Triaging the Week 110
AI fuels wave of industrial-scale malware, forcing defenders to battle new threats on the cloud, mobile, and the abuse of legitimate tools
Hello there 👋
Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!
Top News Stories
Iran-Linked ‘MuddyWater’ Targets U.S. Critical Infrastructure with New ‘Dindoor’ Backdoor
The state-sponsored hacking group MuddyWater (Seedworm) has launched a fresh campaign targeting U.S. banks, airports, and software suppliers using a sophisticated new backdoor dubbed “Dindoor.” This campaign marks a significant escalation in Iranian cyber operations, focusing on cloud control planes and identity theft to infiltrate sensitive networks.
Key takeaways
🔒 Dindoor Backdoor Discovered: A previously unknown backdoor leveraging the Deno JavaScript runtime has been identified, allowing attackers to execute malicious code and maintain persistence within corporate environments.
🚨 High-Value Sector Targeting: The campaign specifically targets U.S. financial institutions, aviation infrastructure, and defense-linked software providers, often exploiting regional geopolitical tensions to frame its social engineering attacks.
💡 Weaponizing Legitimate Cloud Tools: Threat actors are bypassing traditional perimeters by using legitimate utilities like Rclone and cloud storage providers like Wasabi and Backblaze for data exfiltration and malware delivery.
🛡️ Immediate Defense Requirements: To mitigate these threats, organizations must enforce phishing-resistant Multi-Factor Authentication (MFA), implement strict network segmentation, and urgently patch internet-facing edge devices.
Fake ‘Claude Code’ Guides Delivering Infostealers via ‘InstallFix’ Attacks
Threat actors are capitalizing on the hype surrounding Anthropic’s new Claude Code tool by creating fraudulent installation guides that trick developers into executing malicious PowerShell commands. This campaign utilizes “InstallFix” social engineering tactics to bypass traditional security perimeters and deploy infostealers designed to harvest sensitive credentials.
Key takeaways
🚨 Sophisticated Social Engineering: Attackers are leveraging SEO poisoning and fake GitHub repositories to lure users to sites that claim to “fix” installation errors by having the user paste malicious code directly into their terminal.
🔒 Targeting Developer Assets: The primary goal of these infostealers is to exfiltrate browser data, cryptocurrency wallets, and sensitive environment variables (API keys) stored on developer machines.
💡 Exploiting AI Adoption Trends: This campaign specifically targets the high-demand AI sector, knowing that developers are often eager to troubleshoot and install the latest coding assistants quickly.
🛡️ Verify Before You Paste: Always use official documentation from verified domains like anthropic.com and never execute PowerShell or Bash scripts from third-party “fix” sites without a thorough code audit.
Industrializing Malware: Transparent Tribe’s New AI-Driven Strategy
The threat actor Transparent Tribe (APT36) has transitioned to an AI-assisted “industrialization” model, using Large Language Models to mass-produce disposable malware in exotic programming languages. This “Distributed Denial of Detection” (DDoD) strategy aims to overwhelm defensive telemetry by flooding environments with a high volume of unique, unique-language implants.
Key takeaways
🚨 Rise of “Vibeware”: Attackers are leveraging AI to generate functional code in unfamiliar languages like Nim, Zig, and Crystal, creating a massive volume of unique binaries that challenge traditional signature-based detection.
🌐 Abusing Trusted Services: To remain stealthy, the campaign utilizes legitimate platforms, including Slack, Discord, Google Sheets, and Supabase, for Command and Control (C2) traffic, blending in with everyday business operations.
💡 Quantity Over Quality: The strategy shifts from technical sophistication to a “brute force” volume approach, attempting to bypass security monitoring by simply exhausting the capacity of security teams to analyze every new sample.
🛡️ Modern Defense Required: As AI lowers the barrier for malware creation, organizations must move beyond signatures and prioritize behavior-based detection, anomaly monitoring, and strict egress filtering for cloud services.
Trusted Chrome Extensions Turn Malicious After Ownership Change
Cyber researchers have identified popular Chrome extensions, including QuickLens and ShotBird, that are now harvesting sensitive user data and injecting malicious code following a change in ownership. This tactic allows attackers to weaponize once-reputable tools to bypass security headers and siphon your personal credentials.
Key takeaways:
🦠 Malicious Ownership Shift: Attackers are acquiring legitimate extensions to push two-stage malware, enabling remote browser control and host-level execution pivots.
🕵️ Stealthy Data Harvesting: Hijacked tools hook HTML input elements to capture passwords, PINs, card details, and browsing history directly from your browser.
🛡️ Bypassing Critical Security: Malicious updates strip security headers like X-Frame-Options, allowing scripts to bypass Content Security Policy (CSP) protections and poll external servers for commands.
🔒 Immediate Mitigation: You should immediately uninstall QuickLens and ShotBird, audit your browser for unknown extensions, and avoid unverified productivity tools.
Shift in Cloud Threats: Software Flaws Outpace Weak Credentials
Google’s latest Threat Horizons report highlights a critical pivot in attacker tactics, where exploiting unpatched software and misconfigurations has officially overtaken weak passwords as the leading cause of Google Cloud Platform (GCP) compromises. This shift signals a move toward more technical exploitation, requiring a more sophisticated defensive posture from security teams.
Key takeaways
🚨 Exploitation Surge: Software vulnerabilities and misconfigurations now account for the largest share of cloud breaches, proving that attackers are moving beyond simple brute-force attempts to find deeper technical gaps.
🔑 Service Account Risks: Leaked or poorly managed service account keys remain a critical blind spot, frequently weaponized by threat actors to maintain persistence and move laterally through your infrastructure.
💰 Cryptomining Dominance: While data exfiltration is a growing concern, the primary motive for GCP attackers remains the hijacking of high-performance resources for unauthorized cryptomining operations.
🛡️ Defensive Priority: Organizations must transition their focus from simple credential hygiene toward aggressive patch management, automated configuration audits, and strict “Least Privilege” IAM policies.
New Microsoft Teams Phishing Campaign Deploys Persistent Backdoors
Threat actors are increasingly exploiting the inherent trust of collaboration platforms to impersonate IT support and trick employees into granting remote access via Quick Assist. This sophisticated attack chain bypasses traditional email filters to deploy the “A0Backdoor,” giving attackers a permanent foothold in corporate networks.
Key takeaways
🎭 The “Spam-to-Support” Tactic: Attackers overwhelm targets with junk notifications before posing as a helpful IT technician on Teams to “resolve” the fake issue—a classic psychological play to lower defenses.
🛠️ Abusing Legitimate Tools: By weaponizing Microsoft’s own Quick Assist tool, hackers can take full control of a system without triggering standard malware alerts that look for malicious file downloads.
🦠 Stealthy Communication: The deployed A0Backdoor uses specialized DNS MX queries for its command-and-control (C2) traffic, making it incredibly difficult for standard network monitoring tools to detect the breach.
🛡️ Actionable Defense: Organizations should enforce “out-of-band” verification for all remote support requests and evaluate whether to restrict or disable Quick Assist via Group Policy to prevent unauthorized sessions.
New ‘Kadnap’ Botnet Hijacks ASUS Routers for Global Proxy Service
A sophisticated new malware called “Kadnap” is targeting ASUS routers and other edge devices to conscript them into a decentralized proxy botnet. This campaign utilizes peer-to-peer protocols to hide command-and-control servers, making it exceptionally difficult for traditional security monitoring to detect.
Key takeaways:
🕵️♂️ Stealthy P2P Network: Kadnap employs a custom Kademlia Distributed Hash Table (DHT) protocol to mask its infrastructure within legitimate peer-to-peer traffic, effectively evading standard network detection tools.
🛡️ Persistent Access: The malware establishes long-term persistence by creating cron jobs that execute malicious shell scripts hourly, ensuring the bot remains active across device reboots.
⚠️ Monetized Cybercrime: Compromised devices are marketed through the “Doppelgänger” proxy service, allowing other threat actors to purchase anonymous access to your home or office IP address for illicit activities.
🔒 Urgent Mitigation: Security professionals recommend updating firmware immediately, disabling remote WAN management, and replacing end-of-life (EOL) hardware that no longer receives security updates.
New ‘Zombie ZIP’ Evasion Technique Bypasses Security Gateways
A clever new malware delivery method dubbed “Zombie ZIP” is allowing threat actors to slip malicious payloads past standard security headers by exploiting differences in how archive tools parse concatenated files. By nesting malicious archives within legitimate-looking ones, attackers can trick security scanners into only inspecting the harmless “outer” layer while the end-user’s extraction tool reveals the hidden threat.
Key takeaways:
🧟 Archive Concatenation: The “Zombie ZIP” technique works by appending multiple ZIP files into a single document. While many security tools only scan the first archive structure they encounter, popular extraction tools like WinRAR or 7-Zip may process the secondary, malicious payload.
🕵️♂️ Parsing Discrepancies: This exploit relies on the “Central Directory” structure of ZIP files. If a security gateway isn’t configured to identify multiple directory headers within a single file, the “zombie” archive remains invisible to detection.
🛡️ Defensive Gap: Because this is a structural manipulation rather than a traditional exploit, many signature-based antivirus solutions and email filters are currently failing to flag these files as suspicious.
💡 Proactive Protection: Organizations should ensure their security mail gateways are updated to support multi-part archive inspection and consider “Zero Trust” file policies that strip or sandbox all incoming archives from untrusted sources.
HR Departments Targeted by New ‘BlackSanta’ EDR-Killer Malware Emerges
Cybercriminals are deploying a dangerous new malware strain dubbed “BlackSanta” that specifically targets Human Resources departments to bypass enterprise security defenses. By utilizing a “Bring Your Own Vulnerable Driver” (BYOVD) technique, this malware effectively “kills” Endpoint Detection and Response (EDR) tools, leaving the network defenseless against the ensuing ransomware.
Key takeaways:
🚨 Targeted Phishing: Attackers are exploiting HR workflows by sending malicious attachments disguised as job applications or employee complaints to gain an initial foothold.
🛡️ EDR Neutralization: BlackSanta leverages known vulnerable (but legitimately signed) drivers to terminate security software processes, rendering standard antivirus and EDR solutions blind to its presence.
🔒 Ransomware Execution: Once security monitoring is disabled, the malware deploys its ransomware payload, encrypting sensitive corporate data and initiating extortion demands.
💡 Proactive Defense: Organizations should implement strict “Allow Lists” for drivers and ensure that HR staff receive specialized training to identify sophisticated phishing attempts that go beyond basic spam.
Meta Strikes Back: 150,000 Scam Accounts Terminated in Global Crackdown
Meta has disabled over 150,000 accounts linked to industrialized scam centers in Southeast Asia as part of a massive international law enforcement operation involving the U.S., U.K., and various Asia-Pacific authorities. This coordinated effort targeted criminal networks operating “scam factories” that leverage sophisticated fraud to target users globally.
Key takeaways:
🌐 Global Law Enforcement Coordination: The crackdown led to 21 arrests by the Royal Thai Police and targeted criminal compounds in Cambodia, Myanmar, and Laos that operate full-scale businesses designed to avoid detection.
📱 New User Protection Tools: Meta is rolling out suspicious account warnings on Facebook and alerts for fraudulent WhatsApp device-linking requests to prevent attackers from hijacking accounts via malicious QR codes.
🤖 AI-Powered Scam Detection: Messenger has expanded its advanced detection capabilities, using AI to prompt users for a scam review when conversations with new contacts exhibit suspicious patterns, such as fake job offers.
🛡️ Vigilance is Essential: Despite the removal of 10.9 million scam-associated accounts in the past year, these industrial-scale operations are constantly evolving; always verify the identity of new contacts and avoid scanning unsolicited QR codes.
Global MedTech Giant Stryker Paralysed by Massive Wiper Attack
Medical technology leader Stryker is facing a complete operational shutdown following a devastating wiper malware attack attributed to the Iranian-affiliated group “Handala.” With 50TB of data reportedly stolen and over 200,000 systems wiped, including employees’ personal phones. This incident marks a significant escalation in destructive cyber warfare.
Key takeaways:
🚨 Destruction Over Profit: Unlike traditional ransomware, this attack utilized “wiper” malware designed to permanently delete data and disable hardware, aiming for maximum disruption rather than a financial payout.
📱 The MDM Vulnerability: Attackers bypassed security by leveraging Mobile Device Management (MDM) systems to remotely wipe corporate laptops and personal devices enrolled for work, leading to a total loss of local data for thousands of staff.
🌐 Global Supply Chain Paralysis: The breach forced Stryker’s operations in 79 countries offline, reverting critical medical manufacturing workflows to “pen and paper” and causing a massive ripple effect in the healthcare sector.
🛡️ Prepare for “Scorched Earth” Tactics: Organizations must move beyond ransomware defense to prioritize immutable backups and strict MDM permissioning to survive targeted campaigns that seek to destroy infrastructure entirely.
250,000+ WordPress Sites at Risk from SQL Injection Flaw
A high-severity SQL injection vulnerability in the Elementor “Ally” accessibility plugin allows unauthenticated attackers to steal sensitive data from WordPress databases. Despite a patch being available since late February, more than a quarter-million websites remain exposed to potential data theft and system exploitation.
Key takeaways:
🔒 CVE-2026-2313 Explained: Attackers can inject malicious SQL commands via a URL parameter to extract sensitive information, highlighting the persistent danger of insufficient input sanitization.
🚨 Widespread Vulnerability: Current data shows only 36% of users have upgraded to the secured version, leaving approximately 250,000 sites wide open to time-based blind SQL injection attacks.
🛠️ Specific Triggers: The vulnerability is exploitable if the Ally plugin is connected to an Elementor account and its “Remediation module” is actively running on the site.
🛡️ Immediate Action Needed: Administrators must update the Ally plugin to version 4.1.0 immediately and should also upgrade to WordPress 6.9.2 to address other critical security flaws.
Researchers Bypass Perplexity’s Comet Security in Under 4 Minutes
A new study reveals how “Agentic Blabbering” allows attackers to exploit the reasoning processes of AI-powered browsers to facilitate phishing scams. This research highlights a critical shift in the threat landscape where the target of a cyberattack is no longer the human user, but the AI agent itself.
Key takeaways
🚨 Exploiting “Agentic Blabbering”: AI browsers often “narrate” their security reasoning aloud, providing a constant feedback loop that attackers can use to iteratively refine phishing pages until they are deemed “safe” by the AI.
🔄 A Shift in the Attack Surface: Threat actors are moving away from traditional social engineering of humans toward manipulating AI models, using automated tools to ensure malicious content bypasses AI guardrails on the first attempt.
💡 Automated Scam Generation: By leveraging Generative Adversarial Networks (GANs), researchers demonstrated that phishing pages can be optimized to defeat specific AI filters in less than four minutes.
🛡️ The Need for System-Level Safeguards: Prompt injection remains a fundamental challenge for LLMs; organizations must implement robust, multi-layered safeguards rather than relying solely on autonomous AI agents for security decisions.
AI-Generated Malware ‘Slopoly’ Fuels New Hive0163 Ransomware Attacks
Researchers have identified “Slopoly,” a suspected AI-generated malware utilized by the Hive0163 threat group to maintain persistent backdoor access during ransomware operations. While the script itself is not highly complex, its development highlights how generative AI is significantly accelerating the malware production lifecycle for cybercriminals, allowing them to weaponize new frameworks in record time.
Key takeaways
🤖 AI-Assisted Weaponization: Slopoly features extensive logging, error handling, and descriptive comments, clear hallmarks of LLM-generated code, enabling attackers to deploy functional C2 frameworks with minimal manual effort.
🛡️ Stealthy Persistence: The malware achieves persistence by mimicking legitimate system components, specifically through a scheduled task named “Runtime Broker,” allowing it to hide in plain sight on compromised servers for weeks.
🎣 ClickFix Social Engineering: Initial access frequently relies on “ClickFix” tactics, which trick users into manually executing malicious PowerShell commands under the guise of “fixing” browser or document errors.
📊 Multi-Stage Infection Chain: Slopoly is the final anchor in a sophisticated toolkit that includes NodeSnake and Interlock RAT, designed for large-scale data exfiltration and the eventual deployment of Interlock ransomware.
6 New Android Malware Families Targeting Global Payments
Researchers have uncovered a wave of sophisticated Android malware, including PixRevolution and TaxiSpy, capable of hijacking real-time financial transfers and bypassing modern security controls. These “human-in-the-loop” threats allow attackers to monitor your screen and intervene at the exact moment you authorize a payment to drain your banking apps or crypto wallets.
Key takeaways
🔓 Accessibility Abuse: These malware families trick users into enabling “Accessibility Services,” granting the attacker absolute control over the device’s interface, allowing them to read keystrokes and dismiss notifications.
💸 Real-Time Transaction Swapping: PixRevolution targets instant payment platforms (like Brazil’s Pix) by displaying a fake “Wait” overlay while it covertly swaps the intended recipient’s payment key for the attacker’s in the background.
🤖 The Rise of Mobile MaaS: Advanced tools like Oblivion and Mirax are now sold as “Malware-as-a-Service” (MaaS) on Telegram, providing low-skill actors with automated permission bypasses and deep persistence for a monthly fee.
🕵️ Stealth Persistence & AI: From playing inaudible audio loops to prevent the app from being killed to experimenting with LLM (AI) modules, these threats are evolving to be more resilient and harder to detect than traditional trojans.
Feature Video
Your incident response team is playing whack-a-mole. Block the C2. Re-image the host. Close the ticket. Repeat. Sound familiar?
That’s not threat intelligence, that’s reactive firefighting. The F3EAD cycle changes everything!
🔍 Find & Fix smarter - don’t just wait for alerts. Use tools like Velociraptor and RITA to proactively hunt based on intelligence from previous incidents, not just the one in front of you.
🧠 Exploit your evidence - before you nuke that compromised host, capture RAM with FTK Imager, pull a pcap, and run the binary through a sandbox. One Cobalt Strike beacon can unravel an entire threat actor’s infrastructure if you know where to look.
🔗 Pivot with the Diamond Model - one malicious domain → WHOIS lookup → email alias → 12 more domains → attributed to APT28. That’s the difference between blocking one IOC and mapping a full campaign.
📢 Disseminate or waste it - push IOCs to MISP for auto-sync to your firewall, write Sigma rules for your hunters, and brief leadership with actionable recommendations. Intelligence that isn’t shared is intelligence wasted.
See F3EAD in action using a variety of free and open-source security tools in this video. Move from firefighter to intelligence power user!
Feature Course
What Will You Learn?
The basics of cyber threat intelligence (CTI)
Key concepts used within the cyber threat intelligence industry.
How CTI is applied in the real-world
Common challenges and how to overcome them
Learning Resources
Cyber Training
Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development. They equip you with the latest tactics and techniques to succeed in security and defence strategies.
TCM Academy: A comprehensive suite of courses, including everything from penetration testing to malware analysis. Their hands-on, practical approach to training is designed to equip students with the real-world skills needed to succeed in cyber.
Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert. Learn to defend like a pro.
Tools
Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your custom cyber threat intelligence web scraping tool!