Stories first seen on 20 September 2026
Review the tracked stories and available summary evidence for the archived period shown.
Population: stories the tracker first saw on this Coordinated Universal Time (UTC) calendar day; publisher date is used only if first-tracked time is unavailable and remains on each item.
53 stories
- AI Security
Sponsored: SpecterOps on the impact of AI agents on BloodHound
SpecterOps Chief Product Officer Justin Kohler discusses how Entra Agent ID introduces new identity relationships and potential attack paths in BloodHound. The conversation explores the intersection of artificial intelligence (AI) agents and identity security tooling.
Why it matters: Security teams using BloodHound for identity attack path analysis need to understand how AI agents create new lateral movement vectors that existing mappings may not capture.
- Threat Intelligence
Malicious npm packages evade install-script defenses at runtime
An ongoing malware campaign involving the npm package 'indexed-btree' demonstrates how threat actors conceal malicious code in runtime behavior rather than installation scripts to circumvent supply chain protections. The campaign exploits the gap between when a package is installed and when its code actually executes, allowing obfuscated payloads to evade automated detection at setup time.
Why it matters: JavaScript developers and DevSecOps teams need to monitor runtime behavior of dependencies beyond installation phase, as traditional install-script defenses do not catch code executed after a package is imported into an application.
- AI Security
Researchers escape OpenAI Codex sandbox to run commands on host
Researchers demonstrated two methods to escape OpenAI's Codex sandbox, including one that executed commands on a developer's machine from the most restricted configuration. OpenAI has issued patches for both vulnerabilities.
Why it matters: Developers using Codex or similar code generation tools need to update to patched versions to prevent arbitrary code execution on their systems.
- Breaches and Incidents
Week in review: Cisco patches exploited email gateway 0-day, Revolut breach
A week-in-review digest covers Cisco's patch for an exploited email gateway zero-day vulnerability and a Revolut data breach in which an attacker impersonating a government agency obtained customer records. The collection also highlights DeepZero, an open-source tool for identifying vulnerable Windows kernel drivers.
Why it matters: Cisco customers running vulnerable email gateways face active exploitation and should apply patches immediately. Revolut customers may need to monitor accounts for fraud given the confirmed unauthorized access to sensitive data. Security teams evaluating driver security should review DeepZero as a hunting capability.
- Threat Intelligence
The DPRK strikes using a new variant of RUSTBUCKET
Security researchers identified a new variant of RUSTBUCKET malware attributed to North Korea with enhanced capabilities. The discovery includes technical details and detection methods to help organizations identify the malware in their environments.
Why it matters: Organizations face risk from this updated North Korean malware variant; security teams should review detection signatures and indicator of compromise (IOC) data to identify potential infections.
- Threat Intelligence
NAPLISTENER: more bad dreams from developers of SIESTAGRAPH
Elastic Security Labs identified that the threat actor behind SIESTAGRAPH has shifted focus from stealing data to establishing persistent access, developing new malware such as NAPLISTENER to avoid detection.
Why it matters: Organizations targeted by this group now face a higher risk of long-term compromise and lateral movement; defenders should prioritize detection of NAPLISTENER and monitor for persistent access mechanisms.
- Threat Intelligence
Initial research exposing JOKERSPY
Researchers discovered JOKERSPY, a campaign targeting financial institutions using Python backdoors. The article details reconnaissance techniques, attack patterns, and indicators for network detection of the campaign.
Why it matters: Financial institution security teams need to understand JOKERSPY's Python backdoor methods and detection signatures to identify and block this campaign in their environments.
- Research and Reports
Into The Weeds: How We Run Detonate
The article describes the technical architecture and operational processes of the Detonate system, covering sandbox creation, supporting infrastructure, telemetry collection, and detonation methods. This piece provides an inside look at how the malware analysis platform functions and collects data from test executions.
Why it matters: Security teams using Detonate or similar sandboxed detonation environments should understand the underlying system design to optimize malware analysis workflows and interpret telemetry results accurately.
- Threat Intelligence
Elastic charms SPECTRALVIPER
Elastic Security Labs identified three malware families, P8LOADER, POWERSEAL, and SPECTRALVIPER, deployed against a Vietnamese agribusiness. The attack shares characteristics with activity attributed to REF2754, REF4322, and APT32 groups.
Why it matters: Organizations in Vietnam and the agriculture sector face targeted intrusions by established threat actors; monitor for these malware families and update detections accordingly.
- Threat Intelligence
Elastic Security Labs steps through the r77 rootkit
Elastic Security Labs analyzed a campaign using the r77 rootkit, which has been observed deploying the XMRIG cryptocurrency miner. The research documented the rootkit's modular components and their role in delivering additional malicious payloads.
Why it matters: Security teams should understand r77's capabilities and deployment chain to detect and respond to infections that may establish persistence and launch cryptomining or follow-on attacks.
- Threat Intelligence
Elastic Security Labs discovers the LOBSHOT malware
Elastic Security Labs identified a new malware family called LOBSHOT that spreads through Google Ads and hosted virtual network computing (hVNC) sessions. The malware disguises backdoors as legitimate application installers to establish persistent access on compromised systems.
Why it matters: Organizations and users downloading software via online ads face infection risk; security teams should monitor for LOBSHOT indicators and educate users on installer verification.
- Research and Reports
Exploring Windows UAC Bypasses: Techniques and Detection Strategies
A research article examines techniques for bypassing Windows User Account Control (UAC), analyzing the underlying primitives that enable these bypasses and identifying detection methods. The work provides both offensive insights into UAC evasion and defensive strategies for identifying such attempts.
Why it matters: Security teams and incident responders need to understand UAC bypass techniques to detect privilege escalation attempts and strengthen endpoint protections against unauthorized access.
- Breaches and Incidents
Elastic users protected from SUDDENICON’s supply chain attack
Elastic Security Labs published a triage analysis to help 3CX customers identify SUDDENICON, a supply chain compromise affecting 3CX Voice over IP (VoIP) softphone users. The analysis aids in initial detection of the potential threat.
Why it matters: 3CX customers and organizations using 3CX VoIP softphones need to implement detection measures immediately to identify compromised systems and assess their exposure to the supply chain attack.
- Threat Intelligence
Attack chain leads to XWORM and AGENTTESLA
A multi-stage malware campaign uses deceptive documents to trick users into initiating an attack chain that delivers XWORM and AGENTTESLA payloads. The campaign leverages social engineering to appear legitimate and lower user defenses.
Why it matters: Organizations and users are at risk from document-based delivery mechanisms; security teams should warn staff about suspicious files and consider blocking or sandboxing Office documents from untrusted sources.
- Threat Intelligence
Effective Parenting - detecting LRPC-based parent PID spoofing
This research examines detection methods for Local Remote Procedure Call (LRPC) based parent process ID spoofing attacks, which evade traditional process creation monitoring. The study reviews weaknesses in current detection approaches and explores generic detection strategies for this evasion technique.
Why it matters: Security teams using process creation monitoring and endpoint detection tools need to understand LRPC-based spoofing evasion methods to improve their detection coverage and respond to advanced threats that manipulate parent process information.
- Threat Intelligence
REF2924: how to maintain persistence as an (advanced?) threat
Elastic Security Labs documented persistence techniques employed by a threat group responsible for SIESTAGRAPH, NAPLISTENER, and SOMNIRECORD malware families. The analysis reveals methods the group uses to maintain long-term access to compromised systems.
Why it matters: Defenders using Elastic or similar detection tools should review these persistence mechanisms to identify and block similar techniques in their environments; organizations may already host this group's malware without realizing it.
- Threat Intelligence
Not sleeping anymore: SOMNIRECORD's wake-up call
Elastic Security Labs researchers identified SOMNIRECORD, a new C++ backdoor malware that disguises its command and control (C2) communications as DNS traffic. The malware establishes persistent remote access to infected systems while evading detection through protocol obfuscation.
Why it matters: Organizations running systems in Elastic environments should hunt for DNS anomalies and C2 beaconing patterns to detect SOMNIRECORD infections before attackers establish persistence.
- Threat Intelligence
Thawing the permafrost of ICEDID Summary
Elastic Security Labs analyzed a recent ICEDID variant that functions as a loader and bot payload, documenting the malware's execution chain, capabilities, and design. The research was published to help the security community understand how the threat operates.
Why it matters: Practitioners defending against banking trojans and botnet infections should familiarize themselves with ICEDID's current techniques to detect and block the infection chain before payload execution.
- Threat Intelligence
PHOREAL Malware Targets the Southeast Asian Financial Sector
Elastic Security identified PHOREAL malware actively targeting financial organizations in Southeast Asia, with a focus on Vietnamese institutions. The malware represents a regionalized threat to the financial services sector in that geography.
Why it matters: Financial institutions in Southeast Asia, especially Vietnam, need to assess exposure to PHOREAL and update detection rules, as this malware specifically targets their sector.
- Threat Intelligence
Twice around the dance floor - Elastic discovers the PIPEDANCE backdoor
Elastic Security Labs identified an active intrusion targeting a Vietnamese organization using a newly discovered backdoor named PIPEDANCE. The multi-hop malware supports stealthy operations and enables remote attackers to maintain persistent access through named pipes and other obfuscation techniques.
Why it matters: Organizations in Vietnam and those connected to Vietnamese networks face immediate risk from PIPEDANCE; security teams should hunt for indicators of compromise associated with this backdoor and review access logs for suspicious named pipe communications.
- Vulnerabilities and Patches
Sandboxing Antimalware Products for Fun and Profit
A flaw in Windows allows attackers to bypass a security mechanism designed to protect anti-malware products from attack. The vulnerability demonstrates how sandboxing protections can be circumvented to target security software.
Why it matters: Organizations relying on anti-malware products are exposed to bypass techniques that could disable or undermine endpoint protection, requiring immediate assessment of affected Windows versions and anti-malware implementations.
- Threat Intelligence
QBOT Malware Analysis
Elastic Security Labs published a malware analysis report on QBOT that details its execution chain. The report includes a YARA rule, configuration extraction tool, and indicators of compromise (indicator of compromise (IOC)) for detection and response.
Why it matters: Security teams defending against QBOT can use the published YARA rule and IOCs to detect and block this malware in their environments.
- Ransomware and Leak Sites
CUBA Ransomware Malware Analysis
Elastic Security published a technical analysis of the CUBA ransomware family, documenting its malware capabilities and detailing defensive countermeasures. The research provides operational and tactical detail for security teams encountering this threat.
Why it matters: Defenders using Elastic or managing enterprise endpoints need this analysis to identify indicators of compromise (indicator of compromise (IOC)), understand attack techniques, and improve detection and response to CUBA variants.
- Threat Intelligence
Update to the REF2924 intrusion set and related campaigns
Elastic Security Labs published updated findings on the REF2924 intrusion set, expanding on research originally released in December 2022 with new malware analysis, additional discoveries, and connections to related intrusions.
Why it matters: Security teams tracking advanced persistent threats need current intelligence on REF2924 campaigns and their tooling to detect and respond to associated attacks in their environment.
- Research and Reports
Finding Truth in the Shadows
The article examines hardware stack protections, outlining three additional benefits beyond direct exploit mitigation and noting their limitations.
Why it matters: Security practitioners implementing or evaluating hardware-level defenses should understand the broader value and constraints of stack protections in their threat model.
- Research and Reports
FLARE-ON 9 Solutions
FLARE-ON 9 featured 11 reverse engineering challenges across various binary types. Elastic Security Labs published detailed solutions for the competition challenges.
Why it matters: Practitioners developing or improving reverse engineering skills and malware analysis capabilities can learn from documented solutions to real-world challenge scenarios.
- Cloud and SaaS Security
Google Workspace Attack Surface
This article introduces a multipart series on Google Workspace security, covering what the platform is and common associated risks. The content aims to help organizations understand and manage enterprise resource security within the platform.
Why it matters: Google Workspace administrators and security teams need to understand configuration and usage risks in order to reduce exposure in this widely deployed collaboration platform.
- Threat Intelligence
SiestaGraph: New implant uncovered in ASEAN member foreign ministry
Elastic Security Labs identified a new implant called SiestaGraph deployed against a foreign ministry in an ASEAN member nation. The attack chain combined Microsoft Exchange exploits, web shells, and the SiestaGraph implant to establish persistence, escalate privileges, and steal data. Multiple threat actors are believed to be leveraging this toolset.
Why it matters: Government and diplomatic organizations worldwide are targeted; practitioners should review Exchange access logs and hunt for SiestaGraph indicators of compromise (IOCs) to detect similar intrusions.
- Threat Intelligence
Get-InjectedThreadEx – Detecting Thread Creation Trampolines
A blog post presents detection methods for four classes of process trampolining techniques and releases an updated PowerShell script called Get-InjectedThreadEx to identify these attacks.
Why it matters: Defenders need practical detection tools for thread injection and code injection attacks that abuse process trampolining to evade traditional monitoring.
- Threat Intelligence
Operation Bleeding Bear
Elastic Security identified a new destructive malware campaign targeting Ukraine, designated Operation Bleeding Bear. The discovery represents a verification of emerging threats in the region's cybersecurity landscape.
Why it matters: Organizations with operations or connections to Ukraine face direct risk from this destructive malware; security teams should review Elastic's findings and update detection rules accordingly.
- Threat Intelligence
Exploring the REF2731 Intrusion Set
Elastic Security Labs identified REF2731, a five-stage intrusion set that deploys the PARALLAX loader and NETWIRE remote access trojan (RAT). The campaign chains these tools together across its attack stages.
Why it matters: Defenders tracking PARALLAX and NETWIRE activity should correlate findings with REF2731 tactics to identify and disrupt the full infection chain.
- Research and Reports
Deep dive into the TTD ecosystem
Microsoft's Time Travel Debugging (TTD) technology was the subject of independent research published as the first article in a series. The research provides a detailed examination of the TTD ecosystem and its capabilities.
Why it matters: Security researchers and developers using Windows debugging tools should understand TTD's architecture and potential security implications for their environments.
- Threat Intelligence
KNOTWEED Assessment Summary
KNOTWEED deploys Subzero spyware by exploiting zero-day flaws in Adobe Reader and Windows to establish initial access. After compromise, the actor leverages different modules of Subzero to maintain persistence and execute commands on affected systems.
Why it matters: Organizations running Adobe Reader and Windows are exposed to zero-day exploitation by a sophisticated threat actor; patches may not yet exist, making detection and network monitoring critical.
- Threat Intelligence
Doing time with the YIPPHB dropper
Elastic Security Labs documented the tactics of the REF4526 intrusion set, which deploys a multi-stage attack chain using Unicode icons embedded in PowerShell scripts to deliver a loader, dropper, and remote access trojan (RAT) implants. The analysis traced the infection flow and technical characteristics of this malicious infrastructure.
Why it matters: Defenders responsible for PowerShell security and payload detection should understand this obfuscation technique, as the Unicode-based encoding may evade signature-based controls and require behavioral monitoring to identify.
- Threat Intelligence
ICEDIDs network infrastructure is alive and well
Elastic Security Labs examined the command and control infrastructure of the ICEDID botnet using open source data collection tools and the Elastic Stack. The analysis demonstrates that ICEDID's network infrastructure remains active and operational.
Why it matters: Organizations targeted by or monitoring ICEDID should understand the botnet's infrastructure characteristics to improve detection and response capabilities.
- Threat Intelligence
BUGHATCH Malware Analysis
Elastic Security conducted a technical analysis of BUGHATCH malware, documenting its capabilities and identifying defensive countermeasures. The analysis provides actionable insights for detecting and mitigating the threat.
Why it matters: Organizations running systems targeted by BUGHATCH need this analysis to understand attack patterns and strengthen defenses against active exploitation.
- Threat Intelligence
Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER
Elastic published analysis of HERMETICWIPER, a data wiper malware targeting Ukrainian organizations. The research documents the malware's capabilities and behavior to aid in detection and defense.
Why it matters: Ukrainian organizations and defenders monitoring threats in Eastern Europe need this analysis to identify and block HERMETICWIPER attacks before data destruction occurs.
- Ransomware and Leak Sites
CUBA Ransomware Campaign Analysis
Elastic Security identified a ransomware and extortion campaign delivering CUBA ransomware through a combination of offensive security tools, living-off-the-land binaries and scripts (LOLBAS), and exploits. The campaign demonstrates use of legitimate system tools alongside malicious payloads to evade detection and establish persistence.
Why it matters: Organizations running vulnerable systems without network segmentation and endpoint monitoring are at risk of CUBA ransomware infection; security teams should review logs for exploitation patterns and offensive tool usage associated with this campaign.
- Ransomware and Leak Sites
LUNA Ransomware Attack Pattern Analysis
A research publication analyzes LUNA, a cross-platform ransomware variant, and its attack patterns. The analysis documents the technical characteristics and operational behavior of this malware family.
Why it matters: Security teams should understand LUNA's cross-platform capabilities and attack methods to detect and respond to infections in their environments.
- Threat Intelligence
Exploring the QBOT Attack Pattern
Researchers analyzed the QBOT malware family, documenting its features and attack patterns. The analysis characterizes QBOT as a prolific and capable threat with a range of capabilities.
Why it matters: Security teams should understand QBOT's behaviors and infection vectors to detect and respond to compromises involving this malware family.
- Threat Intelligence
Elastic Security uncovers BLISTER malware campaign
Elastic Security discovered active intrusions using BLISTER, a newly identified malware loader that employs legitimate code-signing certificates to bypass security controls. The company released detection guidance to help security teams defend against the campaign.
Why it matters: Security teams need to deploy updated detections for BLISTER to block this evasion technique, which abuses trusted code signatures to establish persistence in targeted environments.
- Threat Intelligence
A peek behind the BPFDoor
Researchers analyzed BPFDoor, a Linux-focused backdoor designed to maintain access in compromised systems. The malware leverages Berkeley Packet Filter (BPF) technology to establish persistence on targeted hosts.
Why it matters: Linux infrastructure owners and defenders need to understand BPFDoor's techniques to detect and prevent re-infection of systems already compromised or under attack.
- Threat Intelligence
A close look at the advanced techniques used in a Malaysian-focused APT campaign
Elastic Security's research team analyzed an advanced persistent threat (APT) campaign targeting Malaysia, documenting the threat actor behind the activity, attack methodology, and tactics aligned with the MITRE ATT&CK framework. The analysis includes indicators of compromise (IOCs) for detection and response.
Why it matters: Security teams in Malaysia and those defending Asian infrastructure should review the disclosed IOCs and attack techniques to detect similar intrusions in their environments.
- Threat Intelligence
Playing defense against Gamaredon Group
Gamaredon Group, a Russia-based threat actor, has conducted recent campaigns targeting organizations. The article outlines the group's activity and provides detection strategies for defenders.
Why it matters: Security teams defending against Russian threat actors need tactical detection guidance to identify and block Gamaredon Group activity.
- Threat Intelligence
Going Coast to Coast - Climbing the Pyramid with the Deimos Implant
The Deimos implant, first reported in 2020, continues active development with sophisticated anti-analysis capabilities. The article describes the tactics, techniques, and procedures (TTPs) of campaigns using this malware and provides associated indicators of compromise (IOCs).
Why it matters: Defenders and threat hunters need to know the Deimos campaign TTPs and IOCs to detect and respond to this ongoing threat in their networks.
- Threat Intelligence
FORMBOOK Adopts CAB-less Approach
Security researchers observed a FORMBOOK intrusion attempt using a new technique that eliminates the need for a command and control (C2) server intermediary. The malware campaign demonstrates an evolution in the threat actor's infrastructure approach, potentially making detection and attribution more difficult.
Why it matters: Organizations running endpoint detection and response (EDR) and network monitoring tools need to update signatures and behavioral rules, as FORMBOOK's CAB-less variant may bypass C2-based detection methods commonly used to identify this malware family.
- Ransomware and Leak Sites
Ransomware, interrupted: Sodinokibi and the supply chain
Elastic Endpoint Security's behavior-based protections blocked a targeted ransomware attack across multiple endpoints. The incident involved Sodinokibi ransomware and highlighted supply chain attack vectors.
Why it matters: Organizations using vulnerable endpoint solutions are at risk from Sodinokibi attacks through supply chain compromises; this demonstrates the need for behavior-based detection and response capabilities.
- Breaches and Incidents
Okta and LAPSUS$: What you need to know
Okta experienced a breach involving the LAPSUS$ group. The article provides threat hunting steps for security teams responding to the incident using Elastic tools.
Why it matters: Okta customers and administrators need to hunt for indicators of compromise in their environments immediately, as the identity platform breach could expose authentication systems and user access.
- Vulnerabilities and Patches
Nimbuspwn: Leveraging vulnerabilities to exploit Linux via Privilege Escalation
The Microsoft 365 Defender team disclosed multiple vulnerabilities affecting Linux systems that enable privilege escalation attacks. These flaws permit adversaries to deploy payloads, ransomware, or conduct further malicious activities on compromised hosts.
Why it matters: Linux administrators and organizations running Linux workloads need to identify and patch these vulnerabilities to prevent attackers from escalating privileges and delivering ransomware or other malware.
- Threat Intelligence
Collecting and operationalizing threat data from the Mozi botnet
The Mozi botnet targets unsecured and vulnerable networking devices as an ongoing malware campaign. This post documents the process of collecting, analyzing, and operationalizing threat data gathered from the botnet.
Why it matters: Network administrators and security teams need to understand Mozi indicators and collection methods to detect and defend against infections targeting their routers and network equipment.
- Identity and Access
Testing your Okta visibility and detection with Dorothy and Elastic Security
Dorothy is a tool that enables security teams to test their visibility and detection capabilities within Okta environments. The post addresses a gap in monitoring identity and access management (IAM) solutions, which are common attack targets but often lack adequate detection.
Why it matters: Security practitioners managing Okta deployments need to validate their detection coverage against IAM attacks, as weak monitoring in this area leaves environments exposed to adversary compromise.
- Research and Reports
Practical security engineering: Stateful detection
This article discusses stateful detection as a security engineering practice, explaining how formalizing stateful rules and processes can expand detection coverage for both current and historical matches. The piece advocates for implementing stateful detection as a foundational concept in security operations.
Why it matters: Security teams responsible for detection engineering need to understand stateful approaches to improve their rule coverage and catch both future and past threats more effectively.
- Threat Intelligence
Embracing offensive tooling: Building detections against Koadic using EQL
Security practitioners can build behavioral detections for the Koadic post-exploitation framework using Event Query Language (EQL). The article discusses detection methodologies rather than a specific vulnerability, incident, or threat actor activity.
Why it matters: Defenders need detection strategies for Koadic to identify and respond to post-exploitation activity in their environments.