Offensive Lab

ReverseEngineer ⚔️
MalwareAnalyser🛡
Cybersecurity💻
Malware Researcher🔍

[Offensive Lab @OffensiveLab]

The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan.

The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation RapidRust.

"APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan," Sudeep Singh, senior manager of APT Research at Zscaler ThreatLabz, said in a technical report published this week.

The discovery comes a little over a month after Acronis Threat Research Unit (TRU) tied the long-running persistent threat group to another campaign aimed at Afghan telecom providers and South Asian critical infrastructure organizations using a backdoor called PATCHCORD.

Cybersecurity
A notable aspect of the campaign is the threat actor's use of private GitHub repositories for command-and-control (C2) and the registration of typosquatted domains impersonating popular Indian news organizations like The Print and India Today to host malicious PowerShell scripts and payloads -

theprints[.]org, which mimics The Print ("theprint[.]in")
indiatodays[.]org, which mimics India Today ("indiatoday[.]in")
Among the four newly identified malware families, one is a backdoor, another is a lateral movement utility, while the remaining two are file-stealing programs designed for Windows and Linux systems.

RUSTYSHADE, as the name implies, is a Rust-based backdoor that makes use of attacker-controlled private GitHub repositories for encrypted C2 communications. It shares some level of functionality overlap with GITSHELLPAD, a Golang implant that was observed in September 2025 in connection with a campaign known as Gopher Strike.

[Offensive Lab @OffensiveLab]

@BitcoinIntelX Done

[Offensive Lab @OffensiveLab]

Both flaws have been addressed as part of an out-of-band update for Windows 11, version 26H1 -

2026-09 Cumulative Update for Windows 11, version 26H1 for arm64-based Systems (KB5129194) (28000.2956)
2026-09 Cumulative Update for Windows 11, version 26H1 for x64-based Systems (KB5129194) (28000.2956)
The disclosure comes days after it patched a record 974 vulnerabilities spanning its software portfolio earlier last week. Two of those defects impacting Windows Advanced Local Procedure Call (ALPC) and the Windows Update Stack have come under active exploitation.

[Offensive Lab @OffensiveLab]

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.

"Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses an automated multi-stage infection pipeline," Zimperium researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega said.

"Once deployed, it pairs Accessibility abuse with autonomous local ADB (Android Debug Bridge) self-pairing to break out of the standard Android application sandbox, staging independent native daemons that execute with shell-level privileges."

Cybersecurity
RatHat is propagated via deceptive phishing sites promoted via malvertising, smishing campaigns, and third-party forums that trick unsuspecting users into installing malware-laced APKs. These packages function as a dropper to launch the main payload, while incorporating layers of anti-analysis and anti-debug checks to sidestep detection.

The four anti-analysis techniques baked into the malware are listed below -

Container tampering, which declares certain files as directories in the package or sets the ZIP general-purpose encryption bit flag on some files so that they are ignored by Android's libziparchive library but not by other tools like unzip and apktool.

Manifest bomb, which causes automated analysis pipelines to crash or time out by placing undocumented 0x9999 chunk headers in "AndroidManifest.xml" that's skipped by Android native runtime.

DEX bytecode poisoning, which includes pseudo-instructions configured with an invalid element_width attribute so as to cause the disassembly process to fail.

Dual string-encryption, which uses an encryption scheme called StringCrypto: Base64 to resist analysis.

The Android malware's architecture consists of three main components: the malicious Android application, a Go Agent, and an FRP reverse-proxy client. The Android app acts as a conduit to acquire critical system permissions and launch the next phase of the attack, allowing it to obtain accessibility services permissions and then abuse it to unlock Developer Options, enable Wireless Debugging, and extract the 6-digit ADB pairing code.

[Offensive Lab @OffensiveLab]

Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15.

The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated Critical, affects versions 0.28.0 up to but not including 0.42.0 on macOS, and was fixed in 0.42.0 on September 7.

Docker Sandboxes runs each AI coding agent in its own small virtual machine with the project directory shared in. The code that could escape is whatever runs inside that machine, such as a coding agent that has been turned against its user, or anything malicious the agent installs and runs.

Docker has not reported any exploitation. CISA's added assessment on the CVE record lists exploitation as none, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog as of the catalog version released on September 16.

The flaw needs malicious code inside the sandbox, and protecting the host from what an agent runs is what the sandbox is for. The agent installs packages and runs commands with sudo inside the virtual machine, and Docker's isolation documentation says the hypervisor boundary "is the isolation control, not in-VM privilege separation."

The escape goes through the virtio-fs host server, the host side of the file sharing between the Mac and the virtual machine, which followed symlinks when it reopened a removed file from a stored path, Docker said.

A guest, meaning whatever runs inside the virtual machine, could replace a parent directory with a symlink and then read or change files as the VMM user, the host account under which the virtual machine monitor runs, Docker said, "potentially leading to code execution on the host

[Offensive Lab @OffensiveLab]

The U.S. Department of Justice (DoJ) on Tuesday announced the court-authorized seizure of internet domains associated with a distributed denial-of-service (DDoS)-for-hire service known as NightmareStresser.

The domains in question are: nightmare-stresser[.]com and nightmarestresser[.]org. Visitors to the site are now greeted by a seizure banner that states -

"This domain has been seized by the Federal Bureau of Investigation in accordance with a seizure warrant pursuant to 18 U.S.C. §§ 981(a)(1)(A) and (b), 982(b)(1), and 1030(i) (1)(A); and 21 U.S.C. § 853 issued by the United States District Court for the District of Alaska as part of a joint international law enforcement operation and action by: United States Attorney's Office for the District of Alaska, Federal Bureau of Investigation (FBI) Anchorage Field Office, [and] Royal Canadian Mounted Police (RCMP)."

These so-called booter services are usually advertised as stress testing utilities but have been used to facilitate attacks targeting a broad range of victims in the U.S. and elsewhere, the Justice Department said. Some of the targeted sectors included educational institutions, government agencies, gaming platforms, and millions of people.

"In addition to affecting targeted victims, these attacks can significantly degrade internet services and can completely disrupt internet connections," the DoJ said in a statement.

[Offensive Lab @OffensiveLab]

Enterprises in #Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky.

The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.

"In most incidents, the attackers used compromised valid credentials to gain access to corporate VPNs," Kaspersky said in an analysis published today. "VPN connections originated from IP addresses in the Russian segment linked to Cloudflare WARP tunnels, as well as from IP addresses associated with European virtual infrastructure providers."

The attacks, as highlighted in July 2025, involve the deployment of GhostContainer, a known modular backdoor that grants the operators complete access to a victim's Microsoft Exchange Server, as well as run arbitrary code, perform file operations, and load additional modules.

To sidestep detection, the malware masquerades as a common server component to blend in with regular operations. It can also function as a traffic redirection or tunnel. Prior attacks involving the malware have targeted a government agency and a high-tech company located in Asia.

"It incorporates components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility," Kaspersky explained. "All of these components are publicly available on GitHub."

The exact method used by the attackers to deliver GhostContainer to Microsoft Exchange servers is unknown, although it's believed to have involved the extraction of cryptographic keys used by the server from the https://t.co/XmU1jHZuDY configuration, followed by overwriting the VIEWSTATE framework parameter, and injecting a payload into it, causing the backdoor to be launched in memory.

To move laterally within the internal network, NightEagle has been observed downloading tunneling tools to redirect network traffic via RDP using Microsoft dev tunnels and an open-source program called rdp2tcp.

[Offensive Lab @OffensiveLab]

@Computerlearn_ Download offline file. It is 100% malware

[Offensive Lab @OffensiveLab]

Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension.

Once the extension was installed, it could access each product's built-in AI with a single click. On Comet, Edge, Opera Neon, and Claude in Chrome, it could drive the AI agent to act on behalf of the attacker; on Chrome and Comet, it could read files from the user's computer, and on Chrome, it could also switch on the camera and microphone.

The findings are researcher demonstrations, not attacks seen in the wild, and each requires the attacker's extension to be already running in the victim's browser.

These products all work the same way. The AI has a "body" inside the browser that can see the screen, open files, use the camera, and take actions, and a "brain" that runs on the company's servers and tells the body what to do, according to Forever Security. The body only takes orders from one trusted web page, such as https://t.co/wsvQ4fTJ4i for Chrome or https://t.co/j99j5ODM9C for Comet.

[Offensive Lab @OffensiveLab]

Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN.

Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and Microsoft Edge.

"The KREMLIN malware ecosystem employs multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions to steal credentials, session tokens, and sensitive data," security researchers Cyril François and Andrew Pease said in a technical report shared with The Hacker News.

"Malicious browser extensions bypass Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs, and App-Bound encrypted hashes."

A defining aspect of the operation is the use of blockchain to conceal the threat actor-controlled infrastructure, leveraging Ethereum smart contracts as dead drop resolvers to dynamically update command-and-control (C2) endpoints and payload hosting locations so that it cannot be disrupted.

The starting point of the KREMLIN is a JavaScript file that masquerades as a banking, invoice, or company document and is manually executed by the victim. In doing so, it leads to the execution of a multi-stage loader that only proceeds if it's not running within a sandbox or virtual machine, downloading and installing additional payloads before launching the next stage.

[Offensive Lab @OffensiveLab]

Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran's intelligence service uses to spy on dissidents, journalists, and activists around the world.

The malware is controlled via the Telegram messaging app and can copy a target's emails and chat messages, take screenshots, and activate the microphone to record audio.

The FBI calls it HEAVYGRAM, and the U.K.'s National Cyber Security Center (NCSC) calls it CHOSEN BRICK.

The joint advisory was published on September 15 by the NCSC, the FBI, and the Netherlands' intelligence service, the AIVD. The FBI also released an updated analysis of the malware that expands on a March 2026 alert, the first to describe the campaign, with more technical detail and new indicators of compromise.

The FBI attributes the malware to Iran's Ministry of Intelligence and Security (MOIS), the country's main intelligence agency, and dates the wider campaign to the autumn of 2023. The advisory says CHOSEN BRICK has been used against people in the U.K., the U.S., and the Netherlands, and around the world, since at least 2025.

The targets are mainly Iranian dissidents, journalists who oppose Iran, activists, and members of groups whose views clash with the government, the agencies say. But the FBI has warned that anyone Iran considers of interest could be a target.

[Offensive Lab @OffensiveLab]

Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems.

The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America. Activity linked to the malware has been detected as recently as July 2026.

Lumen Black Lotus Labs said it discovered the previously undocumented malware on VirusTotal in early 2026, with evidence pointing to a skilled threat actor that has managed to stay undetected until now.

"The actor used Tendyron's 'OnKey' software to sideload agents into targeted machines," Black Lotus Labs said in a report shared with The Hacker News. "Tendyron creates hardware-based tokens employed in high-security settings to verify user identities for workstation access. Their website lists customers in China's financial and government sectors, among other verticals"

Tendyron OnKey is a second-generation Public Key Infrastructure (PKI) USB security token and authentication device designed to protect online banking and financial transactions. On its website, Tendyron claims to have 190 million tokens in circulation.

Although neither Tendyron's code-signing certificate nor its build environment has been compromised in connection with the activity, it's suspected that the operators are relying on binary that's vulnerable to DLL sideloading to trigger the attack within targeted networks that are likely to have the program installed.

[Offensive Lab @OffensiveLab]

A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE.

Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026.

"The emails contained a message encouraging the users to click a link that led to the website of a U.S.-based university," researchers Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster said. "These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain."

The exploit chain, as previously highlighted by Proofpoint, involves three separate flaws – two in Chrome and one in Windows Advanced Local Procedure Call (ALPC). It first abuses CVE-2026-85046 to gain arbitrary read/write within the V8 sandbox, then escapes the browser sandbox via CVE-2026-87491, and finally employs CVE-2026-85880 to inject code into the Chrome browser process and achieve arbitrary code execution.

UTA0560 has been observed relying on this attack method to deploy GRIMWEDGE, which facilitates host reconnaissance, file and process management, command execution, and payload delivery capabilities. It all begins with a spear-phishing email that persuades a recipient into clicking on an embedded link pointing to a legitimate website susceptible to a reflective XSS vulnerability.

[Offensive Lab @OffensiveLab]

A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12.

In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to an attacker-controlled server, or rewrite what the page displayed.

Telegram shipped a fix in July, but the app update does not update files exported with earlier versions, so old HTML exports can still carry the script.

Telegram Desktop, Telegram's app for Windows, macOS, and Linux, can save a single chat or all chats from an account as HTML pages that open in a browser. Bots can attach rows of buttons under their messages, which Telegram calls inline keyboards, and the bot chooses the text shown on each button.

Until the fix, the export code wrote that button text directly into the HTML page without escaping it, the researchers Denis Rostilov and Aleksander Rostilov found.

Escaping converts characters such as < so that a browser shows them as text instead of treating them as code, and the export applied it to message text, sender names, and other fields.

A bot could therefore put a script tag in a button's text, padded with invisible characters so that the button looked empty in the Telegram Desktop build they tested.

[Offensive Lab @OffensiveLab]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.

Details of the vulnerabilities are as follows -

CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization vulnerability in JFrog Artifactory that could lead to privilege escalation due to a validation check of the token signature/issuer and not the token's scope.
CVE-2026-42018 (CVSS score: 7.5) - An improper authentication vulnerability in JFrog Artifactory that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially leaking sensitive resources.
CVE-2026-84869 (CVSS score: 9.9) - An improper privilege management and missing authorization vulnerability in ConnectWise ScreenConnect that could allow an attacker to file transfer and execute through an active remote session without authorization or host confirmation.
CVE-2026-67277 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability in MikroTik RouterOS that could allow kernel memory disclosure and denial-of-service in the btest service.
CVE-2026-86060 (CVSS score: 9.2) - An improper neutralization of argument delimiters in a command vulnerability in MikroTik RouterOS that could allow an attacker to change the trusted RouterOS policy mask and achieve privilege escalation.
As previously reported by The Hacker News, attackers have been observed chaining the two Artifactory bugs alongside CVE-2026-82329 (CVSS score: 9.8) to take administrator control of self-hosted servers and deploy backdoors between August 15 and September 8, 2026. CVE-2026-82329 was added to CISA's KEV catalog earlier this month.

[Offensive Lab @OffensiveLab]

Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, https://t.co/XQXK3cZ8HL (aka Zhipu), and MiniMax.

Knowledge distillation by itself is a legitimate training method. It refers to a machine learning technique where a large, powerful AI model assumes the role of a "teacher" to train a smaller, less-capable or faster "student" model to copy its capabilities.

Illicit distillation, on the other hand, is an industrial-scale campaign that covertly extracts a model's capabilities and replicates them in another model without authorization, typically by making use of networks of fake accounts created with stolen credit cards, login credentials, and API keys.

Frontier AI labs in the West, including those from Google and OpenAI, have repeatedly called out distillation attacks aimed at their models. Anthropic said it has observed unauthorized labs employing "increasingly sophisticated methods" to get around defenses and harvest its capabilities, such as agentic capabilities and tool use, coding and data analysis, and logical reasoning, through prompt manipulation tricks.

"DeepSeek, Xiaomi, and Moonshot fed conversations between their own models and users into Claude," Anthropic said. "These labs then used Claude’s responses as training data with which to distill Claude's capabilities. Some of these exchanges included sensitive information, including from individual users, major multinational companies, and state-affiliated actors.

[Offensive Lab @OffensiveLab]

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026.

The threat actors, which the artificial intelligence (AI) company has branded Generative Threat Groups (GTGs), span state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals.

"The cybersecurity skills of AI models means that AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators," Anthropic said. "The use of AI went beyond simple questions and responses from a chatbot but rather involved the use of multi-agent frameworks executing reconnaissance, exploitation, and data exfiltration."

Among the notable cases highlighted by Anthropic is the development of an AI-assisted workflow by a Russian state-sponsored threat actor it calls GTG-20006, which aligns with broader reporting linking the cluster to Midnight Blizzard (aka APT29 and Cozy Bear). Some of the other AI-enabled cyber campaigns highlighted by Anthropic in its 154-page report include .

[Offensive Lab @OffensiveLab]

Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve.

The operation has been attributed to a cyber espionage group it calls GTG-20006 (where "GTG" stands for Generative Threat Group), which aligns with broader reporting linking the cluster to Midnight Blizzard (aka APT29 and Cozy Bear).

This actor is said to have developed an AI-driven process to automatically rebuild and re-deploy their toolkit if it was detected by security products, thereby undermining defenders' ability to block the artifacts via static detections.

Attacks mounted by GTG-20006 have targeted military intelligence targets in Ukrainian and European governments, along with diplomatic and defense organizations and individuals connected to U.S. foreign policy.

The toolkit includes a number of programs -

Two Windows-based implants
A mobile exploitation kit
A credential stealing tool that targets browser password stores
A phishing platform designed to mimic priority targets like government organizations, and
An administrative console used to manage compromised accounts
"The actor also used AI to monitor how well their tools evaded detections from known security defenses," Anthropic explained. "If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections

[Offensive Lab @OffensiveLab]

A militant group in northern Yemen has reportedly developed software using AI to create ballistic missiles and guided rockets.

According to a report by the international news agency, this was revealed by the American AI company, Anthropic. Anthropic further stated that the militant group created this software using its cloud-based artificial intelligence model.

The American company, Anthropic, also stated that through this software, the Houthis have gained expertise in developing ballistic missiles and guided rockets.

According to Anthropic's latest threat intelligence report, released on September 10th, a cell in northern Yemen was simultaneously running three programs for weapons development.

These included a guided rocket, a multi-stage ballistic missile, and a program for a variety of missile types. The individuals used Claude Code as a substitute for human software engineers.

[Offensive Lab @OffensiveLab]

A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday.

The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns and develops Sogou, fixed the flaw in April 2026.

Gen found the flaw while investigating a live intrusion by UNC3569, a group that Google Threat Intelligence ties to China and places in the country's hacker-for-hire scene. Google has tracked the group since 2021 and says it has targeted government, education, technology, and finance sectors, mostly in East and Southeast Asia.

The backdoor it installed is GRAYRABBIT, a small program the group has used for years and that Google describes as its first step onto a machine. It gives an attacker a remote command shell, allows files to be moved in both directions, and can load additional modules from the attacker's server at any time.

Tencent's fix blocked the way in. It did not change the part of Sogou that made the attack possible. In the patched version Gen examined, the built-in browser engine is still the 2020 version, and its sandbox is still switched off.