Anomali Cyber Watch: SLEEPWALKER Passive Backdoor, GPUThor Attack Bypasses NVIDIA, Enabling Privilege Escalation and DoS; Fire Ant, TACACS Credential Harvester and more

SLEEPWALKER is a passive Windows backdoor that makes no outbound connections and opens no obvious listening port by default, giving network monitoring tools nothing to flag. It arrives as a malicious dynamic-link library (DLL) disguised as Microsoft's dpapi.dll with version metadata copied from ESET Management Agent, and side-loads into ERAAgent.exe via Windows' DLL search order. The backdoor activates only when the attacker delivers a single crafted packet that passes a specific validation check while monitoring all traffic on the host's network interfaces. Its built-in configuration, encrypted with AES-256-CCM, holds one instruction: watch every interface indefinitely. Triggered commands arrive as custom bytecode that only the backdoor's interpreter can decode, so recovering the encryption key alone does not reveal what was sent. The 23-instruction language supports task scheduling, staged payload delivery verified against a SHA-256 fingerprint, in-memory shellcode execution, and communication over TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw packet capture, and VMware's Virtual Machine Communication Interface (VMCI), a covert channel that passes traffic between a guest and its host, or between two guests on the same physical host, without touching a physical network adapter. The backdoor also modifies two Windows registry settings to permit unauthenticated named-pipe access. No victim, actor, or delivery chain was identified from the single analyzed sample, and detection coverage was low at publication.

Source

Analyst Comment

SLEEPWALKER is most significant as a case study in deliberate detection gap construction rather than an immediate threat to most organisations. The implant produces no outbound beacon, opens no obvious port in its dormant state, and rides inside a trusted enterprise security process, each mapping, on assessment, to a common detection dependency. For organisations running ESET Management Agent, check for an unexpected dpapi.dll or dpapisvc.dll alongside ERAAgent.exe, review DLL-load telemetry for that process, and run the published PowerShell scanner. There is no patch; side-loading abuses Windows DLL search order rather than a flaw in ESET's software, and a confirmed detection requires incident response and rebuild. Independent of ESET, EveryoneIncludesAnonymous defaults to 0 on modern Windows; any value of 1 is anomalous and directly queryable across an endpoint fleet. NullSessionPipes warrants the same audit but entries must be assessed against a known-good baseline, as legitimate entries can exist and absence does not confirm a clean state. VMCI traffic between VMware guests or between a guest and its host bypasses conventional network adapters, and most organisations are unlikely to have monitoring coverage without deliberate implementation. No confirmed victim, actor, or delivery chain exists and the targeted assessment remains an inference from design.

University of Toronto researchers have published GPUThor, a Rowhammer attack that defeats error-correcting code (ECC) protections on NVIDIA Ampere-class GPUs, enabling denial-of-service (DoS) and root-level privilege escalation. Rowhammer attacks induce bit flips by repeatedly activating memory rows at high speed until electrical interference corrupts data in neighboring rows. Prior GPU attacks produced too few flips to defeat ECC, which NVIDIA recommended as the primary defense. GPUThor overcomes this by reverse-engineering two undocumented GPU behaviors: how the hardware consolidates repeated memory requests (coalescing), and how frequently its in-DRAM Target Row Refresh (TRR) defense activates, found to fire once every 72 refresh intervals rather than once per interval. This allows aggressor rows to be hammered at 6.6 times the intensity of prior techniques, producing 72,000 to 377,000 bit flips per GB across RTX A4000, A4500, A5000, and A6000 GPUs. At these rates, ECC is bypassed: the campaign produced 387 detectable but uncorrectable double-bit errors and two triple-bit errors ECC silently mis-corrected. Researchers demonstrated privilege escalation to root by corrupting GPU page tables, completing in 0.7 to 1.2 minutes. NVIDIA published guidance on August 25, recommending SYS-ECC, IOMMU/DMA isolation, and restricting untrusted CUDA workloads; complete protection requires stronger multi-bit ECC and hardware-level defenses.

Source

Analyst Comment

ECC remains worth enabling but should no longer be treated as a sufficient standalone defense against GPU Rowhammer; GPUThor has demoted it from a solution to one layer in a defense stack that currently lacks a strong upper layer. The affected GPUs are workstation-class Ampere hardware common in on-premises AI inference deployments, internal ML pipelines, and research environments, not just cloud instances, and any environment where untrusted code executes on affected hardware is in scope. Realistic attacker entry points include compromised containers in shared GPU environments, co-tenants in cloud notebook or inference services, and malicious or compromised dependencies in ML pipelines, the last of which is relevant even on isolated on-premises systems. Organizations using cloud GPU services should ask providers directly whether cross-tenant GPU sharing has been disabled and whether NVIDIA's mitigations have been deployed, as acknowledging the issue and demonstrably mitigating it are not the same thing. November 15, 2026 is a meaningful operational deadline; when the exploit code releases publicly at CCS '26, the accessible attacker pool widens considerably. GPUHammer, GPUBreach, and GPUThor emerged within roughly 15 months; ECC successfully contained the first two, and GPUThor is the first to defeat it; a single paper invalidated NVIDIA's primary recommended defense, and current mitigations should not be treated as permanent.

Fire Ant, a Chinese espionage actor first reported in 2025 and assessed to overlap with UNC3886, expanded from VMware hypervisors in 2026 into Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) authentication servers, and Linux management hosts; the initial access vector was not identified. On compromised routers, malware persisted through a fake startup service running an implant only during odd-numbered hours, selectively suppressed syslog delivery to reduce defender telemetry, filtered command output to conceal tunnel-related configuration, and maintained Telnet connections to actor-controlled infrastructure. The actor captured traffic from multiple routers and exfiltrated PCAP files to external FTP servers. On TACACS servers, a previously undocumented toolset tracked as TacTap injected a malicious library into the authentication process to intercept sessions and write harvested credentials to an obfuscated file on disk. Linux management hosts carried Medusa rootkit components, custom SSH backdoors first deployed in 2025, the BridgeAgent implant disguised as a Zabbix monitoring agent, and a packet-triggered backdoor that activated only on receipt of trigger strings in network traffic. Across all compromised systems, the actor disabled SELinux, redirected selected inbound connections from port 22 to port 443, and altered login records, sudo logs, and file timestamps to obstruct forensic investigation.

Source

Analyst Comment

Fire Ant's targeting logic is the central lesson here: by compromising infrastructure that routes traffic, authenticates administrators, and records activity, the actor converted a single victim into a potential access platform toward connected networks. Organisations with trust relationships to high-value or critical infrastructure environments should assess whether that connectivity makes them a plausible stepping stone regardless of their own perceived target value. The anti-forensic capability is particularly significant. Log tampering and telemetry suppression appear to have been built into the operation by design rather than applied reactively. Standard post-incident workflows that assume log integrity may produce unreliable results when this class of actor has been present. Independent log shipping from network devices and authentication infrastructure to sources those devices cannot modify is a prerequisite for meaningful investigation at this threat level, not an enhancement. For detection, behavioural consistency is more durable than indicator matching. Filenames and hashes will change between operations, but persistence on control-plane devices and selective telemetry suppression have remained consistent across Fire Ant's reported activity, and authentication infrastructure targeting is consistent with the broader cluster's documented tradecraft. Most organisations lack the forensic capability to detect or investigate this activity on network infrastructure without targeted investment. Routers, TACACS servers, and management hosts require monitoring, hardening, and response procedures equivalent to those applied to endpoints.

Anthropic notified an unspecified number of Claude users that a threat actor used active Claude login sessions harvested from infostealer-infected computers to access accounts and consume paid usage. A stolen session cookie proves a login already occurred, so the attacker did not need the account password or a two-factor authentication (2FA) code to get in. Anthropic identified the malware as Vidar, Lumma (LummaC2), StealC, RedLine, and Acreed on Windows, and Atomic Stealer (AMOS) on some Macs; it typically arrives through an unofficial download or malicious app and copies saved passwords, browser cookies, and local credentials. Anthropic said it has no reason to believe the malware is related to Claude or to anything users did within Claude, and that phones and tablets do not appear to have been involved. After detecting the activity, which could appear as usage refilling and draining while the legitimate user was idle, Anthropic invalidated compromised sessions, removed saved payment methods, and refunded charges identified as unauthorized. Because signing out does not remove the malware, Anthropic advised cleaning devices, then securing the email account used for Claude by changing its password, signing out other sessions, enabling 2FA, updating saved browser passwords, and afterward re-adding a payment method.

Source

Analyst Comment

All six malware families identified in this campaign are established commodity infostealers sold or rented through cybercrime markets and malware-as-a-service platforms. The more revealing detail is what the attacker did with the sessions collected: Anthropic said a bad actor had begun selecting Claude sessions from stealer data and reusing them, suggesting AI service accounts now carry operational value beyond being an incidental find. MITRE ATT&CK separates the behavior into two stages, T1539 for acquiring the session cookie and T1550.004 for using it to authenticate as the victim, and password resets or MFA enforcement alone will not terminate an already valid stolen session unless the associated tokens are also revoked. One visible indicator in this incident was abnormal usage consumption rather than a failed login, worth monitoring alongside conventional identity signals. Anthropic's own Enterprise and Console admin settings already allow shortened maximum session durations specifically to limit how long a compromised session stays valid, a control organizations running Claude at scale should confirm is enabled and appropriately configured. Endpoint compromise was the enabling failure here, and password policy alone would not have prevented reuse of a session already in an attacker's hands.

Security researchers detailed two separate malware loaders that both rely on tricking users into starting their own infection. The first, WordlistLoader, spreads through compromised websites showing fake CAPTCHA prompts, a technique known as ClickFix, which copies a malicious command to the clipboard and asks the visitor to paste it into the Windows Run dialog. The command maps a remote WebDAV share and executes a hosted DLL, leading to Amatera Stealer (ACR Stealer). The loader hides its shellcode as ordinary English words or UUID strings, attempts to remove hooks from loaded modules' exported functions, and uses a hardware breakpoint to block Event Tracing for Windows (ETW) logging. The second loader, SynkLoader, was distributed through a Microsoft Teams message in which an attacker posed as internal IT support and convinced the victim to install a fake "PowerShell Cleaner" tool hosted on Microsoft Azure. This installs a Python-based loader that can deploy a fake Windows lock screen to steal login passwords, a scheduled task for persistence, a reverse proxy, a remote command shell, and a screen-sharing module. Researchers assessed with low to medium confidence that the toolkit may belong to a ransomware group or an initial access broker that sells access to ransomware operators.

Source

Analyst Comment

Both cases show real engineering effort, but at different stages. In the observed infection chains, neither relied on exploiting a software vulnerability for initial access; each required the victim to execute something they had been persuaded to trust, whether a familiar CAPTCHA prompt or a Teams message posing as internal IT support. Once executed, both employed techniques meant to reduce visibility to endpoint security tooling, from WordlistLoader's hook removal and ETW evasion to SynkLoader's in memory PowerShell execution ahead of its disk based Python components. That evasion effort did not make either intrusion invisible. Expel discovered SynkLoader after an EDR alert fired on its scheduled task persistence, showing that behavioral detection later in the attack chain can still expose an intrusion after the initial social engineering step succeeds. For defenders, the broader pattern matters as much as the malware internals: verify unexpected IT contact through a separate channel, treat legitimate cloud hosting or a compromised genuine website as no guarantee of safety, and keep watching for the behavioral signals both cases left behind. SynkLoader's possible connection to ransomware operations should stay caveated, since researchers assess that link with only low to medium confidence.

Two Microsoft SharePoint vulnerabilities can be chained to reach unauthenticated remote code execution on unpatched on-premises servers, and attackers are now probing the chain in the wild. The first, CVE-2026-55040, is a flaw in SharePoint's JSON Web Token (JWT) validation pipeline that lets an unauthenticated attacker forge a token and impersonate a SharePoint user, potentially an administrator, given a known target account identifier. Microsoft patched the flaw on July 14, 2026, and a threat intelligence firm reported the August 11 proof-of-concept exploit was weaponized within a day. The second flaw, CVE-2026-63520, lets an authenticated attacker execute arbitrary code with SharePoint service account privileges through Business Connectivity Services. Microsoft patched it on August 11, 2026; chained after the first flaw, it enables unauthenticated code execution. Researchers published a working exploit for the chain on August 24. The same firm reported on August 25 that its honeypots recorded the chain being probed, including the authentication bypass and reconnaissance, though it observed no code execution. The Cybersecurity and Infrastructure Security Agency added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on August 18. More than 8,700 SharePoint servers were tracked exposed online, though how many remain vulnerable to it is unclear.

Source

Analyst Comment

Patching CVE-2026-55040 disrupts the unauthenticated path into this chain by removing the authentication-bypass step, but that should not substitute for patching CVE-2026-63520 as well, since an attacker with sufficient authenticated SharePoint access can still reach that flaw independently. The honeypot activity shows attackers actively testing the complete chain, and while CVE-2026-55040 exploitation is confirmed strongly enough for its inclusion in CISA's Known Exploited Vulnerabilities catalog, successful code execution through the full chain has not been observed. No public attribution exists for who is behind the scanning. Detection teams should note that Rapid7 and VulnCheck independently built different gadget chains for the same RCE bug, so signature-based hunting alone may miss variants; monitoring for unusual Business Data Catalog model activity and unexpected process execution from SharePoint service accounts offers broader coverage. Organizations still running SharePoint Server 2016 or 2019 should treat this as a signal to accelerate migration, since both products reached end of extended support in July 2026, before Microsoft's August fix for CVE-2026-63520 shipped. For most defenders, the practical takeaway is straightforward: confirm exposure, patch both flaws, reduce direct internet access where possible, and watch for updates as this remains an evolving situation.