Recently active topics

Where CVE-2026-12569 code actually executes, and what telemetry sees itThe Clop campaign against PTC Windchill produced two structurally different implants. Most coverage treats them as one thing. They are not, they do not generate the same telemetry, and a detection built for one will not fire on the other. This writeup covers the exploit chain, the Windchill process model that determines where your parent-process anchor belongs, the split between the two shells, and how to instrument both platforms with Sysmon.The exploit chainCVE-2026-12569 is a deserialization of untrusted data flaw in the Windchill login servlet, affecting PTC Windchill PDMLink and FlexPLM prior to 11.0 M030. NVD scores it 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); ReliaQuest and SecurityWeek cite 9.3. Same defect, different scoring sources.It is not exploited alone. Operators chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5) to enumerate the target first. That reconnaissanc

STR took two tools to Black Hat Arsenal this year: Obscurize, a defensive deception tool that turns malware’s own anti-analysis checks against it, and Inquisitron, a real-time Sysmon viewer and behavioral detection engine for threat hunting. Obscurize was demoed twice across the Arsenal schedule, and both sessions drew a standing crowd well past the session ending.The reception said as much as the attendance numbers. Several attendees told us they had been looking for something like Obscurize for a very long time, and one even asked for selfies “with the developer” during the demo. Both projects are open source and available now on Github. Links below!I personally never thought I would get to the point where I would have something unique and novel enough to bring to a conference like Black Hat, but here I am! This journey took me through learning the inner workings of Windows subsystems, how Detours work, userland rootkits and how they can be used offensively and defensively. We all le

Securonix ThreatWatch Monthly Intelligence Insights – July 2026 Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay Kumar  Introduction: The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Watch in July 2026. The report also includes a synopsis of the threats, indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), and related tags. Each threat has a comprehensive summary from Threat Labs and search queries from the Threat Research team. For additional information on Threat Labs and related search queries used via Autonomous Threat Sweeper to detect the below-mentioned threats, refer to our Threat Labs home page. Last month, Securonix Autonomous Threat Sweeper identified and analyzed 4,403 TTPs and IoCs; identified 129 emerging threats; investigated 89 potential threats; and elevated 11 incidents. The top data sources swept against include IDS / IPS / UTM / Threat Detection, Data Loss Pr

We have added email notifications for approaching overages so you can stay ahead of them rather than discovering them later in the invoice cycle. This feature is available in 6.4 April R1 and later.It is designed for platform administrators, MSSP administrators, and billing or capacity owners who want an early warning when ingestion is getting close to the licensed limit.How to get startedGetting started is straightforward:Go to Menu > Reports > Categorized Reports > Overage Notifications Choose the report that matches what you want to monitor Click the schedule icon Set your threshold Add your recipients Save the scheduleThere is no separate feature toggle. Once the report is scheduled, the notification is active.What to expectThe notification is informational, not enforcement-based. It does not pause ingestion or block overage charges. It simply gives you an early signal so you have time to review usage and take action.Recipients do not need a Securonix login, so you can inc

OverviewOn July 22, 2026, six U.S. federal agencies (the FBI, CISA, NSA, the EPA, the Department of Energy, and U.S. Cyber Command) jointly updated an advisory (AA26-097A) first issued in April 2026, warning that nation-state actors are still actively exploiting internet-facing programmable logic controllers (PLCs) across U.S. government facilities, water systems, and energy infrastructure.What makes this campaign notable is not a new vulnerability. The attackers do not exploit a software bug at all; they scan the internet for exposed PLCs and human-machine interfaces (HMIs), then connect using the vendor's own legitimate engineering software with working credentials, indistinguishable at the network level from an authorized technician logging in to do maintenance. Once inside, they copy the controller's project file (the blueprint that encodes both control logic and I/O configuration), modify or delete pieces of that logic, including reusable code modules shared across many devices, a

OverviewOn July 21-22, 2026, Huntress' Security Operations Center identified a burst of unusual executable installs, Microsoft Defender exclusions, and anomalous persistence activity across 29 separate organizations, all traced back to a single process name: ClaudeDesktop.exe. Huntress has named the campaign FakeAgent, and the investigation that followed is one of the more unusual malvertising cases of the year, both for its abuse of legitimate infrastructure and for the anti-analysis lengths the operator went to protect the payload.The short version: a Bing search ad for "Claude Desktop app" pointed, legitimately, to claude.ai. But the ad's destination was a user-generated Claude Artifact, a feature that lets anyone publish and share simple interactive content on Anthropic's own domain. The artifact impersonated the official Claude Desktop download page and redirected victims off-domain to attacker infrastructure serving a trojanized installer. What followed was a Matryoshka-doll chai

TL;DRA Russian state-sponsored actor (tracked by Unit 42 as CL-STA-1114, by the Dutch AIVD/MIVD and joint international advisory as "Laundry Bear," and overlapping with Microsoft's Void Blizzard) has been exploiting a Zimbra Collaboration Suite zero-day (CVE-2025-66376) since at least July 2025. The exploit is a "half-click"/zero-click stored XSS: simply opening or previewing a crafted HTML email in a vulnerable Zimbra Classic UI webmail session is enough to trigger silent JavaScript execution and full mailbox compromise: no attachment, no link click, no macro. The campaign is far larger than the single incident that first surfaced it. Seqrite Labs publicly documented one narrow slice in March 2026 (a Ukrainian State Hydrology Agency target, which it named "Operation GhostMail" and attributed with medium confidence to APT28/Fancy Bear). A July 2026 joint advisory from CISA and 14 other countries' agencies, corroborated by Unit 42 and Proofpoint, revealed the activity dates back a full

Executive Summary: Several packages in the @asyncapi npm namespace were maliciously republished after an attacker abused AsyncAPI's release process. The malicious code did not rely on npm lifecycle scripts. It executed when affected runtime modules were imported or required, which means npm install --ignore-scripts would not have prevented execution once a compromised package was loaded by an application, build process, or developer tool. The impact extended beyond the directly republished packages because @asyncapi/specs is used across AsyncAPI tooling. Parser-based validation, generators, CI jobs, container builds, and developer workstations may have been exposed if they resolved and loaded the affected versions during the publication window.The releases moved through legitimate publishing channels, including GitHub Actions OIDC trusted publishing and valid provenance attestations. Provenance confirmed the publishing path. It did not prove that the release content was safe. The secon

name: 'WordPress wp2shell Post-Exploitation Persistence and Enumeration Activity Analytic'signatureid: WAF-APP02-RUNcategory: 'Persistence'threatname: 'Server Software Component: Web Shell'functionality: 'Web Proxy'description: | Detects the post-exploitation web activity Wiz Research observed following successful exploitation of the wp2shell WordPress Core RCE chain (CVE-2026-63030 + CVE-2026-60137), disclosed 2026-07-17 and confirmed exploited in the wild from 2026-07-18. This rule covers what multiple actors did next on compromised, cloud-self-hosted WordPress instances: 1. Malicious plugin upload for persistence — attackers accessed /wp-admin/plugin-install.php?tab=upload and POSTed to /wp-admin/update.php?action=upload-plugin to install backdoors. Observed payloads included a minimal one-liner PHP webshell (eval($_POST['<param>'] ?? 'http_response_code(404);'), returning 404 as an evasion technique), a ~150KB full-featured webshell masquerading

name: 'WordPress REST Batch API Exploitation wp2shell Analytic'signatureid: WAF-APP01-RUNcategory: 'Initial Access'threatname: 'Exploit Public-Facing Application'functionality: 'Web Application Firewall'description: | Detects requests to the WordPress Core REST API batch endpoint consistent with exploitation of "wp2shell", a pre-authentication remote code execution chain in WordPress Core disclosed 2026-07-17 and confirmed exploited in the wild from 2026-07-18. wp2shell chains CVE-2026-63030 (REST API batch-route confusion) with CVE-2026-60137 (SQL injection reached via the REST author_exclude parameter, which maps into WP_Query's author__not_in query variable). CVE-2026-63030 was discovered by Adam Kues of Searchlight Cyber / Assetnote; CVE-2026-60137 by researchers TF1T, dtro and haongo. Root cause: in WP_REST_Server::serve_batch_request_v1(), a sub-request that fails to parse is appended to the $validation array but not to $matches, leaving the two arrays off by one. Each di

OverviewOn July 17, 2026, WordPress shipped a coordinated security release closing a pre-authentication remote code execution chain reachable against a typical default install, no plugins required, no login page in front of it, provided a persistent object cache is not configured. WordPress runs roughly 43% of all websites. Searchlight Cyber, which found the primary bug, estimates over 500 million sites are built on it.The chain, named wp2shell, combines two flaws:CVE Description Vendor severity (WordPress GHSA) CVSSv3 (per Tenable / Hadrian) CVE-2026-63030 WordPress Core REST API batch-route confusion leading to RCE Critical 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H published by Hadrian CVE-2026-60137 WordPress Core WP_Query author__not_in SQL injection Moderate 5.9 The WordPress GitHub Security Advisories carry severity labels only. The numeric scores and vector above come from third-party analysis (Tenable's RSO FAQ table and Hadrian's technical overview),

name: OTTERCOOKIE Stealer Upload to Rare DEV Domain via axios User-Agent Analyticsignatureid: PXY-WEB11-ERIcategory: 'Exfiltration'threatname: 'Exfiltration Over C2 Channel'functionality: 'Web Proxy'description: | Detects the credential, wallet, and file exfiltration HTTP behavior of the REF9403 Contagious Interview / OTTERCOOKIE stealer modules at the web-proxy layer, without depending on a specific C2 domain that is likely to be sinkholed or rotated shortly after publication. The browser credential / crypto wallet stealer and the file stealer both submit stolen data via HTTP POST to a /upload endpoint (multipart for browser artifacts, raw files for the file stealer) and, for wallet LevelDB stores, to a /cldbs endpoint. All stealer network requests are issued by the malware's embedded HTTP client using the distinctive User-Agent axios/1.18.1. Rather than pinning to rightwidth[.]dev, this rule matches the durable request signature (POST to /upload or /cldbs carrying the axios/

name: OTTERCOOKIE Clipboard Stealer High-Frequency Get-Clipboard Polling Analyticsignatureid: WEL-PSH136-RUNcategory: 'Collection'threatname: 'Clipboard Data'functionality: 'Microsoft Windows PowerShell'description: | Detects the Windows clipboard-stealer module of the REF9403 Contagious Interview / OTTERCOOKIE campaign. The malware's fourth module polls the clipboard every 500 milliseconds and exfiltrates any changed content to the rightwidth[.]dev C2. On Windows it retrieves clipboard contents by spawning a fresh PowerShell process for every poll using the exact invocation "powershell -NoProfile -NonInteractive Get-Clipboard" with windowsHide set. Because a new short-lived PowerShell process is created roughly twice per second, the behavioral signature is a high-frequency repetition of NoProfile/NonInteractive Get-Clipboard executions from the same host. This rule uses aggregated event analytics to surface that abnormal cadence, which is inconsistent with any legitimate inte

name: OTTERCOOKIE SVG Steganography Payload Reassembly and Eval Execution Analyticsignatureid: EDR-NIX26-RUNcategory: 'Execution'threatname: 'Command and Scripting Interpreter: JavaScript'functionality: 'Endpoint Management Systems'description: | Detects the SVG steganography reassembly and dynamic execution stage of the REF9403 Contagious Interview / OTTERCOOKIE campaign. DPRK-aligned actors distribute trojanized e-commerce "coding challenge" repositories (e.g. next-ecommerce-private-main, shopping-platform, gocart-based Next.js templates) in which the malware payload is split into Base64 fragments embedded inside HTML comment blocks (<!-- ... -->) across every country-flag SVG in an assets directory (AE.svg, AF.svg, etc.). A helper file (serverValidation.js) reads every .svg in the flags directory in alphabetical order, concatenates the comment-block chunks, decodes them with a custom Base64 function named Check(), and passes the result straight to eval() via runServer

OverviewOn May 26, 2026, a user calling themselves "Maxwell" posted in the #jobs channel of Elastic's public community Slack workspace, claiming to be upgrading an e-commerce platform to "a modern, scalable architecture using Next.js (v14), NestJS, PostgreSQL, and Auth.js" and looking for an experienced developer to help. Interested developers were moved into direct messages and asked to complete a take-home coding assessment -- a familiar Contagious Interview playbook that has been running since at least December 2022.What was not familiar was how the payload was hidden. Elastic Security Labs, which discovered the campaign after the actor targeted its own Slack community, found that the malicious code was split into Base64-encoded fragments and stashed inside HTML comments across every SVG "flag" image (AE.svg, AF.svg, and so on) bundled into the trojanized repository's assets directory. A helper script reassembled the fragments in alphabetical order and eval()'d the result on every s