Anomali Cyber Watch: Sample v3

TA488 (Void Blizzard, Laundry Bear), a Russia-aligned espionage group, resumed operations on July 22, 2026, after no observed activity since February, exploiting CVE-2026-42897, a cross-site scripting (XSS) vulnerability in on-premises Outlook Web Access (OWA). Opening an affected email executes JavaScript within the victim's authenticated session without interaction. Targets spanned US and European government entities and the telecommunications, financial, hospitality, and aerospace sectors. The payload, OWAReaper, is a JavaScript implant running within the OWA tab with no disk footprint. It harvests saved credentials, stores an encrypted copy in localStorage under a legitimate OWA settings key, and plants a hidden iframe in OWA's offline cache to re-infect after re-imaging. If mailbox add-ins with ReadWriteMailbox permissions are installed, OWAReaper steals OAuth tokens and grants any authenticated organization user full access to the victim's mail folders, persisting through credential resets and re-imaging. Commands arrive via GitHub commit messages or inbound emails polled every five minutes; exfiltration uses HTTPS proxied through legitimate image delivery networks, with DNS tunneling as a fallback. Campaign infrastructure dates to March 2026, two months before Microsoft's out-of-band patch for CVE-2026-42897; infrastructure registration alone does not confirm when exploitation began, but zero-day use is assessed as feasible.

Source

Analyst Comment

Any organization running on-premises Exchange with OWA exposed during July 2026 should treat that period as a potential window of undetected compromise, regardless of whether suspicious activity was observed. Based on infrastructure registration dating, March 2026 is the earliest plausible window, though zero-day exploitation prior to July 22 is assessed as feasible rather than confirmed. TA488 launched this campaign the day before a joint government advisory publicly named the group, meaning affected organizations had no warning during the period when exploitation was underway. Standard incident response actions, including credential resets and device reimaging, do not evict this actor; OWAReaper persists through both via mechanisms in the browser cache and on the Exchange server itself. Detection requires looking in places most teams do not routinely examine: Exchange mailbox folder permissions, installed add-in OAuth tokens, and OWA's offline storage. In this analyst's assessment, these fall outside typical SOC playbooks and are likely to require specialist Exchange forensics expertise. Organizations in the targeted sectors (government, telecommunications, financial, hospitality, and aerospace) should prioritize this review. The source report contains specific remediation guidance. The key point is that patching closes the vulnerability but does not address access that may already be established.

A proof-of-concept exploit has been released for CVE-2026-54121 (Certighost), a Windows Active Directory Certificate Services (AD CS) vulnerability allowing a low-privileged authenticated domain user to impersonate a domain controller and achieve domain compromise in default AD CS configurations. The flaw affects the AD CS enrollment fallback, where the Certification Authority (CA) accepts an attacker-controlled request attribute to redirect its identity lookup to an external host without confirming that host is a legitimate domain controller. An attacker creates a machine account via default ms-DS-MachineAccountQuota settings, runs rogue SMB, LSA, and LDAP services, and directs the CA to those services, causing it to issue a certificate for the targeted domain controller. The attacker then authenticates as that domain controller and performs a DCSync attack to extract the krbtgt account's NT hash. The certighost.py script automates the full chain from a single low-privileged account. Researchers reported the flaw to Microsoft on May 14, 2026; Microsoft patched it in the July 2026 Patch Tuesday updates, with the fix required on all Enterprise CA servers. No threat actor exploitation has been confirmed as of publication. A temporary mitigation to disable the vulnerable fallback via certutil exists but is untested in production environments.

Source

Analyst Comment

Organizations running an Enterprise CA (an AD CS deployment integrated with Active Directory, as distinct from a Standalone CA) should treat this as an immediate patching priority on CA servers specifically, not domain controllers alone. The more consequential operational point is retrospective: Microsoft confirmed this vulnerability on May 22, 2026, approximately eight weeks before the patch shipped. Based on that window, defenders should assess whether silent exploitation may have occurred prior to patching, and review CA request logs for certificate issuances tied to domain controller identities from anomalous or newly created computer accounts, and check for DCSync-consistent replication activity from unexpected sources. No threat actor exploitation has been confirmed as of publication, but the public availability of certighost.py, which automates the full attack chain from a standard domain account, materially lowers the barrier. The certutil workaround that disables the chase fallback is an option for environments that cannot patch immediately, but researchers have not validated it in production environments, and disabling a fallback mechanism of this kind plausibly carries a risk of disrupting legitimate cross-domain certificate enrollment scenarios. Teams that do not control patch cycles directly should escalate CA server patching as a distinct action item rather than assuming it is covered by broader domain infrastructure patch runs.

Researchers identified a targeted campaign in July 2026 against government entities in the Middle East, deploying three previously undocumented malware families: TELESHIM, MIXEDKEY, and BINDCLOAK. The attack began with a weaponized ISO file, using document-themed filenames referencing petroleum agreements and border protocols, containing a legitimate ASUSTek binary that sideloaded the first-stage implant, TELESHIM. This 32-bit Windows backdoor routes Command and Control (C2) traffic through the Telegram API to blend malicious activity with legitimate platform traffic. TELESHIM establishes persistence via a scheduled task and employs hypervisor checks, RAM speed queries, and disk I/O stalling to detect and exit analysis environments. A second sideloading chain delivers MIXEDKEY, a loader that applies two sequential XOR decryption layers to the final payload, with the second using a key derived from the target machine's volume serial number to ensure execution only on the intended host. The final stage, BINDCLOAK, is a 64-bit C++ implant beaconing to cert.hypersnet[.]com. Post-compromise activity captured between July 7 and 9, 2026 included system, user, and network reconnaissance, with all C2 commands issued between 4 AM and 12 PM UTC. Researchers assess with moderate-to-high confidence that the actor originates from East Asia; the campaign remains unattributed.

Source

Analyst Comment

While this campaign targets Middle East government entities and may fall outside the immediate threat profile of most organisations, the techniques employed warrant broader attention. The most transferable concern is the use of legitimate binaries to sideload malicious code, a method that directly undermines security controls that rely on process reputation or binary trust. Defenders should review whether their detection capabilities account for DLL sideloading via legitimate binaries dropped into attacker-created directories, as signature validation alone is insufficient to identify this activity. The abuse of the Telegram API for C2 communication is a reminder that threat actors increasingly route malicious traffic through legitimate platforms to evade network-based controls; organisations should consider how outbound traffic to trusted communication services is monitored rather than simply permitted. On attribution, the moderate-to-high confidence assessment for East Asia origin without group-level attribution is a meaningful distinction: analysts should not map this activity to a known actor's established playbook until further evidence emerges, and the forthcoming Part 2 analysis of BINDCLOAK may materially change the intelligence picture.

A Chinese-speaking threat actor, assessed to be based in Zhuhai, China and operating under the aliases knaithe and KnYuan, conducted a campaign that combined an autonomous AI-driven attack cycle with separate manual operations against targets across multiple countries. For the autonomous element, the actor used DeepSeek, a large language model (LLM), operating through the open-source Hermes Agent framework, which gave the AI the ability to enumerate exposed targets, research and select vulnerabilities, download public exploit code, and attempt exploitation without human involvement beyond the initial task. In the observed session, the agent autonomously abandoned a failing Langflow attack, researched alternatives, selected n8n workflow automation based on deployment scale and vulnerability severity, and attempted exploitation of that instead. Both autonomous attempts failed due to target-side configuration requirements. Manual operations running in parallel achieved confirmed impact, including memory data exfiltration from three organizations via a Citrix NetScaler vulnerability (CVE-2026-3055), command execution on 11 Marimo notebook instances (CVE-2026-39987), Java deserialization reverse shell attempts against nine Apache Tomcat servers (CVE-2026-34486), and reverse shell attempts against Windows IKE VPN endpoints (CVE-2026-33824). The operation was unintentionally exposed when the Hermes Agent started a file server from the actor's home directory, giving researchers access to tool configurations, API keys, exploit scripts, and session logs.

Source

Analyst Comment

The autonomous campaign did not achieve compromise, but that framing requires care. The agent completed every step of the attack cycle autonomously: it assessed a failed exploitation attempt, identified the limiting condition, researched alternative targets across ten product families, evaluated candidates by severity and deployment scale, selected a new target, obtained exploit code, and initiated attacks without human input after the initial task. The failure was a configuration dependency, not a capability limit. Targets with weaker default configurations would have been susceptible. The more significant detail for defenders is what happened before any exploitation attempt: FOFA enumeration means target selection is already passive and continuous. By the time a CVE is public and a patch cycle is being assessed, exposed instances are likely already queued. That window is assessed to be shorter than most patch processes assume, based on the actor's documented use of automated CVE monitoring and autonomous enumeration operating in parallel. The manual operations, which achieved confirmed data exfiltration and command execution across multiple sectors and countries, confirm this actor is operationally capable independent of the AI tooling. The autonomous capability is a parallel development track, not a replacement, and the actor is actively iterating on it. Defenders should also note that the actor evaluated multiple AI platforms and, based on the tool configurations and proxy routing observed, likely selected DeepSeek because provider-side controls on Western models limited their utility for autonomous offensive use. This assessment is consistent with the source reporting but has not been confirmed as explicit actor intent. Whether this reflects a broader trend in how offensive AI infrastructure is constructed remains an open question, though the conditions that would drive such a trend are present and documented here.

Researchers identified a previously undocumented multi-stage intrusion targeting two endpoints at an unspecified law firm, built around a Go-based loader tracked as HollowFrame and a Rust-based malware family tracked as Matryoshka. The attack began with a spear-phishing email delivering a link that directed recipients through an attacker-controlled redirector (avvoalert[.]info) to an encrypted archive hosted on Mega, containing a malicious Windows Shortcut (LNK) disguised as case documents. Executing the shortcut triggered a chain of native Windows tools that decoded and ran an obfuscated PowerShell script, which elevated privileges, pre-emptively excluded a staged Python directory and the python.exe process from Microsoft Defender scanning, then downloaded a trojanized Python package from 2.26.252[.]84. Rather than running Python code, the package used the legitimate python.exe binary to sideload a malicious Go DLL, which decrypted and executed HollowFrame. The framework supported multiple in-memory payload execution techniques, anti-sandbox checks, and three persistence mechanisms: a scheduled task, a Windows Management Instrumentation (WMI) logon-session subscription, and Startup-folder deployment. HollowFrame then decrypted and dropped loader_panda.exe, which sideloaded Matryoshka HTTP (version.dll) inside a legitimate OneDrive updater process, establishing a Command and Control (C2) channel to 45.158.196[.]184:8888 over plaintext HTTP. A second Matryoshka variant (wtsapi32.dll), recovered from the same intrusion, sideloaded as a proxy for a trusted Windows DLL and used a private GitHub repository as its C2 channel, assigning each compromised endpoint its own directory for tasking, results, and file delivery. That variant also included built-in Active Directory reconnaissance and secondary payload execution. No attribution was identified.

Source

Analyst Comment

This intrusion is notable less for any individual technique than for its deliberate architecture. Each stage was designed to appear unremarkable in isolation, distributing malicious behavior across legitimate runtimes, signed binaries, and trusted cloud services including GitHub, meaning detection depends on correlating activity across endpoint, identity, process, and network telemetry simultaneously. The most accessible intervention point for the widest range of defenders is the initial LNK execution: shortcut files spawning encoded command sequences, certutil decoding activity in temporary directories, and PowerShell requesting elevation shortly after user interaction are behaviors detectable without a commercial endpoint product, provided process creation logging with command-line auditing is enabled. Detections requiring DLL load visibility from user-writable paths or process tree correlation under updater binaries are realistic only for organizations with mature endpoint detection capability, and defenders should be honest about which controls they can action today. The law firm targeting has direct relevance for organizations holding privileged client data, litigation strategy, or merger and acquisition information, as the operational discipline documented here, including pre-staged Defender exclusions, layered encryption, and GitHub-based Command and Control (C2), is consistent with a targeted rather than opportunistic actor, though no attribution was identified and this assessment reflects analyst inference from the technical evidence rather than a vendor conclusion. No attribution was identified, which limits actor-based prioritization but does not reduce the relevance of the techniques. The clearest opportunities for most defenders remain at the edges of the chain: user awareness around encrypted archives delivered via link and baseline controls around LNK execution from untrusted sources. The middle of this chain is difficult to see without mature tooling. The edges are not.

Researchers assess with medium confidence that a Chinese-speaking threat actor has been compromising government organizations primarily in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, and Kazakhstan, with additional victims in Syria, since January 2025. Targets span healthcare, research, government offices, foreign affairs, logistics, law enforcement, urban planning, and education. Researchers identified two backdoors, malware designed to provide covert remote access to compromised systems, tracked as OctLurk and SilkLurk, alongside a supporting proxy tool called LurkProxy used to reroute network traffic. Both malware families use loaders that decrypt their payloads using data unique to each victim's machine (a drive serial number for OctLurk, a computer name for SilkLurk), making the malware harder to analyze or detect across different systems. OctLurk supports modular plugins for command execution, file access, screen capture, and input simulation, while SilkLurk can similarly receive and run additional plugins in memory. Post-compromise activity included credential dumping from domain controllers, a keylogger that masqueraded as the legitimate AnyDesk application, browser password theft, internal and external network scanning, and staging of collected documents for exfiltration using renamed copies of WinRAR and 7-Zip. SilkLurk was also used to deploy PlugX, a modular remote access trojan long associated with Chinese-speaking groups. Researchers found infrastructure overlap with a separate campaign involving the TrustFall implant, though the relationship between the two remains unclear, and have not attributed this activity to a known group.

Source

Analyst Comment

This campaign's most useful defensive lesson is its redundancy. The actor combined two custom backdoors with a proxy tool, legitimate remote-access tooling such as Pandora RC, and repurposed credential theft utilities, so neutralizing one component could leave other access pathways available. The strongest evidence tying OctLurk and SilkLurk to a single operator is that a shell obtained through OctLurk was used to directly drop the SilkLurk loader, reinforced by shared staging directories and overlapping victims. The Chinese-speaking assessment rests on a different and somewhat thinner basis, drawn largely from the actor's use of PlugX and its long-documented association with Chinese-speaking groups. The machine-specific decryption scheme complicates off-host sandbox analysis and limits the cross-victim coverage of payload-specific hash indicators, though published domains, IP addresses, service names, and file paths remain useful for hunting and enrichment. Defenders outside the government and public sector organizations named in this report are not confirmed targets, but the broader tradecraft is worth watching regardless of sector: DLL side-loading through legitimate binaries, renamed credential-theft tools including a portable executable version of Impacket's secretsdump, and remote-access software that can resemble normal administrative activity. Behavioral detection of these patterns will likely offer more durable coverage than static indicators alone.