Intelligence Feed

1w ago · security-com

Attackers have developed an autonomous offensive agent named 'Skynet' that hijacks exposed large language model (LLM) endpoints to conduct self-directed cyberattacks. The agent leverages stolen or unsecured AI model access to perform internet-wide scanning, exploit web frameworks, steal credentials and databases, and deploy cryptocurrency miners without human intervention. It uses sophisticated jailbreak techniques to bypass commercial model safety controls by redefining malicious activities as routine development tasks. The activity represents a novel form of LLMjacking, where attackers shift computational costs to victims while maintaining anonymity and evading provider bans.

1w ago · security-com

Two critical use-after-free vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell, enable unauthenticated remote code execution on affected servers. The flaws exist in the PHP runtime and can be exploited via crafted web requests, allowing attackers to take control of servers, execute arbitrary code, read sensitive memory, or establish persistence. Public proof-of-concept code emerged before patches were available, and exploitation attempts have been observed since October 17, 2026, with increased activity following disclosure. All PHP installations handling web requests are affected, especially those using Apache with mod_php, and immediate patching is strongly advised.

2w ago · security-com

The Aoki infostealer (also known as Aokigahara) has evolved to target credentials and session tokens from AI coding assistants such as Claude, OpenAI's Codex, Cursor, Codeium, and Google Gemini. This recent capability expansion indicates attackers are increasingly valuing AI-related tokens for identity impersonation, quota abuse, and access to connected repositories and CI/CD pipelines. The malware also steals data from browsers, cryptocurrency wallets, password managers, messaging apps, gaming platforms, and VPN clients, sending exfiltrated data to command-and-control servers via HTTP. The threat actor behind Aoki remains unidentified, but the malware's broad targeting suggests a financially motivated campaign with potential for supply chain and cloud environment compromise.

1mo ago · security-com

Multiple threat actors have revived the abuse of Node.js to evade detection by executing malicious JavaScript payloads through the legitimate, signed node.exe runtime. The attacks, observed since February 2026, targeted government departments, technology companies, and hotels. In one campaign, attackers used a ClickFix-style lure to deploy PowerShell scripts, established persistence, and leveraged Node.js to connect to Ethereum blockchain gateways (EtherHiding) for command retrieval. A related intrusion involved the deployment of a Rust-based backdoor, C2Looper, linked to ransomware operations. The same actors used shared infrastructure, including the C2 domain datalayerservice[.]com and IP 45.158.196[.]23:8888, across multiple victims.

2mo ago · security-com

Jewelbug, a China-based APT group also known as Earth Alux or REF7707, conducts parallel espionage and cryptocurrency fraud operations using shared infrastructure and a unified control panel called XG-Web. The group targets government ministries in the Middle East, Southeast Asia, and South Asia through browser-based attacks and watering-hole compromises, while simultaneously running a for-profit crypto fraud scheme targeting Chinese-speaking users. Their primary malware includes the Antino Windows backdoor and a malicious 'PDF Viewer' browser extension, both deployed via fake software installers and HTA downloaders. The group leverages compromised hosting providers to scale attacks, stealing over 580,000 browser cookies and more than one million implant check-ins in under three months.

4mo ago · security-com

The DragonForce ransomware group, tracked by Symantec as Hackledorb, conducted a sophisticated attack against a U.S. services firm, leveraging custom malware and novel techniques to evade detection. The attackers used a Go-based backdoor named Backdoor.Turn, which abuses Microsoft Teams' TURN relay infrastructure to hide command-and-control (C2) traffic behind legitimate Microsoft domains. They also employed DLL sideloading, BYOVD techniques exploiting vulnerable signed drivers—including Huawei’s HWAuidoOs2Ec.sys—and modified system configurations for persistence and lateral movement before deploying the DragonForce ransomware payload.

6mo ago · security-com

Trigona ransomware affiliates have deployed a custom exfiltration tool, uploader_client.exe, in attacks observed in March 2026, marking a shift from using common tools like Rclone to proprietary malware for greater control and stealth. The custom tool enables parallel data streams, connection rotation to evade detection, granular file filtering, and uses a shared key for authentication with the attacker-controlled server. Prior to data exfiltration, attackers disable security software using kernel-level tools such as HRSword, PCHunter, Gmer, and others, often leveraging vulnerable drivers (BYOVD technique), and gain remote access via AnyDesk. Credential theft is conducted using Mimikatz and Nirsoft tools.

5mo ago · security-com

Iran-linked threat actor Seedworm (also known as MuddyWater, Temp Zagros, Static Kitten) conducted a global espionage campaign in early 2026, breaching at least nine organizations across four continents, including a major South Korean electronics manufacturer. The attackers used DLL sideloading with legitimately signed binaries from Fortemedia and SentinelOne to execute malicious payloads, leveraging Node.js scripts to orchestrate PowerShell-based reconnaissance, credential theft, privilege escalation, and SOCKS5 reverse-proxy tunneling. Data exfiltration was performed via the public file-transfer service sendit[.]sh, blending malicious traffic with legitimate cloud services to evade detection. The campaign reflects an evolution in Seedworm’s tradecraft toward more disciplined and stealthy operations.

4mo ago · security-com

Backdoor.Mistic is a newly identified stealthy memory-resident backdoor used in cybercrime intrusions since April 2026. It has been deployed alongside ModeloRAT, a Python-based RAT linked to the financially motivated threat actor Woodgnat (aka KongTuke), known for selling initial access to ransomware affiliates including Qilin, Black Basta, and Rhysida. Mistic is sideloaded via legitimate binaries like MpExtMs.exe and loads malicious DLLs such as EndpointDlp.dll, enabling fileless execution, in-memory payload loading, and self-deletion via a kill switch. The actor uses social engineering lures (ClickFix, FileFix, CrashFix) and Microsoft Teams for initial access, with opportunistic targeting across insurance, education, IT, and professional services sectors.

5mo ago · security-com

Fast16 is a sophisticated sabotage framework discovered in April 2026, with components dating back to 2005, designed to subvert nuclear weapons simulations by tampering with high-explosive modeling in LS-DYNA and AUTODYN software. The malware uses a kernel driver and Lua-based logic to selectively alter simulation outputs when material density exceeds 30 g/cm³—consistent with uranium under implosion—thereby distorting critical physics calculations. It targets specific instruction sequences in Intel-compiled binaries and modifies Cauchy stress tensor or pressure outputs down to 1–10% of their true values, potentially causing flawed design decisions in nuclear weapon development.

5mo ago · security-com

A five-month espionage campaign targeted the Outlook mailbox of a senior executive at a major global stock exchange, using masqueraded binaries and legitimate cloud services for persistence and data exfiltration. The attackers achieved SYSTEM-level access and deployed a custom Aspose-based OST stealer to incrementally extract mailbox data, exfiltrating it in small batches via Dropbox and OneDrive Personal to avoid detection. The campaign demonstrated high operational discipline, leveraging scheduled tasks, IP-based OneDrive connections to evade DNS logging, and multiple file redeployments under different names but consistent hashes, indicating a focused, long-term intelligence collection effort.

4mo ago · security-com

Attackers are increasingly leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to exploit legitimate, signed Windows kernel drivers and gain kernel-level privileges, enabling them to disable or bypass security software such as antivirus (AV) and endpoint detection and response (EDR) solutions. This method abuses flaws in trusted drivers like truesight.sys and those used by Microsoft Process Explorer, allowing attackers to terminate, suspend, or blind security processes. The technique has become widespread, with ready-made tools such as TrueSightKiller, GhostDriver, AuKill, and Poortry being integrated into ransomware-as-a-service (RaaS) offerings, making it a common component of modern ransomware attack chains.

3mo ago · security-com

The GodDamn ransomware, a rebranded variant of Beast and Monster ransomware, has been used in a recent attack attributed to the threat actor Hyadina. The attackers leveraged AnyDesk for remote access, deployed the malicious PoisonX kernel driver—signed by Microsoft—to disable endpoint defenses, and used a suite of credential-harvesting tools from NirSoft. The attack involved lateral movement via PsExec, deployment of backdoors across multiple hosts, and eventual execution of the ransomware payload after a four-day dwell period. This represents an evolution in defensive evasion tactics, leveraging signed malicious drivers in a BYOVD-style attack.

3mo ago · security-com

Symantec's Threat Hunter Team discovered the China-linked kernel-mode rootkit Backdoor.Daxin active on a compromised host in Taiwan in May 2026, more than four years after its initial public disclosure. Alongside Daxin, a previously undocumented backdoor, Backdoor.Stupig, was found deployed on the same system. Stupig enables pre-authentication command execution as SYSTEM via a Trojanized keyboard-layout DLL loaded by winlogon.exe, bypassing logon audit events. Both malware samples carry compile timestamps from early 2013, suggesting a potential long-term undetected compromise lasting over a decade, possibly facilitated through an outdated Digiwin single sign-on portal with legacy Java components.

3mo ago · security-com

A new Rust-based ransomware named Spirals was deployed in a double extortion attack against an IT services company in South Asia in June 2026. The attackers gained initial access via a compromised IIS web server and used an ASP.NET web shell to establish persistence, escalate privileges, and move laterally using WMI and PsExec. The ransomware, disguised as bitsadmin.exe, encrypted files using AES-128 keys wrapped with ECDH P-256, and threatened to leak stolen data via a Tor-based portal. Multiple tunneling tools and C2 infrastructure were used to maintain access and exfiltrate data.