Something with IR and Intelligence @InfoGuardAG, Certified Instructor and author @SANSInstitute (@SANSEMEA), Former Principal IR Consultant @Mandiant
Europe
Joined October 2009
- Tweets1.3K
- Following949
- Followers3.1K
- Likes1.2K
1/ BeyondTrust Remote Support 0-day CVE-2026-102764, exploited since Aug 29 (Mandiant: ARMORY CASTLE, ex-UNC5221).
Don't scope this as "an appliance got popped." A remote support box is a jump host with a password vault attached.
2/ Per Mandiant: webshell, SUID root shell, vault dump via bt-secrets, persistence through the sudoers template, a hijacked admin's Jump Item role raised to Administrator, file transfers off endpoints. Then logs wiped.
The new Flax Typhoon advisory (AA26-281A) ships hundreds of IOCs, most last seen 2019-2024, and the FBI seized their domains. Neither evicts anyone. Hunt what survives: SoftEther renamed conhost/dllhost, app-secret mailbox pulls, DCSync from non-DCs. #DFIR
ReliaQuest (Oct 7): attacker's host ran an AI-agent orchestration panel. No 0day, no malware. One unauthenticated Spring Batch endpoint, Nashorn JS inside the app, output pulled out via error messages in 1,800-byte chunks. No child process, so EDR saw nothing until the shell.
NetScaler, round 3. CVE-2026-88779 (SAML, Citrix says DoS) was exploited on boxes already patched for PitScaler. Admins saw nsaaad crash loops right after usernames carrying shell commands pulling from 213.209.159[.]55. Treat unexpected reboots as a lead, not noise. Patch again.
Talos: China-nexus UAT-11587 → Antino (Rust). C2 isn’t a sketchy VPS — it’s Microsoft Graph: Outlook for commands, OneDrive for heartbeats/files. GatherOsState.dll sideload + optional sleep-mask. Hunt identity/Graph, not just “bad C2 IPs.”
blog.talosintelligence.com/c…
Console-pipe injection ≠ PEB: stdin→nslookup/netsh, WriteFile into the child, VirtualProtectEx, SetThreadContext.
No VirtualAllocEx. No WriteProcessMemory.
Hunt: weird console child + remote protect + thread hijack — not yesterday's allocate+write rule.
(PoC/research)
EDR evasion without VirtualAllocEx / WPM.
Medium: Process Parameter Poisoning — shellcode via startup params into PEB. Hooks stay quiet.
Hunt: protect on param mem, SetThreadContext w/o Suspend, weird ShellInfo/cmdline/env.
Hunt video coming.
medium.com/@mathias.fuchs/wh…
Storm-2570 (MS): one affiliate, four brands — Qilin, DragonForce, Anubis, BERT.
Same kit: MeshAgent (renamed to victim org), ntdsutil IFM in Temp, s5cmd→S3, Defender exclusions on PerfLogs.
Encryptor name is the last signal. Hunt the access kit first.
microsoft.com/en-us/security…
Artifactory KEV lands tomorrow (25 Sep): CVE-2026-42016/42018.
Wiz: two unauth requests → anonymous token with admin. Plugins + Access private.key next.
Patch ≠ remediated. Hunt anonymous-as-admin, plugins dir, rotate Access keys — or you’re still owned.
#DFIR
CLOSEDQUORUM (Talos): not “AI malware” — C2 on Gemini/DeepSeek/Qwen/Mistral that votes steal/inject/persist. No human operator. Public build inert.
Hunt: unexpected Windows process → several AI APIs + LSASS / Early Bird / Discord / ETW patch.
blog.talosintelligence.com/t…
Rapuncel isn’t just a stealer.
Fake GitHub downloads drop Microsoft-signed Alinubx.sys (nvfsflt64.sys / NvFsFilter) — kills 145 AV/EDR from ring 0. PPL won’t save you.
Hunt pre-kill: vsdbg.exe sideload, weird signed filter, telemetry silence after load.
bleepingcomputer.com/news/se…
Settra clears event logs, Prefetch, PowerShell history, and USN journal before encryption.
Host-local evidence? Already gone. Forward EDR/SIEM off-host.
Quiet locker ≠ no theft — Cynet found no exfil in the encryptor; that phase was earlier.
huntress.com/blog/new-settra…
Red Heron: public Gitea RCE PoC automated in ~48h. Self-hosted SCM = secrets, SSH keys, OT source.
SIXZUT LD_PRELOAD rootkit hides files/procs/conns. Live tools lie.
Exposed Gitea? Assume hostile. Hunt hooks + /etc/ld.so.preload. Rebuild.
thehackernews.com/2026/09/ch…
Skip the "AI ransomware" headline.
CloudSEK opened an Aurora affiliate box: Kerberos + BloodHound + ADCS, same script on 20+ orgs. Most of it is valid AD.
Hunt identity. Leak sites undercount.
mine2.io/blog/2026-09-12-aur…
Disk-clean ≠ clean.
PoisonedRefresh (F5 APM): memory-only PHP webshell in webtop scripts. Disk unchanged.
Vulnerable history? httpd integrity, /run/bigtlog.pipe, HTTP 201+CSS.
sophos.com/en-us/blog/dissec…
