Nextron Research ⚡️

Nextron threat research team.
Signatures, rules, and analysis focused on eliminating blind spots.

[Nextron Research ⚡️ @nextronresearch]

114,000 OSS artifacts per day. Around 4,618 reach LLM triage. Roughly 100 reach an analyst.

In our latest blog post, @marius_benthin explains how we combine THOR Thunderstorm with LLM triage to monitor ten package registries and extension marketplaces without sending the complete feed to a model.

- THOR Thunderstorm ⚡️ scans the full feed using deterministic detection logic
- Only artifacts with THOR findings enter LLM triage 🤖
- The initial LLM stage costs an average of $2.88 per day
- Suspicious or inconclusive cases reach an analyst
- RuneAI is available on demand for deeper analysis of selected files

The article covers the architecture, operating numbers, limitations and a real malicious VS Code extension detected by the pipeline.

https://t.co/vdsPTskj2Z

[Florian Roth ⚡️ @cyb3rops]

Our OSS artifact scanning picked this up too

The funny part, at least for us, is that this is a side project built around the scanner and detection rules we already ship for endpoints. Its initial LLM triage costs about $3 a day.

We download packages from public registries, unpack them, and run their files through THOR Thunderstorm. The generic detection rules flag suspicious code, obfuscation and recurring attacker tradecraft. Only artifacts with findings reach the LLM, which gets the matched strings and surrounding context to assess what’s going on.

Across roughly 114,000 artifacts a day, about 4% reach that initial LLM pass. The rest never generate a token bill.

In this case, an existing generic Python rule flagged the malicious https://t.co/3A11Y4XWdW. We already had the detection logic; we’re just applying it to packages downloaded from registries as well as files found on endpoints.

And that’s what amuses me about this. Supply-chain security attracts substantial funding, and specialist vendors are reporting this compromise. We picked it up by reusing years of endpoint detection engineering in an internal project, with an initial LLM triage bill averaging $2.88/day.

Pretty useful bycatch.

We described the pipeline here:
https://t.co/bBDiBnUVti

[Nextron Research ⚡️ @nextronresearch]

We’ve been checking our PHP2SHELL detection coverage at Nextron and extending the rule set based on the published PoCs

After successful exploitation, we expect familiar activity: webshell drops, reverse shells, suspicious child processes, new user accounts… Our generic detection rules have covered many of these patterns for years, so useful coverage was already in place before disclosure.

The blog documents that existing coverage and the additions, explains what the findings can actually tell you, and includes PHP hardening recommendations.

https://t.co/DYfcrj4lh6

[Nextron Research ⚡️ @nextronresearch]

#Kimsuky (APT-C-55) is delivering persistent backdoors through multilingual LNK phishing lures

After reading the 360 Threat Intelligence Center's report on APT-C-55's multi-path delivery campaign, we found a cluster of nine related malicious LNK files submitted between September and October 2026, with detection ratios around 10-30 out of 60+ engines.

The LNK files execute a layered attack chain: base64-encoded batch scripts decoded via a renamed copy of certutil.exe, staging in C:\Users\Public, nircmd disguised as ntoskrnl.exe, and scheduled tasks running every 9 minutes for persistence. A parallel variant uses PowerShell with double hex-encoded payloads, and a third path poisons the open-source pybroker Python library as a supply chain attack.

Analysis & IOCs: https://t.co/QbhNDXUZvD

[Nextron Research ⚡️ @nextronresearch]

A reminder of how cool THOR Thunderstorm and its collectors are ⚡

Some systems will never run a security agent: ESXi hosts, network appliances, routers, industrial and out-of-support systems. They are still part of your attack surface.

The trick: don't bring the scanner to the machine. Bring the machine's files to the scanner.

- A collector (one Go binary, or one script in Bash, POSIX sh, Python, Perl, PowerShell or Batch) copies selected files to your own THOR Thunderstorm. The originals stay where they are.
- You decide what leaves: recent files, a size limit, selected types. Preview it with a dry run first.
- THOR does the heavy lifting on your server: YARA rules, your own signatures, IOCs, Sigma rules and forensic parsers.
- Findings land in a log, in syslog or in your SIEM. Run it every night with cron or Ansible and ship only what changed.

No agent. Often a shell and a network connection are enough.

93 seconds, no sound, video below
(The findings in the film are illustrative)

Collectors:
https://t.co/WPEqXAlZF0
The written version: https://t.co/T1ruHIRw4U

#DFIR #ThreatHunting #IncidentResponse #YARA #Sigma

[Nextron Research ⚡️ @nextronresearch]

#APT28 is using weaponized Office documents to deliver the Covenant Grunt backdoor.

We detected a cluster of seven malicious .docm and .xls files between July 8 and July 14, with some having AV detection ratios as low as 5/62 at the time of first submission. Our THOR APT Scanner's YARA rules caught what traditional engines missed.

The documents use obfuscated VBA macros that assemble strings at runtime to evade static analysis, perform XOR-encoded host reconnaissance, and drop a 64-bit Covenant Grunt loader DLL disguised as a log file. The campaign uses Russian-language lures like "Прайс.xls" (Price List) and business-themed filenames like "accounts.xls", consistent with APT28 targeting patterns. Network analysis shows Dropbox being used as C2 infrastructure.

This activity aligns with Zscaler's reporting on Operation NeuSploit (CVE-2026-21509).

Analysis & IOCs: https://t.co/ALVVYK2ZZb

[Nextron Research ⚡️ @nextronresearch]

Our research team identified a second downloader variant linked to the WebSockets backdoor campaign recently analyzed by @dmpdump.

While the original downloader was written in native C++, this new variant uses C# (.NET 8).

Same seven payload files, same NVIDIA-themed disguise, but a very different implementation: no obfuscation, plaintext strings, and extensive retry logic designed to handle hours of unreliable connectivity.

An interesting detail: it ships as a 14 MB self-contained .NET single-file executable. Open it in IDA and you'll mainly see the native .NET runtime host rather than the actual downloader logic.

We've developed three new YARA detection rules covering both downloader variants and the WebSockets backdoor, and added them to our THOR scanners.

You can explore the rules' matches on VirusTotal through our Valhalla pages:

https://t.co/V0r21KOeA2
https://t.co/SwYLEa0ZhD
https://t.co/3U5LyM78rR

Full technical analysis, decompiled source and IOCs:
https://t.co/6DEEwCcAYS

[Nextron Research ⚡️ @nextronresearch]

An Iranian threat actor is still running a GitHub-based loader with low detection rate on VirusTotal, six weeks after first submission.

We went hunting after reading Unit 42's Blinder Tunnel report and found a new variant with infrastructure changes not covered in prior reporting: a Cloudflare Workers relay, a new GitHub account, and credential-rotation instructions hidden inside HTML comments on Microsoft/vscode issues, encrypted per-victim so only the targeted host can read them.

The loader was delivered via an Inno Setup installer themed as a Dubai Airport careers IT assessment, targeting Iraq.

Technical analysis + decompiled source + IOCs:
https://t.co/Waj9rI8YBL

[Nextron Research ⚡️ @nextronresearch]

Seven national blue teams used THOR APT Scanner at Locked Shields 2026, the world’s largest live-fire cyber defence exercise.

We didn’t ask for flowers. We asked how it held up, and what would make their life easier.

Their strongest ask: easier integration with LLM-assisted analysis. Which is exactly where THOR v11 will shine (stay tuned!).

Read the full feedback here:
https://t.co/6hKQHgnCor

#LockedShields @NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE)

[Nextron Research ⚡️ @nextronresearch]

We’ve continued working on the recent Citrix #NetScaler exploitation around CVE-2026-88771 and CVE-2026-88772 and significantly expanded the THOR detection coverage.

We���re now at 21 new rules covering different parts of the exploitation and post-exploitation activity.

New coverage includes:
- CVE-2026-88771 exploitation and encoded variants
- NetScaler webshell droppers and encoded webshell payloads
- Perl bind shells and suspicious Perl execution
- hidden payload downloads
- suspicious chmod operations on /bin/sh
- EPA bypass and authentication policy manipulation
- creation of privileged users
- Platypus C2 agents and bootstrap scripts
- SLAPSHOT / WHIPSHOT related artifacts
- NetScaler persistence and C2-header based webshell indicators
- CVE-2026-88772 PoC artifacts

This comes on top of the generic THOR rules that already detected many of the recovered artifacts before we had campaign-specific signatures. As new samples, reports and information from partners and customers become available, we keep adding more precise coverage.

For scanning NetScaler appliances, there are two practical approaches: SSHFS + THOR for ad-hoc incident response and THOR Thunderstorm collectors for recurring compromise assessments. The infographic below shows the difference.

If you scanned your NetScaler systems a few days ago, update your signatures and scan again. The coverage today is considerably broader than it was immediately after disclosure.

https://t.co/tzGrePicrz

[Florian Roth ⚡️ @cyb3rops]

We examined artifacts left behind by attackers during the recent Citrix #NetScaler compromises. Many were already covered by existing generic THOR rules, including rules we've shipped for years.

One script matched SUSP_Linux_Downloader_Jul20_1. That rule dates back to 2020, more than six years ago(!). The script also matched SUSP_Bash_Jul26.

The recovered webshells matched these existing generic rules:

- SUSP_WEBSHELL_PHP_Encoded_Jun21_1
- SUSP_Eval_Base64_Indicators_Feb22_1
- EXT_WEBSHELL_PHP_Generic_Eval
- EXT_WEBSHELL_PHP_OBFUSC_3
- EXT_WEBSHELL_PHP_Generic
- EXT_WEBSHELL_PHP_Gzinflated
- EXT_WEBSHELL_PHP_Dynamic_Big

Some of those webshell rules are in THOR Lite, too (EXT_*)

This is POST-EXPLOITATION DETECTION. We didn't need to know which zero-day got the attacker in to recognize what they left behind.

A scan could have flagged these artifacts from day one, before the exploited vulnerabilities were public. The rules were already there.
Scan your edge devices regularly. Daily, where practical. Use THOR via SSHFS or scheduled file collection for THOR Thunderstorm.

Don't wait for the next advisory to start looking

Why THOR detects what others miss
https://t.co/EbtVt3al8E

[Nextron Research ⚡️ @nextronresearch]

Our THOR Thunderstorm-based artifact scanning pipeline detected a malicious, newly published npm package: dotenv-async v1.0.0.

Presented as an environment-configuration toolkit, it contains a Windows downloader that executes at import time and is concealed in JPEG metadata.
Because environment-configuration packages are typically loaded during application startup, simply importing the package is enough to trigger the malicious chain.

The downloaded winhost.exe is an unsigned NSIS installer that deploys an obfuscated Electron infostealer. It targets browser passwords, cookies, and payment data, Discord and Telegram sessions, documents, and cryptocurrency wallets and seed phrases.

The malware establishes persistence as:
%LOCALAPPDATA%\Microsoft\Windows\0\svchost.exe

It also connects to a WebSocket gateway that provides an interactive CMD/PowerShell backdoor. Additional payloads are retrieved on demand:

/browser: encrypted shellcode injected into dllhost.exe to extract browser credentials and cookies (browser.h)
/update: a PowerShell loader that retrieves /jack, a native clipboard hijacker exporting StartClipjack, RunClipjackLoop, and StopClipjack.

Collected data is staged in %TEMP%, compressed, uploaded to a separate TryCloudflare endpoint, and then deleted.

We confirmed this multistage behavior in the analyzed artifacts. We are not attributing this activity to a specific actor, nor are we claiming that a legitimate maintainer was compromised.

Domains:
hardwood-studio-obviously-briefing[.]trycloudflare[.]com
manufacturers-arrested-acre-foods[.]trycloudflare[.]com
campus-petite-timothy-gulf[.]trycloudflare[.]com

SHA-256:
2a001e4ef9933701b3d93e1a7e1e7ef67d481fac5febc96f951beabe68022322 (winhost.exe)
196f6b820aaf094b8728a11699e4e91cea464623ab0c3acebdde3d1adab59fb6 (embedded Electron executable)
79121c5d9ddfafd532c30b9c20644b9a45fadadee9163eb2e5678e4efceb4312 (browser.h shellcode)
4a439412a37048f7c4e18c5a6b6763258e6358aa77693802dccc9d9d506ebc44 (ret.ps1 Clipjack PowerShell loader)

[Nextron Research ⚡️ @nextronresearch]

Our THOR Thunderstorm-based artifact scanning pipeline detected a new malicious PyPI package called "beautifyText" with no detections on VT. It contains a cross-platform backdoor and claims to provide harmless text-formatting utilities for terminals, logs, and CLI output.

Installing and importing the package appears routine, but beautifyText/__init__.py silently loads _compat.py. That module launches a detached process and connects to an obfuscated command-and-control server. Moreover, it registers the host, reports system and user information, polls for tasks, executes arbitrary shell commands, reads files for exfiltration, and writes attacker-supplied files.

C2: bleodw[.]wisp[.]uno
PyPI: https://t.co/wxGY1eSDkt

https://t.co/p6fbCPTJ5v

[Nextron Research ⚡️ @nextronresearch]

For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems.

The new THOR Preview signature set currently includes:

- EXPL_CVE_2026_88772_POC_Sep26
Detects artifacts related to the public CVE-2026-88772 PoC

- LOG_SUSP_EXPL_CVE_2026_88771_Sep26
Detects potential CVE-2026-88771 exploitation traces in NetScaler logs

- WEBSHELL_CSS_PassThrough_Sep26
Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise

We also released a new IOC set:
- NetScaler ADC suspicious file artifacts

It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories.

The Preview signatures are already available with:

./thor-util update --sigdev

We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers.

Details:
https://t.co/3JZKTSWgXG

And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:
https://t.co/Q4NWOZxAWL

[Nextron Research ⚡️ @nextronresearch]

More npm packages from this campaign, using the same install script:

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

[Oliver Smith @oliver_ojsec]

Another new worm attempt - new NPM packages react-nodejs and express-javascript contain a postinstall script that sources simple payloads from codeberg that attempt to self-proliferate through NPM and AUR packages. Simple and unlikely to spread based on current foothold but another indication that some threat actors are still chasing Shai-Hulud's tail

https://t.co/ntu57xVRT6

[Nextron Research ⚡️ @nextronresearch]

We found a Ukraine-targeted campaign using two very different lures: an “air raid alert” document aimed broadly at Ukrainian users, and a military-specific unit property inventory.

Both lead to a Telegram-controlled VBScript RAT capable of credential theft, screenshots, command execution and targeted file collection.

The second lure pushes the campaign back to at least 26 August 2026. What stands out is the collection focus: CAD, BIM, GIS, LiDAR and weather-model data, combined with per-host tasking and date-based file harvesting.

Full technical analysis + IOCs:
https://t.co/YVqFy7PXTX

[Nextron Research ⚡️ @nextronresearch]

@MemOS_dev GitHub Security Advisory: https://t.co/eKp1I4ENIl

[Nextron Research ⚡️ @nextronresearch]

🚨 Supply-chain alert affecting PyPI and npm packages from the MemOS project @MemOS_dev.

Detected by our THOR Thunderstorm-based artifact scanning pipeline:
- PyPI: [email protected]
- npm: [at]memtensor/[email protected]

Both packages contain hidden, platform-specific malicious Golang binaries in .sckit directory that are launched silently during normal use.
MemoryOS triggers the binary when logging initializes. The OpenClaw plugin launches it at gateway startup and while processing user prompts. The binaries receive the host environment. The npm variant also receives prompt text.
Embedded configurations specify home inventory, local runtime state, and communication with hard-coded remote endpoints. This creates potential exposure of developer credentials, tokens, configuration, and agent data.

We will provide more information as our investigation progresses.

Technical details and IOCs:
https://t.co/ZfXO23bYWT

[Nextron Research ⚡️ @nextronresearch]

Our THOR Thunderstorm-based artifact scanning pipeline identified a coordinated npm campaign hiding malicious behavior inside packages presented as runtime, process, layout, and image utilities.

When imported, the packages launch a hidden Node.js process that retrieves and executes code from the JSON storage "npoint". The payload collects system and network details, steals Chrome extension data, monitors the clipboard, and can activate a Windows keylogger.

IOCs:
api.npoint[.]io/24c25d5f5fcbb0992a4f
api.npoint[.]io/33e8d008c334b060adad
api.npoint[.]io/641d37178a880b1e8b8f
api.npoint[.]io/ddae72efbb6714fae922
api.npoint[.]io/37c0a0c68bf7a94ed731
103.170.217[.]184:8787

Packages:
[email protected]
[email protected]
[email protected]
[at]biz44/[email protected]
[at]vibecheck-polid/[email protected]
@biz44/[email protected]
[email protected]
[at]railone/[email protected]

[Nextron Research ⚡️ @nextronresearch]

We identified a Rust-based ELF RAT with no existing detection on VirusTotal.

The agent is configured entirely through command-line arguments rather than a static configuration blob.

Observed required flags include:

C2 connectivity: --callback, --beacon, --secret
Tunneling: --socks_port, --local_fwd, --remote_fwd
Persistence and monitoring: --watchdog_pid
Evasion: --jitter, --stealth

Key Capabilities:
- Command Execution: Implements remote shell capabilities
- Pivoting: Integrated SOCKS proxying and port forwarding logic.
- Credential Access: Targets zshrc, ssh/config, and Brave browser data
- Environmental Discovery: Reads hosts and services file, and resolv.conf for network mapping.

Use our THOR Scanner to detect the threat in your environment.

IOCs: https://t.co/GSq5l7FPtW