Threat archive
Every threat the Spectrum Delta Research Team has broken down for detection, newest first.
PEERSTITCH pivot (pipeline test)
CL-STA-0954 (aka UNC5820) turned one FortiManager into keys to 500+ FortiGates, then left a memory-only implant with no file, port or callback; downstream compromise is unconfirmed. Unit 42 (Oct 14, B/2) reported a September 2024 intrusion at a telecom managed service provider via CVE-2024-47575; CISA added CVE-2025-61624 to KEV on Oct 16, 2026 and flags it for forensic triage. Client networks were not examined; stolen trust material stays valid until rotated.
n0n credential extortion
n0n, a destructive extortion crew active since September, enters via FortiGate SSL-VPNs and weak admin credentials, then extorts by encrypting - or exfiltrating and deleting data and backups. SOCRadar STRU (Oct 28) recovered an operator workspace mapping 23 organizations in 14 countries as separate cases, not one intrusion chain; 4 were access attempts without established outcome and scale figures are operator-claimed. No vulnerability exploitation was identified in the recovered material.
Volt Typhoon Silent Train
Volt Typhoon chains compromised home and small-office devices into short-lived SSH relays, then wipes them, to launch zero-days against SD-WAN and RMM management consoles. Black Lotus Labs (Lumen, Oct 28) calls the framework Silent Train: at least four zero-days, including VeloCloud CVE-2026-16812 and Cisco SD-WAN CVE-2026-20127, sessions under 8 hours, hybrid since early 2025. Attribution is Black Lotus Labs' assessment; victims are not enumerated.
Sirius backdoor FedEx fileless
Trellix (Oct 26) documents a priority-customer escalation delivering a previously undocumented variant of the Sirius backdoor - the same family Group-IB (Oct 22) documents as the 'SiriusQT' MaaS RAT (config marker <<SIRIUS_STUB_CONFIG>>, default port 4449). A Korean-language spear-phish posing as a FedEx tax invoice (217,740 KRW) carries a ZIP with a blank PDF whose /OpenAction /Launch object spawns hidden encoded PowerShell. An AES-CBC/GZip in-memory unpacker reflectively loads a .NET Stage 1; RC4 with a SHA256-derived key and a 3-to-1 byte de-interleaving trick rebuild the Stage 2 injector, which patches ntdll!EtwEventWrite to blind EDR/AV, downloads zeus.dat, and hollows msbuild.exe or svchost.exe via Early Bird APC injection (NtQueueApcThread). The VC++ backdoor beacons 185.114.206.45:4449 and pairs HVNC, SOCKS5 pivoting, Chromium credential harvesting and crypto-clipboard swapping with a persistence matrix that includes Windows provisioning packages (.ppkg) surviving full OS resets.
Yoba signed-AI sideload
Check Point Research (Oct 27) documents 'Yoba', a campaign tracked for two months: Likely SEO-poisoned (per CPR) fake GitHub projects pose as GPT-5.6 Sol / GPT-6 Astra / Claude Opus desktop apps and ship the genuinely signed OpenAI or Anthropic Setup.exe next to a malicious winmm.dll that the signed binary sideloads. The YobaDropper stages a Windows-Media-Player-masqueraded scheduled task in ProgramData\WMProcess; the YobaLoader derives tasking domains from the last 50 bytes of a Telegram channel photo, fetches Ed25519-signed AES-encrypted instructions from DNS TXT via Google DoH, and deploys its payload three ways - including XMRig mining through a local Tor SOCKS proxy to an onion endpoint.
Teams external-chat IT scam
Arctic Wolf Labs (Shubham Dubey, Oct 26, A/2) analyzes more than 400 incidents (no full date range stated) in which threat actors abused Microsoft Teams' default-on external access (federation) for initial access: throwaway or acquired M365 tenants — 30-40% still on default *.onmicrosoft[.]com domains, increasingly IT-themed .top/.com paid domains — create one-to-one external chats using 'IT Support (Internal)', emoji-marked and organization-named display names, often minutes after mail-bombing the victim's inbox to manufacture urgency. A voice call from within Teams then walks the victim into launching Quick Assist (quickassist.exe, the most frequent; the report also lists msra.exe, the separate legacy Windows Remote Assistance binary) or a commercial RMM (AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, LogMeIn; Level installed via msiexec); multiple users are targeted within ~5-minute windows (assessed automation) and customer-reported chains reach payload execution in under 15 minutes. The concrete observed example: victim-run PowerShell (explorer.exe parent) downloads an MSI from Azure Blob Storage bundling cleaner.ps1 (hex-array IEX loader that decrypts an AES-encrypted payload with a hard-coded key/IV, hash-checked, executed via ScriptBlock) dropped to AppData\Local\PowershellCleaner\scripts, which extracts pythonw.exe and an ss.py implant from archive6.zip; the implant issues LDAP queries for all AD computer and user objects via adsisearcher and transmits the results to C2 endpoints picked from a domain/URI list. Attackers avoid pasting URLs into Teams (which would trigger Safe Links/ZAP scanning) and instead navigate to payloads during the remote session — shifting the detection burden to endpoint and identity telemetry. Arctic Wolf assesses the chain aligns with vendor-documented campaigns (Microsoft's Black Basta/Storm-1811 2024 origin; Sophos's STAC4749/Chaos .top-domain pivot; Zscaler's GoGRPC) but does not attribute the 400+ incidents to a single actor. (Arctic Wolf Labs (https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/), A/2).
Armorsteal
Zscaler ThreatLabz (Nashid P, Oct 22, A/2) documents Armorsteal, a Python 3.11 malware family packed with Pyarmor 9.1.7, distributed since September 2026 through SEO poisoning: fake Chocolatey (choclatey[.]org) and Microsoft Activation Scripts/Massgrave (massgravel[.]net) websites rank for install-command searches and display a malicious PowerShell command that downloads a ZIP to C:\Windows\SystemHealth\Update\ (a Python 3.11 runtime plus three modules) and creates scheduled tasks. The remote-access module polls a hardcoded set of C2 domains every 60 seconds using a machine ID derived from the motherboard serial number, fetching RSA-2048-signed Python tasks executed in memory, with per-victim (/get-onetime-code/) and global (/get-global/) task channels versioned via onetime_version.txt and global_version.txt. The surveillance module hijacks the clipboard every 0.5 seconds replacing copied cryptocurrency addresses (BTC, LTC, XMR, ETH, TRON, XRP, DOGE, TON, SOL), captures screenshots when configured keywords appear, uploads XOR-encrypted PNGs and keystroke logs, and shows fake Exodus/MetaMask/Phantom transaction notifications. The stealer extracts browser cookies via the Chrome DevTools Protocol on port 9222, searches drives A: through Z: for BIP39 seed phrases, and harvests wallets (21 extensions/apps), Discord tokens (22 client variants), password managers, SSH keys and Steam sessions. Zscaler links both lure sites to one operation via shared components and the RSA task-signing key; after the lure sites went down (~Sept 25 and ~Oct 1) the operation kept rotating C2 (workerstats[.]net to pymons[.]is/datamons[.]org in early October) and moved module downloads to token-protected /C2/?t= requests with an X-Verify header — the actor is assessed to remain active.
Prince of Persia / Infy
Semperis (Tomer Bar, AVP of Security Research, Oct 22, A/2) documents the current state of Prince of Persia (aka Infy), an Iranian nation-state-sponsored espionage group active for nearly two decades against Iranian dissidents and public and private organizations in the US, Europe and the Middle East. When the US–Iran conflict began on February 28, 2026, the group went dark for three months — the longest downtime in its history — then rebuilt: operations restarted May 27, 2026 with a new C2 bank. This research explicitly covers the group's actions since SafeBreach's February 4, 2026 report (same researcher, then at SafeBreach): the C2 server 45.80.148.249 was shut down within a week of that publication and victim GUIDs were purged from the long-standing updatelist.txt management file. The newly located Tornado second-stage C2 — missing from the public picture since September 2025 — runs on US Namecheap shared hosting managed with cPanel, which the primary describes as the group's first US-hosted server in a decade; a further server was rebuilt behind Cloudflare on August 24, 2026, which Semperis suspects followed the actor realizing its newest server had been discovered. The current families use DGA-generated domains alongside non-DGA domains (both appear in the published IOC sets), and incoming C2 requests are authenticated with RSA signature validation, which Semperis describes as locking out security researchers and automated scanners — Tonnerre's anti-takeover signatures are described as preventing sinkholing, the matured counter to Unit 42's 2016 sinkhole of the group's Infy-era C2 (documented in Unit 42's own follow-up research). Exfiltration runs through a Telegram bot: the Tornado second-stage C2 hosts a tga.adr file, obtainable by specific victims, containing the Telegram bot API key used to exfiltrate victim files to a Telegram group chat controlled by the actor — the API key and chat ID live in the C2 backend configuration rather than the malware (the file was unavailable at publication, and Semperis suspects the actor changed its filename). Tornado, the newest family (version 51), builds on the Foudre/Tonnerre codebase, can be delivered through one-day software vulnerabilities (WinRAR exploits cited), and can decode fields hidden in blockchain transactions to change C2 routing without updating malware on victims. Observed campaign activity: in the first week after the May 27 restart, Tonnerre exfiltrated more than 1,800 files from one victim; an August 2026 victim was still active; Semperis monitored the exfiltration for six months and describes a low victim count that could indicate either targeted attacks or difficulty infecting new victims.
deepveindrilling Magento loader
Sansec Forensics Team (Oct 24, A/2) documents a criminal campaign that has infected 953 online stores since July 2025, mostly Magento, with a JavaScript loader written into the Magento cms_block database table — the static blocks Magento renders into storefront pages. Five loader domains rotated across the campaign (manulfie.click 863 stores, neswnsssn.click 494, lanhd6549tdhse.top 355, additionalver.com 246, deepveindrilling.com 83 since October 7). Earlier waves entered through Magento file-upload flaws — the March PolyShell (CVE-2026-48356) wave put webshells and the loader on 471 stores in one hour — and eComscan has flagged rogue administrator accounts and GSocket backdoors on campaign stores; a fully patched Magento 2.4.7-p10 store received the new loader at 16:46 UTC on October 23, one hour after a clean scan, on a store where eComscan had separately found a rogue admin account (September 16) and a GSocket backdoor (September 24) — the primary does not identify the method used for that October write. The October loader inline script sends a browser fingerprint — navigator.webdriver, Selenium globals, ChromeDriver cdc_ properties, GPU, CPU cores, memory, screen size, timezone, client hints — to deepveindrilling.com/?s=49b7ca5f&fp=, and the server picks its response from that fingerprint: urlscan.io's automated Chrome got HTTP 200 with no added content. The loader code is also designed for visitor-side persistence: the first CMS-block script re-executes a payload stored in localStorage key fpCode by writing it into the onclick attribute of an invisible div and clicking it — no eval() — but nothing in the block writes fpCode (the served payload would have to set it), and Sansec has not captured the final payload, so storage and re-execution are code-verified design, not observed behavior. Earlier versions used the Keitaro commercial TDS to decide per visitor between payload, redirect or nothing; Sansec Watch CSP monitoring recorded about 52,000 visitor reports for additionalver.com alone, and in December 2025 logged-in shoppers on infected stores received crypto-themed scripts (leqdger.click, a Ledger misspelling) — a historical payload observation.
testmetest / CementBeetleSteeple
JFrog Security Research (Oct 26, A/3) links 42 armed third-party GitHub repositories across 11 legitimate owners to the testmetest npm campaign, exposing the machinery behind it. Malicious npm releases deliver a worm that steals GitHub and npm credentials, which provide access to third-party repositories; inside hijacked repositories the campaign leaves smoke-test placeholders or armed payloads — execution hooks for AI coding assistants and IDEs (a .claude/settings.json SessionStart hook running 'node .github/init.js || bun .github/init.js', with equivalent triggers planted for Gemini, Cursor MCP configuration and VS Code folder-open tasks) plus 12.9–13.7 MB polymorphic wrappers that all decode to the same hidden CI-publisher payload. The recovered publisher's intended loop: short-lived chore/ci-<hex> branches carry a root-level ci.js and an Actions workflow, and the decoded publisher harvests GitHub tokens, searches files for token-shaped values, and implements GitHub OIDC-to-npm token exchange (the keyOwnerProof/publicKeyRequest trusted-publishing flow) to rebuild the named target package with an injected postinstall and attempt to publish it — feeding package delivery back into repository compromise. Malicious releases were published to npm (data-pipeline-testmetest@2.0.1 at 11:13:23 UTC on October 21, though the primary says that release was likely published manually or from a run subsequently deleted — no retained Actions run aligns with it). The campaign later switched camouflage: a precompiled native addon (addon.node / addon_win.node) containing no payload of its own, which at runtime locates its own folder, decrypts a dotfile named .napi_cache into JavaScript, drops it hidden in the temp directory and runs it as a detached node process — the primary's characterization is that the malicious logic moves 'out of readable JavaScript and into compiled code that refuses to run in CI, containers and debuggers'. The attacker-owned CementBeetleSteeple repository doubles as a live encrypted data sink, having received 27 data/snap-*.json envelopes (384,825 bytes, October 22–24) committed with the message 'chore: sync', and fake CodeQL workflows dumped real npm tokens from the environment into one-day artifacts.
uCreator / YingGai
Independent researcher Ovi (Oct 21, B/3) exposes uCreator — the vendor's own name for the product is YingGai — a commercial Android surveillance platform built around Chinese 'mass control' (群控): a VirtualApp/LSPatch engine, a library of per-application hook modules, a Redis and HTTP control plane, a cloud-phone farm with live screen control, and a Windows operator console, rented to customers who aim its capabilities at victims they pick. The code-confirmed target roster covers about 20 applications including GCash, WeChat, WeCom, QQ, Telegram, WhatsApp, LINE, Zalo, KakaoTalk, Viber and MoMo. Delivery is not a standalone spyware app: thin repackaged copies of legitimate apps (Telegram-X / Telegram-Web, WeChat, GCash) merged via LSPatch or injected from assets/TgJarPine.dex via Pine, or the untouched app run inside the vendor's 'Onion Box' VirtualApp container, with target-specific instrumentation fetched after installation from operator Alibaba OSS and MinIO storage. Inside the app, the recovered code can hook the SRP proof routine to capture Telegram's two-step-verification password in cleartext before it is hashed, issue live SQL queries through Telegram's own MessagesStorage database handle, remove its own session from the account's device-authorization list, and clone WeChat accounts by extracting the login identity and re-running login with a bundled script; code-confirmed support also covers OTP interception, wallet data extraction and camera spoofing intended to defeat KYC liveness checks. A leaked operator backend on an open GitLab server shows a rentable cloud console, customer-ID-tagged commands, and 'account cultivation' schedulers whose randomized limits and budgets are designed to evade platform risk checks. The Telegram component is the same backdoor Doctor Web reported as Baohuo in October 2025 (Android.Backdoor.Baohuo.1.origin, 58,000 devices). The author states the report is an analysis of technical capability, not a measurement of victim impact, and that what the code establishes should be distinguished from what has been exercised end-to-end; the counted procedures of this card are the delivery and the control-channel connections, which standard telemetry records.
Gheist
Wiz Research (Oct 25, A/3) designates Gheist, an automated campaign tracked since September 15, 2026 that performs mass abuse of stolen GitHub tokens: for every repository a token can reach, it pushes a branch named ci-sync- plus six random characters carrying a single new file .github/workflows/sync-check.yml (commit message 'ci: sync config', unsigned, authored as the token's owner). The triggered workflow prints the job environment and the repository's secrets — base32-encoded, which defeats GitHub's verbatim-only log masking — into its own Actions log; the tool then downloads the log through the GitHub API and deletes the run seconds later. There is no attacker server: the secrets leave through GitHub itself. Wiz recovered more than 13,500 planted branches from more than 850 compromised accounts, from personal projects to enterprise organizations' private repositories. GitHub's public-repository approval hold stopped every public run checked (action_required), but the hold does not apply to private repositories or GitHub Enterprise Server, where audit logs show runs completing and being deleted by the 'gheist' user agent and CloudTrail shows organizations' own workflows assuming AWS roles from ci-sync- branches. A later variant adds a sync-host job on self-hosted runners that searches the host for 31 token formats, private keys, .env files, Terraform state and cloud instance-role credentials.
Tailworm — unpatched Tailscale SSH root-escalation and tailnet-escape findings
Erica Windisch (Cyberdione Labs) published 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 on Oct 24-25, 2026, without coordinated disclosure. With Tailscale SSH enabled, root-privileged tailscaled dials root-only Unix sockets on behalf of an approved peer, so an accepted SSH rule with forwarding becomes root on the target and capture of node enrollment keys. No CVE, fix, or vendor bulletin yet; no in-the-wild exploitation reported.
Ebury Tor exits
An independent Tor relay operator publishing as kaba (primary, Oct 20, in-window) documents a coordinated interception campaign that ran Oct 1-5, 2026: attackers who had held Ebury 1.8.3 - an OpenSSH backdoor and credential stealer for Linux - on relay host servers since August switched it on at 09:35 on Oct 2, making 333 of Tor's roughly 3,000 exit relays (~10%) redirect port-22 SSH connections to 12 interception servers. About a dozen relays presented substituted host keys, triggering the client's host-key-changed warning; users who clicked past it and typed a password handed the credential to the interceptor, which kept the session alive by relaying to the real server while watching every command, and opened a further connection attempting to plant Ebury on the destination server via a base64-encoded Perl payload preceded by a sudo-permission probe. Exit policies were also manipulated so the relays carried unencrypted mail traffic. Tor's network health team flagged the relays BadExit from Oct 4; by Oct 5 17:00 UTC none remained in the consensus. ESET's Ebury research (400,000 servers compromised 2009-2023) treats the operators as a financially motivated crime group, and ESET's Léveillé - quoted in the primary - assesses more compromised relays likely remain.
LiteLLM attack chain
LiteLLM's canonical root-cause analysis (Oct 23, B/2 — the vendor's own postmortem, in-window) documents for the first time the intrusion chain behind the already-carded v1.107.0 backdoor: an Agent Platform master key committed to a public repository in May and never revoked let an unidentified attacker extract an organization-owner GitHub CLI OAuth token via the platform API on Oct 10, harvest two maintainer tokens through throwaway-branch CI workflows, and then on Oct 21 disable branch protections, repoint the private release workflow to a lookalike repository, approve the production gate with a stolen token, and delete the workflow-run records and visible history. The whole chain is recorded in GitHub organization audit logs.
Bronze Sandcastle
Sophos CTU and SophosLabs (Oct 20, A/3) designate BRONZE SANDCASTLE, a newly identified, assessed China-based espionage cluster whose most distinctive marker is consistent Sandboxie DLL sideloading: legitimate executables (SandboxieWUAU.exe or a renamed Start.exe) load a malicious sbiedll.dll that reads an encrypted config.ini payload and executes it in memory as a modified Meterpreter-style backdoor. Across incidents from August 2025 to August 2026 the group ran network and account enumeration, then created Volume Shadow Copies and copied the Active Directory ntds.dit database.
Amazon ClickFix (Doina)
Huntress Labs (Oct 21, A/3) documents an Amazon-themed ClickFix campaign observed hitting at least three Huntress customers: a sponsored Google ad for 'amazon business' leads to a spoofed Amazon login whose fake CAPTCHA pastejacks a Windows Run-dialog command that invokes finger.exe to fetch a staged script, ending in a Doina loader, a suspected Lumma Stealer injected via process hollowing, and a pirated NetSupport RMM.
Wazza device-code phishkit
LevelBlue SpiderLabs (Oct 20, A/2) documents Wazza, a newly observed multi-stage phishing kit active since at least early July 2026 that targets Microsoft 365 accounts with device-code phishing — the kit presents Microsoft's device code as a 'document verification code' inside Adobe- and Microsoft-branded document pages, so the victim authorizes the attacker's OAuth client through Microsoft's legitimate device-authorization flow rather than typing a password into a fake form. The kit wraps the final page in staged routing with anti-automation browser checks, making the initial link uninformative to URL reputation and automated scanning.
ARTEX Okta/Entra spray campaign
Wiz Research (Oct 22, A/2) documents a month-long October 2026 campaign in which an ARTEX-using actor — overlapping Microsoft's Storm-0940 attribution — directly attacked identity infrastructure at multiple IT and software vendors: Okta, Entra ID, AWS Cognito and proprietary login flows. The autonomous AI agent ran a repeatable playbook — map the application from its own source maps, probe OAuth/SSO with fabricated codes and unsigned JWTs, abuse account recovery, test tenant isolation, and password-spray in machine-paced bursts — and Wiz states most attempts failed: sustained targeting, not a confirmed breach.
BlackX UEFI bootkit
Kaspersky GReAT (Oct 22, A/3) documents BlackX, a UEFI bootkit used in an early-2026 APT campaign that infected machines at diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan, attributed to APT41 with medium confidence. It re-implements the BlackLotus crimeware bootkit's Baton Drop chain (CVE-2022-21894) to install custom Machine Owner Keys on fully patched hosts — possible because Microsoft's fix requires a manual Secure Boot certificate revocation step the targeted hosts had not activated — followed by a kernel driver that impairs security tooling and espionage payloads.
Majinahanashi ransomware
Majinahanashi is an actively-deployed ransomware operation (Japanese-branded, unattributed; first victim listing June 2026, ~32 tracked victims, most recent Oct 23) analyzed from a live sample by Cynet CyOps (Oct 21, A/3). Its encryptor is built for speed and invisibility: it throttles security agents to 'nothing' via Windows Filtering Platform rules and QoS policies so the agent stays green on the host while cut off from its cloud, fires a twice-run 14-second recovery-inhibition burst of directly-spawned Windows utilities, and encrypts in stripes at lowered disk priority to stay under behavioral-detection thresholds.
APT28 Hookedge NATO campaign
Symantec's Threat Hunter Team (Oct 20, A/3) documents a successful two-month APT28/Swallowtail (GRU-linked) espionage intrusion at a European naval shipbuilder, part of a campaign compromising three national-security-relevant organizations across two unnamed NATO countries (a naval shipbuilder, a military aircraft engine maker, a law enforcement agency). The intrusion chain: a macro-enabled Word attachment dropped the Hookedge backdoor, which used a hidden one-pixel off-screen Microsoft Edge window as its HTTP client to fetch tasks from webhook.site; operators then planted an SSH private key, opened a persistent tunnel to their server, captured NTLM handshakes via a loopback PowerShell listener, and ran an undocumented reflective loader (ld.exe) whose encrypted payload was never recovered. Whether any data was stolen is not established.
Heartbreaker macOS ransomware
Patrick Wardle's Objective-See analysis (Oct 18, A/3) documents Heartbreaker, a previously unknown macOS ransomware sample uploaded to VirusTotal in May 2025 with zero antivirus-engine detections in the scan at publication. It is an ad hoc-signed ARM64 Mach-O that attempts LaunchAgent persistence, recursively encrypts files in the user's ~/Downloads folder in place with AES-256-GCM using a hardcoded key (renaming them .heartbreaker, demanding 0.003 BTC), and then attempts to rebuild itself from embedded Rust source to change its hash — though Wardle assesses it as unlikely to be a major threat in its current form (the hardcoded key makes free recovery possible, and the rebuild depends on a build framework that is no longer publicly available, so successful rebuilds are not established).
GCP billing LLMjacking
Wiz CIRT's incident-response report (Oct 20, A/3) documents multiple observed intrusions in which threat actors hijacked Google Cloud Platform billing accounts to fund unauthorized LLM usage. The chain: Google Search ads on admin terms ('google cloud', 'gcp') led through a Google Sites redirect to a fake Google login that captured credentials AND MFA codes; the kit immediately replayed them for the first malicious login, then the actor re-authenticated from a second IP minutes later. In existing low-usage GCP projects the actor enabled the Gemini API, created service accounts with API keys, and granted roles/ml.admin and roles/mcp.toolUser; deleted the iam.allowedPolicyMemberDomains organization policy; added external Gmail accounts with roles/billing.admin; linked attacker-controlled projects to the victim's billing account (cross-tenant: prompts and outputs stayed in the attacker's tenants, invisible to the victim); demoted legitimate billing admins to viewers; and blended geographically via IPs in the victim's HQ country. Within 24-48 hours victims saw tens to hundreds of thousands of dollars in Gemini API charges (Wiz CIRT (https://www.wiz.io/blog/from-phishing-to-llmjacking), A/3).
OVHcloud CLI envchecker
OVHcloud's security advisory (GHSA-862f-55f5-vmvw (https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw), Oct 20, A/3) confirms that a compromised OVHcloud GitHub developer account was used to replace the release binaries of five already-published ovhcloud-cli releases (v0.11.0–v0.15.0) with trojanized builds on 19 October 2026 between 14:47 and 16:21 (UTC+2). The malicious builds are the original Go CLI recompiled with a stripped stealer embedded in an 'envchecker' module that collects cloud, SSH, Git and AI coding-assistant credentials from developer machines and exfiltrates them as an archive to a reported HTTPS upload endpoint, with associated Solana RPC calls whose exact role the primary does not specify. Users who downloaded or updated the CLI during the 94-minute window (~250 downloads) and ran the binary should treat the secrets on that machine as compromised; source, build chain and CI/CD were never touched.
Aokigahara AI-session stealer
Check Point Research (Oct 23 (https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/)) documents Aokigahara, a newly observed Windows infostealer in the wild whose dedicated `aisessions` handler collects authentication, session and configuration files from Claude/Claude Code, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, JetBrains AI Assistant, Kiro and more — alongside browser, Git/SSH and cloud credentials. Stolen data is packaged in AES-GCM-encrypted ZIPs with X25519-derived keys and uploaded in chunks to a /gate C2 (Check Point Research (https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/), A/3); an earlier version may have been known as Kamidere or Stygian (unconfirmed), and the initial infection method is not stated.
Lazarus FlashHole
Kaspersky GReAT (Securelist, Oct 21 (https://securelist.com/lazarus-operation-flashhole/121541/)) documents Operation FlashHole, a Lazarus espionage campaign against at least three South Korean firms with evidence since July 2025: spearphish links to fabricated GitHub Pages sites are the assessed lure, and a suspicious execution chain originated from INISAFE CrossWeb EX (mandatory South Korean financial-security software) — though the exact infection trigger and abuse mechanism could not be determined. The nearly disk-less chain (Securelist (https://securelist.com/lazarus-operation-flashhole/121541/)) runs TechHub, TouchHub/TouchShift mscoree.dll side-loading, a masqueraded service from a copied system binary, and LPEClient delivering Cubridge in memory with ML-KEM-1024 post-quantum key establishment.
MythicRatatoskr Yggdrasil C2
ESET (Oct 22) documents MythicRatatoskr, a previously unknown Go backdoor that hides its C2 server inside the decentralized Yggdrasil mesh network — the first documented state-aligned use of Yggdrasil for C2. UAC-0099 gained initial access to a Ukrainian grain logistics firm via spearphishing (MATCHBOIL/MATCHWOK chain); MythicRatatoskr appeared the next day, and after an assessed access handoff Sandworm conducted a data-wiping attack two months later by deploying SDelete through Active Directory Group Policy.
k0t edge-device campaign
Group-IB and NyxLab (Oct 21) document k0t, a multi-operator campaign that bulk-scans internet-facing FortiGate, FortiWeb and GlobalProtect devices, breaks in via a FortiWeb path-traversal exploit creating rogue prof_admin accounts, forged GlobalProtect authentication-override cookies or lockout-aware brute force, then downloads FortiGate configs and decrypts stored LDAP/AD/admin secrets offline with the default FortiOS key — invisible to the appliance. Persistence follows via MeshCentral (84 devices beaconing at analysis time) and AdaptixC2 with AD credential attacks and Rclone exfiltration to Wasabi/MEGA; 70,000+ exposed credentials identified, and victim overlap with Qilin and The Gentlemen leak sites suggests a likely initial-access-broker role (unconfirmed).
LiteLLM 1.107.0 backdoor
Attackers with stolen maintainer GitHub credentials redirected LiteLLM's release workflow to a lookalike repo (Berri-AI/litellm) and published litellm==1.107.0 to PyPI and Docker on Oct 21, planting Python startup hooks (cook.pth/cook.py, sitecustomize.py) that execute in ANY Python process without importing litellm — a credential stealer (PRIVCOLLECT) exfiltrating cloud, AI-provider, browser and SSH secrets to litellm[.]dev, plus a detached remote-code loader whose second stage has not been observed firing. Microsoft's deep-dive (Oct 23) ships exact Defender detections and implant hashes; LiteLLM states the impacted releases are pulled and treats any environment that ran Python with the implant as compromised.
INC / The Gentlemen affiliates run intrusions through an AI agent (OpenCode + Phantom framework), with a human approving each step
SOCRadar (Oct 20, updated Oct 22) recovered 7 exposed affiliate servers: 133 AI sessions, 62 named victims (36 in the US) and 46 INC encryptor builds staged for Oct 1. The AI is invisible in victim logs; what a SOC can catch is the tradecraft it drove: rogue FortiClient EMS admins and edited VPN scripts, RMM-pushed payloads, a Zemana driver AV-killer and INC encryption. Victim counts and exploitation numbers come from the operators' own records and are unverified.
Storm-0940 + ARTEX
Microsoft (Oct 21) attributes the ConnectWise compromise (posted Oct 17) to Storm-0940. ARTEX agents ran a cross-tenant password spray, then used the stolen ConnectWise app credentials to sign in without any user, reaching 2,250 tenants at about 2,900 sign-in attempts a minute. In some tenants the agents went on to Graph recon, app credential additions and self-assigned privileged roles that persist after the vendor app is cleaned up.