Anomali Cyber Watch: MythicRatatoskr Backdoor & PHP2Shell

BRONZE SANDCASTLE, a newly designated China-based threat group that researchers could not reliably link to existing groups despite overlapping geographic targeting, conducted intrusions in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea between August 2025 and August 2026. Activity was concentrated in UTC+8, with operating hours consistent with the 996 working pattern (9 a.m. to 9 p.m., six days a week) observed in China’s tech sector. The group’s defining technique is dynamic-link library (DLL) sideloading, which tricks trusted, signed applications into loading attacker-controlled code, bypassing security tools that assess processes by reputation rather than by what they load. Nine sideloading combinations were identified across Sandboxie, Java, Krita, NVDA NonVisual Desktop Access, LINE, and Sysinternals utilities. The malicious DLL decrypts and reflectively loads a modified Meterpreter-based backdoor from an encrypted config.ini file in memory, leaving no additional disk artifacts during execution. Custom API hashing and COFFLoader components distinguish the payload from standard Metasploit shellcode. Post-exploitation included network and account enumeration and extraction of ntds.dit, Active Directory’s central credential database, via Volume Shadow Copy. Both payload versions communicated with legitimate external services including file[.]io, gofile[.]io, and ably[.]net, possibly for operator tasking. Version 1.1.5 used actor-controlled domains for command and control (C2); version 1.1.7 retrieved encrypted configuration files via the GitHub API, routing traffic through trusted infrastructure.

Source

Analyst Comment

The principal defensive implication of this campaign is that static detection is likely insufficient against this class of activity. The combination of runtime decryption, reflective in-memory loading, and trusted-application sideloading is specifically engineered to defeat file-based scanning and process-reputation controls, and organizations that rely primarily on those approaches should not assume they would have visibility into this intrusion chain. Where memory-based and behavioral detection capabilities exist, the signal Sophos identifies is specific: DLLs reading local files followed by immediate in-memory execution, alongside reflective loading patterns and anomalous in-memory PE headers. This analyst would additionally prioritize endpoint detection and response (EDR) coverage on domain controllers based on the documented post-exploitation activity, though that recommendation is a synthesis of the TTPs rather than a source finding. The most actionable detection opportunity is vssadmin.exe creating a Volume Shadow Copy outside a known backup schedule or administrator change window; legitimate activity can generate the same event and should be accounted for when tuning. By the time ntds.dit has been copied, domain-wide credential exposure is a realistic consequence. On C2, rather than blocking file[.]io, gofile[.]io, ably[.]net, or ably[.]io outright, alert on those destinations from processes with no legitimate reason to reach them. Detections built against version 1.1.5 indicators should not be assumed to cover future variants. The TTPs documented here determine what to detect and how to respond; organizations outside the documented target geographies should not consider themselves out of scope.

Storm-0940, a China state-aligned threat actor with no known industry aliases, has conducted automated attacks against hundreds of organizations across at least 14 industries since September 2026 using ARTEX, an originally open-source artificial intelligence penetration testing framework that autonomously executes attack chains from reconnaissance through data exfiltration. Between October 10 and 14, the group ran a password spray campaign from the 144.172.64[.]x infrastructure range against 327 accounts across eight organizations, generating over 151,000 failed login attempts that peaked at 2,900 per minute on October 11; none succeeded. On October 15, as public reports of the ConnectWise Cloud Backup compromise surfaced, Storm-0940 pivoted to stolen credentials from four ConnectWise application accounts and attempted to sign-in to more than 2,250 downstream Microsoft 365 tenants without user interaction, exploiting the trusted access those applications already held. Where agents progressed beyond authentication, documented activity included Microsoft Graph directory reconnaissance, credential additions to existing application identities to establish persistent backdoor access that survives remediation of the original compromise, privileged role manipulation, and bulk secret reads from Azure Key Vaults. In multiple environments, the time from initial contact to privileged access was under three hours. Successful authentication alone does not confirm data was accessed or exfiltrated.

Source

Analyst Comment

The immediate priority for any organization where a ConnectWise Cloud Backup application was present or previously authorized is not removal of the application but audit of what occurred while it had access. Disabling the ConnectWise connection does not remove credentials that Storm-0940’s agents may have added to existing service principals during the compromise window, which can remain active as working backdoors regardless of what happens to the original application. Microsoft’s mitigation guidance sets October 15, 2026 as the baseline starting point for reviewing service principal credential additions, and recommends extending that lookback to October 1 where log retention permits, because the broader ARTEX campaign predates the public ConnectWise disclosure by several weeks. Microsoft’s published hunting queries for Microsoft Defender XDR and Sentinel identify whether any of the four affected ConnectWise application IDs were present in a tenant and authenticated from the documented infrastructure range; for organizations with existing Microsoft tooling, running those queries is the most concrete immediate step available. The absence of confirmed exfiltration should not reduce that urgency: if Storm-0940 achieved privileged persistence or accessed Azure Key Vault secrets in an environment, whether data was also taken is a secondary question to whether access remains active. On the broader significance, the ConnectWise supply chain access was the fundamental enabler of this campaign, with ARTEX amplifying it by eliminating the time advantage defenders typically hold after a compromise is detected; in multiple environments the window between initial access and privileged persistence was under three hours, likely faster than most alert-review-respond cycles operate. The more consequential defensive gap is not AI-driven attacks specifically but the combination of under monitored third-party application permissions and detection timelines calibrated to human-speed intrusion. Any application holding broad Microsoft Graph permissions warrants the same scrutiny here, irrespective of the vendor.

An autonomous offensive AI agent, operating under a directive the attackers named “Skynet,” was captured via a security honeypot in summer 2026 after the trap logged over 127,000 requests from tens of thousands of unique addresses. The agent employs LLMjacking, targeting AI model endpoints left unauthenticated or accessible via stolen API keys, routing attacks through victims’ infrastructure to shift costs, gain anonymity, and avoid account bans. The five-layer prompt jailbreaks a commercial model into compliance: a false identity as a branded coding assistant, a directive reframing credential and environment file access as routine development work, a companion persona designed to override refusals, a protocol suppressing the model’s own safety responses, and approximately 74 offensive tool definitions. Those tools execute a full attack chain covering internet-wide target discovery, exploitation of web frameworks, server-side request forgery to reach cloud credential stores, database dumping, and botnet command-and-control, with the agent authorized to run up to 100,000 steps unattended. A separate obfuscated payload, captured the following day, deployed XMRig Monero-mining software targeting go2rtc video streaming servers by default, disguising the miner as a logging utility (.trace), falling back to the current directory on any system, its configuration made tamper-resistant and local logs continuously erased.

Source

Analyst Comment

The significance lies less in the individual techniques, none of which are novel, and more in what their assembly suggests about evolving offensive AI use. The operators embedded a commercial model into an attack workflow as a reasoning engine, seeking AI infrastructure to power it. Whether this represents a broader shift or an isolated case is not established by a single honeypot capture; the 127,000 request volume confirms sustained scanning activity against AI endpoints but not how many actors are operating this way. Exposure splits into two problems: organizations running self-hosted AI models, AI gateways, or MCP servers without authentication face the more direct risk and any such infrastructure should be treated as already identified and likely tested; stolen API keys, observed in honeypot traffic during the capture period and commonly originating from developer environments, public repositories, and misconfigured pipelines, are a concern for any organization using commercial AI services, with anomalous inference spend the most accessible indicator of abuse. The 74 tool definitions, spanning web framework exploitation, server-side request forgery, and database extraction, suggest in this analyst’s assessment a platform built for indiscriminate targeting. The XMRig payload, delivered the following day via a distinct mechanism, is treated by the primary researchers as a unified campaign; applying a stricter evidential standard, the connection remains plausible but not conclusively established.

Researchers attribute Operation FlashHole to Lazarus Group and assess with medium-to-high confidence that the same actor conducted Operation SyncHole, linking both to the Cascade Hole campaign. The operation targeted at least three South Korean organizations across the software, construction, and wired communication equipment manufacturing sectors from at least July 2025. Spear-phishing links to tailored GitHub Pages sites are assessed as the initial delivery mechanism, with site visits assessed to have initiated infection via CrossWeb EX, a financial security solution required to access South Korean online banking and government websites. Under the CrossWeb EX process, the legitimate Windows binary fsquirt.exe was injected with shellcode containing TechHub, a downloader using private GitHub repositories. TechHub deployed TouchHub, which launched TouchShift; TouchShift executed a second TechHub instance deploying ClientHub and LPEClient. Cubridge, present in memory during initial compromise, was redeployed as the modular orchestrator for file management, command execution, reconnaissance, and screen capture. ClientHub uses SNOW 1.0, identified as its first observed appearance in Lazarus malware. LPEClient uses ML-KEM-1024, standardized by the National Institute of Standards and Technology (NIST) as a post-quantum key encapsulation mechanism, to establish shared cryptographic keys decrypted by Threefish. Additional tooling targets Chromium-based browsers for credentials, cookies, and browsing history.

Source

Analyst Comment

Lazarus’s integration of ML-KEM-1024, standardized by NIST in August 2024, alongside substantial revisions to its malware framework, reflects continued investment in operational concealment and tooling sophistication. Researchers trace the group’s use of post-quantum cryptographic capabilities to at least September 2024, indicating this approach predates Operation FlashHole and is an established part of the group’s toolkit. The more immediate defensive implication is architectural: the initial execution chain runs in memory, while cryptographic protection limits the effectiveness of detection approaches that rely primarily on file writes or network content inspection. Behavioral detection, EDR with memory scanning, process ancestry monitoring, and network metadata analysis provide important detection opportunities at the point of compromise. Persistence components do write files to disk, and the published file hashes, paths, and C2 indicators are worth checking against your telemetry now. Although confirmed FlashHole victims are in South Korea, the underlying techniques are transferable: GitHub and Dropbox as C2 channels, DLL side-loading through trusted Windows binaries, and browser credential harvesting apply across environments. Software supply chain organizations warrant particular attention, as researchers identify software as the only sector targeted in both SyncHole and FlashHole, suggesting sustained interest in organizations whose code or vulnerabilities could support subsequent operations.

UAC-0099 gained initial access to a Ukrainian grain logistics company on July 16, 2025, via a spear-phishing email with a malicious attachment, deploying the MATCHWOK backdoor through a downloader called MATCHBOIL. The following day, the attackers deployed MythicRatatoskr, a previously undocumented Go-based backdoor that routes command-and-control (C2) traffic through Yggdrasil, a decentralized mesh network. The C2 server uses a Yggdrasil IPv6 address rather than a conventional public-facing domain or IP address; traditional domain seizure and DNS sinkholing cannot directly disrupt the C2 endpoint, though blocking the malware’s hardcoded public peer addresses is a viable mitigation. The backdoor installs as a Windows service and supports file transfer, screenshot capture, cmd.exe shell execution, directory enumeration, C2 URL modification, and reverse SOCKS5 proxy management. Some samples include a 10-minute delay before connecting, likely to evade detection. ESET attributes initial access to UAC-0099 and the data-wiping to Sandworm, both with high confidence, and assesses the handoff with equal confidence, though MythicRatatoskr’s operator remains undetermined. Sandworm deployed SDelete via Active Directory Group Policy on September 17, 2025. Unix-style configuration artifacts suggest a Linux variant may exist. To ESET researchers’ knowledge, this is the first documented case of a state-aligned threat actor abusing Yggdrasil for C2.

Source

Analyst Comment

ESET has published the 32 hardcoded Yggdrasil peer addresses MythicRatatoskr requires to join the mesh; blocking these at the network perimeter is a practical, ESET-supported mitigation for the analyzed variants. File hashes, service names, installation paths, and configuration locations are in ESET’s research and GitHub repository; service names and paths are most useful as hunt criteria rather than standalone indicators. Beyond the specific tooling, the 63-day interval between initial access and data destruction is the detail that should give defenders pause. Earlier detection and effective containment during that window could have disrupted the attack before the destructive phase. Defenders should treat initial access detection as the start of an investigation, not its conclusion. Where access broker models are in play, the group that triggered the alert and the group positioned to cause lasting damage may be entirely different, with different tooling and infrastructure. MythicRatatoskr’s decentralized mesh C2 complicates conventional public IP- and domain-based detection; its command server has no public internet presence and cannot be sinkholed, requiring endpoint telemetry and behavioral detection alongside network indicators. Previous documented cooperation among Russia-aligned groups, including Gamaredon-Turla activity, makes inter-group access transfers a credible scenario that defenders should account for in incident response planning.

Cloudflare observed tens of thousands of PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) exploitation attempts within 45 minutes of October 21, 2026 disclosure, rising to millions by October 22; Censys estimated 34.4 million PHP services remained vulnerable on October 23. Both flaws are in the PHP engine, not application code, and permit unauthenticated remote code execution via crafted HTTP requests: CVE-2026-109618 involves memory corruption during out-of-memory handling; CVE-2026-109619 exploits stale use-after-free state across sequential worker requests. One weaponized cluster attempted to deliver Potassium, a Mirai-derived DDoS botnet first identified in March 2026, with a ChaCha20-encrypted configuration table; its live command-and-control (C2) channel uses X25519 and ChaCha20-Poly1305 with a static XOR fallback and 24 attack-vector slots spanning UDP, TCP, ICMP, GRE, and OpenVPN, one a non-functional stub. Multiple source addresses attempted to retrieve payloads from 92.118.112[.]100; sandbox analysis observed C2 communication to 134.199.154[.]64 and DDoS targeting of two Ukrainian-network hosts, without establishing compromise of those targets. Address space layout randomization (ASLR) presented a significant exploitation barrier, though researchers demonstrated a memory-leak bypass on production x86-64 systems. No compromise was confirmed as of October 23; patches cover PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, while PHP 7.4, 8.0, and 8.1 received source-level backports.

Source

Analyst Comment

Patching is the only complete mitigation, and for many defenders the first challenge is confirming who actually owns that responsibility. PHP is embedded in hosting platforms, content management systems, and third-party appliances organizations may not directly control; inventorying those deployments, verifying upstream or vendor-backported fixes, and restarting affected PHP workers are the immediate priorities. CVE-2026-109618 can trigger before application code executes in Apache mod_php environments, making application-level input validation insufficient at the engine level, though PHP-FPM and other serving configurations are also affected. WAF rules offer partial, potentially bypassable coverage for proxied traffic and should stay active during the patch window, not replace it. Amazon’s MadPot telemetry identified a PHP2Shell exploitation attempt on October 17, four days before public disclosure, making that the earliest documented starting point for retrospective log review rather than October 21. Investigators should correlate suspicious multipart POST requests and PHP memory or worker errors with unexpected child processes from web-serving processes, executable writes to temporary directories, and anomalous outbound connections; these signals are more meaningful together than in isolation. The dormant Ethereum Name Service (ENS) resolution capability present in analyzed Potassium samples warrants monitoring: if activated in future variants, it could reduce reliance on conventional DNS infrastructure and complicate command-and-control disruption, though network-level blocking and detection would remain viable