Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk

1. Technical details
2. Disclosure timeline
3. Mitigation and protection guidance
4. References
5. Learn more

During routine security research, we identified a severe intent redirection vulnerability in a widely used third-party Android SDK called EngageSDK. This flaw allows apps on the same device to bypass Android security sandbox and gain unauthorized access to private data. With over 30 million installations of third-party crypto wallet applications alone, the exposure of PII, user credentials and financial data were exposed to risk. All of the detected apps using vulnerable versions have been removed from Google Play.

Following our Coordinated Vulnerability Disclosure practices (via Microsoft Security Vulnerability Research), we notified EngageLab and the Android Security Team. We collaborated with all parties to investigate and validate the issue, which was resolved as of November 3, 2025 in version 5.2.1 of the EngageSDK. This case shows how weaknesses in third‑party SDKs can have large‑scale security implications, especially in high‑value sectors like digital asset management. 

As of the time of writing, we are not aware of any evidence indicating that this vulnerability has been exploited in the wild. Nevertheless, we strongly recommend that developers who integrate the affected SDK upgrade to the latest available version. While this is a vulnerability introduced by a third-party SDK, Android’s existing layered security model is capable of providing additional mitigations against exploitation of vulnerabilities through intents. Android has updated these automatic user protections to provide additional mitigation against the specific EngageSDK risks described in this report while developers update to the non-vulnerable version of EngageSDK. Users who previously downloaded a vulnerable app are protected.

In this blog, we provide a technical analysis of a vulnerability that bypasses core Android security mechanisms. We also examine why this issue is significant in the current landscape: apps increasingly rely on third‑party SDKs, creating large and often opaque supply‑chain dependencies.  

As mobile wallets and other high‑value apps become more common, even small flaws in upstream libraries can impact millions of devices. These risks increase when integrations expose exported components or rely on trust assumptions that aren’t validated across app boundaries. 

Because Android apps frequently depend on external libraries, insecure integrations can introduce attack surfaces into otherwise secure applications. We provide resources for three key audiences: 

• Developers: In addition to the best practices Android provides its developers, we provide practical guidance on identifying and preventing similar flaws, including how to review dependencies and validate exported components.  
• Researchers: Insights into how we discovered the issue and the methodology we used to confirm its impact.  
• General readers: An explanation of the implications of this vulnerability and why ecosystem‑wide vigilance is essential. 

This analysis reflects Microsoft’s visibility into cross‑platform security threats. We are committed to safeguarding users, even in environments and applications that Microsoft does not directly build or operate.  You can find a detailed set of recommendations, detection guidance and indicators at the end of this post to help you assess exposure and strengthen protections.

Technical details

The Android operating system integrates a variety of security mechanisms, such as memory isolation, filesystem discretionary and mandatory access controls (DAC/MAC), biometric authentication, and network traffic encryption. Each of these components functions according to its own security framework, which may not always align with the others_[1].  

Unlike many other operating systems where applications run with the user’s privileges, Android assigns each app with a unique user ID and executes it within its own sandboxed environment. Each app has a private directory for storing data that is not meant to be shared. By default, other apps cannot access this private space unless the owning app explicitly exposes data through components known as content providers.  

To facilitate communication between applications, Android uses intents_[2]. Beyond inter-app messaging, intents also enable interaction among components within the same application as well as data sharing between those components. 

It’s worth noting that while any application can send an intent to another app or component, whether that intent is actually delivered—and more broadly, whether the communication is permitted—depends on the identity and permissions of the sending application.  

Intent redirection vulnerability 

Intent Redirection occurs when a threat actor manipulates the contents of an intent that a vulnerable app sends using its own identity and permissions.  

In this scenario, the threat actor leverages the trusted context of the affected app to run a malicious payload with the app’s privileges. This can lead to: 

• Unauthorized access to protected components  
• Exposure of sensitive data 
• Privilege escalation within the Android environment

Figure 1. Visual representation of an intent redirection.

Android Security Team classifies this vulnerability as severe. Apps flagged as vulnerable are subject to enforcement actions, including potential removal from the platform_[3].

EngageLab SDK intent redirection

Developers use the EngageLab SDK to manage messaging and push notifications in mobile apps. It functions as a library that developers integrate into Android apps as a dependency. Once included, the SDK provides APIs for handling communication tasks, making it a core component for apps that require real-time engagement.

The vulnerability was identified in an exported activity (MTCommonActivity) that gets added to an application’s Android manifest once the library is imported into a project, after the build process. This activity only appears in the merged manifest, which is generated post-build (see figure below), and therefore is sometimes missed by developers. Consequently, it often escapes detection during development but remains exploitable in the final APK.

Figure 2. The vulnerable MTCommonActivity activity is added to the merged manifest.

When an activity is declared as exported in the Android manifest, it becomes accessible to other applications installed on the same device. This configuration permits any other application to explicitly send an intent to this activity.   

The following section outlines the intent handling process from the moment the activity receives an intent to when it dispatches one under the affected application’s identity. 

Intent processing in the vulnerable activity 

When an activity receives an intent, its response depends on its current lifecycle state: 

• If the activity is starting for the first time, the onCreate() method runs.  
• If the activity is already active, the onNewIntent() method runs instead.  

In the vulnerable MTCommonActivity, both callbacks invoke the processIntent() method. 

Figure 3: Calling the processIntent() method.

This method (see figure below) begins by initializing the uri variable on line 10 using the data provided in the incoming intent. If the uri variable is not empty, then – according to line 16 – it invokes the processPlatformMessage():  

Figure 4: The processIntent() method.

The processPlatformMessage() method instantiates a JSON object using the uri string supplied as an argument to this method (see line 32 below):  

Figure 5: The processPlatformMessage() method.

Each branch of the if statement checks the JSON object for a field named n_intent_uri. If this field exists, the method performs the following actions: 

• Creates a NotificationMessage object  
• Initializes its intentUri field by using the appropriate setter (see line 52).  

An examination of the intentUri field in the NotificationMessage class identified the following method as a relevant point of reference:

Figure 6: intentUri usage overview.

On line 353, the method above obtains the intentUri value and attempts to create a new intent from it by calling the method a() on line 360. The returned intent is subsequently dispatched using the startActivity() method on line 365. The a() method is particularly noteworthy, as it serves as the primary mechanism responsible for intent redirection:

Figure 7: Overview of vulnerable code.

This method appears to construct an implicit intent by invoking setComponent(), which clears the target component of the parseUri intent by assigning a null value (line 379). Under normal circumstances, such behavior would result in a standard implicit intent, which poses minimal risk because it does not specify a concrete component and therefore relies on the system’s resolution logic.  

However, as observed on line 377, the method also instantiates a second intent variable — its purpose not immediately evident—which incorporates an explicit intent. Crucially, this explicitly targeted intent is the one returned at line 383, rather than the benign parseUri intent.  

Another notable point is that the parseUri() method (at line 376)   is called with the URI_ALLOW_UNSAFE flag (constant value 4), which can permit access to an application’s content providers [6] (see exploitation example below). 

These substitutions fundamentally alter the method’s behavior: instead of returning a non‑directed, system‑resolved implicit intent, it returns an intent with a predefined component, enabling direct invocation of the targeted activity as well as access to the application’s content providers. As noted previously, this vulnerability can, among other consequences, permit access to the application’s private directory by gaining entry through any available content providers, even those that are not exported.

Figure 8: Getting READ/WRITE access to non-exported content providers.

Exploitation starts when a malicious app creates an intent object with a crafted URI in the extra field. The vulnerable app then processes this URI, creating and sending an intent using its own identity and permissions. 

Due to the URI_ALLOW_UNSAFE flag, the intent URI may include the following flags; 

• FLAG_GRANT_PERSISTABLE_URI_PERMISSION 
• FLAG_GRANT_READ_URI_PERMISSION  
• FLAG_GRANT_WRITE_URI_PERMISSION 

When combined, these flags grant persistent read and write access to the app’s private data.  

After the vulnerable app processes the intent and applies these flags, the malicious app is authorized to interact with the target app’s content provider. This authorization remains active until the target app explicitly revokes it [5]. As a result, the internal directories of the vulnerable app are exposed, which allows unauthorized access to sensitive data in its private storage space.  The following image illustrates an example of an exploitation intent:

Figure 9: Attacking the MTCommonActivity.

Affected applications  

A significant number of apps using this SDK are part of the cryptocurrency and digital‑wallet ecosystem. Because of this, the consequences of this vulnerability are especially serious. Before notifying the vendor, Microsoft confirmed the flaw in multiple apps on the Google Play Store.

The affected wallet applications alone accounted for more than 30 million installations, and when including additional non‑wallet apps built on the same SDK, the total exposure climbed to over 50 million installations.  

Disclosure timeline

Microsoft initially identified the vulnerability in version 4.5.4 of the EngageLab SDK. Following Coordinated Vulnerability Disclosure (CVD) practices through Microsoft Security Vulnerability Research (MSVR), the issue was reported to EngageLab in April 2025. Additionally, Microsoft notified the Android Security Team because the affected apps were distributed through the Google Play Store.  

EngageLab addressed the vulnerability in version 5.2.1, released on November 3, 2025. In the fixed version, the vulnerable activity is set to non-exported, which prevents it from being invoked by other apps. 

Date	Event
April 2025	Vulnerability identified in EngageLab SDK v4.5.4. Issue reported to EngageLab
May 2025	Escalated the issue to the Android Security Team for affected applications distributed through the Google Play Store.
November 3, 2025	EngageLab released v5.2.1, addressing the vulnerability

Mitigation and protection guidance

Android developers utilizing the EngageLab SDK are strongly advised to upgrade to the latest version promptly. 

Our research indicates that integrating external libraries can inadvertently introduce features or components that may compromise application security. Specifically, adding an exported component to the merged Android manifest could be unintentionally overlooked, resulting in potential attack surfaces. To keep your apps secure, always review the merged Android manifest, especially when you incorporate third‑party SDKs. This helps you identify any components or permissions that might affect your app’s security or behavior.

Keep your users and applications secure

Strengthening mobile‑app defenses doesn’t end with understanding this vulnerability.

Take the next step: 

• Strengthen your defenses with Microsoft Defender XDR 
• Accelerate investigations with Microsoft Security Copilot 

Learn more about Microsoft’s Security Vulnerability Research (MSVR) program at https://www.microsoft.com/en-us/msrc/msvr

References

[1] Mayrhofer, René, Jeffrey Vander Stoep, Chad Brubaker, Dianne Hackborn, Bram Bonné, Güliz Seray Tuncay, Roger Piqueras Jover, and Michael A. Specter. The Android Platform Security Model (2023). ACM Transactions on Privacy and Security, vol. 24, no. 3, 2021, pp. 1–35. arXiv:1904.05572. https://doi.org/10.48550/arXiv.1904.05572.  

[2] https://developer.android.com/guide/components/intents-filters  

[3] https://support.google.com/faqs/answer/9267555?hl=en  

[4] https://www.engagelab.com/docs/  

[5] https://developer.android.com/reference/android/content/Intent#FLAG_GRANT_PERSISTABLE_URI_PERMISSION 

[6] https://ift.tt/wWZ0gcx

This research is provided by Microsoft Defender Security Research with contributions from Dimitrios Valsamaras and other members of Microsoft Threat Intelligence.

Learn more

Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.   

• Evaluate your AI readiness with our latest Zero Trust for AI workshop.
• Learn more about Protect your agents in real-time during runtime (Preview)
• Explore how to build and customize agents with Copilot Studio Agent Builder 
• Microsoft 365 Copilot AI security documentation 
• How Microsoft discovers and mitigates evolving attacks against AI guardrails 
• Learn more about securing Copilot Studio agents with Microsoft Defender  

The post Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/b2hlafO
via IFTTT

ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories

Thursday. Another week, another batch of things that probably should've been caught sooner but weren't.

This one's got some range — old vulnerabilities getting new life, a few "why was that even possible" moments, attackers leaning on platforms and tools you'd normally trust without thinking twice. Quiet escalations more than loud zero-days, but the kind that matter more in practice anyway.

Mix of malware, infrastructure exposure, AI-adjacent weirdness, and some supply chain stuff that's... not great. Let's get into it.

1. Resilient hybrid botnet surge

   A new variant of the botnet known as Phorpiex (aka Trik) has been observed, using a hybrid communication model that combines traditional C2 HTTP polling with a peer-to-peer (P2P) protocol over both TCP and UDP to ensure operational continuity in the face of server takedowns. The malware acts as a conduit for encrypted payloads, making it challenging for external parties to inject or modify commands. The primary goal of Phorpiex's Twizt variant is to drop a clipper that re-routes cryptocurrency transactions, as well as distribute high-volume sextortion email spam and facilitate ransomware deployment (e.g., LockBit Black, Global). It also exhibits worm-like behavior by propagating through removable and remote drives, and drop modules responsible for exfiltrating mnemonic phrases and scanning for Local File Inclusion (LFI) vulnerabilities. "Phorpiex has consistently demonstrated its capability to evolve, shifting from a pure spam operation to a sophisticated platform," Bitsight said. "The Phorpiex botnet remains a highly adaptive and resilient threat." There are about 125,000 infections daily on average, with the most affected countries being Iran, Uzbekistan, China, Kazakhstan, and Pakistan.

2. Chained flaws enable stealth RCE

   A remote code execution (RCE) vulnerability that lurked in Apache ActiveMQ Classic for 13 years could be chained with an older flaw (CVE-2024-32114) to bypass authentication. Tracked as CVE-2026-34197 (CVSS score: 8.8), the newly identified bug allows attackers to invoke management operations through the Jolokia API and trick the message broker into retrieving a remote configuration file and executing operating system commands. According to Horizon3.ai, the security defect is a bypass for CVE-2022-41678, a bug that allows authenticated attackers to trigger arbitrary code execution and write web shells to disk. "The vulnerability requires credentials, but default credentials (admin:admin) are common in many environments," Horizon3.ai researcher Naveen Sunkavally said. "On some versions (6.0.0 - 6.1.1), no credentials are required at all due to another vulnerability, CVE-2024-32114, which inadvertently exposes the Jolokia API without authentication. In those versions, CVE-2026-34197 is effectively an unauthenticated RCE." The newly discovered security defect was addressed in ActiveMQ Classic versions 5.19.4 and 6.2.3.

3. Cyber fraud losses hit record highs

   Cyber-enabled fraud cost victims over $17.7 billion during 2025, as financial losses to internet-enabled fraud continue to grow. The total loss exceeds $20.87 billion, up 26% from 2024. "Cyber-enabled fraud is responsible for almost 85% of all losses reported to IC3 [Internet Crime Complaint Center] in 2025," the U.S. Federal Bureau of Investigation (FBI) said. "Cryptocurrency investment fraud was the highest source of financial losses to Americans in 2025, with $7.2 billion reported in losses." In all investment scams led the pack with $8.6 billion in reported losses, followed by business email compromise ($3 billion) and tech support scams ($2.1 billion). Sixty-three new ransomware variants were identified last year, leading to more than $32 million in losses. Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, Ransomhub, Lockbit, Dragonforce, Safepay, and Medusa emerged as the top ten variants to hit critical manufacturing, healthcare, public health, and government entities.

4. AI-driven DDoS tactics escalate

   According to data from NETSCOUT, more than 8 million DDoS attacks were recorded across 203 countries and territories between July and December 2025. "The attack count remained stable compared to the first half of the year, but the nature and sophistication of attacks changed dramatically," the company said. "The TurboMirai class of IoT botnets, including AISURU and Eleven11 (RapperBot), emerged as a major force. DDoS-for-hire platforms are now integrating dark-web LLMs and conversational AI, lowering the technical barrier for launching complex, multi-vector attacks. Even unskilled threat actors can now orchestrate sophisticated campaigns using natural-language prompts, increasing risk for all industries."

5. Insider breach exposes private photos

   A former Meta employee in the U.K. is under investigation over allegations that he illegally downloaded about 30,000 private photos from Facebook. According to The Guardian, the accused developed a software program to evade Facebook's internal security systems and access users' private images. Meta uncovered the breach more than a year ago, terminated the employee, and referred the case to law enforcement. The company said it also notified affected users, although it's not clear how many were impacted.

6. Help desk attacks enable enterprise breaches

   Google said it's tracking a financially motivated threat cluster called UNC6783 that's tied to the "Raccoon" persona and is targeting dozens of high-profile organizations across multiple sectors by compromising business process outsourcing (BPO) providers and help desk staff for later data extortion. "The campaign relies on live chat social engineering to direct employees to spoofed Okta logins using [org].zendesk-support[##].com domains," Austin Larsen, Google Threat Intelligence Group (GITG) principal threat analyst, said. "Their phishing kit steals clipboard contents to bypass MFA and enroll their own devices for persistent access. We also observed them using fake security updates (ClickFix) to drop remote access malware." Organizations are advised to prioritize FIDO2 hardware keys for high-risk roles, monitor live chat for suspicious links, and regularly audit newly enrolled MFA devices.

7. Magecart skimmer hides in SVG

   A large-scale Magecart campaign is using invisible 1x1 pixel SVG elements to inject a fake checkout overlay on 99 Magento e-commerce stores, exfiltrating payment data to six attacker-controlled domains. "In the early hours of April 7th, nearly 100 Magento stores got mass-infected with a 'double-tap' skimmer: a credit card stealer hidden inside an invisible SVG element," Sansec said. "The likely entry vector is the PolyShell vulnerability that continues to affect unprotected Magento stores." Like other attacks of this kind, the skimmer shows victims a convincing "Secure Checkout" overlay, complete with card validation and billing fields. Once the payment details are captured, it silently redirects the shopper to the real checkout page. Adobe has yet to release a security update to address the PolyShell flaw in production versions of Magento.

8. Emoji-coded signals evade detection

   Cybercriminals are using emojis across illicit communities to signal financial activity, access and account compromise, tooling and service offerings, represent targets or regions, and communicate momentum or importance. Using emojis allows bad actors to bypass security controls. "Emojis provide a shared visual layer that allows actors to communicate core concepts without relying entirely on text," Flashpoint said. "This is particularly valuable in: large Telegram channels with international membership, cross-border fraud operations, [and] decentralized marketplaces. This ability to compress meaning into visual shorthand helps scale operations and coordination across diverse actor networks."

9. Stealth RAT delivered via MSI

   A ClickFix campaign targeting Windows users is leveraging malicious MSI installers to deliver a Node.js-based information stealer. "This Windows payload is a highly adaptable remote access Trojan (RAT) that minimizes its forensic footprint by using dynamic capability loading," Netskope said. "The core stealing modules and communication protocols are never stored on the victim’s disk. Instead, they are delivered in-memory only after a successful C2 connection is established. To further obfuscate the attacker’s infrastructure, the malware routes gRPC streaming traffic over the Tor network, providing a persistent and masked bidirectional channel."

10. macOS attack bypasses Terminal safeguards

    More ClickFix, this time targeting macOS. According to Jamf, a ClickFix-style macOS attack is abusing the "applescript://" URL scheme to launch Script Editor and deliver an Atomic Stealer infostealer payload, thereby bypassing Terminal entirely. The attack leverages fake Apple-themed web pages that include instructions to "reclaim disk space on your Mac" by clicking on an "Execute" button that triggers the "applescript://" URL scheme. The new approach is likely a response to a new security feature introduced by Apple in macOS 26.4 that scans commands pasted into Terminal before they're executed. "It's a meaningful friction point, but as this campaign illustrates, when one door closes, attackers find another," security researcher Thijs Xhaflaire said.

11. PyPI package exfiltrates AI prompts

    A malicious PyPI package named hermes-px has been advertised as a "Secure AI Inference Proxy" but contains functionality to steal users' prompts. "The package actually hijacks a Tunisian university's private AI endpoint, bundles a stolen and rebranded Anthropic Claude Code system prompt, launders all responses to hide the true upstream source, and exfiltrates every user message directly to the attacker's Supabase database, bypassing the very Tor anonymity it promises," JFrog said.

12. Exposed PLCs targeted by state actors

    Data from Censys has revealed that there are 5,219 internet-exposed hosts that self-identify as Rockwell Automation/Allen-Bradley devices. "The United States accounts for 74.6% of global exposure (3,891 hosts), with a disproportionate share on cellular carrier ASNs indicative of field-deployed devices on cellular modems," it said. "Spain (110), Taiwan (78), and Italy (73) represent the largest non-Anglosphere concentrations. Iceland's presence (36 hosts) is disproportionate to its population and warrants attention, given its geothermal energy infrastructure." The disclosure follows a joint advisory from U.S. agencies that warned of ongoing exploitation of internet-facing Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs) by Iranian-affiliated nation-state actors since March 2026 to breach U.S. critical infrastructure sectors, causing operational disruption and financial loss in some cases. The agencies said the attacks are reminiscent of similar attacks on PLCs by Cyber Av3ngers in late 2023.

13. Code leak weaponized for malware spread

    In late March 2026, Anthropic inadvertently exposed internal Claude Code source material via a misconfigured npm package, which included approximately 512,000 lines of internal TypeScript. While the exposure lasted only about three hours, it triggered rapid mirroring of the source code across GitHub, prompting Anthropic to issue takedown notices (and later a partial retraction). Needless to say, threat actors wasted no time and took advantage of the topical nature of the leak to distribute Vidar Stealer, PureLogs Stealer, and GhostSocks proxy malware through fake leaked Claude Code GitHub repositories. "The campaign abuses GitHub Releases as a trusted malware delivery channel, using large trojanized archives and disposable accounts to repeatedly evade takedowns," Trend Micro said. "The combined functionality of the malware payloads enables credential theft, cryptocurrency wallet exfiltration, session hijacking, and residential proxy abuse across Windows, giving the operators multiple monetization paths from a single infection."

14. Lumma successor adopts evasive tactics

    A new 64-bit version of Lumma Stealer called Remus (historically called Tenzor) has emerged in the wild following Lumma's takedown and the doxxing of its alleged core members. "The first Remus campaigns date back to February 2026, with the malware switching from Steam/Telegram dead drop resolvers to EtherHiding and employing new anti-analysis checks," Gen researchers said. Besides using identical code, direct syscalls/sysenters, and the same string obfuscation technique, another detail linking the two is the use of an application-bound encryption method, only observed in Lumma Stealer to date.

15. Court rulings split on AI risk label

    In a setback for Anthropic, a Washington, D.C., federal appeals court declined to block the U.S. Department of Defense's national security designation of the AI company as a supply chain risk. The development comes after another appeals court in San Francisco came to the opposite conclusion in a separate legal challenge by Anthropic, granting it a preliminary injunction that bars the Trump administration from enforcing a ban on the use of AI chatbot Claude.The company has said the designation could cost the company billions of ⁠dollars in lost business and reputational harm. As Reuters notes, the lawsuit is one of two that Anthropic filed over the Trump administration's unprecedented move to classify it as a supply chain risk after it refused to allow the military to use Claude for domestic mass surveillance or autonomous weapons.

16. Trojanized tools deliver crypto clipper

    In a new campaign observed by Kaspersky, unwitting users searching for proxy clients like Proxifier on search engines like Google and Yandex are being directed to malicious GitHub repositories that host an executable, which acts as a wrapper around the legitimate Proxifier installer.Once launched, it configures Microsoft Defender Antivirus exclusions, launches the real Proxifier installer, sets up persistence, and runs a PowerShell script that reaches out to Pastebin to retrieve a next-stage payload. The downloaded PowerShell script is responsible for retrieving another script containing the Clipper malware from GitHub. The malware substitutes cryptocurrency wallet addresses copied to the clipboard with an attacker-controlled wallet with the intention of rerouting financial transactions. Since the start of 2025, more than 2,000 Kaspersky users – most of them in India and Vietnam – have encountered the threat.

17. SaaS platforms abused for phishing delivery

    Threat actors are leveraging notification pipelines in popular collaboration platforms to deliver spam and phishing emails. Because these emails are dispatched from the platform's own infrastructure (e.g., Jira's Invite Customers feature), they are unlikely to be blocked by email security tools. "These emails are transmitted using the legitimate mail delivery infrastructure associated with GitHub and Jira, minimizing the likelihood that they will be blocked in transit to potential victims," Cisco Talos said. "By taking advantage of the built-in notification functionality available within these platforms, adversaries can more effectively circumvent email security and monitoring solutions and facilitate more effective delivery to potential victims." The development coincides with a phishing campaign targeting multiple organizations with invitation lures sent from compromised email accounts that lead to the deployment of legitimate remote monitoring and management (RMM) tools like LogMeIn Resolve. The campaign, tracked as STAC6405, has been ongoing since April 2025. In one case, the threat actor has been found to leverage a pre-existing installation of ScreenConnect to download a HeartCrypt-protected ZIP file that ultimately leads to the installation of malware that's consistent with ValleyRAT. Other campaigns have leveraged procurement-themed emails to direct users to cloud-hosted PDFs containing embedded links that, when clicked, take victims to Dropbox credential harvesting pages. Threat actors have also distributed executable files disguised as copyright violation notices to trick them into installing PureLogs Stealer as part of a multi-stage campaign. What's more, Reddit posts advertising the premium version of TradingView have acted as a conduit for Vidar and Atomic Stealer to steal valuable data from both Windows and macOS systems. "The threat actor actively comments on their own posts with different accounts, creating the illusion of a busy and helpful community," Hexastrike said. "More concerning, any comments from real users pointing out that the downloads are malware get deleted within minutes. The operation is hands-on and closely monitored."

18. Linux SMB flaw leaks crypto keys

    A high-severity security flaw has been disclosed in the Linux kernel's ksmbd SMB3 server. Tracked as CVE-2026-23226 (CVSS score: 8.8), it falls under the same bug class as CVE-2025-40039, which was patched in October 2025. "When two connections share a session over SMB3 multichannel, the kernel can read a freed channel struct – exposing the per-channel AES-128-CMAC signing key and causing a kernel panic," Orca said. "An attacker needs valid SMB credentials and network access to port 445." Alternatively, the vulnerability can be exploited by an attacker to leak the per-channel AES-128-CMAC key used to sign all SMB3 traffic, enabling them to forge signatures, impersonate the server, or bypass signature verification. It has been fixed in the commit "e4a8a96a93d."

19. Prompt injection turns AI into attack tool

    New research has demonstrated it's possible to trick Anthropic's vibe coding tool Claude Code into performing a full-scope penetration attack and credential theft by modifying a project's "CLAUDE.md" file to bypass the coding agent's safety guardrails. The instructions explicitly tell Claude Code to help the developer complete a penetration testing assessment against their own website and assist them in their tasks. "Claude Code should scan CLAUDE.md before every session, flagging instructions that would otherwise trigger a refusal if attempted directly within a prompt," LayerX said. "When Claude detects instructions that appear to violate its safety guardrails, it should present a warning and allow the developer to review the file before taking any actions."

20. AI exploit silently leaks enterprise data

    Grafana has patched a security vulnerability that could have enabled attackers to trick its artificial intelligence (AI) capabilities into leaking sensitive data by means of an indirect prompt injection and without requiring any user interaction. The attack has been codenamed GrafanaGhost by Noma Security. "By bypassing the client-side protections and security guardrails that restrict external data requests, GrafanaGhost allows an attacker to bridge the gap between your private data environment and an external server," the cybersecurity company said. "Because the exploit ignores model restrictions and operates autonomously, sensitive enterprise data can be leaked silently in the background." GrafanaGhost is stealthy, as it requires no login credentials and does not depend on a user clicking a malicious link. The attack is another example of how AI-assisted features integrated into enterprise environments can be abused to access and extract critical data assets while remaining entirely invisible to defenders.
21. Android framework abused for payment fraud

    LSPosed is a powerful framework for rooted Android devices that allows users to modify the behavior of the system and apps in real-time without actually making any modifications to APK files. According to CloudSEK, threat actors are now weaponizing the tool to remotely inject fraudulent SMS messages and spoof user identities in modern payment ecosystems via a malicious module called "Digital Lutera." The attack effectively undermines SIM-binding restrictions applied to banking and instant payment apps in India. However, for this approach to work, the threat actor requires a victim to install a Trojan that can intercept SMS messages sent to/from the device. While the attack previously combined a trojanized mobile device (the victim) and a modified mobile payment APK (on the attacker's device) to trick bank servers into believing the victim's SIM card is physically present in the attacker's phone, the latest iteration leans on LSPosed to achieve the same goals. A key requisite to this attack is that the attacker must have a rooted Android device with the LSPosed module installed. "This new attack vector allows threat actors to hijack legitimate, unmodified payment applications by 'gaslighting' the underlying Android operating system," CloudSEK said. "By using LSPosed, the threat actor ensures the payment app's signature remains valid, making it invisible to many standard integrity checks."

That's the week. A lot of ground covered — old problems with new angles, platforms being abused in ways they weren't designed for, and a few things that are just going to keep getting worse before anyone seriously addresses them.

Patch what you can. Audit what you've trusted by default. And maybe double-check anything that touches AI right now — that space is getting messy fast.

Same time next Thursday.

from The Hacker News https://ift.tt/PsSl7BF
via IFTTT

Edge Decay: How a Failing Perimeter Is Fueling Modern Intrusions

In the first blog of this series, we explored the Identity Paradox and how attackers exploit valid credentials to operate undetected inside enterprise environments. However, identity compromise rarely happens in isolation.

To understand how these attacks begin, we need to look earlier in the intrusion lifecycle at the place many organizations still assume is secure: the edge.

For years, cybersecurity strategy has been built around defending the perimeter to protect the enterprise. Firewalls, VPNs, and secure gateways were designed as the outer boundary of the organization – hardened systems intended to control access and reduce risk. But that model is breaking down. What was once treated as a defensive layer is now a frequent target of modern attacks.

Rather than acting purely as protection, the perimeter increasingly introduces exposure. This shift reflects what can be described as edge decay, a gradual erosion of trust in boundary-based security as attackers focus on the infrastructure that defines it.

The Perimeter Is No Longer a Safe Boundary

The scale of this shift is hard to ignore. Zero-day vulnerabilities often target edge devices, including firewalls, VPN concentrators, and load balancers, all of which are not fringe systems. They are foundational components of enterprise connectivity, and the infrastructure that organizations built to protect themselves has become the infrastructure attackers exploit first.

Yet, unlike endpoints or servers, many edge devices still sit outside traditional endpoint visibility and control. Because these appliances typically cannot run EDR agents, defenders are often forced to rely on logs and external monitoring instead. However, logging can be inconsistent, patch cycles are often slow, and in many environments, these devices are treated as stable infrastructure rather than active risk. This combination creates a persistent visibility gap.

Attackers have recognized this gap and are exploiting it at scale. Rather than targeting hardened endpoints, adversaries are shifting their focus to unmanaged and legacy edge infrastructure and the systems that sit at the intersection of trust and exposure.

Weaponization at Machine Speed

One of the most significant accelerators of edge-focused attacks is the rise of automation and AI-assisted exploitation.

Threat actors are no longer relying on manual discovery. Instead, they use automated tooling to scan global IP space, identify exposed devices, and operationalize vulnerabilities within hours of disclosure. In some cases, exploitation begins within days or even hours of a vulnerability becoming public.

This compression of the attack timeline has important implications for defenders. Traditional patching cycles and risk prioritization models are no longer sufficient when adversaries can move faster than organizations can respond. As a result, edge compromise is increasingly observed as an early step in broader intrusion chains, often preceding identity-based attacks.

Edge Devices as Persistent Beachheads

Adversaries are increasingly prioritizing edge infrastructure because it represents a structural blind spot. Rather than targeting well-defended endpoints, they focus on unmanaged or legacy systems that fall outside standard visibility. Once compromised, these devices become more than just entry points, they provide a stable foothold for continued operations.

Once attackers gain access to a firewall or VPN appliance, that system effectively becomes an internal pivot point rather than a boundary control. From there, adversaries can monitor traffic, capture credentials, and pivot deeper into the network.

Investigations have repeatedly shown how compromised edge devices are used to:

• Intercept authentication flows and harvest credentials
• Deploy web shells on internal systems
• Create unauthorized accounts for persistence
• Pivot directly into sensitive infrastructure such as virtualization platforms

SentinelOne’s® Annual Threat Report observed a case where attackers leveraged compromised F5 BIG-IP devices to move from the internet-facing edge directly into internal VMware vSphere environments. In another, vulnerabilities in Check Point gateway devices were exploited to gain initial access across dozens of organizations globally.

These incidents reflect a broader pattern where the edge is becoming the attacker’s preferred entry point for lateral movement and identity compromise.

Living Inside the Infrastructure

More advanced campaigns take this concept even further by embedding themselves directly into the firmware of edge devices. The ongoing ArcaneDoor campaign, as noted in the Annual Threat Report, illustrates this evolution. Targeting legacy Cisco Adaptive Security Appliance (ASA) devices, attackers chained multiple zero-day vulnerabilities to deploy a firmware-level bootkit known as RayInitiator.

This implant is particularly dangerous because it operates below the operating system, allowing it to survive reboots and software updates. Alongside it, attackers deployed LINE VIPER, an in-memory payload capable of capturing authentication traffic and suppressing logging activity to evade detection. In effect, the device itself becomes both the attack platform and the concealment mechanism. When logging is suppressed and monitoring is absent, defenders lose visibility into the intrusion entirely.

The Rise of Untraceable Relay Networks

Compromised edge devices are not just used for internal access, they are also being repurposed as part of global attack infrastructure. State-sponsored actors have begun building Operational Relay Box (ORB) networks from compromised routers and firewalls. These networks allow attackers to route malicious traffic through legitimate but hijacked infrastructure, obscuring the true origin of their operations.

Clusters such as PurpleHaze and activity linked to groups like APT15 and Hafnium demonstrate how these relay networks are used to dynamically rotate attack paths, making attribution more difficult. As a result, malicious traffic can appear to originate from trusted enterprise systems, complicating both detection and response.

This dual use of edge devices as both entry points and relay infrastructure highlights a shift in how adversaries operationalize compromised systems.

Legacy Systems and the Illusion of Patchability

A major contributor to edge decay is the persistence of legacy systems. Many organizations continue to rely on outdated appliances that lack modern security features such as Secure Boot or robust integrity verification. These systems are often considered “patchable,” but in practice, they represent long-term operational risk that is difficult to fully mitigate.

Firmware updates can be disruptive and vendor support may be inconsistent. In many cases, organizations are hesitant to modify systems that underpin critical connectivity. The result is a growing population of edge devices that remain exposed long after vulnerabilities are discovered. In some environments, this problem is compounded by visibility gaps. Devices running unsupported operating systems or incompatible software cannot host modern security tooling, leaving them effectively unmonitored. These “legacy ghosts” become ideal targets for attackers for being stable, trusted, and largely invisible.

The Identity Connection

Edge compromise does not exist in isolation. It is deeply connected to identity-based attacks. Once an attacker controls a gateway or VPN appliance, they gain access to authentication flows, session data, and credential material. This allows them to pivot directly into identity infrastructure, bypassing traditional defenses.

In many intrusions, edge compromise becomes the first step toward identity abuse. This creates a direct connection between edge exposure and the challenges described in the Identity Paradox. Attackers do not need to break authentication if they can intercept it. By observing or capturing identity data in transit, they can operate using valid artifacts without triggering traditional controls.

Conclusion | Securing Edge Infrastructure from the Vanishing Perimeter

The perimeter isn’t failing, it’s already failed. Every unpatched VPN, every legacy firewall running decade-old firmware, every edge device outside your visibility is a door left open and forgot about. The question isn’t whether attackers will find it. It’s whether you’ll see them when they walk through. Once attackers establish a foothold at the edge, they move quickly to compromise identities, escalate privileges, and expand their reach across the environment. This progression from edge access to identity abuse to full-scale intrusion is becoming the dominant pattern in modern attacks.

In this context, defending the edge means both protecting infrastructure and disrupting the earliest stages of the attack lifecycle. Given how dynamic and often unmanaged edge environments have become, they can no longer be treated as a reliable line of defense on their own.

To defend against adversaries who specialize in exploiting these blind spots, the path forward requires a shift in perspective from device-level alerts to attack lifecycle visibility, and from assumed integrity to continuous validation.

SentinelOne's Annual Threat Report

A defender’s guide to the real-world tactics adversaries are using today to abuse identity, exploit infrastructure gaps, and weaponize automation.

Get the Full Report

Third-Party Trademark Disclaimer

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third-party.

from SentinelOne https://ift.tt/iESbm67
via IFTTT

What’s left for humans?

A Citrix colleague and I were talking about AI’s impact on knowledge work. I was droning on (and on and on) about agents doing the work, apps dissolving, and the cognitive stack becoming the new workspace, when she …

from Citrix Blogs https://ift.tt/3bFIV7L
via IFTTT

Bitter-Linked Hack-for-Hire Campaign Targets Journalists Across MENA Region

An apparent hack-for-hire campaign likely orchestrated by a threat actor with suspected ties to the Indian government targeted journalists, activists, and government officials across the Middle East and North Africa (MENA), according to findings from Access Now, Lookout, and SMEX.

Two of the targets included prominent Egyptian journalists and government critics, Mostafa Al-A'sar and Ahmed Eltantawy, who were at the receiving end of a series of spear-phishing attacks that sought to compromise their Apple and Google accounts in October 2023 and January 2024 by directing them to fake pages that tricked them into entering their credentials and two-factor authentication (2FA) codes.

"The attacks were carried out from 2023 to 2024, and both targets are prominent critics of the Egyptian government who have previously faced political imprisonment; one of them was previously targeted with spyware," Access Now's Digital Security Helpline said.

Also singled out as part of these efforts was an anonymous Lebanese journalist, who received phishing messages in May 2025 through the Apple Messages app and WhatsApp containing malicious links that, when clicked, tricked users into entering their account credentials as part of a supposed verification step from Apple.

"The phishing campaign included persistent attacks via iMessage/Apple Messenger and WhatsApp app, [...] impersonating Apple Support," SMEX, a digital rights non-profit in the West Asia and North Africa (WANA) region, said. "While the main focus of this campaign appears to be Apple services, evidence suggests that other messaging platforms, namely Telegram and Signal, were also targeted."

In the case of Al-A'sar, the spear-phishing attack aimed at compromising his Google account began with a LinkedIn message from a sock puppet persona named "Haifa Kareem," who approached him with a job opportunity. After the journalist shared their mobile number and email address with the LinkedIn user, he received an email from the latter on January 24, 2024, instructing him to join a Zoom call by clicking on a link shortened using Rebrandly.

The URL is assessed to be a consent-based phishing attack that leverages Google's OAuth 2.0 to grant the attacker unauthorized access to the victim's account through a malicious web application named "en-account.info."

"Unlike the previous attack, where the attacker impersonated an Apple account login and used a fake domain, this attack employs OAuth consent to leverage legitimate Google assets to deceive targets into providing their credentials," Access Now said.

"If the targeted user is not logged in to Google, they are prompted to enter their credentials (username and password). More commonly, if the user is already logged in, they are prompted to grant permission to an application that the attacker controls, using a third-party sign-in feature that is familiar to most Google users."

Some of the domains used in these phishing attacks are listed below -

• signin-apple.com-en-uk[.]co
• id-apple.com-en[.]io
• facetime.com-en[.]io
• secure-signal.com-en[.]io
• telegram.com-en[.]io
• verify-apple.com-ae[.]net
• join-facetime.com-ae[.]net
• android.com-ae[.]net
• encryption-plug-in-signal.com-ae[.]net

Interestingly, the use of the domain "com-ae[.]net" overlaps with an Android spyware campaign that Slovakian cybersecurity company ESET documented in October 2025, highlighting the use of deceptive websites impersonating Signal, ToTok, and Botim to deploy ProSpy and ToSpy to unspecified targets in the U.A.E.

Specifically, the domain "encryption-plug-in-signal.com-ae[.]net" was used as an initial access vector for ProSpy by claiming to be a non-existent encryption plugin for Signal.The spyware comes fitted with capabilities to exfiltrate sensitive data like contacts, SMS messages, device metadata, and local files.

Neither of the Egyptian journalists' accounts was ultimately infiltrated. However, SMEX revealed that the initial attack that targeted the Lebanese journalist on May 19, 2025, completely compromised their Apple Account and resulted in the addition of a virtual device to the account to gain persistent access to the victim's data. The second wave of attacks was unsuccessful.

While there is no evidence that the three journalists were targeted with spyware, the evidence shows that threat actors can use the methods and infrastructure associated with the attacks to deliver malicious payloads and exfiltrate sensitive data.

"This suggests that the operation we identified may be part of a broader regional surveillance effort aimed at monitoring communications and harvesting personal data," Access Now said.

Lookout, in its own analysis of these campaigns, attributed the disparate efforts to a hack-for-hire operation with ties to Bitter, a threat cluster that's assessed to be tasked with intelligence gathering efforts in the interests of the Indian government. The espionage campaign has been operational since at least 2022.

Based on the phishing domains observed and ProSpy malware lures, the campaign has likely targeted victims in Bahrain, the U.A.E., Saudi Arabia, the U.K., Egypt, and potentially the U.S., or alumni of U.S. universities, indicating the attacks go beyond members of Egyptian and Lebanese civil society.

"The operation features a combination of targeted spear-phishing delivered through fake social media accounts and messaging applications leveraging persistent social engineering efforts, which may result in the delivery of Android spyware depending on the target’s device," the cybersecurity company said.

The campaign's links to Bitter stem from infrastructure connections between "com-ae[.]net" and "youtubepremiumapp[.]com," a domain flagged by Cyble and Meta in August 2022 as linked to Bitter in relation to an espionage effort that used fake sites mimicking trusted services like YouTube, Signal, Telegram, and WhatsApp to distribute an Android malware dubbed Dracarys.

Lookout's analysis has also uncovered similarities between Dracarys and ProSpy, despite the latter being developed years later using Kotlin instead of Java. "Both families use worker logic to handle tasks, and they name the worker classes similarly. They also both use numbered C2 commands," the company added. "While ProSpy exfiltrates data to server endpoints starting with 'v3,' Dracarys exfiltrates data to server endpoints starting with 'r3.'"

These connections notwithstanding, what makes the campaign unusual is that Bitter has never been attributed to espionage campaigns targeting civil society members. This has raised two possibilities: either it's the work of a hack-for-hire operation with ties to Bitter or the threat actor itself is behind it, in which case it could indicate an expansion of its targeting scope.

"We do not know whether this represents an expansion of Bitter's role, or if it is an indication of overlap between Bitter and an unknown hack-for-hire group," Lookout added. "What we do know is that mobile malware continues to be a primary means of spying on civil society, whether it is purchased through a commercial surveillance vendor, outsourced to a hack-for-hire organization, or deployed directly by a nation state."

from The Hacker News https://ift.tt/uzPorNs
via IFTTT

From the field to the report and back again: How incident responders can use the Year in Review

Every year, Cisco Talos publishes Year in Review, a comprehensive look at the previous year’s threat landscape. It’s drawn from an enormous volume of telemetry, such as endpoint detections, network traffic, email data, and boots-on-the-ground Cisco Talos Incident Response (Talos IR) engagements. 

As incident responders, we see threats mid-detonation in the wreckage of an Active Directory environment, or in the lateral movement artifacts left behind by an affiliate who got in using nothing more than a valid account. The Year in Review distills those raw observations into structured intelligence, but that intelligence loop works both ways. The same report that our IR casework feeds into is the report that defenders should be feeding back into their own preparation cycles.

IR casework shapes the Year in Review, the Year in Review shapes your readiness 

When Talos IR closes out an engagement with customers, the tactics, techniques, and procedures (TTPs) we observe through forensic work and analysis are catalogued, aggregated, and analyzed alongside broader Cisco telemetry. When we track the emergence of a new exploit like React2Shell redefining attacker speed, or when we see Qilin rise to dominate the ransomware landscape while legacy groups like others maintain rare, sustained momentum, those shifts in the adversary ecosystem become the intelligence that informs what we are on the lookout for during the next investigation. When we observe patterns of behavior, they may form trend lines that span multiple years and reveal how the landscape is evolving. 

For defenders, this means the Year in Review is not a theoretical document. It is a distillation of what actually happened to organizations we respond to, investigated by the people who were in the room when things broke down. Here are some suggestions on how to operationalize these findings.

Turning findings into tabletop scenarios 

One of the most immediate and practical applications of Year in Review is raw material for tabletop exercises. The report hands you the adversary playbook. For example, the 2024 Year in Review highlighted that identity-based attacks accounted for 60% of all Talos IR cases, with Active Directory being the focal point in 44% of those incidents. Attackers were not breaking down doors with zero-days; rather, they were walking through the front door with stolen credentials, often bypassing multi-factor authentication (MFA) through push fatigue, misconfigured policies, or the simple fact that MFA was never fully enrolled in the first place for some accounts.  

The 2025 Year in Review reinforces and deepens this picture. Attacks against MFA evolved significantly, with MFA spray attacks doubling down on identity and access management (IAM) infrastructure while expanding efforts against high-value privileged accounts. Device compromise attacks saw a significant rise in activity, showing that actors increasingly value reliable, repeatable access methods over one-off exploitation. These are adversary preferences that should directly shape your exercise scenariosand cybersecurity preparedness. 

That is a ready-made tabletop scenario. Work with your team on this exact entry scenario and walk through it just as adversary would. An adversary authenticates to your VPN. MFA fires, but the user approves the push because they were already expecting a login prompt. The attacker is now inside your perimeter with legitimate access. What does your detection look like? How quickly do your analysts identify the anomaly? Who makes the call to force a password reset and revoke sessions? These are some good questions to cover in this scenario. The 2025 Year in Review found that actors tailor their MFA attack style depending on the sector, and that manufacturing was the most impacted sector for ransomware in 2025, underscoring persistent risk to repeatedly targeted industries. If you operate in manufacturing, health care, or another sector that has appeared consistently in ransomware targeting data, your tabletop should reflect the specific TTPs directed at your vertical — not a generic ransomware exercise. These are just some ideas to get started on scenarios.

Validate your detections against real-world tradecraft 

Beyond tabletops, the Year in Review provides a prioritized list of what to test your detections against. Year after year, Talos IR engagements reveal a consistent core of adversary tradecraft that organizations are still struggling to detect. Tools like PowerShell and Mimikatz appear in a significant portion of engagements. Remote services such as RDP and SSH continue to be abused for lateral movement. Ransomware operators are increasingly disabling security solutions before deploying payloads, and in 2024, they succeeded in doing so at an alarming rate. 

The 2025 Year in Review adds critical nuance to detection priorities through its vulnerability analysis. The top 10 most targeted vulnerabilities tell a story about what attackers reach for. React2Shell redefined attacker speed and targeting, compressing the window between disclosure and exploitation. ToolShell's quick rise to the top five highlighted the sheer volume and impact of attacks exploiting development tool vulnerabilities. 

For defenders, this is a checklist. Can your endpoint detection and response (EDR) detect and alert on the disabling of its own agent? Do you have detections for credential dumping from LSASS or web shell deployment? What about a scenario where direct exploitation takes place, but no web shell is deployed? Are you monitoring for anomalous Remote Desktop Protocol (RDP) sessions originating from unexpected source hosts? The Year in Review tells you what the adversary is actually doing, not what they might hypothetically do. That distinction is critical when you are prioritizing detection engineering across your organization. 

Map these findings to the MITRE ATT&CK framework, which the Talos Quarterly IR Trend Reports and the Year in Review already reference, and you have a structured way to assess your coverage gaps. If valid account abuse is the dominant initial access technique and your detections are heavily weighted toward exploit-based intrusions, you have a mismatch between your defensive posture and the actual threat landscape.

Stress-test your IR plan, not just your tooling 

The Year in Review also reveals patterns in where organizations struggle that go beyond technology. Across multiple years of IR engagements, common security weaknesses keep surfacing: incomplete asset inventories, inconsistent logging, missing or misconfigured MFA, inadequate network segmentation, and unpatched or end-of-life network devices that remain exposed. The 2024 report noted that some of the most targeted network vulnerabilities affected end-of-life devices with no available patches, yet those devices remained in production environments. The 2025 data reinforce this with even sharper clarity:  Legacy systems remain highly vulnerable to attack, CVE age distribution data highlights systemic patch delays, and a small number of vulnerabilities in network infrastructure continue to drive outsized risk. 

Two additional areas from the 2025 report deserve attention in your planning cycle. First, phishing continues to evolve. Phishing plays a key role in both initial access and post-compromise activity, with business email compromise-style and workflow-based lures remaining the primary theme. Travel and logistics lures surged, while political lures dropped off and IT-themed lures became more prominent. These shifts matter for security awareness training; if your phishing simulations are still heavily weighted toward current-events lures, they may not reflect what your users are encountering. 

Second, the AI threat landscape warrants monitoring. The 2025 observations include dedicated coverage of how AI is shaping the threat environment. While the full scope of AI-enabled threats is still emerging, defenders should consider how AI may be lowering the barrier for adversaries in areas like phishing content generation, vulnerability discovery, and social engineering at scale. Your IR plans should be tested, validated, and updated to handle the new security regime we find ourselves in. 

Build a year-round preparation cadence 

Rather than treating the Year in Review as a one-time read, consider building a recurring preparation cycle around it. When the report drops, review the top-level findings with your security leadership and identify the three or four trends most relevant to your environment. In the quieter early months, run a tabletop exercise built around the most applicable scenario. Through the middle of the year, use Quarterly IR Trend Report data to adjust detection priorities and validate coverage. Before year-end, when threat activity tends to intensify, conduct a focused review of your IR plan. 

from Cisco Talos Blog https://ift.tt/ZBP8Yp9
via IFTTT

APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies

The Russian threat actor known as APT28 (aka Forest Blizzard and Pawn Storm) has been linked to a fresh spear-phishing campaign targeting Ukraine and its allies to deploy a previously undocumented malware suite codenamed PRISMEX.

"PRISMEX combines advanced steganography, component object model (COM) hijacking, and legitimate cloud service abuse for command-and-control," Trend Micro researchers Feike Hacquebord and Hiroyuki Kakara said in a technical report. The campaign is believed to be active since at least  September 2025.

The activity has targeted various sectors in Ukraine, including central executive bodies, hydrometeorology, defense, and emergency services, as well as rail logistics (Poland), maritime and transportation (Romania, Slovenia, Turkey), and logistical support partners involved in ammunition initiatives (Slovakia, Czech Republic), and military and NATO partners.

The campaign is notable for the rapid weaponization of newly disclosed flaws, such as CVE-2026-21509 and CVE-2026-21513, to breach targets of interest, with infrastructure preparation observed on January 12, 2026, exactly two weeks before the former was publicly disclosed.

In late February 2025, Akamai also disclosed that APT28 may have weaponized CVE-2026-21513 as a zero-day based on a Microsoft Shortcut (LNK) exploit that was uploaded to VirusTotal on January 30, 2026, well before the Windows maker pushed out a fix as part of its Patch Tuesday update on February 10, 2026.

This pattern of zero-day exploitation indicates that the threat actor had advanced knowledge of the vulnerabilities prior to them being revealed by Microsoft.

An interesting overlap between campaigns exploiting the two vulnerabilities is the domain "wellnesscaremed[.]com." This commonality, combined with the timing of the two exploits, has raised the possibility that the threat actors are stringing together CVE-2026-21513 and CVE-2026-21509 into a sophisticated two-stage attack chain.

"The first vulnerability (CVE-2026-21509) forces the victim's system to retrieve a malicious .LNK file, which then exploits the second vulnerability (CVE-2026-21513) to bypass security features and execute payloads without user warnings," Trend Micro theorized.

The attacks culminate in the deployment of either MiniDoor, an Outlook email stealer, or a collection of interconnected malware components collectively known as PRISMEX, so named for the use of a steganographic technique to conceal payloads within image files. These include -

• PrismexSheet, a malicious Excel dropper with VBA macros that extracts payloads embedded within the file using steganography, establishes persistence via COM hijacking, and displays a decoy document related to drone inventory lists and drone prices after macros are enabled.
• PrismexDrop, a native dropper that readies the environment for follow-on exploitation and uses scheduled tasks and COM DLL hijacking for persistence.
• PrismexLoader (aka PixyNetLoader), a proxy DLL that extracts the next-stage .NET payload scattered across a PNG image's ("SplashScreen.png") file structure using a bespoke "Bit Plane Round Robin" algorithm and runs it entirely in memory.
• PrismexStager, a COVENANT Grunt implant that abuses Filen.io cloud storage for C2.

It's worth mentioning here that some aspects of the campaign were previously documented by Zscaler ThreatLabz under the moniker Operation Neusploit. 

APT28's use of COVENANT, an open-source command-and-control (C2) framework, was first highlighted by the Computer Emergency Response Team of Ukraine (CERT-UA) in June 2025. PrismexStager is assessed to be an expansion of MiniDoor and NotDoor (aka GONEPOSTAL), a Microsoft Outlook backdoor deployed by the hacking group in late 2025.

In at least one incident in October 2025, the COVENANT Grunt payload was found to not only facilitate information gathering, but also run a destructive wiper command that erases all files under the "%USERPROFILE%" directory. This dual capability lends weight to the hypothesis that these campaigns could be designed for both espionage and sabotage. 

"This operation demonstrates that Pawn Storm remains one of the most aggressive Russia-aligned intrusion sets," Trend Micro said. "The targeting pattern reveals a strategic intent to compromise the supply chain and operational planning capabilities of Ukraine and its NATO partners."

"The strategic focus on targeting the supply chains, weather services, and humanitarian corridors supporting Ukraine represents a shift toward operational disruption that may presage more destructive activities."

from The Hacker News https://ift.tt/LYeg9US
via IFTTT

Scalable Storage Guide: Architecture, Concepts, and Examples

Gartner projects data center spending will clear $650B in 2026 a 31.7% jump year-over-year. Storage is a big part of that number, but budget alone doesn’t solve the underlying problem: a system can be large and still fall apart the moment demand shifts. An aggressive backup window that bleeds into business hours, an analytics job nobody planned for, a sudden spike in random 4K writes – any of these can expose gaps in a storage design that looked fine on paper six months ago.

This article covers what scalable storage means in practice, how the core mechanics work, and how to think through the scale-up vs. scale-out decision before you’re making it under pressure.

What is scalable storage?

Scalable storage is a storage architecture that grows capacity and performance with predictable operational impact – using scale-up, scale-out, or a combination of both.

Today, the word “scalable” gets thrown around loosely. Adding drive shelves to a controller that’s already maxed out on IOPS doesn’t count. Real scalability means four things move together:

• Usable capacity after protection overhead
• Latency under actual production load (not vendor benchmark conditions)
• Resilience when hardware fails mid-operation
• Manageability as the footprint grows

When any one of these falls behind the others, you end up with a system that looks healthy on the capacity dashboard but delivers inconsistent performance to the workloads that matter.

How it works under the hood

Scalable storage systems take heterogeneous physical resources and present them as a single logical service. That abstraction holds up under growth because of a few core mechanics working together.

Pooling 

Aggregates disks and nodes into shared namespaces or volumes. It’s primarily an operational convenience – scalability can be achieved without it, but managing dozens of independent storage silos is nobody’s idea of a good time.

Data placement distributes workload across nodes so no single controller becomes a bottleneck. This is where many storage designs quietly fail. A cluster can look perfectly balanced on capacity metrics while showing wildly uneven latency because placement isn’t accounting for I/O density per node.

Data protection

Handled through either replication or erasure coding. Replication is simple – keep two or three full copies, but the space overhead is steep (either 50% or ~33,33%).

Erasure coding splits data into fragments with distributed parity, which is far more space-efficient at scale, but is significantly less performant in terms of IOPS and throughput. For example, Ceph’s recent FastEC implementation (released in Tentacle v20.2.0, November 2025) improved small read/write performance on erasure-coded pools by 2-3x, making the trade-off more favorable than it used to be. With a 6+2 EC profile, you get roughly 50% of replication’s performance at 33% of the space cost: not perfect, but works good enough for environments where cheap capacity is the priority.

The rebuild cost is the part that doesn’t make it into most marketing materials. When a node fails in an erasure-coded pool, the system has to read fragments from every surviving node, recalculate parity, and write new fragments – all while serving production I/O. Systems that spread fragments independently across disks can parallelize this across many drives, which helps enormously, but the I/O tax during rebuild is real and needs to be planned for.

Rebalancing 

The operational reality nobody talks about enough. When you add hardware, the system redistributes existing data across the new nodes. NetApp’s StorageGRID documentation explicitly warns that EC rebalance procedures decrease the performance of both ILM operations and client operations while running, and recommends only running them when existing nodes are above 80% full and you can’t add enough new nodes to absorb future writes naturally. That’s not a theoretical concern – it’s documented operational guidance from a vendor who’s seen what happens when people rebalance casually.

The control plane

Orchestrates all of it: health checks, configuration, automated recovery. Its reliability determines whether a component failure automatically generates a maintenance ticket or, at least, meaningful logs, system events and alerts for further troubleshooting.

Scale-up vs. scale-out vs. hybrid

The architecture choice you make early shapes every expansion decision that follows.

Figure 1: Storage growth models compared: scale-up hits a hardware ceiling, scale-out adds independent nodes across a shared network fabric.

Scale-up (vertical)

You grow by making the existing system larger: more RAM, faster controllers, additional drive shelves. It’s operationally simple, and for latency-sensitive workloads like core OLTP databases, keeping data on a single controller namespace still makes sense. There’s a reason high-frequency trading firms and critical database workloads still run on big iron.

The constraint is physical. Every chassis and controller has a ceiling, and when you hit it, your options narrow to buying a new system and migrating data – exactly the scenario scalable storage is supposed to prevent. The upgrade cycle also tends to be forklift: you’re not adding a little capacity, you’re replacing the whole controller pair and hoping the data migration completes during the maintenance window.

Scale-out (horizontal)

You grow by adding nodes to a cluster. Each node brings its own compute, storage, and network bandwidth, so capacity and performance grow together in a well-designed system.

This model handles unpredictable growth better than the alternatives: large VM fleets, unstructured data, object storage at petabyte scale. But scale-out has its own failure modes that vendors under-discuss. The network becomes the critical path – internal cluster traffic can saturate switch fabric before storage media is anywhere near its limit. Metadata hot spots are a known issue in distributed systems where a small number of directories or buckets handle disproportionate traffic. And the operational complexity is genuine: more nodes means more firmware versions to track, more failure domains to reason about, and more rebalancing events to schedule.

Hybrid

Most mid-market deployments end up here by necessity. You scale up within nodes first (adding drives or RAM), then scale out by adding nodes once you hit internal chassis limits. This works well for virtualization stacks and edge/ROBO deployments where growth comes in controlled increments.

The failure mode is planning gaps. Organizations that focus exclusively on TB targets and ignore controller throughput limits end up with systems that have plenty of space but can’t sustain the IOPS their workloads actually need. If your capacity planning spreadsheet doesn’t have a column for controller CPU utilization and front-end port bandwidth, you’re only seeing half the picture.

ModelHow You GrowBest FitWhere It Breaks Down

Scale-up	Expand one system	Low-latency, single-namespace workloads	Controller and chassis ceilings; forklift upgrades
Scale-out	Add nodes to cluster	Unstructured growth, shared services, petabyte scale	Network fabric saturation, metadata hot spots
Hybrid	Larger nodes, then more nodes	Phased growth, virtualization stacks	Overlooked controller limits as TB count grows

Practical benefits

The case for scalable storage comes down to avoiding the operational situations that consume engineering time and unplanned budget.

Pay-as-you-grow means capital expenditure tracks actual demand rather than worst-case projections from three years ago. With infrastructure cost scrutiny increasing everywhere, the ability to expand in $20-50K increments instead of $200K forklift upgrades changes the budgeting conversation entirely.

Fewer migrations are the direct result of building on a platform that expands in place. Anyone who’s lived through a storage migration knows the reality: months of planning, weekend maintenance windows, application-level validation afterward, and at least one thing that doesn’t come back up cleanly. Designing to avoid that cycle is worth real money over a five-year infrastructure lifecycle.

Performance that actually scales with capacity is the sign of a well-designed architecture. In a many-to-many system, adding nodes should increase aggregate throughput and support more concurrent clients. If adding a node only adds TBs without improving IOPS, the architecture is bottlenecked somewhere – usually the network or the metadata layer.

Node-level failure tolerance changes the operational posture significantly. When a single node failure is a hardware replacement ticket instead of a production incident, your on-call engineers sleep better and your SLAs get easier to maintain.

Workload fit

Different storage models suit different I/O profiles. Getting this wrong usually shows up as a performance problem that gets misdiagnosed as a capacity problem.

Backup and archive workloads involve large sequential writes with long retention. S3-compatible object storage with immutability policies is the standard fit, and immutability is increasingly non-negotiable for ransomware protection. Don’t put these workloads on your primary block storage – the sequential write patterns will interfere with the random I/O your production VMs need.

File services at scale – many users, many small files – puts heavy pressure on metadata operations. This is where scale-out NAS systems designed for high metadata throughput earn their cost. A block-oriented or object-oriented platform technically stores files fine, but the metadata overhead will kill performance once you’re past a few million objects per namespace.

Virtualization and edge compute generates high-pressure, largely random I/O. Block storage or hyperconverged infrastructure is the right fit. Object storage is architecturally wrong for this workload, regardless of what any vendor’s marketing page suggests.

Analytics and data lakes need high parallel read throughput and support for large sequential scans. The common pattern is object storage for the lake tier with a high-performance file system or caching layer in front of compute for active workloads. Separation of storage and compute works well here because you can scale query engines independently of the data footprint.

What to measure before you buy (and after)

Scalable storage systems run into physics eventually. Throughput is bounded by network bandwidth, rebalancing operations consume real I/O capacity, and rebuild times after failures depend on how much data needs to move. Planning around these constraints rather than discovering them post-purchase is the difference between a system that scales gracefully and one that surprises you.

What to MeasureWhy It Matters

Read/write ratio and block size distribution	A spec tested on sequential 128K reads tells you almost nothing about 4K random write performance. Capture your actual I/O profile before evaluating platforms.
Rebalancing throughput	Expansion operations run concurrently with production workloads. Know how fast data moves and what the I/O tax is so you can schedule expansions outside peak hours.
Failure domains	Whether a failure domain is a disk, host, rack, or site determines the blast radius of any single failure event. Design for the largest domain you can tolerate losing.
p99 latency under load	Averages hide the outliers that users actually experience. The 99th percentile tells you what the worst-case VM or query is seeing during peak hours.
Controller CPU and port utilization	The metric most often missing from capacity plans. A controller at 85% CPU will bottleneck before you fill the drives behind it.

One rule applies across all architectures: don’t operate near capacity limits. The last 20% of usable space is where placement algorithms degrade, rebalancing slows, and performance becomes unpredictable. Running at 70-75% utilization is a reasonable ceiling for most production workloads. Some popular storage vendors even recommend avoiding EC rebalance unless nodes exceed 80% – which means if you’re already at 80%, you’ve waited too long to expand.

Platform options

Cloud-managed storage (AWS S3/EFS/EBS, Azure Blob/Files/Disks, GCP Storage/Filestore/PD) offers the lowest operational overhead since the provider handles hardware and service management. The trade-offs are real: performance can throttle near published limits, egress costs accumulate quickly with heavy data movement, and matching access patterns to the right storage class requires ongoing attention. Separating storage and compute in the cloud lets you scale processing independently, but the bandwidth between compute and storage tiers isn’t unlimited and can become the bottleneck in analytics-heavy workloads.

On-premises platforms give tighter control and predictable data locality at the cost of owning the full operational stack: expansions, compatibility testing, upgrade discipline, and rebuild planning. Hyperconverged platforms like vSAN make the scale-out model explicit – adding hosts adds compute and storage together, with fairly automated performance tuning. Ceph offers similar scale-out capabilities but requires more manual tuning to reach optimal performance; the trade-off is full open-source flexibility versus operational simplicity.

S3-compatible object storage bridges on-premises deployments and cloud API compatibility. A word of caution here: MinIO, which was a popular choice for self-hosted S3, effectively entered maintenance mode in late 2025 when a quiet README commit announced it would no longer accept new changes. Key features like SSO, LDAP, and OIDC had already moved to the paid edition, and pre-built binaries were discontinued for community users. If you’re evaluating S3-compatible platforms, factor in the long-term licensing trajectory, not just today’s feature set. Ceph’s RADOS Gateway (RGW) is the most established open-source alternative.

DataCore covers both ends of the on-prem spectrum. StarWind Virtual SAN delivers HA shared storage for SMB and ROBO clusters on commodity hardware through synchronous replication between as few as two nodes. DataCore Swarm is a scale-out S3-compatible object storage platform that pools standard x86 servers into a self-managing cluster, using only 5% of disk capacity for system overhead, targeting petabyte-scale active archives, immutable backup, and multi-tenant storage environments.

Platform	Deployment	Model	Best For
AWS (S3/EFS/EBS)	Cloud	Managed	Mixed object, file, and block workloads
Azure (Blob/Files/Disks)	Cloud	Managed	Object storage, SMB/NFS files, VM disks
Google Cloud (GCS/Filestore)	Cloud	Managed	Object storage, NFS files, VM block
Dell PowerScale	On-prem	Scale-out NAS	Large file services, content workflows
NetApp ONTAP	On-prem	Scale-out NAS	Mature file and block services
VMware vSAN	On-prem	HCI	Virtualization-centric growth
MinIO	On-prem	Scale-out S3	S3 workloads (evaluate licensing carefully)
Ceph (RGW)	On-prem	Scale-out S3	Open-source object, optional block and file
Scality (via HPE)	On-prem	Scale-out S3	Backup targets, multi-tenant object storage
StarWind Virtual SAN	On-prem	2-node HA	SMB/ROBO HA shared storage
DataCore Swarm	On-prem	Scale-out S3	Archives, immutable backup, data lakes

Conclusion

Scalable storage is an architecture decision, not a product category. The key is matching the growth model to how your workload actually behaves and being honest about where the limits are before you hit them.

Scale up when you need deterministic latency on a single, high-intensity workload and can accept the eventual ceiling. Scale out when growth is unpredictable or when you’re managing shared services at any meaningful size. Hybrid covers most of the middle ground, particularly for virtualization-centric environments, as long as you’re tracking controller headroom alongside raw capacity.

Whatever model you choose: watch your p99 latency, not just your averages, and keep utilization below 75%. The behavior of a storage system at 90% capacity is rarely what anyone tested in the proof of concept.

from StarWind Blog https://ift.tt/0KWRvud
via IFTTT