Hunt.io traced ARTEX servers and AI-powered hacking tools used in breaches affecting seven South Korean financial institutions.

Between late September and early October 2026, seven South Korean financial institutions had data breached through internet-facing systems. About 66,000 to 67,000 people and around 2,200 corporations were affected, and personal, employment, income and loan data was exposed. Hunt.io dug into the infrastructure behind the campaign, and its findings add a lot to what CrowdStrike and Genians already published.

CrowdStrike reported on October 7 and Genians Security Center on October 12, and both pointed to ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. CrowdStrike assessed with moderate confidence that a single Chinese-speaking individual motivated by money ran it, and not an established threat group. DeepSeek v4.1 Flash was the main model, with GLM 5.3 and Grok 4.6 as backups, reached partly through a reseller domain, xcai[.]pro.

The public indicators were a server at 38.244.50[.]120, which hosted the ARTEX console, plus a Hong Kong address and nine proxies. Genians said the ARTEX GitHub repository and Docker image were removed on October 11, though forks and mirrors remain.

“CrowdStrike assessed with moderate confidence that the operator was a single Chinese-speaking individual motivated by financial gain rather than an established threat group.” reads the report published by Hunt.io. “The infrastructure reportedly accessed these services in part through the reseller domain xcai[.]pro. Both reports described a two-server configuration, consisting of a Hong Kong-based IP address used as primary infrastructure and 38.244.50[.]120, which hosted the ARTEX console.”

Hunt.io notified the relevant national CERT before publishing, and says the report holds no personal records or credentials.

The company’s own scanning showed 38.244.50[.]120 sits on Cogent’s network in Los Angeles, with 15 open ports. The ARTEX login page, with a Chinese title meaning “autonomous penetration testing console”, appears on ports 443 and 8090. Other services include a Gemini2API admin console and a Tinyproxy server.

Searching its AttackCapture platform for that address, Hunt.io found another open directory at 23.248.226[.]250, a jump server in Hong Kong on AS138415. It held 42 files in 2 subdirectories, 105 MB in all, and the platform had logged warnings on September 5, September 26 and October 5. A file in it names 38.244.50[.]120 as the jump host, and its own comment tells the operator never to paste the credentials into a session. It sat in an open directory.

Three scripts back up the link. They keep reverse SSH tunnels alive, run a local relay, and copy files to the jump host, one tunnel is named grok2api, and the credentials file also holds keys for Zhipu AI’s GLM models, an OpenAI-compatible relay and a proxy service. That explains how several language models ran in one campaign.

The AI setup is the most striking part. A state file shows the harness is Claude Code itself, version 2.1.221, started 510 times since August 4, but it isn’t talking to Anthropic. A small proxy, ds-models-shim.py, fixes a compatibility problem by faking a model list and sending requests to DeepSeek, and another, xcai-effort-shim.py, adds a reasoning setting because the DeepSeek backend otherwise skips its reasoning step. The route runs from Claude Code through Claude Code Router, an open-source project, to xcai and then to DeepSeek.

“A small local proxy, ds-models-shim.py, addresses a compatibility issue: the official /v1/models endpoint returns a 404 response when queried against a non-Anthropic backend, preventing Claude Code from discovering the available models. The shim intercepts that specific request and returns a locally defined model list containing deepseek-v4-pro and deepseek-flash. All other requests are forwarded to api.deepseek.com/anthropic.” states the report.

The same file counts 19 custom skills, reusable instruction sets for the agent, with 147 recorded uses. They cover code audit, reconnaissance, web injection, WAF bypass testing, authentication testing, Telegram Mini Apps, APK download and decompiling, cloud phone control and payment logic testing. Next to the payment skill sat three self-registered test accounts with tokens for a cash-in deposit API, dated September 12, and a comment calls them an authorized, self-built test. The setup fits testing for insecure direct object reference flaws, a technique CrowdStrike and Genians described against Korean loan and inquiry services.

The directory also held supporting tools. A script queried FOFA, a Chinese asset search engine like Shodan, through a third-party API, and a comment says the primary membership had expired and a backup key was in use. Proxy scripts enumerated a rotating proxy service at 154.201.79[.]246:443, where 79 unique exit IPs showed up among the first 100 identities tested.

A separate directory at 23.248.226[.]250:8001 held a small staged setup for JNDI and LDAP exploitation, retrieved on October 5 at 03:42 UTC. It confirms command execution through a DNS callback, and one script lets web and LDAP traffic share a single port. Hunt.io’s analysis describes the tooling without publishing steps to reproduce it.

Other recovered files include tools aimed at a cryptocurrency exchange’s admin session and withdrawals, Linux privilege escalation exploits, iOS probe source code and Android kernel and firmware utilities. Hunt.io says their connection to the Korean breaches isn’t confirmed.

Hunt.io then showed how to hunt ARTEX servers. Searching for an ARTEX certificate issuer returned 19 IP addresses, and searching its malware classification returned 1,303 addresses across 30 countries, led by the United States, China and Hong Kong. Those figures show where addresses are registered, not where the operator sits.

“The result returned 19 distinct IP addresses, including 38.244.50[.]120. This method is precise but limited to hosts that expose a matching certificate. Systems using a different certificate will not appear in these results.” continues the report.

Matching the console’s page title returned about 1,300 IPs, and a looser search found 21 title strings, 19 of them likely ARTEX consoles, in English, Chinese, Korean, Japanese, Russian, Portuguese and Vietnamese.

A malware-name search in AttackCapture gave 280 results with open directories. One at 130.94.31[.]86:18888 in Seoul held two small scripts, and another at 156.251.11[.]39 held an SMB reconnaissance toolkit whose test script writes a file named artex_probe_11876.txt.

More hosts held exploitation kits for DedeCMS and FangCMS, a CAPTCHA bypass suite, a RuoYi and Spring administrative console exploit and CAPTCHA-based login automation. Together they show the framework attracting many operators.

For defenders, the advice is plain. Remove public access and put administration behind VPNs or allowlists, and reset SSH passwords and rotate API keys, proxy credentials and tokens that exposed files may have revealed. Patch internet-facing services, watch for unexpected LDAP and JNDI activity, DNS callbacks and remote script downloads, and store secrets in a managed vault with least-privilege permissions. Also restrict access to model gateways, watch their requests, and enforce compliance rules on managed phones. Hunt.io’s lesson is that an investigation shouldn’t stop at the first list of indicators, because

The company also published indicators of compromise in its analysis.

“The findings highlight risks associated with exposed administrative services, reusable credentials, remote access tunnels, proxy infrastructure, and exploitation tooling.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ARTEX)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Linux Kernel and Broadcom VMWare ESX vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

Below are the flaws added to the catalog:

• CVE-2026-41709 (CVSS score of 7.6) Broadcom VMWare ESX Insufficient Logging Vulnerability
• CVE-2026-46300 (CVSS score of 2.7) Linux Kernel Missing Initialization of a Variable Vulnerability

In July, Broadcom released patches to address five vulnerabilities affecting VMware ESXi, vCenter, Workstation, and Fusion, including CVE-2026-41709. The vulnerability in VMware ESX is caused by insufficient logging. A malicious user with administrator privileges could perform certain operations on the affected system without those actions being recorded in the logs.

This could allow an attacker to hide specific activities and make it harder for security teams to detect suspicious behavior, investigate incidents, and determine what happened. The flaw does not itself grant administrator privileges; the attacker must already have them.

According to CrowdStrike’s 2026 Legal Threat Landscape Report, which said the China-linked threat actor Warp Panda (aka Armory Castle, UNC5221, Clay Typhoon and VerdantBamboo) exploited CVE-2026-41709 as a zero-day in early 2026 to reduce the visibility of its activities in audit logs.

Warp Panda targets internet-facing edge devices by exploiting zero-day vulnerabilities and deploying custom malware to maintain persistent, covert access. The group also attempts to evade detection by bypassing audit logging, stealing cloud session tokens and registering unauthorized multi-factor authentication (MFA) devices.

The second flaw added to the catalog is CVE-2026-46300, also known as Fragnesia, could let local attackers gain root access through page cache corruption.

The flaw affects the XFRM ESP-in-TCP subsystem and could allow local attackers to gain full root access by corrupting the kernel page cache.

Security experts warn that the issue is dangerous because attackers with low privileges can modify read-only files in memory and take complete control of vulnerable systems. The vulnerability was discovered by William Bowling of the V12 security team, while Wiz published a detailed technical analysis.

“The vulnerability allows unprivileged local attackers to modify read-only file contents in the kernel page cache.” reads the report published by Wiz. “Attackers can then achieve root privileges through deterministic page-cache corruption.”

Fragnesia shares similarities with earlier Linux privilege escalation flaws, such as Dirty Frag and Copy Fail. According to researchers, the bug can reliably provide root access on major Linux distributions without requiring race conditions or complicated timing attacks.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix CVE-2026-41709 by November 11, 2026, while CVE-2026-46300, must be fixed by October 31, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

CVE-2026-41709

China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed.

Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks at machine speed against hundreds of organizations across aerospace, defense, energy, financial services, government, manufacturing, and more.

“Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours.” reads the report. “Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.”

Storm-0940 has been active since 2021 and has historically relied on password spraying and OAuth application abuse to get into Microsoft 365 environments. Adding ARTEX changed the scale of what they could do. In some attacks, the time between initial targeting and achieving privileged cloud access was under three hours.

Before obtaining the ConnectWise credentials, Storm-0940 launched a password spraying attack between October 10 and 14. The attack came from the IP address 144.172.64[.]99. Microsoft recorded more than 151,000 failed login attempts against 327 accounts at eight organizations. Activity peaked on October 11, with 2,900 failed attempts per minute. Forty-eight accounts each received more than 1,000 failed attempts. None of these attempts succeeded.

The situation changed on October 15, one day after the ConnectWise breach became public. The AI agents stopped trying passwords and switched to a different attack method. By then, Storm-0940 had obtained the credentials of several ConnectWise cloud application accounts. The agents used these credentials to log directly into customer Microsoft 365 environments.

“Storm-0940’s use of ARTEX accelerated the speed of compromised application abuse to authenticate to Microsoft 365 customer environments through applications that had already been granted access.” Microsoft continues. “This allowed the threat actor to operate without requiring an interactive user sign-in. “

The agents used applications that already had permission to access their targets. This allowed the attackers to enter customer environments without requiring users to sign in interactively.

In a subset of environments where authentication succeeded, the agents didn’t stop there. They moved into Microsoft Graph and ran directory reconnaissance, modified application credentials to establish persistence, and attempted changes to identities, groups, and privileged roles. Microsoft identified multiple customer environments with evidence of this follow-on activity.

The persistence mechanism is the part defenders need to act on now, even if they’ve already disabled the ConnectWise connections.

“These changes can remain active as a backdoor even after the original compromised application is mediated.” says the IT giant.

An attacker who added their own credentials to a trusted application before you revoked access still has a working key. Reviewing all service principal credential additions since at least October 1 is the right starting point, not October 15 when the public breach was announced.

ARTEX is not a tool used only by Storm-0940. Microsoft says threat actors in several regions have used the same framework. Originally open-source, ARTEX was written in Go and can use different AI models to plan and carry out tasks. Researchers at Zscaler and Recorded Future also found a Chinese-speaking group using it to target South Korean financial institutions. The setup used DeepSeek, GLM, and Grok as coordinated AI agents, with GLM checking DeepSeek’s work. After these attacks became public, the project went closed-source. However, anyone who already has a copy can still use it.

The speed point is what Microsoft keeps coming back to in its report. Agents don’t take weekends, don’t sleep, and can run multiple attack paths simultaneously.

“This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially.” Microsoft concludes. “Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises.”

When Storm-0940 had valid application credentials, they didn’t have to iterate slowly. They hit 2,250 tenants with 2,900 sign-in attempts per minute, a pace at which manual detection and response simply can’t keep up.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ARTEX)

F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication.

Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, critical vulnerabilities tracked as CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests.

Under certain conditions beyond their control, an unauthenticated attacker could exploit the security flaws to trigger a buffer overflow leading to a restart. If ASLR is disabled or can be bypassed, the attacker could achieve RCE.

The flaw CVE-2026-15176 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code by sending crafted HTTP requests. The vulnerability occurs under specific configurations involving the alias directive and the $request_filename variable. Remote code execution may be possible if ASLR is disabled or bypassed.

The flaw CVE-2026-93479 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code through crafted HTTP requests. It affects specific configurations where regular-expression capture variables from the map directive are referenced before the map output variable, or where a non-cacheable variable is used in a string expression under certain conditions. Remote code execution may be possible if ASLR is disabled or bypassed.

The third critical flaw fixed by the vendor, tracked as CVE-2026-97205 (CVSS score of 9.2), is a use-after-free vulnerability in NGINX ngx_http_core_module that, under certain configurations with asynchronous file I/O (AIO) enabled, may cause memory corruption or unexpected worker process termination when processing Server Side Includes (SSI) pages containing include virtual commands. A remote attacker could exploit the flaw to cause a denial-of-service (DoS) or potentially execute code, particularly when ASLR is disabled or can be bypassed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, NGINX)

Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia.

Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia.

The targets include the Orsk Oil Refinery in southern Russia, about 25 kilometers from the Kazakhstan border, and the government of Nizhny Novgorod, a major city about 425 kilometers east of Moscow. The city lies where the Volga and Oka rivers meet, an important waterway system connected to the Caspian Sea. This target may be significant because Kazakhstan depends on the Caspian basin.

The group has been running targeted intrusion campaigns against government bodies, diplomatic missions and civil society organizations across Central Asia since at least 2024.

“Silent Lynx (overlapping with activity tracked as UAT-6275 by Cisco Talos and as TAG-193 by Recorded Future) is a persistent threat actor that has conducted targeted intrusion campaigns against government ministries, diplomatic missions and civil society organizations across Central Asia since at least 2024.” the paper states. “The group maintains a strong focus on high-value public sector organizations in the Commonwealth of Independent States (CIS), frequently leveraging spear-phishing campaigns conducted through compromised government email accounts and malware staging through trusted public services such as GitHub to increase credibility and infection success rates.”

The group overlaps significantly with clusters previously documented under names like YoroTrooper, ShadowSilk, and Hydra Saiga, all pointing at the same underlying activity.

The toolkit is deliberately lightweight: PowerShell-based reverse shells, proprietary shells written in C++, C#, and Go, commodity tunneling tools, and spear phishing emails sent through compromised government email accounts in Tajikistan and Kyrgyzstan to add credibility. GitHub, Telegram, and hijacked legitimate servers all serve as staging platforms. Nothing about it is technically flashy, which is part of why the group has stayed active for years without much public attention.

The researchers found links that go beyond technical evidence. In March 2026, a Tajik government agency contacted a Silent Lynx server, shortly after Kazakhstan’s lower house of parliament ratified a Treaty on Allied Relations with Tajikistan. In early April, a Belarusian government entity appeared on the same infrastructure, about a week before Kazakhstan’s president met with the Belarusian foreign minister in Astana. These links do not prove the reasons behind the activity, but the researchers highlight them in their paper, and they are difficult to ignore.

The connection to the Orsk refinery also has a clear context. A Ukrainian drone attack in August forced the refinery to shut down for months. Russia had already asked Kazakhstan to help make up for the resulting loss of refining capacity. If a Kazakhstan-linked actor was collecting intelligence on Russian energy infrastructure at that time, it could have been assessing the economic impact or trying to understand how the disruption might affect Kazakhstan’s own export pipelines. The researchers stress that they do not have enough evidence to identify a specific motive. However, they present the facts and let readers draw their own conclusions.

“A sample compiled in August 2025 was observed using a document titled Деловое предложение о сотрудничестве между ГК «Туркменнебит» и руководством Орского НПЗ (translated: Business proposal on cooperation between State Concern ‘Turkmennebit’ and the management of Orsk Refinery) (see Figure 11). We assess that this sample may be targeting Russia’s critical energy infrastructure, given the close integration of the Russian BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE SHEN & VÖGELE 10 VIRUS BULLETIN CONFERENCE OCTOBER 2026 and Kazakh energy sectors.” continues the report. “The document outlines proposals for developing mutually beneficial cooperation, with a particular focus on the exchange of expertise, technologies, and industry best practices. It is worth noting that the author of this PDF file is ‘pickle rick’ and the document was created just one hour after the payload was compiled. The name ‘pickle’ is aligned with the name ‘pickl’ we observed in the PickleShell PDB string3.”

What gave the group away wasn’t a sophisticated interception, it was their own operational sloppiness. They left open directories exposed on public servers containing live tooling, staged payloads, and one very incriminating shell command history showing keyboard input typed in Latin with a Russian keyboard layout active, so “whoami” came out as “црщфьш.” GitHub commit timestamps across 77 commits fit working hours in Astana, Kazakhstan, at 95 percent, compared to only 51 percent if you plot them against Moscow time. Administration connections to Silent Lynx servers came from ProtonVPN egress IPs geolocated to Kazakhstan, exclusively on weekdays between 7 AM and noon local time.

The group’s servers were also being reached from those VPN addresses, which Proton typically assigns based on geographic proximity. Two malware samples were uploaded to VirusTotal from Kazakhstan within minutes of compilation, which is classic anti-detection testing behavior and points to the operator location directly.

“We identified several additional indicators that strengthen the assessment of a Kazakhstan-based origin. The first derives from what appears to be malware detection-testing activity conducted through VirusTotal.” continues the report. “Two samples showed this pattern: an early Chvost sample12 was uploaded to VirusTotal only 86 seconds after compilation, while a second sample13 was uploaded approximately four minutes after compilation. Both samples were uploaded from Kazakhstan, and the same uploaders had submitted additional tools that were later observed in Silent Lynx campaigns.”

A researcher at Johns Hopkins School of Advanced International Studies told Reuters that the case highlights an important point: cyber espionage is no longer the domain of a few major powers. Smaller countries are also developing their capabilities and running long-term operations against neighboring states, often driven by serious geopolitical interests.

Silent Lynx is also becoming more technically advanced. In April 2026, the group used an exploit for the first time to deliver malware. It abused a WinRAR path traversal flaw (CVE-2025-8088) to place malicious files directly in the Windows Startup folder, without requiring victims to enable macros. The group also stored a public proof of concept for a FortiWeb authentication bypass vulnerability on its own command-and-control (C2) server. Researchers have also found signs of growing interest in Linux systems. After relying mainly on social engineering for two years, Silent Lynx appears to be building a more advanced set of attack tools.

Full joint Virus Bulletin paper with full indicators of compromise, malware hashes, and infrastructure details is available here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SILENT LYNX)

Citrix patched CVE-2026-107406, a critical NetScaler ADC and Gateway flaw that could allow remote code execution or denial-of-service attacks.

Citrix has released security updates to fix CVE-2026-107406 (CVSS score of 9.5), a critical flaw affecting NetScaler ADC and NetScaler Gateway that could allow remote code execution or denial-of-service (DoS) under certain conditions.

The vulnerability is caused by a memory overflow. The company says its impact depends on the system’s configuration and could allow attackers to run code remotely or disrupt services.

“CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial of service under specific configuration conditions. The issue carries a CVSS v4.0 base score of 9.5 and is rated Critical.” reads the report published by Citrix. “We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible. As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability. “

At this time, Citrix is not aware of attacks in the wild exploiting this vulnerability.

The following versions address the vulnerability:

• Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.46  and later releases
• Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.29  and later releases of 13.1
• Citrix NetScaler ADC 14.1-FIPS 14.1-73.46 FIPS and later releases of 14.1-FIPS
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283 and later releases of 13.1-FIPS and 13.1-NDcPP

Citrix NetScaler ADC and NetScaler Gateway are vulnerable only if they meet the following conditions: the device must be configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP), depending on the software version.

Customers can check their NetScaler configuration to see whether the appliance is set up as a SAML Service Provider (SP) or Identity Provider (IdP).

Look for one of the following entries in the configuration:

• SAML Service Provider (SP): add authentication samlAction
• SAML Identity Provider (IdP): add authentication samlIdPProfile

Check the Affected Versions section above for the specific requirements for each software version.

Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, and Maxim Suhanov reported the vulnerability to the vendor.

Recently, the company confirmed active exploitation of two other flaws, respectively tracked as CVE-2026-88771 (CVSS score of 9.5) and CVE-2026-88772 (CVSS score of 9.5), on unpatched systems and urged customers to install the relevant updates as soon as possible.

This week, CISA added the flaw CVE-2026-88779 to its KeV catalog. The issue is a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that can cause denial-of-service under specific conditions. It affects certain customer-managed deployments running vulnerable versions.

“CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to denial-of-service under specific deployment conditions,” reads the advisory. “The issue affects customer-managed NetScaler deployments running affected supported versions when the required preconditions are met.”

Successful exploitation requires NetScaler ADC or Gateway to be configured as a SAML service provider (SP) or identity provider (IdP). Customers can check their configuration for the relevant SAML settings.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Citrix)

CrowdStrike analyzes open directories left by an attacker who used the ARTEX AI pentest tool and LLMs to breach South Korean financial firms.

CrowdStrike published a research on a campaign against South Korean financial organizations that ran from late September to early October 2026 and ended with stolen data. The attacker left their working notes where anyone could read them.

Open directories on servers controlled by the attacker exposed Claude Code session histories, ARTEX configuration files, and Claude memory files. Researchers could see how the operator worked, prompt by prompt. That is rare, and it makes this report particularly interesting.

“Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor’s operational methodology and tooling.” reads the report published by CrowdStrike. “The use of agentic AI tooling alongside traditional offensive capabilities highlights the continued evolution CrowdStrike has observed in adversarial tradecraft.”

ARTEX is a recently released open-source tool from China that allows AI agents to run penetration tests on their own. The attacker combined it with large language models. CrowdStrike has not linked the activity to a specific group, but it has moderate confidence that the operator is Chinese-speaking and financially motivated, based on the tool used and the Chinese-language prompts.

Industry reports describe several South Korean financial organizations breached since late September. At one bank, the attacker reportedly got into a loan progress inquiry service used by financial brokers. At another, they compromised an employee mobile work-support system. Nobody has confirmed how many organizations were hit.

Investigators connected the dots through overlapping IP addresses and references to the string ARTEX in HTML files on a server the attacker reportedly controlled. One address, 38.244.50[.]120, hosted an ARTEX instance and an open directory. Inside sat a Claude Code markdown file with a Chinese-language pentesting prompt that told the model how to run its tests.

“The IP address 38.244.50[.]120 was associated with the activity described and hosted an ARTEX instance and open directory containing a Claude Code markdown document at http[:]//38.244.50[.]120:18899/.claude/CLAUDE.md.” continues the report. “The markdown document contained a Chinese-language pentesting prompt that specified how the LLM should conduct pentesting activities.”

That file also pointed to a Hong Kong IP address, and that server held more open directories with session histories, configuration files and memory files. The files show the operator going after Korean financial targets with ARTEX and LLMs across those weeks, and the targets match the ones in industry reporting.

The sessions reveal a two-server setup. The Hong Kong address is the attacker’s main infrastructure, and 38.244.50[.]120 runs the ARTEX instance likely behind the Korean attacks. DeepSeek v4.1-flash served as the main model, with GLM-5.3 from Zhipu AI and Grok 4.6 added for extra sessions. The operator probably reached DeepSeek through a reseller, xcai[.]pro, and used nine proxy addresses that CrowdStrike lists in its report.

“Analysis of Claude Code sessions showed the threat actor also used the following proxy IP addresses during the ARTEX-related activity:

• 101.53.80[.]20
• 205.214.59[.]31
• 124.155.252[.]63
• 154.201.79[.]246
• 23.248.249[.]90
• 23.158.220[.]98
• 103.248.148[.]84
• 203.160.133[.]172
• 209.209.85[.]38

In addition to conducting ARTEX-related operations, the threat actor asked Claude where threat actors typically sell Korean data breach information and asked Claude for assistance in finding Korean Telegram data sales groups.” reads the report.

Exfiltration was only the first step. The stolen data was already being prepared for sale.

In one session, the user asked Claude to write a security researcher résumé with bullet points describing the ARTEX results. The prompt also included personal details. The same Telegram username appeared in sessions involving a Telegram-based NFT gift marketplace and the targeting of what may have been a Chinese payment platform. CrowdStrike says the details likely belong to the operator, but it cannot confirm the link. Given that uncertainty, those details should not be included in a news article.

According to The Hacker News, ARTEX’s developer, Autumn-27, has since closed the source and stopped updates, saying the tool was built for learning and research and that the attacks have nothing to do with the project. Copies already in circulation don’t disappear with a license change.

CrowdStrike says this activity shows how AI tooling can let a financially motivated actor run several intrusions in a short time.

“The use of agentic AI tooling alongside traditional offensive capabilities highlights the continued evolution observed by CrowdStrike in adversarial tradecraft. This activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span.” concludes the report. “CrowdStrike Intelligence assesses that adversaries will likely continue to experiment with implementing AI tooling in their operations to enhance their operational tempo and capabilities.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ARTEX)

Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands.

The lure is the now-familiar ClickFix technique, dressed up as Cloudflare’s standard bot check. The fake page asks you to run a command, supposedly to confirm you’re not a bot, and that command quietly downloads and installs an MSI package from an attacker-controlled server. There’s no bot to fool here, you’re the one being fooled.

“In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers. When visiting such a site, the user was shown a fake Cloudflare verification page, which, under the pretext of confirming that the visitor was a human, offered to execute a command.” reads the report published by the Ukraine CERT-UA. “Executing the command resulted in downloading and installing an MSI package from a remote server (ClickFix technique).”

What makes this campaign interesting is how the attackers control it. The domain used for the fake page and the script’s settings are stored in a smart contract on the Polygon or Ethereum blockchain. The script checks the contract each time it runs, so the attackers can change the domain or turn the attack on and off without changing the compromised websites. In effect, they are using the blockchain as a remote control that is difficult to take down.

The script has three modes: off, silent visitor tracking, and the full fake verification page. The attack mode only targets Windows users who arrive through search engines, and it will show the fake page no more than twice within 12 hours for the same visitor. This is clearly designed to keep the campaign quiet and make it harder to spot through unusual traffic patterns.

CERT-UA pulled apart three separate MSI variants used in the campaign. The first just installs the stealer directly. The second is more elaborate, trying to slip past Windows User Account Control, carving out Microsoft Defender exceptions, and deploying a vulnerable AMD driver to exploit CVE-2023-20598, a bring-your-own-vulnerable-driver (BYOVD) move that blinds security tools before the real payload drops.

The third variant skips the driver abuse entirely and uses DLL side-loading instead, tricking a legitimate executable into loading a malicious library that decrypts and launches the stealer. Three different paths, the same room goal. CERT-UA names that payload LunexStealer.

LunexStealer isn’t just a credential grabber, it doubles as a remote execution tool, able to download and run executables, MSI packages, PowerShell scripts, and raw commands on demand. Depending on what configuration it pulls from its command server, it can also install a browser extension called LUNARAXE, disguised under the name “Microsoft Office Word Editor” so it blends into a list of legitimate-looking add-ons.

That extension steals cookies, browsing history, and anything typed into a web form, and gives the attacker live remote control over the browser itself.

“Depending on the configuration received from the control server, LUNEXSTEALER can install a malicious browser extension called LUNARAXE, which appears in the browser under the name “Microsoft Office Word Editor”.” continues the report. “The extension steals cookies, browsing history, and credentials entered into web forms, and also allows attackers to remotely control the browser: execute JavaScript code on web pages, manage tabs and take snapshots of them, and change proxy server settings. If the NAIVEMESS auxiliary component is present, the extension also gains access to the computer’s file system.”

There’s a file system access layer too, a PowerShell component called NAIVEMESS that CERT-UA says registers itself as a legitimate browser-to-system messaging host, letting the extension read, write, and launch files on the victim’s machine.

CERT-UA’s advice is simple: a real security check will never ask you to open the Run window, Command Prompt, or PowerShell and paste a command. If a website asks you to do that, close it, even if the site looks familiar.

For system administrators, CERT-UA recommends additional controls, such as restricting Win+R with Group Policy, limiting who can install MSI files, and blocking known vulnerable drivers.

Full CERT-UA advisory with indicators of compromise and the complete malware breakdown is available here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, LunexStealer)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Citrix NetScaler flaw tracked as CVE-2026-88779 (CVSS score of 8.7), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that can cause denial-of-service under specific conditions. It affects certain customer-managed deployments running vulnerable versions.

“CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to denial-of-service under specific deployment conditions,” reads the advisory. “The issue affects customer-managed NetScaler deployments running affected supported versions when the required preconditions are met.”

Successful exploitation requires NetScaler ADC or Gateway to be configured as a SAML service provider (SP) or identity provider (IdP). Customers can check their configuration for the relevant SAML settings.

Below are the impacted versions:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41 
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28 
• NetScaler ADC FIPS before 14.1-73.41 FIPS 
• NetScaler ADC FIPS and NDcPP before 13.1-37.282 

Citrix says it has observed targeted attacks against unpatched deployments that can cause denial of service. Repeated exploitation may keep the affected service unavailable, but Citrix has not identified any impact on customer data integrity.

“Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service. If the condition is triggered repeatedly, the service may remain unavailable.” continues the advisory. “Our analysis indicates that this issue affects service availability, and we have not identified an impact on the integrity of customer data. Citrix strongly urges all customers to install the latest versions as soon as possible.”

The company urges customers to install the latest versions as soon as possible. Exposure depends on the deployment configuration, particularly whether NetScaler uses SAML with Gateway or AAA functionality. Customers should check their configurations for SAML authentication settings, including add authentication samlAction for a SAML service provider or add authentication samlIdPProfile for a SAML identity provider. The bulletin applies only to customer-managed NetScaler ADC and Gateway deployments; Citrix-managed cloud services have already been updated.

The following versions fix the issue:

• NetScaler ADC and NetScaler Gateway 14.1-73.41 and later releases
• NetScaler ADC and NetScaler Gateway 13.1-64.28 and later releases of 13.1
• NetScaler ADC 14.1-FIPS 14.1-73.41 FIPS and later releases of 14.1-FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later releases of 13.1-FIPS and 13.1-NDcPP

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 7, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.

Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.

CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service, and it affects appliances with DTLS enabled. That’s particularly relevant for NetScaler Gateway because DTLS is enabled by default for VPN virtual servers unless an administrator has explicitly disabled it.

The bug is triggered during the appliance’s first handshake, before any login is required. NetScaler’s packet engine processes incoming DTLS traffic to set up the encrypted connection. A specially crafted or fragmented header can corrupt its memory, allowing an attacker to run arbitrary code with root privileges on the underlying FreeBSD system, without needing any credentials.

There are also signs of a successful attack in the logs. You may see an SSL handshake failure using DTLSv1.0 with the message “Handshake failure-Internal Error.” At the same time, the packet engine process crashes and the appliance’s watchdog fails to restart it. If these events happen close together, they could indicate that the exploit was successfully triggered.

“While Google Threat Intelligence Group does not possess exploit code, analysis of frontline telemetry suggests that transmitting specially malformed or fragmented record headers induces heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform.” reads Google’s report. “Successful exploitation attempts generated two log artifacts:

0-PPE-0 : default SSLLOG SSL_HANDSHAKE_FAILURE 0 : SPCBId - ClientIP - ClientPort - VserverServiceIP - VserverServicePort 443 - ClientVersion DTLSv1.0 - CipherSuite "TLS1-AES-256-CBC-SHA" - Session New - Reason "Handshake failure-Internal Error""

Once inside, the attacker’s first move is installing a web shell, and the installation trick itself is worth appreciating for its pettiness. In some intrusions, the attacker edited the appliance’s Apache config to treat .deb files as executable PHP scripts, then dropped a web shell wearing that fake extension. Nobody expects a Debian package to run code, which is exactly the point.

A stealthier version does the same trick with .sig files instead, and adds a redirect so that a request for a harmless looking .ico icon file actually gets served by the hidden PHP shell. Someone requesting /vpn/media/e6ee7c85.ico unknowingly triggers e6ee7c85.sig. Mandiant even noticed some of these requests returning a normal-looking 404 error while taking unusually long to process, which is the kind of detail that only stands out once you know to look for it.

Getting root access the first time is easy because the exploit already runs with root privileges. To keep that access for future web requests, the installer makes /bin/sh setuid, so commands run through the shell continue to run as root.

It then forces a full reboot of the appliance to make sure the changes stay in place. Simple, effective, and a pretty clever way to make the compromised system keep giving the attacker root access.

The two custom tools doing the real work are called WHIPSHOT and SLAPSHOT, and Mandiant hadn’t seen either before.

“Following successful exploitation, the initial web shell payload self-installs by modifying target httpd.conf files, configuring the system to treat specified non-script file types as executable PHP scripts, setting the stage for the deployment of additional custom malware including WHIPSHOT (a PHP web shell) and SLAPSHOT (a Python proxy/tunneler).” states the report.

WHIPSHOT is the PHP web shell, disguised as a Debian package, that reads commands hidden inside sequential HTTP header fields, decodes them from Base64, and forwards them over a local loopback connection. It also quietly kills its own error reporting and always answers with a 404, so a scan of the web server logs shows nothing unusual on the surface.

SLAPSHOT is what lets the attacker move beyond the compromised appliance. It creates a simple Python proxy that opens a local port and forwards TCP traffic into the internal network.

In one confirmed attack, the attacker used it to explore the network and look for credentials. The connection started from an internet-facing gateway, giving the attacker a tunnel into the internal network.

SLAPSHOT even cleans up after itself if nobody’s using it, closing idle sessions after 15 minutes and shutting itself down entirely after 10 minutes with no activity, deleting its own port and lock files on the way out. That’s not laziness, that’s someone who’s thought about what a forensic analyst would go looking for and decided not to leave it lying around.

This is not a new problem. Edge devices such as VPN gateways, load balancers and firewalls are often targeted because they are exposed to the internet, are usually outside standard endpoint security tools, and may contain credentials that provide access to the internal network.

Mandiant recommends patching to the fixed versions first. Isolating a remote-access gateway can cause major disruption. If patching is not immediately possible, disabling DTLS and blocking inbound UDP/443 can stop this specific attack path, but it does not protect against the second zero-day.

If an appliance may have been compromised, assume that all credentials it handled are exposed. This includes admin accounts, SSH keys, TLS certificates, LDAP and RADIUS credentials, and other secrets used to access internal systems. Rotate them after the appliance has been patched, not before.

“This campaign underscores the continued targeting of edge devices to gain initial access to victim networks, a trend that GTIG has tracked across a range of threat actors. Notably, these vulnerabilities made up about half of the enterprise-related zero-days in 2025.” contludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Citrix NetScaler)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-88771 (CVSS score: 9.5) Citrix NetScaler Improper Input Validation Vulnerability
• CVE-2026-88772 (CVSS score: 9.5) Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-88771 (CVSS score: 9.5) is a remote code execution vulnerability caused by improper input validation that could allow an unauthenticated remote attacker to execute arbitrary commands. The flaw affects all NetScaler ADC and NetScaler Gateway deployments in their default configuration and does not require any additional features to be enabled.

CVE-2026-88772 (CVSS score: 9.5) is a memory buffer overflow vulnerability that could allow remote code execution or cause a denial-of-service condition. The flaw affects NetScaler ADC and NetScaler Gateway deployments with DTLS enabled, which is enabled by default on VPN vServers. The vulnerability is classified as CWE-119.

This week, Citrix confirmed that the two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway were exploited before the company released patches. The flaws allow remote code execution, meaning attackers can potentially take control of affected appliances. The first warnings did not come from Citrix. On September 26, administrators said IT providers and security teams were privately advising them to take NetScaler systems offline, sometimes without explaining why.

The two zero-day issues are not related to NetScaler vulnerabilities CVE-2026-19490 and CVE-2026-19489 that were disclosed in August.

The reports show how the attacks were already underway while defenders were still waiting for official details and fixes.

Security researchers at watchTowr then confirmed that the reports were credible. The company said it was investigating reports of multiple unpatched NetScaler remote code execution flaws being exploited in the wild and later said the vulnerabilities had been found during forensic investigations.

“We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible,” watchTowr wrote on X.

The Dutch National Cyber Security Centre also sent a pre-notification to organizations in the Netherlands. According to a notice seen by BleepingComputer, a European partner CERT had shared information about two critical NetScaler zero-days that could allow remote code execution. One of the flaws could even let an attacker inject shellcode directly into memory.

Both vulnerabilities have been fixed in the following NetScaler releases:

• Citrix NetScaler ADC and NetScaler Gateway 14.1-73.37 and later
• Citrix NetScaler ADC and NetScaler Gateway 13.1-64.23 and later
• Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later

CISA said it has received reports and threat intelligence confirming that attackers are actively exploiting the vulnerabilities worldwide.

“CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally. Because updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.” reads the advisory published by CISA. “Given the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories.”

CISA also noted that updating NetScaler appliances can be complex and may require downtime. The alert is intended to help organizations assess their exposure, prioritize mitigation and include the vulnerabilities in their risk management plans.

Citrix has also released generic indicators of compromise (IoCs) through NetScaler Console. These can help customers check whether their systems may have been compromised.

If a compromise is suspected, Citrix recommends taking the following steps:

• Preserve evidence from the NetScaler ADC VPX instance.
• Isolate the device.
• Revoke credentials and access.
• Check connected servers and systems for signs of further compromise.
• Rebuild the device and update it to the latest firmware.
• Rotate local account passwords and Key Encryption Keys (KEK), and replace restored SSL certificates when recovering from a known-good backup.
• Harden the device according to Citrix security best practices.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by September 30, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Citrix confirmed two critical NetScaler zero-days were exploited before patches were available, with attackers able to remotely execute code.

Citrix confirmed that two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway were exploited before the company released patches. The flaws allow remote code execution, meaning attackers can potentially take control of affected appliances. The first warnings did not come from Citrix. On September 26, administrators said IT providers and security teams were privately advising them to take NetScaler systems offline, sometimes without explaining why.

The two zero-day issues are not related to NetScaler vulnerabilities CVE-2026-19490 and CVE-2026-19489 that were disclosed in August.

The reports show how the attacks were already underway while defenders were still waiting for official details and fixes.

Security researchers at watchTowr then confirmed that the reports were credible. The company said it was investigating reports of multiple unpatched NetScaler remote code execution flaws being exploited in the wild and later said the vulnerabilities had been found during forensic investigations.

“We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible,” watchTowr wrote on X.

The Dutch National Cyber Security Centre also sent a pre-notification to organizations in the Netherlands. According to a notice seen by BleepingComputer, a European partner CERT had shared information about two critical NetScaler zero-days that could allow remote code execution. One of the flaws could even let an attacker inject shellcode directly into memory.

That warning has now become a confirmed security incident.

Citrix published fixes for the two exploited vulnerabilities on September 27, along with patches for six other security issues. The company confirmed that both NetScaler flaws had been exploited against systems that had not been mitigated, although it hasn’t said how many organizations were affected, who was behind the attacks or when exploitation started.

“Citrix has released updates for NetScaler ADC and NetScaler Gateway to address multiple security vulnerabilities. These vulnerabilities vary by deployment configuration and enabled features, and include issues that could allow remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction under specific conditions.” reads the advisory. “Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible. “

Citrix confirmed active exploitation of CVE-2026-88771 (CVSS score of 9.5) and CVE-2026-88772 (CVSS score of 9.5) on unpatched systems and urged customers to install the relevant updates as soon as possible.

“Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible.” Continue the advisory.

The first vulnerability, CVE-2026-88771, involves improper input validation and allows an unauthenticated attacker to execute arbitrary commands, and Citrix says it affects all NetScaler ADC and NetScaler Gateway deployments in the affected versions without requiring an additional feature to be enabled.

The second flaw, CVE-2026-88772, is a memory overflow that can lead to remote code execution or denial of service, and it affects appliances with DTLS enabled. That’s particularly relevant for NetScaler Gateway because DTLS is enabled by default for VPN virtual servers unless an administrator has explicitly disabled it.

NetScaler sits at a particularly sensitive point in many corporate networks. These appliances provide VPN and remote access, load balancing and authentication, so compromising one can give an attacker a useful position at the edge of an organization.

Citrix’s fixes are available in NetScaler ADC and Gateway 14.1-73.37 and later, and in the 13.1-64.23 and later releases. Fixes are also available for the 14.1-FIPS, 13.1-FIPS and 13.1-NDcPP branches.

There’s an important detail for organizations that patched NetScaler last month. The builds 14.1-73.32 and 13.1-63.21, which fixed the previously disclosed authentication-bypass vulnerability CVE-2026-19490, are still within the affected range for these new flaws. Installing those earlier builds doesn’t address the two newly disclosed vulnerabilities.

The 13.1 branch also deserves attention because that release line reached End of Maintenance on September 15. The new security fix still covers it, but organizations running that branch should factor its maintenance status into their upgrade planning.

But patching the two zero-days is only half the job.

Citrix is providing generic Indicators of Compromise (IoCs) through NetScaler Console to help customers quickly assess whether their NetScaler deployments may have been compromised.

The feature is available in NetScaler Console service and on-premises deployments with Cloud Connect, starting with version 14.1-73.36, and requires the telemetry channel to be enabled. Customers can launch scans from the Security Advisory page once the IoC detection logic is released. Those without NetScaler Console can contact Citrix Support for access and assistance. Citrix warns that the IoCs do not cover all attacker techniques and may miss compromises, so experienced forensic investigators should be involved when needed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Kosovo national Ardit Kutleshi pleaded guilty to running Rydox, a cybercrime marketplace that sold stolen identities and credentials for years.

Ardit Kutleshi, 28 years old and a citizen of Kosovo, pleaded guilty last week to building and running the cybercrime marketplace Rydox.

The Rydox marketplace has been active since February 2016; it facilitated over 7,600 sales of stolen PII, access devices, and cybercrime tools, generating $230,000 since 2016. It offered over 321,000 products to 18,000 users, including names, social security numbers, and hacking tools. Thousands of U.S. victims were affected.

“According to court documents, since at least 2016, Rydox conducted over 7,600 transactions involving stolen personally identifiable information (PII), stolen access devices, means of identification, and cybercrime tools and services, receiving at least $232,000 in revenue.  These transactions involved the sale of PII stolen from victims located in the United States.” reads the DoJ’s press release. “Kutleshi pleaded guiltyin the District Court for the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy. “

The U.S. authorities seized the Rydox domain in 2025, a coordinated operation by the FBI and Royal Malaysian Police seized servers in Kuala Lumpur, Malaysia, that hosted the illicit marketplace. The US authorities also seized $225,000 in cryptocurrency.

Kutleshi did not run Rydox alone. His brother, Jetmir, also helped operate the marketplace. He pleaded guilty separately and was sentenced in December 2025 before being deported to Kosovo.

Both brothers have now pleaded guilty in US federal court for their roles in running the same criminal marketplace, bringing the case to a close after an investigation that involved several countries.

The FBI arrested Kutleshi in Kosovo in December 2024, seized the Rydox.cc domain at the same time, and extradited him to the US in 2025. Coordination on this case included Kosovo’s Special Prosecution Office and Cybercrime Investigation Directorate, Albania’s anti-corruption body, and Malaysia’s Royal Police and Attorney General’s office, which is a genuinely international lineup for what was, at its core, a website selling other people’s information.

Kutleshi pleaded guilty in the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy. He faces a mandatory minimum of two years on the identity theft count and up to 20 years on the money laundering charge. Sentencing is scheduled for February 9, 2027.

The FBI’s cyber division assistant director put the harm in plain terms. Rydox, he said, put

“Cybercriminals Ardit Kutleshi and his brother Jetmir — who pleaded guilty and was sentenced in December 2025 prior to his deportation back to Kosovo — operated the Rydox marketplace for their own gain, making hundreds of thousands of dollars from the marketplace where cyber criminals could purchase information and tools to effect and further their online crime,” said U.S. Attorney Troy Rivetti of the Western District of Pennsylvania. “These types of cybercrimes cause not only financial loss, but also ongoing psychological harm to the victims who lose both money as well as trust in institutions and the online market infrastructure. Our office will continue to work with our law enforcement partners to find and prosecute individuals who attempt to profit from the illegal sharing and sale of other people’s personal information and access devices, and related cybercrime.”

That second part is easy to undercount. Identity theft isn’t a one-time event that ends when the fraudulent charge gets reversed. It follows people through credit checks, background checks, and account recovery processes for years, and the damage to how someone trusts systems they have to keep using is harder to quantify than the dollar figure prosecutors cite in press releases.

The Justice Department’s Criminal Division said that, since 2020, its Computer Crime and Intellectual Property Section has secured convictions against more than 180 cyber and intellectual property criminals. Courts have also ordered the return of more than $350 million to victims.

Kutleshi’s case adds to those figures. His extradition from Kosovo also shows that operating outside the United States does not necessarily protect cybercriminals from US prosecution.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)

Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials.

Psychedelic Stealer is being distributed through compromised Ukrainian business websites. Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen to visitors. The affected sites included a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller, a psychological facility, a tool retailer, and an automotive retailer.

These were legitimate businesses with established social media profiles and third-party listings. Visitors were therefore directed to a trusted website they may have visited before, making the fake Cloudflare CAPTCHA harder to recognize.

That’s the core of what makes this campaign uncomfortable to dismiss. Visitors didn’t stumble onto an obvious fake domain. They landed on a site they may have visited before, for a business they already had some reason to trust, and got served a fake CAPTCHA instead of the page they were looking for.

The fake verification page imitates Cloudflare, complete with a randomly generated “Ray ID” in the footer and a fixed “visitor identifier” in the agreement text. Both look like the kind of tracking and authentication markers Cloudflare actually uses, and neither one means anything here.

“The page footer displays a randomly generated hexadecimal “Ray ID.” Cloudflare assigns a legitimate Ray ID to each request that passes through its network, but the value displayed by this lure is not evidence that Cloudflare performed the verification.” reads the report published by ArticWolf. “The agreement text also contains a fixed “visitor identifier.” Both identifiers imitate familiar verification and tracking elements, making the page appear more legitimate without providing evidence of an authentic Cloudflare verification. Put simply, all of this is fake; window dressing to fool the site visitor.”

The page is written in Ukrainian, which fits the target audience, but its HTML carries Russian-language comments and the document declares lang=”ru,” a detail that tells you something about who built it even if it doesn’t confirm nationality or location.

When the victim clicks the fake CAPTCHA, the page silently copies a Windows Installer command to the clipboard. It then tells the user to press Windows+R, paste the command and press Enter. There is no PowerShell involved, which can help the attack bypass security controls focused on detecting malicious PowerShell activity. Instead, the command directly launches msiexec.exe. It also includes the fake Cloudflare verification text, making the command in the Run window look like part of the verification process.

The downloaded MSI file then installs a 64-bit executable called psychedeliclove.exe, which Arctic Wolf Labs tracks as Psychedelic Stealer. The malware targets saved passwords from browsers such as Chrome, Edge, Brave, Opera, Opera GX, Vivaldi and Yandex. It also steals browser account tokens and targets cryptocurrency wallets, including Exodus, Atomic Wallet, Electrum, Bitcoin Core and Litecoin Core.

Beyond the one-time credential grab, the implant installs browser components and sets up a native messaging bridge that lets deployed browser content communicate with a local process on the machine. It creates a scheduled task for persistence named psychedelicloveUtils, profiles the host in detail including antivirus status and installed browsers, and then starts polling its command-and-control server for additional tasks. As Arctic Wolf Labs puts it:

“The implant tracks task state in executed_tasks.json, downloads attachments into downloads\<taskid>_<filename>, and supports EXE, COM, BAT, CMD, MSI, and PowerShell files.” states the report. “This gives operators a route to introduce additional code after installation.”

Which means whoever’s behind this isn’t necessarily done with a compromised machine after the initial credential sweep. The remote tasking capability supports EXE, COM, BAT, CMD, MSI, and PowerShell payloads, so the initial infection is better understood as a foothold than a finished operation.

The campaign also uses a management panel called “РУБЛЁВКА TDS” (Rublevka TDS), a name referring to the wealthy Rublevka area near Moscow. The panel allows the attackers to control the Windows Installer command delivered by each compromised website. This means they can change the payload URL from one place without modifying every infected page.

The panel also tracks how visitors interact with the fake CAPTCHA. It records when the page is opened, when the CAPTCHA is clicked and when the user presses the Done button.

The Done button remains disabled for about 35 seconds after the command is copied. The delay has no technical purpose. It simply gives victims enough time to follow the instructions and run the command, adding another layer of social engineering to the attack.

At collection time the panel showed 557 views, 426 clicks, and 79 complete events across 32 countries. Ukraine accounted for 446 of those views and 351 of the clicks, which combined with Ukrainian-language instructions and Ukrainian business websites makes the targeting intent about as clear as it gets. The panel labeled its complete events as “executions” and calculated a conversion rate from them, which Arctic Wolf correctly points out overstates actual confirmed compromises, since a complete event only means someone clicked Done in the browser, not that they ran anything.

The domain at the center of this, uasputnik[.]com, was registered September 9, 2026, updated three and a half hours later, and associated with lure URLs appearing on September 12 and 13. The whole operational window from registration to observed delivery fits inside a week.

For defenders, there are several useful indicators to monitor. Network traffic to uasputnik[.]com, followed by a request to admin777111777.php, could indicate an early stage of the attack. A later-stage sign is traffic to 193.178.159[.]128:8080, particularly requests to /api/v1/agent/ and /api/v1/ext/ with an X-API-Key header.

These indicators should be investigated together with file creation and process execution events to confirm whether a system has been compromised.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

Blackpoint uncovers ChainScript, a Node.js RAT that queries a Polygon smart contract to find and rotate its command server.

Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript. The malicious code is a previously undocumented Node.js remote access trojan that hides its command server on a public blockchain.

The infection starts with a familiar ClickFix trick. The victim gets talked into pasting and running a command that fires up msiexec.exe, which pulls down an installer dressed up as Spotify. Inside that installer sits a full Node.js runtime and a JavaScript agent ready to launch.

Once it runs, the installer scatters its pieces across folders with Microsoft-sounding names, blending into the rest of the system. A hidden PowerShell script kicks off a VBScript file, which then starts the bundled Node.js runtime. None of this needs admin rights, since the installer is set to run entirely within the user’s own profile.

The main part of the malware is contained in a single file: app\src\index.js. This file does almost everything. It handles the configuration, collects information about the infected computer, finds the command server, manages WebSocket connections, runs commands, updates the malware and cleans things up. The other components, including the PowerShell and VBScript files and the helper binaries, are mainly there to launch this file and make sure it stays running.

The interesting part is how ChainScript finds its command server. Instead of having a fixed server address that security teams could block, the malware asks a smart contract on the Polygon blockchain for the address. It sends a request to the contract, gets an address back and then connects to it.

This technique is known as EtherHiding. It is not a new idea, but ChainScript uses it effectively. The malware contacts the smart contract and receives a string starting with ws:// or wss://. It then saves that address for five minutes and uses it to connect to the attackers’ server.

If the attackers want to move to a different server, they only need to update the smart contract. They don’t have to change or rein

“For C2 discovery, ChainScript uses an EtherHiding style technique that treats a Polygon smart contract as the authoritative resolver for the active WebSocket panel. The analyzed build targeted contract 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 on chain ID 137 and supplied function selector 0x4ab7874e in an eth_call request.” read the report published by Blackpoint’. “ChainScript ABI decodes the returned string, verifies that it begins with ws:// or wss://, caches the result for five minutes, and uses it in place of the panel value stored directly in the configuration” 

Blackpoint watched this play out live. During analysis, the contract first pointed the agent to one server, which stayed active for about 18 minutes while exchanging heartbeat traffic. Twelve minutes after the connection reset, the same contract handed back a completely different address, proving the backend can rotate without anyone ever updating the malware itself.

One detail, flagged by an independent researcher on GitHub, is almost funny given the stakes. The smart contract behind one sample was deployed just 23 seconds before the installer was compiled. That’s too tight a window for a human to have done it by hand. Contract creation is almost certainly baked into the same build pipeline that produces the malware.

Once connected, ChainScript doesn’t just sit and listen. It hands operators a full interactive shell, file read and write access, desktop screenshots, the ability to push additional payloads, a scan for installed crypto wallets, arbitrary JavaScript execution, and a self-update function. That’s complete control of the machine, with a cleanup command built in for when the job is done.

On the wallet front, the malware stops at reconnaissance. It lists which wallets are installed and where, but there’s no dedicated code for stealing seed phrases or private keys. Given the shell access it already has, that distinction matters less than it should.

Blackpoint found the same agent wearing different outfits. Alongside the Spotify build, other versions turned up posing as Zoom Workplace and Microsoft Teams, each with its own package name but the same code underneath. The costume changes. The thing wearing it doesn’t.

“The malware was uncovered while investigating ClickFix activity that led to the execution of a malicious Windows Installer disguised as Spotify software.” reads the report. “Once executed, the MSI deployed its own Node.js runtime and launched a JavaScript agent through hidden PowerShell and VBScript stages. The running agent then established persistence in the user profile.”

This isn’t happening in isolation either. Research into other malware families, Tsundere and EtherRAT among them, has already documented the same recipe: Node.js, a malicious installer, and blockchain-based server discovery. The pattern keeps showing up, and that’s the uncomfortable part. Splitting the malware from its infrastructure is turning into a design choice, not a one-off trick.

For defenders, this changes where they should focus their attention. Tracking domains and IP addresses is still useful, but those indicators may not stay valid for long if the attackers can simply change the blockchain contract. Looking at the chain of processes can be much more effective: msiexec starting wscript, wscript launching the VBScript, and node.exe running app\src\index.js. These relationships are much harder for attackers to change than the server address they happen to be using this week.

Defenders should also watch for less obvious signs of activity. For example, a node.exe process suddenly making outbound blockchain RPC requests and then opening a WebSocket connection should attract attention.

Neither of these behaviors is necessarily malicious on its own. But when they happen together, they become a much stronger indicator of compromise than simply looking for a specific domain or IP address on a blocklist.

“ChainScript combines familiar RAT functionality with a flexible C2 design built around blockchain based infrastructure discovery.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.

Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin.

The company was first compromised on September 10, when attackers exploited a vulnerability in its SAML SSO system and gained access to 138 accounts, including one belonging to cryptocurrency hardware wallet maker Trezor. Six accounts were used to send phishing emails, while contact data was exported from 43 accounts.

Brevo blocked the unauthorized access, but attackers returned four days later using a compromised, long-lived Cloudflare API key. They used the key to deploy a malicious Cloudflare Worker that injected code into Brevo’s websites and three JavaScript files embedded in customer sites.

“A long-lived Cloudflare API key with full account permissions was stored in application source code and was obtained by the attacker. With it, they could create Workers, routes and DNS records on Brevo’s zones without triggering an alert.” reads a Brevo’s notice of incident. “Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.”

This turned Brevo’s trusted infrastructure into a malware distribution channel. The malicious code was served to visitors and users of websites relying on Brevo’s services. Security firm Sansec estimated that more than 100,000 sites may have been affected. Unlike the initial incident, this was no longer just a breach of customer accounts: the vendor’s own infrastructure had become the mechanism for distributing the attack.

“On 14 September, Brevo served malware to visitors of its own site and more than 100 thousand customer sites.” cybersecruity firm Sansec reports. “The malware had two components:

• a malicious WordPress plugin, installed when site admins visited their own site
• a clickfix overlay, shown to everyone browsing a customer site or clicking an (unsubscribe) link in a Brevo-sent campaign email”

Brevo’s chat widget and tracking scripts, loaded directly from cdn.brevo.com by thousands of websites, were modified to load an additional script from sendibt1.com, a domain owned by Brevo. This meant attackers could reach a large number of sites without compromising them individually.

Visitors were shown a fake “prove you’re human” prompt designed to trick them into running a malicious command. WordPress administrators faced a more serious threat: if they were logged in while visiting their site, a malicious plugin could be installed through their active session without requiring a password.

The malware also tried to avoid detection by targeting only logged-in WordPress admins and ignoring crawlers, developers and security scanners. BleepingComputer later found the plugin on VirusTotal disguised as “Web Media Optimizer.” It could hide from the normal plugin list, persist through the must-use plugins folder and communicate with its command-and-control server.

The files on Brevo’s servers were completely clean the entire time. Anyone checking file hashes or running standard integrity monitoring on the origin would have found nothing wrong, because nothing on the origin ever changed. The attack lived entirely at the CDN edge, invisible to any tool watching the wrong layer.

Sansec says supply-chain attacks offer attackers enormous reach. In this case, a single stolen key and compromised Cloudflare access allowed malware to spread through Brevo’s trusted infrastructure to websites using its scripts. Attackers did not need to compromise each customer or trick every victim individually. The trust was already built into the websites through a simple <script> tag, making the vendor a powerful distribution point for the attack.

The exposure window ran from roughly 16:05 to 20:13 UTC on September 14th, and both companies agree everything was clean again by the 15th. Brevo revoked the compromised key, pulled the hardcoded credential out of its source code, deleted the attacker’s hostnames, and flushed its edge caches. Whether this Cloudflare compromise connects back to the SSO-related account hijacking Brevo disclosed on September 10th, the one that led to phishing emails reaching 347,000 addresses tied to crypto wallet vendor Trezor, is still an open question Brevo hasn’t answered.

If you run a Brevo widget, a form, or the chat script on your site, don’t take “we fixed it” as the end of the story. Check your access logs for a plugin install or activation around September 14th, compare what’s on disk against what the WordPress admin screen actually shows (this plugin specifically hides itself from that list), and rotate admin passwords if you find anything. And if anyone on your team pasted a “verification” command into their terminal that day because a website told them to, that machine needs a proper scan, not just a shrug.

Ironically, sendibt1.com is probably the domain many people would want to block. But that would cause problems because it is a legitimate Brevo domain used for email tracking. Blocking it could break open and click tracking for customers still using the service. The attackers simply abused infrastructure that was already trusted.

Sansec’s report includes indicators of compromise, C2 paths, and file hashes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, supply chain)

North Korea-linked hackers hid a backdoor inside HAProxy, masking C2 traffic and stealing data while keeping the load balancer working normally.

North Korean-linked hackers found a genuinely clever hiding spot for their malware: inside the actual source code of HAProxy, the load balancing software running at the edge of two South Korean companies’ networks. Rapid7’s research documents a previously undocumented Linux toolkit hitting South Korea’s automotive and media sectors, and the depth of integration here goes well beyond a typical backdoor bolted onto a system.

“A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd.” reads the report published by Rapid7. “This previously undocumented framework enabled threat actors to execute remote commands on compromised servers, inject malicious scripts into web traffic, perform credential harvesting, and engage in long-term surveillance.”

The implant, which Rapid7 calls the “ted backdoor” based on debug strings the attackers left behind, isn’t a separate process running alongside HAProxy. It’s compiled directly into HAProxy’s own source code as a custom plugin, using the software’s native filter API, internal memory management, and event scheduler to intercept HTTP traffic while completely legitimate load balancing keeps running normally on top of it.

“The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12.” continues the report. “It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected.”

Rapid7 explains, which is really the whole thesis of why this backdoor is so hard to spot: it’s not an addition to the software, it’s woven into it.

The backdoor receives commands through a surprisingly simple trick. The attackers send a request for a fake image at /favorite_list_2x_m500_ico.jpg. This switches the HAProxy filter into command-and-control mode.

The malware then saves the command in a named pipe and removes traces of the request from HAProxy’s internal counters. It also clears the forwarding buffers, so the request never reaches the backend server. The command ends at the load balancer, leaving nothing in the application logs to show that it happened.

This ability to erase its own traces makes the backdoor very different from a normal web shell. The C2 requests never reach the backend server and are also removed from HAProxy’s statistics.

As a result, neither the application logs nor HAProxy’s connection logs show that the attack happened. A security team checking the logs could find nothing suspicious because the backdoor has already erased the evidence.

Beyond remote command execution, the backdoor can quietly inject malicious scripts or entirely swap out page content for specific victims matched by IP address, browser fingerprint, or even a hidden authentication credential smuggled inside the Accept-Language header, effectively turning a company’s own load balancer into a watering hole against its own visitors. It also hooks response bodies carefully enough to hide the size difference caused by injected content, stripping the header that would let a browser notice the byte-range mismatch. That’s a level of protocol-level care that suggests real HAProxy internals expertise, not a quick copy-paste job.

The main backdoor also comes with a separate toolkit that modifies common Linux system daemons such as crond, agetty, atd, and sshd. These programs continue to work normally but also carry malicious features.

One component acts as an SSH keylogger. It captures passwords that administrators enter in plain text and quietly records them. Another tool, called curlRAT, contacts a remote server every 12 hours by default, or every 30 seconds when the attacker enables its fast-poll mode.

curlRAT also checks whether the system runs inside a virtual machine. If it does not find the expected signs, it refuses to run. This behavior suggests the attackers designed the malware to avoid sandboxes and other analysis environments.

Attribution here sits at medium confidence, and Rapid7 is upfront about the limits of what the evidence actually shows. The targeting pattern, simple XOR-based encryption, a custom substitution cipher, and command-server infrastructure already linked to APT37 by other threat intelligence feeds all point toward North Korean state involvement, with some technical overlap also drawing comparisons to a concurrent Lazarus Group campaign against South Korean media sites.

“Further evidence is necessary to make a more definitive assessment. Moreover, the presence of ngx_* prefixed routines within the ted backdoor suggest code reused from an nginx backdoor. The ngx_* prefixed routines were observed during the latest Funnull campaign, where (similar to our case) a custom nginx filter was registered to hook HTTP traffic, and simple XOR encryption was applied to the configuration file.” Rapid7 states. “However, other than a similar naming convention, no significant code-level overlaps exist to support a stronger linkage.”

If your organization runs HAProxy, or really any edge component handling SSL termination and traffic routing, the practical lesson here is uncomfortable but simple: that software deserves the same scrutiny as your actual application servers, not less. The Hacker News confirmed in early September that the specific command domains used in this campaign have already gone dark, returning no DNS records at all, which is useful for reviewing historical logs but does nothing to stop whatever comes next from the same operators. Checking a load balancer’s own logs isn’t enough anymore when the backdoor’s entire design goal is making sure those logs never see it in the first place.

“ted backdoor and curlRAT were designed to persist during long-term espionage operations with the ability to steal cookie sessions, credentials, redirect selected users, conduct drive-by download attacks, and hide evidence of the tampered page to a specific range of IPs to evade detection.” concludes the report. “Defenders should treat any edge component managing user traffic, SSL, or runtime modules with the same strict security standards as their main application servers. Relying on the component’s own logs is not enough; securing these systems requires independent network correlation, memory behavioral analysis, and binary integrity checks.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, North Korea)