2026 First quarter attacker campaigns
Campaigns in this report
A visual roadmap of the operations examined in this quarterly review. Select any campaign to move directly to its technical analysis.
Quarterly Attack Trends Briefing
Between April and June 2026, the most consequential intrusions did not begin with an obviously malicious executable landing on an employee workstation. They began further upstream: at the firewall, VPN gateway, Exchange server, web application, CI/CD workflow or remote-management service that organizations already trusted. Once attackers controlled those systems, they inherited the reach and authority of the platform itself.
The quarter also showed how sharply intrusion timelines have compressed. Storm-1175 moved from exploitation to Medusa ransomware in days—and in some cases in less than 24 hours—while CL-STA-1132 converted a newly discovered PAN-OS weakness into root-level access, tunneling and identity-focused follow-on activity. At the same time, FIRESTARTER and ShadowPad demonstrated the opposite operational model: quiet, durable access engineered to survive routine administration and remain useful for long-term intelligence collection.
Another defining trend was the blending of exploitation with trusted identities and legitimate tooling. FortiBleed-style credential operations turned exposed appliances into reusable access inventories. Megalodon placed malicious logic inside GitHub Actions, where a workflow could inherit deployment secrets and publishing privileges. Ransomware operators continued to rely on familiar administration utilities, RMM software, cloud-transfer tools and vulnerable drivers, making behavioral context more valuable than simple tool blocking.
Taken together, these campaigns show an attacker ecosystem moving toward faster edge exploitation, deeper control-plane persistence, automated secret theft and more dependable paths to extortion. The technical chapters that follow trace how each operation progressed, which ATT&CK techniques were visible, what evidence defenders can hunt, and where intervention is most likely to break the chain.
Rapid ransomware intrusion
Storm-1175 and Medusa: speed as the weapon
A financially motivated actor repeatedly weaponized web-facing vulnerabilities, moved from exploit to extortion in days—and sometimes under 24 hours—and deployed Medusa ransomware.
Why Storm-1175 and Medusa matters
Microsoft tracks Storm-1175 as a high-velocity actor that rapidly rotates through newly disclosed N-days and has also used zero-days. Since 2023 it exploited more than 16 vulnerabilities across Exchange, PaperCut, Ivanti, ScreenConnect, TeamCity, SimpleHelp, CrushFTP, GoAnywhere, SmarterMail and BeyondTrust. The defensive problem is the compressed time between disclosure, exploitation, credential theft, exfiltration and ransomware. [secpod-storm]
Visual attack flow
Attack methodology and infection process
- Initial access. Exploit vulnerable public-facing applications. Microsoft observed rapid adoption of CVE-2026-23760, CVE-2026-1731 and multiple older enterprise flaws.
- Persistence. Create local or domain users and add them to privileged groups; deploy web shells or SimpleHelp for durable remote access.
- Credential access. Dump LSASS and domain material using Mimikatz/Impacket-style tooling.
- Lateral movement. Use PowerShell, PsExec, RDP, PDQ Deploy and RMM channels to reach servers and backup infrastructure.
- Collection and impact. Stage and exfiltrate data with Rclone, impair security controls, then distribute Medusa via administrative deployment mechanisms.
MITRE ATT&CK mapping
| Tactic | ID | Technique | Observed use |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | More than 16 exploited CVEs; rapid N-day/zero-day weaponization |
| Persistence | T1136.002 | Create Account: Domain Account | New privileged accounts after compromise |
| Execution | T1059.001 | PowerShell | Post-exploitation and lateral tooling |
| Credential Access | T1003.001 | LSASS Memory | Mimikatz/Impacket credential dumping |
| Lateral Movement | T1021.002 | SMB/Windows Admin Shares | PsExec and administrative deployment |
| Exfiltration | T1567.002 | Exfiltration to Cloud Storage | Rclone staging and transfer |
| Defense Evasion | T1562.001 | Impair Defenses | Security setting and protection changes |
| Impact | T1486 | Data Encrypted for Impact | Medusa ransomware |
Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.
Indicators of compromise and high-signal artifacts
| Type | Indicator | Why it matters |
|---|---|---|
| SHA-256 | 0cefeb6210b7103fd32b996beff518c9b6e1691a97bb1cda7f5fb57905c4be96 | Gaze.exe / Medusa |
| SHA-256 | 9632d7e4a87ec12fdd05ed3532f7564526016b78972b2cd49a610354d672523c | lsp.exe / Rclone; also used by other actors |
| IP | 185.135.86[.]149 | SimpleHelp C2 |
| IP | 134.195.91[.]224 | SimpleHelp C2 |
| IP | 85.155.186[.]121 | SimpleHelp C2 |
| Behavior | Privileged account creation + remote tool + Rclone within hours | High-signal sequence even when hashes change |
Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.
Campaign-specific detection and mitigation
- Prioritize exposed-system patches within hours when exploitation is reported; isolate if a fix is unavailable.
- Alert on account creation followed by Administrators/Domain Admins membership.
- Detect PsExec/PDQ/RMM deployment outside approved change windows.
- Block or tightly govern Rclone and investigate first-seen cloud destinations.
- Protect and separately monitor backup, virtualization and domain-control planes.
Edge-device espionage
UAT-4356 and FIRESTARTER: persistence inside Cisco LINA
A custom Linux ELF backdoor survives graceful reboots and software upgrades by manipulating Cisco Service Platform mount behavior and injecting an in-memory handler into LINA.
Why UAT-4356 and FIRESTARTER matters
Cisco Talos linked continued targeting of Firepower devices to UAT-4356, the actor associated with the ArcaneDoor campaign. The group exploited CVE-2025-20333 and CVE-2025-20362, deployed FIRESTARTER, and used it to execute arbitrary shellcode inside LINA. Its transient on-disk persistence survives graceful reboots and upgrades, while a true hard power cycle interrupts the runlevel-dependent restoration mechanism; compromised appliances should still be reimaged. [SecPod-blog]
Visual attack flow
Attack methodology and infection process
- Initial access. Exploit missing-authorization and buffer-overflow conditions on vulnerable Cisco devices.
- Boot-sequence persistence. Modify CSP_MOUNT_LIST so commands run during graceful reboot; copy the implant to a log-like backup path when runlevel 6 is detected.
- Self-restoration. Copy the ELF back to /usr/bin/lina_cs, execute it, then restore the original mount list and delete staging artifacts.
- In-memory execution. Locate executable libstdc++.so memory, stage shellcode, replace a LINA handler and parse specially prefixed WebVPN XML requests.
- Follow-on control. Execute arbitrary shellcode, including LINE VIPER capabilities, within the firewall data-plane process.
MITRE ATT&CK mapping
| Tactic | ID | Technique | Observed use |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | CVE-2025-20333 and CVE-2025-20362 |
| Persistence | T1547 | Boot or Logon Autostart Execution | CSP_MOUNT_LIST abuse during the appliance boot sequence; analyst-level parent mapping |
| Defense Evasion | T1036 | Masquerading | Implant stored as a log-like file |
| Defense Evasion | T1070.004 | File Deletion | Remove lina_cs and temporary mount-list copy |
| Privilege / Execution | T1055 | Process Injection | Unauthorized handler and shellcode inside LINA |
| Command and Control | T1105 | Ingress Tool Transfer | Shellcode delivered through crafted WebVPN request |
| Execution | T1059.004 | Unix Shell | Arbitrary shell commands on appliance |
Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.
Indicators of compromise and high-signal artifacts
| Type | Indicator | Why it matters |
|---|---|---|
| File path | /usr/bin/lina_cs | Observed FIRESTARTER filename; actor can rename it |
| File path | /opt/cisco/platform/logs/var/log/svc_samcore.log | Backup location used during graceful reboot |
| Artifact | CSP_MOUNT_LIST / CSP_MOUNTLIST.tmp | Boot persistence and temporary restoration artifacts |
| Process | lina_cs or anomalous executable mapped into LINA | Treat as confirmed compromise pending vendor validation |
| Network | WebVPN XML carrying custom prefix plus shellcode | Backdoor trigger pattern; requires device/network inspection |
| CVE | CVE-2025-20333; CVE-2025-20362 | Initial-access vulnerabilities |
Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.
Campaign-specific detection and mitigation
- Upgrade to Cisco-fixed releases and follow vendor compromise guidance; patching alone does not clean an implanted device.
- Open a Cisco TAC case for forensic acquisition and reimage confirmed devices from trusted media.
- Use a hard power cycle only as an emergency interruption, followed by reimaging and credential/certificate rotation.
- Hunt for lina_cs, altered CSP_MOUNT_LIST, svc_samcore.log anomalies and unexplained LINA memory behavior.
- Rotate administrative credentials, VPN secrets, certificates and private keys accessible from the device.
China-aligned cyberespionage
SHADOW-EARTH-053: ProxyLogon to GODZILLA and ShadowPad
A provisional China-aligned cluster exploited old Exchange/IIS flaws, maintained web-shell access, sideloaded ShadowPad through signed executables and collected high-value mailbox data.
Why SHADOW-EARTH-053 matters
Trend Micro observed SHADOW-EARTH-053 in at least eight countries. The actor repeatedly exploited long-patched Exchange/IIS vulnerabilities—especially ProxyLogon—then used GODZILLA web shells, registry-staged ShadowPad, legitimate signed loaders, WMIC, Sharp-SMBExec, Mimikatz and custom mailbox-export tools. Nearly half of targeted environments overlapped with SHADOW-EARTH-054, but available evidence suggested independent exploitation rather than coordinated operations. [SecPod-blog]
Visual attack flow
Attack methodology and infection process
- Initial access. Exploit CVE-2021-26855, -26857, -26858 and -27065 against exposed Exchange infrastructure.
- Web-shell persistence. Deploy .aspx or .ashx GODZILLA shells in aspnet_client or OWA auth directories.
- Discovery. Run nltest, nslookup, csvde, PowerView and a custom DomainMachines.exe directly under w3wp.exe.
- ShadowPad loading. Abuse legitimate signed executables for DLL sideloading; retrieve a machine-specific scode value from HKCU\Software\[ComputerName] and execute via EnumDesktopsA callback injection.
- Lateral movement. Use WMIC, Sharp-SMBExec, admin shares and copied web shells to expand across Exchange servers.
- Collection. Dump LSASS/SAM and DCSync material; export executive PST/mailbox data and stage password-protected RAR archives.
MITRE ATT&CK mapping
| Tactic | ID | Technique | Observed use |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | ProxyLogon and IIS N-days |
| Persistence | T1505.003 | Web Shell | GODZILLA .aspx/.ashx files |
| Defense Evasion | T1574.002 | DLL Side-Loading | Signed executables load malicious DLLs |
| Execution | T1106 | Native API | EnumDesktopsA callback injection |
| Discovery | T1087.002 | Domain Account Discovery | PowerView/csvde enumeration |
| Credential Access | T1003.001 | LSASS Memory | Evil-CreateDump and Mimikatz |
| Credential Access | T1003.006 | DCSync | newdcsync artifact |
| Lateral Movement | T1047 | WMI | WMIC backdoor/tool deployment |
| Collection | T1114.002 | Remote Email Collection | ExchangeExport/EWS and PST collection |
| Archive | T1560.001 | Archive via Utility | Password-protected RAR |
Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.
Indicators of compromise and high-signal artifacts
| Type | Indicator | Why it matters |
|---|---|---|
| Web-shell names | error.aspx; signout.aspx; warn.aspx; charcode.aspx; tunnel.ashx; i.aspx | Representative filenames; validate content and parent process |
| Web roots | ?:\inetpub\wwwroot\aspnet_client\system_web; ...\owa\auth | Repeated web-shell locations |
| Registry | HKCU\Software\[ComputerName] value scode | Registry-staged ShadowPad shellcode |
| Loader | CIATosBtKbd.exe + TosBtKbd.dll | Toshiba loader sideload chain |
| SHA-256 | 4264cfb3980a068ab36d842c7ee0942f40aaf308f31ed48b41e140e59885f5c8 | Legitimate vulnerable loader; hunt only with adjacent artifacts |
| SHA-256 | 8d9433e9734dd629d74abe41ff7024c84b3a28c45671df8f4baed344de733c78 | Legitimate xReport loader used in chain |
| Process chain | w3wp.exe → rundll32.exe / cmd.exe / PowerShell | Strong post-exploitation signal on Exchange |
Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.
Campaign-specific detection and mitigation
- Patch or retire legacy Exchange/IIS; validate ProxyLogon remediation and external exposure.
- Alert on w3wp.exe spawning shells, discovery tools, rundll32 or credential-dumping processes.
- File-integrity monitor Exchange web roots for new .aspx/.ashx content.
- Detect signed executables loading unexpected DLLs from writable directories and registry values named scode.
- Restrict EWS/mailbox-export rights and monitor bulk PST/RAR creation.
PAN-OS zero-day exploitation
CL-STA-1132: root RCE through the Captive Portal
A likely state-sponsored cluster exploited CVE-2026-0300, injected shellcode into nginx, stole identity context from the firewall and used intermittent SOCKS tunnels while destroying forensic evidence.
Why CL-STA-1132 matters
CVE-2026-0300 is a critical unauthenticated buffer overflow in the PAN-OS User-ID Authentication Portal. Exposure requires the portal plus a response-enabled interface reachable from untrusted traffic. CL-STA-1132 achieved root execution, cleared crash and nginx evidence, deployed EarthWorm and ReverseSocks5, enumerated Active Directory using credentials likely obtained from the firewall, and operated in short, low-noise sessions.
Visual attack flow
Attack methodology and infection process
- Exploit. Trigger an out-of-bounds write in the Captive Portal and gain root-level arbitrary code execution.
- Immediate cleanup. Clear crash kernel messages, nginx crash entries/records and core dumps.
- Tool deployment. Write tunneling binaries into /var/tmp and /tmp and run them with root privileges.
- Identity-driven discovery. Use firewall service-account credentials to enumerate domain root and DomainDnsZones.
- HA targeting. Flood SAML traffic to promote a second peer to Active, then exploit the newly exposed device.
- Low-noise persistence. Favor intermittent non-persistent tunnels and delete ptrace/SUID evidence rather than installing a durable branded implant.
MITRE ATT&CK mapping
| Tactic | ID | Technique | Observed use |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | CVE-2026-0300 |
| Execution | T1055 | Process Injection | Shellcode in nginx worker |
| Proxy | T1090.001 | Internal Proxy | EarthWorm / ReverseSocks5 SOCKS |
| C2 | T1572 | Protocol Tunneling | Multi-hop and reverse tunnels |
| Discovery | T1087.002 | Domain Account Discovery | AD enumeration with service account |
| Defense Evasion | T1070.002 | Clear Linux or Mac System Logs | Crash/nginx/audit cleanup |
| Defense Evasion | T1070.004 | File Deletion | Core dumps, tools and SUID artifact removed |
Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.
Indicators of compromise and high-signal artifacts
| Type | Indicator | Why it matters |
|---|---|---|
| IP | 67.206.213[.]86 | Observed attacker infrastructure |
| IP | 136.0.8[.]48 | Observed attacker infrastructure |
| IP | 146.70.100[.]69 | C2 staging; EarthWorm download host |
| URL | hxxp[:]//146.70.100[.]69:8000/php_sess | EarthWorm download |
| SHA-256 | e11f69b49b6f2e829454371c31ebf86893f82a042dae3f2faf63dcd84f97a584 | EarthWorm binary |
| Paths | /var/tmp/linuxap; /var/tmp/linuxda; /var/tmp/linuxupdate | Tunneling tools |
| Paths | /tmp/.c; /tmp/R5; /var/R5 | Python/ReverseSocks5 artifacts |
| User-Agent | Safari/532.31 Mozilla/5.5 ... Chrome/138 ... Edg/138 | Observed attacker string |
Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.
Campaign-specific detection and mitigation
- Upgrade to fixed PAN-OS versions and verify the exact product train against the vendor advisory.
- Disable User-ID Authentication Portal if unnecessary; otherwise restrict it to trusted internal zones and disable response pages on untrusted L3 interfaces.
- Enable Threat ID 510019 where supported and monitor portal exposure continuously.
- Preserve off-box logs; hunt for gaps or deletion in crash, nginx and audit telemetry.
- Rotate service-account credentials accessible to the firewall and investigate downstream AD queries.
CI/CD supply-chain compromise
Megalodon / TeamPCP: malicious workflows at repository scale
More than 5,500 repositories received automated commits that inserted or replaced GitHub Actions workflows, harvesting deployment secrets from privileged runners.
Why Megalodon / TeamPCP matters
The campaign described as Megalodon abused GitHub Actions rather than changing application code directly. Automated commits inserted Base64-encoded Bash into workflow files. One variant triggered on every push and pull request; another remained dormant until workflow_dispatch. The reporting associated the activity with TeamPCP and linked poisoned source to malicious npm publication, including Tiledesk. [secpod-mega]
Visual attack flow
Attack methodology and infection process
- Repository access. Use automated, throwaway accounts and maintenance-themed commit identities to push workflow changes.
- Workflow persistence. Add always-on triggers or dormant manual-dispatch backdoors.
- Runner execution. Decode Bash payloads inside GitHub-hosted or self-hosted runners.
- Credential theft. Harvest GitHub, AWS, Azure, GCP, Kubernetes, Vault, SSH and deployment secrets available to the job.
- Exfiltration. Send secrets to dedicated attacker infrastructure over an application-layer channel.
- Downstream compromise. Use stolen publishing access or poisoned source to publish malicious npm versions.
MITRE ATT&CK mapping
| Tactic | ID | Technique | Observed use |
|---|---|---|---|
| Initial Access | T1195.002 | Compromise Software Supply Chain | Malicious CI/CD workflow commits |
| Execution | T1059.004 | Unix Shell | Base64-decoded Bash in runners |
| Persistence | T1546 | Event Triggered Execution | push, pull_request and workflow_dispatch triggers |
| Credential Access | T1552.001 | Credentials In Files | Workflow secrets and environment material |
| Discovery | T1083 | File and Directory Discovery | Runner/repository enumeration |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | Secrets sent to attacker server |
| C2 | T1071.001 | Web Protocols | Application-layer transfer |
Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.
Indicators of compromise and high-signal artifacts
| Type | Indicator | Why it matters |
|---|---|---|
| IP | 216.126.225[.]129:8443 | Reported exfiltration/C2 endpoint |
| Path | .github/workflows/ | Unauthorized additions or replacements |
| Content | Base64-encoded Bash in YAML run steps | High-signal workflow artifact |
| Commit identities | build-bot; auto-ci; ci-bot; pipeline-bot | Reported suspicious authors; names are spoofable |
| Emails | build-system@noreply[.]dev; ci-bot@automated[.]dev | Reported commit identities |
| Behavior | New workflow trigger + secret enumeration + outbound 8443 | More durable than account-name matching |
Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.
Campaign-specific detection and mitigation
- Require CODEOWNERS and protected-branch approval for .github/workflows changes.
- Use read-only GITHUB_TOKEN by default; grant publishing and OIDC permissions only to dedicated jobs.
- Prevent pull requests or unknown forks from reaching privileged secrets/runners.
- Inspect workflow diffs for encoded shell, curl/wget, environment dumps and manual-dispatch backdoors.
- Rotate all secrets exposed to affected runners and review downstream registry/cloud audit logs.
VPN-to-ransomware intrusion
Qilin and CVE-2026-50751: authentication bypass plus EDR killing
A Check Point IKEv1 certificate-validation flaw enabled passwordless VPN sessions; Qilin-linked post-exploitation overlapped with Linux payload delivery and a sophisticated vulnerable-driver EDR killer.
Why Qilin and CVE-2026-50751 matters
Check Point confirmed exploitation of CVE-2026-50751 against Remote Access VPN and Mobile Access deployments using deprecated IKEv1. The flaw bypasses user authentication but still requires post-authentication work to reach internal resources or escalate. One observed case involved a Qilin affiliate. Separately, Talos analyzed Qilin’s msimg32.dll loader, which blinds telemetry and abuses the signed rwdrv.sys/ThrottleStop driver to terminate hundreds of EDR drivers. [SecPod-blog]
Visual attack flow
Attack methodology and infection process
- Perimeter entry. Exploit CVE-2026-50751 on affected Check Point configurations.
- Post-authentication expansion. Use the VPN foothold to discover internal resources and obtain higher privileges.
- Defense impairment. Run msimg32.dll, recover clean syscalls, suppress ETW-related visibility and use exception-driven obfuscation.
- BYOVD. Load renamed signed ThrottleStop.sys as rwdrv.sys and use physical-memory primitives for kernel manipulation.
- Impact. Deploy Windows or Linux Qilin ransomware and conduct double extortion.
MITRE ATT&CK mapping
| Tactic | ID | Technique | Observed use |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | VPN authentication bypass |
| Valid Session | T1078 | Valid Accounts / authenticated channel | Passwordless VPN session resembles legitimate remote access |
| Defense Evasion | T1562.001 | Impair Defenses | Terminate 300+ EDR drivers |
| Privilege / Kernel | T1068 | Exploitation for Privilege Escalation | Vulnerable signed driver primitives |
| Execution | T1129 | Shared Modules | Multi-stage malicious DLL chain |
| Lateral Movement | T1021 | Remote Services | Internal expansion after VPN access |
| Impact | T1486 | Data Encrypted for Impact | Qilin ransomware |
| Impact | T1490 | Inhibit System Recovery | Backup/recovery disruption common to Qilin operations |
Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.
Indicators of compromise and high-signal artifacts
| Type | Indicator | Why it matters |
|---|---|---|
| IP | 45.77.149[.]152 | Check Point observed infrastructure |
| IP | 209.182.225[.]136 | Check Point observed infrastructure |
| IP | 38.60.157[.]139 | Check Point observed infrastructure |
| IP | 162.33.177[.]101 | Check Point observed infrastructure |
| Filename | msimg32.dll | Qilin EDR-killer loader |
| Filename | rwdrv.sys | Renamed vulnerable ThrottleStop driver |
| Behavior | VPN session without expected authentication events | High-value gateway hunting sequence |
| Behavior | EDR health loss immediately after driver load | Defense-impairment indicator |
Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.
Campaign-specific detection and mitigation
- Patch affected Check Point gateways, disable deprecated IKEv1 and review configuration against sk185033.
- Hunt retrospectively from 7 May, not from public disclosure.
- Correlate gateway VPN session establishment with IdP/MFA records; investigate sessions lacking the normal sequence.
- Enable Microsoft vulnerable-driver protections and application control; alert on rwdrv.sys or equivalent hashes/renames.
- Isolate immediately when multiple EDR agents disappear or ETW telemetry drops after a driver load.
Ransomware ecosystem activity
INC / Lynx RaaS: scale, affiliate reuse and double extortion
The INC lineage expanded through displaced affiliates, opportunistic edge exploitation, credential abuse, cross-platform encryption and a mature leak-site pressure model.
Why INC / Lynx RaaS matters
SecPod’s June review described INC as one of 2026’s most active RaaS ecosystems, citing more than 830 claimed victims since emergence. The operation and related Lynx lineage use varied affiliate entry methods, including exposed services, valid credentials, phishing and exploitation of Citrix, Fortinet and SimpleHelp vulnerabilities. Because affiliates differ, behavior-based coverage is more reliable than a single universal IOC set. [secpod-inc]
Visual attack flow
Attack methodology and infection process
- Initial access. Use compromised credentials, RDP/VPN, phishing or CVEs such as CVE-2023-3519, CVE-2025-5777, CVE-2023-48788 and CVE-2024-57727.
- Reconnaissance. Identify domain controllers, backups, hypervisors, file servers and sensitive repositories.
- Credential access. Dump LSASS, SAM and service/backup credentials with affiliate-selected tooling.
- Movement and persistence. Use RDP, PowerShell, PsExec, WMI and commercial remote tools.
- Exfiltration. Stage financial, customer, employee and intellectual-property data to cloud or attacker infrastructure.
- Impact. Delete recovery material, encrypt Windows/Linux/virtualization assets, append .INC and drop INC-README notes.
MITRE ATT&CK mapping
| Tactic | ID | Technique | Observed use |
|---|---|---|---|
| Initial Access | T1078 | Valid Accounts | VPN/RDP and compromised credentials |
| Initial Access | T1190 | Exploit Public-Facing Application | Citrix, Fortinet, SimpleHelp flaws |
| Execution | T1059 | Command and Scripting Interpreter | PowerShell/cmd/shell |
| Persistence | T1098 | Account Manipulation | Affiliate persistence |
| Credential Access | T1003 | OS Credential Dumping | LSASS/SAM/domain material |
| Discovery | T1018 | Remote System Discovery | Network/AD inventory |
| Lateral Movement | T1021 | Remote Services | RDP, SMB, WMI/PsExec |
| Exfiltration | T1567.002 | Cloud Storage | Rclone/MEGA/Restic |
| Impact | T1490 | Inhibit System Recovery | Shadow-copy and backup disruption |
| Impact | T1486 | Data Encrypted for Impact | .INC encryption |
Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.
Indicators of compromise and high-signal artifacts
| Type | Indicator | Why it matters |
|---|---|---|
| Extension | .INC | Encrypted files in INC variants |
| Ransom notes | INC-README.txt; INC-README.html | Common INC note names |
| Lynx note | README.txt | Related Lynx lineage |
| SHA-256 | 64b249eb3ab5993e7bcf5c0130e5f31cbd79dabdcad97268042780726e68533f | Published INC sample |
| Behavior | Rclone/MEGASync/Restic + include list + large outbound transfer | Pre-encryption exfiltration pattern |
| Behavior | vssadmin/WMIC shadow-copy deletion before mass writes | Impact-stage indicator |
Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.
Campaign-specific detection and mitigation
- Patch internet-facing Citrix, Fortinet and SimpleHelp systems and remove obsolete remote interfaces.
- Require MFA for VPN/RDP/RMM and block unmanaged remote tools.
- Monitor abnormal LSASS access, DCSync, PsExec service creation and backup-console logins.
- Alert on Rclone/MEGA/Restic from servers and on shadow-copy deletion.
- Maintain immutable backups with separate identity and test bare-metal/virtualization recovery.
Credential compromise campaign
FortiBleed: valid credentials as a self-reinforcing attack engine
Internet-wide spraying, configuration theft, offline cracking and credential reuse turned edge-device access into an expanding targeting database rather than a single-CVE exploit wave.
Why FortiBleed matters
Unit 42 independently observed large-scale password spraying against Fortinet devices and MSSQL, with reports involving Sophos. It described a multi-stage loop of spraying, configuration extraction, optional privilege escalation and offline cracking; it did not validate an initial-access broker’s claimed CVE. SecPod reported approximately 73,000 firewall records, while SOCRadar later reported 86,644 working credentials and attributed the operation to Lynx/INC. These figures reflect evolving datasets and vendor methodology, not one immutable count. [secpod-forti]
Visual attack flow
Attack methodology and infection process
- Reconnaissance. Identify exposed FortiGate management and SSL VPN interfaces on 443 and common alternate ports.
- Initial access. Use credentials from previous breaches, infostealers and historic Fortinet leaks rather than depending on a new zero-day.
- Configuration theft. With sufficient rights, export appliance configuration and encrypted credential material.
- Offline cracking. Use Hashcat/Hashtopolis-style infrastructure to recover plaintext without generating victim-side password-guess logs.
- Expansion. Reuse recovered credentials across devices and organizations, creating a positive feedback loop.
- Monetization. Offer high-privilege access to brokers or ransomware affiliates; attribution remains a vendor assessment.
MITRE ATT&CK mapping
| Tactic | ID | Technique | Observed use |
|---|---|---|---|
| Credential Access | T1110.003 | Password Spraying | Curated internet-wide attempts |
| Initial Access | T1078 | Valid Accounts | Successful appliance/VPN logins |
| Credential Access | T1552.001 | Credentials In Files | Configuration export and stored material |
| Persistence | T1098 | Account Manipulation | New administrator accounts/policy changes |
| Discovery | T1049 | System Network Connections Discovery | Appliance and VPN context |
| Collection | T1005 | Data from Local System | Device configuration collection |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | Exported configs/credentials |
| Defense Evasion | T1562.001 | Impair Defenses | Logging/authentication configuration changes |
Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.
Indicators of compromise and high-signal artifacts
| Type | Indicator | Why it matters |
|---|---|---|
| Behavior | Successful admin login immediately after high-volume failures | Core spray-to-access sequence |
| Audit event | Configuration export to unfamiliar destination | Credential-harvesting precursor |
| Account | New super_admin or altered trusted-host setting | Potential persistence |
| Network | Persistent outbound tunnel from firewall | Follow-on control channel |
| Tooling | Hashcat; Hashtopolis; CyberStrike; passive VPN sniffer | Reported attacker-side components; not malicious by themselves |
| Dataset caveat | ~73,000 SecPod records; 86,644 SOCRadar credentials | Evolving datasets—validate organization-specific exposure |
Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.
Campaign-specific detection and mitigation
- Remove management interfaces from the public internet; use allow-listed bastions.
- Rotate all administrator and VPN credentials and enforce MFA.
- After FortiOS upgrades, verify stronger password rehashing and remove retained weak hashes per vendor guidance.
- Review new accounts, trusted hosts, logging, authentication policy, config exports and unusual geo/ASN access.
- Treat verified inclusion in the leaked dataset as a compromise and perform full appliance incident response.
Post-quarter technical appendix
JADEPUFFER: autonomous database extortion as the reference format
Included because you supplied it as the desired structural model. Sysdig disclosed the research on 1 July 2026, so it is not counted as an April–June disclosure.
Why JADEPUFFER matters
Sysdig assessed JADEPUFFER as the first documented end-to-end agentic ransomware operation. The agent delivered Base64 Python through Langflow’s unauthenticated code-validation endpoint, searched for AI/cloud/database secrets, pivoted to a production database, self-corrected failed steps within seconds, encrypted 1,342 Nacos configuration items, dropped original tables and created a ransom table. Sysdig could not independently verify the agent’s exfiltration claim, and the generated AES key was not preserved—meaning payment could not restore the data. [SecPod-blog]
Visual attack flow
Attack methodology and infection process
- Langflow compromise. Abuse the missing-authentication code-validation endpoint for arbitrary Python.
- Parallel secret search. Enumerate OpenAI/Anthropic/DeepSeek/Gemini keys, cloud credentials, wallets and database files.
- Internal discovery. Probe MinIO, Nacos, secret stores and databases; adapt parsing and authentication logic when attempts fail.
- Persistence. Install a 30-minute cron beacon to the source/C2 address.
- Database extortion. Use AES_ENCRYPT() to copy encrypted configuration content, delete originals/history and create README_RANSOM.
- Destruction. Disable foreign-key checks when necessary and drop high-value schemas; the asserted staging/exfiltration was not independently proven.
MITRE ATT&CK mapping
| Tactic | ID | Technique | Observed use |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | CVE-2025-3248 |
| Execution | T1059.006 | Python | Base64 Python payloads |
| Discovery | T1082 | System Information Discovery | id, uname, hostname, processes |
| Credential Access | T1552.001 | Credentials In Files | Environment/config secret sweep |
| Discovery | T1046 | Network Service Discovery | Internal service probing |
| Persistence | T1053.003 | Cron | 30-minute beacon |
| Collection | T1005 | Data from Local System | Langflow database/configuration data |
| Impact | T1485 | Data Destruction | DROP TABLE / DROP DATABASE |
| Impact | T1486 | Data Encrypted for Impact | Nacos configuration encryption |
Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.
Indicators of compromise and high-signal artifacts
| Type | Indicator | Why it matters |
|---|---|---|
| IP | 45.131.66[.]106 | Initial access/C2; cron beacon on port 4444 |
| IP | 64.20.53[.]230 | Claimed staging server; exfiltration not independently observed |
| CVE | CVE-2025-3248 | Langflow unauthenticated RCE |
| Cron | */30 * * * * ... 45.131.66[.]106:4444/beacon | Persistence behavior |
| Table | README_RANSOM | Database ransom artifact |
| e78393397[@]proton[.]me | Ransom contact |
Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.
Campaign-specific detection and mitigation
- Patch Langflow and never expose code-validation endpoints publicly.
- Keep LLM/cloud provider keys out of Langflow process environments.
- Restrict database admin ports and prohibit root access from application subnets.
- Harden Nacos, change default signing keys and remove database root privileges.
- Detect Python spawned by Langflow, cron modifications and destructive SQL from application hosts.
Consolidated defense
Mitigations across all campaigns
These controls are ordered around the recurring attack surfaces visible across the campaigns: exposed edge systems, identity and secrets, privileged automation, incomplete telemetry, and weak recovery assurance.
Shrink the external attack surface
- Inventory every internet-facing firewall, VPN, Exchange/IIS server, MFT application, AI workflow server and OT endpoint.
- Disable unused portals and services; restrict management and authentication interfaces to trusted networks.
- Apply emergency patch SLAs based on exposure and exploitation, not CVSS alone.
Protect identities and secrets
- Require phishing-resistant MFA for remote access and privileged administration.
- Keep CI/CD, cloud and LLM-provider secrets out of web-reachable process environments.
- After device or pipeline compromise, rotate downstream credentials—not only the first observed token.
Control privileged automation
- Use least-privilege GitHub Actions permissions, protected workflow files, approval gates and immutable action pins.
- Block untrusted fork code from privileged runners and publishing identities.
- Alert on large package-size changes, new workflow triggers and Base64 shell payloads.
Detect defense impairment
- Alert on EDR/ETW gaps, log deletion, crash-record cleanup, audit-policy changes and vulnerable-driver loads.
- Forward edge-device, firewall, VPN, OT and CI logs off-device to immutable storage.
- Treat sudden telemetry loss as an incident signal, not an agent-health ticket.
Prepare for destructive impact
- Maintain offline, immutable backups and test restoration of AD, appliance configurations, PLC logic and critical databases.
- Segment management, backup and virtualization infrastructure from user networks.
- Exercise a response scenario where a valid login or signed build is malicious.
