Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

CERT-AGID identified and disrupted a new MintsLoader campaign that abused compromised PEC mailboxes to send convincing fake invoice-payment messages to other certified email addresses. The attack chain delivered a ZIP file containing HTML, JavaScript, PowerShell, and MintsLoader components, with rotating infrastructure and DGA-based domains leading to final payloads such as RATs and stealers. #CERT-AGID #MintsLoader #PEC

Microsoft Desired State Configuration 3.3.0 is generally available, with new built-in Windows resources and wider `--what-if` coverage for services, firewall rule lists, and SSHD configuration. Before a maintenance window, validate firewall ownership, registry type coverage, command aliases, and the experimental status of synthetic export filtering.

Huntress investigated an August post-incident case involving INC ransomware that impacted at least 175 endpoints, with traces found on domain controllers and evidence of early persistence, lateral movement, and later ransomware deployment. Researchers also uncovered two ransom notes, an AnyDesk-based deployment path, and a BYOVD technique used to load a driver and disable security tools. #INC #AnyDesk #Impacket #HwAudio #HWAuidoOs2Ec.sys

An advanced malware campaign known as TASK#STOMP has recently been discovered, which utilizes a PowerShell-based backdoor to collect business documents, Wi-Fi passwords, clipboard data, and screenshots from compromised computers using a PowerShell backdoor. Moreover, the malware also provides attackers with remote command execution and maintains multiple channels for further access. VBScript files are executed via the legitimate Windows Script Host utility wscript.exe in order to initiate the infection.  In spite of the fact that the exact method of delivery has not been confirmed, phishing or social engineering could be considered possible methods of delivering the script. Following the script's delivery, it sets up a set of scheduled tasks resembling legitimate Windows components, establishing persistence.  By naming these tasks Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, malicious activities can be blended seamlessly with normal system activities. Another persistence mechanism places another VBScript file in the Windows Startup folder, enabling it to run when the user logs in.  Upon launching the malware, it executes two PowerShell components. Among these are sys_loader.ps1, which collects documents, gathers system information, steals Wi-Fi passwords, monitors clipboards, captures screenshots, and executes remote commands. Another persistent command-and-control channel, win_conn.ps1, provides additional collection capability as well as a persistent command-and-control channel.  By monitoring each other and restarting the other process if one is disabled, this setup provides redundancy, making it more difficult to remove the malware if only one process is terminated or a single persistence entry is deleted. In addition to hiding execution activities, timestamp manipulations, and cleanup activities, Task#STOMP can also be used for continuous document theft, increasing the difficulty of detection and forensic investigation.  As opposed to collecting only files that are already present on an infected computer, TASK#STOMP monitors the file system for newly created or modified documents. This enables the collection of business files as they appear and change during an active infection. In addition to obtaining Wi-Fi credentials and clipboard contents, the malware targets saved Wi-Fi credentials as well.  With clipboard monitoring, operators can identify information temporarily copied by users, while screenshot capture allows them to view information displayed on a compromised system. By combining these capabilities with remote command execution, Task#STOMP is able to gather more information about user activity than a conventional file-stealing malware.  A separate command-and-control path, Win_conn.ps1, is maintained by TASK#STOMP in addition to data collection. From win_conn_cfg.dat, the component decodes its configuration and connects to attacker-controlled infrastructure at corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. Researcher identification of related traffic can be improved by using a hardcoded authentication token for communication.  Parts of network communication are handled by a compiled C# component. During connection times, connections can proceed when certificates are invalid, self-signed, or otherwise mismatched due to the code disabling TLS certificate validation. This reduces the level of protection usually provided by certificate checks and makes it easier for the malware to communicate with its servers. Additionally, TASK#STOMP alters file timestamps and cleans up activity following execution to provide further anti-forensic measures.  According to the researchers, several files have been backdated to January 15, 2024, but that date is not conclusive of when the campaign began. This date was deliberately inserted by the malware, and therefore cannot be regarded as evidence of the age of the campaign. Securonix has not determined why the malware opens a page associated with irantenders[.]com in Chrome, but the page relates to government contracts and tenders in Iran.  Securonix has not established whether the site indicates a specific victim profile or why it is opened. Researchers have cautioned that the domain alone may not be sufficient to confirm the campaign's geographical or sectoral targeting. Securonix has not linked TASK#STOMP to a known threat group. Due to the use of a single compromised system, it is unclear how the overall campaign scope and duration were determined.  The initial delivery method is also unclear, although similar VBScript campaigns suggest phishing involving archive or disk image attachments as a possible route. To detect an infection, researchers recommend examining suspicious Windows Script Host and PowerShell activity that originates from writable locations, newly created scheduled tasks, and instances where PowerShell invokes the C# compiler from .NET C#.  A suspected infection can be investigated with additional evidence from PowerShell Script Block Logging, AMSI telemetry, and scheduled task records.

A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner.

A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner.

Researchers analyzed a multi-stage infection that used Registry-stored PowerShell, DNS TXT records, PNG and WAV file payload containers, and in-memory .NET loading to hide its activity. The chain ultimately deployed an XMRig-based cryptocurrency miner while maintaining a separate C2 channel and weakening Microsoft Defender and PowerShell logging controls. #XMRig #WinRing0.sys #RealtekHDAudio.wav #sslvalidcert.com #httptls.org

Last Updated: 2026-09-16T14:53:57Z (UTC) What’s Happening TL;DR: `fileupdates.blob.core.windows[.]net is hosting “QuickFix,”, a new-ish installer file with PowerShell that installs its own Python interpreter, then activates a light C2 beacon for Python commands send via JSON. The detection opportunity is Python executing outside of expected directories. This was a tip from Fedi and turned into a really fun investigation. The tipper was surprised that Microsoft even allowed that blob storage...

A five-stage AsyncRAT campaign abuses AutoIt and PowerShell to inject its payload into charmap.exe, bypassing traditional file-based detection. The key is tracking behavioral chains, not static artifacts.

Four HTTP tools - hget, hexec, hwait, hmirror - in bash, zsh, ash and PowerShell, using only what the environment already ships. No curl, no wget. - remcovanmook/hexec

Exchange Online starts enforcing an AppID-based EWS allow-list on October 1, 2026. Learn how EWSEnabled and EWSAllowedAppIDs work, and how to find every app still calling EWS before Microsoft decides ...

At a Glance Malware family: Multiple families including ModeloRAT, EtherRAT, AsukaStealer, and C2Looper Threat actor: Suspected initial access broker Woodgnat (KongTuke) and unnamed cybercrime groups Target or victims: Technology firms, fintech companies, hotels, and government agencies Delivery vector: ClickFix fake update prompts and malicious PowerShell commands Key capabilities: Living-off-the-land execution, registry persistence, and blockchain-based EtherHiding Source: Symantec Threat Hunter Team and Zscaler…

Turn PowerShell scripts into portable Windows EXE files with configurable architecture, window mode, runtime, UAC, and app options.

The August 21, 2026, SANS Internet Storm Center StormCast, presented by Johannes Ullrich from Jacksonville, Florida, highlighted two PowerShell scripts for Microsoft Graph automation to manage Entra (Azure AD) security. The first script identifies stale user accounts—those inactive for extended periods—and lists their assigned licenses, while the second collects users flagged by Entra’s risk detection system, detailing reasons like unusual browsers, geographic origins, or ASN-based anomalies. Keycloak version 26.7.2 was released to fix a critical password reset vulnerability allowing unauthenticated attackers to spoof verification tokens and reset any user’s password without email access. A blog post demonstrated 'cryptographic context injection,' a technique to bypass LLM guardrails by encrypting malicious requests, decrypting them only after the initial security filter. N-able’s Passportal password manager was patched for a cross-origin messaging flaw where improper origin checks enabled any website to extract stored passwords, posing a severe risk to managed service providers. The vulnerabilities underscore the importance of input validation after data transformation and secure cross-window communication in browser extensions.

What Happened Microsoft observed a multistage intrusion campaign (TerminalFix / ClickFix variant) that combined social engineering, signed‑binary abuse, steganography and a Python‑based reverse tunnel to enable silent pivoting and reconnaissance…