Virus Bulletin

#VB2027 is heading to London, 6–8 October 2027! 🎉 We’re excited to return to this iconic city and bring together brilliant minds from across the cybersecurity industry for another three days of cutting-edge research, insightful discussions and unforgettable moments.

Infoblox traced Hidden Hawk's gambling SEO across school and government domains. Researchers contacted the group using a fake casino persona. www.infoblox.com/blog/threat-...

The Trellix team found Sirius Backdoor behind a blank FedEx PDF. A provisioning package allows it to reinstall after a Windows reset. www.trellix.com/blogs/resear...

Vojtech Moravec at GenDigital details how AMOS can replace Ledger and Trezor apps to steal phrases. The campaign used Google Ads and fake claude.ai pages. www.gendigital.com/blog/insight...

Huntress researchers Jonathan Semon & Rich Mozeleski show how stolen ConnectWise credentials were used against nearly 1000 M365 tenants. In two cases, attackers gained privileged roles within three hours. www.huntress.com/blog/connect...

Check Point Research analysed Aokigahara, a new infostealer with a dedicated module targeting authentication and session data from Codex, Claude, Cursor, Copilot and Gemini. research.checkpoint.com/2026/infoste...

Microsoft researchers analysed a compromised LiteLLM 1.107.0 release published to the PyPI & distributed through official container images. They explain the startup mechanisms, the credentials the payload could reach, & the evidence to investigate exposure. www.microsoft.com/en-us/securi...

The Zscaler Threat Hunting team identified an SEO poisoning campaign that distributed Armorsteal through websites impersonating Chocolatey and the Microsoft Activation Scripts (MAS) tool. www.zscaler.com/blogs/securi...

ESET researchers Anton Cherepanov & Peter Strýček uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – which paved the way for a destructive attack against a Ukrainian grain firm. www.welivesecurity.com/en/eset-rese...

Microsoft researchers show how Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. www.microsoft.com/en-us/securi...

Sophos researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading. www.sophos.com/en-us/blog/b...

Group-IB and NyxLab found 70,000+ credentials in k0t's edge-device campaign. The operators decrypted FortiGate configs for LDAP and AD secrets, then deployed AdaptixC2. www.group-ib.com/blog/stray-c...

Unit 42 found BUGSTER using jailbroken DeepSeek and Hermes to steal 5,200+ university records and build tooling for VoIP fraud, Wi-Fi cracking and C2. unit42.paloaltonetworks.com/ai-assisted-...

NorForge researcher Snorre Fagerland analysed more than 20 exposed Cairn panels. One Chinese-language cluster ran over 1,100 attack projects; he also confirmed a live webshell. norforge.com/blog/inside_...

Symantec's Threat Hunter Team uncovered what followed Hookedge delivery at a NATO naval shipbuilder: NTML theft, a persistent reverse SSH tunnel, and a new reflective loader. www.security.com/threat-intel...

SOCRadar found INC and The Gentlemen affiliates using LLMs in intrusions and extortion. Seven servers held 8,257 AI messages and 46 encryptors staged for six victims. socradar.io/blog/inc-gen...

The SlowMist team linked DarkSword's panel to public GitHub code. 1,187 attempts, 10 successful exploits and 9 thefts were logged. slowmist.medium.com/threat-intel...

Google Mandiant details how ARMORY CASTLE exploited a BeyondTrust Remote Support zero-day, deployed SAWFLY, and used BARECLAW to tunnel into downstream systems. cloud.google.com/blog/topics/...

Sekoia's Flowise honeypot caught an attacker stealing credentials and trying to use a decoy AI agent to analyse a Nightingale target in the iGaming sector. www.sekoia.com/blog/a-honey...

Hunt.io investigated a PaperCut campaign in which attackers used AI agents to automate credential theft & maintain reverse SOCKS5 tunnels. The analysis uncovered 45 active pivots & a potential second RCE path through the XML-RPC interface. hunt.io/blog/papercu...

ThreatFabric researchers identified Hirudo, a new Android banking RAT delivered via fake app updates. It replaces eight Indonesian banking apps with patched copies to bypass signature, accessibility, screen-capture and Play integrity checks. www.threatfabric.com/blogs/hirudo...

Unit 42 researchers identified CL-UNK-1211, a campaign targeting government Linux infrastructure with AI-assisted scripts and the SysGoRAT backdoor. Attackers used PHP auto_prepend_file for persistence and a .bashrc alias to steal sudo passwords. unit42.paloaltonetworks.com/ai-campaign-...

Unit 42 researchers analyse an intrusion where CL-STA-0954 stole configurations and cryptographic materials for over 500 FortiGate firewalls. The attackers deployed PEERSTITSH, an ARM64 implant that runs in memory and hides in legitimate traffic. unit42.paloaltonetworks.com/fortimanager...

Once again, VB congratulates the Rapid7 team for winning the 2026 Peter Szor Award. Christiaan Beek explains what the award means to the team, and gives some background to the research behind the award. www.rapid7.com/blog/post/tr...

That's a wrap for #VB2026! 🇪🇸📸 A huge thank you to all our speakers, attendees, partners and everyone who helped make this year's conference such a special experience! See you in London for VB2027! 🇬🇧

We are delighted to announce that Edoardo Giuggioloni, Christiaan Beek and Jindrich Karasek of Rapid7 Labs have received this year's Péter Szőr Award for their research, "BPFdoor in Telecom Networks: Sleeper Cells in the Backbone." Congratulations! 🔗Full research: tinyurl.com/4xv58ejn

Many congratulations to Edoardo Giuggioloni, Christiaan Beek and Jindrich Karasek of Rapid7 Labs, who are the winners of this year's Péter Szőr Award for "BPFdoor in Telecom Networks: Sleeper Cells in the Backbone".

A look back at Day 1 of #VB2026! 📸 A great start to this year's conference, with insightful talks, interesting conversations, familiar faces and new connections. We rounded off the day with our evening drinks reception! 🥂 A big thank you to everyone who joined us yesterday!

VB congratulates the researchers shortlisted for the 2026 Péter Szőr Award, both for their nominations and for the outstanding research they have contributed to the field. The winner will be announced tonight at the VB2026 gala dinner in Seville. www.virusbulletin.com/blog/2026/09...

#VB2026 comes with a side of sunshine ☀️ And even better, Wednesday's drinks reception will take place outdoors in Jardines Cartuja, the hotel's beautiful garden space. 🍹 Hope you packed your sunglasses and Hawaiian shirt! 😎🌺 👉 vb2026.virusbulletin.com

LevelBlue analysed TIKTOUK, a WordPress toolkit probing REST routes and configuration files to decrypt SMTP credentials using WP key material. A leaked panel revealed ~50k credentials harvested across ~37k domains. www.levelblue.com/blogs/spider...

One week to go until VB2026! ❗ We’re officially into the final week, so if VB2026 is still in your plans, now’s the time to secure your ticket. 🇪🇸 14–16 October 2026 | Seville, Spain 🎟️ Get your ticket: tinyurl.com/ysdny5ae #VB2026 #CyberSecurity #Seville #VBConference

Ready for Seville? With #VB2026 just around the corner, it’s time to start getting conference-ready. Passport packed, out-of-office on, must-see talks saved... there’s just one question left: have you secured your ticket? 🎟️ Get your ticket: vb2026.virusbulletin.com#tickets

A recent Microsoft blog post provides an updated technical analysis of the Russian threat actor Star Blizzard’s TTPs. In 2026 Star Blizzard adopted RedFlick, a malware delivery technique that helps evade detection and deploy the custom backdoor CosmicPulse. www.microsoft.com/en-us/securi...

eSentire's TRU team shows how a threat actor exploited an internet-facing PaperCut MF server to deploy a Java loader & a web shell. Threat actors subsequently used the web shell to deploy a trojanized Microsoft Copilot binary carrying an AdaptixC2 implant. www.esentire.com/blog/papercu...

K7 Labs' Harihara Sudhan looks into a multi-stage infection chain that started from a KMS Auto execution and led to cryptocurrency mining activity, remote access software deployment, and finally the delivery of a scareware payload masquerading as ransomware. labs.k7computing.com/index.php/fr...

Cleafy's Simone Mattia & Alberto Giust look inside the evolving C2 panel behind RATHat. RATHat's Android malware remained largely static from late 2025 to Sept 2026, while its C2 panel was replaced entirely and has gone through three generations in six months. www.cleafy.com/cleafy-labs/...

Microsoft researchers identified NeedyMantis, a modular post-compromise malware family observed in targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors. www.microsoft.com/en-us/securi...

Proofpoint researchers identified an active TeamFiltration campaign - tracked as UNK_CondorFiltration - that targeted over 5,700 accounts across 28 Microsoft 365 tenants in Latin America, focusing intensively on Chilean organizations. www.proofpoint.com/us/blog/thre...

The FortiGuard Incident Response (FGIR) team recently investigated an intrusion involving SectopRAT (also known as ArechClient2), which was used to control the victim’s device. www.fortinet.com/blog/threat-...

K7 researchers analyse a Python-based MaaS infostealer builder and an embedded infostealer payload. Operators are able to generate customized Windows executables using Nuitka or PyInstaller, with webhook configuration integrated into the build process. labs.k7computing.com/index.php/th...

G Data's Karsten Hahn shows how threat actors recompile open-source software such as the 7zip SFX stub to sneak a reflective loader into it. blog.gdatasoftware.com/2026/09/3849...

Gambit Security's Eyal Sela writes about a financially motivated threat actor that is using open-source AI harnesses to attack hundreds of online retailers, at a marginal cost of tens of dollars per company. gambit.security/blog-posts/a...

Microsoft researchers delve into the attack techniques attributed to Storm-2570, a ransomware affiliate linked to multiple ransomware payloads like Qilin, DragonForce, Anubis, and BERT ransomware. www.microsoft.com/en-us/securi...

Huntress researchers Harlan Carvey & Lindsey O'Donnell-Welch found a threat actor doing something unique: instead of simply dropping a miner, one was compiled directly on the victim endpoint, tailoring the payload while generating unusually conspicuous EDR telemetry. www.huntress.com/blog/threat-...

Varonis Threat Labs recently discovered AvisLoader, a new Windows loader named after the Latin word for bird. They found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its command centre. www.varonis.com/blog/meet-av...

The VB2026 programme has just been updated with this year’s last-minute papers, adding even more timely research to the line-up. 🔍 View the full programme: vb2026.virusbulletin.com 🎟️ Get your ticket: vb2026.virusbulletin.com#tickets #VB2026 #VBConference #SecurityResearch #Seville

ThreatDown​ ​researchers​ ​uncovered​ ​CARBONATO, which targets unauthenticated Docker daemons, then installs the legitimate Hermes Agent. A modified SOUL.md tells it to take Telegram tasks and prioritise AI API keys over credentials. www.threatdown.com/blog/carbona...

DarkMe has dropped the WinRAR and SmartScreen zero-days it used previously. Huntress saw it delivered through a phising-linked .pif file, with persistence hidden behind a custom protocol handler. www.huntress.com/blog/darkme-...

More than 1200 Meta ads pushed 17 malicious apps through Google Play in a Polish toll-fraud operation. CERT Polska saw the C2 assign premium SMS and carrier-billing jobs to infected devices. cert.pl/en/posts/202...