> ## Content Index
> Fetch the complete content index at: https://guide.gpplabs.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# Weekly Threat Digest 26.41 || Oct 5
- URL: https://guide.gpplabs.io/weekly-threat-digest-26-41-oct-5/
- Published: 2026-10-05T11:00:00.000Z
- Updated: 2026-10-18T18:43:10.000Z
- Description: Citrix NetScaler zero-days lead the week; Cisco SD-WAN and FortiMail also exploited; Warlock hits water and telecom
- Author: JP Williams

*Note: This issue was originally posted to Substack on 10/5, prior to our migration to Ghost. It is being reposted here now due to relevance of recent activity.*

Google Threat Intelligence Group reports attackers have used two zero-days since early September to gain root on ADC and Gateway appliances, plant web shells, and tunnel into internal networks. Cisco and Fortinet also confirmed exploitation of critical flaws in SD-WAN Manager and FortiMail.

For critical infrastructure, Symantec reports the Warlock ransomware group breached a water utility and a telecom operator through year-old SharePoint flaws, and Microsoft lists energy among Storm-2570’s targets. Microsoft also details Storm-3168’s automated destruction of Azure resources through stolen service principals. In phishing, attackers are hosting ClickFix lures inside ChatGPT Custom GPTs, and Star Blizzard has moved to large-scale campaigns.

#### Act now

- **Citrix NetScaler ADC and Gateway:** Two zero-days, one a pre-auth DTLS flaw that gives root, have been exploited since early September. If you run NetScaler: upgrade to 14.1-73.37 or 13.1-64.23, then rotate credentials and check for web shells.
- **Cisco Catalyst SD-WAN Manager:** An exploited API authentication bypass (CVE-2026-76504, CVSS 9.8) grants admin access, and there is no workaround. If you run SD-WAN Manager: upgrade to a fixed release and check its access logs.
- **Fortinet FortiMail:** An unauthenticated path traversal (CVE-2026-104286) lets attackers write files and run code. If you run FortiMail 7.2 through 8.0.1: apply Fortinet’s fix and review web interface logs.

*Drafted with AI from public reporting; reviewed and edited by GPP Labs before publishing.*

---

## Critical Infrastructure & OT

####   
Warlock ransomware breaches water and telecom operators through SharePoint

[Symantec](https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure) reports the Warlock ransomware group compromised at least four organizations in July and August, including a water utility and a telecom operator. The victims were in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. Symantec links the group to Storm-2603, a China-nexus actor.

The attackers got in through the 2025 ToolShell SharePoint flaws and newer SharePoint bugs. They loaded a vulnerable K7 driver (CVE-2025-1055) to switch off security tools, used a Visual Studio Code tunnel for covert access, and staged the ransomware in the domain’s SYSVOL share so Group Policy pushed it to at least 33 hosts.

- **Exposure:** On-premises SharePoint Server not patched for ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771).
- **Response:** Patch on-premises SharePoint, block the K7RKScan driver through a vulnerable-driver blocklist, and alert on executables written to SYSVOL.
- **Detections:** [Symantec published](https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure) 18 file hashes and two network indicators.
- **Also reported by:** [Cryptika](https://www.cryptika.com/warlock-ransomware-exploiting-sharepoint-flaws-to-attack-water-and-telecom-operators/)

####   
Storm-2570 runs one playbook across four ransomware families

[Microsoft](https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/) tracks Storm-2570 as a ransomware affiliate that has deployed Qilin, DragonForce, Anubis, and BERT since April 2025 without changing its tools or techniques. Microsoft lists energy and critical manufacturing among its targets, alongside healthcare, education, government, and financial services.

The actor gets in and runs commands through RMM tools (MeshAgent, Atera, ScreenConnect, NinjaRMM), dumps Active Directory credentials with Mimikatz, LaZagne, and ntdsutil, then moves laterally with PsExec, Impacket and RDP scripts. It disables Microsoft Defender and sends data to cloud storage with s5cmd and Rclone before encrypting.

- **Exposure:** Windows and Active Directory environments, especially where unapproved RMM tools can run.
- **Response:** Turn on tamper protection, require MFA on approved RMM tools, enable attack surface reduction rules, and reset credentials if you find unauthorized RMM installs.
- **Detections:** [Microsoft published](https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/) hunting queries for PsExec deployment and renamed MeshAgent binaries.

###   
OT/ICS Advisories

*Marker shows the highest CVSS v3 score in each advisory:* 
*🔴 9.0 and up · 🟠 7.0–8.9 · 🟡 4.0–6.9*

- 🔴 **Toptech TMS7 and TopHAT** · ICSA-26-272-02 · 10 CVEs · CVSS 10.0\. Unauthenticated SQL injection, file upload and table export allow data theft and PHP code execution. Patch available. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02)
- 🔴 **Armatura One access control** · ICSA-26-274-01 · 5 CVEs · CVSS 9.8\. Embedded Apache ActiveMQ allows unauthenticated code execution, and hardcoded credentials expose the database. Patch available. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01)
- 🔴 **MikroTik RouterOS** · ICSA-26-272-06 · CVE-2026-84411 · CVSS 9.8\. An integer underflow in the web service gives unauthenticated attackers root code execution. Upgrade to 7.24 or later. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06)
- 🔴 **Monta EV charging platform** · ICSA-26-274-02 · 4 CVEs · CVSS 9.4\. Unauthenticated WebSocket endpoints let attackers impersonate charging stations and take admin actions. Monta is adding authentication and rate limiting. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02)
- 🟠 **Lantronix G520 cellular gateway** · ICSA-26-272-01 · 2 CVEs · CVSS 7.5\. Cross-site scripting in update metadata and exposed production signing keys allow root code execution. Update to firmware 2.6.0.7R6\. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-01)
- 🟠 **Johnson Controls EasyIO Neo controllers** · ICSA-26-274-04 and -05 · 2 CVEs · CVSS 7.3\. Debug interfaces expose data, and credentials cross the network in cleartext HTTP. Update EC to V3.3b64 and CW to V3.3b26\. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-04) *·* [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-05)
- 🟡 **ABB PCM600** · ICSA-26-274-03 · 2 CVEs · CVSS 6.4\. The scheduler service in this protection relay manager allows local privilege escalation. Run the service under the PCM600 operator account. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-03)

###   
In brief

- **Remus malware traffic from state and local government networks:** CIS reports command-and-control traffic tied to the Remus malware distribution operation coming from SLTT networks. [*Center for Internet Security*](https://www.cisecurity.org/insights/blog/sltt-c2-traffic-tied-to-remus-malware-distribution-operation)

---

## Exploited & Notable Vulnerabilities

####   
Citrix NetScaler zero-days give attackers root

[Google Threat Intelligence Group](https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances/) reports attackers have exploited two zero-days in NetScaler ADC and Gateway (CVE-2026-88771 and CVE-2026-88772) since at least early September. Government, financial services, technology, education and legal organizations in North America and Europe were likely affected.

CVE-2026-88772 is a pre-authentication heap memory corruption flaw: malformed DTLS records sent to UDP/443 give the attacker root. From there, attackers planted WHIPSHOT, a PHP web shell that hides commands in HTTP headers, and SLAPSHOT, a Python tunneler they used to reach internal networks for reconnaissance and credential theft.

- **Exposure:** NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus older FIPS and NDcPP builds. DTLS is on by default for VPN virtual servers.
- **Response:** Upgrade per [Citrix’s security bulletin](https://community.citrix.com/techzone-blogs/110%5Fsecurity-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/). If you can’t yet, disable DTLS where it isn’t needed and block inbound UDP/443\. After patching, rotate admin credentials, LDAP bind accounts, RADIUS secrets and session tokens. Then check `/etc/httpd.conf` for unexpected AddHandler or AliasMatch lines, `/bin/sh` for the SUID bit, and `/var/netscaler/gui/vpn/scripts/` for stray files.
- **Detections:** [GTIG published](https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances/) YARA rules, IOC scanner guidance and hunting queries.
- **Also reported by:** [Center for Internet Security](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-netscaler-adc-and-netscaler-gateway-could-allow-for-remote-code-execution%5F2026-103), [Brandefense](https://brandefense.io/blog/netscaler-zero-day-cve-2026-88771-response/), [Cyber Press](https://cyberpress.org/hackers-exploit-citrix-netscaler-zero-days/)

####   
Cisco SD-WAN Manager authentication bypass exploited

[Cisco](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU) confirmed in September that attackers are exploiting CVE-2026-76504 (CVSS 9.8), an authentication bypass in the Catalyst SD-WAN Manager API. A request with URI-encoded characters slips past authentication and gives the attacker admin access to the manager.

- **Exposure:** SD-WAN Manager releases before the first fixed builds: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1.
- **Response:** Upgrade to a fixed release. Cisco lists no workaround; its temporary Live Protect shield offers only partial protection.
- **Detections:** Cisco advises checking `serviceproxy-access.log` for POST requests to `j_security_check` containing URI-encoded characters, and `vmanage-server.log` for accounts prefixed `viptela-reserved-`.
- **Also reported by:** [Center for Internet Security](https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-catalyst-sd-wan-manager-could-allow-for-authentication-bypass%5F2026-105)

####   
FortiMail zero-day allows unauthenticated code execution

Fortinet reports attackers are exploiting CVE-2026-104286 in FortiMail, according to the [Center for Internet Security](https://www.cisecurity.org/advisory/a-vulnerability-in-fortinet-fortimail-could-allow-for-arbitrary-code-execution%5F2026-108). The flaw combines path traversal and NULL byte injection in FortiMail’s web interface, letting an unauthenticated attacker write arbitrary files to the appliance with crafted HTTP or HTTPS requests and potentially run code.

- **Exposure:** FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9.
- **Response:** Apply Fortinet’s fix after testing. Until then, segment FortiMail from critical systems and review web interface logs for unusual requests.
- **Also reported by:** [SOCRadar](https://socradar.io/blog/fortimail-zero-day-under-active-exploitation/), [Beazley Security](https://labs.beazley.security/advisories/BSL-A1218), [Truesec](https://www.truesec.com/hub/blog/cve-2026-104286-fortimail-path-traversal-vulnerability-actively-exploited)

###   
In brief

- **Zimbra command injection exploited** (CVE-2026-73570): Crafted SMTP requests inject commands through the SNMP notification path on servers with zimbra-snmp installed. Microsoft saw webshells, privilege escalation, and mailbox theft. Fixed in 10.1.20\. [*Microsoft*](https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/)
- **WordPress core RCE added to KEV** (CVE-2026-87902): Unauthenticated attackers can manipulate page-template resolution to run local PHP files outside theme directories. CISA added it to the catalog September 25\. [*Center for Internet Security*](https://www.cisecurity.org/advisory/a-vulnerability-in-wordpress-could-allow-for-remote-code-execution%5F2026-106)
- **Apple Core Graphics zero-day** (CVE-2026-86950): Exploited against specific targeted individuals on iOS versions before 27\. Update to iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1\. [*Center for Internet Security*](https://www.cisecurity.org/advisory/a-vulnerability-in-apple-products-could-allow-for-arbitrary-code-execution%5F2026-104) *·* [*SANS Internet Storm Center*](https://isc.sans.edu/diary/rss/33376)
- **MikroTik RouterOS flaws added to KEV** (CVE-2026-67277, CVE-2026-86060): Rescana reports CISA added both to the Known Exploited Vulnerabilities catalog. [*Rescana*](https://www.rescana.com/post/mikrotik-routeros-mikrotrick-cve-2026-67277-86060-kev)
- **Kiteworks Email Protection Gateway** (CVE-2026-54154): Input-handling flaws could allow unauthenticated code execution as root. Patch available; no known exploitation. [*Center for Internet Security*](https://www.cisecurity.org/advisory/a-vulnerability-in-kiteworks-epg-email-security-gateway-could-allow-for-arbitrary-code-execution%5F2026-107)
- **ServiceNow AI Platform:** Five flaws, including SQL injection and authorization bypass, could expose instance data without authentication. Patch available; no known exploitation. [*Center for Internet Security*](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-servicenows-ai-platform-could-allow-for-unauthorized-access%5F2026-102)

---

## Credential Theft & Phishing

####   
Attackers hide ClickFix lures inside ChatGPT Custom GPTs

[Huntress](https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat) found attackers using malicious Custom GPTs on ChatGPT.com to send users to a ClickFix page. The GPT, titled “Plus 5.6,” showed a fake service notice pointing to a “backup domain” on Google Sites, where a fake CAPTCHA told victims to paste a PowerShell command.

The command installed an MSI that sideloaded a malicious DLL through a Canon-signed program (`COTFileReadApp.exe`) and delivered a full-featured RAT. Huntress responded to at least 40 related intrusions. OpenAI removed the first GPT on September 25; a replacement appeared two days later, and a second variant swapped in a Stardock-signed binary.

- **Exposure:** Windows users who search for ChatGPT or click sponsored search results.
- **Response:** Hunt for PowerShell launching `msiexec` on GUID-named MSI files in `%TEMP%`, signed programs running from `%LOCALAPPDATA%\Programs\` after an `msiexec` install, and Run keys or scheduled tasks that re-create themselves when deleted.
- **Also reported by:** [Cryptika](https://www.cryptika.com/hackers-using-chatgpts-custom-gpt-feature-to-trick-victims-into-installing-malware/)

####   
OAuth token theft through Microsoft’s own sign-in flow

[Huntress](https://www.huntress.com/blog/stealing-oauth-tokens-through-microsofts-front-door) shows how an attacker can steal OAuth tokens through Microsoft’s own sign-in flow. A sideloaded AppX package that declares `WindowsRuntimeAccess="all"` lets remote JavaScript call `WebAuthenticationBroker` through `WWAHost.exe`, a Microsoft-signed binary.

The victim sees a genuine login.microsoftonline.com dialog and completes MFA. The attacker walks away with access and refresh tokens carrying broad Microsoft Graph scopes. The refresh token keeps working until it is revoked. Every piece is signed Microsoft code on real Microsoft infrastructure, so signature-based detection misses it.

- **Exposure:** Windows 11 devices with Developer Mode or enterprise sideloading enabled, signed in to Microsoft 365 and Entra ID.
- **Response:** Disable Developer Mode by GPO where it isn’t needed, and require compliant devices in Conditional Access.
- **Detections:** [Huntress published](https://www.huntress.com/blog/stealing-oauth-tokens-through-microsofts-front-door) a Sigma rule for `MSAppHost/3.0` user agents reaching non-Microsoft destinations, plus endpoint IOCs.

####   
Star Blizzard trades ClickFix for RedFlick

[Microsoft](https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/) reports that Star Blizzard, a Russian state actor, moved to large-scale phishing in 2026 and now delivers malware with a technique Microsoft calls RedFlick. The campaigns hit more than 100 organizations, mostly in the US and UK, including Ukrainian organizations, NGOs, think tanks and governments that support Ukraine.

RedFlick uses a scheduled task to install the CosmicPulse backdoor after a single user interaction, replacing the actor’s earlier ClickFix lures. Star Blizzard sent the emails from accounts it created on compromised cPanel and WordPress sites and hid payloads inside PDFs.

- **Exposure:** Government, NGO and think tank staff working on Ukraine policy, mainly on Windows.
- **Response:** Use phishing-resistant authentication and Conditional Access, run EDR in block mode with cloud-delivered protection, and turn on network protection.
- **Detections:** [Microsoft published](https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/) Defender XDR hunting queries for conhost.exe invoking curl, SSH launching local commands, and Star Blizzard’s scheduled task names.

###   
In brief

- **Phishing drops RMM tools for persistent access:** Lures install disguised MSP360 and ConnectWise ScreenConnect installers, giving attackers redundant remote access for credential theft and long-term footholds. [*Microsoft Threat Intelligence*](https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/) *·* [*Huntress*](https://www.huntress.com/blog/rogue-rmm-abuse-phishing-persistent-access) *·* [*SANS Internet Storm Center*](https://isc.sans.edu/diary/rss/33388)
- **TA419 impersonates AI policy figures:** China-aligned TA419 posed as White House and think tank figures in July to phish US AI policy experts, using adversary-in-the-middle pages against Microsoft 365 and Entra ID. [*Proofpoint*](https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy) *·* [*Cryptika*](https://www.cryptika.com/chinese-hackers-posing-as-senior-anthropic-employee-targeting-us-ai-policy-experts/)
- **Fraud actors take over .edu accounts:** West African fraud groups phish university email credentials, then use the trusted addresses to send job scams that lead to advance-fee fraud. [*Proofpoint*](https://www.proofpoint.com/us/blog/threat-insight/edu-account-takeover-job-scam-abuse-west-african-fraud-actors-target)
- **DarkMe RAT trades zero-days for phishing:** Water Hydra’s DarkMe now spreads through PIF attachments, using VB6 loaders that hollow out signed Microsoft binaries. [*Huntress*](https://www.huntress.com/blog/darkme-rat-abandons-exploits) *·* [*CyberVeille*](https://cyberveille.ch/posts/2026-09-25-darkme-rat-water-hydra-abandonne-les-zero-days-pour-le-phishing-par-fichier-pif/)
- **Macfinger ClickFix targets macOS:** Clipboard-injected Terminal commands install an infostealer that persists and requests access to files and apps. [*SANS Internet Storm Center*](https://isc.sans.edu/diary/rss/33368)
- **Italian phishing campaign delivers an iOS exploit chain:** D3Lab reports a phishing campaign in Italy delivering an exploit chain against iPhones. [*D3Lab*](https://www.d3lab.net/an-italian-phishing-campaign-delivering-an-ios-exploit-chain/)

---

## Ransomware

####   
Storm-3168 wipes Azure resources with stolen service principals

[Microsoft](https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/) describes how Storm-3168, the actor Sysdig calls JADEPUFFER and documented as the first agentic ransomware operation, used two compromised Azure service principals to map and then destroy a victim’s cloud resources. The credentials had leaked in a public GitHub issue and stayed readable in its edit history after removal.

One principal spent about 15 and a half hours on reconnaissance. The second ran a seven-minute destructive sequence against Storage accounts, SQL databases, Key Vaults, Function Apps and App Services, made more than 100 storage account deletion attempts, and pulled storage account keys. Its attempts to remove Azure Site Recovery and Backup protection locks failed, and resource locks stopped some deletions.

- **Exposure:** Azure tenants whose service principals hold broad Contributor or Storage Account Contributor roles, or whose secrets have appeared in public repositories or issues.
- **Response:** Rotate any service principal secret that has ever been public, even if since deleted. Apply least privilege to workload identities, enable Defender for Cloud plans, and lock down backup and recovery resources.
- **Detections:** [Microsoft published](https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/) Defender for Cloud alerts, IOCs and ATT&CK mappings.

####   
INC ransomware attack leaves two ransom notes

[Huntress](https://www.huntress.com/blog/two-inc-ransom-notes) reconstructed an INC ransomware attack that reached 175 endpoints, including domain controllers. In early August the attackers created a randomly named scheduled task, ran a heavily obfuscated PowerShell implant that called out to throughoutes\[.\]net, and moved laterally over RDP with a compromised account. Then they went quiet for 17 days.

In late August they returned with AnyDesk, loaded a vulnerable kernel driver (`HWAuidoOs2Ec.sys`) to disable security tools, ran tools across endpoints with Impacket’s `atexec.py`, and deployed INC. A standard ransom note was followed 53 minutes later by a second “press release” note threatening to alert media and stakeholders. Huntress suggests an access broker and a ransomware affiliate may have been working the same network.

- **Exposure:** Windows and Active Directory environments. Huntress could not determine the initial access vector.
- **Response:** Enforce MFA, restrict privileged accounts, keep offline backups, and alert on new scheduled tasks, unsigned drivers and remote-management tools.
- **Detections:** [Huntress published](https://www.huntress.com/blog/two-inc-ransom-notes) IOCs, including file paths, domains and IP addresses.

###   
Ransomware tracker

- **ShinyHunters (UNC6240)** · Education, healthcare, government, technology · Renewed mass exploitation of Oracle PeopleSoft (CVE-2026-35273), slipping past WAF rules with URL-encoded paths to deploy web shells and MeshAgent. [*Google Threat Intelligence Group*](https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/) *·* [*TrendAI*](https://www.trendaisecurity.com/en/resources-insights/trendai-security-blog/shinyhunters-peoplesoft-one-character-waf-bypass)
- **DragonForce** · Sectors not named · Two backdoors relay command-and-control through legitimate Microsoft Teams TURN servers, with MQTT brokers as a fallback. IOCs published. [*Lab52*](https://lab52.io/blog/backdoors-in-the-dungeon-turn-mqtt-abused-by-dragonforce/)
- **Galago** · Healthcare (claimed) · New operation claiming a partnership with the Panzer group and one victim, an Icelandic healthcare organization. Neither claim has been confirmed. [*Cryptika*](https://www.cryptika.com/new-galago-ransomware-operation-emerges-with-links-to-panzer-group/)

---

## Threat Activity & Tradecraft

####   
NeedyMantis malware linked to the DAEMON Tools supply chain attack

[Microsoft](https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/) details NeedyMantis, a modular post-compromise malware family used since at least October 2025 against telecom operators, universities, medical nonprofits, intergovernmental organizations and government contractors. Microsoft found it while working indicators from the DAEMON Tools supply chain compromise that Kaspersky reported, and ties one cluster to Storm-3069, which it assesses originates from China.

NeedyMantis arrives after initial access, sideloaded as a fake DLL beside legitimate programs such as Poedit, curl, Vim and TightVNC. It uses custom encrypted archives and modular components, and talks to its C2 over HTTPS before switching to WebSockets.

- **Exposure:** Windows environments in the targeted sectors where attackers already have a foothold.
- **Response:** Block corp.tripswithengine\[.\]com, and enable cloud-delivered protection, EDR in block mode and network protection.
- **Detections:** [Microsoft published](https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/) Defender XDR and Sentinel hunting queries, Defender detections and IOCs.

###   
In brief

- **Attackers hide malware with Defender exclusions:** Attackers with admin access add path and extension exclusions through PowerShell, WMI, Group Policy or the registry, then set `HideExclusionsFromLocalAdmins` to hide them. Alert on new exclusions for C:, Temp or Downloads. [*Huntress*](https://www.huntress.com/blog/you-can-run-but-you-cant-hide-defender-exclusions)
- **MSSQL turned into a C2 and exfiltration channel:** A post-exploitation toolkit uses Microsoft SQL Server for command execution, credential theft, lateral movement and data exfiltration. [*Cryptika*](https://www.cryptika.com/hackers-turned-a-microsoft-sql-server-into-a-command-and-data-exfiltration-channel/) *·* [*Cyber Press*](https://cyberpress.org/mssql-toolkit-threatens-credentials/)

---

## Further Reading

- **Chrome update fixes more than 100 flaws:** The most severe allows code execution; no known exploitation. [*Center for Internet Security*](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution%5F2026-101)
- **Phishing URLs built to confuse parsers:** URLs that mix userinfo fields, invalid hostname labels and embedded email addresses look valid to browsers but trip up security tools. [*SANS Internet Storm Center*](https://isc.sans.edu/diary/rss/33366)

---

*Every item links to its original source. Spot an error? Reply or leave a comment. Know a defender who'd find this useful? Forward it along.*

GPP Labs · Threat Intelligence & Detection Engineering  
GPP // Genuine People Personality™