2026 Second quarter attacker campaigns

Visual attack flow

Attack methodology and infection process

1. Initial access. Phishing messages posed as students seeking internships or as outreach about the AAS-in-Asia 2026 conference, sometimes after rapport-building exchanges. Victims saw a loading page for several seconds and were then redirected to a legitimate site such as github.com or asianstudies.org.
2. Browser exploitation. An orchestration script (driver-html.js) runs as a worker and controls retries and the follow-on download. The TurboFan bug, triggered by mutating an array mid-sort, yields addrof/fakeobj primitives and arbitrary read/write inside the V8 cage; the WebAssembly corruption then runs shellcode outside the sandbox.
3. Windows escalation. A reflectively loaded DLL collects the Windows build, token integrity level and kernelbase.dll version. Only Windows 10 1809 through 22H2, Server 2019, Server 2022 and Windows 11 21H2 proceed to the LPE DLL, which obtains kernel read/write and enables SeDebugPrivilege.
4. Payload launch. Injector shellcode writes a CreateProcess stub into the parent Chrome broker process and runs a curl command that saves msgbox.exe or ChromeUpdate.exe to %TEMP% and executes it.
5. Extension install. The installer extracts the extension to C:\Users\Public\stomp_ext, closes Chrome, Edge, Brave and Vivaldi, recomputes the Secure Preferences HMACs and super_mac, and relaunches the browser with --restore-last-session.
6. GemStone surveillance. The extension registers with a Cloudflare Workers C&C, polls for commands every 30 seconds or 60 minutes, and can inject a keylogger, capture cookies and storage, take screenshots and issue arbitrary HTTP requests from the browser context.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. Target verification. Servers typically receive five to 15 POST requests to /%50SEMHUB/hub carrying a serialized Java object. Unpatched servers answer with the host operating system without writing files, which lets the actor confirm exploitability quietly.
2. WAF bypass. %50 is the encoded form of P. WAF and proxy rules that match /PSEMHUB before decoding miss the request, while WebLogic decodes the path and serves the vulnerable servlet.
3. Exploitation. Two methods were seen: a burst of requests followed by x.jsp or sequentially numbered JSP files in PSEMHUB.war (the repetition likely ensures every node behind a load balancer gets a copy), and fileless execution where command output returns in the HTTP response.
4. Post-exploitation tooling. x.jsp accepts hex-encoded commands and detects the operating system; u.jsp and u2.jsp write 150 KB Base64 chunks. On Windows, Ple64.exe masquerades as a signed Light Alloy installer, unpacks a VMProtect-protected launcher and loads SIDEEYE, which talks to its C2 over raw TCP ports 3333 and 3334. Neo-reGeorg tunnel.jsp and tunnel.jspx provide SOCKS5 over HTTP(S).
5. Persistence and access. On Linux, UNC6240 deployed MeshAgent and used IT-themed infrastructure (winmanage-me[.]network). A quarter of observed commands ran as root or NT AUTHORITY\SYSTEM; the rest ran as PeopleSoft or WebLogic service accounts, which still expose configuration files and database connection strings.
6. Collection and extortion. Defenders should look for large tar, tar.gz or zstd archives, and for rsync, sshpass or curl launched by the WebLogic service account, ahead of extortion contact.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. Initial access. In most incidents the operators connected to corporate VPNs with compromised valid credentials, routing through Cloudflare WARP-linked Russian addresses and European virtual infrastructure providers.
2. GhostContainer on Exchange. The backdoor is a .NET assembly that incorporates the Neo-reGeorg tunnel, a CVE-2020-0688 exploit and the GhostWebShell class from ysoserial. Analysts assess with high confidence that it was delivered by extracting Exchange cryptographic keys from the ASP.NET configuration, overwriting the VIEWSTATE parameter and injecting a payload that starts the backdoor in memory. C2 commands arrive in x-owa-urlpostdata headers, and the code overwrites addresses in amsi.dll and ntdll.dll to evade AMSI and event logging.
3. Tool staging. Archives were hosted in GitHub repositories such as mirror-js/mirror-js and browserthemes/resourcepack, and the executables inside mimic Adobe, TrueConf and 1C software.
4. Tunneling. Microsoft dev tunnels published port 3389 on *.devtunnels.ms, rdp2tcp carried TCP traffic over established RDP sessions, and Impacket atexec created scheduled tasks that ran netsh interface portproxy rules.
5. Active Directory compromise. In one incident BlueKeep (CVE-2019-0708) created a local account that was added to Administrators and Remote Desktop Users. The operators also requested Kerberos tickets with Forwardable, Proxiable and Renewable flags and attempted DCSync to impersonate a domain controller.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. Vulnerability. The diffpatch endpoint runs git apply with three-way merge fallback inside a bare temporary clone. Submitting the same patch twice forces a checkout to disk, so a file written to hooks/post-index-change executes as the Gitea service account. Open registration, enabled by default, removes the need for prior credentials. Affected versions are 1.17 through 1.27.0.
2. Targeting. Targets were classified with Simplified Chinese sector labels (defense, elections, energy, aerospace, telecom, government, research); 128 had open signup, and a separate list held 477 Taiwanese instances.
3. Exploitation and theft. The framework registers accounts with a word_word_NNN pattern, exploits each server, dumps the filesystem and repositories with --dump-fs, and attempts to remove its traces from the Gitea database. Hashcat was used on stolen bcrypt hashes.
4. Persistence. SSH keys named like victim-backdoor and root-shell were planted, a raw TCP backdoor accepted key:command input, and one victim was accessed through the Gitea metrics API.
5. Virtualization takeover. On a Taiwanese Synology NAS the actor obtained a Proxmox root@pam ticket, uploaded payloads to three nodes and launched vzdump backups, which could have exposed full VM disk images.
6. Implant and rootkit. JITTERLY, a C++ implant compatible with the Adaptix C2 protocol, supports more than 30 commands. SIXZUT drops libglthread.so.2, writes it to LD_PRELOAD, hides files, processes and connections, blocks kill signals and relaunches the implant.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. UNK_LateNight (from 2 September). RFQ-themed emails aimed at US aerospace and defense companies linked to domains spoofing aerospace firms. The loader dropped a DLL-sideloading pair plus an AES-encrypted TMP file, injected ShadowPad into targets such as wmpnetwk.exe, and created the scheduled task EdgeCore_AutoUpdate. ShadowPad unhooks 20 network-monitoring functions and beacons to ms.checrity[.]com.
2. UNK_DoubleCheck (from 2 September). Emails from a compromised Southeast Asian government address, themed around vaccination appointments, hit a Vietnamese manufacturer. The only obfuscated BlueMoon variant used curl to fetch wint.exe, calibre-launcher.dll and an RC4-encrypted SysPr.prx, which loads a Rust executable that pulls a second stage from a Cloudflare R2 bucket and uses fracons[.]com for C&C.
3. UNK_QuietRacket (from 3 September). Indonesian conference lures (Indo Startup Expo & Forum 2026 and WCCE 2026) targeted government, consulting and finance organizations in Indonesia and Singapore. A modified injector fetched GfExperienceService64.exe and GFExperienceUpdate.dll, which resolve C&C by decrypting Google DoH TXT records and then use Cloudflare Workers.
4. Shared pattern. All builds share the exploit chain and the loader structure (p1 reconnaissance DLL, p2 LPE DLL, pp injector shellcode), and the default process tree is chrome.exe, cmd.exe, curl.exe, then the payload.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. Discovery. Scanners test the batch route in three forms: /wp-json/batch/v1, /index.php?rest_route=/batch/v1 and /?rest_route=/batch/v1, which work when pretty permalinks are off.
2. Route confusion. An outer batch request wraps an inner batch with malformed sub-request paths; a parse failure shifts indexes between the validation and match arrays so the dispatcher reaches handlers it should not.
3. SQL injection. The posts endpoint maps author_exclude to WP_Query's author__not_in argument, which is not sanitized enough. Detection should key on author_exclude, the name visible in HTTP traffic.
4. Escalation (public PoCs). Public tools use the injection to forge cache objects and a changeset that creates an administrator, then upload a plugin to run commands. Observed in-the-wild activity so far is dominated by scanning and injection attempts.
5. Post-exploitation. Defenders should look for unexpected administrators, new files in wp-content/plugins/ and wp-content/cache/, and commands launched by the web server process.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. Discovery. Attackers identify internet-facing Windchill and FlexPLM servers and use reconnaissance against the FlexPLM WSDL functionality.
2. Exploitation. Unsafe processing of attacker-controlled serialized data gives unauthenticated code execution; the flaw has been paired with a pre-authentication information disclosure on the FlexPLM WSDL endpoint.
3. Web shells. JSP files appear in /Windchill/login/ with 16-character or six-character hexadecimal names, and a dpr_ variant with eight hex characters.
4. Implant capability. Reporting describes a custom implant that can decrypt credentials in the Windchill keystore, enumerate connected file repositories and pull data in bulk, rather than a simple command shell.
5. Theft. Operators list files, stage selected data and exfiltrate it; some victims claim multi-terabyte theft.
6. Extortion. Emails come from compromised accounts, include Cl0p contact details and name Windchill PDMLink. The leak site began naming victims in August; no file encryption was used.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. Tunnel. Requests to /wsproxy with the right user-agent and bmID return HTTP 101 and open WebSockets to EPMD (1051), CouchDB (1050) and the control service (8188) without a session cookie.
2. Root. The actor used CouchDB's built-in admin:admin credentials to stage a script that reads the appliance UUID, then traversed out of the rollback directory (../../../../../tmp/1234.sh) to execute it as root.
3. Implants. ROOTRUN (/usr/bin/xzfind) is a setuid root command runner. KNUCKLEBALL (deploy_new.py) injects two JARs into workplace.startup.CommandStartup using the Java Attach API and is made persistent through init.d.
4. Java agents. Suo5 is an HTTP proxy tool; ORANGETAIL is a Behinder-style webshell with a hardcoded AES key. Both only answer a specific fake user-agent, so passive scans see 404s.
5. Credential theft and pivoting. On the second appliance, tcpdump scripts captured LDAP on TCP 389; the actor leaked hostnames including DESKTOP-5P0TSCP and KALI. A reboot on 2 July removed memory-resident implants there.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. Initial access. Valid VPN credentials (including Cisco AnyConnect logins from hosting ASNs) or CitrixBleed 2. In the example log, the session's Source IP (45.227.254[.]25) differed from the original broadband Client_ip.
2. Lateral movement. RDP between VPN client ranges and servers that normally get no interactive logons, Hyper-V servers used as jump hosts, and PsExec service creation (PSEXESVC.exe).
3. RMM abuse. ScreenConnect from lookalike azuremicrosoft[.]us, Zoho Assist agents under the ZohoMeeting path, MeshAgent (mvtcs.exe, sysagent.exe, MeshUserTask), Remotely, UltraVNC and Total Software Deployment.
4. Credential access. Mimikatz in Public and temp folders, Chrome and Edge password exports, and an ntds.dit copy followed within an hour by encryption in one case.
5. Tunneling and exfiltration. cloudflared on Synology NAS and Windows servers, an authenticated proxy, ssh -D SOCKS proxies, and S3 Browser, rclone, s5cmd, WinSCP and PuTTY.
6. Impact. Defender disablement, SophosUninstall, PCHunter and log clearing preceded encryption. Anubis writes .anubis files and RESTORE FILES.html on Windows and Linux.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. Infection paths. Weak or default Telnet and SSH passwords, exposed ADB, and RCE in routers, DVRs and cameras, plus web and enterprise components such as ThinkPHP, Jenkins and YARN.
2. Two-stage loading. The loader appends compressed core data and config to an ELF. Variants moved from LCG with XOR and LZ4, to Xoshiro128 with BLZ, to standard XOR with a fixed magic string, to ChaCha20.
3. Anti-analysis. The core scores process lists (Wireshark, gdb, frida), TracerPid, injected libraries, an appended SHA-256 checksum, Cowrie and Dionaea files, sandbox environment variables, a connect test to 192.0.2.1, dual-clock sleep timing and VM hardware or MAC prefixes; high scores trigger cleanup and exit.
4. C2 protocol. Handshake with Curve25519 and HKDF-SHA256, ChaCha20-Poly1305 for authentication, then AES-GCM with separate uplink and downlink keys; command traffic carries a three-byte header resembling TLS records.
5. Commands. Attack (types 3 and 8), stop (9), update (10), status (11) and C2 update (14), so operators can rotate infrastructure without losing bots.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.

Visual attack flow

Attack methodology and infection process

1. Scanning. masscan swept Russian address space and then the full IPv4 range on port 37777, skipping blocks outside local business hours.
2. Brute force. The Easy4IP engine scaled from 300 to 4,000 workers, abandoned hosts after five failures to preserve them for a later CVE pass, captured filtered snapshots and exported results for SMART PSS (13,229 records, 52 XML files).
3. Bypass chain. p2pwn exploits NetKeyboard trust (CVE-2021-33044) and a loopback source-address spoof (CVE-2021-33045), then installs the backdoor account over RPC; it survives password changes and, on most firmware, a factory reset.
4. P2P relay. Fixed SDK credentials in every Dahua client authenticate to the relay, and a serial number is enough to reach management ports; control still needs credentials or a bypass.
5. Transferable access. Offline recovery-code generation and SMART PSS exports led Hunt.io to assess, with moderate confidence, that the toolkit was built to hand access to a third party.
6. Separate capability. A UPX-packed Windows binary (SalatStealer-tagged) and a Defender exclusion script on the same host should be treated as a distinct incident.

MITRE ATT&CK mapping

Technique mappings are based on reported behavior; they are not a claim that every affiliate or victim exhibited every technique.

Indicators of compromise and high-signal artifacts

Note: Defang network indicators before operational use. Validate age, ownership and local context; do not block shared infrastructure solely by hostname.