@ExpelSecurity

The leader in agentic MDR.

expel.com
Joined August 2016
  • Tweets4.2K
  • Following281
  • Followers12.9K
2KMedia
Microsoft says Storm-0940 used ARTEX, an open-source AI attack framework, in the #ConnectWise Cloud Backup compromise. A stolen app credential let it sign in to Microsoft 365 tenants as the app, with no user login needed. We’ve seen the same infrastructure go after #Okta. (1/3)
2
1
1
783
In one customer’s Okta environment, the attacker used self-service registration to create at least five accounts of its own, enrolled Okta Verify on three within about a minute, then started signing in to apps via SSO. We haven’t seen this in public reporting yet. (2/3)
1
4
2
255
If you’ve ever had a ConnectWise Cloud Backup or SkyKick app in Microsoft 365, disable it (don’t delete it) and check every app for secrets added since Oct. 13 that you didn’t create. Then hunt in all your identity providers. IOCs and details (3/3): expel.com/blog/storm-0940-ar…

Storm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-ups | Expel

Storm-0940 used ARTEX AI agents to abuse ConnectWise apps and Okta self-registration. Get the IOCs, detection guidance, and steps to take now.

expel.com
3
2
227
By now, you’ve probably seen php2shell: two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) that can let attackers run code without logging in. Here’s what defenders need to know. (1/5)
1
2
3
1,202
more replies
No confirmed IOCs yet. Watch for: → PHP or web server processes launching shells or download tools → New or changed PHP files in web directories → Unexpected outbound traffic from web servers Clean logs don’t prove safety. Some exploit paths may not log predictably. (4/5)
1
1
231
(5/5) expel.com/blog/php2shell-two…
1
174
Cute: QuartzLine’s C2 paths read like a geology glossary (/quarry/geode, /quarry/talc, /quarry/sinter). Less cute: Stone-cold social engineering. #QuartzLine hides a backdoor inside a working PDF viewer, then quietly mines Chrome data and drops a RAT. (1/2)
2
2
1
4
774
(2/2) What we saw in real environments, plus IOCs, detection tips, and cleanup steps: expel.com/blog/quartzline-a-…

QuartzLine: A working PDF viewer with a backdoor inside

QuartzLine is a working PDF viewer with a backdoor inside, spread in part through Google Ads. See what it does in real environments, plus IOCs.

expel.com
1
3
1
5
738
Your AI Risk Isn’t Unknown: It’s Unowned hubs.li/Q04wbq0m0 Written by Dave Merkel of @expelsecurity

Council Post: Your AI Risk Isn’t Unknown: It’s Unowned

The leadership teams that want to come out on the other side of this successfully must top treating AI risk as an undifferentiated fear.

forbes.com
1
2
2
393
On August 18, we caught a malware loader we believe to be novel. Entry point: a threat actor phished a client’s user through Microsoft Teams, posing as the IT help desk. We named it SynkLoader. (1/7)
3
8
22
2,752
more replies
The attackers went hands-on-keyboard, running commands in real time, until they realized our “network” wasn’t real. Then they disconnected. (6/7)
1
2
3
368
Our read, medium confidence: this toolkit belongs to a ransomware group or an initial access broker feeding one. Full breakdown, every module we received, and IOCs on the blog: expel.com/blog/synkloader-wh… (7/7)
4
10
459
Based on our analysis, GoldenEyeDog has separate teams with dedicated resources and targets, and these separate teams can be distinguished based on code-signing certificate usage and tactics. 1/2
1
1
580
We’re tracking these two groups as CylindricalCanine (Expel-TA-0002) and CuboidalCanine (Expel-TA-0003). This blog, part two of the series, is dedicated to understanding their differences and diving into CuboidalCanine. expel.com/blog/cylindricalca… 2/2
193
Load more