Threat Research & Intelligence

Securonix Threat Research Security Advisory“VOID#GEIST: Stealthy Multi-Stage Python Loader with Embedded Runtime Deployment, Startup Persistence, and Fileless Early Bird APC Injection into explorer.exe”By Securonix Threat Research: Akshay Gaikwad, Shikha Sangwan, Aaron Beardslee Feb 17, 2026tldr:Securonix Threat Research analyzed a stealthy, multi-stage malware intrusion chain utilizing an obfuscated batch script (non.bat) to deliver multiple encrypted RAT shellcode payloads corresponding to XWorm, XenoRAT, and AsyncRAT. The script establishes persistence by deploying a secondary batch script (spol.bat) into the Windows Startup folder, stages a legitimate embedded Python runtime from python.org, and decrypts encrypted shellcode blobs (new.bin, pul.bin, xn.bin) at runtime using external XOR key material (a.json, p.json, n.json).The decrypted payloads are not written to disk as executables. Instead, they are injected directly into separate instances of explorer.exe using Early Bird APC i

Service Principal Names (SPNs) associated with user accounts are prime targets for Kerberoasting attacks. Canary SPNs detect when attackers request service tickets for offline cracking.NOTE: When creating any kind of Cyber Deception in your organization be creative with your strategy! Create Canaries that make sense for your network and existing assets so they are believable by adversaries. The examples below are to show you the basic structure for creating a Canary SPN - create your own names that make sense for your specific deception. One last pro-tip, log into your canary accounts and/or SPN accounts every so often so they have a somewhat current ‘last logon’ timestamp.   Understanding the AttackAttacker enumerates user accounts with SPNs Requests TGS tickets for those SPNs Extracts tickets and cracks them offline Canary SPNs have no real service—any ticket request is malicious What is a Service Principal Name (SPN)? DefinitionA Service Principal Name (SPN) is a unique identifier t

Securonix Threat Labs 2025 Annual Autonomous Threat Sweeper Intelligence InsightsAuthors: Dheeraj Kumar and Sina Chehreghani Executive Summary:The 2025 Annual Cyber Threat Intelligence Report captures the year’s most impactful attack patterns across exploitation-led intrusion, advanced malware (including AI-assisted techniques), and the ongoing evolution of ransomware/RaaS economics. Across multiple campaigns, threat actors prioritized speed-to-impact through weaponized vulnerabilities (notably ToolShell SharePoint exploitation and React2Shell / CVE-2025-55182), while simultaneously improving stealth using in-memory execution, cloud-native abuse, living-off-the-land tooling, and increasingly AI-enabled obfuscation.The year also reinforced that defenders must track threats as repeatable behaviors, not only as malware names: webshell placement, privilege escalation, rapid lateral movement, exfiltration via common tools (e.g., rclone), defense evasion (shadow copy deletion / log clearing)

Canary Shares Canary shares are decoy network file shares strategically deployed across an enterprise environment to detect unauthorized network reconnaissance and lateral movement. These honeypot shares are configured with enticing names like "Finance," "Backups," "HR_Documents," or "IT_Admin" and populated with bait files (credentials.xlsx, passwords.txt, database_backup.sql) that appear valuable to attackers but serve no legitimate business function. When adversaries gain initial access to a network, one of their first actions is typically share enumeration to identify accessible resources containing sensitive data, credentials, or pathways to high-value targets. Attackers commonly use built-in Windows commands like net view, net share, and dir \\server\share, as well as offensive tools such as PowerView (Invoke-ShareFinder, Find-InterestingFile), SharpShares, NetExec (netexec smb --shares), SMBMap, Impacket's smbclient.py, Snaffler (for automated credential hunting in shares), and

Canary Files Canary files are decoy documents placed in strategic locations to detect unauthorized file access, data exfiltration attempts, or ransomware activity. Besides creating these files manually in your network, Blue Teams can use free online tools like Thinkst Canary Tokens to even get an email when the token is opened or used - with the offenders IP address! How cool is that!? We’ll go over more techniques in the rest of this series. For now, here’s the strategy and some ideas for building your Canary Files manually: File Naming StrategyCreate files with names that attract attackers:passwords.xlsxcredentials.txtemployee_ssn.csvfinancial_records_2024.xlsxadmin_passwords.docxnetwork_diagram.pdfvpn_credentials.txtbitcoin_wallet.txtcustomer_database_backup.sqlhr_salaries_confidential.xlsx File Placement Locations Location Purpose C:\Users\Administrator\Desktop\ Attracts attackers with admin access C:\Users\Public\Documents\ Visible to all users \\server\share\IT\ Networ

A state-sponsored supply chain attack compromised Notepad++'s update infrastructure from June to December 2025, Ampcus Cyber enabling Chinese APT group Lotus Blossom Securelist (aka Billbug, Lotus Panda, Raspberry Typhoon) to deliver malicious payloads to targeted victims. The Hacker News The attackers deployed three distinct infection chains Securelist featuring rotating C2 infrastructure, a custom backdoor called Chrysalis, Ampcus CyberRapid7 and multiple evasion techniques including DLL sideloading, ProShow vulnerability exploitation, and Microsoft Warbird abuse. The Hacker NewsRapid7 This report provides comprehensive technical details for building Sigma/Delta detection rules.Attack timeline and initial access vectorThe compromise began in June 2025 when attackers breached Notepad++'s shared hosting provider, Ampcus Cyber gaining the ability to intercept and redirect update traffic. Direct server access ended September 2, 2025, but attackers retained internal service credentials un

Introduction Cyber deception is a proactive defense strategy that deploys decoy assets (canaries, honeypots, honeytokens) throughout your environment to detect adversary presence. Unlike traditional security tools that rely on signatures or known malicious behavior, deception techniques detect attackers by monitoring access to resources that have no legitimate business purpose.Key Principle: Any interaction with a canary asset is inherently suspicious because legitimate users and processes have no reason to access them. Why Cyber Deception? Limitations of Traditional Security Tools Traditional Tool Limitation Antivirus/EDR Relies on signatures; can be bypassed with custom malware Firewalls Cannot detect lateral movement within trusted networks IDS/IPS Generates false positives; misses novel attack techniques SIEM Only as good as the logs collected; alert fatigue  Advantages of Cyber DeceptionLow False Positive Rate: Canaries have no legitimate use, so any access is suspi

The Interlock ransomware group has weaponized a gaming anti-cheat driver vulnerability (CVE-2025-61155) in a sophisticated BYOVD attack chain to disable endpoint security tools before encryption. This novel technique emerged in campaigns targeting healthcare, defense, and education sectors across North America and Europe, with 60+ victims claimed since September 2024. The vulnerability's moderate severity rating obscures its actual danger when combined with ransomware operations. The vulnerability hiding in plain sightCVE-2025-61155 affects GameDriverX64.sys, a signed kernel-mode anti-cheat driver developed by Hotta Studio for the game "Tower of Fantasy." Published in the NVD on October 28, 2025, this vulnerability allows local attackers to crash arbitrary processes by sending specially crafted IOCTL requests—no administrative privileges required. Attribute    ValueCVSS v3.1    5.5 (Medium)Vector    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCWE    CWE-400 (Uncontrolled Resource Consu

The 2024 funding crisis exposed a fundamental truth: we've built critical infrastructure without critical infrastructure protection.CVE IDs are now the universal language of vulnerability management. Every major vendor uses them. Every scanner depends on them. Compliance frameworks like PCI-DSS, HIPAA and SOC 2 mandate them. Procurement requirements reference them. They're embedded in automated security tooling across every sector.Yet this entire system runs on year-to-year government contracts.When MITRE's funding faced renewal uncertainty, the global vulnerability identification system nearly collapsed. Not because the program was flawed, but because we treat essential internet infrastructure like a discretionary line item.The market must understand: CVE operates without statutory protection, dedicated long-term appropriations or formal governance that could survive agency reorganizations or budget cuts. We've created a single point of failure for global cybersecurity and funded it l

Beyond patching for VMware vCenter Server's DCERPC protocol, I HIGHLY recommend incorporating Sysmon and Sysmon For Linux into any security stack. And here's why. From a Sysmon telemetry perspective, detecting exploitation attempts and post-compromise activity related to CVE-2024-37079 requires monitoring several key event types that reveal both the initial attack vector and subsequent adversary behavior. Event ID 1 (Process Creation) becomes the cornerstone for identifying post-exploitation activity, particularly when monitoring for unusual child processes spawned from vCenter-related parent processes such as vpxd.exe, vws.exe, or other VMware services running on the compromised system. Attackers who successfully exploit the DCERPC heap overflow to achieve remote code execution will inevitably spawn command interpreters like cmd.exe, powershell.exe, or pwsh.exe to establish their foothold and begin reconnaissance operations. Detection logic should zero in on process creation events wh

Last year in October, phishing statistics show a tactical evolution with 40% of business-targeted phishing emails now AI-generated, producing perfectly personalized, grammatically flawless attacks that eliminate traditional detection markers. Attackers are weaponizing legitimate platforms: Figma for credential theft (49% linked to Storm-1747), fake Google Careers pages, and ClickUp redirect chains to bypass email filters and URL reputation checks. PDF-based QR code phishing has surged as the primary attack vector, replacing direct email QR codes to push victims toward mobile devices lacking enterprise security controls. The TyKit phishing kit demonstrates the new baseline: SVG-embedded obfuscated JavaScript, Cloudflare Turnstile CAPTCHA chains, and multi-stage verification pages designed to evade security bots, while revived calendar injection attacks add malicious events directly to corporate calendars, triggering phishing attempts through meeting reminders even when users ignore the

This is, in my opinion, only the beginning of what we will see in the future of "AI Powered" everything. As new innovations land in the hands of cyber professionals and criminals, both sides will find ways to enhance their playbook to maximize their potential and effectiveness. Part of the process for making improvements is testing - this attack, I think, is just that. GTIG noted back in January they we're starting to see integrations of AI into threat actor's toolkits with a recent update in November siting malware strains such as FRUITSHELL, PROMPTFLUX, PROMPTLOCK, PROMPTSTEAL, and QUIETVAULT experimenting with LLMs to achieve dynamic obfuscation. My question is, and has been for some time, who is moving faster - us or them? Threat actors don't have to deal with compliance, ticket queues, reports, metrics, buzzwords, or even laws. Defenders are almost completely reactive in their craft and have to deal with all of the things threat actors don't have to... which costs us time. Time is

The STR Team was presented with the following questions: What are the most recent toolchain improvements that you see **Kimsuky** developing and deploying? What are the most recent toolchain improvements that you see **Lazarus** developing and deploying? Overall, what weaknesses are APT attackers trying to overcome in their toolsets with their latest developments? Will these updates make it more likely that the attackers can bypass reasonable antivirus defenses? What should defenders make sure they are doing to protect against these variants and future variants of these tools? Our response to these questions were sited by Dark Reading here:https://www.darkreading.com/vulnerabilities-threats/kimsuky-httptroy-backdoor-south-korea-users However, I wanted to share our full commentary since many of the details in our answers were left out but very relevant to the threat landscape as a whole.Let’s start with how to approach the defensive side before digging into the offensive tooling. Organi

This is, in my opinion, only the beginning of what we will see in the future of "AI Powered" everything. As new innovations land in the hands of cyber professionals and criminals, both sides will find ways to enhance their playbook to maximize their potential and effectiveness. Part of the process for making improvements is testing - this attack, I think, is just that. GTIG noted back in January they we're starting to see integrations of AI into threat actor's toolkits with a recent update in November siting malware strains such as FRUITSHELL, PROMPTFLUX, PROMPTLOCK, PROMPTSTEAL, and QUIETVAULT experimenting with LLMs to achieve dynamic obfuscation. My question is, and has been for some time, who is moving faster - us or them? Threat actors don't have to deal with compliance, ticket queues, reports, metrics, buzzwords, or even laws. Defenders are almost completely reactive in their craft and have to deal with all of the things threat actors don't have to... which costs us time. Time is

The XWiki CVE-2025-24893 exploitation campaign demonstrates a rapidly evolving multi-faceted attack landscape where threat actors leverage unauthenticated remote code execution through Groovy code injection in the SolrSearch macro. Attackers employ a diverse toolkit ranging from automated botnet operations (RondoDox) to sophisticated two-stage payload delivery mechanisms that stage downloaders in the /tmp/ directory before executing cryptocurrency miners 20+ minutes later. The attack chains include reverse shell establishment using BusyBox netcat and bash TCP redirections to attacker-controlled infrastructure, with some operations originating from compromised QNAP devices and legitimate AWS IP addresses. Reconnaissance efforts span from Nuclei-based scanning executing cat /etc/passwd for validation to custom OAST callback mechanisms, while payload delivery leverages standard Linux utilities (wget, curl) to retrieve obfuscated base64-encoded scripts from DynamicDNS domains and hardcoded

India's Sanchar Saathi - The Premature MandateIndia's attempt to mandate the Sanchar Saathi app represents, in my opinion, what happens when governments prioritize deployment speed over trust-building. The app itself had legitimate fraud-prevention features—device tracking, IMEI verification, suspicious call reporting—but the execution was fundamentally flawed. Requiring pre-installation on every device with system-level access that "cannot be disabled or restricted" essentially converted smartphones into mandatory government monitoring endpoints. The backlash was swift and appropriate: opposition parties, digital rights groups, and even Apple pushed back hard. What bothers me most about this approach is that the government had a potentially useful tool and completely squandered public trust by making it mandatory instead of voluntary. My question is, why rush to force adoption when you haven't built the transparency framework first? The WORST thing governments can do is assume citizen