Kategorie

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]

DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. [...]

Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw critical, released version 10.6p2 today to block it. Alpine has published fixed packages for every Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Attackers target IT service desks to bypass MFA by impersonating employees and convincing staff to reset passwords or register new authentication devices. Specops Software explains why traditional identity verification methods are no longer sufficient and how organizations can secure account recovery against social engineering risks. [...]

How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A critical finding can move through several security tools and still leave the organization exposed.  The vulnerability has a severity score, and a ticket has reached the queue. Progress then depends on information the finding may lack: who owns the system, whether attackers can reach it, what protection exists, and how a change could affect the business.  Each missing detail [email protected]

OpenAI on Wednesday detailed a pipeline that employed an upcoming cyber-focused artificial intelligence (AI) model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2 million in API costs. "Our prototype identified and analyzed 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 local privilege escalation (LPE)Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

When it comes to Android security, we’ve got three main types of threats to contend with as informed phone-owners determined to keep our data safe.

First, there are the theft-related worries — the breaches that happen when someone physically takes possession of your device and manages to get past its virtual gates. (Setting up Android’s native theft protection options and enabling all the right Android security settings in advance makes a massive difference in terms of proactive protection.)

Next, there are the many, many theoretical threats played up by companies hoping to sell you over-the-top security software. (Choosing a device that actually gets timely and reliable software updates and then maintaining a teensy shred of common sense is generally all that’s needed to keep these overhyped boogeymen at bay.)

And finally, every single one of us faces the most worrisome threats of all — the ones related to good old-fashioned trickery and our own occasional lapses in judgment. From phishing to smishing and vishing and now even quishing (I swear I’m not making these up), there’s no shortage of shenanigans trying to trick us into willingly giving up our information without even realizing it. And all the easily accessible AI these days only makes matters worse.

Suffice it to say, that last category is generally the most pressing — ’cause it’s our own very human shortcomings that make it possible. And even the most savvy and cautious creatures among us can be convinced to click a thoroughly cloaked questionable link in the right moment.

With that kind of threat, your best bet is simply having as many layers of protection as possible in front of you — so if your own guard is ever down and a particularly convincing scam attempt appears in front of you, there’ll be something standing between it and you that says: “Hey buddy: You sure you want to do this?”

That’s precisely what’s popping up as an easily overlooked new option on Android right now — in one of the places where you’re most likely to encounter scam attempts on your phone. And as a smart and sensible Android Intelligence reader, you don’t have to wait for Google to officially give it to you to start embracing its power.

[Get level-headed knowledge in your inbox with my free Android Intelligence newsletter — a single useful new tip every Friday.]

Hello, Enhanced Protection

The arena at the center of our attention this week is none other than texting and the de facto default Google Messages app for Android.

Google Messages has long had a simple spam protection option among its many buried features, but Google’s in the midst of expanding that to include an even meatier Enhanced Protection mode for all of your incoming messages.

Specifically, Enhanced Protection includes three new forms of in-message scam defense:

1. An AI-powered analysis that puts messages from new, unknown senders under an especially strong microscope to seek out signs of “novel and sophisticated attacks” — a trend that Google says increasingly gets hidden within “slow-burn conversations” designed to get you to give up innocuous-seeming but potentially problematic slivers of personal info along the way.
2. An even stronger form of link scanning that looks at real-time signals to see if any link you’ve received contains scammy elements or signs of phishing within — even if the site itself isn’t immediately known to be shady.
3. More prominent warnings anytime you’re about to open a link from a potentially questionable sender — to confirm you actually want to proceed and make sure you didn’t tap something inadvertently.

All these new features work from a privacy-first perspective, according to Google, with either on-device processing or cloud-based computing that occurs only in an encrypted, secure dedicated space that makes all the related info inaccessible to anyone else (including even Google itself).

The Messages Enhanced Protection options are available for anyone to opt into as of this moment — but, as is so often the case with these kinds of updates, it’s up to you to realize they’re available and then take the steps to activate ’em on any device(s) you’re using.

Your 3-step Android security upgrade

If you want to step up your Android messaging protection this instant, you need to manually apply a couple of pertinent under-the-hood updates that’ll enable all the new options and let you activate ’em without any delay or potential for forgetting.

1️⃣ First, bump yourself up to the beta version of the Google Messages app. This gives you early access to incoming features like these before they reach everyone and lets you skip the line of uncertain waiting. Joining an app’s beta channel is completely free and takes about a minute to do. Just follow these instructions, if you aren’t already familiar with the process, then move on our next step.

2️⃣ Once you’re in the Google Messages beta channel and with the latest available app version in front of you, we need to update a typically invisible Android element called Google Play Services to make sure you’re on the most recent version of that as well. Google Play Services powers a lot of important processes and works hand in hand with apps like Messages to make certain features, including this new Enhanced Protection option, available.

To manually apply the latest Google Play Services update, head into your system settings and search for the word play. Find the item in the results labeled “Google Play system update” — then tap it, tap the line that says “Google Play system update” on the screen that comes up next, and wait for the system to find and apply any available updates. You’ll probably be prompted to restart your device after any updates are made.

Now take a deep breath: You’ve got all the related elements up to date and ready, and all that’s left is to find and opt in to the actual Messages Enhanced Protection feature.

3️⃣ This last step is especially easy: Just open up the Google Messages app, tap your profile picture in its upper-right corner, and select “Messages settings.” Find and tap “Protection & Safety” in the settings menu that shows up next, and you should then see the newly expanded series of options in front of you.

With all the early-access updates in place, you’ll see Messages’ newly expanded security options.

JR Raphael, Foundry

Tap “Enhanced Protection” to select it, and that’s it: You’re now opted in to the full new Enhanced Protection option for all of your incoming texting activity.

All that’s left is to keep your common sense defenses up and rest a little easier knowing that if your own judgment ever falters — even just for a second — you’ve got another layer of protection in place to fall back on and help you avoid falling into a truly troubling trap.

Keep the helpful knowledge coming with my free Android Intelligence newsletter — one useful new thing to try every Friday and my Android Notification Power-Pack as an instant welcome bonus.

Almost everyone in tech already knows about Apple’s new MacBook Pro with PROLED XDR Display, a light, bright, thin pro Mac notebook with a reference-grade touch responsive display, adding a touch of iPad to the Mac. It’s already being talked about as the future, at least of the company’s pro laptops. 

I spoke with Apple’s Vice President of Mac and iPad Product Marketing, Tom Boger, to find out more. The specs of the new MacBook Pro are written about everywhere — including here — so I wanted to get a feel for how Apple thought about building the system. We looked at the weight the team took out, the restraint behind its design choices, the illuminated logo it brought back, and why the Mac makes so much sense for the enterprise.

Weight: a thousand small decisions

The first thing people notice about the new MacBook Pro, Boger said, is how much lighter it has become. The 14-inch model is about half a pound lighter, and the 16-inch about 0.7 pounds lighter. This weight loss was not easy to achieve. 

The team looked at every single component used in the Mac to find opportunities to reduce its weight, Boger said. “It’s not one thing here, one thing there. It’s a thousand things.” 

The challenge is to reduce the weight of individual components while leaving each part as functional as it was. “You have to make sure you’re not compromising the integrity of whatever component you’re taking the weight out of.” 

I pictured engineers shaving away microns, milligrams, and grams from all the components used. “That’s literally what it takes,” Boger said. Of all the things Apple did with this product, he said, this was probably the one where “you really have to sweat every little detail.”

Design: raise the bar, don’t change the Mac

The display is the headline feature of this MacBook Pro, Boger said. It did not appear overnight. Apple’s display engineering team is “one of, if not the best in the world,” he said. Building a panel like this “takes years of development.” The technology is only half the job, manufacturing it at scale is another. 

He was blunt about the result: “There’s literally nothing else in the industry like this,” he said, pointing to the display’s 10,000,000:1 contrast ratio. In working on the project, the question the team kept asking was simple: “If this is the world’s best pro notebook, how do we make it even better?”

Apple made it better with an astonishing display. The tandem OLED panel combines two stacked electroluminescent-emitting layers to deliver that extraordinary contrast ratio, up to 2,000 nits of brightness, and self-emissive pixels to eliminate the blooming and halo artifacts you see on other displays.

I’ve been lucky enough to see one of these Macs in action alongside a higher-end Windows laptop with touch, and you can very quickly see the difference. Apple has published a helpful white paper to explain more on its display tech.

The touch functionality supported by the display follows a similar logic of adding without disrupting.

Drawing inspiration from the iPad and iPhone, which almost every MacBook Pro owner already has, the intention was to ensure that the expanded user interface did not fundamentally change the nature of the laptop. “The MacBook Pro is still first and foremost about a trackpad and keyboard interaction,” Boger said. 

The aim is familiarity from one device to the next. What is new, he said, is pairing touch with a far more powerful system than an iPad Pro, which “opens doors” for creative applications. He pointed out that Apple’s touch is more responsive than on other laptops. You’ll also be impressed at how little the display wobbles when you touch it.

The new Mac comes as a new generation of professionals who have used touch all their lives graduate into employment. These digital natives use touch every day, and now they can do so with their Mac.

The logo

I recalled a conversation with Jony Ive many years ago about the care that went into a single component used in a previous MacBook Pro. Ive explained how simplicity reflects the care behind a product: making it not obvious how hard it was to build. I asked Boger if there was a small feature on Apple’s brand-new MacBook Pro in which the team who created it takes similar pride.

“In fact, there is,” Boger smiled, twisting his demo Mac around to so we could both see the illuminated Apple logo that now sits once again on its lid following a decade-long absence. I’d already heard there were gasps and applause when Apple first revealed the glowing logo to the media on launch. “Reception so far has been great,” Boger confirmed. 

The magic this time, he said, is that the logo is also reflective, with the mirror-like finish intact. What that means is that when you close the Mac, the logo appears as a shiny mirror black logo. He would not explain how. “That’s something we’re going to let be the mystery and the magic of this implementation,” he told me. Pressed a second time, he said only that Apple has fantastic engineers and “it’s just magic.” 

He framed it as a gesture to the customer. “People’s lives are on their Mac,” he said, and they take great pride in it. Bringing the glowing logo back is one way to honor that relationship. Apple wanted to revive in “a much more elevated way.” 

The picture he gave me was of countless small design decisions like these made in pursuit of this product. 

Macs have never been more popular

Analyst Horace Dediu this week shared analysis based on recent financial results that implied Apple may have outsold Dell in the last quarter. Boger declined to speak directly on that but told me the Mac has never been more popular than it is today and has never had a higher market share across its history.

“We’re bringing the greatest number of new-to-Mac customers than we ever have in the 42 years that the Mac has been around,” he said. He credited the MacBook Neo as “a huge momentum creator.” 

In the enterprise, Boger pointed to the Mac being cheaper to support, more reliable, and better liked by the people using it. “It can save an enterprise money if they put a Mac in the hands of their employees,” he said. When you give employees Macs, they become happier and more productive, and support costs shrink. 

Those traditional advantages have been boosted by something new — the power of Apple Silicon. “One of the things that differentiates Apple Silicon from any other platform is the incredibly fast and low-latency unified memory and the capacity that it has.” 

“The Mac is, from our perspective, the best platform for running AI in an enterprise,” he said. “There’s now this concept of tokenomics, where if you’re using AI more and more, if you use cloud-based AI, you’re going to be paying for tokens, where if you can run those models on device, it’s essentially free.” 

For enterprise users, that cost savings delivers real benefits. Run a model locally instead of paying for cloud tokens, and “a Mac can pay for itself in a matter of months.” 

For creative people doing creative things

What Apple has done is pair its real-world tested implementation of touch with a far more powerful system in the form of the MacBook Pro. 

For people using Macs, this means “higher-end applications and use cases can be combined with touch in ways that it hasn’t been combined before,” Boger said. This opens the doors to new creative possibilities.

Why does that matter? “People literally change the world” with MacBook Pros, Boger said. The hope is that touch on the new MacBook Pro will help creative people do even more creative things, maintaining the platform’s long-held ethos once characterized by founder Steve Jobs as “a bicycle for the mind.”

That’s not to say this bicycle comes cheap. The MacBook Pro with PROLED XDR Display costs from $2,899.

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk of financial losses, data breaches, and costly operational disruption. Below, we examine five [email protected]

Executive summary

In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution through crafted HTTP requests. One of the threat actors deployed ransomware on the target’s systems after successful exploitation. Microsoft attributed this ransomware-related ToolShell activity to Storm-2603, distinguishing it from other actors whose observed activity was primarily focused on credential theft, espionage, and data exfiltration.

In December, our retrospective analysis identified activity consistent with Storm-2603’s TTPs. This activity involved the attacker using the IIS worker process as an in-memory bridge to the customer’s infrastructure, keeping the access and control layer entirely within w3wp.exe without writing anything to disk. Although subsequent post-exploitation activity generated disk artifacts, the bridge used to maintain access remained memory-resident.

Let’s look in more detail at this attack.

The attack chain, from reconnaissance to infrastructure compromise

Intrusion timeline: Strategic latency and exploitation

The intrusion analyzed in this report occurred in two stages, with a temporal gap between initial access and subsequent exploitation activity. The attack timeline was as follows:

• Dec 20 – Vulnerability fingerprinting: A single HTTP request targeted a SharePoint administrative endpoint associated with the ToolPane component to determine whether the host was vulnerable to CVE-2025-53770.
• Dec 21-23 – Tactical latency: A three-day period of silence followed the initial probe, separating the vulnerability fingerprinting from subsequent malicious activity and potentially reducing the likelihood of immediate detection.
• Dec 24 – High-intensity re-engagement: On Christmas Eve, when security staffing at many companies is reduced, the full RCE chain was executed through the IIS worker process (w3wp.exe) on the same endpoint as the initial probe.
• Dec 26 – Incident discovery: The three-day gap initially prevented the December 20 probe from being correlated with subsequent malicious activity, marking the event as low priority. Retrospective analysis established that the probe was the initial phase of the subsequent intrusion.

Intrusion timeline

Initial access validation phase Vulnerability fingerprinting

A vulnerability fingerprinting request on December 20 marked the first observed interaction with the target. The request originated from infrastructure associated with ONYPHE, an internet-scale attack surface discovery and management platform for identifying exposed assets, vulnerabilities, and cyberthreats. Unlike widely used tools such as Shodan and Censys, which merely provide a list of internet-facing assets correlated with the open-source data about known vulnerabilities, ONYPHE actually checks if the target system is vulnerable.

Fingerprinting with ONYPHE

The request characteristics were consistent with ONYPHE’s vulnerability checks, which use active, non-intrusive probes to identify internet-exposed systems vulnerable to specific CVEs. For ToolShell, ONYPHE adopted the approach used by Niels Hofmans (hazcod). Namely, it attempts to inject a harmless marker into the target server to find out if it is vulnerable.

OFFICIAL ONYPHE CVE CHECKER (TOOLSHELL)

This phase served as a validation step against the SharePoint execution surface exposed over HTTP:

• The target processed structured requests through the ASP.NET pipeline without rejection.
• The request path reached application logic capable of handling serialized input.
• No defensive controls interrupted or altered the execution flow at the application boundary.

Approximately 12 minutes later, a second inbound connection originated from infrastructure associated with Pfcloud UG, a provider operating under a bulletproof hosting (BPH) model. Given the timing and the IP’s documented history of scanning and abusive activity, the connection may represent follow-on reconnaissance against the newly identified target. No exploitation was attempted at this stage.

A connection from an IP address belonging to Pfcloud UG BPH

Active exploitation: Santa took your data and left a backdoor

The main malicious activity occurred on December 24. The actor targeted the same SharePoint host with a crafted request from 45.91.94.204 (45.91.92.0/22, ASN 63473, HostHatch, LLC). This resulted in a webshell execution within the IIS worker process (w3wp.exe). The payload was not written to disk; rather, it was loaded directly into the ASP.NET runtime and used during subsequent request processing. The implant remained resident for the lifetime of the affected application domain. This runtime state was lost when the application pool was recycled or IIS was restarted.

Attack originated from an SPN node

The IP address 45.91.94.204 is a Safing Privacy Network (SPN) node. SPN routes each connection through a multilayer VPN path with multiple relay nodes that can obscure the originating IP.

SPN promotes itself as a network that offers strong privacy protection for internet traffic. Its infrastructure resembles Tor’s in many ways, but with some differences. It features the following capabilities:

• Speed: Near-VPN performance for high-speed data transfer.
• Layer 3 support: Supports multiple protocols like TCP, UDP, ICMP (unlike Tor, which only supports TCP).
• App-routing: Direct tunneling without a browser.
• Multi-identity: Simultaneous exit nodes to bypass IP rate limits.
• Fixed-size packets and padding make it harder to analyze its traffic.

It is less common than Tor, and frequently bypasses standard Tor blocklists.

Webshell architecture

The webshell the attackers injected into the w3wp.exe runtime is a multi-module in-memory framework, where execution is orchestrated through the main component (G.cs) and extended via multiple functional units across namespaces.

The implementation follows a modular C# project structure in which each capability is isolated into its own compilation unit and invoked dynamically at runtime.

Webshell components

“G.cs” pipeline control and C2 Pipeline control

The main webshell component is G.cs. It orchestrates the implant’s execution context, lifecycle, C2 and session management.

To ensure persistence within the runtime, G.cs performs the following actions:

• Registers a custom VirtualPathProvider using the non-public RegisterVirtualPassProviderInternal method from the ASP.NET HostingEnvironment class so that ASP.NET uses it for virtual-path processing. The provider is automatically added to the chain of registered virtual path providers.
  
• Delegates the provider’s .NET Remoting lifetime policy to the previous provider in the chain, preserving the existing lifetime behavior.
  

Additionally, to evade defenses and enable the VirtualPathProvider to be registered even if the application in whose AppDomain the webshell is running is precompiled, the module implements the trust control subversion (T1553) technique:

• Uses reflection to check if the application is precompiled.
• Extracts pointers for internal state fields for the BuildManager class, which manages application compilation, and modifies them at runtime.
  
• Uses reflection once again to force runtime injection.

G.cs uses the GetCacheKey() function as the interception point for the virtual path processing flow. It processes incoming requests to the SharePoint server and checks their headers to filter out requests from the attacker.

The specific User-Agent in the request headers triggers the webshell execution. If the request doesn’t match this condition, the implant remains dormant, making its traffic harder to recognize.

Command and control layer (in-memory transport)

The same core module (G.cs) implements the communication layer.

Instead of relying on external frameworks or standard beacons, it uses a custom binary protocol with XOR-based obfuscation to exchange data with the C2. These communications blend into normal application traffic. The module uses the GetCacheKey() hook to intercept standard HTTP requests. When a specific User-Agent is detected in the request headers, the module parses it, extracts the payload, and establishes a TCP connection to a target host inside the target’s network if needed.

Bidirectional TCP tunnel initialization

G.cs establishes a full-duplex proxy tunnel to support interactive control. It stores active target sockets in memory to pair concurrent HTTP read and write channels.

TCP connections from the C2 server to arbitrary hosts inside the target network are supported for pivoting and lateral movement. The traffic is proxied through the SharePoint host.

Target-to-attacker data channel

Attacker-to-target data channel

As can be seen in the screenshots, the attackers used the suo5 tool to implement traffic proxying. Its authors promote it as a stable forward-proxying tool for scenarios where outbound internet connections are prohibited.

To increase its performance, G.cs manipulates ThreadPool by raising its limits for concurrent operations and maximum timeout.

ThreadPool manipulation

“Prog.cs”: Execution entry point and task dispatcher

Prog.cs is the entry point that receives command-line arguments and passes them to uk/London.cs. The latter acts as the orchestrator, handling command parsing and privilege escalation (via named pipe impersonation). We’ll review it in more detail later. If the “suo5” command is provided, London.cs triggers G.cs to hook into the ASP.NET runtime as a memory shell. Once active, G.cs independently processes incoming web traffic inside the web server memory.

Host interaction modules

The following modules provide direct system interaction capabilities, each implemented as a separate unit. London.cs triggers these modules when it receives a corresponding command from Prog.cs.

“FileDownloader.cs”

The FileDownloader.cs module downloads arbitrary files from external URLs provided by the C2. It stores the downloaded files in the Program Data directory without any user interaction.

“LoggedOnUsers.cs”

This module enumerates logged-on users and identifies their session types (interactive, service, remote). The results are stored in memory. The attackers can retrieve them using the proxy and tunneling capabilities provided by G.cs.

“ProcessList.cs”

This module lists running processes with full paths to the corresponding executables on the disk. The results are stored in memory and the attackers can retrieve them via G.cs.

“NetworkInfo.cs”

This module extracts information about existing network connections, including protocols, local and remote IPs and ports, and connection state. It also enumerates network interfaces and headers. The results are stored in memory and can be retrieved by the attackers via G.cs.

“MSI.cs”

This module silently installs and executes MSI packages previously downloaded by FileDownloader.cs.

“User.cs”

This module creates administrative accounts using the native SAM RPC subsystem (SAMRPCNative namespace) rather than standard command-line tooling. This may indicate an attempt to evade detection and provide the attackers with privileged stealthy access to target systems that persists after the webshell has finished its work.

SAMRPCNative

The SAMRPCNative namespace implements a low-level C# P/Invoke wrapper for the native Windows samlib.dll library, comprising three types: SAMStructs.cs, SAMMethods.cs, and SAMEnums.cs.

“SAMEnums.cs”

Implements structured bitwise lists and constant flags mapping numeric codes to their security meaning in SAM, and translates system status return codes.

“SAMStructs.cs”

Defines native data structures required for P/Invoke memory alignment and for marshalling. It securely formats and aligns data structures.

“SAMMethods.cs”

Contains external API declarations (P/Invoke) imported from samlib.dll to perform actions such as connecting to the SAM server, creating users and opening domains.

This layer is crucial for the attackers because it enables account operations.

Privilege escalation

The uk namespace contains offensive primitives for privilege escalation. To elevate privileges to SYSTEM, it uses a local token impersonation technique via the Encrypting File System Remote Protocol (EFSRPC) interface adopted from the EfsPotato tool.

This functionality is implemented in the uk/London class. It creates a malicious named pipe while the EfsrTiny class (a tiny version of the EfsPotato tool) connects to the LSASS.exe RPC server. Then it’s London.RpcThread function calls the EfsRpcEncryptFileSrv function from EfsrTiny with a crafted \\localhost path. This tricks LSASS.exe into connecting back to the attacker’s named pipe. Finally, the London.Exp function uses ImpersonateNamedPipeClient to coerce and impersonate the LSASS.exe token and spawn a new process via CreateProcessAsUser with SYSTEM privileges. As the webshell resides in the IIS worker process, it has the necessary SeImpersonatePrivilege to perform this technique.

The uk namespace also implements a minimal MSRPC client layer by explicitly defining structures such as RPC_CLIENT_INTERFACE and MIDL_STUB_DESC, thereby spoofing an interface stub. This enables direct interaction with the Windows RPC runtime (Rpcrt4.dll) without relying on MIDL-generated stubs or higher-level RPC abstractions. This provides direct control over binding and marshaling that goes beyond the constraints of standard client APIs.

Post-exploitation activity

Shortly after the webshell injection, the infected worker process spawned msiexec.exe to install a remote MSI payload hosted in Supabase cloud storage. The payload was Velociraptor, an open-source digital forensics and incident response tool – namely version 0.73.4.0 vulnerable to CVE-2025-6264 – that the attackers abused for command execution on the target network.

In October 2025, Cisco Talos reported Velociraptor being leveraged by threat actors as a post-compromise execution framework and attributed this activity to Storm-2603. This tool enables arbitrary command execution, and can be used for various purposes. In our case, it was used for persistence, discovery, data collection and payload execution.

The threat actor used Velociraptor to deploy multiple independent tunneling mechanisms, including Zoho Assist-Unattended Support for unauthorized remote access, VS Code CLI tunneling, Cloudflare Tunnel, and a lightweight reverse proxy utility. By doing so, they attempted to maintain access even if some of their tools were detected and deleted. At this stage, they also no longer depended on the IIS worker process lifecycle and ToolShell vulnerability.

EDR-killing attempts

Once the threat actor had access to the target system, they were able to upload a vulnerable driver that is used by many attackers to terminate EDR solutions. We were able to detect the main driver at C:\programdata\rsndispot.sys (054a32d6033b1744dca7f49b2e466ea2). In addition, the adversary used a malicious DLL (2d9ebf9c042f596f435865b40edad928) in a sideloading attack. This DLL was identified as Warlock ransomware’s AV killer. It was possibly intended to kill security solutions using the vulnerable rsndispot.sys driver.

Ransomware deployment attempt

The attackers made attempts to launch ransomware on the compromised system. However, the Proactive Defense Module in Kaspersky Endpoint Security blocked the ransomware process, effectively preventing this activity. The malware DLL we obtained was identified as Warlock ransomware.

What defenders really need to look for ToolPane deserialization and CLR artifacts

When the attackers tried to access ToolPane, both the dynamically compiled App_Web_toolpane.aspx assembly and the Microsoft.GeneratedCode helper assembly were present within the same application domain.

Both assemblies are used in legitimate scenarios. App_Web_* assemblies are generated during normal ASP.NET page compilation, while Microsoft.GeneratedCode is typically produced by the XmlSerializer during legitimate serialization workflows. However, a request to the ToolPane endpoint that results in immediate loading of Microsoft.GeneratedCode within the same execution window indicates that the runtime is processing serialized data supplied through the request.

Detecting deserialization exploitation

First, it is highly recommended to read this article (in Russian) on how deserialization exploit attempts in the CLR should be detected, with examples of YARA rules and monitoring recommendations. A summary of the main idea of the detection logic is provided below.

Deserialization vulnerabilities should be treated as a distinct class of exploitation events. In the CLR, deserialization is not merely the conversion of bytes into values – it is the reconstruction of an object graph from an incoming stream. Serialization and deserialization are performed by formatters. One of the most widely used formatters is BinaryFormatter. It uses the NRBF format, which defines the stream as a sequence of records describing classes, arrays, primitives, and references between objects. The shape of the resulting graph is determined by the data supplied to the deserializer. This means that the input stream defines not only the values but also the specific types, relationships, and lifecycle points that the runtime must materialize.

Microsoft states explicitly that BinaryFormatter is unsafe and cannot be made safe; beginning with .NET 9, the in-box implementation is effectively removed from ordinary use. However, Microsoft continues to use it in its products, including SharePoint, because it is powerful and easy to use. To fix BinaryFormatter-related issues, architectural changes are needed. Similar warnings also apply to related unsafe mechanisms, including LosFormatter (used in the vulnerable page).

The primary risk of unsafe deserialization is that the CLR may resolve unexpected types, instantiate objects outside normal constructor invariants, and invoke special lifecycle mechanisms such as ISerializable, IObjectReference, IDeserializationCallback, and methods marked [OnDeserialized]. In other words, the attacker-controlled data can force the runtime to construct a graph containing types with executable side effects.

A practical detection strategy should therefore focus on graph-construction artifacts. CLR loader events identify the relevant assemblies and application domains. Memory and metadata inspection then reveal the type names and generated serializer structures associated with the suspected gadget chain. In ToolShell-like scenarios, unsafe deserialization usually produces helper assemblies (evidence in loader events) with metadata containing fully qualified type names, gadget class names, and string representations of the constructed generic types (just scan via YARA for it). In our case, the artifacts to look for include Microsoft.GeneratedCode, App_Web_toolpane.aspx* (evidence of deserialization in loader events) as well as strings identifying ObjectDataProvider, ExpandedWrapper, and LosFormatter (evidence that the input stream was deserialized into dangerous objects). Note that these indicators are not significant in isolation; their value lies in the fact that they show the runtime has already received data requiring helper code generation to reconstruct a dangerous object graph.

Gadget objects that exploit vulnerabilities like those associated with ToolShell are conveniently represented in corpus-style tooling such as ysoserial.net/YSoNet, which aggregate known gadget chains for unsafe .NET deserialization. For defensive purposes, the value of these projects lies not in their offensive capability but in the catalog of types and structures that can be searched for in streams, memory, and helper assemblies. The presence of any of them in memory or in a helper assembly should be treated as a strong indicator of exploitation.

To simplify deserialization exploit detection, we created a tool named CLRDeserializationExploitFinder. It can detect ToolShell exploitation attempts, as well as other gadget chains covered by ysoserial.net.

Detecting a VPP-based webshell/runtime implant

A mechanism based on VirtualPathProvider should be treated as a separate class of runtime implant (no files involved). In ASP.NET, HostingEnvironment.RegisterVirtualPathProvider registers a new virtual-path provider (VPP) in the application’s compilation system. Once registered, the application can serve virtual paths during dynamic compilation as though they were ordinary on-disk pages. Dynamic compilation does not require the payload to exist as a file in the filesystem. It operates entirely within the trust boundary of the application itself. During the compilation process, temporary files may be generated, but they cannot be treated as reliable forensic artifacts. Because VPPs can also be used for legitimate purposes, the defensive model should begin with an inventory of the legitimate VirtualPathProvider implementations. In all other cases, the registration or use of a new VPP should be considered anomalous.

To see how the dynamic generation of virtual pages using ASP.NET, IIS, and the CLR works, and to learn how to detect such activity, use our project VirtualPathProvider Lab.

The most useful telemetry source for this technique is the Microsoft-Windows-IIS-Configuration ETW provider. To detect virtual paths, events 25 and 47 are of primary value. Event 25 records the mapping of ConfigPath to PhysicalPath, and event 47 records the mapping of the configuration path to a directory. In the case of a VPP-backed path, these events create an inconsistency: IIS and ASP.NET behave as if the path has a physical representation, while the corresponding file does not exist on disk. In the example provided by VirtualPathProvider Lab, this appears as a mapping of the virtual resource googlecheck.aspx to a physical path where no real file is present. This discrepancy between configuration resolution and filesystem reality is the primary indicator of virtual content.

The second indicator is more negative than positive. For disk-backed files, IIS normally creates a FileChangeNotificationMonitor chain, as reflected in events 17, 18, 19, and 21. For virtual paths served by a custom VirtualPathProvider, this chain is absent or does not match the normal profile of an ordinary file because there is no physical object or corresponding on-disk change lifecycle. Consequently, the presence of positive events 25 and 47 combined with the absence of the expected events 17, 18, 19, and 21 for the same path forms a reliable detection pattern: the path exists for IIS as a configuration-resolved resource, yet it is not backed by the filesystem and is not accompanied by normal file-change monitoring.

To sum up, the hunting target here is the discrepancy between how IIS/ASP.NET resolves a resource and what is actually present on the disk and in the change-monitoring chain. For known applications, such cases can be filtered through an allowlist of legitimate VirtualPathProvider implementations. Anything else should be treated as a potential runtime implant and examined using ETW, filesystem verification, and memory inspection of the w3wp.exe process.

Attribution

Microsoft tracks Storm-2603 as a standalone threat actor with no known links to other groups. While they are careful about assessing the actor’s motivation, they mention that it has previously deployed Warlock and LockBit ransomware following active exploitation of on-premises SharePoint vulnerabilities. In the analyzed incident, we observed similar SharePoint exploitation activities, as well as an EDR killer associated with Warlock ransomware and unsuccessful Warlock launch attempts.

Other documented intrusions have identified Storm-2603 as leveraging known flaws within perimeter mail gateways to achieve initial access, subsequently staging the Velociraptor framework with elevated privileges and establishing persistent encrypted tunnels via commercial remote management software to orchestrate secondary lateral movement. This aligns with the post-exploitation behavior we observed in our case. Together with the ToolShell exploitation scenario, this allows us to attribute this case to Storm-2603 with moderate confidence.

Conclusion

From the incident analyzed in this article, the main defensive lesson is that exploiting an internet-facing SharePoint server can enable fileless code execution directly inside the application trust boundary. Storm-2603 did not require a conventional dropper, persistent service, or exposed C2 endpoint; instead, it deployed a webshell inside w3wp.exe, from which tunneling, privilege escalation, credential access, and lateral movement could be orchestrated. Detection therefore needs to move beyond file-based webshell hunting toward runtime behavior, such as anomalous w3wp.exe activity, unexpected outbound connections, RPC coercion, token impersonation, and the introduction of remote-management or DFIR tooling after application compromise.

To correctly attribute malicious activity and develop appropriate response measures, defenders should reconstruct execution chains and temporal relationships across application, host, and identity layers. They should also preserve memory and IIS telemetry, and correlate low-signal reconnaissance with subsequent privileged activity rather than evaluating events in isolation. A confirmed SharePoint exploit with code execution should trigger host-level containment, persistence hunting, credential and exposed MachineKey rotation, and TTP-driven investigation rather than remediation limited to the initial exploit or known IOCs.

Kaspersky products detect the threats mentioned in this article as:

• Trojan.MSIL.Agent.gen
• Trojan.Win64.DLLhijack.cdp

Indicator of compromise Indicator of compromise Description 45.91.94[.]204 SPN node 0xFD91321BF7FF7245DDA9B7B5D791ACE8 vskp2 – webshell implant hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi Vulnerable Velociraptor package 0x3A55D8F8F29716C694671834D8C6CB29 C:\ProgramFiles\Velociraptor\Velociraptor.exe hxxps://auth[.]qgtxtebl[.]workers[.]dev/ Velociraptor server URL 199.232.210[.]172 C2 traffic relay 0x991EC6E04413F2D4D29341C17A8A54D5 Abused legitimate VS Code 0x3D553B9061C03F891CE97D7D2E64DDEE VS Code Insiders for tunneling 91.224.92[.]121 Bulletproof-hosted C2 server 49.51.132[.]100 SPN node hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64[.]msi Abused legitimate tunneling tool 0x2C32E44A013CBFC5A323EFB7694701D2 Abused tunneling tool executable hxxps://files[.]catbox[.]moe/8f7vex[.]msi Abused Zoho Assist Unattended Agent download URL 0x112A86ECA3CB5A0B5E20AB744CC5AF93 7z.exe renamed for sideloading 0xA930F81E3FB0A226EC5904D9043A17B8 C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z 204.76.203[.]219 Bulletproof-hosted C2 server 0x054a32d6033b1744dca7f49b2e466ea2 Vulnerable driver

Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. [...]

Apple has revealed that it plans to start checking public iCloud links for harmful content starting with iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3. The change specifically applies to scenarios where users share iCloud content, such as photos in iCloud Photos or files in iCloud Drive, by sharing a link and making it accessible to "Anyone with the link." When users choose this option,Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country. Describing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole. The earlier fix is the 2.90 Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A WordPress vulnerability is being used in attacks that target the moment a site updates its main software.

Two flaws in the Xen hypervisor can let a malicious virtual machine reach memory that belongs to other parts of the same computer. That includes the powerful management system used to control the other virtual machines. A break in that separation can put more than one virtual machine at risk. For people running several systems on the same computer, the concern is how far an attacker could reach from just one of them. The flaws were disclosed on November 3. Xen has published patches, and platf...

Hackers possibly linked to the Kremlin exploited previously patched iOS and Android flaws in an attempt to hack visitors of multiple websites, including one celebrating the 250th anniversary of American independence, researchers said Wednesday.

The attackers, which the researchers assessed with “moderate to high confidence” were part of Russia’s Foreign Intelligence Service, targeted other sites, many with links to that country’s ongoing war against Ukraine. The attacks began when iPhone or Android users visited one of potentially hundreds of different sites. JavaScript injected into the traffic then profiled the device. The final payloads, tailored to the type of platform visiting, attempted to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.

Wielding DarkSword

One of the impersonated sites was america250.org, belonging to a non-partisan group of lawmakers, business executives, and at least one former member of the Trump administration. The attackers registered america250[.]holiday and used it as a reverse proxy to america250.org. The imposter website delivered content from the real one but added malicious JavaScript into it.

Read full article

Comments

After alienating many long-time small- to medium-sized business (SMB) customers, Broadcom’s VMware is trying to appeal to its smaller customers.

Today, the virtualization company announced vSphere Express, a lower-end virtualization offering for organizations that require “cost-effective essential virtualization.”

vSphere Express comes after many customers reported that VMware was pushing them to VMware Cloud Foundation (VCF), the flagship private cloud bundle that has many features SMBs don’t need and is expensive. Some SMB users have reported that VMware sales representatives previously told them that vSphere Standard, VMware's prior entry-level virtualization offering, wasn’t available anymore.

Read full article

Comments