Learn & Share

The STR Team was presented with the following questions: What are the most recent toolchain improvements that you see **Kimsuky** developing and deploying? What are the most recent toolchain improvements that you see **Lazarus** developing and deploying? Overall, what weaknesses are APT attackers trying to overcome in their toolsets with their latest developments? Will these updates make it more likely that the attackers can bypass reasonable antivirus defenses? What should defenders make sure they are doing to protect against these variants and future variants of these tools? Our response to these questions were sited by Dark Reading here:https://www.darkreading.com/vulnerabilities-threats/kimsuky-httptroy-backdoor-south-korea-users Ho

This is, in my opinion, only the beginning of what we will see in the future of "AI Powered" everything. As new innovations land in the hands of cyber professionals and criminals, both sides will find ways to enhance their playbook to maximize their potential and effectiveness. Part of the process for making improvements is testing - this attack, I think, is just that. GTIG noted back in January they we're starting to see integrations of AI into threat actor's toolkits with a recent update in November siting malware strains such as FRUITSHELL, PROMPTFLUX, PROMPTLOCK, PROMPTSTEAL, and QUIETVAULT experimenting with LLMs to achieve dynamic obfuscation. My question is, and has been for some time, who is moving faster - us or them? Threat actors don't have to deal with compliance, ticket queues, reports, metrics, buzzwords, or even laws. Defenders are almost completely reactive in their craft and have to deal with all of the things threat actors don't have to... which costs us time. Time

The XWiki CVE-2025-24893 exploitation campaign demonstrates a rapidly evolving multi-faceted attack landscape where threat actors leverage unauthenticated remote code execution through Groovy code injection in the SolrSearch macro. Attackers employ a diverse toolkit ranging from automated botnet operations (RondoDox) to sophisticated two-stage payload delivery mechanisms that stage downloaders in the /tmp/ directory before executing cryptocurrency miners 20+ minutes later. The attack chains include reverse shell establishment using BusyBox netcat and bash TCP redirections to attacker-controlled infrastructure, with some operations originating from compromised QNAP devices and legitimate AWS IP addresses. Reconnaissance efforts span from Nuclei-based scanning executing cat /etc/passwd for validation to custom OAST callback mechanisms, while payload delivery leverages standard Linux utilities (wget, curl) to retrieve obfuscated base64-encoded scripts from DynamicDNS d

India's Sanchar Saathi - The Premature MandateIndia's attempt to mandate the Sanchar Saathi app represents, in my opinion, what happens when governments prioritize deployment speed over trust-building. The app itself had legitimate fraud-prevention features—device tracking, IMEI verification, suspicious call reporting—but the execution was fundamentally flawed. Requiring pre-installation on every device with system-level access that "cannot be disabled or restricted" essentially converted smartphones into mandatory government monitoring endpoints. The backlash was swift and appropriate: opposition parties, digital rights groups, and even Apple pushed back hard. What bothers me most about this approach is that the government had a potentially useful tool and completely squandered public trust by making it mandatory instead of voluntary. My question is, why rush to force adoption when you haven't built the transparency framework first? The WORST thing governm

In today’s multi-vendor firewall landscape—SonicWall, Cisco, Palo Alto, Fortinet, you name it—the real challenge isn’t the volume of alerts, it’s the fact that defenders are drowning in vendor-defined noise while adversaries move with zero friction. Attackers don’t care which firewall brand you use; they probe them all the same way, exploiting whatever CVE is easiest, chaining behaviors across edges, VPNs, and segmentation layers faster than most teams can triage a single ticket. That means security organizations must break out of the old model of blindly trusting each vendor’s severity ratings and instead normalize everything into a unified risk framework driven by asset criticality, exploitability, and real-world threat intel. The teams who win will be the ones who correlate signals across all their firewalls, prioritize based on behavior and KEV-level urgency, and automate the enrichment so analysts aren’t stuck babysitting logs. This isn’t about choosing which vendor screams th

India's Sanchar Saathi - The Premature MandateIndia's attempt to mandate the Sanchar Saathi app represents, in my opinion, what happens when governments prioritize deployment speed over trust-building. The app itself had legitimate fraud-prevention features—device tracking, IMEI verification, suspicious call reporting—but the execution was fundamentally flawed. Requiring pre-installation on every device with system-level access that "cannot be disabled or restricted" essentially converted smartphones into mandatory government monitoring endpoints. The backlash was swift and appropriate: opposition parties, digital rights groups, and even Apple pushed back hard. What bothers me most about this approach is that the government had a potentially useful tool and completely squandered public trust by making it mandatory instead of voluntary. My question is, why rush to force adoption when you haven't built the transparency framework first? The WORST thing governm

Ransomware payments remain astronomically high despite year-over-year declines because threat actors have shifted from volume-based spray-and-pray attacks to highly selective, intelligence-driven operations against organizations they've researched and know can pay. The RaaS ecosystem has matured significantly with initial access brokers, data exfiltration specialists, and professional negotiators optimizing the entire kill chain to maximize payment extraction from fewer, higher-value targets. While organizations HAVE improved with better backups, incident response plans, and EDR/XDR adoption, I'd argue the bigger factor driving declining payment numbers is shifting attacker tactics rather than defender resilience. We're seeing ransomware groups evolve beyond traditional encryption to data-only extortion, incremental staged payments and hybrid attacks combining ransomware with DDoS and supplier targeting. These sophisticated extortion models often don't get categorized as "ransomware

Amazon's threat intelligence team dropped research on a years-long Russian GRU campaign (Sandworm/APT44) targeting Western critical infrastructure, and the headline finding should make every security team think twice about their priorities. Between 2021-2024, these actors burned through CVE-2022-26318 (WatchGuard), CVE-2021-26084 and CVE-2023-22518 (Confluence), and CVE-2023-27532 (Veeam) like they were going out of style. But in 2025? Sharp decline in vulnerability exploitation activity, replaced almost entirely by targeting misconfigured customer network edge devices with exposed management interfaces. Here's what's actually happening: security teams have gotten dramatically better at vulnerability management, patch cycles have compressed from months to weeks, EDR and SIEM platforms now catch exploitation artifacts reliably - but still bypassable by skilled threat actors, and threat intelligence sharing means exploits have shorter useful lifespans before defenders adapt. The resul

The PHALT#BLYX campaign exemplifies a well-established pattern where threat actors utilize European markets as operational proving grounds before targeting North American organizations. While Europe maintains robust regulatory frameworks like GDPR and NIS2, the practical security posture varies significantly across member states, particularly among small-to-medium hospitality businesses that often rely on basic perimeter defenses rather than mature SOC operations and EDR deployments common in US enterprises. Russian-speaking threat actors, evidenced by Cyrillic debug strings and DCRat usage in this campaign, deliberately test TTPs in lower-risk environments to refine detection evasion techniques against European security vendors before facing US-dominant solutions like CrowdStrike and Microsoft Defender for Endpoint. The use of Euro-denominated lures (€1,004.38 charges) demonstrates targeted geographic focus, allowing attackers to validate psychological manipulation tactics, infrast

Analyzing PHALT#BLYX: How Fake BSODs and Trusted Build Tools Are Used to Construct a Malware InfectionBy Securonix Threat Research: Shikha Sangwan, Akshay Gaikwad, Aaron BeardsleeJanuary 5, 2025 tldr:Securonix threat researchers have been tracking a stealthy campaign targeting the hospitality sector using click-fix social engineering, fake captcha and fake blue screen of death to trick users into pasting malicious code. It leverages a trusted MSBuid.exe tool to bypass defenses and deploys a stealthy, Russian-linked DCRat payload for full remote access and the ability to drop secondary payloads. An ongoing malware campaign tracked as PHALT#BLYX has been identified as a multi-stage infection chain that begins with the click-fix and fake captcha social engineering tactic and deploys a customized DCRat payload. For initia

Greetings Securonix Connect Members,We are pleased to share the December 2025 Autonomous Threat Sweeper (ATS) Monthly Digest.During December, ATS tracked 141 emerging threats identified in the wild and performed corresponding sweeps across customer environments to assess potential exposure and validate detection coverage. This monthly digest provides insight into the evolving threat landscape, highlighting key trends, active threat actors, and commonly observed MITRE ATT&CK techniques.Emerging Threat TrendsSeveral recurring themes were observed throughout the month’s activity: Exploitation of public-facing applications remained one of the most common initial access vectors. React2Shell / CVE-2025-55182 was exploited by multiple threat actors, often for persistence or cryptomining payloads.

 Audience: SOC Analysts, Threat Intelligence Analysts, Security Operations LeadersProduct Module:Threat Intelligence Management (ThreatQ Platform)Last Updated: December 18, 2025KB ID: KB‑20251218‑ThreatQ‑Scoring‑ExpirationTags: Threat Intelligence, Lifecycle Management, Scoring, Expiration, Indicator Management, ThreatQ, SOC OperationsProblemOrganizations often ingest large volumes of threat intelligence but still experience security gaps, alert fatigue, and false positives. Without a way to prioritize and retire data, threat intelligence becomes noisy instead of actionable.ObjectiveHelp security teams understand how scoring and expiration can be used to manage the full threat intelligence lifecycle—from ingestion to retirement—so analysts can focus on intelligence that is relevant, timely, and ali

 Grouping in Securonix is a two-fold process: Create Data Sources (DS) correctly — Syslog and API logs must be separated into their own DS so that grouping is clean and meaningful. Use functionality and Spotter searches — Once DS are created properly, Securonix automatically groups the logs and allows you to search, drill down, and correlate them easily. Both steps together form the basis of how grouping works end-to-end. Creating Data Sources Correctly (Foundation of Grouping) A. Syslog When onboarding syslog data, for example Palo Alto firewall data, we can use separate Data Sources to maintain zone-based segmentation such as Trust, Untrust, DMZ.Example using different ports:Palo_Untrust → TCP 514 Palo_Trust → TCP 515If using multiple ports is not an option, we can use Syslog filters to sp

During an undetermined number of executions of my playbook, it crashes. Is there a way to validate how many executions have been performed and whether they are causing instability in my service?

ThreatQ provides a comprehensive REST API documentation and an extensive Swagger collection, making it easy to explore available endpoints and parameters. However, we’ve heard that developers and analysts could benefit from use-case–based documentation — examples that walk through common workflows and best practices for interacting with the API.This type of documentation could help: Understand best practices for using the API effectively Avoid inefficient or unsupported methods for common operations Get started faster with real-world, task-based examples We’d like your input on what would be most helpful: What API use cases do you find yourself repeating or struggling to document?

Securonix Threat Research (STR) Monthly Newsletter– November 2025 Edition – Welcome back to another newsletter by the Securonix Threat Research Team!November has been a month of a LOT of reverse engineering. The team has been grabbing malware samples from multiple sources to find novel and interesting techniques and indicators to share with the community. Our team has also been featured and seen this month during the FS-ISAC EMEA webinar where Shikha Sangwan presented her findings for CHAMELEON#NET. We provided commentary on the latest Kimsuky & Lazarus Tooling, Evolving ClickFix Attacks, the recent Government Compromise, CISA 2015 Reauthorization, Chinese using Claude to “AutoAttack”,  XWiki CVE-2025-24893, and Legacy Firewall Attacks. We also now have Securonix Connect to share these ideas and updates in a more streamlined way! Oftentimes, news outlets summarize a lot of our commentary but now we h

When searching in Spotter AI, entering a generic field name like “hostname” may not return results from all related attributes. Currently, Spotter AI appears to select one matching field (e.g., hostname) instead of searching across all similar variations such as: devicehostname sourcehostname destinationhostname host This means a query like:“Provide me all violations involving the hostname XYZ.acme.com”may return only a subset of results instead of all logs where that hostname appears in any related field. We’d like to better understand how you’d want Spotter AI to interpret these kinds of queries: Should Spotter AI automatically include all fields with a common root term (e.g., “hostname”) in a

Currently, the ThreatQ platform can parse Snort, Suricata, and YARA signatures, extracting metadata and indicators of compromise (IOCs) for use in investigations and automation workflows.At this time, Sigma Rules are not supported for parsing.We know Sigma is a widely adopted detection format across many environments. If Sigma parsing would help improve your threat detection workflows, we’d like to hear your perspective: How do you currently manage Sigma Rules in your threat intelligence processes? What would you expect from a Sigma Rule parser in ThreatQ — e.g., extracted fields, metadata, or IOC types? How might this integration benefit your day-to-day investigations or automation? Your feedback will help shape potential ideas for future development.👉

Current StateCurrently, the ThreatQ user interface does not allow users to create new Indicator Types.While users can create ad-hoc types for other objects such as Events or Attachments, defining new Indicator Types currently requires the ThreatQ API. Some users have leveraged this API to create types such as:    •    Routing Number    •    Bitcoin Address    •    Account Number    •    Phone NumberAlternatively, it’s possible to achieve similar outcomes with Custom Objects, though those typically require more configuration and are not as seamlessly integrated across the platform.We’d like to better understand what would be most useful to you:    •    How important is it for your team to create new Indicator Types through the UI?    •    What kinds of custom indicators do you need to track most often?    •    How would you expect to manage these custom types (na

Current State Currently, when creating a new object in ThreatQ using the Create Object modal, users can set a limited set of fields: Value Type Status Source (and, for some object types, a description) The APIs already allow additional details — such as Tags and Attributes — to be added when creating objects. However, these options aren’t currently available in the UI, which means users often have to go back and edit the object later to add context. We’d like to hear how expanding the Create Object modal could improve your workflows: What extra fields or context would be most helpful to capture at creation time? Would being able to add Tags,

Currently, ThreatQ does not display UI notifications or alerts when a newer version of an installed integration is available in the Marketplace. Users need to manually check for updates and then download and upload the new integration files to update their environment.We’re exploring how to make this experience more seamless and would love your input: How would you like to be notified that an integration is out of date — a badge, alert, or status message? Would you prefer to see version information (installed vs. latest) directly on the Integrations page? How useful would a one-click “Update” option be for your workflows? Would automated or scheduled updates fit into your organization’s change control process? Your feedback will help us understand what kind of update visibil

When a feed fails—or while developing a new feed—users often download Feed Run files to troubleshoot and understand what went wrong.Currently, these files are automatically zipped and password protected. This design helps prevent the files from being flagged by security tools, since they may contain data that appears malicious.However, some organizations (such as financial institutions) have strict security policies that prohibit downloading password-protected files, since they can’t be inspected by endpoint protection tools. This can make troubleshooting feeds more difficult.We’d like to better understand how you’d prefer to handle this scenario: Would you want the option to toggle password protection for Feed Run files directly from the UI? Would it be more useful to view the file contents securely in-platform,