Cato CTRL exposed the MuddyWater SimpleHelp campaign in Israel using tax lures. Learn how the MuddyWater SimpleHelp campaign abuses RMM tools.
Related Posts:
The post Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures appeared first on Daily CyberSecurity.
Fortinet exposes the PapRAT malware campaign. See how the BITTER PapRAT malware uses three infection chains and Rust to spy on South Asian targets.
Related Posts:
The post BITTER PapRAT Malware Targets South Asian Organizations appeared first on Daily CyberSecurity.
The VULONE Team reveals that the Kimsuky Operation GitPower campaign remains live on GitHub, with Operation GitPower repos staging AnyDesk malware.
Related Posts:
The post Kimsuky Operation GitPower Staging Infrastructure Stays Live on GitHub appeared first on Daily CyberSecurity.
NetamLoader, a new XAML-based .NET loader, points to a supply chain attack on a custom Windows build used by government entities in Asia.
Related Posts:
The post NetamLoader Hides in Windows Update Folder in Suspected Supply Chain Attack on Asian Government appeared first on Daily CyberSecurity.
Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid exploitation of software flaws the vendors didn’t know about yet. Black Lotus sent hundreds of victim notifications along the way, and the investigations that followed revealed the exploitation of at least four confirmed zero-days and one likely.
“Volt Typhoon’s Silent Train is a covert network designed to gain and maintain access to the technologies businesses rely on to manage devices, networks and critical operations.” reads the report published by Lumen. “Black Lotus Labs® tracked how the group used rapidly changing chains of compromised infrastructure to conceal its activity while exploiting previously unknown vulnerabilities in centralized management platforms.”
Silent Train first showed up in November 2023, shortly before the first takedown of the KV-botnet, Volt Typhoon’s earlier network of hijacked routers. Activity rose after the second disruption. The group dropped persistent infrastructure and moved to disposable chains of compromised devices that it could rebuild whenever it wanted.
Each session began on a rented server outside the United States. It then passed through another server and compromised small-office routers, home devices and IoT equipment in other countries. Finally, the traffic passed through a compromised device in the U.S., close to the target. This helped the attackers make their activity look like normal local traffic and bypass location-based blocks and IP reputation filters. On average, the chains passed through about four devices before reaching a U.S. IP address. Some used as many as six.
Lumen identified more than 27 types of devices used in the network, including TP-Link routers and Fortinet appliances. Some of these devices had no known vulnerabilities, suggesting that Volt Typhoon may have used previously unknown exploits to compromise them and create relay points.
“We observed more than 27 device classes exploited and used in Silent Train operations, ranging from SOHO and IoT devices like TP-Link routers and Netgear Orbi devices to enterprise platforms like Fortinet appliances and CyberPanel servers.” the report continues. “Some relay device types lack known vulnerabilities, suggesting Volt Typhoon leveraged undisclosed zero-day exploits to set up a single relay in a four-to-six hop chain and indicating a willingness to commit significant resources to protecting future access capabilities.”
The attackers exploited exposed web interfaces and installed only the tools needed to connect the devices through SSH. These included temporary SSH services, keys, configuration files and tools already available on the systems. At the end of each session, they removed all traces of their activity and dismantled the relay chain. Sessions lasted about four hours on average, although some lasted only minutes. The attackers could also build a new chain in less than two minutes, suggesting that they had partly automated the process.
The group worked with strict discipline. New device types arrived about one per quarter, and about one per month during the 2023 and 2024 build-out, always tested outside the U.S. first. Roles never changed: Intelbras modems served only as overseas relays, Netgear Orbi devices only as the U.S. hops facing victims, and the server providers stayed separated by layer too.
By early 2025, enterprise platforms like Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel joined as final hops. They stayed up one to three months and supported several intrusions. The group also added reverse tunnels using the open-source proxies Chisel and FRP, and the old and new methods ran in parallel.
Volt Typhoon used Silent Train only during key stages of its attacks, including exploiting vulnerabilities, stealing credentials and data, and maintaining access to compromised systems. Each session targeted between one and five victims, often just one organization. The activity was carried out by human operators, mainly from Monday to Friday, between 9 a.m. and 10 p.m. China Standard Time. The group also paused operations for several weeks around Chinese New Year.
The group targeted tools used to manage endpoints and networks, as well as SD-WAN systems and other control platforms. These systems can manage hundreds or thousands of devices, allowing attackers to reach many systems without moving through the network in the usual way. This approach also helped them leave fewer traces. After the attacks, investigators found webshells running in memory, stolen credentials, misuse of built-in features such as remote file transfers, and deleted logs.
The four confirmed zero-day campaigns hit Versa Director in 2024, N-able N-central through CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN through CVE-2026-20127, and VeloCloud Orchestrator through CVE-2026-16812. The Cisco bug is a CVSS 10.0 flaw, and the group kept exploiting it well after Cisco disclosed it in February 2026. In the Versa case, the group used an in-memory JAR webshell to limit forensic evidence and reach downstream customers.
The likely fifth is Quest KACE. The campaign hit more than 30 victims and faded after Quest’s October 2025 security updates.
“The campaign affected more than 30 victims, followed vendor remediation timelines and declined after Quest’s October 2025 security updates.” the report states. “Despite limited forensic evidence, the available data supports a moderate-confidence assessment that Volt Typhoon exploited a zero-day vulnerability.”
The actor stayed on the KACE server and used its admin features to take credentials.
Victims include telecoms, government agencies, defense contractors, satellite and emergency communications, universities with ROTC programs, managed service and IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail and aviation. What they share is access to bigger networks or customers. Hawaii, California and Texas were the top locations for several years. Lumen can’t say why, but the pattern fits pre-positioning for a crisis in the Indo-Pacific.
“For enterprise leaders, the lesson is clear: systems with broad administrative reach can become high-value gateways to the entire organization and its customers. Reducing internet exposure, accelerating patching, strengthening access controls and preserving security telemetry are essential to detecting threats earlier and limiting their impact.” Lumen concludes.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, China)
BRONZE SANDCASTLE uses Sandboxie DLL sideloading to run a modified Meterpreter backdoor in memory against targets in Asia and Africa.
Related Posts:
The post BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor appeared first on Daily CyberSecurity.
APT28 used the Hookedge backdoor, SSH tunnels, and a new loader to spy on a naval shipbuilder and defense firms in two NATO countries.
Related Posts:
The post APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries appeared first on Daily CyberSecurity.
In Operation FlashHole, the Lazarus Group used AI-made lure sites, CrossWeb EX, and GitHub C2 to spy on South Korean firms. Here is how.
Related Posts:
The post Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms appeared first on Daily CyberSecurity.
Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia.
The targets include the Orsk Oil Refinery in southern Russia, about 25 kilometers from the Kazakhstan border, and the government of Nizhny Novgorod, a major city about 425 kilometers east of Moscow. The city lies where the Volga and Oka rivers meet, an important waterway system connected to the Caspian Sea. This target may be significant because Kazakhstan depends on the Caspian basin.
The group has been running targeted intrusion campaigns against government bodies, diplomatic missions and civil society organizations across Central Asia since at least 2024.
“Silent Lynx (overlapping with activity tracked as UAT-6275 by Cisco Talos and as TAG-193 by Recorded Future) is a persistent threat actor that has conducted targeted intrusion campaigns against government ministries, diplomatic missions and civil society organizations across Central Asia since at least 2024.” the paper states. “The group maintains a strong focus on high-value public sector organizations in the Commonwealth of Independent States (CIS), frequently leveraging spear-phishing campaigns conducted through compromised government email accounts and malware staging through trusted public services such as GitHub to increase credibility and infection success rates.”
The group overlaps significantly with clusters previously documented under names like YoroTrooper, ShadowSilk, and Hydra Saiga, all pointing at the same underlying activity.
The toolkit is deliberately lightweight: PowerShell-based reverse shells, proprietary shells written in C++, C#, and Go, commodity tunneling tools, and spear phishing emails sent through compromised government email accounts in Tajikistan and Kyrgyzstan to add credibility. GitHub, Telegram, and hijacked legitimate servers all serve as staging platforms. Nothing about it is technically flashy, which is part of why the group has stayed active for years without much public attention.
The researchers found links that go beyond technical evidence. In March 2026, a Tajik government agency contacted a Silent Lynx server, shortly after Kazakhstan’s lower house of parliament ratified a Treaty on Allied Relations with Tajikistan. In early April, a Belarusian government entity appeared on the same infrastructure, about a week before Kazakhstan’s president met with the Belarusian foreign minister in Astana. These links do not prove the reasons behind the activity, but the researchers highlight them in their paper, and they are difficult to ignore.
The connection to the Orsk refinery also has a clear context. A Ukrainian drone attack in August forced the refinery to shut down for months. Russia had already asked Kazakhstan to help make up for the resulting loss of refining capacity. If a Kazakhstan-linked actor was collecting intelligence on Russian energy infrastructure at that time, it could have been assessing the economic impact or trying to understand how the disruption might affect Kazakhstan’s own export pipelines. The researchers stress that they do not have enough evidence to identify a specific motive. However, they present the facts and let readers draw their own conclusions.
“A sample compiled in August 2025 was observed using a document titled Деловое предложение о сотрудничестве между ГК «Туркменнебит» и руководством Орского НПЗ (translated: Business proposal on cooperation between State Concern ‘Turkmennebit’ and the management of Orsk Refinery) (see Figure 11). We assess that this sample may be targeting Russia’s critical energy infrastructure, given the close integration of the Russian BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE SHEN & VÖGELE 10 VIRUS BULLETIN CONFERENCE OCTOBER 2026 and Kazakh energy sectors.” continues the report. “The document outlines proposals for developing mutually beneficial cooperation, with a particular focus on the exchange of expertise, technologies, and industry best practices. It is worth noting that the author of this PDF file is ‘pickle rick’ and the document was created just one hour after the payload was compiled. The name ‘pickle’ is aligned with the name ‘pickl’ we observed in the PickleShell PDB string3.”
What gave the group away wasn’t a sophisticated interception, it was their own operational sloppiness. They left open directories exposed on public servers containing live tooling, staged payloads, and one very incriminating shell command history showing keyboard input typed in Latin with a Russian keyboard layout active, so “whoami” came out as “црщфьш.” GitHub commit timestamps across 77 commits fit working hours in Astana, Kazakhstan, at 95 percent, compared to only 51 percent if you plot them against Moscow time. Administration connections to Silent Lynx servers came from ProtonVPN egress IPs geolocated to Kazakhstan, exclusively on weekdays between 7 AM and noon local time.
The group’s servers were also being reached from those VPN addresses, which Proton typically assigns based on geographic proximity. Two malware samples were uploaded to VirusTotal from Kazakhstan within minutes of compilation, which is classic anti-detection testing behavior and points to the operator location directly.
“We identified several additional indicators that strengthen the assessment of a Kazakhstan-based origin. The first derives from what appears to be malware detection-testing activity conducted through VirusTotal.” continues the report. “Two samples showed this pattern: an early Chvost sample12 was uploaded to VirusTotal only 86 seconds after compilation, while a second sample13 was uploaded approximately four minutes after compilation. Both samples were uploaded from Kazakhstan, and the same uploaders had submitted additional tools that were later observed in Silent Lynx campaigns.”
A researcher at Johns Hopkins School of Advanced International Studies told Reuters that the case highlights an important point: cyber espionage is no longer the domain of a few major powers. Smaller countries are also developing their capabilities and running long-term operations against neighboring states, often driven by serious geopolitical interests.
Silent Lynx is also becoming more technically advanced. In April 2026, the group used an exploit for the first time to deliver malware. It abused a WinRAR path traversal flaw (CVE-2025-8088) to place malicious files directly in the Windows Startup folder, without requiring victims to enable macros. The group also stored a public proof of concept for a FortiWeb authentication bypass vulnerability on its own command-and-control (C2) server. Researchers have also found signs of growing interest in Linux systems. After relying mainly on social engineering for two years, Silent Lynx appears to be building a more advanced set of attack tools.
Full joint Virus Bulletin paper with full indicators of compromise, malware hashes, and infrastructure details is available here.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SILENT LYNX)
On September 30, OpenAI staff found a small audio recording device jammed into a USB port on the back of a television in an executive conference room in their San Francisco office. The device had been there since September 28, its contents were encrypted, and whoever put it there had wrapped it in toilet paper to hide it.
Federal prosecutors named the man as Abdulrahman Alfozan, 35, a Saudi national who’d been working on OpenAI’s product team since July 2025.
Alfozan was fired and arrested on October 9. He faces up to five years in prison and a $250,000 fine if convicted.
“An employee of OpenAI has been arrested for and charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications.” states DoJ. “Abdulrahman Alfozan, 35, a national of the Kingdom of Saudi Arabia, was arrested on Oct. 9, and made his initial appearance in federal court today.”
The executive conference room hosted meetings about confidential research, product plans, business deals, government relations, and OpenAI’s technical progress. These were clearly sensitive discussions. FBI Director Kash Patel said the alleged goal was to spy on conversations about the company’s intellectual property.
“According to the complaint unsealed today, Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer’s executive conference room to secretly capture sensitive communications about the company’s super intelligence technology,” said FBI Director Kash Patel. “Protecting American SI innovation is essential to safeguarding our nation’s economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities. Thank you to Director of National Intelligence Jay Clayton and our law enforcement partners for their support — and we will continue working closely with our partners across the U.S. government and private sector to keep American businesses and citizens safe and to ensure our country maintains its competitive edge.”
Alfozan had no permission to enter the room or attend meetings there. CCTV footage showed him near the conference room several times before the recording device was discovered. On October 5, five days after OpenAI found it, cameras captured him looking behind the same television where the device had been hidden. He appeared to be checking on it or preparing to retrieve it.
Before the device was installed on September 28, Alfozan used an internal OpenAI tool to search for office addresses, meeting rooms and their capacity, room calendars, the locations of executives and senior leaders, and schedules for meetings with external partners. These searches suggest he was gathering information about the company’s facilities and activities.
Investigators also found a series of chatbot prompts submitted between September 24 and 30 through an account linked to Alfozan’s spouse. The account shared several identifiers with his own. The prompts covered how to build a continuous audio recorder, configure Wi-Fi, improve recording and live listening quality, encrypt an SD card, and enable remote access. Prosecutors also noted that on September 27 and 28, the account submitted prompts referring specifically to the custom header and unique MAC address of Recording Device 1. This happened just one day before the device was installed.
On October 5, the same day Alfozan was caught on camera looking behind the television, he also left a bag unattended in a different room in an OpenAI building.
Security staff opened it and found another recording device similar to the first one, along with his wallet and ID. So either he was planning to plant a second device, or he was already carrying a spare.
“If convicted, Alfozan faces a maximum penalty of 5 years in prison and a $250,000 fine, followed by 3 years of supervised release.” concludes DoJ.
OpenAI said it used its own internal AI models to help analyze the device, which TechCrunch reported “contained advanced encryption, audio monitoring capabilities, and a mechanism for transferring data designed to evade monitoring.” OpenAI also confirmed there’s no indication that Alfozan accessed or exfiltrated model weights, source code, or customer data through any other channel.
This case is being prosecuted under National Security Presidential Memorandum 11, specifically tied to protecting American superiority in what the government is now formally calling “super intelligence” technology. The Director of National Intelligence, Jay Clayton, weighed in personally, calling AI development a national security prerogative. That framing, a straightforward wire tap case dressed in super intelligence language, tells you something about where this administration sees AI in the broader geopolitical picture.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, OpenAI)
Kimsuky spear phishing lures target Ukrainian security experts with fake invitations, as Operation GitPower abuses GitHub and GitLab.
Related Posts:
The post Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower appeared first on Daily CyberSecurity.
Cisco Talos has been tracking a cluster of espionage activity since September 2025 that it calls UAT-11587, and by July 2026 the group had hit at least 16 government and policy organizations across eight Asian countries. The toolset includes a previously undocumented backdoor Talos named Antino, and the thing that makes it worth paying attention to isn’t how it gets in. It’s where it hides once it’s there.
Antino is written in Rust and works on both 32-bit and 64-bit versions of Windows. It supports the usual backdoor features, including shell and PowerShell access, file transfers, in-memory shellcode execution and persistence.
“Antino is a Rust-compiled Windows backdoor that supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading and persistence. Its native command-and-control channel operates exclusively through Microsoft 365, using Microsoft Graph to interact with Outlook and OneDrive.” reads the report published by Talos.
None of these features are particularly new. What makes Antino different is how it communicates: instead of using its own command-and-control server, it uses Microsoft Graph to read commands from an Outlook mailbox and send stolen files to OneDrive. This allows its traffic to blend in with normal Microsoft 365 activity.
The attack starts in a more traditional way, with a convincing phishing email. UAT-11587 created highly targeted documents that suggest the attackers had researched their victims, including a fake workshop document about Taiwan’s information warfare and a document that closely copied a real Taiwan Ministry of Finance ruling about tax treatment for legislators.
“The document exactly reproduces a public Taiwan Ministry of Finance ruling to make the decoy appear credible.” conctinues the report. “Its subject strongly suggests that it was prepared for members of Taiwan’s public sector.”
In another case, the attackers reused a real Associated Press story about alleged Russian offers to the US over Venezuela. Matching malware samples appeared on VirusTotal two days after the original article was published.
The delivery trick is a simple but effective email spoofing technique that takes advantage of a gap many people overlook. The attackers sent the email through a legitimate provider, using one domain as the technical sender, while the visible From address showed the organization they were impersonating. SPF passed because the real sending domain was authorized, but DMARC detected the mismatch and failed. That still wasn’t enough to block the message. The impersonated domain had a DMARC policy set to monitoring rather than rejection, so the failed email still reached the inbox.
The Gmail trick is even more interesting. The attackers recreated Gmail’s normal attachment preview card almost pixel by pixel using images embedded in the email’s HTML. They then made the fake preview a link to a page controlled by the attackers. Open the email in Gmail and it looks just like the real thing because Gmail simply renders the HTML it receives. There is no exploit here. It’s just a very convincing copy of something users already trust.
From that click, a five-stage chain kicks in, leaning on legitimate-looking HTA files, Windows Script Host, and a scripted .NET deserialization trick that abuses a known gadget chain to load malicious code inside a trusted process. The final stage sideloads Antino through a signed Microsoft diagnostic binary, meaning the thing dropping the backdoor onto disk is a tool Windows itself trusts by default. Cloudflare Pages, R2, and Amazon CloudFront carried almost every stage of this, which kept the traffic blending into ordinary HTTPS the whole way through.
Once Antino is running, it checks its Outlook mailbox for new commands every ten seconds. The commands and results are sent as structured JSON hidden inside specially formatted email subjects.
“The Antino backdoor receives commands through email messages. The implant actively pulls commands from the threat actor’s Outlook mailbox folder every 10 seconds. The protocol uses two message types: command emails contain tasking from the controller, while response emails contain the implant’s results.” states Talos. “Command messages are identified by the subject prefix command_req_[session_id] and responses by command_res_[session_id], as indicated in the HTTP GET request sent by Antino: “
A separate system is used to upload stolen files to one OneDrive folder and download attacker tools from another. Even the naming makes the attacker’s perspective clear: “uploads” are files sent to the victim, while “downloads” are files pulled back from the victim.
The attribution case leans on accumulated small details rather than any single smoking gun, which is honestly how these assessments should work. Decoy document metadata carries Simplified Chinese language tags and a UTC+8 timestamp, a combination more consistent with mainland China than Taiwan or Hong Kong, where Traditional Chinese dominates. Separately, ten different Antino builds reference a Rust package mirror built specifically to speed up dependency downloads inside mainland China, the kind of tooling choice a developer picks for convenience, not for disguise.
The victim list reads like a checklist of what an intelligence service would actually want: defense ministries, legislatures, foreign affairs offices, border and interior security agencies, plus the think tanks and civil society groups that tend to know things governments care about early. Around 350 compromised endpoints turned up across eight countries, with the largest single wave, roughly 57 new endpoints, hitting India over two days in June. That’s not noise. That’s a deliberate and sustained collection effort.
“Based on the development, preparation-environment, and targeting indicators detailed in this report, Talos assesses with high confidence that UAT-11587 is China-nexus.” the report concludes.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Antino backdoor)
Entrar