as an Atomic macOS Stealer variant, targets cryptocurrency wallets, browser cookies and login data, macOS Keychain information, SSH keys, AWS credentials, `.env` files, and OpenClaw-related agent data such as `~/.clawdbot/HEARTBEAT.md`. The binary supports Intel and Apple Silicon architectures and uses XOR-based string obfuscation. OpenClaw’s unrestricted `child_process.exec()` functionality also enables malicious skills or injected prompts to access clipboard contents, download and execute binaries, and create scheduled tasks. The report also details indirect prompt injection attacks in which malicious instructions embedded in emails, webpages, documents, or chat content manipulate the agent into issuing shell commands. OpenClaw may pass LLM-generated commands directly to the host shell, including PowerShell, `curl`, `nc.exe`, or `schtasks.exe`, without mandatory approval when parameters disable approval checks. Recommended controls include isolating deployments on dedicated systems or VPS instances, restricting network access, preventing public gateway exposure, using non-sensitive accounts, auditing installations, and monitoring `node.exe` child-process chains and suspicious file writes associated with known ClawHavoc artifacts.
rst_cloud's tweet photo. #threatreport #HighCompleteness When Agents Go Rogue: The OpenClaw Supply Chain Crisis | 19-08-2026 Source: https://t.co/xTXjL4cvZC Key details below ↓ 🧑‍💻Actors/Campaigns: Clawhavoc 💀Threats: Supply_chain_technique, Clickfix_technique, Nova_stealer, Typosquatting_technique, Amos_stealer, Clipboard_hijacking_technique, Netcat_tool, Lolbin_technique, Polymorphism_technique, 🎯Victims: Openclaw users, Web3 developers, Ai developers, Cryptocurrency users 🏭Industry: Retail 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 7 🧨IOCs: - File: 13 - IP: 2 - Command: 1 - Path: 1 - Hash: 2 💽Software: OpenClaw, ClawHub, Clawdbot, Moltbot, macOS, curl, Slack, Node.js, process explorer, Chrome, ... 📲Wallets: metamask, electrum 🔢Algorithms: base64, zip, sha256, xor 🔠Functions: Set-Clipboard, Get-Clipboard 📜Programming Languages: powershell 💻Platforms: cross-platform, apple, arm, intel #threatreport: OpenClaw is an open-source agentic AI framework that connects large language models to operating-system resources, including local files, messaging platforms, the clipboard, and unsandboxed terminal commands. The report describes vulnerabilities and active exploitation affecting releases before version 2026.1.29 and ClawHub registry snapshots from March–May 2026. Its primary risks arise from broad command execution, weak isolation, plaintext credential storage, and implicit trust in LLM-generated tool requests. The ClawHavoc supply-chain campaign poisoned the ClawHub skill registry with more than 350 malicious or typosquatted skills. Packages impersonated tools such as `clawhub-cli` and targeted crypto, developer, and social-media use cases. Malicious `SKILL.md` files used ClickFix-style social engineering to instruct users to install a fake authentication utility, often named AuthTool, or manually execute a Base64-encoded command. That command downloaded and executed a Mach-O universal binary, NovaStealer v2, from `91.92.242.30` on macOS systems. NovaStealer v2, described as an Atomic macOS Stealer variant, targets cryptocurrency wallets, browser cookies and login data, macOS Keychain information, SSH keys, AWS credentials, `.env` files, and OpenClaw-related agent data such as `~/.clawdbot/HEARTBEAT.md`. The binary supports Intel and Apple Silicon architectures and uses XOR-based string obfuscation. OpenClaw’s unrestricted `child_process.exec()` functionality also enables malicious skills or injected prompts to access clipboard contents, download and execute binaries, and create scheduled tasks. The report also details indirect prompt injection attacks in which malicious instructions embedded in emails, webpages, documents, or chat content manipulate the agent into issuing shell commands. OpenClaw may pass LLM-generated commands directly to the host shell, including PowerShell, `curl`, `nc.exe`, or `schtasks.exe`, without mandatory approval when parameters disable approval checks. Recommended controls include isolating deployments on dedicated systems or VPS instances, restricting network access, preventing public gateway exposure, using non-sensitive accounts, auditing installations, and monitoring `node.exe` child-process chains and suspicious file writes associated with known ClawHavoc artifacts.
0
0
0
0
125
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Anatomy of an Agent Tesla BEC Attack: From Inbox to In-Memory Infostealer | 20-08-2026 Source: https://t.co/z0Ta1UEnqL Key details below ↓ 💀Threats: Agent_tesla, Bec_technique, Donut, Credential_harvesting_technique, Pe_injection_technique, Confuserex_tool, Antidebugging_technique, Credential_dumping_technique, 🎯Victims: Finance departments, Metropolitan bank and trust company 🏭Industry: Financial 🌐Geo: Philippines 📚TTPs: ⚔️Tactics: 8 🛠️Technics: 17 🧨IOCs: - File: 17 - Domain: 2 - Registry: 5 - Path: 6 - IP: 2 - Hash: 1 - Url: 2 - Email: 1 💽Software: Chromium, Outlook, Foxmail, Discord, VirtualBox, Chrome, Opera, Vivaldi, Firefox, SeaMonkey, ... 🔢Algorithms: aes, md5, sha256, xor, aes-gcm 🔠Functions: GetModuleHandle, CreateFileMapping, SetWindowsHookEx, GetWindowText, CreateObject 🗂️Win API: CryptUnprotectData, DuplicateHandle, MapViewOfFile, NtQuerySystemInformation, ToUnicodeEx, GetForegroundWindow, SetClipboardViewer ⚙️Win Services: WebClient 📜Programming Languages: swift, python, jscript 💻Platforms: x86, intel #threatreport: The analyzed campaign used a business email compromise lure spoofing Metropolitan Bank and Trust Company to target finance personnel. The message appeared as a forwarded wire-transfer discussion and urged recipients to confirm an attached document. The attachment was a 6.94 MB JScript dropper named “SWIFT Payment Maker 103 - 10.06.26.JS.” Its code was obscured with Unicode emoji characters interleaved throughout the script, disrupting string-based detection and visual analysis. Execution followed a fileless chain of JScript, DonutLoader shellcode, and reflective in-memory .NET/MSIL injection. Supporting files included a 32-bit .NET loader and a file disguised with a `.ttf` extension that actually contained an encoded Agent Tesla payload. The final infostealer was not written to disk. Its assembly metadata falsely identified it as a Python 3.11.3 64-bit installer, despite being an obfuscated 32-bit x86 .NET 4.0 binary protected with ConfuserEx. Before executing its credential theft routines, Agent Tesla performed anti-analysis checks including `CheckRemoteDebuggerPresent`, cloud or hosting IP detection, a sleep-based virtual machine timing test, sandbox DLL enumeration, and WMI queries for VMware, VirtualBox, and Microsoft virtual machine identifiers. It also generated a hardware fingerprint from the motherboard serial number, CPU ID, and primary MAC address, hashing these values with MD5 for victim tracking. The malware contained 21 harvesting modules covering 27 Chromium-based and 13 Mozilla-based browsers, Outlook, Foxmail, Discord, Thunderbird contacts, Windows Credential Manager, Windows Vault, SMTP stores, and other applications. It used application-specific decryption routines, DPAPI, raw vault structure access, and handle duplication to read locked browser files. Discord OAuth tokens, including MFA-related token patterns, were targeted for potential account takeover. Collected information was exfiltrated over FTP to `https://t.co/dLXn0k1bse` using credentials embedded in the binary. Transfer metadata included the username, hostname, operating system, hardware details, public IP address, timestamp, and MD5 hardware identifier. The build also contained functionality for keylogging, screenshots, clipboard collection, persistence in `%APPDATA%` with a startup key, Mark-of-the-Web removal, hosts-file modification, TLS validation bypass, and single-instance enforcement, although some collection features were disabled in the analyzed configuration.
rst_cloud's tweet photo. #threatreport #HighCompleteness Anatomy of an Agent Tesla BEC Attack: From Inbox to In-Memory Infostealer | 20-08-2026 Source: https://t.co/z0Ta1UEnqL Key details below ↓ 💀Threats: Agent_tesla, Bec_technique, Donut, Credential_harvesting_technique, Pe_injection_technique, Confuserex_tool, Antidebugging_technique, Credential_dumping_technique, 🎯Victims: Finance departments, Metropolitan bank and trust company 🏭Industry: Financial 🌐Geo: Philippines 📚TTPs: ⚔️Tactics: 8 🛠️Technics: 17 🧨IOCs: - File: 17 - Domain: 2 - Registry: 5 - Path: 6 - IP: 2 - Hash: 1 - Url: 2 - Email: 1 💽Software: Chromium, Outlook, Foxmail, Discord, VirtualBox, Chrome, Opera, Vivaldi, Firefox, SeaMonkey, ... 🔢Algorithms: aes, md5, sha256, xor, aes-gcm 🔠Functions: GetModuleHandle, CreateFileMapping, SetWindowsHookEx, GetWindowText, CreateObject 🗂️Win API: CryptUnprotectData, DuplicateHandle, MapViewOfFile, NtQuerySystemInformation, ToUnicodeEx, GetForegroundWindow, SetClipboardViewer ⚙️Win Services: WebClient 📜Programming Languages: swift, python, jscript 💻Platforms: x86, intel #threatreport: The analyzed campaign used a business email compromise lure spoofing Metropolitan Bank and Trust Company to target finance personnel. The message appeared as a forwarded wire-transfer discussion and urged recipients to confirm an attached document. The attachment was a 6.94 MB JScript dropper named “SWIFT Payment Maker 103 - 10.06.26.JS.” Its code was obscured with Unicode emoji characters interleaved throughout the script, disrupting string-based detection and visual analysis. Execution followed a fileless chain of JScript, DonutLoader shellcode, and reflective in-memory .NET/MSIL injection. Supporting files included a 32-bit .NET loader and a file disguised with a `.ttf` extension that actually contained an encoded Agent Tesla payload. The final infostealer was not written to disk. Its assembly metadata falsely identified it as a Python 3.11.3 64-bit installer, despite being an obfuscated 32-bit x86 .NET 4.0 binary protected with ConfuserEx. Before executing its credential theft routines, Agent Tesla performed anti-analysis checks including `CheckRemoteDebuggerPresent`, cloud or hosting IP detection, a sleep-based virtual machine timing test, sandbox DLL enumeration, and WMI queries for VMware, VirtualBox, and Microsoft virtual machine identifiers. It also generated a hardware fingerprint from the motherboard serial number, CPU ID, and primary MAC address, hashing these values with MD5 for victim tracking. The malware contained 21 harvesting modules covering 27 Chromium-based and 13 Mozilla-based browsers, Outlook, Foxmail, Discord, Thunderbird contacts, Windows Credential Manager, Windows Vault, SMTP stores, and other applications. It used application-specific decryption routines, DPAPI, raw vault structure access, and handle duplication to read locked browser files. Discord OAuth tokens, including MFA-related token patterns, were targeted for potential account takeover. Collected information was exfiltrated over FTP to `https://t.co/dLXn0k1bse` using credentials embedded in the binary. Transfer metadata included the username, hostname, operating system, hardware details, public IP address, timestamp, and MD5 hardware identifier. The build also contained functionality for keylogging, screenshots, clipboard collection, persistence in `%APPDATA%` with a startup key, Mark-of-the-Web removal, hosts-file modification, TLS validation bypass, and single-instance enforcement, although some collection features were disabled in the analyzed configuration.
1
0
0
0
163
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness FTP Banners: The New Dead Drop Resolver Delivering Novel RATs | 22-08-2026 Source: https://t.co/gMoA5yjIpA Key details below ↓ 💀Threats: Dead_drop_technique, Clickfix_technique, E4del, Pinhole, Apc_injection_technique, Smuggling_technique, Hellsgate_technique, Donut, Spear-phishing_technique, Process_injection_technique, 🏭Industry: Healthcare 🌐Geo: Spanish 📚TTPs: ⚔️Tactics: 9 🛠️Technics: 34 🧨IOCs: - File: 19 - IP: 12 - Url: 8 - Path: 2 - Domain: 2 - Hash: 7 💽Software: Discord, Chromium, Node.js, Electron, Windows Defender, Google Chrome, curl, Windows Imaging Component 🔢Algorithms: xor, base64, aes-256-cbc, chaskey, exhibit, sha256, zip, prng 🔠Functions: setLoginItemSettings, CreateCompatibleDC, CreateDIBSection, CreateStreamOnHGlobal, InitializeFromIStream, CreateEncoder, CreateNewFrame, WritePixels 🗂️Win API: VirtualProtect, RtlAddVectoredExceptionHandler, RtlRemoveVectoredExceptionHandler, ShellExecuteW, DeleteFileW, NtQuerySystemInformation, TerminateProcess, reateCompatibleDC →, ateDIBSection → Bi, t → WICI, ... 📜Programming Languages: powershell, javascript 💻Platforms: x64 #threatreport: Threat actors are abusing FTP server banners as dead drop resolvers (DDRs), embedding commands in the initial response from port 21 services. Malicious LNK files observed in phishing campaigns retrieve and execute these commands, although the technique could also support other delivery methods. Investigation identified two separate clusters deploying previously undocumented RATs, E4del and PINHOLE; available evidence is insufficient to attribute either cluster to a specific actor. E4del is a Node.js/Electron RAT delivered through a modified Discord package. A staged FTP chain launches PowerShell, downloads a ZIP archive, and executes a Discord binary whose bundled Electron resources and `app.asar` logic have been replaced with malicious code. E4del requires an `-init` argument containing the victim’s username and terminates if it does not match, providing an anti-analysis check. It runs headlessly with Chromium switches such as `--headless`, establishes persistence through Electron login-item settings, fingerprints the host using MAC addresses and CPU data, and queries WMI or the registry for installed antivirus products. Its C2 uses AES-256-CBC-encrypted HTTP POST requests, a hardcoded key, browser-like headers, and a tiered beaconing system that transitions among active, semi-active, and inactive states based on task inactivity. PINHOLE uses a more complex multi-stage chain initiated through an FTP banner. PowerShell retrieves a script, which writes Base64 data disguised as a certificate, decodes it with `certutil`, extracts it with `expand`, and executes the resulting binary before deleting temporary files. The loader uses string and API obfuscation, PEB-based export resolution, anti-emulation checks, and Halo’s Gate direct system calls. It stores configuration in NTFS Alternate Data Streams and encrypts encoded DDR URLs using a custom base-41 scheme and a SplitMix64-derived keystream. PINHOLE resolves its C2 through Pinterest pins and SurveyMonkey content, then proxies communications through Cloudflare Workers. It retrieves additional payloads from health-check and download endpoints, disguises responses as JPEG data, uses shellcode fluctuation to keep most memory encrypted, and decrypts a Donut configuration protected with Chaskey-CTR. The final stage is injected into `ApplicationFrameHost.exe` using Early Bird APC Injection. PINHOLE supports commands for reconnaissance, browser credential theft, file upload and download, command execution, screenshots, and interactive shell access.
rst_cloud's tweet photo. #threatreport #HighCompleteness FTP Banners: The New Dead Drop Resolver Delivering Novel RATs | 22-08-2026 Source: https://t.co/gMoA5yjIpA Key details below ↓ 💀Threats: Dead_drop_technique, Clickfix_technique, E4del, Pinhole, Apc_injection_technique, Smuggling_technique, Hellsgate_technique, Donut, Spear-phishing_technique, Process_injection_technique, 🏭Industry: Healthcare 🌐Geo: Spanish 📚TTPs: ⚔️Tactics: 9 🛠️Technics: 34 🧨IOCs: - File: 19 - IP: 12 - Url: 8 - Path: 2 - Domain: 2 - Hash: 7 💽Software: Discord, Chromium, Node.js, Electron, Windows Defender, Google Chrome, curl, Windows Imaging Component 🔢Algorithms: xor, base64, aes-256-cbc, chaskey, exhibit, sha256, zip, prng 🔠Functions: setLoginItemSettings, CreateCompatibleDC, CreateDIBSection, CreateStreamOnHGlobal, InitializeFromIStream, CreateEncoder, CreateNewFrame, WritePixels 🗂️Win API: VirtualProtect, RtlAddVectoredExceptionHandler, RtlRemoveVectoredExceptionHandler, ShellExecuteW, DeleteFileW, NtQuerySystemInformation, TerminateProcess, reateCompatibleDC →, ateDIBSection → Bi, t → WICI, ... 📜Programming Languages: powershell, javascript 💻Platforms: x64 #threatreport: Threat actors are abusing FTP server banners as dead drop resolvers (DDRs), embedding commands in the initial response from port 21 services. Malicious LNK files observed in phishing campaigns retrieve and execute these commands, although the technique could also support other delivery methods. Investigation identified two separate clusters deploying previously undocumented RATs, E4del and PINHOLE; available evidence is insufficient to attribute either cluster to a specific actor. E4del is a Node.js/Electron RAT delivered through a modified Discord package. A staged FTP chain launches PowerShell, downloads a ZIP archive, and executes a Discord binary whose bundled Electron resources and `app.asar` logic have been replaced with malicious code. E4del requires an `-init` argument containing the victim’s username and terminates if it does not match, providing an anti-analysis check. It runs headlessly with Chromium switches such as `--headless`, establishes persistence through Electron login-item settings, fingerprints the host using MAC addresses and CPU data, and queries WMI or the registry for installed antivirus products. Its C2 uses AES-256-CBC-encrypted HTTP POST requests, a hardcoded key, browser-like headers, and a tiered beaconing system that transitions among active, semi-active, and inactive states based on task inactivity. PINHOLE uses a more complex multi-stage chain initiated through an FTP banner. PowerShell retrieves a script, which writes Base64 data disguised as a certificate, decodes it with `certutil`, extracts it with `expand`, and executes the resulting binary before deleting temporary files. The loader uses string and API obfuscation, PEB-based export resolution, anti-emulation checks, and Halo’s Gate direct system calls. It stores configuration in NTFS Alternate Data Streams and encrypts encoded DDR URLs using a custom base-41 scheme and a SplitMix64-derived keystream. PINHOLE resolves its C2 through Pinterest pins and SurveyMonkey content, then proxies communications through Cloudflare Workers. It retrieves additional payloads from health-check and download endpoints, disguises responses as JPEG data, uses shellcode fluctuation to keep most memory encrypted, and decrypts a Donut configuration protected with Chaskey-CTR. The final stage is injected into `ApplicationFrameHost.exe` using Early Bird APC Injection. PINHOLE supports commands for reconnaissance, browser credential theft, file upload and download, command execution, screenshots, and interactive shell access.
0
0
0
0
93
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack | 20-08-2026 Source: https://t.co/GcpQ7sruje Key details below ↓ 🧑‍💻Actors/Campaigns: Bluenoroff 💀Threats: Supply_chain_technique, Typosquatting_technique, Launchagents_tool, 🎯Victims: Rust ecosystem, Software developers 🌐Geo: Dprk 📚TTPs: ⚔️Tactics: 3 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027, T1036.005, T1059.001, T1059.004, T1059.005, T1071.001, T1082, T1105, T1195.001, T1480, ... 🧨IOCs: - Url: 1 - IP: 3 - Hash: 2 💽Software: arrayref, Linux, macOS, Unix, Windows PowerShell, Chromium, Google Chrome, Microsoft Edge, Mastra 🔢Algorithms: base64, sha256 📜Programming Languages: powershell, rust 💻Platforms: apple, intel #threatreport: On August 20, the Rust crates `append-only-vec`, `arrayref`, and `internment` were compromised after their maintainer accounts or release process were used to add a malicious dependency named `proc-macro1`. The affected crates had approximately 4 million, 244 million, and 14 million downloads respectively. `proc-macro1` is a typosquat of the legitimate `proc-macro2` crate and imitates its metadata, author information, and documentation. A related package, `proc-macro-en`, also impersonated the legitimate maintainer. The malicious code is contained in `proc-macro1`’s `https://t.co/vhKYKeThox` file, which Cargo automatically compiles and executes during builds. It conceals its download destination using Base64-encoded fragments, selects a payload based on the host operating system and architecture, and retrieves it over HTTPS. On Linux and macOS, the payload is written to disk, marked executable, and launched as a detached process with output suppressed. On Windows, it writes a PowerShell script and uses hidden `wscript` and VBScript launchers to allow the process to survive after the Cargo build ends. Therefore, compiling a project that depends on any compromised crate can trigger the infection without invoking the crate’s functionality. Recovered Linux x86_64 and macOS ARM64 payloads are Rust-based infostealers. They accept the command-and-control address as a launch argument rather than embedding it directly. The dropper supplies `23.254.165.112:443`, and the malware communicates with `https://{host}/49890878`. On macOS, it targets credentials stored in Chromium-based browsers, including Chrome, Brave, and Edge, using embedded SQL queries against browser login databases. It also contains a LaunchAgent template configured with `RunAtLoad`, indicating user-level persistence through `~/Library/LaunchAgents`. The malware registers infected systems with host and platform details, including operating system, architecture, version, application, and email fields. Its command dispatcher supports configuration, startup, script execution, shell execution, and timed waiting, indicating periodic C2 polling and remote command execution. The campaign shares infrastructure, beaconing, and dependency-injection techniques observed in previous npm compromises, and may be associated with the same DPRK-linked threat activity.
rst_cloud's tweet photo. #threatreport #HighCompleteness Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack | 20-08-2026 Source: https://t.co/GcpQ7sruje Key details below ↓ 🧑‍💻Actors/Campaigns: Bluenoroff 💀Threats: Supply_chain_technique, Typosquatting_technique, Launchagents_tool, 🎯Victims: Rust ecosystem, Software developers 🌐Geo: Dprk 📚TTPs: ⚔️Tactics: 3 🛠️Technics: 0 🤖LLM extracted TTPs:` T1027, T1036.005, T1059.001, T1059.004, T1059.005, T1071.001, T1082, T1105, T1195.001, T1480, ... 🧨IOCs: - Url: 1 - IP: 3 - Hash: 2 💽Software: arrayref, Linux, macOS, Unix, Windows PowerShell, Chromium, Google Chrome, Microsoft Edge, Mastra 🔢Algorithms: base64, sha256 📜Programming Languages: powershell, rust 💻Platforms: apple, intel #threatreport: On August 20, the Rust crates `append-only-vec`, `arrayref`, and `internment` were compromised after their maintainer accounts or release process were used to add a malicious dependency named `proc-macro1`. The affected crates had approximately 4 million, 244 million, and 14 million downloads respectively. `proc-macro1` is a typosquat of the legitimate `proc-macro2` crate and imitates its metadata, author information, and documentation. A related package, `proc-macro-en`, also impersonated the legitimate maintainer. The malicious code is contained in `proc-macro1`’s `https://t.co/vhKYKeThox` file, which Cargo automatically compiles and executes during builds. It conceals its download destination using Base64-encoded fragments, selects a payload based on the host operating system and architecture, and retrieves it over HTTPS. On Linux and macOS, the payload is written to disk, marked executable, and launched as a detached process with output suppressed. On Windows, it writes a PowerShell script and uses hidden `wscript` and VBScript launchers to allow the process to survive after the Cargo build ends. Therefore, compiling a project that depends on any compromised crate can trigger the infection without invoking the crate’s functionality. Recovered Linux x86_64 and macOS ARM64 payloads are Rust-based infostealers. They accept the command-and-control address as a launch argument rather than embedding it directly. The dropper supplies `23.254.165.112:443`, and the malware communicates with `https://{host}/49890878`. On macOS, it targets credentials stored in Chromium-based browsers, including Chrome, Brave, and Edge, using embedded SQL queries against browser login databases. It also contains a LaunchAgent template configured with `RunAtLoad`, indicating user-level persistence through `~/Library/LaunchAgents`. The malware registers infected systems with host and platform details, including operating system, architecture, version, application, and email fields. Its command dispatcher supports configuration, startup, script execution, shell execution, and timed waiting, indicating periodic C2 polling and remote command execution. The campaign shares infrastructure, beaconing, and dependency-injection techniques observed in previous npm compromises, and may be associated with the same DPRK-linked threat activity.
0
2
0
0
172
rst_cloud's profile image
RST Cloud Verified account @rst_cloud
#threatreport #HighCompleteness Shadow HVNC and Shadow Loader: The Kit That Protects Its License Better Than Its Customers | 18-08-2026 Source: https://t.co/cCvFekdcca Key details below ↓ 🧑‍💻Actors/Campaigns: Remotex 💀Threats: Hvnc_tool, Remotex, Wevtutil_tool, Mimikatz_tool, Pypykatz_tool, Uac_bypass_technique, Chromelevator_tool, Anydesk_tool, Teamviewer_tool, Mremoteng_tool, Putty_tool, Chromeelevator_tool, Fodhelper_uac_bypass_technique, Purerat, Native_loader, 🎯Victims: Facebook business page administrators, Banking customers, Cryptocurrency users, Gaming users 🏭Industry: Financial, Entertainment 🌐Geo: Spain, Japan, Hong kong, Africa, Canada, South korea, Latam, Middle east, South africa, Denmark, Italy, China, Korea, Russia, Vietnamese, American, India, Italian, Korean, Asia 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 0 🧨IOCs: - File: 136 - Path: 12 - Command: 13 - Coin: 5 - Registry: 10 - Url: 2 - Hash: 3 💽Software: Chrome, Telegram, Steam, Discord, Windows DNS, Windows kernel, Windows service, Winlogon, Windows Defender, Microsoft Windows Defender, ... 🔢Algorithms: base64, aes, aes-gcm, md5, chacha20, zip, aes-256-gcm, sha256, ed25519, sha1, aes-256-cbc 🔠Functions: CreateService, setDPIAware, getCountryCode, Windows, GetModuleHandle, getAllWindowTitles, HTTPS, Get-MpThreatDetection, CreateDesktop 🗂️Win API: CreateMutexW, Join, MkdirAll, Base, SetProcessDPIAware, GetCurrentThreadId, GetThreadDesktop, SetThreadDesktop, CreateProcess, ShowWindow, ... 📜Programming Languages: rust, powershell YARA: Found #threatreport: Shadow HVNC is a Go-based stealer and hidden virtual network computing (HVNC) RAT of approximately 16 MB. It provides operators with browser session control, cookie injection, keylogging, file and process management, terminal access, screenshots, webcam capture, clipboard monitoring, SOCKS5 and reverse-proxy tunneling, and remote execution. Its hidden desktop, `RemoteXHidden`, allows browsers, PowerShell, command shells, and other applications to run outside the victim’s visible session. The malware can also fall back to controlling the real desktop by blocking input and powering off the monitor. The payload establishes a persistent WebSocket connection, sends host reconnaissance, and retries continuously with increasing delays. A secondary WebSocket handles hidden-browser screen streaming and input. HTTP POST endpoints are used for harvested data after the WebSocket handshake succeeds. Collected information includes Chromium and Gecko browser credentials, cookies, tokens, cryptocurrency wallets, Telegram, Discord and Steam data, VPN and SSH configurations, cloud credentials, password-manager data, Windows Vault entries, Wi-Fi profiles, and environment variables. Stolen cookies remain queued in memory and can be injected into a hidden Chrome instance through Chrome DevTools Protocol using `Network.setCookies`, enabling reuse of authenticated sessions. Shadow HVNC performs extensive reconnaissance, including hardware, network, locale, elevation, active sessions, installed software, processes, RDP logs, screenshots, autologon credentials, GPP passwords, and domain information. It includes an LSASS dumping component, `lss.exe`, that locates LSASS using hashed process names, resolves system calls dynamically, uses Halo’s Gate-style syscall recovery, reads LSASS memory directly, and creates a valid minidump without `dbghelp.dll`. The dump is staged for later credential extraction. Persistence includes services, Run keys, Winlogon logon scripts, Startup-folder shortcuts, scheduled tasks, Active Setup, PowerShell profile modification, WMI event subscriptions, and watchdog processes. The malware attempts Defender exclusion changes and includes UAC bypasses using `fodhelper`, `computerdefaults`, SilentCleanup, and CMSTPLUA. It geofences victims in several Russian and CIS countries plus South Africa. Browser databases are copied as `.rxcopy` files, and browser profiles are staged under `%LOCALAPPDATA%\RemoteX Profiles`. The related Shadow HVNC Loader is a Rust agent using `%LOCALAPPDATA%\Bridge` artifacts. It communicates through `/api/agent/connect`, HTTPS polling, enrollment, and certificate-recovery endpoints, with pinned TLS. It downloads and SHA-256-verifies payloads, extracts applications with `tar.exe`, supervises processes through Job Objects, and provides terminal, screen-sharing, private-desktop, and managed-application capabilities. A Vietnamese operator reportedly used the loader in localized malspam campaigns targeting Facebook business-page administrators.
rst_cloud's tweet photo. #threatreport #HighCompleteness Shadow HVNC and Shadow Loader: The Kit That Protects Its License Better Than Its Customers | 18-08-2026 Source: https://t.co/cCvFekdcca Key details below ↓ 🧑‍💻Actors/Campaigns: Remotex 💀Threats: Hvnc_tool, Remotex, Wevtutil_tool, Mimikatz_tool, Pypykatz_tool, Uac_bypass_technique, Chromelevator_tool, Anydesk_tool, Teamviewer_tool, Mremoteng_tool, Putty_tool, Chromeelevator_tool, Fodhelper_uac_bypass_technique, Purerat, Native_loader, 🎯Victims: Facebook business page administrators, Banking customers, Cryptocurrency users, Gaming users 🏭Industry: Financial, Entertainment 🌐Geo: Spain, Japan, Hong kong, Africa, Canada, South korea, Latam, Middle east, South africa, Denmark, Italy, China, Korea, Russia, Vietnamese, American, India, Italian, Korean, Asia 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 0 🧨IOCs: - File: 136 - Path: 12 - Command: 13 - Coin: 5 - Registry: 10 - Url: 2 - Hash: 3 💽Software: Chrome, Telegram, Steam, Discord, Windows DNS, Windows kernel, Windows service, Winlogon, Windows Defender, Microsoft Windows Defender, ... 🔢Algorithms: base64, aes, aes-gcm, md5, chacha20, zip, aes-256-gcm, sha256, ed25519, sha1, aes-256-cbc 🔠Functions: CreateService, setDPIAware, getCountryCode, Windows, GetModuleHandle, getAllWindowTitles, HTTPS, Get-MpThreatDetection, CreateDesktop 🗂️Win API: CreateMutexW, Join, MkdirAll, Base, SetProcessDPIAware, GetCurrentThreadId, GetThreadDesktop, SetThreadDesktop, CreateProcess, ShowWindow, ... 📜Programming Languages: rust, powershell YARA: Found #threatreport: Shadow HVNC is a Go-based stealer and hidden virtual network computing (HVNC) RAT of approximately 16 MB. It provides operators with browser session control, cookie injection, keylogging, file and process management, terminal access, screenshots, webcam capture, clipboard monitoring, SOCKS5 and reverse-proxy tunneling, and remote execution. Its hidden desktop, `RemoteXHidden`, allows browsers, PowerShell, command shells, and other applications to run outside the victim’s visible session. The malware can also fall back to controlling the real desktop by blocking input and powering off the monitor. The payload establishes a persistent WebSocket connection, sends host reconnaissance, and retries continuously with increasing delays. A secondary WebSocket handles hidden-browser screen streaming and input. HTTP POST endpoints are used for harvested data after the WebSocket handshake succeeds. Collected information includes Chromium and Gecko browser credentials, cookies, tokens, cryptocurrency wallets, Telegram, Discord and Steam data, VPN and SSH configurations, cloud credentials, password-manager data, Windows Vault entries, Wi-Fi profiles, and environment variables. Stolen cookies remain queued in memory and can be injected into a hidden Chrome instance through Chrome DevTools Protocol using `Network.setCookies`, enabling reuse of authenticated sessions. Shadow HVNC performs extensive reconnaissance, including hardware, network, locale, elevation, active sessions, installed software, processes, RDP logs, screenshots, autologon credentials, GPP passwords, and domain information. It includes an LSASS dumping component, `lss.exe`, that locates LSASS using hashed process names, resolves system calls dynamically, uses Halo’s Gate-style syscall recovery, reads LSASS memory directly, and creates a valid minidump without `dbghelp.dll`. The dump is staged for later credential extraction. Persistence includes services, Run keys, Winlogon logon scripts, Startup-folder shortcuts, scheduled tasks, Active Setup, PowerShell profile modification, WMI event subscriptions, and watchdog processes. The malware attempts Defender exclusion changes and includes UAC bypasses using `fodhelper`, `computerdefaults`, SilentCleanup, and CMSTPLUA. It geofences victims in several Russian and CIS countries plus South Africa. Browser databases are copied as `.rxcopy` files, and browser profiles are staged under `%LOCALAPPDATA%\RemoteX Profiles`. The related Shadow HVNC Loader is a Rust agent using `%LOCALAPPDATA%\Bridge` artifacts. It communicates through `/api/agent/connect`, HTTPS polling, enrollment, and certificate-recovery endpoints, with pinned TLS. It downloads and SHA-256-verifies payloads, extracts applications with `tar.exe`, supervises processes through Job Objects, and provides terminal, screen-sharing, private-desktop, and managed-application capabilities. A Vietnamese operator reportedly used the loader in localized malspam campaigns targeting Facebook business-page administrators.
0
1
0
0
244

Last Seen Hashtags on Sotwe

เย็ดนม
Seen from Thailand
bopper
Seen from France
InformedCitizens
Seen from United States
Vibraba
Seen from United States
ทรงอิทธิพล
Seen from Argentina
TEENAGER filter:videos
nakal
Seen from Indonesia
MonkeyApp()
女奴
Seen from Japan
momsonn
Seen from Norway

Trends for you

1
Peter Cullen
Under 10K tweets
2
Boosie
Under 10K tweets
3
Till All Are One
Under 10K tweets
4
Tropical Storm Dolly
Under 10K tweets
5
Amish
Under 10K tweets
6
Hinges
Under 10K tweets
7
Grim Reaper
Under 10K tweets
8
$CHUMP
Under 10K tweets
9
Frank Welker
Under 10K tweets
10
Bovino
Under 10K tweets

Most Popular Users

elonmusk's profile image
1
Elon Musk Verified account
@elonmusk
241.5M followers
barackobama's profile image
2
Barack Obama Verified account
@barackobama
119M followers
cristiano's profile image
3
Cristiano Ronaldo Verified account
@cristiano
113.8M followers
realdonaldtrump's profile image
4
Donald J. Trump Verified account
@realdonaldtrump
111.8M followers
narendramodi's profile image
5
Narendra Modi Verified account
@narendramodi
107.2M followers
rihanna's profile image
6
Rihanna Verified account
@rihanna
98.6M followers
nasa's profile image
7
NASA Verified account
@nasa
92.4M followers
justinbieber's profile image
8
Justin Bieber Verified account
@justinbieber
91.7M followers
katyperry's profile image
9
KATY PERRY Verified account
@katyperry
89.6M followers
taylorswift13's profile image
10
Taylor Swift Verified account
@taylorswift13
83.6M followers
ladygaga's profile image
11
Lady Gaga Verified account
@ladygaga
75M followers
imvkohli's profile image
12
Virat Kohli Verified account
@imvkohli
72.8M followers
kimkardashian's profile image
13
Kim Kardashian Verified account
@kimkardashian
70.7M followers
youtube's profile image
14
YouTube Verified account
@youtube
68.8M followers
neymarjr's profile image
15
Neymar Jr Verified account
@neymarjr
65.8M followers
billgates's profile image
16
Bill Gates Verified account
@billgates
64.9M followers
selenagomez's profile image
17
Selena Gomez Verified account
@selenagomez
62.7M followers
theellenshow's profile image
18
The Ellen Show
@theellenshow
62.3M followers
cnn's profile image
19
CNN Verified account
@cnn
61.8M followers
x's profile image
20
X Verified account
@x
60.7M followers