SentinelOne Intelligence Brief: Iranian Cyber Activity Outlook

To Our Partners and Customers

The following intelligence brief was sent to all SentinelOne partners and customers today:

Executive Summary

Recent U.S. and Israeli strikes against Iranian targets, followed by Iranian attacks on multiple regional locations, present a highly dynamic geopolitical situation with credible cyber threat implications. Iran has historically incorporated cyber operations into periods of regional escalation.

Given the rapid escalation of geopolitical tensions, we assess that Iranian state-aligned cyber activity is likely to intensify in the near-term based on a long track record of leveraging cyber operations for asymmetric retaliation, coercive signaling, and strategic messaging. Prior campaigns, including destructive wiper malware, infrastructure disruption, and influence operations masquerading as ‘hacktivism’, demonstrate both capability and intent to operate in the cyber domain alongside kinetic action.

At the time of publication, SentinelOne has not attributed significant malicious cyber activity directly to these recent events. We have no indications that SentinelOne or our customers are being specifically targeted in connection with these developments.

This report outlines Iran’s historical cyber posture, relevant tactics and tradecraft, and our forward-looking assessment of potential cyber responses in the days and weeks following the airstrikes.

We assess with high confidence that organizations in Israel, the United States, and allied nations are likely to face direct or indirect targeting – particularly within government, critical infrastructure, defense, financial services, academic, and media sectors.

We recommend that all clients, especially those operating in, or supporting, U.S. and Israeli infrastructure, review their security posture and preparedness accordingly.

This assessment is current as of February 28, 2026 and reflects a rapidly evolving threat environment.

Iran’s Cyber Operations to Date

Iran presents a mature, well-resourced cyberthreat based on more than fifteen years of experience across a wide range of malicious cyber events.

Iran uses a diverse set of cyber tools to further state objectives, particularly preservation of the Iranian regime, including:

• Espionage and credential theft via APT34, APT39, APT42, and MuddyWater, targeting a wide range of military, civilian, telecommunications, and academic institutions, particularly against regional targets (Israel, Middle East) and the United States
• Disruptive and destructive campaigns, notably wiper malware such as Shamoon and MeteorExpress
• Targeted spearphishing and social engineering campaigns, supporting strategic intelligence collection across multiple industries
• Fake hacktivist personas for plausible deniability and psychological impact (e.g., DarkBit, Cyber Av3ngers)
• Coordinated disinformation and influence ops across Telegram, X, and compromised news outlets
• Internet blackouts within Iran to control public opinion and narrative, while similarly countering the effect of foreign influence operations
• Proxy ransomware and criminal fronts blurring lines between state and financially motivated actors

Iranian cyber actors previously aligned their operations with kinetic campaigns, often acting as a force multiplier for regional allies like Hamas or as a standalone tool of retaliation. The TTPs employed by Iranian hacktivists increasingly mirror those used by state-sponsored APTs, raising critical questions about capability sharing and formal command-and-control relationships within this environment.

Expected Iranian Cyber Response to Current Events

1 – Precision Espionage Operations

Expect escalated targeting of Israeli defense, government, and intelligence networks using spearphishing, credential harvesting, and deployment of custom malware. Historically, groups such as APT34 (OilRig) and APT42 (TA453) leveraged legitimate access to move laterally and exfiltrate strategic intelligence. Additionally, U.S. military and government organizations will likely be targeted in similar campaigns.

Anticipated Targets:

• U.S. military and government organizations
• Israeli defense entities and affiliated research organizations
• U.S. and Israeli diplomatic infrastructure
• Defense contractors and supply chain partners
• Strategic allies and locations in theater

2 – Disruptive & Destructive Tactics

Iran has a well-documented history of using destructive malware and DDoS attacks to disrupt the critical infrastructure of its adversaries. We assess a high likelihood of similar tactics being deployed against U.S. and Israeli sectors, particularly utilities and public-facing systems.

Key techniques include:

• Deployment of wipers via fake hacktivist personas or directly-attributed APT clusters
• Exploitation of unpatched or poorly secured public-facing web services for defacement and initial access
• Use of scheduled tasks and LOLBins to execute custom wiper malware with stealth and persistence

Anticipated Targets:

• Transportation, Communication, Energy and Water utilities in U.S. and Israel
• Telecom, alerting systems, and national broadcast infrastructure
• Financial platforms and digital banking services

3 – Coordinated Influence & Disinformation Campaigns

Iranian-aligned actors are likely to amplify disinformation campaigns to shape public perception, particularly around civilian impact, military failure, and geopolitical instability. These efforts often run concurrently with real-world escalations and aim to degrade public trust in institutions.

Anticipated Themes:

• Allegations of Israeli war crimes
• U.S. and Israeli military losses
• Fabricated claims of successful Iranian cyber retaliation
• Disinformation on U.S.–Israel political division
• Leaks of manipulated or stolen documents misattributed to Israeli insiders
• Lack of support from the U.S. populace for ongoing strikes against Iran

4 – Probing Attacks on U.S. & Israeli Infrastructure

Iran has demonstrated readiness to expand attacks to Western infrastructure during periods of high tension. Recent examples include the exploitation of Unitronics PLCs at U.S. water treatment plants (late 2023), highlighting a shift toward ICS/OT targets. Such actions serve retaliatory and signaling purposes and are often designed to be low-impact yet high-visibility to maximize psychological effect.

Anticipated Targets:

• U.S. defense industrial base, especially contractors supporting military action
• Israeli military and key government organizations
• Critical infrastructure (water, energy, transportation) in the U.S. and Israel
• Regional partners (e.g., Jordan, UAE, Egypt, Saudi Arabia) aligned with U.S. and Israeli interests
• Media and academic institutions reporting on the conflict

SentinelOne Detection & Monitoring Posture

SentinelOne research and detection teams have closely followed Iranian cyber actors for many years. We provide multiple layers of protection and are closely monitoring emerging threat intelligence to maximize coverage.

We extensively cover techniques known to be used by Iranian threat groups including:

• PowerShell and script abuse
• Proxy tools
• Credential theft
• Keylogger components
• Wipers
• Browser credential theft
• DLL sideloading
• Tunneling tools (ngrok/Cloudflared)
• Scheduled task persistence
• Remote access tool abuse
• Active Directory reconnaissance
• Destructive boot tampering

These protections are not Iran-specific but known to be effective in detecting their operations.

We are monitoring the situation closely and can ship new detections quickly through Platform Rules updates or Live Security Updates.

For maximum protection, we recommend:

• Turning on Live Updates

• Ensuring you’re opted-in to Emerging Threat Platform Rules

• Activating Platform Detection Library rules listed in Appendix A

Recommendations

1. Increase Vigilance Against Phishing and Credential Abuse

• Prioritize MFA enforcement and internal phishing detection
• Monitor for abuse of VPN, email, and collaboration platforms
• Monitor for suspicious activity involving legitimate user accounts and applications

2. Harden Critical Infrastructure and OT Environments

• Patch and segment exposed ICS components, especially common HMI/PLC vendors
• Scan all Internet-facing infrastructure, and patch any vulnerable Internet-facing services
• Consider removing or restricting network access to any non-critical Internet-facing services, especially if they are not protected by MFA
• Review DDoS mitigation playbooks and response procedures

3. Monitor for Influence Operations and Fake Leaks

• Establish rapid communication response protocols for disinformation relevant to your organization
• Be prepared for threat actors using “hacktivist” branding and Telegram/Telegram-style platforms for communication
• Consider there are likely masquerade efforts and this requires a detailed assessment to determine true origin

4. Review and Test Incident Response Plans

• Ensure IR and SOC teams maintain heightened alert status
• Simulate data-wipe and ransomware scenarios
• Simulate corporate social media hijacking scenarios and prepare for account pausing/access resets

5. Establish Clear Points of Contact

• Ensure internal organization has direct POCs for support for security incidents
• Communicate posture expectations and escalation paths internally

6. Monitor for activity associated with Iranian state-aligned threat actors

SentinelOne is proactively hunting for IOCs and TTPs associated with these groups. These threat hunts are being performed for all Wayfinder Threat Hunting customers. Any related hunt findings will be visible in the Wayfinder Threat Hunting dashboard.

Closing Note

This report is intended to support informed decision-making and proactive defensive measures amid a dynamic and escalating geopolitical conflict.

The cyber threat landscape associated with Iranian state-aligned actors is adaptive, and we assess that both targeting priorities and tactics may shift rapidly in response to real world developments, political statements, or perceived provocations.

We advise clients to treat this as a time-sensitive assessment and to revisit posture, incident response, and monitoring processes regularly.

For immediate questions or escalations, please contact your Client Success Lead or reach our Support teams directly at: https://www.sentinelone.com/global-services/get-support-now/

Appendix

Customers should consider activating Platform Detection Library rules to improve coverage. The following rules are known to be effective against Iranian cyber operations:

MuddyWater

• Possible MuddyWater DLL Drop Consistent with Audio Driver Sideloading

Credential Dumping

• Suspicious Task Creation for Credential Harvesting
• Python-Based Network Exploitation Tool
• Potential LSASS Dumping Tools
• Credential Dumping via Shadow Copy
• Interactive NTDS Harvesting via VSS
• Cached Domain Credential Dumping

Tunneling & Remote Access

• Ngrok Domain Contacted
• Cloudflared Persistent Tunnel Establishment Detected
• Anomalous Process Initiating Cloudflare Tunnel Traffic

Collection & Exfiltration

• Keylogging Script via PowerShell
• Chromium Browser Info Stealer via Remote Debugging
• Browser Credential and Cookie Data Access Attempt

PowerShell/Script Abuse

• PowerShell Script Execution via Time Based Integer IPv4
• Suspicious Usage of .NET Reflection via PowerShell
• Encoded Powershell Launching Command Line Download

Defense Evasion, Impact, Discovery

• Potential DLL Sideloading in PerfLogs Directory
• Disk Data Wipe Attempt via Dd Utility
• Boot Configuration Tampering via BCDEdit
• BloodHound Active Directory Reconnaissance File Creation

from SentinelOne https://ift.tt/WZVSfYR
via IFTTT

ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket

OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence (AI) agent and take over control.

"Our vulnerability lives in the core system itself – no plugins, no marketplace, no user-installed extensions – just the bare OpenClaw gateway, running exactly as documented," Oasis Security said in a report published this week.

The flaw has been codenamed ClawJacked by the cybersecurity company.

The attack assumes the following threat model: A developer has OpenClaw set up and running on their laptop, with its gateway, a local WebSocket server, bound to localhost and protected by a password. The attack kicks in when the developer lands on an attacker-controlled website through social engineering or some other means.

The infection sequence then follows the steps below -

• Malicious JavaScript on the web page opens a WebSocket connection to localhost on the OpenClaw gateway port.
• The script brute-forces the gateway password by taking advantage of a missing rate-limiting mechanism.
• Post successful authentication with admin-level permissions, the script stealthily registers as a trusted device, which is auto-approved by the gateway without any user prompt.
• The attacker gains complete control over the AI agent, allowing them to interact with it, dump configuration data, enumerate connected nodes, and read application logs.

"Any website you visit can open one to your localhost. Unlike regular HTTP requests, the browser doesn't block these cross-origin connections," Oasis Security said. "So while you're browsing any website, JavaScript running on that page can silently open a connection to your local OpenClaw gateway. The user sees nothing."

"That misplaced trust has real consequences. The gateway relaxes several security mechanisms for local connections - including silently approving new device registrations without prompting the user. Normally, when a new device connects, the user must confirm the pairing. From localhost, it's automatic."

Following responsible disclosure, OpenClaw pushed a fix in less than 24 hours with version 2026.2.25 released on February 26, 2026. Users are advised to apply the latest updates as soon as possible, periodically audit access granted to AI agents, and enforce appropriate governance controls for non-human (aka agentic) identities.

The development comes amid a broader security scrutiny of the OpenClaw ecosystem, primarily stemming from the fact that AI agents hold entrenched access to disparate systems and the authority to execute tasks across enterprise tools, leading to a significantly larger blast radius should they be compromised.

Reports from Bitsight and NeuralTrust have detailed how OpenClaw instances left connected to the internet pose an expanded attack surface, with each integrated service further broadening the blast radius and can be transformed into an attack weapon by embedding prompt injections in content (e.g., an email or a Slack message) processed by the agent to execute malicious actions.

The disclosure comes as OpenClaw also patched a log poisoning vulnerability that allowed attackers to write malicious content to log files via WebSocket requests to a publicly accessible instance on TCP port 18789.

Since the agent reads its own logs to troubleshoot certain tasks, the security loophole could be abused by a threat actor to embed indirect prompt injections, leading to unintended consequences. The issue was addressed in version 2026.2.13, which was shipped on February 14, 2026.

"If the injected text is interpreted as meaningful operational information rather than untrusted input, it could influence decisions, suggestions, or automated actions," Eye Security said. "The impact would therefore not be 'instant takeover,' but rather: manipulation of agent reasoning, influencing troubleshooting steps, potential data disclosure if the agent is guided to reveal context, and indirect misuse of connected integrations."

In recent weeks, OpenClaw has also been found susceptible to multiple vulnerabilities (CVE-2026-25593, CVE-2026-24763, CVE-2026-25157, CVE-2026-25475, CVE-2026-26319, CVE-2026-26322, CVE-2026-26329), ranging from moderate to high severity, that could result in remote code execution, command injection, server-side request forgery (SSRF), authentication bypass, and path traversal. The vulnerabilities have been addressed in OpenClaw versions 2026.1.20, 2026.1.29, 2026.2.1, 2026.2.2, and 2026.2.14.

"As AI agent frameworks become more prevalent in enterprise environments, security analysis must evolve to address both traditional vulnerabilities and AI-specific attack surfaces," Endor Labs said.

Elsewhere, new research has demonstrated that malicious skills uploaded to ClawHub, an open marketplace for downloading OpenClaw skills, are being used as conduits to deliver a new variant of Atomic Stealer, a macOS information stealer developed and rented by a cybercrime actor known as Cookie Spider.

"The infection chain begins with a normal SKILL.md that installs a prerequisite," Trend Micro said. "The skill appears harmless on the surface and was even labeled as benign on VirusTotal. OpenClaw then goes to the website, fetches the installation instructions, and proceeds with the installation if the LLM decides to follow the instructions."

The instructions hosted on the website "openclawcli.vercel[.]app" include a malicious command to download a stealer payload from an external server ("91.92.242[.]30") and run it.

Threat hunters have also flagged a new malware delivery campaign in which a threat actor by the name @liuhui1010 has been identified, leaving comments on legitimate skill listing pages, urging users to explicitly run a command they provided on the Terminal app if the skill "doesn't work on macOS."

The command is designed to retrieve Atomic Stealer from "91.92.242[.]30," an IP address previously documented by Koi Security and OpenSourceMalware for distributing the same malware via malicious skills uploaded to ClawHub.

What's more, a recent analysis of 3,505 ClawHub skills by AI security company Straiker has uncovered no less than 71 malicious ones, some of which posed as legitimate cryptocurrency tools but contained hidden functionality to redirect funds to threat actor-controlled wallets.

Two other skills, bob-p2p-beta and runware, have been attributed to a multi-layered cryptocurrency scam that employs an agent-to-agent attack chain targeting the AI agent ecosystem. The skills have been attributed to a threat actor who operates under the aliases "26medias" on ClawHub and "BobVonNeumann" on Moltbook and X.

"BobVonNeumann presents itself as an AI agent on Moltbook, a social network designed for agents to interact with each other," researchers Yash Somalkar and Dan Regalado said. "From that position, it promotes its own malicious skills directly to other agents, exploiting the trust that agents are designed to extend to each other by default. It's a supply chain attack with a social engineering layer built on top."

What bob-p2p-beta does, however, is instruct other AI agents to store Solana wallet private keys in plaintext, purchase worthless $BOB tokens on pump.fun, and route all payments through an attacker-controlled infrastructure. The second skill claims to offer a benign image generation tool to build the developer's credibility.

Given that ClawHub is becoming a new fertile ground for attackers, users are advised to audit skills before installing them, avoid providing credentials and keys unless it's essential, and monitor skill behavior.

The security risks associated with self-hosted agent runtimes like OpenClaw have also prompted Microsoft to issue an advisory, warning that unguarded deployment could pave the way for credential exposure/exfiltration, memory modification, and host compromise if the agent can be tricked into retrieving and running malicious code either through poisoned skills or prompt injections.

"Because of these characteristics, OpenClaw should be treated as untrusted code execution with persistent credentials," the Microsoft Defender Security Research Team said. "It is not appropriate to run on a standard personal or enterprise workstation."

"If an organization determines that OpenClaw must be evaluated, it should be deployed only in a fully isolated environment such as a dedicated virtual machine or separate physical system. The runtime should use dedicated, non-privileged credentials and access only non-sensitive data. Continuous monitoring and a rebuild plan should be part of the operating model."

from The Hacker News https://ift.tt/MmX3Irp
via IFTTT

AI & Cloud News of the Month - Feb 2026

This episode marks the transition from The Cloudcast to The Reasoning Show, focusing more on AI and cloud topics. Brian Gracely (@bgracely) and Brandon Whichard (@bwhichard, @SoftwareDefTalk) discuss recent trends in AI, the evolution of tech teams, and the shifting landscape of enterprise AI tools.

SHOW: 1006

SHOW TRANSCRIPT: The Cloudcast #1006 Transcript

SHOW VIDEO: https://youtube.com/@TheCloudcastNET 

NEW TO CLOUD? CHECK OUT OUR OTHER PODCAST - "CLOUDCAST BASICS" 

SHOW NOTES:

• Link to February 2026 News and Articles

FEEDBACK?

• Email: show at the cloudcast dot net
• Bluesky: @cloudcastpod.bsky.social
• Twitter/X: @cloudcastpod
• Instagram: @cloudcastpod
• TikTok: @cloudcastpod

from The Cloudcast (.NET) https://ift.tt/LyXiI79
via IFTTT

Pentagon Designates Anthropic Supply Chain Risk Over AI Military Dispute

Anthropic on Friday hit back after U.S. Secretary of Defense Pete Hegseth directed the Pentagon to designate the artificial intelligence (AI) upstart as a "supply chain risk."

"This action follows months of negotiations that reached an impasse over two exceptions we requested to the lawful use of our AI model, Claude: the mass domestic surveillance of Americans and fully autonomous weapons," the company said.

"No amount of intimidation or punishment from the Department of War will change our position on mass domestic surveillance or fully autonomous weapons."

In a social media post on Truth Social, U.S. President Donald Trump said he was ordering all federal agencies to phase out the use of Anthropic technology within the next six months. A subsequent X post from Hegseth mandated that all contractors, suppliers, and partners doing business with the U.S. military cease any "commercial activity with Anthropic" effective immediately.

"In conjunction with the President's directive for the Federal Government to cease all use of Anthropic's technology, I am directing the Department of War to designate Anthropic a Supply Chain Risk to National Security," Hegseth wrote.

The designation comes after weeks of negotiations between the Pentagon and Anthropic over the use of its AI models by the U.S. military. In a post published this week, the company argued that its contracts should not facilitate mass domestic surveillance or the development of autonomous weapons.

"We support the use of AI for lawful foreign intelligence and counterintelligence missions," Anthropic noted. "But using these systems for mass domestic surveillance is incompatible with democratic values. AI-driven mass surveillance presents serious, novel risks to our fundamental liberties."

The company also called out the U.S. Department of War's (DoW) position that it will only work with AI companies that allow "any lawful use" of the technology, while removing any safeguards that may exist, as part of efforts to build an "AI-first" warfighting force and bolster national security.

"Diversity, Equity, and Inclusion and social ideology have no place in the DoW, so we must not employ AI models which incorporate ideological 'tuning' that interferes with their ability to provide objectively truthful responses to user prompts," a memorandum issued by the Pentagon last month reads.

"The Department must also utilize models free from usage policy constraints that may limit lawful military applications."

Responding to the designation, Anthropic described it as "legally unsound" and said it would set a dangerous precedent for any American company that negotiates with the government. It also noted that a supply chain risk designation under 10 USC 3252 can only extend to the use of Claude as part of DoW contracts, and that it cannot affect the use of Claude to serve other customers.

Hundreds of employees at Google and OpenAI have signed an open letter urging their companies to stand with Anthropic in its clash with the Pentagon over military applications for AI tools like Claude.

The standoff between Anthropic and the U.S. government comes as OpenAI CEO Sam Altman said OpenAI reached an agreement with the U.S. Department of Defense (DoD) to deploy its models in their classified network. It also asked DoD to extend those terms to all AI companies.

"AI safety and wide distribution of benefits are the core of our mission. Two of our most important safety principles are prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems," Altman said in a post on X. "The DoW agrees with these principles, reflects them in law and policy, and we put them into our agreement."

from The Hacker News https://ift.tt/NTyHkZY
via IFTTT

DoJ Seizes $61 Million in Tether Linked to Pig Butchering Crypto Scams

The U.S. Department of Justice (DoJ) this week announced the seizure of $61 million worth of Tether that were allegedly associated with bogus cryptocurrency schemes known as pig butchering.

The confiscated funds were traced to cryptocurrency addresses used for the laundering of criminally derived proceeds stolen from victims of cryptocurrency investment scams, the department added.

"Criminal actors and professional money launderers use cyber-enabled fraud schemes to swindle their victims and conceal their ill-gotten gains," said HSI Charlotte Acting Special Agent in Charge Kyle D. Burns.

"HSI special agents work diligently to trace the illicit proceeds of crime across the globe to disrupt and dismantle the transnational criminal organizations that seek to defraud hardworking Americans."

As is the norm in such cybercrime operations, threat actors are known to target individuals by cultivating romantic relationships after approaching them on dating and social media messaging apps. These activities are carried out by individuals who are trafficked into scam compounds operating primarily in Southeast Asia with promises of high-paying jobs.

The cybercrime syndicates behind the scams then confiscate their passports and are coerced into conning victims online by posing as charming strangers or brokers on investment platforms, or face brutal consequences. The end goal is to coax unsuspecting users into parting with their hard-earned money in fraudulent cryptocurrency investment schemes.

According to the DoJ, the fake platforms displayed made-up investment portfolios displaying unusually high returns in a deliberate attempt to make victims invest more of their funds. The reality hits when users try to withdraw their funds, at which point they are asked to pay an extra fee as a way to extract even more money from them.

"Once the victims' money transferred to a cryptocurrency wallet under the scammers’ control, the crooks quickly routed that money through many other wallets to hide the nature, source, control, and ownership of that stolen money," the department added.

In a coordinated announcement, Tether said it has frozen around $4.2 billion in assets linked to illicit activity to date, including nearly $250 million related to scam networks since June 2025 alone.

from The Hacker News https://ift.tt/i8Hyer6
via IFTTT

900+ Sangoma FreePBX Instances Compromised in Ongoing Web Shell Attacks

The Shadowserver Foundation has revealed that over 900 Sangoma FreePBX instances still remain infected with web shells as part of attacks that exploited a command injection vulnerability starting in December 2025.

Of these, 401 instances are located in the U.S., followed by 51 in Brazil, 43 in Canada, 40 in Germany, and 36 in France.

The non-profit entity said the compromises are likely accomplished via the exploitation of CVE-2025-64328 (CVSS score: 8.6), a high-severity security flaw that could enable post-authentication command injection.

"The impact is that any user with access to the FreePBX Administration panel could leverage this vulnerability to execute arbitrary shell commands on the underlying host," FreePBX said in an advisory for the flaw in November 2025. "An attacker could leverage this to obtain remote access to the system as the asterisk user."

The vulnerability affects FreePBX versions higher than and including 17.0.2.36. It was resolved in version 17.0.3. As mitigations, it's advised to add security controls to ensure that only authorized users have access to the FreePBX Administrator Control Panel (ACP), restrict access from hostile networks to the ACP, and update the filestore module to the latest version.

The vulnerability has since come under active exploitation in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog earlier this month.

Source: The Shadowserver Foundation

In a report published late last month, Fortinet FortiGuard Labs revealed that the threat actor behind the cyber fraud operation codenamed INJ3CTOR3 has been exploiting CVE-2025-64328 starting early December 2025 to deliver a web shell codenamed EncystPHP.

"By leveraging Elastix and FreePBX administrative contexts, the web shell operates with elevated privileges, enabling arbitrary command execution on the compromised host and initiating outbound call activity through the PBX environment," the cybersecurity company noted.

FreePBX users are recommended to update their FreePBX deployments to the latest version as soon as possible to counter active threats.

from The Hacker News https://ift.tt/qBQiWvt
via IFTTT

Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor

Cybersecurity researchers have disclosed details of a malicious Go module that's designed to harvest passwords, create persistent access via SSH, and deliver a Linux backdoor named Rekoobe.

The Go module, github[.]com/xinfeisoft/crypto, impersonates the legitimate "golang.org/x/crypto" codebase, but injects malicious code that's responsible for exfiltrating secrets entered via terminal password prompts to a remote endpoint, fetches a shell script in response, and executes it.

"This activity fits namespace confusion and impersonation of the legitimate golang.org/x/crypto subrepository (and its GitHub mirror github.com/golang/crypto)," Socket security researcher Kirill Boychenko said. "The legitimate project identifies go.googlesource.com/crypto as canonical and treats GitHub as a mirror, a distinction the threat actor abuses to make github.com/xinfeisoft/crypto look routine in dependency graphs."

Specifically, the backdoor has been placed within the "ssh/terminal/terminal.go" file, so that every time a victim application invokes ReadPassword() – a function supposedly meant to read input like passwords from a terminal – it causes that information to capture interactive secrets.

The main responsibility of the downloaded script is to function as a Linux stager, appending a threat actor's SSH key to the "/home/ubuntu/.ssh/authorized_keys" file, set iptables default policies to ACCEPT in an attempt to loosen firewall restrictions, and retrieve additional payloads from an external server while disguising them with the .mp5 extension.

Of the two payloads, one is a helper that tests internet connectivity and attempts to communicate with an IP address ("154.84.63[.]184") over TCP port 443. The program likely functions as a recon or loader, Socket noted.

The second downloaded payload has been assessed to be Rekoobe, a known Linux trojan that has been detected in the wild since at least 2015. The backdoor is capable of receiving commands from an attacker-controlled server to download more payloads, steal files, and execute a reverse shell. As recently as August 2023, Rekoobe has been put to use by Chinese nation-state groups like APT31.

While the package still remains listed on pkg.go.dev, the Go security team has taken steps to block the package as malicious.

"This campaign will likely repeat because the pattern is low-effort and high-impact: a lookalike module that hooks a high-value boundary (ReadPassword), uses GitHub Raw as a rotating pointer, then pivots into curl | sh staging and Linux payload delivery," Boychenko said.

"Defenders should anticipate similar supply chain attacks targeting other 'credential edge' libraries (SSH helpers, CLI auth prompts, database connectors) and more indirection through hosting surfaces to rotate infrastructure without republishing code."

from The Hacker News https://ift.tt/FNr2tLn
via IFTTT

The Good, the Bad and the Ugly in Cybersecurity – Week 9

The Good | Authorities Arrest Hacktivist & Convict L3Harris Insider for Selling Secrets to Russia

Spanish authorities have arrested four suspected members of “Anonymous Fénix”, a hacktivist group accused of launching distributed denial-of-service (DDoS) attacks against government ministries, political parties, and public institutions in Spain and parts of South America.

According to the Spanish Civil Guard, the group intensified its operations after the deadly Valencia floods in October 2024, blaming officials for the disaster. The suspects allegedly used X and Telegram to spread anti-government propaganda and recruit volunteers. Courts have since shut down the group’s social media accounts and messaging channels as part of a broader crackdown on cybercrime networks.

In the U.S., a former executive at defense contractor L3Harris Technologies has been sentenced to over seven years in prison for stealing classified zero-day exploits and selling them to a Russian cyber-weapons broker. Peter Williams, who led the firm’s Trenchant cybersecurity unit, admitted taking at least eight sensitive exploit components between 2022 and 2025, using an external drive and encrypted transfers. He sold the tools, developed exclusively for U.S. and allied intelligence agencies, for millions of dollars in cryptocurrency.

U.S. prosecutors said the theft caused tens of millions in losses and posed a severe national security risk. The broker, Operation Zero, allegedly resells exploits to Russian government and private clients. The Department of the Treasury simultaneously imposed sanctions on the company, its owner Sergey Sergeyevich Zelenyuk, and affiliated entities under a law targeting intellectual property theft by foreign adversaries.

Williams pleaded guilty in October 2025 and was ordered to forfeit cash, cryptocurrency, property, and luxury assets. Insider threats endangering national defense capabilities continue to rise and officials warn that trafficking in offensive cyber tools has become a lucrative global black market.

The Bad | ‘MuddyWater’ Actors Launch Operation Across the MENA Region with New Malware

MuddyWater (aka TEMP.Zagros, TA450, G0069), an Iranian state-linked threat actor, has initiated a new cyber campaign dubbed “Operation Olalampo”, which targets organizations and individuals across the Middle East and North Africa (MENA) amid ongoing regional tensions. First observed in January, new research observes the operation introducing novel malware variants while maintaining tactics consistent with the group’s past intrusions.

The campaign relies heavily on phishing emails carrying malicious Microsoft Office attachments that trigger macro-based infections. Victims are tricked into enabling macros, which deploy novel downloaders GhostFetch and HTTP_VIP. These tools profile compromised systems, evade legacy defenses, and deliver secondary payloads including the novel GhostBackDoor malware, an implant capable of remote command execution, file manipulation, and persistent access. In some cases, attackers deploy legitimate remote administration software to blend malicious activity with normal operations.

Malicious Microsoft Excel file before macros are enabled (Source: Group-IB)

A notable addition is CHAR, another novel Rust-based backdoor controlled through a Telegram bot for command-and-control (C2), enabling attackers to execute commands, exfiltrate data, and launch additional malware. Analysis indicates possible AI-assisted development, reflecting threat actors increasing experimentation with generative tools to accelerate malware creation. Researchers also noted infrastructure reuse from late 2025, suggesting sustained operations rather than isolated attacks.

Operation Olalampo points to MuddyWater’s focus on post-exploitation control, including reconnaissance, credential harvesting, and lateral movement. The group has also exploited vulnerabilities in public-facing servers to gain initial access. Security analysts warn that the campaign is a sign of broader plans to target network edge systems and critical sectors to establish long-term footholds, reinforcing concerns about nation-state-backed cyber operations expanding in scope and sophistication across the MENA region.

Defenders are urged to prioritize phishing resistance and monitor for unusual outbound communications to messaging platforms often used as C2 channels.

The Ugly | Attackers Exploit Critical Cisco SD-WAN Flaw to Target National Infrastructure

Cisco has disclosed an active zero-day exploitation of a critical authentication bypass in its Catalyst SD-WAN platform, a maximum-severity flaw that lets remote attackers compromise controllers and insert malicious peers into targeted networks. The flaw, tracked as CVE-2026-20127, affects both on-premises and cloud deployments of SD-WAN Controller, Manager, and Cloud products.

The vulnerability stems from a broken peering authentication mechanism that can be abused with crafted requests. Successful exploitation grants attackers high-privilege internal access, enabling manipulation of network configurations via NETCONF. By adding malicious peers that appear legitimate, adversaries can route traffic, advertise attacker-controlled networks, and pivot deeper into affected environments.

Cisco Talos attributes the campaign, tracked as UAT-8616, to a sophisticated threat actor active since at least 2023. Investigators believe attackers escalated privileges by downgrading to an older version of the software, exploiting an older root-level flaw (CVE-2022-20775), then restoring the original version to evade detection while retaining control. Talos also links the activity to a broader pattern of targeting network edge devices to gain footholds in high-value organizations, including critical national infrastructure (CNI) operators, suggesting possible nation-state backing.

Government agencies warn the threat is global and ongoing. So far, CISA has issued an emergency directive ordering federal agencies to inventory devices, collect forensic evidence, and patch immediately, while the UK’s National Cyber Security Centre urges organizations to report signs of compromise and follow hardening guidance to minimize risk.

Indicators or compromise include suspicious authentication logs, unauthorized SSH keys, rogue accounts, log tampering, and unexplained software downgrades. Authorities also stress that SD-WAN management interfaces should never be internet-exposed and recommend isolating control systems, forwarding logs externally, and applying updates.

from SentinelOne https://ift.tt/SdWemK7
via IFTTT

ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks

The North Korean threat actor known as ScarCruft has been attributed to a fresh set of tools, including a backdoor that uses Zoho WorkDrive for command-and-control (C2) communications to fetch more payloads and an implant that uses removable media to relay commands and breach air-gapped networks.

The campaign, codenamed Ruby Jumper by Zscaler ThreatLabz, involves the deployment of malware families, such as RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, and BLUELIGHT to facilitate surveillance on a victim's system. It was discovered by the cybersecurity company in December 2025.

"In the Ruby Jumper campaign, when a victim opens a malicious LNK file, it launches a PowerShell command and scans the current directory to locate itself based on file size," security researcher Seongsu Park said. "Then, the PowerShell script launched by the LNK file carves multiple embedded payloads from fixed offsets within that LNK, including a decoy document, an executable payload, an additional PowerShell script, and a batch file."

One of the lure documents used in the campaign displays an article about the Palestine-Israel conflict that's translated from a North Korean newspaper into Arabic.

All three remaining payloads are used to progressively move the attack to the next stage, with the batch script launching PowerShell, which, in turn, is responsible for loading shellcode containing the payload after decrypting it. The Windows executable payload, named RESTLEAF, is spawned in memory, and uses Zoho WorkDrive for C2, marking the first time the threat actor has abused the cloud storage service in its attack campaigns.

Once it's successfully authenticated with the Zoho WorkDrive infrastructure by means of a valid access token, RESTLEAF downloads shellcode, which is then executed via process injection, eventually leading to the deployment of SNAKEDROPPER, which installs the Ruby runtime, sets up persistence using a scheduled task, and drops THUMBSBD and VIRUSTASK.

THUMBSBD, which is disguised as a Ruby file and uses removable media to relay commands and transfer data between internet-connected and air-gapped systems. It's capable of harvesting system information, downloading a secondary payload from a remote server, exfiltrating files, and executing arbitrary commands. If the presence of any removable media is detected, the malware creates a hidden folder and uses it to stage operator-issued commands or store execution output.

One of the payloads delivered by THUMBSBD is FOOTWINE, an encrypted payload with an integrated shellcode launcher that comes fitted with keylogging and audio and video capturing capabilities to conduct surveillance. It communicates with a C2 server using a custom binary protocol over TCP. The complete set of commands supported by the malware is as follows -

• sm, for interactive command shell
• fm, for file and directory manipulation
• gm, for managing plugins and configuration
• rm, for modifying the Windows Registry
• pm, for enumerating running processes
• dm, for taking screenshots and captures keystrokes
• cm, for performing audio and video surveillance
• s_d, for receiving batch script contents from C2 server, saving it to the file %TEMP%\SSMMHH_DDMMYYYY.bat, and executing it
• pxm, for setting up a proxy connection and relaying traffic bidirectionally.
• [filepath], for loading a given DLL

THUMBSBD is also designed to distribute BLUELIGHT, a backdoor previously attributed to ScarCruft since at least 2021. The malware weaponizes legitimate cloud providers, including Google Drive, Microsoft OneDrive, pCloud, and BackBlaze, for C2 to run arbitrary commands, enumerate the file system, download additional payloads, upload files, and remove itself.

Also delivered as a Ruby file, VIRUSTASK functions similar to THUMBSBD in that it acts as a removable media propagation component to spread the malware to non-infected air-gapped systems. "Unlike THUMBSBD which handles command execution and exfiltration, VIRUSTASK focuses exclusively on weaponizing removable media to achieve initial access on air-gapped systems," Park explained.

"The Ruby Jumper campaign involves a mult-stage infection chain that begins with a malicious LNK file and utilizes legitimate cloud services (like Zoho WorkDrive, Google Drive, Microsoft OneDrive, etc.) to deploy a novel, self-contained Ruby execution environment," Park said. "Most critically, THUMBSBD and VIRUSTASK weaponize removable media to bypass network isolation and infect air-gapped systems."

from The Hacker News https://ift.tt/nrYv0qK
via IFTTT

ThreatsDay Bulletin: Kali Linux + Claude, Chrome Crash Traps, WinRAR Flaws, LockBit & 15+ Stories

Nothing here looks dramatic at first glance. That’s the point. Many of this week’s threats begin with something ordinary, like an ad, a meeting invite, or a software update.

Behind the scenes, the tactics are sharper. Access happens faster. Control is established sooner. Cleanup becomes harder.

Here is a quick look at the signals worth paying attention to.

1. AI-powered command execution

   Kali Linux, an advanced penetration testing Linux distribution used for ethical hacking and network security assessments, has added an integration with Anthropic's Claude large language model through the Model Context Protocol (MCP) to issue commands in natural language and translate them into technical commands.

2. Belarus-linked Android spyware

   ResidentBat is an Android spyware implant used by Belarusian authorities for surveillance operations against journalists and civil society. Once installed, it provides operators with access to call logs, microphone recordings, SMS, encrypted messenger traffic, screen captures, and locally stored files. The malware, although first documented in December 2025, is assessed to date back to 2021. According to Censys, ResidentBat-associated infrastructure is concentrated in Europe and Russia: the Netherlands (5 hosts), Germany (2 hosts), Switzerland (2 hosts), and Russia (1 host) in a recent Platform view, using a narrow port range (7000-7257) for control traffic.

3. Crypto phishing wave

   Phishing campaigns are impersonating cryptocurrency brokerage services like Bitpanda to harvest sensitive data under the pretext of reconfirming their information or risk having their accounts blocked. "Attempting to get multiple forms of information and identification, the attackers used tactics that would seem legitimate to the everyday user," Cofense said. "User information such as name verification, email, and password credentials, and location were all used in this attempt to harvest information under the guise of a multi-factor authentication process."

4. Breakout times shrink

   In its 2026 Global Threat Report, CrowdStrike said adversaries became faster than ever before in 2025. "The average e-crime breakout time — the period between initial access and lateral movement onto another system — dropped to 29 minutes, a 65% increase in speed from 2024," the company said. One such intrusion undertaken by Luna Moth (aka Chatty Spider) targeting a law firm moved from initial access to data exfiltration in four minutes. Chief among the factors fueling this dramatic acceleration was the widespread abuse of legitimate credentials, which allowed attackers to blend into normal network traffic and bypass many traditional security controls. This was coupled with threat actors of varied motivations utilizing AI technology to accelerate and optimize their existing techniques. Some of the threat actors that have leveraged AI in their operations include Fancy Bear, Punk Spider (aka Akira), Blind Spider (aka Blind Eagle), Odyssey Spider (aka TA558), and an India-nexus hacking group called Frantic Tiger that has used Netlify and Cloudflare pages for credential-harvesting operations. The cybersecurity company said it observed an 89% increase in the number of attacks by AI-enabled adversaries compared to 2024 and a 42% year-over-year increase in zero-days exploited prior to public disclosure. In tandem, 67% of vulnerabilities exploited by China-nexus adversaries provided immediate system access, and 40% targeted edge devices that typically lack comprehensive monitoring. The vast majority of attacks, 82%, were free of malware — highlighting attackers' enduring shift toward hands-on-keyboard operations and the abuse of legitimate tools and credentials.

5. 4-minute lateral movement

   In a similar report, ReliaQuest said the fastest intrusions reached lateral movement in just 4 minutes, an 85% acceleration from last year, with data exfiltration taking place in 6 minutes. The statistic is fueled by attackers increasingly weaving AI and automation into their tradecraft. "As attackers increasingly secure valid credentials with elevated privileges, the time to react has drastically dropped," ReliaQuest said. "In 2025, the average breakout time (initial access to lateral movement) dropped to 34 minutes. In 47% of incidents, they secured high privileges before ever touching the network. This allows them to skip escalation, blend into traffic, and repurpose legitimate tools."

6. ClickFix fuels Mac stealers

   Mac users searching for popular software like Homebrew, 7-Zip, Notepad++, LibreOffice, and Final Cut Pro are the target of an active malvertising campaign powered by at least 35 hijacked Google advertiser accounts originating from countries including the U.S., Canada, Italy, Poland, Brazil, India, Saudi Arabia, Japan, China, Romania, Malta, Slovenia, Germany, the U.K., and the U.A.E. More than 200 malicious advertisements impersonating legitimate macOS software have been found. The end goal of these efforts is to direct users to fake pages that contain ClickFix-like instructions to deliver MacSync stealer. Another ClickFix campaign has been observed using fake CAPTCHA verification lures on bogus phishing pages to distribute stealer malware that can harvest data from web browsers, gaming apps like Steam, cryptocurrency wallets, and VPN apps. According to ReliaQuest data, a quarter of attacks used social engineering for initial access last year, with ClickFix responsible for delivering 59% of the top malware families.

7. Encryption debate resurfaces

   Meta went ahead with a plan to encrypt the messaging services connected to its Facebook and Instagram apps despite internal warnings that it would hinder the social media giant's ability to flag child-exploitation cases to law enforcement, Reuters reported. The internal chat exchange dated March 2019 was filed in connection with a lawsuit brought by the U.S. state of New Mexico, accusing it of exposing children and teens to sexual exploitation on its platforms and profiting from it. In response to the concerns raised, Meta said it worked on additional safety features before it launched encrypted messaging on Facebook and Instagram in 2023.

8. ActiveMQ flaw aids LockBit

   Threat actors are exploiting a now-patched security flaw in internet-facing Apache ActiveMQ servers (CVE-2023-46604) to deploy LockBit ransomware. "Despite being evicted after the initial intrusion, they successfully breached the same server on a second occasion 18 days later," The DFIR Report said. "After compromising the server, the threat actor used Metasploit, possibly along with Meterpreter, to perform post-exploitation activities. These activities included escalating privileges, accessing LSASS process memory, and moving laterally across the network. After regaining access following their eviction, the threat actor swiftly transitioned to deploying ransomware. They leveraged credentials extracted during their previous breach to deploy LockBit ransomware via RDP." The ransomware is suspected to be crafted using the leaked LockBit builder.

9. Chrome crash-to-command trick

   Two newly flagged Google Chrome extensions, Pixel Shield - Block Ads (ID: nlogodaofdghipmbdclajkkpheneldjd) and PageGuard - Phishing Protection (ID: mlaonedihngoginmmlaacpihnojcoocl), have been found to adopt the same playbook as CrashFix, where the browser is deliberately crashed, and the user is tricked into running a malicious command à la ClickFix. The most concerning aspect of this campaign is that the extensions actually work and offer the advertised functionality. "The original NexShield DoS created a billion chrome.runtime.connect() calls," Annex Security's John Tuckner said. "These variants use a different technique I'm calling the Promise Bomb because it crashes the browser by flooding Chrome's message passing system with millions of unresolvable promises." While the original NexShield used timer-based activation, the new variants have evolved to push notification-based command-and-control (C2), causing the denial-of-service to be triggered only when the C2 server sends a push notification containing a "newVersion" value ending in "2." This, in turn, gives the attacker selective remote control over when the crashes happen.

10. WinRAR patch lag persists

    Cybersecurity firm Stairwell said more than 80% of the IT networks it monitors run versions of WinRAR vulnerable to CVE-2025-8088, a vulnerability that has been widely exploited by cybercrime and cyber espionage groups. "This finding underscores a persistent challenge in enterprise security when widely deployed, trusted software that quietly falls out of date and becomes a high-value target for attackers," Alex Hegyi said.

11. Crypto IV reuse risk

    A new analysis from Trail of Bits has revealed that more than 723,000 open-source projects use cryptographic libraries with insecure defaults. The aes-js and pyaes libraries have been found to provide a default initialization vector (IV) in their AES-CTR API, leading to a large number of key/IV reuse bugs. "Reusing a key/IV pair leads to serious security issues: if you encrypt two messages in CTR mode or GCM with the same key and IV, then anybody with access to the ciphertexts can recover the XOR of the plaintexts, and that’s a very bad thing," Trail of Bits said. While neither library has been updated in years, strongSwan has released an update to address the problem in strongMan (CVE-2026-25998).

12. AI audits smart contracts

    OpenAI and Paradigm have jointly announced EVMbench, a benchmark that measures how well AI agents can detect, exploit, and patch high-severity smart contract vulnerabilities. "EVMbench draws on 120 curated vulnerabilities from 40 audits, with most sourced from open code audit competitions," OpenAI said. "EVMbench is intended both as a measurement tool and as a call to action. As agents improve, it becomes increasingly important for developers and security researchers to incorporate AI-assisted auditing into their workflows."

13. Fake FSB extortion plot

    A Russian national has been accused of trying to extort money from the notorious Conti ransomware group by posing as an officer of Russia’s Federal Security Service (FSB), according to local media reports. RBC reported that the suspect, Ruslan Satuchin, posed as an FSB officer and demanded a large payment from Conti. Although an investigation was formally launched in September 2025, the incident allegedly began in September 2022 when Satuchin contacted one of the members of the hacker group and extorted them to avoid criminal liability. Once a prolific ransomware gang, Conti shut down its operations in mid-2022 after splintering into small groups.

14. Ad cloaking service exposed

    Varonis has disclosed details of a newly identified cybercrime service known as 1Campaign that enables threat actors to run malicious Google Ads for extended periods of time while evading scrutiny. The cloaking platform "passes Google's screening, filters out security researchers, and keeps phishing and crypto drainer pages online for as long as possible, funneling real users to attacker-controlled sites," Varonis security researcher Daniel Kelley said. "It combines real-time visitor filtering, fraud scoring, geographic targeting, and a bot guard script generator into a single dashboard." It's developed and maintained by a threat actor named DuppyMeister for over three years, along with offering Telegram channels for support. Traffic linked to 1Campaign has been distributed across the U.S., Canada, the Netherlands, China, Germany, France, Japan, Hungary, and Albania.

15. Teams call drops macOS malware

    A social engineering campaign has been observed using Microsoft Teams meetings to trick attendants into installing macOS malware. Daylight Security has assessed that the activity is consistent with an ongoing attack campaign orchestrated by North Korean threat actors under the name GhostCall. "During the call, the attacker claimed audio issues and coached the victim into running terminal commands that downloaded and executed malicious binaries," Daylight researchers Kyle Henson and Oren Biderman said. "Analysts observed staged downloads and execution from macOS cache and temporary paths, Keychain credential access, and outbound connections to newly created attacker-controlled domains."

16. RAMP fallout reshapes underground

    Last month, law enforcement authorities from the U.S. seized the notorious RAMP cybercrime forum. The event has had a cascading impact, destabilising trust and accelerating fragmentation across the underground cybercrime ecosystem. There are also speculations that RAMP may have functioned as a honeypot or had been compromised long before its seizure. "Rather than consolidating around a single successor, ransomware actors are redistributing across both gated platforms like T1erOne and accessible forums such as Rehub," Rapid7 said. "This shift reflects adaptation, not decline. Disruption fractures trust and redistributes coordination across multiple platforms."

17. Anonymous Fénix members detained

    Spanish authorities have announced the arrest of four members of the Anonymous Fénix group for their involvement in distributed denial-of-service (DDoS) attacks. The suspects, whose names were not disclosed, targeted the websites of government ministries, political parties, and public institutions. Two of the group leaders were arrested in May 2025. The first attacks occurred in April 2023. The group is said to have intensified its activities beginning in September 2024, recruiting volunteers to mount DDoS attacks against targets of interest.

18. Judicial spear-phish drops RAT

    A spear-phishing campaign has been observed targeting Argentina's judicial sector that delivers a ZIP archive containing a Windows shortcut that, when launched, displays a decoy PDF to the victims, while stealthily dropping a Rust-based remote access trojan (RAT). "The campaign leverages highly authentic judicial decoy documents to exploit trust in court communications, enabling successful delivery of a covert remote access trojan and facilitating long-term access to sensitive legal and institutional data," Seqrite Labs said.

19. Typosquat spreads ValleyRAT

    A persuasive lookalike website of Huorong Security antivirus ("huoronga[.]com") has been used to deliver a RAT malware known as ValleyRAT. The campaign is the work of a Chinese cybercrime group called Silver Fox, which has a history of distributing trojanized versions of popular Chinese software and other popular programs through typosquatted domains to distribute trojanized installers responsible for deploying ValleyRAT. "Once it's installed, attackers can monitor the victim, steal sensitive information, and remotely control the system," Malwarebytes said.

20. Repo-squatting via Google Ads

    Users searching for developer tools have become the target of an ongoing campaign dubbed GPUGate that uses a malicious installer to deliver Hijack Loader and Atomic Stealer. "The attacker creates a throwaway GitHub account and forks the official GitHub Desktop repository," GMO Cybersecurity by Ierae said. "The attacker edits the download link in the README to point to their malicious installer and commits the change. Lastly, the attacker used sponsored ads for 'GitHub Desktop' to promote their commit, using an anchor in README.md to skip past GitHub's cautions." Victims who downloaded the malicious Windows installer would execute a multi-stage loader, while Mac victims received Atomic Stealer.

These stories may seem separate, but they point in the same direction. Speed is increasing. Deception is improving. And attackers are finding new ways to blend into everyday activity.

The warning signs are there for those who look closely. Small gaps, delayed patches, misplaced trust, and rushed clicks still make the biggest difference.

Staying aware of these shifts is no longer optional. The details change each week. The pressure does not.

from The Hacker News https://ift.tt/N36hfcs
via IFTTT

Ransomware Detection and Defense Methods: Spot Attacks Before Encryption Starts

Ransomware rarely starts with encryption. By the time files are locked and ransom notes appear, the attacker has usually been inside for a while. They already know where data lives and which systems to hit first. The real fight happens earlier, when activity still looks half-legitimate and easy to dismiss.

And if you’re running IT for a 50- or 200-person company, you’re not less of a target. Attackers know smaller organizations have thinner defenses. The median ransom payout in 2024 was $200,000. That’s enough to be devastating for an SMB, and enough to be worth an attacker’s time.

Sophos’s 2025 State of Ransomware report puts the average recovery cost at $1.53M (excluding the ransom). For smaller organizations, it’s around $638K, which is still existential for most. Mandiant’s 2025 data puts ransomware dwell time at just 6 days. Sophos says 4 days. Arctic Wolf documented Akira campaigns that went from VPN login to full encryption in under an hour.

The detection window is collapsing. Here’s how to make the most of what’s left.

What ransomware looks like in your environment

Ransomware is an intrusion that ends in disruption. The stages: gain access, move laterally, prepare impact, extort. Detection depends on recognizing what each stage looks like in your logs.

Figure 1: Ransomware attack stages

Initial access comes from phishing, exposed RDP or VPNs, unpatched edge devices, or stolen credentials (now the second-most-common vector at 16% of investigations, per Mandiant). If RDP is open to the internet, even on a non-standard port, attackers will find it.

Pre-encryption staging is where the real damage gets set up, and where most detection opportunities exist. Attackers steal data for extortion leverage, hunt for backup infrastructure to destroy, and position for maximum impact.

Modern extortion almost always combines encryption with data theft. Double extortion threatens to leak your data. Triple adds DDoS. Quadruple goes directly after your customers, partners, and regulators. For SMBs, the customer-contact angle is particularly dangerous. You might survive downtime, but not your clients’ data on a leak site.

Top ransomware detection methods

No single tool catches ransomware in every environment. That needs to be the starting point of this entire conversation, because it’s the thing most vendor marketing actively obscures.

Here’s what actually happens in the field: every major EDR platform – CrowdStrike, SentinelOne, Huntress – gets bypassed. Not theoretically, not in a lab. In real engagements, skilled attackers silence EDR and successfully encrypt machines that have top-tier solutions installed. Red team operators (ethical hackers) do it routinely during validation assessments, and ransomware groups do it in the wild. These are good products that catch a lot of attacks. But if your entire security strategy depends on any single one of them being perfect, you will eventually get burned.

What actually stops ransomware is layered defense. Not some abstract layers, but layers as a deliberate architectural choice where each detection method covers a different angle of attack, so that when one fails (and it will), another one catches the activity from a different vantage point.

Think about it this way. An attacker gains access through a phished credential. The EDR doesn’t flag the login because it’s a legitimate account using a legitimate VPN. But your DNS logging spots the compromised machine querying a domain that’s never appeared in your environment before. Or the EDR misses the attacker running PsExec because it’s a legitimate admin tool, yet your canary file on the shared drive trips when the ransomware starts encrypting alphabetically and hits the decoy before reaching real data. Or the attacker successfully kills the EDR agent on the endpoint, but the network layer catches the sudden 200GB outbound transfer to a cloud storage bucket that your accounting server has never talked to before.

Each layer alone has gaps. Together, they force the attacker to evade all of them simultaneously, which is dramatically harder than evading any one of them.

Here’s what each layer covers and where it falls short.

Signature-based detection (traditional AV) catches known ransomware binaries and file extensions. Low false positives, but completely blind to anything new, customized, or using built-in system tools. It’s a baseline layer, not a strategy.

Behavior-based detection (EDR) watches for suspicious process chains, privilege abuse, and ransomware-like patterns on individual machines. This is your most important single detection layer. It catches things signatures miss, like unusual process trees and mass file modifications. But it can be silenced by a skilled attacker, and it misses activity that uses legitimate admin tools in ways that look “normal enough” to the detection engine. EDR needs to be paired with other layers that see what it can’t.

Network monitoring (DNS/proxy/firewall logs) catches what endpoint tools are blind to: unusual outbound data transfers, connections to suspicious destinations, command-and-control traffic patterns. This layer often reveals staging and data exfiltration before encryption even starts. Even basic DNS logging, which most business firewalls already support and costs nothing to turn on, can flag connections to domains your environment has never contacted before. When the attacker is living off the land (LotL) with your own admin tools and the EDR doesn’t flag it, the network layer catches the traffic those tools generate.

Anomaly/behavioral correlation (UEBA or MDR) ties weak signals from different sources into a single picture. An unusual VPN login, followed by RDP access to a server that account has never touched, followed by a spike in file writes. Each individually explainable, but together within a two-hour window they become a high-confidence alert. For SMBs, an MDR service (Managed Detection and Response) is the practical version of this: a third-party team monitoring your environment 24/7 and calling you when patterns look wrong. Providers like Huntress, Sophos MDR, or Arctic Wolf are built for organizations that can’t staff a round-the-clock security team.

Deception (honeypots, canary files, and decoy infrastructure) is arguably the most underused detection layer in small and midsize environments, which is strange because it’s also one of the cheapest and most reliable. The core idea is simple: you place fake resources in your environment that have no legitimate reason to be accessed. When something touches them, you know it’s either an attacker or malware, because nothing else would.

This works at multiple levels. At the file system level, you create decoy folders on your shared drives with names that look valuable – “AA_Financials,” “AA_ClientData,” “Passwords_backup.” Inside those folders you place decoy documents. At the server level, you can set up a honeypot machine with a name like “AA-FileServer” that exists only to be found. At the document level, tools like Thinkst Canarytokens let you create files (Word docs, PDFs, spreadsheets) that phone home the moment they’re opened, telling you exactly when, from what IP, and on what device.

The reason deception works so well against ransomware specifically is that ransomware is almost always programmatic. It doesn’t carefully choose which files to encrypt first. It iterates through whatever it can reach, usually in alphabetical order. That means your “AA_Financials” folder gets hit before your real production data. The ransomware announces itself while still chewing through worthless decoys, buying you time to respond before real damage starts.

What makes this layer different from everything above is the false positive rate. EDR generates alerts that need triage. SIEM correlation rules fire on things that turn out to be legitimate. Network monitoring flags traffic that’s unusual but harmless. Deception doesn’t have this problem. Nothing legitimate should ever touch a honeypot folder, open a canary document, or connect to a decoy server. When an alert fires, it’s real. That near-zero false positive rate means you can set these alerts to CRITICAL priority, the kind that page you at 3am, and trust that when the phone rings it’s not a false alarm.

Which detection layer catches what, and when

Attack stage	What the attacker does	Signature/AV	EDR	Network monitoring	UEBA/MDR	Deception
Initial access	Phishing, exploiting VPN/RDP, using stolen credentials	Catches known malware droppers	Flags suspicious process launches from email or browser	Spots connections to known-bad IPs/domains	Detects unusual login patterns (new location, odd hours)	No coverage at this stage
Credential harvesting	Running Mimikatz, dumping LSASS, kerberoasting	Catches known tools by hash	Detects credential dumping behavior and suspicious LSASS access	Limited visibility	Correlates privilege escalation with prior anomalies	No coverage at this stage
Lateral movement	PsExec, RDP pivoting, SMB spreading, WMI commands	Misses living-off-the-land tools	May flag unusual parent-child process chains	Catches unusual internal traffic patterns between hosts	Ties together multi-host activity into a single alert	Honeypot servers trip when accessed by unexpected accounts
Discovery and staging	Mapping shares, identifying backups, exfiltrating data	No coverage	May detect mass file enumeration	Catches large outbound transfers and C2 traffic	Correlates data movement with prior suspicious activity	Canary files trip when attacker opens decoy documents during recon
Backup destruction	Deleting backup repos, disabling VSS, wiping shadow copies	May catch known backup-deletion scripts	Detects VSS deletion commands and backup agent tampering	Limited visibility unless backup traffic patterns change	Flags backup console login anomalies	Canary files in backup-adjacent folders trip as attacker navigates to backups
Encryption	Mass file modification, ransom note deployment	Catches known ransomware variants	Detects mass file rename/modify behavior	Catches ransomware C2 callbacks	High-confidence alert from combined signals	Honeypot folders hit first (alphabetical order), alerting before real data is touched

The table makes the case for layers visually: no single column covers every row. Signature/AV is blind to anything past initial access unless the attacker uses known tools. EDR has the broadest coverage but can be silenced. Network monitoring catches exfiltration that endpoint tools miss. UEBA/MDR ties weak signals together. And deception is the only layer that catches activity during encryption with near-zero false positives, but it offers nothing during the early stages. You need all of them working together.

This is what layered detection looks like in practice. No single layer is sufficient. The combination is what makes ransomware detection work.

Best ransomware defense practices

This ordering comes from what actually fails first in real ransomware incidents, not from what looks good in a security framework slide deck.

1. Protect your backups – they’re the first target, not the last resort. This is usually the very first thing ransomware operators go after. In roughly 9 out of 10 incidents, attackers target backup infrastructure before they trigger encryption. The logic is simple: if you can restore, you have no reason to pay. So they eliminate that option first.

Don’t use your domain admin account to manage backups. Use a separate, dedicated account with credentials that don’t exist anywhere else. Don’t join the backup server to the domain if you can avoid it. Enable immutability (write-once storage that can’t be modified or deleted even by an admin) on your backup repositories. Veeam hardened Linux repos, Wasabi S3 with object lock, and Backblaze B2 with object lock all support this at reasonable price points. Maintain at least one copy that is physically disconnected from everything else: tape, rotated USB, or a cloud target that’s only online during the backup window.

Monitor your backup console for anomalous behavior. Failed jobs, vanishing retention points, unfamiliar login sessions. These aren’t IT glitches to investigate Monday morning. They’re potential early indicators that someone is already inside and preparing to cut off your recovery path.

And test your restores. Not “job completed successfully” in the console, but actual restore tests where you boot a VM or mount a database and verify it works. A backup you’ve never tested is a backup you don’t have.

2. Deploy your deception layer with the alphabetical trick. Now that you understand how deception detection works, here’s the specific deployment that gets the most out of it. Create shared folders named “AA_Financials” or “AA_ClientData” on every file server, and if possible, set up a honeypot server named “AA-FileServer.” The “AA” prefix matters because ransomware works alphabetically, so these get hit first. Give everyone read access so the ransomware’s compromised account can reach them. Place Thinkst Canarytokens inside each folder. Set CRITICAL-level alerts on all of it, the kind that page you at 3am.

The result: when ransomware starts encrypting, it announces itself on worthless decoy data before touching your real files. You get an alert with high confidence that it’s not a false alarm, and you get it while the ransomware is still busy with decoys instead of production data.

3. Have a response plan ready before the alert fires, and know how to find patient zero fast. When a honeypot or canary trips, you need to find the source machine immediately. The technique that works consistently in the field: check the “Owner” property on any encrypted or modified file. In most ransomware attacks, the encrypted file will list the owner as the account that performed the encryption. That gives you patient zero in seconds instead of hours.

Here’s the critical part that most people get wrong: do NOT shut off access to the honeypot folder or server until you have confirmed patient zero. If you cut access prematurely, the ransomware process simply moves to the next available target and your honeypot has bought you nothing. Let it keep chewing on the decoy data while you trace the source. The honeypot is doing its job, keeping the ransomware busy on worthless data. Don’t interrupt that by reacting too fast to the wrong thing.

Once you’ve identified patient zero, isolate the machine and kill the compromised identity at the same time. Use EDR to network-isolate the host (or pull the cable). Disable the Active Directory account, kill all sessions, revoke cloud tokens. Speed matters here. You can always re-enable a clean account, but you can’t un-encrypt a file server.

4. Decide who can pull the plug before it’s 2am on a Saturday. The organizations that come out of ransomware incidents relatively intact are almost always the ones where someone made the big call early. Pulled the plug on production, isolated aggressively, asked questions later. Over and over, the pattern holds: a forward-thinking engineer who just makes the huge call and takes an entire production system offline saves the entire organization. A few hours of unplanned operational downtime is painful, but it’s cheap compared to a week of encrypted servers and an Active Directory rebuild.

Decide in advance who has the authority to isolate a production system without escalating through three approval levels. Write it down. If that decision requires a CEO sign-off while the attack is spreading, you’ve already lost the containment window.

5. Know your data flows. If you know which systems talk to which under normal conditions, it’s dramatically easier to spot abnormal connections during an incident and figure out the blast radius before it becomes unmanageable. You don’t need a network diagram tool for this. A spreadsheet showing “Server X talks to Y for backup, Z talks outbound for email relay, nothing else goes to the internet” is enough. When containment starts and you’re trying to figure out how far the attacker got, that map is the difference between a targeted response and blind guessing.

6. Drill until the response is muscle memory. Run ransomware simulations with your team. Walk through realistic scenarios. Get to know what the early signs look like. The difference between organizations that contain ransomware quickly and those that don’t is almost never better tools. It’s that the team has practiced. They’ve built the muscle memory. They know the runbook exists because they helped write it, and they’ve walked through it recently enough to remember where the credentials are stored and who to call.

For a small team, this doesn’t require a formal tabletop exercise with an outside facilitator. It means walking through the scenario once a quarter: “EDR flags ransomware behavior on Server01 at 2am. What’s the first thing we do? Who does it? Where’s the runbook?”

Ransomware response workflow

When monitoring flags something suspicious, the goal is speed with evidence.

Find patient zero first. Check the “Owner” property of encrypted files. The owner is usually the account that encrypted them. That gives you patient zero fast.

Let honeypots keep working. If you have decoy shares, don’t kill access to them until you’ve confirmed the source machine. Cutting access prematurely just pushes the ransomware to the next target.

Isolate and kill the identity simultaneously. EDR-isolate the machine (or unplug the cable). Disable the compromised AD account, kill sessions, revoke cloud tokens. Don’t wait for full confirmation. You can re-enable a clean account, you can’t un-encrypt a file server.

Assess lateral movement in parallel. Check if the compromised account touched other systems. Look for SMB connections, new admin accounts, unexpected scheduled tasks. With fast campaigns like Akira, this can’t wait until isolation is complete.

Verify backups immediately. Log in from a clean machine. Check for deletion attempts, failed jobs, unfamiliar sessions. Keep air-gapped copies disconnected until the threat is fully contained.

Recover and verify. Rebuild from clean images, restore from verified-clean backups, patch the entry point. The Northshore School District learned the cost of skipping this: their two-person sysadmin team had to rebuild 180 Windows servers and reconstruct Active Directory from scratch because their backups weren’t properly tested.

Post-mortem: fix the gap, not the person. What worked? What failed? Were honeypots in the right places? Did someone ignore an alert? Update the runbook. Attackers will come back if the door stays open.

Anti-ransomware tools and solutions

If you’re an SMB picking one stack: Microsoft Defender for Business (EDR, included in M365 Business Premium) + Huntress or Sophos MDR (24/7 human-reviewed monitoring) + Thinkst Canarytokens (free canary files) + immutable backups. That covers behavioral detection, expert alerting, deception-based early warning, and ransomware-proof recovery on a realistic budget.

For teams with more technical depth, Wazuh (free open-source SIEM/XDR), Velociraptor (free endpoint forensics for mid-incident hunting), and Suricata (free network IDS) are all production-grade tools, but they require setup and maintenance that most SMBs can’t realistically staff.

The bottom line

Ransomware dwell time has dropped from weeks to days to, in some campaigns, under an hour. But you don’t need a million-dollar security budget to defend against this.

You need EDR on every machine, someone watching the alerts (even if it’s an MDR service), canary files and honeypot shares in the right places, backups that are disconnected, immutable, and actually tested, and a one-page plan for what to do when things go wrong.

No single product will save you. Anyone who tells you otherwise is selling something. What saves organizations is layers that compensate for each other, a team that’s practiced the response, and the willingness to overreact when the alert fires. The difference between a bad week and a company-ending disaster usually comes down to whether those basics were in place before the attack started.

from StarWind Blog https://ift.tt/IFo3aur
via IFTTT