Securonix ThreatWatch Monthly Intelligence Insights – October 2026

Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay Kumar 

Introduction:

The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Watch in October 2026. The report also includes a synopsis of the threats, indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), and related tags. Each threat has a comprehensive summary from Threat Labs and search queries from the Threat Research team. For additional information on Threat Labs and related search queries used via Autonomous Threat Sweeper to detect the below-mentioned threats, refer to our Threat Labs home page.

Last month, Securonix Autonomous Threat Sweeper identified and analyzed 4,631 TTPs and IoCs; identified 107 emerging threats; investigated 75 potential threats; and elevated 17 incidents. The top data sources swept against include IDS / IPS / UTM / Threat Detection, Data Loss Prevention, Endpoint Management Systems, and Email / Email Security.

Executive Summary:

• TRUST#GRAFT: Securonix Threat Research uncovered a JavaScript-driven attack chain that abuses authenticated WordPress administrator sessions to deploy a persistent PHP backdoor. The loader uses fake Cloudflare verification pages, browser fingerprinting, and credential collection before attempting to install a malicious plugin through legitimate WordPress workflows. The backdoor establishes must-use plugin persistence, injects remote JavaScript, hides from plugin listings, and enables unauthorized administrator access. 

• PHP2Shell: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, expose web applications to memory corruption and potential unauthenticated remote code execution. The flaws involve unsafe out-of-memory cleanup and use-after-free conditions across PHP requests. Exploitation attempts were observed before public disclosure, although confirmed production compromises remain unverified. Exposure depends on the PHP runtime, server configuration, and worker lifecycle. 

• Node2Shell: CVE-2026-111497, also known as HTTP2Shell or Broccoli2Shell, affects the Brotli decoder used by Node.js and other software. Malformed compressed data can trigger an out-of-bounds write, potentially causing crashes, memory disclosure, or remote code execution. Public demonstrations confirmed code execution under controlled conditions, while reported exploitation activity raised concerns for enterprise applications processing attacker-controlled compressed content. 

• Operation FlashHole: Lazarus targeted South Korean organizations through tailored phishing lures and malicious websites that abused CrossWeb EX financial security software. The campaign used in-memory execution, DLL side-loading, and a multi-stage malware framework involving TechHub, Cubridge, TouchHub, and TouchShift. GitHub-based command and control, modular payload delivery, credential theft, and Windows service persistence supported prolonged access while limiting forensic traces. 

• ARMORY CASTLE: The suspected China-linked espionage actor exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day to establish persistent access. Following exploitation, operators deployed the SAWFLY PHP webshell and BARECLAW tunneler, escalated privileges to root, and manipulated startup configurations. The intrusion also involved credential vault access attempts, log deletion, and abuse of legitimate remote-support functionality to reach internal systems. 

• Funhouse Ransomware / Kimsuky: Kimsuky-linked operators distributed Funhouse ransomware through malicious Hangul documents disguised as resumes, replacing previously observed LNK-based delivery methods. The infection chain combined embedded OLE objects, Batch, VBS, and PowerShell scripts, a Python-based backdoor, and Quasar RAT to deploy ransomware. Funhouse retained encryption mechanisms and configuration similarities with earlier Endpoint ransomware variants despite changes to infrastructure and payload versions. 

• n0n Ransomware: An AI-assisted extortion operation that relied on stolen credentials, FortiGate SSL-VPN credential stuffing, weak remote access, and exposed cloud keys rather than vulnerability exploitation. The operators used AI-assisted tooling to develop attack scripts, automate data theft, and support ransomware deployment. Victims faced encryption, backup destruction, network disruption, and data-leak threats, with evidence pointing to human-directed rather than autonomous attacks. 

• BPFDoor / AVERAT: Linux backdoors targeting telecommunications and network-edge appliances in South Korea and Taiwan. BPFDoor variants used passive packet filtering, hidden activation triggers, and process-name spoofing to evade detection. AVERAT employed SMTP and STARTTLS communication for encrypted command and control, supporting remote shells, file operations, and proxying. Self-deleting payloads and environment-specific disguises further complicated forensic analysis. 

• PEERSTITCH: A prolonged intrusion involving FortiManager and managed FortiGate firewalls, where attackers exploited CVE-2024-47575 and CVE-2025-61624 to steal sensitive configurations and deploy a memory-resident ARM64 implant. PEERSTITCH injected malicious code into FortiOS logging and VPN processes, enabling covert access through legitimate traffic without persistent binaries or dedicated network connections. The compromise exposed management data for more than 500 firewalls, although downstream client intrusions were not confirmed.

Threat Overview:

Securonix Threat Research Highlights:

• TRUST#GRAFT: JavaScript Attack Targets WordPress Admins with Persistent PHP Backdoor 

Securonix Threat Research team has identified TRUST#GRAFT, a JavaScript-based attack that targets authenticated WordPress administrators to install a persistent PHP backdoor. Instead of exploiting a WordPress vulnerability, the attack takes advantage of an administrator's existing browser session to deploy malicious plugins. The infection begins with a JavaScript loader that displays a fake Cloudflare verification page, collects browser information, and attempts to gain administrative access. The initial delivery method remains unconfirmed, but possible sources include compromised websites, malicious advertisements, injected scripts, or vulnerable WordPress plugins and themes. 

The JavaScript loader creates a full-screen "Just a moment" verification overlay while collecting browser details such as navigator.webdriver, screen resolution, WebGL information, installed plugins, and timezone. It communicates with attacker-controlled endpoints /api/v1/8e4c615 and /api/v1/f659473 to retrieve a token, complete a proof-of-work challenge, and submit fingerprint data. This process helps filter automated analysis environments before delivering additional malicious content. The loader also supports ClickFix-style attacks by retrieving commands through /api/v1/e81929c and attempting to copy them to the clipboard. It searches localStorage, sessionStorage, and accessible browser cookies for authentication tokens and other sensitive data, which can be sent to /api/v1/6a38418. 

The main attack occurs when the JavaScript detects an active WordPress administrator session. It accesses /wp-admin/plugin-install.php?tab=upload, extracts a valid WordPress nonce, and downloads a malicious archive named wm.zip from attacker infrastructure. The archive is uploaded through /wp-admin/update.php?action=upload-plugin and subsequently activated using the legitimate WordPress plugin activation process. This allows the attacker to install malicious code using an already authenticated administrator session without directly bypassing login authentication. 

The wm.zip archive contains a PHP backdoor disguised as "Web Media Optimizer" version 2.1. Once activated, the plugin retrieves malicious JavaScript through vilialobos[.]lol/ads.php and injects it into public WordPress pages. It also copies itself to wp-content/mu-plugins/wmedia-recovery.php, allowing it to persist even if the original plugin is removed. The backdoor hides from standard plugin listings, disables TLS certificate verification during remote requests, and includes token-protected functionality to restore administrator access without a password. Related infrastructure includes caapman[.]me, vtevens[.]icu, gerlace[.]com, nutmann[.]club, and okuneva[.]sbs. 

Analyst assessment: TRUST#GRAFT is concerning because it turns a legitimate WordPress administrator session into a means of installing persistent malicious code. The attack combines fake verification pages, browser fingerprinting, credential collection, unauthorized plugin installation, and hidden PHP persistence. While the recovered payload confirms these capabilities, the initial infection source and actual victim impact remain unconfirmed. A successful compromise could allow attackers to maintain administrator access, steal sensitive information, and continuously inject malicious scripts into affected websites. 

Defender priority: Monitor WordPress plugin uploads and activation requests, particularly unusual activity involving /wp-admin/update.php?action=upload-plugin. Inspect wp-content/mu-plugins/ for suspicious PHP files, especially wmedia-recovery.php, and review WordPress options for unauthorized external script URLs. Hunt for connections to the identified domains and suspicious /p/wm.zip downloads. Preserve web server, WAF, proxy, and browser logs during investigations. Restrict plugin installation permissions, use separate browser profiles for WordPress administration, and invalidate administrator sessions if compromise is suspected.

PHP2Shell & Node2Shell: Critical RCE Threats:

• PHP2Shell: Critical PHP Remote Code Execution Vulnerabilities Exploited Before Public Disclosure

October 2026 saw active exploitation attempts targeting PHP2Shell, a pair of critical vulnerabilities in the PHP core tracked as CVE-2026-109618 and CVE-2026-109619, each assigned a CVSS v4.0 score of 9.2. These vulnerabilities could allow unauthenticated attackers to execute arbitrary code on affected web servers without relying on flaws in the hosted applications. Although security patches were released on October 21, 2026, exploitation attempts were reported as early as October 17, suggesting that attackers had knowledge of the vulnerabilities before public disclosure. The affected PHP environments include Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, with Apache mod_php configurations showing the highest exploitation success in the reported testing.

The two vulnerabilities affect different parts of PHP's memory management. CVE-2026-109618 involves memory corruption triggered by out-of-memory (OOM) conditions during the processing of specially crafted multipart/form-data requests. Attackers can trigger these conditions using hundreds of empty file fields, deeply nested parameter names, excessive headers, or unusually large request bodies. When memory allocation fails, PHP's error-handling process may leave partially initialized structures that are later accessed during request cleanup, potentially leading to memory corruption and arbitrary code execution. CVE-2026-109619, on the other hand, involves stale global state that can leave pointers referencing memory that has already been freed. If the same PHP worker processes another request, these dangling pointers may be reused, resulting in a use-after-free condition. Researchers identified PHP_SESSION_UPLOAD_PROGRESS as one confirmed exploitation path, while PHP 8.5's fatal_error_backtraces functionality provides another affected code path.

Following the disclosure of PHP2Shell on October 21, 2026, exploitation attempts increased rapidly, with 743 suspicious requests from 33 IP addresses recorded in a single day. Attackers used automated scanning tools, crafted multipart requests, memory-exhaustion payloads, and commands such as uname -a; id; echo JACKALPOC to test potential code execution. Researchers also observed attempts to deploy second-stage payloads, including Mirai-based botnet malware, PHP web shells, DDoS tools, and remote access agents. One attack chain attempted to download and execute a Linux payload from 92.118.112[.]100/nfs, while associated malware used encrypted C2 communications and IP manipulation techniques to evade detection.

Separate intelligence reporting identified a suspected North Korean state-linked campaign, potentially associated with the Lazarus Group ecosystem, targeting vulnerable PHP infrastructure. The campaign reportedly targeted 216 internet-facing systems across 10 countries, including the United States, Japan, South Korea, and India, with attackers later claiming an expansion to 581 systems. The activity involved low-volume scanning, rotating infrastructure, modified public exploits, and attempted web-shell deployment. Suspected objectives included credential theft, financial data collection, espionage, and persistent access. However, the Lazarus attribution and claimed expansion remain unverified, and the observed exploitation attempts do not independently confirm successful compromise. 

Analyst Assessment: PHP2Shell poses a serious risk to internet-facing infrastructure because the vulnerabilities exist within PHP's core request-processing and memory-management functions. As a result, exploitation may occur even when the hosted web application does not contain a known vulnerability. The reported exploitation attempts before public disclosure, followed by automated scanning and malware delivery activity, indicate that attackers moved quickly to take advantage of exposed systems. The widespread use of PHP, availability of public exploit tooling, and potential for unauthenticated remote code execution increase the risk for organizations running vulnerable versions. However, suspicious multipart requests or references to PHP_SESSION_UPLOAD_PROGRESS should not be treated as confirmation of compromise without additional evidence from application logs, endpoint telemetry, or network activity.

Defender Priority: Organizations should prioritize identifying vulnerable PHP installations and upgrading to patched versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or applying verified backported security fixes where applicable. All PHP workers should be restarted after patching to ensure the updated components are loaded, with internet-facing Apache mod_php deployments receiving immediate attention. Security teams should review web server, WAF, and application logs dating back to October 17, 2026, for unusual multipart/form-data POST requests, excessive form fields, deeply nested parameters, PHP_SESSION_UPLOAD_PROGRESS references, and suspicious PHP2Shell user-agent strings. These findings should be correlated with PHP worker crashes, memory exhaustion errors, HTTP 500 responses, newly created .php or .phtml files, and unexpected shell execution originating from php-fpm, httpd, or apache2 processes. Defenders should also investigate suspicious outbound connections to reported malicious infrastructure and unexpected executable activity within /tmp, /var/tmp, and /dev/shm. Where immediate patching is not possible, organizations should restrict public exposure and apply temporary vulnerability-specific mitigations, while recognizing that configuration changes alone do not fully address the underlying vulnerabilities.

Securonix Threat Labs has also published a detailed PHP2Shell analysis covering tradecraft, impact, and recommended mitigations. Refer to the full reports for complete findings: 

• PHP2Shell: ThreatWatch Assessment of CVE-2026-109618 and CVE-2026-109619 

• PHP2Shell: The Parent Process Is The Whole Story

• Node2Shell / HTTP2Shell: Critical Brotli Decoder Vulnerability Enables Remote Code Execution (CVE-2026-111497)

October 2026 identified CVE-2026-111497, also known as Node2Shell, HTTP2Shell, or Broccoli2Shell, a critical out-of-bounds write vulnerability affecting the Brotli decompression library used by Node.js and several other software platforms. Disclosed on October 21, 2026, the vulnerability received a CVSS v4.0 score of 9.2 (Critical), although the Node.js project classified it as High severity. Successful exploitation could allow unauthenticated attackers to corrupt application memory, expose sensitive information, disrupt services, or execute arbitrary code. On October 27, the vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog, increasing the urgency for organizations to identify and remediate affected systems.

The vulnerability originates in the Brotli decoder's DecodeBlockTypeAndLength() function within c/dec/decode.c. When processing malformed compressed data, the decoder may incorrectly interpret an invalid block-switch condition as a request for additional input rather than a permanent format error. This allows processing to continue with an invalid internal state, potentially causing attacker-controlled data to overwrite memory beyond an eight-byte internal buffer. The flaw is associated with CWE-252 (Unchecked Return Value) and CWE-787 (Out-of-Bounds Write). Depending on the runtime conditions, exploitation may result in memory corruption, sensitive information disclosure, application crashes, or remote code execution. Certain malformed Brotli streams can also trigger infinite processing loops, leading to sustained CPU utilization and denial of service.

Attackers can reach the vulnerable decoder through both inbound HTTP requests and outbound HTTP responses. Inbound attacks involve specially crafted requests containing the Content-Encoding: br header, targeting applications configured to decompress incoming data. Frameworks such as Express 5, body-parser 2.x, and Koa with @koa/bodyparser may expose this functionality. Outbound attacks occur when applications automatically decompress attacker-controlled Brotli responses retrieved through HTTP clients such as fetch(), axios, or got. This creates additional exposure for services handling webhooks, URL previews, web crawling, and third-party integrations. Direct processing of untrusted compressed data through node:zlib is another possible entry point. However, a basic Node.js HTTP server does not automatically decompress incoming Brotli requests, so exploitation requires the malicious content to reach a vulnerable decoding function.

Security researchers demonstrated successful remote code execution against unmodified Node.js 24.22.0 installations on Linux ARM64 and x86-64 systems. The attacks worked across applications using built-in HTTP functionality, Express 5, Koa 3, and direct Brotli decompression routines. Successful exploitation allowed commands to execute with the privileges of the affected application, including root access when the service itself was running as root. The demonstrations did not require modified binaries or disabled memory protections, although repeated attempts were sometimes necessary. The same malicious inputs were rejected by patched Node.js 24.22.1 builds.

Following public disclosure, researchers recorded 402 reconnaissance and exploitation events from 20 IP addresses within 24 hours, affecting 12 monitored environments. Automated scanning activity included the user-agent string node2shell-check/1.0, which was used to identify applications processing Brotli-compressed content. On October 26, additional monitoring captured a malicious Brotli payload of approximately 23 MB targeting Node.js 24.22.0 on x86-64 systems. The payload incorporated publicly available exploitation techniques and a modified return-oriented programming (ROP) chain. However, testing did not achieve successful command execution in 50 attempts, demonstrating that observed exploitation attempts do not necessarily indicate successful compromise.

Exploitation reliability depends on factors such as memory layout, runtime conditions, and application behavior. Failed attempts may cause segmentation faults, worker crashes, or repeated service restarts. These events are particularly relevant when applications automatically restart failed processes, potentially allowing attackers to make repeated attempts. Crashes may also expose sensitive information if the operating system generates core dumps containing authentication tokens, session cookies, or cryptographic material. Such files may be stored under locations including /var/lib/systemd/coredump.

The potential exposure extends beyond Node.js because Brotli is also incorporated into technologies such as Bun, Python Brotli libraries, .NET, Java brotli4j, Envoy, and Istio. Applications may also contain statically linked or independently bundled decoder implementations that require separate updates. Fixed Node.js releases include 22.23.4, 24.22.1, and 26.12.1, while upstream Brotli fixes are available in versions 1.0.10, 1.1.1, and 1.2.1, depending on the supported release branch. Organizations should verify their deployed runtime versions and embedded dependencies rather than relying solely on system-level package updates or the process.versions.brotli value, which may not accurately reflect whether a Node.js installation contains the security fix.

Analyst assessment: Node2Shell presents a serious risk to applications that process untrusted Brotli-compressed content. Successful exploitation across different processor architectures and application frameworks demonstrates that the threat is not limited to a specific deployment. The ability to exploit vulnerable decoders through outbound HTTP responses also creates exposure that may be missed by security monitoring focused only on inbound requests. While exploitation may require repeated attempts, unsuccessful attempts can still disrupt services or expose sensitive memory through crash dumps. The reported exploitation activity and inclusion in the CISA KEV Catalog make remediation a priority, particularly for internet-facing applications and services running with elevated privileges. 

Defender priority: Organizations should identify vulnerable Brotli implementations and prioritize upgrading Node.js to 22.23.4, 24.22.1, 26.12.1, or later patched releases, along with applying appropriate updates to other affected runtimes and libraries. Container images, statically linked libraries, and bundled dependencies should be reviewed separately to ensure vulnerable components are fully remediated. Security teams should monitor malformed Content-Encoding: br requests, unusual compressed payload sizes, decompression errors, CPU spikes, repeated worker crashes, and unexpected shell execution by application processes. Suspicious outbound connections and access to sensitive core dumps should also be investigated. Where immediate patching is not possible, restricting Brotli decompression on exposed request paths and limiting unnecessary outbound connectivity can reduce risk. However, these measures should be treated as temporary controls rather than replacements for security updates. 

Securonix Threat Labs has also published a detailed CVE-2026-111497 (Node2Shell, HTTP2Shell, or Broccoli2Shell) analysis covering tradecraft, impact, and recommended mitigations. Refer to the full reports for complete findings: 

• Node2Shell: Brotli Decoder Memory Corruption and Enterprise Exposure

Stealthy Backdoors Target Network-Edge Devices:

• Threat actors deploy PEERSTITCH, a stealthy memory-resident implant targeting FortiGate firewalls

A sophisticated intrusion targeting a telecommunications managed service provider has revealed the use of PEERSTITCH, a memory-resident backdoor designed to operate within legitimate FortiGate firewall processes. The activity, tracked as CL-STA-0954 (UNC5820), began in September 2024 when attackers exploited CVE-2024-47575 to compromise a centralized FortiManager appliance. They subsequently extracted configuration files, encrypted credentials, cryptographic material, and network information associated with more than 500 managed firewalls.

Using credentials recovered from the stolen configurations, the attackers established unauthorized VPN sessions and exploited CVE-2025-61624 to gain root-level access to selected firewalls. They then deployed PEERSTITCH, which injects malicious code into the legitimate /bin/miglogd and /bin/iked processes using ptrace-based memory manipulation. The implant operates without persistent binaries, listening ports, or independent outbound connections, making conventional detection difficult. The attackers also abused Apache's mod_md ACME functionality to establish reverse-shell access and removed traces of their activity by terminating logging services, clearing crash logs, and deleting malicious configuration objects.

Analyst assessment: The most concerning aspect of this intrusion is the attacker's ability to compromise hundreds of firewall configurations through a single management appliance. PEERSTITCH further complicates detection by operating inside trusted system processes rather than as a standalone executable. Even after affected systems are patched, stolen credentials and cryptographic material could allow attackers to regain access unless those secrets are replaced.

Defender priority: Investigate suspicious system.auto-script configurations containing path traversal sequences such as ../../../../setup, unauthorized device registrations, and unexpected management traffic over TCP port 541. Monitor miglogd, iked, and syslogd for abnormal termination, unauthorized memory modifications, and unusual access to /proc/<pid>/mem. Hunt for anonymous 16 KB executable memory regions within affected processes and review connections to 23.240.77[.]233 and 47.18.167[.]159. Organizations should also rotate potentially compromised credentials and cryptographic trust material and review downstream firewall configurations for unauthorized changes.

• BPFDoor and AVERAT backdoors exploit SMTP traffic and legitimate system processes to evade detection on network-edge devices

Newly analyzed Linux malware samples reveal how attackers are using BPFDoor and AVERAT to maintain covert access to telecommunications infrastructure and network-edge appliances. The research covers BPFDoor variants associated with South Korean environments and six AVERAT builds identified in Taiwanese appliances. BPFDoor uses Berkeley Packet Filter (BPF) mechanisms to monitor network traffic for specially crafted activation packets without opening conventional listening ports. An updated controller can also deliver activation commands through legitimate-looking HTTPS POST requests, allowing them to pass through SSL-terminating proxies. The malware disguises itself using familiar service names such as chronyd and rsyslogd, along with environment-specific artifacts including /var/run/spamsniper.pid. 

AVERAT takes a different approach by using SMTP over TCP port 25 for command-and-control communications. It initiates sessions using EHLO and STARTTLS before establishing an additional encrypted channel for attacker commands. The backdoor supports remote shell access, file transfers, process control, module loading, and network proxying, with callbacks occurring approximately every 600 to 699 seconds. During deployment, a dropper stages malicious executables as /sbin/ntpdate and /sbin/udevds, launches them, and deletes the files after approximately ten seconds while the processes continue running. AVERAT also stores operational settings in hidden files such as /var/lib/.db and uses compromised NAS devices, network appliances, and surveillance recorders as communication relays. 

Analyst assessment: Both malware families are designed to blend into the environments they target. BPFDoor avoids conventional network scanning by waiting for specific activation packets, while AVERAT hides its communications within SMTP traffic that may appear normal on mail-related infrastructure. Their use of legitimate process names and short-lived executable files reduces the evidence available to defenders. The compromised devices used as communication relays also make it harder to distinguish attacker-controlled infrastructure from ordinary internet traffic. Although the malware families share similar evasion techniques, the available evidence does not confirm that they are operated by the same threat actor. 

Defender priority: Hunt for unexpected raw packet sockets, BPF filters, and processes impersonating legitimate Linux daemons, particularly on systems that do not normally perform packet capture. Review outbound TCP port 25 connections from non-mail processes and investigate communications with mx.zxopfds[.]com, spam.suwaccqi[.]com, and mx1.wwstifsteel[.]com. Check for suspicious files such as updIptable.php, /HDD/ms6x2xTo64/execProcEnd, and hidden configuration files under /var/lib/. Pay particular attention to processes whose /proc/<pid>/exe paths reference deleted executables, along with rapid file creation and deletion activity in /sbin/.

Ransomware Threats Evolve with New Attack Tactics:

• Kimsuky-linked threat activity evolves from Endpoint to Funhouse ransomware using malicious HWP documents

In October 2026, researchers reported a Kimsuky-linked campaign distributing Funhouse ransomware, a variant of the previously identified Endpoint ransomware family. The campaign uses malicious Hangul Word Processor (HWP) documents disguised as resumes, moving away from the LNK-based delivery methods observed in earlier attacks. When a victim opens the malicious resume.Hwp document, it drops pdf.Exe and pdf.Exe.Manifest into the %TEMP% directory. Clicking an embedded hyperlink then triggers a chain of Batch, VBS, and PowerShell scripts that deploy a Python-based backdoor. The attackers subsequently install Quasar RAT, which is used to execute the Funhouse ransomware payload. Despite changes in delivery methods and C2 infrastructure, Funhouse retains several characteristics of the earlier Endpoint ransomware, including its encryption method, ransom-note filename, mutex, and internal encryption markers. 

Analyst assessment: The campaign suggests that the threat actor is refining an existing attack chain rather than developing an entirely new ransomware operation. Replacing suspicious shortcut files with familiar document formats may increase the likelihood of victims opening malicious content and following embedded links. The continued use of Quasar RAT and similarities between Funhouse and earlier Endpoint ransomware samples support the reported connection between these campaigns. Changes to malware versions, C2 addresses, and attacker contact details also indicate that the operators are updating their infrastructure while retaining proven infection techniques. 

Defender priority: Hunt for suspicious HWP documents that create executable files in temporary directories, particularly pdf.Exe, pdf.Exe.Manifest, and lpe*.Bat. Monitor document applications spawning unexpected script interpreters, including Batch, VBS, and PowerShell, followed by Python-based payload execution. Investigate Quasar RAT configuration files such as dog.dwg, the mutex _QQ_XCZ_VCXZ, and connections to 70.36.97[.]236:443. Watch for files encrypted with the .Funhouse extension and ransom notes named How To Restore Your Files.Txt. Restrict unauthorized script execution, keep document-processing software updated, and strengthen controls against malicious links embedded in resumes and other business documents.

• n0n ransomware group leverages AI-assisted tooling and compromised credentials for destructive extortion operations

Active since September 2026, the financially motivated n0n ransomware group has been targeting organizations across multiple sectors through credential theft, data exfiltration, and destructive extortion. An exposed server linked to the group revealed ransomware source code, attack scripts, command-and-control (C2) infrastructure, and an AI coding environment used to develop and refine malicious tools. The group primarily gains access through credential stuffing against SSL-VPN gateways, compromised RDP/WinRM accounts, exposed cloud access keys, and stolen administrative sessions. Once inside, attackers establish persistence using hidden administrator accounts and scheduled tasks before stealing sensitive data. Depending on the target, they deploy AES-256-CBC ransomware against Windows and Linux systems or destroy data and backups without encryption. In some cases, the group has also manipulated firewall policies to disrupt network connectivity.

Analyst assessment: The group's operations show how AI-assisted development can help attackers produce and modify malicious scripts while continuing to rely on familiar intrusion techniques. The available evidence points to human-directed attacks rather than fully autonomous AI operations. More concerning is the group's willingness to destroy backups, delete cloud data, and interfere with network infrastructure to increase pressure on victims. This approach allows the attackers to cause serious operational damage even when ransomware encryption is not deployed.

Defender priority: Monitor repeated authentication failures against SSL-VPN gateways, unusual RDP/WinRM activity, and suspicious cloud administrative access. Hunt for hidden accounts such as svc_upd and svc_reg, scheduled tasks referencing C:\Users\Public\n0n\, and ransomware artifacts including .n0n, .n0n.tmp, and n0n_READ_ME.txt. Investigate unexpected firewall policy changes, bulk cloud storage deletions, shadow-copy removal, and suspicious service termination. Enforce phishing-resistant MFA, restrict privileged access, and maintain offline or immutable backups to reduce the impact of destructive attacks

APT Threats: Zero-Day Exploits and Stealth Malware:

• Lazarus targets South Korean organizations with modular, memory-resident malware in Operation FlashHole

Active since at least July 2025, the North Korea-linked threat group Lazarus has been conducting a targeted espionage campaign known as Operation FlashHole, affecting organizations in South Korea's software, construction, and communication equipment manufacturing sectors. The group used fabricated résumé and portfolio websites hosted on GitHub Pages, likely distributed through spear-phishing emails, to lure victims into visiting malicious pages. These websites loaded external JavaScript linked to an infection chain involving INISAFE CrossWeb EX, legitimate financial security software commonly used in South Korea. Although the exact infection trigger remains unclear, investigators observed the INISAFECrossWebEXSvc.exe process launching fsquirt.exe, which was subsequently injected with the TechHub malware.

The campaign uses a multistage malware chain involving TechHub, TouchHub, TouchShift, ClientHub, LPEClient, and Cubridge. TechHub acts as the initial downloader and communicates through private GitHub repositories using GitHub API requests. For persistence, TouchHub copies a legitimate executable to C:\Windows\System32\RasConv\ImeBroker.exe, registers it as a Windows service, and uses DLL side-loading to execute the malicious mscoree.dll containing TouchShift. Additional components are then loaded into memory, eventually deploying Cubridge, a modular backdoor capable of command execution, system reconnaissance, credential theft, file collection, and process injection.

The group also uses several communication methods to make its traffic harder to distinguish from legitimate activity. ClientHub supports C2 communication through compromised websites or the Dropbox API, while TechHub uses GitHub repositories to exchange encrypted commands and payloads. The updated LPEClient no longer communicates directly with its C2 infrastructure. Instead, it exchanges data through ClientHub using shared memory buffers. Its latest version also incorporates ML-KEM-1024 post-quantum cryptography during key exchange to protect subsequent payload delivery. Most of the infection chain executes directly in memory, leaving relatively few artifacts on disk.

Analyst assessment: Operation FlashHole shows that Lazarus is continuing to refine previously used malware rather than replacing its entire toolkit. The group has separated its capabilities across multiple components, allowing different payloads to handle persistence, reconnaissance, communication, and further malware delivery. The combination of trusted software abuse, legitimate cloud services, and memory-resident execution reduces the effectiveness of detections that depend mainly on malicious files or known C2 addresses. The use of post-quantum cryptography in LPEClient also makes payload analysis more difficult.

Defender priority: Investigate unusual process execution involving INISAFECrossWebEXSvc.exe spawning fsquirt.exe, particularly when followed by suspicious memory activity or code injection. Hunt for unauthorized Windows services executing C:\Windows\System32\RasConv\ImeBroker.exe, malicious mscoree.dll files, and configuration artifacts such as ActivationStore.dat and msadc.inc. Review unexpected GitHub API requests, unusual GitHub Issues activity, and Dropbox API communications from processes that do not normally access these services. Monitor connections to known campaign infrastructure, including javadevhouse.co[.]kr, pythonapischool[.]com, and cubedesign[.]co[.]kr. Prioritize detections for reflective DLL loading, suspicious service creation, process injection, and credential collection within legitimate Windows processes.

• ARMORY CASTLE exploits BeyondTrust zero-day to deploy SAWFLY webshell and BARECLAW tunneler

In late August 2026, the suspected China-linked espionage group ARMORY CASTLE (formerly UNC5221) exploited CVE-2026-102764, a zero-day vulnerability in BeyondTrust Remote Support appliances that was publicly disclosed on October 15. The flaw allows unauthenticated attackers to upload arbitrary files and potentially gain control of affected appliances. After gaining access, the group deployed two custom tools, SAWFLY and BARECLAW, to maintain access and move further into compromised networks.

The attackers initially deployed SAWFLY (mangoapi.php), a PHP webshell that processes encrypted commands through HTTP POST requests using Base32 encoding and RC4 encryption. They then copied /bin/sh to /usr/bin/dbus-authd and assigned SUID permissions to obtain root-level access. For persistence, the group created a startup script named zz-root-persist, which modifies /ns/config/sudoers.template to grant passwordless administrative privileges. The attackers also attempted to extract stored credentials using the appliance's bt-secrets utility and removed system and application logs to conceal their activity.

Once they had administrative access, the attackers modified Jump Item permissions and initiated remote support sessions to access internal endpoints and retrieve sensitive files. They also deployed BARECLAW, a custom SOCKS5-over-WebSocket tunneler, and modified /ns/config/haproxy.conf to route incoming requests through /uidchanarge to a local listener on TCP port 19800. This allowed external communication with the tunneler without directly exposing its listening port.

Analyst assessment: The most concerning aspect of this activity is the attackers' use of the remote support appliance itself to maintain access and reach internal systems. Rather than relying solely on malware, ARMORY CASTLE modified native configurations, abused privileged accounts, and used legitimate remote support features for lateral movement. Its persistence mechanisms could survive reboots and configuration resets, while access to stored credentials and connected endpoints could allow the compromise to extend beyond the original appliance.

Defender priority: Apply the BT26-05 security patch and investigate appliances that were exposed before remediation. Hunt for suspicious PHP files such as mangoapi.php, unauthorized binaries such as /usr/bin/dbus-authd, and startup scripts including zz-root-persist. Review changes to /ns/config/sudoers.template and /ns/config/haproxy.conf, particularly entries associated with /uidchanarge and TCP port 19800. Investigate unusual bt-secrets activity, unexpected administrative permission changes, suspicious remote support sessions, and unauthorized file transfers. Preserve available logs and rotate potentially exposed credentials after securing the affected appliances.

Securonix ThreatWatch Summary:

Based on the threats observed during October 2026, the Securonix ThreatWatch team recommends the following security measures to help organizations reduce exposure, detect suspicious activity, and prevent attackers from establishing or maintaining unauthorized access.

• Secure WordPress Administration and Plugin Management: Use dedicated browser profiles for WordPress administration and avoid accessing untrusted websites while logged into privileged accounts. Limit plugin installation permissions, require approval for changes, and monitor unusual plugin uploads or activations. Regularly inspect wp-content/mu-plugins for unauthorized PHP files and investigate suspicious JavaScript injections, external scripts, and administrator session activity associated with TRUST#GRAFT.

• Address Critical PHP Vulnerabilities: Prioritize patching PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or applying verified security fixes. Review PHP deployments across Apache, PHP-FPM, and containerized environments, and restart affected workers after patching. Monitor suspicious multipart requests, memory exhaustion errors, unexpected child processes, and unusual outbound connections that could indicate exploitation attempts.

• Protect Node.js Applications Against Brotli Exploitation: Address CVE-2026-111497 (Node2Shell) by updating affected Node.js runtimes and vulnerable Brotli libraries, including components bundled within applications, containers, and gateways. Prioritize services that decompress untrusted HTTP requests, external responses, or uploaded content. Where immediate patching is not possible, restrict unnecessary Brotli decompression and processing of untrusted content. Investigate repeated application crashes, unexpected Node.js child processes, service restarts, and suspicious network activity.

• Strengthen Defenses Against Advanced Persistent Threats: Keep endpoint security tools and software components updated, particularly applications and browser-related components such as CrossWeb EX targeted in Lazarus-linked activity. Investigate suspicious DLL side-loading, unauthorized Windows services, process injection, and unusual execution involving legitimate system binaries. Monitor unexpected GitHub API and Dropbox communication from unfamiliar processes, as these services may be abused for malware command-and-control operations.

• Harden Remote Support Infrastructure and Privileged Access: Apply security updates to BeyondTrust Remote Support, particularly for CVE-2026-102764, and restrict administrative access to trusted management networks. Monitor unauthorized configuration changes, web shells, unexpected tunneling services, and privilege escalation attempts associated with ARMORY CASTLE. Review Jump Item permissions, API accounts, and remote-support sessions. Preserve external security logs and rotate exposed credentials after securing affected appliances. Rebuild confirmed or potentially compromised systems when necessary.

• Reduce Exposure to Phishing and Ransomware: Strengthen email filtering and employee awareness against malicious Hangul documents, fraudulent resumes, and suspicious hyperlinks used in Kimsuky-linked Funhouse ransomware campaigns. Keep document-processing applications and endpoint security tools updated. Monitor unusual execution involving HWP files, Batch scripts, VBS, PowerShell, and Quasar RAT. Restrict unauthorized script execution through application controls and maintain tested, isolated backups to support recovery.

• Protect Against Credential Theft and AI-Assisted Extortion: Enforce phishing-resistant multi-factor authentication across VPNs, RDP, WinRM, administrative portals, and cloud services. Monitor FortiGate SSL-VPN credential stuffing, unauthorized firewall policy changes, and suspicious cloud API activity associated with n0n ransomware operations. Replace long-lived cloud access keys with short-lived credentials, limit privileged access, and maintain immutable backups. Investigate unusual data transfers, backup deletion attempts, and mass file encryption that may indicate ransomware or extortion activity.

• Improve Network-Edge Visibility and Backdoor Detection: Restrict administrative access to Linux servers, routers, telecommunications systems, and embedded network appliances. Monitor unexpected raw packet sockets, Berkeley Packet Filter activity, process-name spoofing, and running processes whose executable files have been deleted. Investigate unusual outbound SMTP traffic over TCP/25 from non-mail processes, which may indicate BPFDoor or AVERAT activity. Review suspicious startup scripts, hidden configuration files, and unauthorized proxy or tunneling connections.

• Secure Fortinet Management Infrastructure: Keep FortiManager and FortiGate appliances updated, restrict management interfaces, and monitor unauthorized administrative activity or configuration changes. Investigate suspicious FortiOS auto-script modifications, unexpected VPN sessions, logging disruptions, and unusual memory activity involving miglogd and iked. If centralized management infrastructure is compromised, assess all connected firewalls, rotate exposed credentials and cryptographic trust material, and investigate potential downstream access. Memory-resident threats such as PEERSTITCH require behavioral monitoring because traditional file-based detection may not identify their activity.

Organizations should prioritize timely vulnerability remediation, stronger privileged-access controls, improved visibility across endpoints and network infrastructure, and continuous threat hunting. Regular security assessments, monitoring of emerging attack techniques, and tested recovery procedures can help reduce the likelihood of compromise and limit the impact of successful attacks.

Outlook for the Months Ahead:

As 2026 draws to a close and organizations prepare for 2027, cyber threats are expected to remain a concern, particularly as attackers continue exploiting trusted infrastructure, legitimate administrative tools, and vulnerabilities in widely used software. The activity observed in October points to several trends that could shape the threat landscape in the coming months.

• Faster Exploitation of Critical Vulnerabilities: The PHP2Shell and Node2Shell vulnerabilities demonstrate how quickly attackers can move from public disclosure to active exploitation. As technical details and exploit tools become more accessible, unpatched PHP and Node.js environments, internet-facing applications, and vulnerable third-party components will likely remain attractive targets. Organizations may have increasingly limited time to identify and remediate critical vulnerabilities before exploitation begins.

• Continued Targeting of Network and Management Infrastructure: The ARMORY CASTLE and PEERSTITCH campaigns show how attackers can exploit remote-support tools and centralized firewall management systems to gain broader access. Administrative interfaces, exposed management services, and compromised credentials are likely to remain targets. Stealthy malware such as BPFDoor, AVERAT, and PEERSTITCH also demonstrates the difficulty of detecting threats that operate within network infrastructure without relying on conventional malicious files.

• Evolving State-Sponsored Espionage Operations: Lazarus-linked Operation FlashHole illustrates how state-sponsored attackers continue combining social engineering, DLL side-loading, memory-resident malware, and legitimate cloud services to maintain access while avoiding detection. Similarly, TRUST#GRAFT demonstrates how authenticated WordPress sessions can be abused for malicious purposes without directly exploiting authentication vulnerabilities. These techniques are likely to remain relevant in future espionage campaigns.

• Growing Use of AI in Cybercrime and Extortion: The n0n investigation suggests that financially motivated attackers are increasingly using AI-assisted tools to speed up malware development and automate parts of their operations. Credential theft, cloud data exfiltration, backup destruction, and multi-stage extortion are expected to remain common tactics. However, current findings point to AI supporting human-directed attacks rather than fully autonomous cyber operations.

• Greater Need for Behavioral Detection and Threat Hunting: Attackers continue to rely on legitimate tools, encrypted communications, fileless execution, and disguised network traffic to blend into normal operations. This makes traditional signature-based detection less reliable, particularly in cloud environments and privileged administrative sessions. Organizations will need stronger visibility across identity, endpoint, application, and network telemetry to identify suspicious behavior and investigate potential compromises.

Overall, October's findings suggest that rapid vulnerability patching, stronger access controls, continuous security monitoring, and proactive threat hunting will remain important priorities heading into 2027. Organizations should also review their exposure to critical infrastructure vulnerabilities, strengthen recovery capabilities, and regularly assess emerging attack techniques to reduce the likelihood and impact of future incidents.

For a full list of the search queries used on Autonomous Threat Sweeper for the threats detailed above, refer to ours Threat Labs home page. The page also references a list of relevant policies used by threat actors.  

We would like to hear from you. Please reach out to us at scia@securonix.com.  

Note: The TTPs when used in silo are prone to false positives and noise and should ideally be combined with other indicators mentioned. 

Contributors: Dheeraj Kumar