Kategorie

N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. [...]

Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. [...]

Elections have consequences — and big elections have big consequences. Few have been bigger than last week’s US midterms, featuring a Blue Tsunami that swept aside Republican control of Congress and signaled the end of Trumpism.

Those consequences will especially be felt by Big Tech and Big AI. Voters made it clear that they don’t want data centers in their backyards. They voted for candidates who vowed to rein in AI, and those who promised to investigate the cozy relationship between tech companies and President Trump. And they voted for candidates who promised to put an end to rampant government corruption tied to tech billionaires.

Microsoft didn’t go all-in on Trump as so many Big Tech firms did. The company held fast to core values like diversity, equity, and inclusion in its hiring and employment practices. Microsoft CEO Satya Nadella didn’t attend Trump’s inauguration as other tech CEOs including Meta’s Mark Zuckerberg, Amazon’s Jeff Bezos, Google’s Sundar Pichai, and Tesla and SpaceX CEO Elon Musk did. He didn’t fawn over Trump like Apple’s Tim Cook, who gave Trump a 24-carat gold plaque and attended the gala White House screening of the Amazon-funded Melania documentary held on the day US Immigration and Custom Enforcement (ICE) agents murdered Alex Pretti in Minnesota.

Microsoft even fired its law firm because the firm agreed to provide Trump with $125 million in pro bono work, replacing it with a firm that sued Trump.

But in other ways, Microsoft has played nice with the Trump administration, including donating millions of dollars for his White House ballroom project.

So Microsoft is no more protected than other tech companies against what comes next under the Democratic Congress. In this column I’ll look at the potential bad news for the company. In the next I’ll look at how Microsoft might benefit from the election.

Investigate, investigate, investigate

The voting was barely over when top Democratics made clear that one of their first orders of business would be investigations and public hearings into Big Tech and Big AI. Microsoft will be among the companies investigated.

Two days after election day, Senator Richard Blumenthal demanded that the FCC and tech companies including Microsoft, Apple, Meta, Google, Nvidia, Amazon and others turn over documents related to the companies’ donations to Trump for his new ballroom. That’s part of an investigation that will look into conflicts of interest and quid pro quos. The Washington Post reported that Microsoft donated $10 million to the project.

If the companies didn’t turn over the documents, Blumenthal warned, they’d face subpoenas when he becomes chair of the Permanent Subcommittee on Investigations when the new Congress convenes in January.

That’s only the first investigation of many to come. Senator Ed Markey, who has locked horns with Microsoft and other tech firms in the past, posted on X on election night: “They are going to need to plant new forests for all of the subpoenas we’ll be printing.”

No free ride for data centers

One of the midterm election’s biggest issues was the data centers Microsoft and other AI giants have been building. Critics say the centers increase electricity costs, and that residents are subsidizing tech companies by bearing those higher costs. “Data centers raised wholesale [electricity] prices by 6.9 percent nationally by 2025,” the Federal Reserve Bank of Dallas reported.

Critics also complain of data centers’ water use, noise level, pollution, and taking away both open space and local control from communities.

Forty out of 41 local ballot initiatives against the centers won. Democratic governors, senators, and state officials promised crackdowns. Darrell West, a senior fellow at the Brookings Institution, a think tank, told the New York Times, “Expect a tsunami of new rules and oversight.”

That’s bad news for Microsoft. The company has already said that it can’t build data centers fast enough to meet demand for its AI services. Microsoft CFO Amy Hood said on the company’s Q1 2026 earnings call that Microsoft can’t keep up with demand for Azure AI services, because it doesn’t don’t have enough computing power.

With so many local, state, and federal officials pledging during the election to crack down on data centers, Microsoft should expect it to become more difficult to build them.

AI under the microscope

Trump and Republican officials have been all-in on AI and against any government oversight. They’ve been big cheerleaders for the technology and fought hard to make sure AI development remains unfettered. Trump even signed an executive order blocking states from regulating AI.

With a Democratic Congress, and with many statehouses across the country now controlled by Democrats, expect big pushback against that order, along with plenty of attempts to rein in AI.

The Hill reports, “Democrats are making commitments to make artificial intelligence regulation and the investigation of companies a key priority as they prepare to take control of the House and Senate after Tuesday night’s election sweep.”

That regulation will cover everything from AI-related job losses and AI safety problems to protecting intellectual property from being hoovered up for free by AI companies to train AI models.

All that means Microsoft, like other AI companies, may not be able to operate freely anymore. There may be slowdowns in AI development, rules about AI safety, and more.  

The bigger the AI company, the more they’ll feel the impact. Microsoft is one of the biggest, so it’ll feel a lot of pain.

ICED out

One of the more surprising results of the midterms was how many people across the political spectrum, from conservatives to progressives, cited ICE as being out of control and want it held accountable.

Peter Polos, a 73-year-old New Jersey physician, summed it up this way for the New York Times: “Saying he was going to secure the border is one of the reasons Trump got elected. But he didn’t say he was going to secure the border by knocking people down in the street, throwing them in a car, and taking them away.”

Under Trump, ICE’s budget has skyrocketed: a baseline budget of $10 billion, pumped up by a $75 billion supplement in 2025. (By way of contrast, the Justice Department, which includes the FBI, has a $35 billion budget.)

Microsoft has been one of the recipients of the ICE spending spree. An investigation by The Guardian and its partners +972 Magazine and Local Call found that ICE stores vast amounts of data on Microsoft’s Azure cloud storage and uses Microsoft AI tools to analyze it. It also found that ICE uses Microsoft productivity tools and might be running its own tools and systems on Microsoft servers.  

The Democratic Congress will certainly slash ICE’s budget. Microsoft may lose a significant revenue stream.

The upshot

The midterm election wasn’t just a reckoning for Trump, Republicans, and MAGA supporters. It’s one for Microsoft and Big Tech as well. Microsoft will soon be facing a landscape of much more government oversight, the end of AI’s free ride, and maybe reduced revenue.

The election wasn’t all bad news for the company, though. There’s some good news as well. I’ll be writing about that in my next column.

Related: Midterm results will raise AI costs and compliance questions for IT leaders

Adobe will open its Creative Cloud applications to third-party AI assistants, with the ability to edit content in Photoshop, After Effects, Illustrator, and Premiere from tools such as ChatGPT or Claude, the company announced at its Max event.

The model context protocol (MCP) integration, due in private beta in early 2027, would let third-party AI assistants to make changes to content in Creative Cloud desktop applications, without losing the ability to adjust individual elements of a design or video manually afterwards.

For example, a third-party AI assistant could remove a logo from multiple advertising campaign assets. “Make the change once, then ask your agent to cascade it across the rest of the campaign, and step in at any moment to refine the work by hand,” said Deepa Subramaniam, Adobe’s VP, product marketing for Creative Cloud, in a blog post Tuesday.

Third-party agents could also connect to other apps in a single workflow, so it would be possible to “pull in a project brief from Google Docs, work on it in Adobe’s tools and share the result with your team via Slack,” for example, Subramaniam said.

The MCP connections can help creative professionals “keep their work where they choose to work, without sacrificing the upside of modern collaborative and secure systems,” said Liz Miller, vice president and principal analyst at Constellation Research. “End users … have always relied on multiple tools to capture their taste and bring it to life. For them, these connections are another tool that opens up access to so much more of their toolkit.”

Keith Kirkpatrick, vice president of research at The Futurum Group, also anticipates demand from Adobe users to access Creative Cloud apps via third-party AI assistants, though he expects it will appeal most to a “fairly specific crowd” of “creative technologists, production teams, and power users who already spend their day in Claude or ChatGPT and want an agent to take care of the tedious stuff: organizing assets, setting up layers, building out sequences.”

“Most creative pros are still going to want their hands in the application,” he said.

Opening access to Creative Cloud apps via third-party agents could potentially loosen the direct relationship Adobe has with customers — a scenario that many software vendors are now grappling with.

For Adobe, it’s a necessary adaptation, as employees increase their use of AI assistants to get work done. “Companies are using several AI models at once, and people are starting more of their work inside these assistants,” said Kirkpatrick. “If that’s where the request starts, Adobe wants to be the one doing the work behind it.”

Gartner predicts that enterprise AI assistants will account for more of knowledge workers’ daily interaction time than any other application within the next three years, according to a recent Magic Quadrant report.

Miller said that opening its applications to third-party tools could be beneficial for Adobe’s business. “This won’t negatively impact Adobe’s place with their core creative, marketing, or business users,” she said.

“In fact, the flexibility will give their customers options in where and how to get work done. “For users who have found their flow and patterns of work in ChatGPT or Claude, [they can] stay there but still access the skills and tools you need to use to generate the quality of work expected,” Miller said.

The MCP integration in Creative Cloud is the latest part of Adobe’s strategy to embrace third-party AI assistants — Adobe has previously announced ChatGPT, Claude, and Google Gemini integrations that provide limited editing capabilities for apps such as Acrobat, Photoshop, Premiere, Express, and Lightroom, directly within the AI assistants. This contrasts with the new MCP integrations that let AI assistants make changes directly to content in Adobe’s desktop applications.

“The real question is whether any of this turns into paying Adobe customers, and Adobe hasn’t shown that yet with its existing connectors,” said Kirkpatrick. “Adobe’s edge has to be that its tools are better and that it comes with the IP and brand controls enterprises need.”

Firefly upgrades — Builder, Design, and ‘always-on’ agents

The MCP integration was one of numerous agent-related announcements at Adobe Max on Tuesday, with other updates aimed at enhancing native functionality within Creative Cloud and the Firefly AI assistant.

This includes “always-on” agents that work in the background, taking on recurring tasks for users. Users choose from pre-built agents aimed at specific workflows, then customize what actions the agent takes, set goals, and review plans before it begins. The agents ask for approval for certain decisions, learn preferences from feedback, and are managed via a central dashboard in Firefly.

“On a multi-week video project, for example, an always-on agent can organize incoming footage, remove duplicate clips, and flag camera shake or audio issues for your review,” Mike Polner, vice president of product marketing, Creators at Adobe, said in a blog post.

“For the right person, I think it’s an easy sell,” said Kirkpatrick, such as a social media manager starting their day with a batch of draft posts to review, though it may be less appealing to creative professionals responsible for generating broader ideas.

For some end users, the always-on agents can be “an additional set of hands to drive efficiency,” said Miller, while “others will see this as a force multiplier, allowing them to expand their business flow … while the assistant handles the sorting and cleaning.”

Customers who use the always-on agent should ensure there are sufficient guardrails in place, said Kirkpatrick.

“Before activating an always-on agent, I’d want to know exactly what it can touch, and I’d make sure it drafts but never publishes on its own. Everything it makes should get a brand check,” he said.

He cited Adobe’s own survey of marketing and creative professionals that showed that around a believe that public-facing content is “off-brand.” “An agent working around the clock can make that a lot worse if nobody’s paying attention,” said Kirkpatrick.

Managing costs of an always-on agent with budget controls is another consideration, he said. Adobe hasn’t disclosed full pricing information at this stage. Always-on agents, launching in beta in early 2027, will initially be available for Adobe Firefly.

Other Firefly capabilities announced at the MAX event include Firefly Builder, in private beta, which creates prototypes of websites and interactive apps from natural language prompts. Firefly Design, in beta, is a new design workspace app that combines tools for image editing, animation, illustration, and 3D designs.

Adobe

While Adobe builds out its own native and third-party AI features, it also faces competition from other software tools aimed at creative professionals.

“From a competitive perspective, I see Canva and Figma going after the same in-house teams and are showing up in the same AI assistants,” said Kirkpatrick.

Adobe also faces competition from AI model providers such as Anthropic, Google, and OpenAI that are building design tools into their products.  

“Where Adobe really wins is when precision, brand control and commercially safe content matter, and that’s mostly in the enterprise,” said Kirkpatrick. “With individual creators, its lead is a lot smaller, and where Adobe is most at risk for displacement.”

When we talk about more efficient text entry on Android, we’re typically talkin’ about one of two things:

1. Tips for tapping into little-known shortcuts and extras within your existing on-screen keyboard
2. Smarter voice input systems for faster and easier speech-to-text transcription

Those areas of improvement are all well and good — and plenty important, without a doubt! — but when it comes to serious productivity and work communication, there’s one more type of tool that can make a monumental difference and yet virtually never comes up in the Android typing conversation.

It’s the type of tool that lots of smart workers already embrace on the desktop front but that’s far less common in the mobile world, where it’s if anything even more useful — and that’s an intelligent text expander. Text expanders let you create and save common phrases or even entire paragraphs of text you find yourself typing often and then insert ’em into any text field, anywhere, with a quick ‘n’ simple keyboard command.

There’s one such tool on Android that stands out above the rest, and it just got a massive makeover that makes it even more of an indispensable addition.

Lemme show ya how it works and what it’s all about.

[Psst: Want even more advanced Android knowledge? Check out my free Android Shortcut Supercourse to learn tons of time-saving tricks for your phone.]

Your Android text expander advantage

My fellow Android-appreciating animal, allow me to introduce — or maybe re-introduce — you to a handy little tool called Typing Hero.

Typing Hero first popped up on my radar a few years ago. But it’s come a really long way since, especially with its recent revamp, and it’s well worth bringing to the surface now as a potential new piece of your Android productivity toolbox.

On the simplest possible level, what Typing Hero does is allow you to create prewritten text snippets and then map ’em to specific keyboard commands — short and memorable abbreviations like *thx or *omw that you can type into any text field, using whatever regular Android keyboard app you already use, and then have your full snippet appear right in that same place.

It’s so easy and so effective, it genuinely gives me a jolt of joy every time I see it happen:

Typing Hero in action, with its most basic text expanding feature.

JR Raphael, Foundry

Setting up snippets is super-simple, too: You just go into the Typing Hero app, create a new snippet, and put in whatever keyword and result you want.

Creating new snippets in Typing Hero is surprisingly simple.

JR Raphael, Foundry

That in and of itself is such a smart time-saver, especially if you tend to type the same sorts of stock responses over and over while you’re dealing with emails, Slack messages, or any other kind of communication. And honestly, that’s what’ll make Typing Hero worth having in place for most of us.

But the app gets even more interesting when you start to explore some of its extra-advanced options — for instance, being able to map multiple snippets to a single trigger keyword and then get a pop-up menu to choose from anytime you enter the term.

Triggering multiple related snippets is a powerful Typing Hero possibility.

JR Raphael, Foundry

Typing Hero also supports all sorts of advanced commands for actual actions on Android — like automatically hitting send and then moving back to the previous screen as a part of a single keyword.

Text expansion alongside actual system-level actions makes for a pretty incredible pairing.

JR Raphael, Foundry

Not bad for step-saving, right?

Beyond that, Typing Hero can incorporate a bunch of different variables into its snippets — so, for instance, you might have it automatically insert whatever text was most recently copied into your Android system clipboard as a part of a snippet or automatically insert the current date or time. 

You can even configure it to pause for your input and ask you to fill in certain blank variables whenever a snippet is activated — if, say, you want to manually type a name or a precise number into an otherwise standard prewritten message.

width="1024" height="998" sizes="auto, (max-width: 1024px) 100vw, 1024px"> Typing Hero’s form filling feature presents a whole other level of time-saving delight.

JR Raphael, Foundry

No exaggeration: This thing feels like a secret weapon. And once you get used to having it in place on whatever device you’re using, you’ll wonder how it wasn’t always there and built right into Android as a readily available asset for everyone.

Oh, and the app is respectful of your privacy, too, with virtually no data ever leaving your device or being used in any way beyond its intended and approved purpose.

Typing Hero is free for up to 20 saved snippets and with certain feature limitations in place, like only being able to use a single snippet per keyword and not having the multiple-choice menu possibility we talked about a moment ago. You can lift all those limitations and unlock its full set of features with the app’s premium version, which costs $20 a month or $60 for a lifetime license.

Whether you go the premium route or just stick with the basic free setup, it’ll save you tons of time and bring a hefty upgrade to your on-the-go productivity. And that, m’dear, is yet another only-on-Android advantage worth celebrating.

Keep the enlightened Android phone-owner knowledge coming with my free Android Shortcut Supercourse. You’ll learn tons of time-saving tricks!

The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. [...]

In recent years, cyberthreats have increasingly taken a hybrid approach, combining time-tested techniques for advancing through infrastructure, modern methods of evading network filters, and automation powered by large language models. This is also the approach of Citrus Ransomware, a previously undocumented group whose toolset includes VLESS tunnels (used to disguise traffic as regular HTTPS) and a ransomware Trojan from the Sn00py family. The attackers also integrate LLMs (large language models) into the process of infrastructure compromise.

In this article, we review the tactics and techniques the group used in recent incidents.

Initial Access: attacks through contractors

The attackers gain initial access to victims’ infrastructure through compromised contractors. They use credentials stolen from these contractors’ employees to connect to corporate VPNs or directly to internet-facing terminal servers over RDP.

Execution: commands, LLMs, and Impacket

The attackers run commands on compromised systems through the standard Windows command interpreter and PowerShell. As the attack progresses, they create and run PowerShell scripts, batch files, and commands generated by LLMs. One example of the latter is the commands below, which disable the account of one of the administrators.

Comment translation

# Disable account
# Verify result

Both commands come with comments, something attackers rarely bother with, so the comments very likely point to LLM use. And the models did more than generate commands. The attackers also produced full scripts, complete with the comments typical of LLM output.

Comment translation

# Creating background tasks for each computer with a thread limit
# Concurrent task limit control
# Quick ping

The fragment above comes from a script Citrus used to enumerate active user sessions on domain systems.

Besides LLMs, the attackers use atexec, a classic tool from the Impacket collection, to create scheduled tasks that run commands on hosts:

Task name Launched executable file sIErKswD C:\Windows\System32\..\System32\cmd.exe PpMBCCSR C:\Windows\system32\cmd.exe QwZtLmNp C:\Windows\..\Windows\System32\cmd.exe

We did not see the exact commands behind these tasks, but Group Policy was refreshed after they ran, so they most likely executed gpupdate /force.

When the group compromises 1C:Enterprise servers, it uses external data processors (1C-Shell) to run commands.

Persistence: scheduled tasks

Citrus uses scheduled tasks to launch its malicious tools automatically. The attackers create the tasks manually through PowerShell:

On systems that are not regularly rebooted, such as terminal servers, they sometimes run their tools without establishing persistence at all.

Privilege Escalation: vulnerabilities and configuration flaws

In every case we know of, the contractor domain account used for initial access had very limited privileges, so the attackers tried to escalate them.

To do this, they attempted to exploit the authentication bypass vulnerability CVE-2026-54121 (Certighost); these attempts created machine accounts with telltale names in Active Directory, such as:

• GHOSTAUFTAFGS
• GHOSTCZYQVAZS
• GHOSTIVPRLDZA
• GHOST{8 random letters}

These names are generated by scripts making use of an exploit published on GitHub.

The exploit works like this: on behalf of the newly created account, it requests a certificate based on the Machine template from the system holding the AD CS role. The Attributes, Subject, and SubjectAlternativeName fields contain parameters like these:

<Data Name='Attributes'>CertificateTemplate:Machine\nSAN:dns=dc01.victim.domain\ncdc:91.210.109[.]118\nrmd:dc01.victim.domain </Data> <Data Name='Subject'>CN=GHOSTABUIEFAD.victim.domain</Data> <Data Name='SubjectAlternativeName'>DNS name =dc01.victim.domain\r\n</Data>

The cdc attribute specifies the IP address or name of the system that the certification authority must contact to verify the data. The attackers specify the address of a system they control (in this case, 91.210.109[.]118) and send forged data from it. If exploitation succeeds, the certification authority issues a certificate with the specified parameters, based on the specified template.

Once the certificate is issued, the domain controller name in its SubjectAlternativeName field lets the attackers authenticate as the domain controller account.

In one case, the attackers also uploaded an executable for persistence, on behalf of which PowerShell scripts were launched with nonstandard HostName (Имя узла) field value.

Field name translation

Severity
HostName
HostVersion
HostId
HostApplication
EngineVersion
RunspaceId
PipelineId
CommandName
CommandType
ScriptName

Although the file was later deleted, indirect evidence hints at its purpose. For example, the MSFConsole value may indicate that the file is a component of the Metasploit framework. The PowerShell scripts run through this file included an exploit for the CVE-2020-1337 vulnerability; the same exploit is available in the Metasploit GitHub repository.

Beyond classic vulnerabilities in Microsoft products, the attackers also took an interest in 1C:Enterprise servers with insecure configurations (article in Russian).

On top of the configuration flaws, 1C:Enterprise systems are frequently accessed by support staff and administrators who hold elevated privileges in Active Directory. Together, these factors make it easy for attackers to escalate privileges and start moving laterally.

Stealth: covering tracks and masquerading

To hinder incident response, the attackers delete their tools and output files and clear the command history.

While the tools are still in use in the victim’s infrastructure, the attackers typically give them and their auxiliary objects legitimate-looking names:

• KasperskyGPO_Deploy_64.exe and KasperskyGPO_Deploy_64_FIXED.exe are self-extracting archives. They contain the Deploy-KasperskyGPO.ps1 script, a directory with a malicious Group Policy Object, and one of two archives, KasperskyAgent.exe or agent.exe.
• KasperskyAgentInstaller.exe, KasperskyAgent.exe, and agent.exe are self-extracting archives containing the ransomware Trojan executable and auxiliary files.
• Kaspersky GPO is the name of the Group Policy Object that distributes the ransomware Trojan in the victim’s infrastructure.
• KasperskyAgentInstallTask and Sysvc are names used for the scheduled task that runs the self-extracting ransomware archive files.
• Deploy-KasperskyGPO.ps1 is the PowerShell script that creates the malicious Kaspersky GPO.
• Kaspersky_GPO_Deployment.log is the log of the Deploy-KasperskyGPO.ps1 script.

Note that using the Kaspersky name in malicious file names doesn’t help the attackers avoid detection. Kaspersky solutions successfully detect and block these malicious files.

Defense Impairment: weak access policies for security tools play into attackers’ hands

To stay under the radar longer, the attackers clear event logs on some systems using the built-in wevtutil utility.

In addition, once they have sufficient privileges, they disable antivirus protection on hosts, which lets them run tools such as mimikatz.

The attackers also go after the centralized management consoles for security solutions, which they then use to disable protection en masse.

At the Impact stage, the attackers also use a Group Policy Object that modifies Windows Defender settings in the registry to switch it off. As a result, the antivirus did not respond when the ransomware was launched.

Finally, if they have sufficient privileges, the attackers manually add their malicious tools to the antivirus exclusion list.

Credential Access: mimikatz, a keylogger, and extraction of credentials from files

To capture keystrokes on a compromised system, the attackers use a modified version of the peeping-tom keylogger, whose source code is available on GitHub. The keylogger executable and its log file are located at the following paths:

• C:\ProgramData\Oracle\Java\jhost.exe
• C:\Users\<username>\AppData\Roaming\Microsoft\CLR\ErrorLog.txt

In the sample we found, stolen data was sent to 91.210.109[.]118. Persistence for the keylogger is provided by the scheduled task described above in the Persistence section.

To dump credentials from memory, the attackers use mimikatz. Files related to mimikatz are located at the following paths:

• C:\ProgramData\x64\mimidrv.sys
• C:\ProgramData\x64\mimikatz.exe
• C:\ProgramData\x64\mimilib.dll
• C:\ProgramData\x64\mimispool.dll

To hunt for credentials and other secrets (SSH keys, access tokens, and the like) in files on accessible network shares, the group uses Snaffler. To simplify running the tool, the attackers drop a configuration file on the system:

Besides data from network shares, the attackers were interested in data stored in password managers (for example, KeePass) on administrator workstations.

Discovery: the standard toolkit Local discovery

After gaining control of a compromised system, the attackers ran a basic set of commands to identify the current user, running processes, network interface settings, the system’s external IP address, and so on:

whoami tasklist quser ipconfig curl 2ip[.]io

Remote discovery

In the early stages, the attackers used the fscan scanner to gather information on the internal infrastructure. They were particularly interested in the following ports:

• 135 (RPC)
• 139 (NetBIOS-SSN)
• 1433 (Microsoft SQL)
• 8006 (Proxmox VE)

Once they had the access they needed and had moved laterally, the attackers ran ADRecon on domain controllers and SharpHound on one of the workstations.

The attackers also used PowerShell to run LDAP queries against the controllers of adjacent domains, pulling lists of domain systems, users, and groups.

Russian text translation

The user has no additional groups in memberOf (primary only)
User not found

As an alternative to PowerShell, the attackers used the net.exe utility to get information about domain users and privileged groups:

net users /domain net group "Domain Admins" /domain net group "Администраторы домена" /domain

Lateral Movement: SSH, RDP, and WinRM

For lateral movement, the group relies on standard remote administration protocols: SSH, WinRM, and RDP. The attackers connect to systems either through previously deployed tunnels or directly from the compromised host.

Command and Control: delivering tools to the system

To deliver its tools to target hosts, the group uses built-in OS utilities. Specifically, the incidents involved:

1. certutil:
   
2. The Windows BITS background service (invoked in two ways):
   
3. cURL:
   
4. PowerShell:
   

Creating tunnels with Xray

The certutil and BITS commands shown above are what the attackers used to download Xray onto victim systems. They then used Xray to set up reverse VLESS tunnels to the command-and-control server. The configuration file, stored alongside the Xray executable, was usually named config.json. In some cases, the attackers deleted it right after starting the tunnel to hide the Xray configuration from defenders.

Judging by the configuration files recovered during the analysis, the attackers used port 443 on the VLESS server to blend in with legitimate HTTPS traffic. The configuration files also contain blocks that set up the REALITY protocol, which is intended to disguise the attackers’ traffic as requests to the legitimate site mirror.yandex.ru:

The traffic was also disguised as requests to another legitimate site, yastatic.net:

Installing AnyDesk

The PowerShell command above AnyDesk, which the attackers used to remotely control compromised hosts.

After the download, the attackers installed the software with the --silent flag to avoid alerting the user, set a connection password, and used PowerShell to pull the infected machine’s ID (which AnyDesk uses for remote connections on the client side) from the configuration file:

Collection & Exfiltration: data from messaging apps

Right before encrypting the data, the attackers connected to one of the domain controllers and ran the PowerShell script steal_tgs.ps1, which created the tdatas directory. According to the NTFS USN journal, while the script ran, 7-Zip created archives in this directory with telltale names hinting at their contents:

<system_name>_<date>_<username>_tdata.zip

The directory name tdatas and the substring tdata may refer to the C:\Users\<username>\AppData\Roaming\Telegram Desktop\tdata directory. The Telegram messaging app uses this directory to store authorization keys, session data, app settings, and other session information.

So the attackers were harvesting messaging app data from remote systems they could reach, packing it with 7-Zip and uploading it to an external web service through Google Chrome.

Impact: Sn00py ransomware Trojan

The Citrus group uses ransomware from the Sn00py family to encrypt data. It’s written in Go and uses the RSA-2048 and ChaCha20 algorithms to encrypt user files (but not system files) on Windows systems. Encrypted files receive the .citrus extension. For now, decryption is impossible without the attackers’ private key.

When launched, the ransomware opens a console on the victim’s device, where it outputs the commands it runs. It also attempts to modify the boot configuration data (BCD) by invoking a nonexistent executable, bcedit (likely a typo for bcdedit):

The ransomware’s console output contains the string:

We`re going to do something special today :). Made with RaaS platform Sn00py.

The string likely means the ransomware is distributed under the ransomware-as-a-service model, where attackers don’t write the malware themselves but subscribe to a ready-made offering.

The ransomware configuration contains the Citrus group’s public key in the pubkey parameter:

-----BEGIN PUBLIC KEY----- A7+eV3M+EDIh5kId+vf46QkKpAOKxUxv97PDFj66ox+uE0GV9UQhrSmBAoGAcyNI +z7noIwrFYnHi6wtj8gLEOT0hE/cNDp0VLoUnAzi551kZA7J3Q575jwqrJcDrZSO JLkZX7pxLLSd9iQdxMxDrLYZGRtiht8ToD5OGZri36oPvnW56ijJZ/NMzlFtVr7V iSZJr5Qkz2cxShcSuhDLLXmzleclBd7HQtWTuZUCgYEAqN8WFAZxkV2e1p4v3U98 VOu4XxEfqAc2Gs2Ccs/kkWoX/1fxvuSRcF6/hMdfVwUP0z+/fnhbFMNfysBeWo1W ZfmpBF/HbnRSg2ZDLWIwXEXEsNNSRmlvwyHWSEZgyG1xjgjSZKWuxo92WVmPxb5i S6NLrZkHPHwqaBy8CnD6ft8= -----END PUBLIC KEY-----

The host_blacklist parameter also lists the system names that are exempt from encryption:

[ "DC01", "DC02", "DC03", "DC04" ]

This list includes the domain controllers used to distribute the policy that launches the ransomware. This way, the attackers ensure the policy keeps propagating uninterrupted.

As it runs, the Trojan drops CITRUS_README.txt files containing the ransom note:

-[ All your data were encrypted ] | |-If you try to decrypt them yourself, you will lose your data. To decrypt all systems, you need to contact us for guidance and a data recovery tool in the future. If you ignore our offer and the conversation does not take place, we will take extreme measures against your company and your employees, as a result of which you will lose access to all resources of your network and lose your reputation. | |-To contact us - register your mail here: https://account.proton.me/mail/signup?plan=free and write to us by email: [REDACTED] |-Further negotiations regarding this situation will be conducted there. Also we have Telegram: [REDACTED] | |-Be sure to use a VPN, and do not attempt to write from other email addresses, as there is a high chance that the messages will not be delivered to either party. | |-You have 72 hours to contact us to establish negotiations and interaction, starting from the date of creation of this file. |-If you do not contact us within 3 days, we will consider this a refusal to cooperate. This will entail immediate measures, such as: Dumps of your services, personal data of employees, accounting, contracts and source code. | |-Warning: \\_ Do not delete, modify, or attempt to recover files by any means other than using our key and decryptor. This will damage your data, and we cannot guarantee its recovery. \\_ Do not try to make this public, as you will only harm yourself and your reputation.

As mentioned above, the group uses malicious Group Policy Objects to launch the ransomware across victim systems en masse. The GPOs are created by self-extracting archives, of which we have seen two versions. Each archive contains:

• A self-extracting archive with the ransomware Trojan and auxiliary files.
• A directory containing the Group Policy Object. The policy drops the ransomware archive on the target system, creates a scheduled task that runs the archive with the parameters /quiet /norestart, enables the WinRM service, and disables the Volume Shadow Copy service and Windows Defender antivirus protection. It also sets a desktop wallpaper displaying the ransom note.
  
• A PowerShell script that copies the ransomware archive to the \\<current_domain_name>\SYSVOL directory on the domain controller and links the malicious GPO to the domain using the Import-GPO and New-GPLink

One version of the PowerShell script contained comments suggesting that it was likely edited with an LLM:

Links to Toy Ghouls

While analyzing Citrus activity, we noticed several similarities to Toy Ghouls. Although their infrastructures don’t directly overlap, the two groups share TTPs: they encrypt their victims’ systems, use a similar set of tools (1C-Shell for remote command execution on 1C:Enterprise servers, mimikatz, PsExec, and ADRecon), and store these tools in the same directories. What’s more, both groups are Russian-speaking and attack Russian companies only. In several incidents, we saw the same infrastructure compromised simultaneously by both Toy Ghouls and Citrus.

Conclusion

What makes Citrus interesting is its unconventional approach to network tunneling and its use of AI to generate auxiliary tools. Even so, the attackers largely rely on well-known tools and techniques, which makes early detection somewhat easier. Kaspersky solutions detect all the activity described in this article.

That said, the Citrus attacks are another reminder that contractor access to an organization’s infrastructure must be tightly controlled and restricted. After all, compromising contractor accounts is exactly how the attackers get into their victims’ networks. We’ll continue to track the group’s activity and report new techniques as we discover them.

Indicators of compromise File hashes Xray d631627131b90d576d77f4bf530e1abe mst.exe, sabycenter.exe, webex.exe, rpchost.exe Meterpreter stager 7107fb029e7c63523e3aca5fc8e56b38 2341.exe Keylogger e251df2d0b7c3682965efb4d2009a2f4 jhost.exe Sn00py 17b29b6c9de80402a45e321bbe1168fa build_64.exe 9eee984b187423c46c10a63d080da15d build_64.exe fscan cf903e4a1629aa0582fd0363b5786676 fscan.exe File paths C:\ProgramData\ADRecon-Report-* C:\ProgramData\SharpHound.exe C:\ProgramData\Snaffler.exe C:\ProgramData\WebEx\config.json C:\ProgramData\WebEx\host_to_ip.ps1 C:\ProgramData\WebEx\ping_oldwin.bat C:\ProgramData\WebEx\web.txt C:\ProgramData\WebEx\webex.exe C:\ProgramData\ad_ru.ps1 C:\ProgramData\computers.txt C:\ProgramData\config.json C:\ProgramData\default.toml C:\ProgramData\fscan.exe C:\ProgramData\llc\*_BloodHound.zip C:\ProgramData\mst.exe C:\ProgramData\oracle\java\jhost.exe C:\ProgramData\pve.exe C:\ProgramData\rules C:\ProgramData\sabycenter.exe C:\ProgramData\steal_tgs.ps1 C:\ProgramData\tdatas C:\ProgramData\x64\mimikatz.exe C:\ProgramData\xray.exe C:\ProgramData\rpchost.exe C:\ProgramData\3777.exe C:\ProgramData\2341.exe C:\ProgramData\ChromeSetup.exe C:\ProgramData\Kaspersky\KasperskyAgent.exe C:\ProgramData\Kaspersky\KasperskyAgentInstaller.exe C:\ProgramData\1.txt C:\ProgramData\7z2603-x64.exe C:\ProgramData\Kaspersky\task.log C:\ProgramData\enum.ps1 C:\ProgramData\kp.ps1 C:\ProgramData\ping.ps1 C:\ProgramData\result.txt C:\ProgramData\user_activity_report.txt C:\Users\*\AppData\Local\Temp\7ZipSfx.000\Deploy-KasperskyGPO.ps1 C:\Users\*\AppData\Local\Temp\Kaspersky_GPO_Deployment.log C:\Users\*\AppData\Local\Temp\7ZipSfx.000\KasperskyAgent.exe C:\Users\*\Desktop\KasperskyGPO_Deploy_64.exe C:\Users\*\Desktop\KasperskyGPO_Deploy_64_FIXED.exe C:\Windows\SYSVOL\domain\KasperskyAgent.exe C:\Windows\SYSVOL\domain\build_64.exe C:\Windows\SYSVOL\domain\icon.ico C:\Windows\SYSVOL\domain\wallpaper.bmp C:\Windows\Temp\agent.exe C:\Windows\build_64.exe C:\Windows\icon.ico C:\Windows\wallpaper.bmp C:\Users\*\AppData\Roaming\Microsoft\CLR\ErrorLog.txt C:\Users\*\Desktop\webex.zip Scheduled task names Java rpchost agent KasperskyAgentInstallTask Sysvc IP addresses 91.210.109[.]118 91.210.108[.]180

Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. [...]

Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them. The company builds and runs apps for its customers and stores their secrets, such as API keys and database Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights. The team tested the method on Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

There’s a new flavor of cereal on the table, but not the appealing kind, particularly for defenders.

A new report from global security company ESET describes a “sophisticated, modular, and tightly interconnected” toolset designed to run on compromised Exchange servers for long-term cyberespionage.

The malware is named ‘Cereal’ because it relies heavily on serialization, a technique used to package data and code for transport. It comprises a novel Exchange email collection module, a sneaky command and control (C&C) mechanism, and clever .NET execution tricks.

While as of now, it is being used by nation-state actors to attack government bodies, enterprises should still be concerned.

“Tradecraft like this tends not to stay with its inventors,” said Frank Dickson of Dickson Research, citing a baseball analogy: “Criminal groups study nation-state techniques the way minor leaguers study a big league pitcher’s grip. What works in the majors eventually shows up in every ballpark.”

Sophisticated tradecraft

ESET describes Cereal as a malware toolkit that runs on Microsoft Exchange servers, receives commands and executes them in memory, maps the victim organization, and collects selected email messages. No external network infrastructure was identified; instead, the toolkit contains a passive backdoor that runs on targeted servers and provides access. It leaves little on disk.

The researchers noted that one of the most interesting aspects of the toolkit is what they did not find: External C&C infrastructure. The victim’s compromised Exchange server is effectively “co-opted” to play the part.

Operators send commands as separate, but similarly-structured, executables, suggesting an automated framework. An automated email collection module is injected into legitimate Microsoft Exchange processes, allowing threat actors to access and manipulate the email transport pipeline, the researchers explained. 

“This requires deep understanding of the inner workings of Microsoft Exchange and is a novel technique,” they wrote.

They described a typical attack chain this way: An official in a national government office sends an email to a colleague at a transnational military alliance. The message goes out through a Microsoft Exchange server, just as it should; nothing looks suspicious. But before the email departs, a piece of code quietly examines it, identifies whether it is interesting, and if it is, sets aside a copy to be forwarded to “prying eyes.” The original email continues on its way as usual.

The toolset demonstrated that Exchange servers are not just mail servers, they are “durable collection points,” internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft, the researchers noted. The transport pipeline reflects a level of investment in this type of technique that is “uncommon even among sophisticated APT [advanced persistent threat] actors,” they said.

The researchers discovered that the malware has so far been used to target Kazakhstan and Romania. ESET attributes the toolkit to Russia-aligned APT group Turla.

Attackers made a significant effort to remain undetected

Experts agreed that some of the most notable aspects of Cereal are the lack of a C2 channel and the effort the attackers made to stay in stealth mode.

“ESET found no attacker-controlled server. None,” Dickson noted. The victim’s own Exchange server is the command center, and the backdoor waits for encrypted requests on web paths that look like ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic.

“Cereal never calls home. It is home,” he said.

This is dangerous because most network defenses watch for traffic leaving for a suspicious destination. But here, there is no destination to block and no server to take down. “The attackers walk in through the front door, dressed as Outlook,” he noted.

Then there is the mail hook: Legitimate transport agents in Exchange allow software to inspect mail as it flows. But Cereal injects itself into Exchange’s mail process and wraps the agents already running in memory.

Mail keeps flowing, but nothing new appears. “It is the postal carrier who steams open the envelope, copies the letter, and reseals it before delivery,” Dickson said.

A component dubbed CerealBox selects messages with .doc, .docx, and .pdf attachments from chosen senders, recipients, and subjects. In Romania, ESET discovered that it collected mail involving The North Atlantic Treaty Organization (NATO)  and EU addresses. This should concern enterprises, Dickson said; swap in your preferred targets: outside counsel, your acquisition target, or your regulator, to retrieve a contract, a deal memo, or a legal strategy.

Further, the commands ESET documented include pulling entire mailboxes, extracting credentials stored on the server, and querying Active Directory for users, groups, and computers. An Exchange server sits deep inside the identity fabric. It is an Achilles’ heel because it is internet-facing, highly privileged, and complex. “Own it, and you hold the keys to the kingdom if you will,” Dickson said.

His advice: Migrate or retire on premises Exchange where possible. Treat whatever remains as a tier-zero asset, “guarded like a domain controller.” Limit internet exposure of Outlook Web Access and ActiveSync to what the business truly needs. Hunt with the indicators described by ESET. Watch for unexpected code loading into Exchange’s transport process.

But while the researchers’ work is excellent because it maps what Turla did once inside an organization in “remarkable detail,” it does not say how Turla got onto those servers, Dickson pointed out. No vulnerability is named, and no stolen credential or phishing email is described.

“A burglar who leaves no fingerprints is impressive,” said Dickson. “A burglar whose way in remains unknown is a problem for every house on the street.”

‘A level above’

And, said David Shipley, CEO of Beauceron Security, we’ve seen the gap between nation state hackers and criminals collapse over the past few years in terms of sophistication, in particular thanks to AI, but “then you see something like this, which is still a level above.”

Running on premises Exchange has been increasingly risky for years, he noted. For government, AI firms, finance, and other high-value targets, the risk of hosting on prem instead of using cloud-based versions continues to grow.

However, it’s worth noting that just having Microsoft host Exchange doesn’t mean you’re safe from nation-states, Shipley said. “It just raises the bar.” Another key challenge with Exchange servers is Microsoft’s own advice not to have anti-virus scanners looking in certain places like ExchangeTransport.exe, because doing so could create instability.

“They basically told criminals where to hide and why it’s good to hide there,” he noted. “Not that they can do much about it, but it points to a huge Catch-22.”

Another Catch-22: With the publication of this report and new ideas that will undoubtedly come from it, “we’ll likely see criminal groups consider the value of this kind of technique in the future,” Shipley noted.

This article originally appeared on CSOonline.

Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces. [...]

Grok Build, the vibe-coding agent from SpaceXSI, is leaking data—some of it proprietary business information and other sensitive secrets—from thousands of its users, including the very same Elon Musk-owned company that offers the platform, new research shows.

The information is revealed through links allowing Grok Build users to share their apps with others. Grok takes steps to randomize the URLs so only people who know the exact URL can access the data stored there. A design decision by developers of the platform, however, completely torpedoes that objective and makes it possible for anyone to enumerate thousands of live Grok Build projects. Except in rare cases, clicking those links opens the app and reveals all data associated with it.

You had one job

Research from security firm Claroc shows that the exposed data includes things like internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. Ironically, some of the sensitive data comes from two-dozen apps built by SpaceXSI (the name of the now-merged SpaceX and xAI) itself. A small sampling of the documents revealed in the SpaceXSI apps—Claroc found 24 of them—include an onboarding plan, marked confidential, for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals.

Read full article

Comments

Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. [...]

Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]

A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. [...]

A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEESwati Khandelwalhttp://www.blogger.com/profile/[email protected]