ASEC found Larva-26009 targeting MS-SQL servers to deploy VShell, GotoHTTP, SoftEther, and XMRig, using remote control and proxy tools to maintain access and mine cryptocurrency. The attack also involved web shells, credential theft attempts, privilege escalation utilities, and cloud-based infrastructure to obscure command-and-control activity. #Larva26009 #VShell #GotoHTTP #SoftEther #XMRig...

WhoisXML API expanded on Cisco Talos’s research into the UAT-8099 campaign, identifying 27 IoCs (10 domains and 17 subdomains), DNS resolution histories, WHOIS history artifacts, and thousands of email-connected domains with several malicious ties. The actor exploited vulnerable IIS servers—using web shells, PowerShell, BadIIS variants, and the GotoHTTP remote-access tool—primarily targeting hosts in Thailand and Vietnam. #UAT-8099 #GotoHTTP

A vulnerability has been found in GotoHTTP up to 10.2. This issue affects some unknown processing of the file /reg.12x. The manipulation of the argument sn leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The …

Curate Feeds | Make Collections | Customize Email Briefs

If you think a 'clean' event log means you’re safe, you’ve already lost the forensic battle. Senior Analyst Michael Ransier dissects the ferocious persistence tools of UAT-8099—from Sharp4RemoveLog to the GotoHTTP stealth agent—revealing how to secure your IIS perimeter against automated quiet occupancy