名

无

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

第1四半期から追跡されている新興のボットネットDysphoriaが、侵害したホストをC2の中継所へ作り替えているとの報告。DDoS用の検体とは別に、6月25日以降は攻撃機能を一切持たない中継専用の検体が現れ、両方が併存しています。

中継の作りは、UPnPでルーターに155ポートを一括で開かせ、外から届いた通信を同じポート番号で本来のC2へ流す構成。中継ノードは接続数と帯域を定期的に報告しており、網として管理されています。

DDoS検体がブロックチェーン名から配布ノードを引き、そこへ問い合わせて得たC2の一覧は、追跡の結果すべて他の被害ホストを転用した中継所だったとのこと。遮断したい相手と守るべき相手が重なります。

運用は商用で、販売ページが掲げるのは最大4Tbpsの攻撃能力と、継続時間や帯域に応じて数十から数百ドルという階層型の料金です。

【要点の整理】

・C2の取得は多段で、まずENSのburrberry[.]ethのnodeレコードから配布ノードのIPを復元し、そこへ問い合わせて実C2の一覧を受け取る流れ。ENSのukranianhorseriding[.]ethとSNSの24carnforth2merseyside[.]solは基盤側の情報に使われ、初期の系統ではm3rnbvs5d[.]ethが確認されたとの整理。レコード内では偽のIPv6アドレスを並べ、そこから4バイトを抜いて独自の変換で実IPv4へ戻す難読化を挟むとの説明

・中継専用の検体はDDoS機能を持たず、epollによる双方向のノンブロッキング転送に徹する作り。4秒を超える間隔で、状態と接続数と帯域をJSON形式でlogin[.]trees4sale[.]netの9000番ポートへ送るという記述。DDoS用と中継用のいずれも、実行時にプロセス名をlibdalvikengine[.]soへ偽装する実装

・拡散はTelnetとSSHの弱い認証情報への総当たりが主軸で、組込みLinuxのルーターやゲートウェイ、IPカメラを狙う既知の脆弱性13件を併用。2013年から2022年にかけての定番と2025年公開の4件が混在しており、機種の広がりに合わせて更新を続けているとの分析。文字列の保護には、Sボックスを線形合同法で5周かき混ぜ、鍵列生成に線形帰還シフトレジスタを織り込んだRC4の改造版を使うとの解析

・規模の数値は出所も母数も異なる内訳。7月14〜20日に中国本土で重複を除いて確認されたのが4,401台、その日次ピークが1,801台、海外の日次ピークが239,000台、日次のC2アクセスが最大740,000回。海外の観測規模が大きくなるのは侵害ホストをC2の中継に使う仕組みによるものと報告元自身が説明しており、中継への転用分だけ見かけが膨らむ関係。漏えいした管理画面の表示は約20万台で、報告元は自らの監視データと近い値として画面の信憑性を裏づけるものと扱う一方、計数の方法や重複排除の基準は示されていない前提

攻撃は世界中の複数業種に対してほぼ毎日続いているとしています。各数値は計測方法も期間も異なり、中継への転用が観測数を押し上げる関係もあるため、確定した感染台数として一つにまとめて扱うことはできません。

詳細は以下を参照：
https://t.co/HhGUy5bYng

(※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)

[The DFIR Report @TheDFIRReport]

EtherRAT brought blockchain-backed C2 into this intrusion.

A malicious MSI masquerading as Sysinternals RAMMap deployed EtherRAT, which used EtherHiding to retrieve Ethereum-hosted C2 config updates before pivoting to TryCloudflare infrastructure.

Full report: https://t.co/QZoH3FXfTp

#DFIR #ThreatIntel #DigitalForensics

[Yogesh Londhe @suyog41]

MAC Rust Stealer

Sparksly.dmg
3390b960af5dd1933289b916af3ecce9

C2
e1[.]cdnresolver[.]com
a2[.]cdnresolver[.]com

#RustStealer #Stealer #IOC

[Eugene Kaspersky @e_kaspersky]

Threat actors are increasingly exploiting legitimate cloud services like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS to evade detection and streamline the deployment of the scam infrastructure.

We analyze the mechanics of a real-life adversary-in-the-middle (AitM) attack in a cloud and share detailed statistics on the platforms and domains phishers abuse most frequently 👉 https://t.co/50VSnAwNoF

[Virus Bulletin @virusbtn]

Zscaler ThreatLabz presents the second part of a technical analysis of new tools used by an East Asia-linked threat actor targeting government entities in the Middle East. This part looks into a new modular stage 3 backdoor: BINDCLOAK, a variant of OctLurk https://t.co/2iESHSiRMx

[Sudeep_Singh @SinghSoodeep]

Dropping Elephant targets East Asia using ICASSE decoy theme.

LNK MD5: a02dca4d1487f9141a90f3b11aa08d64
Malicious DLL: f8f03a6a3edbf7985469de26bdfb5e97
Base64-encoded and XOR-encrypted shellcode: fdfce91c0a9758a24ea98b48c44fdc9c
.NET assembly payload: 1ac87c87bc585605b75b269ca510fc52

Malicious DLL - msdtctm.dll sideloaded by msdtc.exe
Scheduled task name - GoogleErrorReport launches msdtc.exe to start attack chain

DLL sideloading -> Base64 + XOR decrypt shellcode -> Donut shellcode -> in-memory execution of .NET DLL

All DLL sideloading components downloaded from the staging domain: cas-edu[.]org

C2 URL: hxxps://wtechnote[.]org/c019e2b6b055-48d2/a5c5a153b6caddd7.php

#threatintel

@smica83 @malwrhunterteam @volrant136

[Hackread.com @HackRead]

H96 #AndroidTV boxes are doing far more than streaming. Researchers found devices that rotate between ad fraud and residential proxy abuse, turning home networks into malware infrastructure.

Listen/Read: https://t.co/gxiSV1JoOH

#CyberSecurity #Android #Malware #AdFraud #IoT

[Is Now on VT! @Now_on_VT]

Sample is now on VT!

🚩Hash: 8e6c07f38ef920b5154fd081ba252b9295e8184d
🎯Actor name: APT28
🔹Comment: This blogpost introduces an operation that we named RoundPress, targeting high-value webmail servers with XSS vulnerabilities, and that we assess with medium confidence is run by the Sednit cyberespionage group. The ultimate goal of this operation is to
🌐URL: https://t.co/TGLS5pw6YG
🔎OnVT: https://t.co/TjjIIjyJJS

[Lontz @lontze7]

We uncovered #DOUBLECUP, a ClickFix loader using steganography & IP-based environmental keying to deliver #CountLoader and #DeviceManager. DeviceManager is a novel RAT using #EtherHiding & DNS tunneling for covert C2.

https://t.co/W9jOhVCIfi

[Zscaler ThreatLabz @Threatlabz]

📦 ThreatLabz has identified a malicious PyPI package named jsonschema-viewer. The package name was designed to impersonate the legitimate jsonschema package, one of the most widely used Python libraries with over 100 million weekly downloads.

The malicious PyPI package executes a multi-stage attack chain using curl to pull a shell script from the C2 server, which then downloads an architecture-specific ELF loader. The loader decrypts and executes the final payload in memory using a single byte XOR key (0x99), delivering VShell, a Go-based remote access tool and backdoor.

The package has since been removed from PyPI.

IOCs for this campaign are the following:
C2: 49[.]232[.]169[.]67[:]8084
Shell script MD5: 21f5c39665ad9fcbaa173084ed1ce966
Linux_amd64 (loader) MD5: 37a6bfa17f600445df6abb9f26bc29ed
Linux_arm MD5: a976f5be086cf15cae1614f188be1502
Linux_arm64 MD5: d0f38b97b43049adfd37088dbeaa69b9
Linux_i386 MD5: 28057c3e5fb92492801b91bd97ae8625
VShell payload MD5: b1acca2399b7289b684daee915d53efb

[Yusuf Can Çakır @Yusufcancakiir]

A full-scale municipal data breach and active Sliver C2 operation have been uncovered. The attacker used multiple implants communicating over mTLS with 43.157.204[.]73:8888 and c2.ashveil[.]org:8888, leveraging ECC certificates with codenames like OBJECTIVE_CHANNEL, SPIRITUAL_WOMEN, COMMERCIAL_CONVERSATION. On a compromised Windows host, Mimikatz extracted NTLM hashes for Administrator and several other accounts. TeamViewer 15.80.4 was fully backdoored via exfiltration of PermanentPassword, CertificateKey, PK/SK blobs, and SRP identifier while Always_Online was set to 1. AnyDesk device-id cache, stored RDP credentials, and router panels (TP-Link, ZTE) were also harvested. Internal scanning of the 10.160.197[.]0/24 range identified an Oracle database server at 10.160.197[.]88:1521 (SID newdhmos) accessed with hardcoded credentials lucence:otsdba. The full database was dumped, exposing 103,892 associate records containing full names, IBANs, AMKA social security numbers, tax IDs, monthly salaries, addresses, and contact details. Additionally, 1,390 employee records and 13,667 payroll entries were exfiltrated. Live API keys for the Greek transparency portal Diavgeia (6212_4 / 17DD357783BED4EF01A6CB) and the GSIS tax authority service manage_afe (L00011242L01450HKTWHXZNW87SH7P7H3FE / 0BD72E7B87FCDCEF0ED6, running on 10.160.197[.]88:7575) were stored in plaintext. Financial data shows 137,064 e-payment transactions totaling €341,748.13, with 92 payments already processed in 2025.

The operator's OPSEC is critically broken. The entire Sliver database is backed up via a shell script to github[.]com/serverops-admin/sliver using a hardcoded personal access token: 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. The repo ballooned from 365 MB to 634 MB in one day, indicating continuous exfiltration. Git config reveals the email feiyue@hermes[.]local and alias "绯月 FeiYue", granting full access to the attacker's GitHub account and a rare attribution window.

#ThreatIntel #Sliver #C2 #DataBreach #Oracle #Greece #OpSecFail #Infosec

[Zscaler ThreatLabz @Threatlabz]

Zscaler ThreatLabz has published Part 2 of our technical analysis of a targeted campaign against government entities in the Middle East. Part 1 covered a multi-stage infection chain that begins with an ISO file delivering previously undocumented tooling: TELESHIM and MIXEDKEY. In Part 2, we analyze BINDCLOAK and highlight code overlaps and shared C2 infrastructure with OctLurk.

Read our full analysis here: https://t.co/LUm7NvQElT

[Virus Bulletin @virusbtn]

Microsoft details CaptiveCrunch, a Storm-2945 (Midnight Blizzard sub-cluster) campaign targeting captive portal traffic at hospitality venues, using doppelganger domains & Entra ID device-code AiTM phishing to deliver malware & steal traveller credentials. https://t.co/OMaJurdGah

[misaki @tdatwja]

Analysis of the malware led to a Telegram channel distributing the source code for an undocumented Android application builder and device control framework called Flying Eagle (飞鹰).

Jul 28, 2026

https://t.co/SFtP6wJM40

[misaki @tdatwja]

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

July 30, 2026

https://t.co/xxBYPVKB2k

[Is Now on VT! @Now_on_VT]

Sample is now on VT!

🚩Hash: 162e436f18fe6099c57855c8d63fd747493624e87702dc749b242eb9a6b758ca
🎯Actor name: UAT11795
🔹Comment: UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. The actor targets victims' credentials and cryptocurrency wallet assets, establishing a persistent connection to the victims' machines from the C2 server, with the potential to deliver and execute further payloads
🌐URL: https://t.co/Qu02gQURl8
🔎OnVT: https://t.co/NpGxV2HuLP

[N Shams @Nav_the_Sham]

A new RAT variant has been discovered named AtlasRAT, masquerading as a Flash Player installer. Discovered by researchers at ASEC, AtlasRAT obfuscates itself and disguises as a legitimate Flash Player installer using ChaCha20 encryption over TLS, employing self-signed certificates spoofed to resemble Microsoft update infrastructure.

The RAT once fully deployed contains a variety of capabilities including offline keylogging, gathering system information and identifying installed security products, exfiltrating data over encrypted channels, and injecting DLLs into applications like WeChat, potentially allowing the attacker to hide malware activity or connectivity.

Based on historical data, the researchers suspect that AtlasRAT is a reusable framework or commercial offering rather than a one-off tool used by a single group.
#ThreatIntel #cyber #CyberSecurity

https://t.co/87aPiTu9Sw

[cr3ghost @cr3ghost]

This kernel rootkit takes its C2 commands through the Windows registry.

It registers a CmRegisterCallbackEx routine, then the user-mode agent writes commands into a benign key using nothing but standard registry APIs. Every write gets checked for the magic value 0x2625B7146B and the command is unpacked from it.

No IOCTL. No DeviceIoControl. No named pipe. Nothing on the user-mode side that looks like it is talking to a driver at all.

The command set behind it is a full kernel toolkit: arbitrary physical memory read and write by building a custom page table and injecting it into a free PML4 slot, PFN database reads, KVA shadow bypass, kernel APC DLL injection, ETW and CKCL and syscall table hooks, HvlGetQpcBias and GetCpuClock patched for timing.

Then the HWID spoofing shows up. Disk, Nvidia GPU, SMBIOS, plus forged mouhid and i8042prt input packets.

This started life as a game cheat driver. The cheat scene has been shipping production grade kernel capability for a decade and it keeps getting laundered into malware.

Author: @xeroxsec

Full analysis, IOCs and a YARA rule by 0xSec:
https://t.co/T4GX6pKFqN

The C2 infrastructure was still live and unflagged on VirusTotal at time of writing.

[Virus Bulletin @virusbtn]

IIJ-SECT's Bynaoki Takayam looks into three of the latest BlueShell variants observed in May 2026, primarily used in attacks by threat actors based in China. https://t.co/efc2LpU6rY

[LanfAI @Huahuazo]

还记得逆向工程吗？那曾是属于黑客圈子秘不外传的压箱底手艺。

如今可倒好，被人打包成了一个技能路由包，直接怼到AI嘴边，张口就能用了。

玩法其实很简单：只要塞一份 routing.md 进去，AI碰到安全类任务，自己就知道该走哪条道。比如：

1️⃣ APK逆向、IDA静态分析
2️⃣ 前端JS破解、固件渗透
3️⃣ EDR绕过、漏洞利用链
二十多个子技能铺开，安全攻防原本那点门槛，又被AI往下狠踩了一截。这事到底是福是祸，各位心里有杆秤，自己掂量吧。

🔗 https://t.co/6cAVM1Y0gu