Securonix ThreatWatch Monthly Intelligence Insights – July 2026

Securonix ThreatWatch Monthly Intelligence Insights – July 2026 

Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay Kumar 

Introduction: 

The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Watch in July 2026. The report also includes a synopsis of the threats, indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), and related tags. Each threat has a comprehensive summary from Threat Labs and search queries from the Threat Research team. For additional information on Threat Labs and related search queries used via Autonomous Threat Sweeper to detect the below-mentioned threats, refer to our Threat Labs home page. 

Last month, Securonix Autonomous Threat Sweeper identified and analyzed 4,403 TTPs and IoCs; identified 129 emerging threats; investigated 89 potential threats; and elevated 11 incidents. The top data sources swept against include IDS / IPS / UTM / Threat Detection, Data Loss Prevention, Endpoint Management Systems, and Email / Email Security. 

Executive Summary: 

• Veil#Drop: Securonix Threat Research uncovered a multi-stage delivery chain that uses compromised websites, document-themed JavaScript files, Blogspot-hosted PowerShell stages, and XOR-encoded .NET assemblies to deploy PureLog Stealer in memory. The framework also uses reflective loading and trusted Microsoft utilities to reduce disk artifacts and evade application controls. 

• AsyncAPI supply chain compromise: Attackers exploited a misconfigured GitHub Actions workflow to obtain privileged repository access, inject malicious code, and publish five poisoned versions across four widely used npm packages through legitimate release pipelines. The loader executed when affected modules were imported, fetched the Miasma runtime from IPFS, and established persistence and resilient command and control across Windows, Linux, and macOS. 

• GenieLocker: Toy Ghouls introduced a custom ransomware family for Windows, Linux, and VMware ESXi, reducing its reliance on third-party encryptors such as LockBit and Babuk. Observed intrusions used stolen partner credentials, OpenVPN, Mimikatz, network scanning, RDP and SSH lateral movement, and PsExec or PAExec deployment before encrypting endpoints, servers, and virtual machine disks. 

• Krybit: The emerging ransomware-as-a-service operation uses a double-extortion model and provides affiliates with builders for Windows, Linux, ESXi, and NAS environments. Despite an early breach of its affiliate panel that exposed plaintext credentials and internal operations, Krybit resumed activity and continued broad, opportunistic targeting across multiple regions and industries. 

• HOLLOWGRAPH: The espionage malware abuses the Microsoft Graph API and compromised Microsoft 365 calendars for command delivery and encrypted data exfiltration, with malicious events hidden far into the future. DNS tunneling refreshes Entra ID credentials, allowing the operation to blend into trusted cloud traffic while targeting a small set of primarily Israeli organizations. 

• HelloNet: An advanced campaign used the ViPNet update system for DLL side-loading and persistence, injecting a loader into svchost.exe before deploying proxy, command-execution, cleanup, and Rust-based backdoor modules. The operators conducted internal reconnaissance, created SSH tunnels with renamed PuTTY tooling, and targeted large Russian organizations across government, energy, transport, education, logistics, and industrial sectors.  

• Operation RoundPress: Russia-aligned TA458 continued targeting government and military webmail systems with "half-click" exploits that require victims only to view a malicious message. The campaign expanded across SOGo, Kerio, Zimbra, mDaemon, and Roundcube, while newer SpyPress variants added interactive backdoors and multiple persistence fallbacks for long-term server access. 

Threat Overview: 

Securonix Threat Research Highlights:                            (Originally published in July 2026) 

• Veil#Drop Delivers PureLog Stealer via XOR-Encoded In-Memory .NET Payloads 

Securonix Threat Research team identified VEIL#DROP, a multi-stage malware delivery framework that uses compromised websites, deceptive JavaScript files, PowerShell, and attacker-controlled Blogspot pages to deliver PureLog Stealer. The attack begins with a file such as transcript.pdf.js, which can appear to be a normal PDF when Windows hides the final extension. Opening it launches Windows Script Host, which starts PowerShell with execution-policy bypasses and retrieves the next stages through Invoke-RestMethod and Invoke-Expression. The loader also displays decoy content, pauses between stages, deletes the original JavaScript file, and stops selected scripting and .NET processes to limit evidence. 

The later PowerShell stages hide their code and .NET payloads with custom XOR routines. VEIL#DROP also changes URL paths, task names, strings, and other execution artifacts at runtime, making static signatures less reliable. Two .NET assemblies are reconstructed from encoded decimal data, decrypted with XOR key 47, and loaded directly into the PowerShell process through [Reflection.Assembly]::Load(). If reflective loading is blocked, the malware falls back to trusted Microsoft tools such as RegSvcs.exe, InstallUtil.exe, MSBuild.exe, and several .NET compilers. 

The final payload is PureLog Stealer, which targets browser passwords, cookies, session tokens, autofill data, browsing history, cryptocurrency wallets, and system information. It supports common browsers and wallets, including Chrome, Edge, Firefox, MetaMask, Exodus, and Electrum. Since most of the attack runs in memory and uses trusted cloud services and signed Windows binaries, defenders may have little more than process activity, PowerShell logs, and network telemetry to work with. 

Analyst assessment: The main concern with VEIL#DROP is the delivery chain rather than PureLog Stealer by itself. The campaign uses user deception, Blogspot hosting, XOR-obfuscated payloads, changing runtime artifacts, and in-memory .NET execution. It also falls back to trusted Microsoft binaries when its primary loading method fails. Any one of these events may appear legitimate, but together they form a clear sequence that defenders can track. Detection should focus on activity across the full chain, not only on hashes, filenames, or known domains. 

Defender priority: Review instances where wscript.exe or cscript.exe starts PowerShell, especially from Downloads, Desktop, AppData, or temporary directories. PowerShell traffic to blogspot[.]com or blogger[.]com should also be examined, along with commands containing Invoke-RestMethod, Invoke-Expression, ScriptBlock::Create(), or Reflection.Assembly::Load(). PowerShell spawning InstallUtil.exe, MSBuild.exe, or RegSvcs.exe is another useful lead. Files ending in .pdf.js, .docx.pdf, or .odp.pdf.sys should be treated as suspicious and investigated quickly. 

Spyware / Malware Activity & Trends:                                   (Originally published in July 2026) 

• HelloNet abuses the ViPNet update system to deploy modular backdoors 

HelloNet is a targeted campaign that has been active since at least May 2026, primarily affecting large Russian organizations in government, energy, transport, education, logistics, and industry. The attackers gained persistence by placing a malicious wtsapi32.dll file in the ViPNet Update System directory, where the legitimate itcsrvup64.exe process loaded it through DLL side-loading. The malicious library, called HelloInjector, then injected code into an svchost.exe process and ran HelloProxy directly in memory. HelloProxy worked as both a hidden traffic proxy and a loader, listening on ports 5003 and 5060 and using a custom handshake to identify command-and-control traffic. It also delivered HelloExecutor for command execution and reconnaissance, and HelloCleaner for deleting ViPNet logs. 

Once inside the network, the operators used standard Windows commands to collect information about users, groups, network settings, active sessions, and ViPNet installations. They also ran a renamed PuTTY/Plink binary called frontpage.exe from C:\Users\Public\Music to establish a reverse SSH tunnel to 5.39.253[.]206. Another implant, the Rust-based HelloBackdoor, listened on TCP port 443 and allowed the attackers to upload or download files, execute commands through cmd.exe, and remove the malware. Researchers found several Chinese-language development artifacts in the samples, but these were not enough for firm attribution. The campaign was therefore linked to an unknown Chinese-speaking APT group with low confidence, with the possibility that the clues were planted as false flags.  

Analyst assessment: The attackers turned a trusted ViPNet update process into a reliable way to run malware and remain on affected systems. They used DLL side-loading and signed ViPNet executables to blend into normal activity, then injected code into svchost.exe and kept later payloads in memory. Custom C2 traffic and log deletion made the activity harder to trace, while the use of several smaller modules allowed each part of the operation to handle a specific task, including proxying traffic, running commands, cleaning logs, creating tunnels, and accessing files. The campaign appears aimed at organizations using ViPNet, but this is not identifying the initial access method or confirming how widely the attackers succeeded. 

Defender priority: Start with ViPNet installation directories. Look for wtsapi32.dll being created or loaded by itcsrvup64.exe or itcsrvup.exe, and review any injection from those processes into svchost.exe. Unusual child processes, files written to C:\Users\Public, and renamed PuTTY, Plink, or SSH binaries with reverse port forwarding commands also warrant investigation. Monitor traffic on ports 5003, 5060, and 443, and search for the HelloBackdoor activation value 47c6235b4d2611184. Make sure endpoint logging captures Sysmon events 1, 7, and 11, as well as Windows Security events 4688 and 4663. 

• HOLLOWGRAPH uses Microsoft 365 calendars as a covert C2 channel 

HOLLOWGRAPH is a newly discovered malware component tied with high confidence to the Cavern backdoor framework. It does not rely on a typical attacker-controlled C2 server. Instead, it uses the Microsoft Graph API and a compromised Microsoft 365 mailbox to exchange commands and stolen data. Operators hide encrypted tasking in calendar events dated 13 May 2050, where users are unlikely to notice it. The implant reads those events and sends stolen files back as encrypted attachments. Researchers identified at least 12 compromised systems, mostly connected to Israeli organizations, but only a few were actively communicating. That pattern points to a selective espionage operation, not a large-scale malware campaign.  

The implant is a .NET NativeAOT DLL with a limited command set. The get command pulls tasking from calendar events, and send uploads stolen files to the mailbox. It encrypts the traffic with RSA-OAEP and AES-256-GCM and uses separate RSA keys for commands and exfiltration. A second channel uses IPv6 AAAA DNS queries to cloudlanecdn[.]com to refresh Microsoft Entra ID credentials stored in logAzure.txt. The strongest link to Cavern comes from shared command structures, task formatting, and syntax. Researchers also found overlap with malware associated with Lyceum and OilRig, although that connection remains low confidence. 

Analyst assessment: The malware is not especially broad in what it can do. Its advantage comes from where it operates. Microsoft Graph traffic, calendar updates, attachment uploads, and OAuth activity are common in enterprise environments, so malicious actions can blend into normal Microsoft 365 use. The limited victim set and small number of active infections also suggest the operators were careful about when and where they used it. The technical evidence supports the Cavern link, but the report does not provide enough evidence to name the operator behind the campaign. 

Defender priority: Start with Microsoft 365 audit data rather than relying only on endpoint alerts or blocked domains. Look for calendar events created decades in the future, especially around May 2050, and check for application-driven attachment uploads, unusual event renaming, and mailbox activity that does not fit the user or application involved. Review OAuth applications, service principals, Graph API calls, and sign-in activity tied to the affected identity. On endpoints, investigate logAzure.txt, NativeAOT DLLs using Microsoft Graph, and unusual AAAA queries to cloudlanecdn[.]com. These signals are more useful here because the malware is designed to disappear into trusted cloud traffic after execution. 

Emerging Vulnerabilities & Exploits:              (Originally published in July 2026) 

• Operation RoundPress keeps webmail exploitation alive with new zero-days and persistent SpyPress access 

TA458 is continuing Operation RoundPress with "half-click" exploits against government and military webmail systems. The victim does not need to click a link or open an attachment. Opening the malicious message in a vulnerable webmail viewer is enough to trigger the exploit. 

Researchers observed the actor targeting Zimbra, mDaemon, Roundcube, Kerio, and SOGo. The campaign used three reported zero-days: CVE-2025-27915 in Zimbra, CVE-2025-3929 in mDaemon, and CVE-2026-8496 in SOGo. TA458 also used known Roundcube flaws, including CVE-2023-43770 and CVE-2024-42009. Successful exploitation loads SpyPress, a JavaScript malware family built to steal credentials, contacts, and email content. The payload changes depending on the webmail platform.  

On Roundcube, the actor has moved beyond short-term mailbox theft. Since at least July 2025, TA458 has used CVE-2025-49113 to reach the underlying server through unsafe PHP deserialization. SpyPress then tries several ways to keep access, including PHP and Bash reverse shells, downloads through Python or cURL, and PHP webshells hidden in normal-looking Roundcube directories. The multiple methods appear to be fallbacks, giving the operator another option when one technique fails. 

Analyst assessment: TA458 is treating the webmail platform itself as the entry point. That allows the actor to steal sensitive email data and, on some systems, maintain access to the mail server without first compromising a user endpoint. The steady use of new exploits suggests access to a reliable vulnerability supply chain, although it does not establish whether those exploits are developed internally, supplied through the GRU, or obtained from a third party. 

TA458 is assessed as likely linked to Russian military intelligence, although no specific GRU unit has been confirmed. Observed targeting has focused on government and military organizations in Ukraine, Albania, Greece, Moldova, and Türkiye, with limited activity against chemical, telecommunications, and technology companies. 

Defender priority: Patch internet-facing webmail systems and remove unsupported Kerio installations. Hunt for malicious calendar invites or HTML content that executes JavaScript as soon as a message is viewed. On Roundcube servers, review unusual PHP files, outbound connections, reverse shells, and webmail processes launching Bash, Python, cURL, GPG, or PHP networking functions. Give particular attention to files created under program/js, program/resources, plugins/password, and program/actions/mail. Endpoint telemetry may show little or nothing because the first stage runs inside the webmail application. 

Supply Chain Attack Intelligence Insights                          (Originally published in July 2026) 

• AsyncAPI supply-chain attack abused GitHub Actions to push Miasma-linked malware through trusted npm releases 

The AsyncAPI compromise started with a vulnerable GitHub Actions workflow that exposed privileged release credentials. With that access, the attacker pushed malicious code into the project’s normal release process, which then published the affected packages through trusted npm publishing. The initial access path was traced to a compromised CI pipeline, while the malware avoided common install-time checks by using import-time execution when the poisoned packages were loaded. 

The initial compromise involved a pull_request_target workflow in the asyncapi/generator repository. Because it executed pull request code in the privileged context of the main repository, attacker-controlled code could access secrets that should have been isolated from an untrusted fork. Multiple researchers assess that these exposed credentials associated with asyncapi-bot, which the attacker then used to push malicious commits into AsyncAPI repositories. 

Those commits resulted in five malicious npm releases across four packages: @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, and both @asyncapi/specs@6.11.2-alpha.1 and 6.11.2. The attacker did not have to steal a npm publishing token. AsyncAPI's own GitHub Actions release workflows published the packages through GitHub OIDC, which meant the malicious releases still had valid provenance attestations. 

The payload was also built to avoid a common npm detection point. There were no malicious preinstall or postinstall scripts. The injected code ran when an affected package was imported or loaded with require(). It launched a detached Node.js process, downloaded sync.js from IPFS, and placed it under an OS-specific directory named NodeJS. The recovered Miasma-linked runtime supported persistence, shell execution, file operations, and multiple C2 channels. Its fallback communications included Nostr, Ethereum, BitTorrent DHT, libp2p, and IPFS. It is also found code for credential harvesting, propagation, AI-tool poisoning, and evasion, although those modules were disabled in the build it analyzed. 

Analyst assessment: This incident shows the limitation of treating package provenance as proof that a release is safe. The provenance was valid because the packages really were produced by AsyncAPI's authorized workflow. The problem was earlier in the chain: the commits that triggered that workflow were unauthorized. The import-time execution path is just as important for defenders because controls that only inspect npm lifecycle scripts would not catch it. The GitHub Actions weakness had also been reported before the attack, but the proposed fix had not yet been merged. Technical overlap points toward Miasma, but the investigation does not support firm actor attribution. 

Defender priority: Hunt for the five malicious package versions across developer endpoints, CI runners, lockfiles, caches, and internal artifact repositories. Search for sync.js under %LOCALAPPDATA%\NodeJS\, ~/.local/share/NodeJS/, and ~/Library/Application Support/NodeJS/. Also review detached Node.js execution, IPFS retrievals, and connections to 85.137.53[.]71 on ports 8080, 8081, and 8091. If an affected package was imported, rotate credentials that were available to that host from a clean system. CI/CD teams should also review pull_request_target workflows, bot account permissions, branch protections, and release automation so that an unauthorized source change cannot move straight into a trusted package release. 

Ransomware Threat Landscape:           (Originally published in July 2026) 

• Toy Ghouls upgrades its ransomware operations with a custom cross-platform GenieLocker encryptor 

Toy Ghouls, also known as Bearlyfy, Labubu, and Laboo.boo, has been using a new ransomware family called GenieLocker since March 2026. The group has mainly targeted organizations in Russia, with manufacturing seeing the most activity, followed by construction, financial services, retail, and technology. GenieLocker appears to be a custom tool developed to replace the third-party ransomware the group previously relied on, including RedAlert, LockBit, and Babuk. In one investigated March intrusion, the attackers gained access through an OpenVPN connection from an external partner's network, likely using stolen but valid credentials. They then deployed tools such as OpenSSH, socks5.exe, SoftPerfect Network Scanner, and Mimikatz for tunneling, network discovery, and credential theft, and accessed KeePassXC installations in an apparent attempt to recover stored credentials. Lateral movement relied on RDP for Windows systems and SSH for Linux, while PsExec and PAExec were used to push GenieLocker across the environment. The Windows build encrypted Windows hosts, while the ELF build stopped virtual machines and encrypted disks on Linux and ESXi systems. Investigators did not find evidence of data theft, which is consistent with the group's previous encryption-focused extortion activity. 

The Windows version of GenieLocker can terminate processes and services, avoid selected files and directories, discover network shares, and encrypt only part of a file when configured to do so. It also requires a "secret" command-line argument before execution, a feature that may help prevent automated sandbox analysis or unauthorized use. A watchdog thread continuously checks for debuggers and verifies the integrity of the malware's .text section. For encryption, GenieLocker uses XChaCha20-Poly1305 for file content and metadata, while Curve25519-XSalsa20-Poly1305 protects each file's encryption key. The Linux and ESXi version is less complex but includes features tailored to virtualized environments, such as daemonizing through double-forking, modifying /etc/vmware/welcome, setting the number of encryption workers, and using /vmfs/volumes as its default encryption path. 

Analyst assessment: GenieLocker improves Toy Ghouls' ransomware capability, but the group's attack pattern remains familiar. It still relies on compromised trusted access, stolen credentials, legitimate administration tools, RDP and SSH for lateral movement, and hands-on deployment of ransomware. What has changed is the malware itself. Toy Ghouls now has its own Windows, Linux, and ESXi encryptor rather than depending on leaked or third-party ransomware families. That gives the group a single ransomware tool it can use across endpoint, server, and virtualized environments. The lack of ransom notes and observed data theft also remains consistent with its previous operations, where the goal has been system encryption and extortion rather than data-leak pressure. 

Defender priority: Hunt for unusual OpenVPN connections coming through partner networks, especially when valid accounts appear from infrastructure that has not been seen before. Activity involving Mimikatz, SoftPerfect Network Scanner, OpenSSH, socks5.exe, PsExec, or PAExec should be investigated when it appears alongside RDP or SSH movement, reverse SSH tunnels, process or service termination, and sudden file encryption. For ESXi systems, watch for unexpected access to /vmfs/volumes, changes to /etc/vmware/welcome, unexplained VM shutdowns, and unfamiliar encryption processes. 

• Krybit Ransomware pairs a familiar ransomware codebase with a fast growing affiliate operation 

Krybit Ransomware appeared in late March 2026 as a financially motivated Ransomware as a Service operation. Its model is straightforward: affiliates gain access to a victim, data is stolen before encryption, and the victim is pressured through a Tor based leak site. Krybit gives affiliates 80% of ransom proceeds and offers builders for Windows, Linux, VMware ESXi, and NAS environments. An April leak of its affiliate panel exposed two administrators, five affiliates, 20 victims in active negotiation, 10 to 250 GB of staged data per victim, and ransom demands ranging from $40,000 to $100,000. 

The group is casting a wide net rather than concentrating on a particular region or industry. Its affiliates have claimed victims across 43 countries. Germany has seen the highest share of reported activity, followed by Spain and Brazil, while Professional Services, Technology, and Manufacturing account for the largest sector concentrations. The April breach of Krybit's affiliate panel by rival group 0APT caused public exposure but did not stop operations. By early July, It was tracking 70 attributed victims, with additional claims still appearing. 

Krybit's technical behavior is consistent with the playbook used by many affiliate led ransomware operations. The activity includes compromised credentials, RDP and other remote services, script execution, boot or logon persistence, process injection, defense impairment, Tor communications, and data theft before encryption. One useful host level signal is its use of vssadmin.exe delete shadows /all /quiet to remove Windows Volume Shadow Copies. Files are then encrypted with the .KRYBIT extension, and victims receive RECOVER-README.txt, which points them to a Tor based negotiation portal. 

Analyst assessment: Krybit's main concern is not a technically unusual encryptor. Antivirus detections cited in the report point to Babuk derived code. What deserves attention is how quickly the operation has built an affiliate base and continued adding victims after its internal panel was exposed. Cross platform builders also give affiliates the option to target servers, hypervisors, and storage systems instead of limiting encryption to Windows endpoints. No confirmed relationship with an established ransomware gang or nation state actor has been identified, so current reporting supports treating Krybit as an emerging financially motivated RaaS operation rather than part of a known larger actor set. 

Defender priority: Put most of the detection effort around access, recovery disruption, and pre-encryption behavior. Require MFA for RDP, VPN, and remote administration interfaces, reduce exposed remote services, and investigate unusual valid account activity. Alert shadow copy deletion, process injection, suspicious script execution, and Tor related traffic. Backups should be immutable or offline, with recovery testing that includes ESXi and NAS systems. Hunt for the .KRYBIT extension and RECOVER-README.txt on endpoints, but do not rely on those artifacts alone. Krybit's affiliate model means the steps leading up to encryption may vary from one intrusion to another. 

Securonix ThreatWatch Summary: 

Based on the threats observed during July 2026, Securonix ThreatWatch team recommends implementing the following defensive measures to reduce exposure across developer environments, cloud services, endpoints, email systems, and ransomware-prone infrastructure. 

Identity and access: 

• Rotate GitHub personal access tokens, npm credentials, SSH keys, cloud credentials, CI/CD secrets, and other authentication material accessible from systems that imported the compromised AsyncAPI packages. Treat affected developer workstations and build runners as potentially compromised, even when the packages were only loaded during a build or application startup. 

• Restrict service accounts and release bots to the minimum repository and workflow permissions required. Review privileged tokens for organization-wide access, remove unnecessary write permissions, and require approval for changes to protected branches and release workflows. 

• Review Microsoft 365 identities for unusual Graph API activity, suspicious OAuth use, unexpected calendar attachments, and events scheduled far into the future. Investigate anomalous Entra ID credential refresh activity, especially when it is paired with unusual DNS requests or access from unfamiliar systems.  

• Require MFA for VPN, RDP, administrative portals, and remote access services. Investigate valid-account activity from external partners or unfamiliar infrastructure, since both ransomware and targeted intrusion activity used trusted access paths and stolen credentials. 

Email, webmail, and user awareness: 

• Patch internet-facing webmail platforms promptly, including SOGo, Zimbra, mDaemon, Roundcube, and Kerio deployments. Review systems for exploitation attempts involving malicious calendar invitations, crafted email content, cross-site scripting, unsafe file uploads, and PHP deserialization. 

• Treat simply viewing an email as a possible exploitation event on vulnerable webmail systems. Operation RoundPress did not require victims to click a link or open an attachment, so user awareness alone cannot mitigate this activity. 

• Monitor webmail servers for new PHP files, reverse-shell activity, unexpected outbound connections, changes to application resources, and persistent access mechanisms. TA458 used several fallback methods to retain access when one persistence path failed. 

• Show full file extensions in Windows and train users to treat document-themed JavaScript files, including names such as transcript.pdf.js, as executable content. Block or isolate JavaScript files delivered through untrusted websites, email, chat, and download portals. 

Endpoint and malware prevention: 

• Alert when wscript.exe or cscript.exe launches PowerShell, particularly when execution-policy bypasses, Invoke-RestMethod, Invoke-Expression, or Blogspot-hosted content appear in the same process chain. These behaviors were central to the Veil#Drop infection sequence. 

• Hunt for PowerShell that downloads and executes content directly in memory, XOR-decodes embedded payloads, or loads .NET assemblies through Reflection.Assembly::Load(). Monitor abuse of RegSvcs, InstallUtil, MSBuild, CSC, VBC, ILAsm, and AspNet_Compiler as alternate execution paths. 

• Inspect systems for PureLog Stealer activity, including access to browser credentials, cookies, autofill data, browsing history, cryptocurrency wallets, and system information. Treat discovery of these behaviors as a credential exposure event, not only a malware cleanup issue. 

• Monitor ViPNet installations for wtsapi32.dll or other unsigned libraries written into update directories. Alert when itcsrvup64.exe or itcsrvup.exe injects into svchost.exe, launches unusual child processes, or loads code that is not signed by InfoTeCS. 

• Detect renamed PuTTY, Plink, SSH, or tunneling utilities by their original file metadata and command-line behavior rather than filename alone. The HelloNet operators renamed legitimate tools and used them to create reverse tunnels from compromised environments. 

Developer and software supply chain security: 

• Audit all environments for the affected AsyncAPI versions and remove them from lockfiles, package caches, artifact repositories, container layers, build images, and developer systems. Pin dependencies to known-good versions and rebuild affected projects from a clean baseline. 

• Do not rely on npm install --ignore-scripts as the sole defense against malicious packages. The AsyncAPI loader executed when the package was imported or required, not through a preinstall or postinstall hook. 

• Review GitHub Actions workflows for pull_request_target jobs that check out or execute untrusted pull-request content. Separate untrusted build activity from jobs that have repository secrets, privileged tokens, publishing rights, or access to protected environments. 

• Require branch protection, signed commits where practical, workflow approval for external contributions, and restrictions on direct pushes to release branches. Alert when placeholder Git identities, force pushes, unexpected branch creation, or unusual service-account activity appears in repositories used for package publishing. 

• Treat provenance as evidence of how a package was built, not proof that the source commit was authorized. The malicious AsyncAPI packages carried valid GitHub OIDC provenance because the attacker used the project's legitimate release workflows. 

• Hunt for sync.js under NodeJS-themed directories, detached Node.js child processes, IPFS downloads, and Miasma persistence such as miasma-monitor or miasma-monitor.service. Block or alert on the associated C2 endpoints and decentralized fallback channels where they are not required for business use. 

Cloud and trusted-service abuse: 

• Monitor Microsoft Graph API activity by application, identity, source system, and operation type. Pay close attention to calendar creation, attachment uploads, mailbox access, and activity involving dates far outside normal business use. 

• Review Microsoft 365 audit logs alongside endpoint and network telemetry. HOLLOWGRAPH used legitimate Graph traffic for command delivery and exfiltration, which makes domain reputation and conventional C2 blocking less effective. 

• Inspect PowerShell and scripting-engine traffic to trusted hosting services such as Blogspot and IPFS gateways. Trusted domains should not be automatically exempted from content inspection when they are accessed by unusual processes or immediately followed by in-memory execution. 

• Block public IPFS gateways where they are not required. Where blocking is not practical, inspect downloads for known content identifiers, JavaScript payloads, and follow-on execution from user-writable NodeJS directories. 

Ransomware prevention and recovery: 

• Apply MFA to RDP, VPN, and remote administration interfaces. Restrict remote services to trusted networks and investigate authentication from partner environments that does not match normal access patterns. 

• Monitor for Mimikatz, network scanners, OpenSSH deployment, KeePass database access, PsExec, PAExec, reverse SSH tunnels, and rapid use of RDP or SSH across multiple systems. Toy Ghouls used these tools before deploying GenieLocker. 

• Extend endpoint monitoring and backup coverage to Linux, VMware ESXi, and NAS systems. GenieLocker and Krybit both support non-Windows targets, including server and virtualization infrastructure. 

• Alert on virtual-machine shutdown, service termination, security-tool interference, shadow-copy deletion, and encryption processes that access local and network drives. Maintain offline or immutable backups and test restoration for Windows, Linux, ESXi, and storage platforms. 

• Do not rely solely on leak-site claims when assessing ransomware incidents. Validate claims against internal logs, authentication records, endpoint telemetry, and confirmed data movement, while treating any credible listing as a reason to begin investigation. 

Vulnerability and exposure management: 

• Prioritize patches for internet-facing webmail products and verify that old or unsupported versions are removed from service. Webmail systems should be isolated from unnecessary outbound access and monitored for application-level exploitation, unexpected file creation, and command execution. 

• Review ViPNet update components and directories for DLL side-loading exposure. Restrict write access to software update paths and validate the signature of libraries loaded by trusted update processes. 

• Inventory cloud applications, OAuth permissions, developer integrations, package registries, and CI/CD workflows that can access production credentials. Remove stale trust relationships and reduce the number of systems that can publish code or retrieve sensitive secrets. 

• Treat trusted update systems, cloud APIs, open-source packages, and legitimate automation as part of the attack surface. July's activity repeatedly showed that valid signatures, trusted domains, or approved workflows can still deliver attacker-controlled code. 

Detection engineering and response: 

• Correlate repository events, package downloads, Node.js execution, endpoint persistence, credential access, and outbound connections into a single investigation timeline. This is necessary to distinguish a poisoned dependency from a routine package update. 

• Add detections for pull_request_target workflows that execute untrusted code, direct pushes by service accounts, deleted workflow runs, unexpected OIDC publishing, and package releases that follow unusual branch or commit activity. 

• Hunt for Microsoft Graph calendar abuse, distant-future events, application-driven attachment uploads, unusual DNS tunneling, and token refresh activity outside normal Microsoft 365 patterns. 

• Detect wscript.exe to PowerShell execution, Invoke-RestMethod followed by Invoke-Expression, Blogspot or IPFS retrieval from scripting engines, reflective .NET loading, and Microsoft-signed .NET utilities launching unknown assemblies. 

• Monitor webmail servers for SpyPress-related JavaScript, suspicious PHP files, reverse shells, curl or Python retrieval commands, and outbound traffic to newly observed infrastructure. 

• During containment, rotate credentials from a clean system, remove all persistence paths, rebuild compromised developer and CI systems, purge package caches, validate repository history, and confirm that release workflows have not been modified before restoring publishing access. 

Outlook for the Months Ahead: 

• software supply chain attacks will keep targeting CI/CD workflows, release bots, protected branches, and package-publishing automation. Attackers have shown they can turn one stolen repository credential into trusted, provenance-signed malicious releases without compromising the package registry itself. 

• Import-time execution will receive more attention from both attackers and defenders. Malicious packages that run when an application imports a module can bypass controls focused on installation hooks, which makes dependency loading, build startup, and application initialization likely targets for future campaigns. 

• Trusted cloud and collaboration services will remain useful attacker infrastructure. Microsoft Graph, Microsoft 365 calendars, Blogspot, IPFS, Nostr, and other legitimate services offer reliable hosting or communication while blending into traffic that many organizations allow by default. 

• Cloud-native espionage will continue shifting detection pressure toward identities, OAuth activity, API use, and SaaS audit logs. Endpoint and network controls alone will struggle when commands and stolen data move through calendar events, attachments, and normal-looking Graph API requests. 

• User-driven execution will remain dependable for commodity malware. Document-themed JavaScript files, hidden extensions, compromised websites, and trusted hosting can still move victims into a PowerShell-based infection chain without exploiting a software vulnerability. 

• Memory-resident malware and trusted-binary abuse will keep growing. Reflective .NET loading, XOR-decoded assemblies, PowerShell ScriptBlocks, and Microsoft-signed utilities allow operators to reduce disk evidence while retaining flexible execution paths when one method is blocked. 

• Ransomware groups will continue expanding beyond Windows endpoints. Custom encryptors for Linux, VMware ESXi, and storage platforms give affiliates access to systems where outages are harder to contain and recovery is often slower. 

• Pre-encryption activity will remain as important as the locker itself. Expect more use of stolen VPN credentials, network scanners, Mimikatz, RDP, SSH, tunneling tools, and legitimate remote-execution utilities before ransomware deployment. 

• Internet-facing webmail and trusted update systems will remain attractive targets because they provide broad access with limited user interaction. Half-click email exploitation, DLL side-loading, signed update processes, and server-side persistence allow attackers to maintain access without depending on traditional attachment delivery. 

• Anti-analysis measures will continue to become more common in both malware and ransomware. Runtime checks, delayed execution, secret launch arguments, code-integrity validation, obfuscated configuration, and selective artifact cleanup will slow triage and make early evidence less reliable. 

For a full list of the search queries used on Autonomous Threat Sweeper for the threats detailed above, refer to ours Threat Labs home page. The page also references a list of relevant policies used by threat actors.  

We would like to hear from you. Please reach out to us at scia@securonix.com.  

Note: The TTPs when used in silo are prone to false positives and noise and should ideally be combined with other indicators mentioned. 

Contributors: Dheeraj Kumar