Threat Intelligence Researcher @esthreat 🚀🚀| Blue Teamer
Joined August 2014
- Tweets5.4K
- Following4K
- Followers2K
- Likes15.6K
Bohan Zhang retweeted
EV signature "Space Solar Technologies LLC"
Signs fake CloakGuard RMM disguised as Windows service -> fake blue screen -> installs ScreenConnect
rmm[.]cloakguard[.]org
162[.]246.19.216
relay[.]alico[.]shop · 69[.]169.106.96:8041
rogueauthority.org/cloakguar…
Bohan Zhang retweeted
Microsoft gives anyone with a Microsoft account a free Azure Data Explorer cluster.
No subscription, no credit card, full KQL. Mine took under 2 minutes to create.
aka.ms/kustofree
ALT Azure Data Explorer free cluster create dialog
Bohan Zhang retweeted
Cohere released the traces, so I had a look. Interesting stuff.
The model was asked to create a detection for curl downloading scripts to /tmp, followed by bash execution. Instead, it:
- Listed files under /tmp
- Checked for curl, wget, python3 and jq
- Read the DNS configuration
- Attempted an HTTP PUT to an Alibaba OSS endpoint with a synthetic test payload
- Checked the HTTP response code
I’m leaning towards training contamination. It’s bizarre behavior, especially without being asked or any prior context.
Could it have been trying to test curl before simulating the actual attack? Possibly. Still a very strange way to approach this.
In the spirit of transparency and openness, we are releasing the traces so developers can test this out for themselves. We noticed this behaviour without prefilling with the following prompt, but this is rare. If you want to reproduce it, you can use this prompt with prefilling.
Open models make for better science and are part of why this problem came to light at all: developers running Qwen3.8 on their own machines spotted the strange links, and having the weights let us study the behaviour in depth.
We're encouraged by the thoughtful discussion our research has sparked across the AI and security communities. It's our belief that open-weight models are an important part of the future of AI, and we've recently released several under the Apache 2.0 license.
Trace, raw tokens, & minimal reproduction script: huggingface.co/datasets/Cohe…
Bohan Zhang retweeted
php2shell (CVE-2026-109618/109619, CVSS 9.2) is unauthenticated RCE in PHP core. We took it into the lab to see what it actually looks like on a host, and how a SOC catches it.
activesoc.blackhillsinfosec.…
Bohan Zhang retweeted
Another day - another Stealer: MopsStealer 🐶
Active botnet C2s, hosted at Podaon SIA 🇳🇱:
📡 mops .to
📡 45.91.202.47:408
📡 45.91.202.47:1488
📡 45.91.202.146:408
📡 45.91.202.146:1488
Malware samples ⤵️
bazaar.abuse.ch/browse/signa…
IOCs ⤵️
threatfox.abuse.ch/browse/ma…
Bohan Zhang retweeted
Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder bundled with Node.js that can lead to RCE.
Discover affected versions, detection queries, and mitigation steps: ow.ly/T99a51013NZ
Bohan Zhang retweeted
Microsoft wants EDR out of the Windows kernel. We checked the binaries
They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U
Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds.
What we found:
• wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
• EspFilterPort: the filter communication port it uses to reach user mode
• espclient.dll: 120 Esp* exports for rules, filters and event queues
Bohan Zhang retweeted
❗️ A Chinese spyware kit called uCreator hides in repackaged Telegram, WeChat and GCash apps.
In Telegram it can read chats and grab the 2FA password in cleartext, researcher Ovi found.
Its makers left their backend and the names of ~3 dozen developers on an open GitLab server.
Bohan Zhang retweeted
🚨 Brotli2Shell goes beyond HTTP2Shell.
CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.
JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.
We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.
Full research and technical details in our blog 👇
Bohan Zhang retweeted
Signed "Lway Firmware" - 7th unique cert serial for them 🫥
h/t @malwrhunterteam
Microsoft teams lure -> BabaDeda loader -> CNCMachineRMS RAT
C2: wizardexpensive[.]com:
96.62.218[.]59
rogueauthority.org/signed-te…
Bohan Zhang retweeted
Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild. Updated threat brief:
unit42.paloaltonetworks.com/…
Bohan Zhang retweeted
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
Bohan Zhang retweeted
1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)
✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less
Update with Get-ZimmermanTools 🧵 #DFIR
Bohan Zhang retweeted
‼️ PHP2Shell exploit attempts hit millions as attackers try to deploy Mirai malware. Exposed attacker servers reveal RCE tooling.
No successful compromises confirmed so far.
Inside the payloads, exploit tools, and failed attempts → thehackernews.com/2026/10/ph…
Bohan Zhang retweeted
Nice :)
http.component:"php"
"X-Powered-By: PHP"
http.component:"php" country:"xx"
"X-Powered-By: PHP/7.4.33"
"X-Powered-By: PHP/7.4"
"X-Powered-By: PHP/8."
http.component:"php" http.component_version:"7.4"
"X-Powered-By: PHP/8.1" country:"xx"
shodan.io/search?query=http.…
Bohan Zhang retweeted
My lab runs MDE and Elastic side by side, so I gave Claude Code a skill for each:
- mde-hunt: KQL on MDE + my ADX archive
- elastic-hunt: ES|QL on Elastic
One question, both stacks searched, one table back.
Most SOCs run one of these. Whichever is yours, want the skill? I can share it on GitHub.
ALT Lab report compares remote-access tools using MDE and Elastic over 120 days, listing commands, hosts, and detected tools. Results show discrepancies.
Bohan Zhang retweeted
🚨 BREAKING: Microsoft says China state-aligned hackers used AI agents in the ConnectWise supply-chain hack.
Storm-0940 used the AI pentest tool ARTEX to reach 2,250+ Microsoft 365 tenants at 2,900 attempts a minute.
Some attacks reached privileged cloud access within 3 hours.
Bohan Zhang retweeted
“We don’t use PHP” doesn’t settle your PHP2Shell exposure.
Third-party products, containers, and hosted apps may carry the runtime. Finding it starts the investigation; exploitability and impact depend on the environment.
Read our analysis to understand what PHP2Shell means and why you should be paying attention 👇
bit.ly/3WG3my2
Bohan Zhang retweeted
Today we're launching cve.now 🚨
Yesterday was a rough day for security. php2shell, LiteLLM, Railway... How are we supposed to stay on top of all of this?
cve.now aggregates 4 vulnerability sources into one free feed and uses AI to explain each one in plain English. No login.
cve.now
Bohan Zhang retweeted
Let’s not forget about this certificate clusterfuck while everyone is busy with the PHP RCE news.
Almost at the same time, another serious security incident became public.
Eight intermediate CA certificates from eMudhra were found to use ridiculously weak private keys. We’re talking about P-384 keys where one private key was literally the number 4. FOUR!
Six of these were TLS CAs, allowing anyone to recover their private keys and potentially issue trusted certificates for arbitrary domains.
Major browsers have already blocked the affected CAs. But what about API clients, backend services, embedded devices, containers, and systems with outdated trust stores?
Many don’t enforce Certificate Transparency or check revocation. Some could remain vulnerable for years.
These weak keys have existed since April 2025. No confirmed malicious exploitation so far, but the implications are serious.
Don’t overlook this one while focusing on PHP.
Technical details and test endpoints:
emudhra.we-have-a-problem.co…