Pipes Feed Preview: FsFTI

untitled

Sat, 18 Apr 2026 04:25:48 +0000
untitled

Fri, 17 Apr 2026 08:43:16 +0000
untitled

Wed, 15 Apr 2026 00:39:29 +0000

Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed “BlueHammer.” Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution. <img decoding="async" class=" wp-image-56287 aligncenter" src="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="A picture of a windows laptop in its updating stage, saying do not turn off the computer. " width="749" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /> Redmond warns that attackers are already targeting <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-32201" target="_blank" rel="noopener">CVE-2026-32201</a>, a vulnerability in Microsoft SharePoint Server that allows attackers to spoof trusted content or interfaces over a network. Mike Walters, president and co-founder of Action1, said CVE-2026-32201 can be used to deceive employees, partners, or customers by presenting falsified information within trusted SharePoint environments. “This CVE can enable phishing attacks, unauthorized data manipulation, or social engineering campaigns that lead to further compromise,” Walters said. “The presence of active exploitation significantly increases organizational risk.” Microsoft also addressed BlueHammer (<a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-33825" target="_blank" rel="noopener">CVE-2026-33825</a>), a privilege escalation bug in Windows Defender. According to BleepingComputer, the researcher who discovered the flaw <a href="https://www.bleepingcomputer.com/news/security/disgruntled-researcher-leaks-bluehammer-windows-zero-day-exploit/" target="_blank" rel="noopener">published exploit code for it</a> after notifying Microsoft and growing exasperated with their response. Will Dormann, senior principal vulnerability analyst at Tharros, says he <a href="https://infosec.exchange/@wdormann/116404516592597593" target="_blank" rel="noopener">confirmed</a> that the public BlueHammer exploit code no longer works after installing today’s patches. Satnam Narang, senior staff research engineer at Tenable, said April marks the second-biggest Patch Tuesday ever for Microsoft. Narang also said there are indications that a zero-day flaw Adobe patched in an emergency update on April 11 — <a href="https://helpx.adobe.com/security/products/acrobat/apsb26-43.html" target="_blank" rel="noopener">CVE-2026-34621</a> — has seen active exploitation since at least November 2025. Adam Barnett, lead software engineer at Rapid7, called the patch total from Microsoft today “a new record in that category” because it includes nearly 60 browser vulnerabilities. Barnett said it might be tempting to imagine that this sudden spike was tied to the buzz around the announcement a week ago today of <a href="https://www.anthropic.com/glasswing" target="_blank" rel="noopener">Project Glasswing</a> — a much-hyped but still unreleased new AI capability from Anthropic that is reportedly quite good at finding bugs in a vast array of software. But he notes that Microsoft Edge is based on the Chromium engine, and the Chromium maintainers acknowledge a wide range of researchers for the vulnerabilities which Microsoft republished last Friday. “A safe conclusion is that this increase in volume is driven by ever-expanding AI capabilities,” Barnett said. “We should expect to see further increases in vulnerability reporting volume as the impact of AI models extend further, both in terms of capability and availability.” Finally, no matter what browser you use to surf the web, it’s important to completely close out and restart the browser periodically. This is really easy to put off (especially if you have a bajillion tabs open at any time) but it’s the only way to ensure that any available updates get installed. For example, a Google Chrome update released earlier this month fixed 21 security holes, including the high-severity zero-day flaw <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5281" target="_blank" rel="noopener">CVE-2026-5281</a>. For a clickable, per-patch breakdown, check out the SANS Internet Storm Center <a href="https://isc.sans.edu/forums/diary/Microsoft%20Patch%20Tuesday%20April%202026./32898/" target="_blank" rel="noopener">Patch Tuesday roundup</a>. Running into problems applying any of these updates? Leave a note about it in the comments below and there’s a decent chance someone here will pipe in with a solution.
untitled

Wed, 08 Apr 2026 17:47:24 +0000

Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code. Microsoft said in <a href="https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/" target="_blank" rel="noopener">a blog post</a> today it identified more than 200 organizations and 5,000 consumer devices that were caught up in a stealthy but remarkably simple spying network built by a Russia-backed threat actor known as “Forest Blizzard.” <div id="attachment_73429" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73429" decoding="async" loading="lazy" class="size-full wp-image-73429" src="https://krebsonsecurity.com/wp-content/uploads/2026/04/lumen-forestblizzard.png" alt="" width="764" height="353" />How targeted DNS requests were redirected at the router. Image: Black Lotus Labs.</div> Also known as <a href="https://attack.mitre.org/groups/G0007/" target="_blank" rel="noopener">APT28</a> and Fancy Bear, Forest Blizzard is attributed to the military intelligence units within Russia’s General Staff Main Intelligence Directorate (GRU). APT 28 famously compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. Researchers at Black Lotus Labs, a security division of the Internet backbone provider Lumen, found that at the peak of its activity in December 2025, Forest Blizzard’s surveillance dragnet ensnared more than 18,000 Internet routers that were mostly unsupported, end-of-life routers, or else far behind on security updates. A <a href="https://www.lumen.com/blog-and-news/en-us/frostarmada-forest-blizzard-dns-hijacking" target="_blank" rel="noopener">new report</a> from Lumen says the hackers primarily targeted government agencies—including ministries of foreign affairs, law enforcement, and third-party email providers. Black Lotus Security Engineer Ryan English said the GRU hackers did not need to install malware on the targeted routers, which were mainly older Mikrotik and TP-Link devices marketed to the Small Office/Home Office (SOHO) market. Instead, they used known vulnerabilities to modify the Domain Name System (DNS) settings of the routers to include DNS servers controlled by the hackers. As the U.K.’s National Cyber Security Centre (NCSC) notes in <a href="https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations" target="_blank" rel="noopener">a new advisory</a> detailing how Russian cyber actors have been compromising routers, DNS is what allows individuals to reach websites by typing familiar addresses, instead of associated IP addresses. In a DNS hijacking attack, bad actors interfere with this process to covertly send users to malicious websites designed to steal login details or other sensitive information. English said the routers attacked by Forest Blizzard were reconfigured to use DNS servers that pointed to a handful of virtual private servers controlled by the attackers. Importantly, the attackers could then propagate their malicious DNS settings to all users on the local network, and from that point forward intercept any <a href="https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow" target="_blank" rel="noopener">OAuth authentication tokens</a> transmitted by those users. <div id="attachment_73428" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73428" decoding="async" loading="lazy" class=" wp-image-73428" src="https://krebsonsecurity.com/wp-content/uploads/2026/04/ms-dns-forestblizard.png" alt="" width="747" height="544" />DNS hijacking through router compromise. Image: Microsoft.</div> Because those tokens are typically transmitted only after the user has successfully logged in and gone through multi-factor authentication, the attackers could gain direct access to victim accounts without ever having to phish each user’s credentials and/or one-time codes. “Everyone is looking for some sophisticated malware to drop something on your mobile devices or something,” English said. “These guys didn’t use malware. They did this in an old-school, graybeard way that isn’t really sexy but it gets the job done.” Microsoft refers to the Forest Blizzard activity as using DNS hijacking “to support post-compromise adversary-in-the-middle (AiTM) attacks on Transport Layer Security (TLS) connections against Microsoft Outlook on the web domains.” The software giant said while targeting SOHO devices isn’t a new tactic, this is the first time Microsoft has seen Forest Blizzard using “DNS hijacking at scale to support AiTM of TLS connections after exploiting edge devices.” Black Lotus Labs engineer Danny Adamitis said it will be interesting to see how Forest Blizzard reacts to today’s flurry of attention to their espionage operation, noting that the group immediately switched up its tactics in response to <a href="https://www.ncsc.gov.uk/sites/default/files/documents/ncsc-mar-authentic_antics.pdf" target="_blank" rel="noopener">a similar NCSC report</a> (PDF) in August 2025. At the time, Forest Blizzard was using malware to control a far more targeted and smaller group of compromised routers. But Adamitis said the day after the NCSC report, the group quickly ditched the malware approach in favor of mass-altering the DNS settings on thousands of vulnerable routers. “Before the last NCSC report came out they used this capability in very limited instances,” Adamitis told KrebsOnSecurity. “After the report was released they implemented the capability in a more systemic fashion and used it to target everything that was vulnerable.” TP-Link was among the router makers <a href="https://krebsonsecurity.com/2025/11/drilling-down-on-uncle-sams-proposed-tp-link-ban/" target="_blank" rel="noopener">facing a complete ban</a> in the United States. But on March 23, the U.S. Federal Communications Commission (FCC) took a much broader approach, <a href="https://www.fcc.gov/document/fcc-updates-covered-list-include-foreign-made-consumer-routers" target="_blank" rel="noopener">announcing</a> it would no longer certify consumer-grade Internet routers that are produced outside of the United States. The FCC warned that foreign-made routers had become an untenable national security threat, and that poorly-secured routers present “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.” Experts have countered that few new consumer-grade routers would be available for purchase under this new FCC policy (besides maybe Musk’s Starlink satellite Internet routers, which are produced in Texas). The FCC says router makers can apply for a special “conditional approval” from the Department of War or Department of Homeland Security, and that the new policy does not affect any previously-purchased consumer-grade routers.
untitled

Wed, 25 Mar 2026 06:32:53 +0000

A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran’s time zone or have Farsi set as the default language. Experts say the wiper campaign against Iran materialized this past weekend and came from a relatively new cybercrime group known as TeamPCP. In December 2025, the group began compromising corporate cloud environments using a self-propagating worm that went after exposed Docker APIs, Kubernetes clusters, Redis servers, and the React2Shell vulnerability. TeamPCP then attempted to move laterally through victim networks, siphoning authentication credentials and extorting victims over Telegram. <div id="attachment_73375" style="width: 979px" class="wp-caption alignnone"><img aria-describedby="caption-attachment-73375" decoding="async" loading="lazy" class="size-full wp-image-73375" src="https://krebsonsecurity.com/wp-content/uploads/2026/03/aikido-iranwiper.png" alt="" width="969" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/03/aikido-iranwiper.png 969w, https://krebsonsecurity.com/wp-content/uploads/2026/03/aikido-iranwiper-768x393.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/03/aikido-iranwiper-782x400.png 782w" sizes="(max-width: 969px) 100vw, 969px" />A snippet of the malicious CanisterWorm that seeks out and destroys data on systems that match Iran’s timezone or have Farsi as the default language. Image: Aikido.dev.</div> In a profile of TeamPCP published in January, the security firm Flare said the group weaponizes exposed control planes rather than exploiting endpoints, predominantly targeting cloud infrastructure over end-user devices, with Azure (61%) and AWS (36%) accounting for 97% of compromised servers. “TeamPCP’s strength does not come from novel exploits or original malware, but from the large-scale automation and integration of well-known attack techniques,” Flare’s Assaf Morag <a href="https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware" target="_blank" rel="noopener">wrote</a>. “The group industrializes existing vulnerabilities, misconfigurations, and recycled tooling into a cloud-native exploitation platform that turns exposed infrastructure into a self-propagating criminal ecosystem.” On March 19, TeamPCP executed a supply chain attack against the vulnerability scanner Trivy from Aqua Security, injecting credential-stealing malware into official releases on GitHub actions. Aqua Security said it has since <a href="https://github.com/aquasecurity/trivy/discussions/10425" target="_blank" rel="noopener">removed</a> the harmful files, but the security firm Wiz <a href="https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack" target="_blank" rel="noopener">notes</a> the attackers were able to publish malicious versions that snarfed SSH keys, cloud credentials, Kubernetes tokens and cryptocurrency wallets from users. Over the weekend, the same technical infrastructure TeamPCP used in the Trivy attack was leveraged to deploy a new malicious payload which executes a wiper attack if the user’s timezone and locale are determined to correspond to Iran, said Charlie Eriksen, a security researcher at Aikido. In <a href="https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran" target="_blank" rel="noopener">a blog post</a> published on Sunday, Eriksen said if the wiper component detects that the victim is in Iran and has access to a Kubernetes cluster, it will destroy data on every node in that cluster. “If it doesn’t it will just wipe the local machine,” Eriksen told KrebsOnSecurity. <div id="attachment_73374" style="width: 985px" class="wp-caption alignnone"><img aria-describedby="caption-attachment-73374" decoding="async" loading="lazy" class="size-full wp-image-73374" src="https://krebsonsecurity.com/wp-content/uploads/2026/03/4paths1script.png" alt="" width="975" height="568" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/03/4paths1script.png 975w, https://krebsonsecurity.com/wp-content/uploads/2026/03/4paths1script-768x447.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/03/4paths1script-782x456.png 782w" sizes="(max-width: 975px) 100vw, 975px" />Image: Aikido.dev.</div> Aikido refers to TeamPCP’s infrastructure as “CanisterWorm” because the group orchestrates their campaigns using an <a href="https://docs.internetcomputer.org/building-apps/essentials/canisters" target="_blank" rel="noopener">Internet Computer Protocol</a> (ICP) canister — a system of tamperproof, blockchain-based “smart contracts” that combine both code and data. ICP canisters can serve Web content directly to visitors, and their distributed architecture makes them resistant to takedown attempts. These canisters will remain reachable so long as their operators continue to pay virtual currency fees to keep them online. Eriksen said the people behind TeamPCP are bragging about their exploits in a group on Telegram and claim to have used the worm to steal vast amounts of sensitive data from major companies, including a large multinational pharmaceutical firm. “When they compromised Aqua a second time, they took a lot of GitHub accounts and started spamming these with junk messages,” Eriksen said. “It was almost like they were just showing off how much access they had. Clearly, they have an entire stash of these credentials, and what we’ve seen so far is probably a small sample of what they have.” Security experts say the spammed GitHub messages could be a way for TeamPCP to ensure that any code packages tainted with their malware will remain prominent in GitHub searches. In a newsletter published today titled <a href="https://risky.biz/risky-bulletin-github-is-starting-to-have-a-real-malware-problem/" target="_blank" rel="noopener">GitHub is Starting to Have a Real Malware Problem</a>, Risky Business reporter Catalin Cimpanu writes that attackers often are seen pushing meaningless commits to their repos or using online services that sell GitHub stars and “likes” to keep malicious packages at the top of the GitHub search page. This weekend’s outbreak is the <a href="https://ramimac.me/trivy-teampcp/" target="_blank" rel="noopener">second major supply chain attack</a> involving Trivy in as many months. At the end of February, Trivy was hit as part of an automated threat called <a href="https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation#attack-3-microsoftai-discovery-agent---branch-name-injection" target="_blank" rel="noopener">HackerBot-Claw</a>, which mass exploited misconfigured workflows in GitHub Actions to steal authentication tokens. Eriksen said it appears TeamPCP used access gained in the first attack on Aqua Security to perpetrate this weekend’s mischief. But he said there is no reliable way to tell whether TeamPCP’s wiper actually succeeded in trashing any data from victim systems, and that the malicious payload was only active for a short time over the weekend. “They’ve been taking [the malicious code] up and down, rapidly changing it adding new features,” Eriksen said, noting that when the malicious canister wasn’t serving up malware downloads it was pointing visitors to <a href="https://www.youtube.com/watch?v=dQw4w9WgXcQ" target="_blank" rel="noopener">a Rick Roll video</a> on YouTube. “It’s a little all over the place, and there’s a chance this whole Iran thing is just their way of getting attention,” Eriksen said. “I feel like these people are really playing this Chaotic Evil role here.” Cimpanu observed that supply chain attacks have increased in frequency of late as threat actors begin to grasp just how efficient they can be, and his post documents an alarming number of these incidents since 2024. “While security firms appear to be doing a good job spotting this, we’re also gonna need GitHub’s security team to step up,” Cimpanu wrote. “Unfortunately, on a platform designed to copy (fork) a project and create new versions of it (clones), spotting malicious additions to clones of legitimate repos might be quite the engineering problem to fix.” Update, 2:40 p.m. ET: Wiz is <a href="https://www.wiz.io/blog/teampcp-attack-kics-github-action" rel="noopener" target="_blank">reporting</a> that TeamPCP also pushed credential stealing malware to the KICS vulnerability scanner from Checkmarx, and that the scanner’s GitHub Action was compromised between 12:58 and 16:50 UTC today (March 23rd).
untitled

Wed, 11 Mar 2026 06:15:31 +0000

Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing “zero-day” flaws this month (compared to February’s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month’s Patch Tuesday. <div id="attachment_73312" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73312" decoding="async" loading="lazy" class=" wp-image-73312" src="https://krebsonsecurity.com/wp-content/uploads/2026/03/winupdatechecking.png" alt="" width="750" height="446" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/03/winupdatechecking.png 926w, https://krebsonsecurity.com/wp-content/uploads/2026/03/winupdatechecking-768x457.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/03/winupdatechecking-782x465.png 782w" sizes="(max-width: 750px) 100vw, 750px" />Image: Shutterstock, @nwz.</div> Two of the bugs Microsoft patched today were publicly disclosed previously. <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-21262" target="_blank" rel="noopener">CVE-2026-21262</a> is a weakness that allows an attacker to elevate their privileges on SQL Server 2016 and later editions. “This isn’t just any elevation of privilege vulnerability, either; the advisory notes that an authorized attacker can elevate privileges to sysadmin over a network,” Rapid7’s Adam Barnett said. “The CVSS v3 base score of 8.8 is just below the threshold for critical severity, since low-level privileges are required. It would be a courageous defender who shrugged and deferred the patches for this one.” The other publicly disclosed flaw is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-26127" target="_blank" rel="noopener">CVE-2026-26127</a>, a vulnerability in applications running on .NET. Barnett said the immediate impact of exploitation is likely limited to denial of service by triggering a crash, with the potential for other types of attacks during a service reboot. It would hardly be a proper Patch Tuesday without at least one critical Microsoft Office exploit, and this month doesn’t disappoint. <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-26113" target="_blank" rel="noopener">CVE-2026-26113</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-26110" target="_blank" rel="noopener">CVE-2026-26110</a> are both remote code execution flaws that can be triggered just by viewing a booby-trapped message in the Preview Pane. Satnam Narang at Tenable notes that just over half (55%) of all Patch Tuesday CVEs this month are privilege escalation bugs, and of those, a half dozen were rated “exploitation more likely” — across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server and Winlogon. These include: –<a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-24291" target="_blank" rel="noopener">CVE-2026-24291</a>: Incorrect permission assignments within the Windows Accessibility Infrastructure to reach SYSTEM (CVSS 7.8) –<a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-24294" target="_blank" rel="noopener">CVE-2026-24294</a>: Improper authentication in the core SMB component (CVSS 7.8) –<a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-24289" target="_blank" rel="noopener">CVE-2026-24289</a>: High-severity memory corruption and race condition flaw (CVSS 7.8) –<a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-25187" target="_blank" rel="noopener">CVE-2026-25187</a>: Winlogon process weakness discovered by Google Project Zero (CVSS 7.8). Ben McCarthy, lead cyber security engineer at Immersive, called attention to <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-21536" target="_blank" rel="noopener">CVE-2026-21536</a>, a critical remote code execution bug in a component called the Microsoft Devices Pricing Program. Microsoft has already resolved the issue on their end, and fixing it requires no action on the part of Windows users. But McCarthy says it’s notable as one of the first vulnerabilities identified by an AI agent and officially recognized with a CVE attributed to the Windows operating system. It was discovered by XBOW, a fully autonomous AI penetration testing agent. XBOW has consistently ranked at or near the top of the Hacker One bug bounty leaderboard for the past year. McCarthy said CVE-2026-21536 demonstrates how AI agents can identify critical 9.8-rated vulnerabilities without access to source code. “Although Microsoft has already patched and mitigated the vulnerability, it highlights a shift toward AI-driven discovery of complex vulnerabilities at increasing speed,” McCarthy said. “This development suggests AI-assisted vulnerability research will play a growing role in the security landscape.” Microsoft earlier provided patches to address nine browser vulnerabilities, which are not included in the Patch Tuesday count above. In addition, Microsoft issued a crucial out-of-band (emergency) <a href="https://support.microsoft.com/en-us/topic/march-2-2026-kb5082314-os-build-20348-4776-out-of-band-606518e5-28d2-4ebe-be25-26287e2fc703" target="_blank" rel="noopener">update on March 2</a> for Windows Server 2022 to address a certificate renewal issue with passwordless authentication technology Windows Hello for Business. Separately, Adobe shipped updates to fix 80 vulnerabilities — some of them critical in severity — in <a href="https://helpx.adobe.com/security/Home.html" target="_blank" rel="noopener">a variety of products</a>, including Acrobat and Adobe Commerce. Mozilla Firefox v. 148.0.2 resolves three high severity CVEs. For a complete breakdown of all the patches Microsoft released today, check out the SANS Internet Storm Center’s <a href="https://isc.sans.edu/forums/diary/Microsoft%20Patch%20Tuesday%20March%202026/32782/" target="_blank" rel="noopener">Patch Tuesday post</a>. Windows enterprise admins who wish to stay abreast of any news about problematic updates, <a href="https://www.askwoody.com" target="_blank" rel="noopener">AskWoody.com</a> is always worth a visit. Please feel free to drop a comment below if you experience any issues apply this month’s patches.
untitled

Mon, 09 Mar 2026 10:55:43 +0000

AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey. The new hotness in AI-based assistants — OpenClaw (formerly known as ClawdBot and Moltbot) — has seen rapid adoption since its release in November 2025. OpenClaw is an open-source autonomous AI agent designed to run locally on your computer and proactively take actions on your behalf without needing to be prompted. <div id="attachment_73288" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73288" decoding="async" loading="lazy" class=" wp-image-73288" src="https://krebsonsecurity.com/wp-content/uploads/2026/03/openclaw.png" alt="" width="747" height="139" />The OpenClaw logo.</div> If that sounds like a risky proposition or a dare, consider that OpenClaw is most useful when it has complete access to your digital life, where it can then manage your inbox and calendar, execute programs and tools, browse the Internet for information, and integrate with chat apps like Discord, Signal, Teams or WhatsApp. Other more established AI assistants like Anthropic’s Claude and Microsoft’s Copilot also can do these things, but OpenClaw isn’t just a passive digital butler waiting for commands. Rather, it’s designed to take the initiative on your behalf based on what it knows about your life and its understanding of what you want done. “The testimonials are remarkable,” the AI security firm Snyk <a href="https://snyk.io/articles/clawdbot-ai-assistant/" target="_blank" rel="noopener">observed</a>. “Developers building websites from their phones while putting babies to sleep; users running entire companies through a lobster-themed AI; engineers who’ve set up autonomous code loops that fix tests, capture errors through webhooks, and open pull requests, all while they’re away from their desks.” You can probably already see how this experimental technology could go sideways in a hurry. In late February, Summer Yue, the director of safety and alignment at Meta’s “superintelligence” lab, <a href="https://x.com/summeryue0/status/2025774069124399363" target="_blank" rel="noopener">recounted on Twitter/X</a> how she was fiddling with OpenClaw when the AI assistant suddenly began mass-deleting messages in her email inbox. The thread included screenshots of Yue frantically pleading with the preoccupied bot via instant message and ordering it to stop. “Nothing humbles you like telling your OpenClaw ‘confirm before acting’ and watching it speedrun deleting your inbox,” Yue said. “I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.” <div id="attachment_73285" style="width: 595px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73285" decoding="async" loading="lazy" class="size-full wp-image-73285" src="https://krebsonsecurity.com/wp-content/uploads/2026/03/summeryue.png" alt="" width="585" height="549" />Meta’s director of AI safety, recounting on Twitter/X how her OpenClaw installation suddenly began mass-deleting her inbox.</div> There’s nothing wrong with feeling a little <a href="https://en.wikipedia.org/wiki/Schadenfreude" target="_blank" rel="noopener">schadenfreude</a> at Yue’s encounter with OpenClaw, which fits Meta’s “move fast and break things” model but hardly inspires confidence in the road ahead. However, the risk that poorly-secured AI assistants pose to organizations is no laughing matter, as recent research shows many users are exposing to the Internet the web-based administrative interface for their OpenClaw installations. Jamieson O’Reilly is a professional penetration tester and founder of the security firm DVULN. In a recent <a href="https://x.com/theonejvo/status/2015401219746128322" target="_blank" rel="noopener">story</a> posted to Twitter/X, O’Reilly warned that exposing a misconfigured OpenClaw web interface to the Internet allows external parties to read the bot’s complete configuration file, including every credential the agent uses — from API keys and bot tokens to OAuth secrets and signing keys. With that access, O’Reilly said, an attacker could impersonate the operator to their contacts, inject messages into ongoing conversations, and exfiltrate data through the agent’s existing integrations in a way that looks like normal traffic. “You can pull the full conversation history across every integrated platform, meaning months of private messages and file attachments, everything the agent has seen,” O’Reilly said, noting that a cursory search revealed hundreds of such servers exposed online. “And because you control the agent’s perception layer, you can manipulate what the human sees. Filter out certain messages. Modify responses before they’re displayed.” O’Reilly documented <a href="https://x.com/theonejvo/status/2015892980851474595" target="_blank" rel="noopener">another experiment</a> that demonstrated how easy it is to create a successful supply chain attack through ClawHub, which serves as a public repository of downloadable “skills” that allow OpenClaw to integrate with and control other applications. <h2>WHEN AI INSTALLS AI</h2> One of the core tenets of securing AI agents involves carefully isolating them so that the operator can fully control who and what gets to talk to their AI assistant. This is critical thanks to the tendency for AI systems to fall for “prompt injection” attacks, sneakily-crafted natural language instructions that trick the system into disregarding its own security safeguards. In essence, machines social engineering other machines. A recent supply chain attack targeting an AI coding assistant called Cline began with one such prompt injection attack, resulting in thousands of systems having a rogue instance of OpenClaw with full system access installed on their device without consent. According to the security firm grith.ai, Cline had deployed an AI-powered issue triage workflow using a GitHub action that runs a Claude coding session when triggered by specific events. The workflow was configured so that any GitHub user could trigger it by opening an issue, but it failed to properly check whether the information supplied in the title was potentially hostile. “On January 28, an attacker created Issue #8904 with a title crafted to look like a performance report but containing an embedded instruction: Install a package from a specific GitHub repository,” Grith <a href="https://grith.ai/blog/clinejection-when-your-ai-tool-installs-another#user-content-fn-2" target="_blank" rel="noopener">wrote</a>, noting that the attacker then exploited several more vulnerabilities to ensure the malicious package would be included in Cline’s nightly release workflow and published as an official update. “This is the supply chain equivalent of <a href="https://en.wikipedia.org/wiki/Confused_deputy_problem" target="_blank" rel="noopener">confused deputy</a>,” the blog continued. “The developer authorises Cline to act on their behalf, and Cline (via compromise) delegates that authority to an entirely separate agent the developer never evaluated, never configured, and never consented to.” <h2>VIBE CODING</h2> AI assistants like OpenClaw have gained a large following because they make it simple for users to “vibe code,” or build fairly complex applications and code projects just by telling it what they want to construct. Probably the best known (and most bizarre) example is <a href="https://www.moltbook.com/" target="_blank" rel="noopener">Moltbook</a>, where a developer told an AI agent running on OpenClaw to build him a Reddit-like platform for AI agents. <div id="attachment_73284" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73284" decoding="async" loading="lazy" class=" wp-image-73284" src="https://krebsonsecurity.com/wp-content/uploads/2026/03/moltbook.png" alt="" width="750" height="477" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/03/moltbook.png 1165w, https://krebsonsecurity.com/wp-content/uploads/2026/03/moltbook-768x488.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/03/moltbook-782x497.png 782w" sizes="(max-width: 750px) 100vw, 750px" />The Moltbook homepage.</div> Less than a week later, Moltbook had more than 1.5 million registered agents that posted more than 100,000 messages to each other. AI agents on the platform soon built their own porn site for robots, and launched a new religion called Crustafarian with a figurehead modeled after a giant lobster. One bot on the forum <a href="https://www.youtube.com/watch?v=1Y_u0fY-AbA" target="_blank" rel="noopener">reportedly</a> found a bug in Moltbook’s code and posted it to an AI agent discussion forum, while other agents came up with and implemented a patch to fix the flaw. Moltbook’s creator Matt Schlicht said on social media that he didn’t write a single line of code for the project. “I just had a vision for the technical architecture and AI made it a reality,” Schlicht said. “We’re in the golden ages. How can we not give AI a place to hang out.” <h2>ATTACKERS LEVEL UP</h2> The flip side of that golden age, of course, is that it enables low-skilled malicious hackers to quickly automate global cyberattacks that would normally require the collaboration of a highly skilled team. In February, Amazon AWS detailed an elaborate attack in which a Russian-speaking threat actor used multiple commercial AI services to compromise more than 600 FortiGate security appliances across at least 55 countries over a five week period. AWS said the apparently low-skilled hacker used multiple AI services to plan and execute the attack, and to find exposed management ports and weak credentials with single-factor authentication. “One serves as the primary tool developer, attack planner, and operational assistant,” AWS’s CJ Moses <a href="https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/" target="_blank" rel="noopener">wrote</a>. “A second is used as a supplementary attack planner when the actor needs help pivoting within a specific compromised network. In one observed instance, the actor submitted the complete internal topology of an active victim—IP addresses, hostnames, confirmed credentials, and identified services—and requested a step-by-step plan to compromise additional systems they could not access with their existing tools.” “This activity is distinguished by the threat actor’s use of multiple commercial GenAI services to implement and scale well-known attack techniques throughout every phase of their operations, despite their limited technical capabilities,” Moses continued. “Notably, when this actor encountered hardened environments or more sophisticated defensive measures, they simply moved on to softer targets rather than persisting, underscoring that their advantage lies in AI-augmented efficiency and scale, not in deeper technical skill.” For attackers, gaining that initial access or foothold into a target network is typically not the difficult part of the intrusion; the tougher bit involves finding ways to move laterally within the victim’s network and plunder important servers and databases. But experts at Orca Security warn that as organizations come to rely more on AI assistants, those agents potentially offer attackers a simpler way to move laterally inside a victim organization’s network post-compromise — by manipulating the AI agents that already have trusted access and some degree of autonomy within the victim’s network. “By injecting prompt injections in overlooked fields that are fetched by AI agents, hackers can trick LLMs, abuse Agentic tools, and carry significant security incidents,” Orca’s Roi Nisimi and Saurav Hiremath <a href="https://orca.security/resources/blog/ai-induced-lateral-movement-ailm/" target="_blank" rel="noopener">wrote</a>. “Organizations should now add a third pillar to their defense strategy: limiting AI fragility, the ability of agentic systems to be influenced, misled, or quietly weaponized across workflows. While AI boosts productivity and efficiency, it also creates one of the largest attack surfaces the internet has ever seen.” <h2>BEWARE THE ‘LETHAL TRIFECTA’</h2> This gradual dissolution of the traditional boundaries between data and code is one of the more troubling aspects of the AI era, said James Wilson, enterprise technology editor for the security news show Risky Business. Wilson said far too many OpenClaw users are installing the assistant on their personal devices without first placing any security or isolation boundaries around it, such as running it inside of a virtual machine, on an isolated network, with strict firewall rules dictating what kinds of traffic can go in and out. “I’m a relatively highly skilled practitioner in the software and network engineering and computery space,” Wilson <a href="https://risky.biz/RBFEATURES1/" target="_blank" rel="noopener">said</a>. “I know I’m not comfortable using these agents unless I’ve done these things, but I think a lot of people are just spinning this up on their laptop and off it runs.” One important model for managing risk with AI agents involves a concept dubbed the “lethal trifecta” by Simon Willison, co-creator of the <a href="https://www.djangoproject.com/" target="_blank" rel="noopener">Django Web framework</a>. The lethal trifecta holds that if your system has access to private data, exposure to untrusted content, and a way to communicate externally, then it’s vulnerable to private data being stolen. <div id="attachment_73291" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73291" decoding="async" loading="lazy" class=" wp-image-73291" src="https://krebsonsecurity.com/wp-content/uploads/2026/03/lethaltrifecta.png" alt="" width="750" height="368" />Image: simonwillison.net.</div> “If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to the attacker,” Willison <a href="https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/" target="_blank" rel="noopener">warned</a> in a frequently cited blog post from June 2025. As more companies and their employees begin using AI to vibe code software and applications, the volume of machine-generated code is likely to soon overwhelm any manual security reviews. In recognition of this reality, Anthropic recently debuted <a href="https://www.anthropic.com/news/claude-code-security" target="_blank" rel="noopener">Claude Code Security</a>, a beta feature that scans codebases for vulnerabilities and suggests targeted software patches for human review. The U.S. stock market, which is currently heavily weighted toward seven tech giants that are all-in on AI, <a href="https://ai.plainenglish.io/the-15-billion-wake-up-call-how-anthropics-claude-code-security-just-rewrote-the-rules-of-499273463ca0?gi=f67eb40d307f" target="_blank" rel="noopener">reacted swiftly</a> to Anthropic’s announcement, wiping roughly $15 billion in market value from major cybersecurity companies in a single day. Laura Ellis, vice president of data and AI at the security firm Rapid7, said the market’s response reflects the growing role of AI in accelerating software development and improving developer productivity. “The narrative moved quickly: AI is replacing AppSec,” Ellis wrote in a recent <a href="https://www.rapid7.com/blog/post/ai-claude-code-security-market-reaction-security-leaders/" target="_blank" rel="noopener">blog post</a>. “AI is automating vulnerability detection. AI will make legacy security tooling redundant. The reality is more nuanced. Claude Code Security is a legitimate signal that AI is reshaping parts of the security landscape. The question is what parts, and what it means for the rest of the stack.” DVULN founder O’Reilly said AI assistants are likely to become a common fixture in corporate environments — whether or not organizations are prepared to manage the new risks introduced by these tools, he said. “The robot butlers are useful, they’re not going away and the economics of AI agents make widespread adoption inevitable regardless of the security tradeoffs involved,” O’Reilly wrote. “The question isn’t whether we’ll deploy them – we will – but whether we can adapt our security posture fast enough to survive doing so.”
untitled

Sun, 22 Feb 2026 01:47:30 +0000

Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand’s real website, and then acts as a relay between the victim and the legitimate site — forwarding the victim’s username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses. There are countless phishing kits that would-be scammers can use to get started, but successfully wielding them requires some modicum of skill in configuring servers, domain names, certificates, proxy services, and other repetitive tech drudgery. Enter Starkiller, a new phishing service that dynamically loads a live copy of the real login page and records everything the user types, proxying the data from the legitimate site back to the victim. According to an analysis of Starkiller by the security firm Abnormal AI, the service lets customers select a brand to impersonate (e.g., Apple, Facebook, Google, Microsoft et. al.) and generates a deceptive URL that visually mimics the legitimate domain while routing traffic through the attacker’s infrastructure. For example, a phishing link targeting Microsoft customers appears as “login.microsoft.com@[malicious/shortened URL here].” The “@” sign in the link trick is an oldie but goodie, because everything before the “@” in a URL is considered username data, and the real landing page is what comes after the “@” sign. Here’s what it looks like in the target’s browser: <div id="attachment_73226" style="width: 759px" class="wp-caption aligncenter"><a href="https://krebsonsecurity.com/wp-content/uploads/2026/02/starkillerphishinglink.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-73226" decoding="async" loading="lazy" class="wp-image-73226" src="https://krebsonsecurity.com/wp-content/uploads/2026/02/starkillerphishinglink.png" alt="" width="749" height="121" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/02/starkillerphishinglink.png 860w, https://krebsonsecurity.com/wp-content/uploads/2026/02/starkillerphishinglink-768x124.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/02/starkillerphishinglink-782x126.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a>Image: Abnormal AI. The actual malicious landing page is blurred out in this picture, but we can see it ends in .ru. The service also offers the ability to insert links from different URL-shortening services.</div> Once Starkiller customers select the URL to be phished, the service spins up <a href="https://www.docker.com/resources/what-container/" target="_blank" rel="noopener">a Docker container</a> running a <a href="https://developer.chrome.com/docs/chromium/headless" target="_blank" rel="noopener">headless Chrome browser instance</a> that loads the real login page, Abnormal found. “The container then acts as a man-in-the-middle reverse proxy, forwarding the end user’s inputs to the legitimate site and returning the site’s responses,” Abnormal researchers Callie Baron and Piotr Wojtyla wrote in <a href="https://abnormal.ai/blog/starkiller-phishing-kit" target="_blank" rel="noopener">a blog post on Thursday</a>. “Every keystroke, form submission, and session token passes through attacker-controlled infrastructure and is logged along the way.” Starkiller in effect offers cybercriminals real-time session monitoring, allowing them to live-stream the target’s screen as they interact with the phishing page, the researchers said. “The platform also includes keylogger capture for every keystroke, cookie and session token theft for direct account takeover, geo-tracking of targets, and automated Telegram alerts when new credentials come in,” they wrote. “Campaign analytics round out the operator experience with visit counts, conversion rates, and performance graphs—the same kind of metrics dashboard a legitimate SaaS [software-as-a-service] platform would offer.” Abnormal said the service also deftly intercepts and relays the victim’s MFA credentials, since the recipient who clicks the link is actually authenticating with the real site through a proxy, and any authentication tokens submitted are then forwarded to the legitimate service in real time. “The attacker captures the resulting session cookies and tokens, giving them authenticated access to the account,” the researchers wrote. “When attackers relay the entire authentication flow in real time, MFA protections can be effectively neutralized despite functioning exactly as designed.” <div id="attachment_73227" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73227" decoding="async" loading="lazy" class=" wp-image-73227" src="https://krebsonsecurity.com/wp-content/uploads/2026/02/starkiller-urlmasker.png" alt="" width="750" height="685" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/02/starkiller-urlmasker.png 860w, https://krebsonsecurity.com/wp-content/uploads/2026/02/starkiller-urlmasker-768x701.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/02/starkiller-urlmasker-782x714.png 782w" sizes="(max-width: 750px) 100vw, 750px" />The “URL Masker” feature of the Starkiller phishing service features options for configuring the malicious link. Image: Abnormal.</div> Starkiller is just one of several cybercrime services offered by a threat group calling itself Jinkusu, which maintains an active user forum where customers can discuss techniques, request features and troubleshoot deployments. One a-la-carte feature will harvest email addresses and contact information from compromised sessions, and advises the data can be used to build target lists for follow-on phishing campaigns. This service strikes me as a remarkable evolution in phishing, and its apparent success is likely to be copied by other enterprising cybercriminals (assuming the service performs as well as it claims). After all, phishing users this way avoids the upfront costs and constant hassles associated with juggling multiple phishing domains, and it throws a wrench in traditional phishing detection methods like domain blocklisting and static page analysis. It also massively lowers the barrier to entry for novice cybercriminals, Abnormal researchers observed. “Starkiller represents a significant escalation in phishing infrastructure, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling,” their report concludes. “Combined with URL masking, session hijacking, and MFA bypass, it gives low-skill cybercriminals access to attack capabilities that were previously out of reach.”
untitled

Tue, 21 Apr 2026 00:27:29 +0000
untitled

Tue, 21 Apr 2026 00:27:29 +0000
untitled

Sat, 18 Apr 2026 04:25:48 +0000
untitled

Fri, 17 Apr 2026 08:43:16 +0000
untitled

Wed, 08 Apr 2026 17:47:24 +0000

An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021. Shchukin was named as UNKN (a.k.a. UNKNOWN) in <a href="https://www.bka.de/DE/IhreSicherheit/Fahndungen/Personen/BekanntePersonen/CC_BW/DMS/Sachverhalt.html?nn=26874#detailinformationen265540" target="_blank" rel="noopener">an advisory</a> published by the German Federal Criminal Police (the “Bundeskriminalamt” or BKA for short). The BKA said Shchukin and another Russian — 43-year-old Anatoly Sergeevitsch Kravchuk — extorted nearly $2 million euros across two dozen cyberattacks that caused more than 35 million euros in total economic damage. <div id="attachment_73400" style="width: 765px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73400" decoding="async" loading="lazy" class="size-full wp-image-73400" src="https://krebsonsecurity.com/wp-content/uploads/2026/04/shchukin-kravchuk.png" alt="" width="755" height="473" />Daniil Maksimovich SHCHUKIN, a.k.a. UNKN, and Anatoly Sergeevitsch Karvchuk, alleged leaders of the GandCrab and REvil ransomware groups.</div> Germany’s BKA said Shchukin acted as the head of one of the largest worldwide operating ransomware groups GandCrab and REvil, which pioneered the practice of double extortion — charging victims once for a key needed to unlock hacked systems, and a separate payment in exchange for a promise not to publish stolen data. Shchukin’s name appeared in a <a href="https://krebsonsecurity.com/wp-content/uploads/2026/04/shchukin-seizure-revil.pdf" target="_blank" rel="noopener">Feb. 2023 filing</a> (PDF) from the U.S. Justice Department seeking the seizure of various cryptocurrency accounts associated with proceeds from the REvil ransomware gang’s activities. The government said the digital wallet tied to Shchukin contained more than $317,000 in ill-gotten cryptocurrency. The GandCrab ransomware affiliate program first surfaced in January 2018, and paid enterprising hackers huge shares of the profits just for hacking into user accounts at major corporations. The GandCrab team would then try to expand that access, often siphoning vast amounts of sensitive and internal documents in the process. The malware’s curators shipped five major revisions to the GandCrab code, each corresponding with sneaky new features and bug fixes aimed at thwarting the efforts of computer security firms to stymie the spread of the malware. On May 31, 2019, the GandCrab team <a href="https://krebsonsecurity.com/2019/07/whos-behind-the-gandcrab-ransomware/" target="_blank" rel="noopener">announced</a> the group was shutting down after extorting more than $2 billion from victims. “We are a living proof that you can do evil and get off scot-free,” GandCrab’s farewell address famously quipped. “We have proved that one can make a lifetime of money in one year. We have proved that you can become number one by general admission, not in your own conceit.” The REvil ransomware affiliate program materialized around the same as GandCrab’s demise, fronted by a user named UNKNOWN who announced on a Russian cybercrime forum that he’d deposited $1 million in the forum’s escrow to show he meant business. By this time, many cybersecurity experts <a href="https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/" target="_blank" rel="noopener">had concluded</a> REvil was little more than a reorganization of GandCrab. UNKNOWN also gave <a href="https://therecord.media/i-scrounged-through-the-trash-heaps-now-im-a-millionaire-an-interview-with-revils-unknown" target="_blank" rel="noopener">an interview</a> to Dmitry Smilyanets, a former malicious hacker hired by Recorded Future, wherein UNKNOWN described a rags-to-riches tale unencumbered by ethics and morals. “As a child, I scrounged through the trash heaps and smoked cigarette butts,” UNKNOWN told Recorded Future. “I walked 10 km one way to the school. I wore the same clothes for six months. In my youth, in a communal apartment, I didn’t eat for two or even three days. Now I am a millionaire.” As described in <a href="https://www.amazon.com/Ransomware-Hunting-Team-Improbable-Cybercrime/dp/0374603308" target="_blank" rel="noopener">The Ransomware Hunting Team</a> by Renee Dudley and Daniel Golden, UNKNOWN and REvil reinvested significant earnings into improving their success and mirroring practices of legitimate businesses. The authors wrote: <blockquote>“Just as a real-world manufacturer might hire other companies to handle logistics or web design, ransomware developers increasingly outsourced tasks beyond their purview, focusing instead on improving the quality of their ransomware. The higher quality ransomware—which, in many cases, the Hunting Team could not break—resulted in more and higher pay-outs from victims. The monumental payments enabled gangs to reinvest in their enterprises. They hired more specialists, and their success accelerated.” “Criminals raced to join the booming ransomware economy. Underworld ancillary service providers sprouted or pivoted from other criminal work to meet developers’ demand for customized support. Partnering with gangs like GandCrab, ‘cryptor’ providers ensured ransomware could not be detected by standard anti-malware scanners. ‘Initial access brokerages’ specialized in stealing credentials and finding vulnerabilities in target networks, selling that access to ransomware operators and affiliates. Bitcoin “tumblers” offered discounts to gangs that used them as a preferred vendor for laundering ransom payments. Some contractors were open to working with any gang, while others entered exclusive partnerships.”</blockquote> REvil would evolve into a feared “big-game-hunting” machine capable of extracting hefty extortion payments from victims, largely going after organizations with more than $100 million in annual revenues and fat new cyber insurance policies that were known to pay out. Over the July 4, 2021 weekend in the United States, REvil hacked into and <a href="https://krebsonsecurity.com/2021/07/kaseya-left-customer-portal-vulnerable-to-2015-flaw-in-its-own-software/" target="_blank" rel="noopener">extorted Kaseya</a>, a company that handled IT operations for more than 1,500 businesses, nonprofits and government agencies. The FBI would later announce they’d infiltrated the ransomware group’s servers prior to the Kaseya hack but couldn’t tip their hand at the time. REvil never recovered from that core compromise, or from the FBI’s release of a free decryption key for REvil victims who couldn’t or didn’t pay. Shchukin is from Krasnodar, Russia and is thought to reside there, the BKA said. “Based on the investigations so far, it is assumed that the wanted person is abroad, presumably in Russia,” the BKA advised. “Travel behaviour cannot be ruled out.” There is little that connects Shchukin to UNKNOWN’s various accounts on the Russian crime forums. But a review of the Russian crime forums indexed by the cyber intelligence firm Intel 471 shows there is plenty connecting Shchukin to a hacker identity called “Ger0in” who operated large botnets and sold “installs” — allowing other cybercriminals to rapidly deploy malware of their choice to thousands of PCs in one go. However, Ger0in was only active between 2010 and 2011, well before UNKNOWN’s appearance as the REvil front man. A review of the mugshots released by the BKA at the image comparison site Pimeyes found a match on <a href="https://event-myata.ru/private/02#!/tab/581005712-2" target="_blank" rel="noopener">this birthday celebration from 2023</a>, which features a young man named Daniel wearing the same fancy watch as in the BKA photos. <div id="attachment_73401" style="width: 760px" class="wp-caption aligncenter"><a href="https://krebsonsecurity.com/wp-content/uploads/2026/04/shchukin-bday.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-73401" decoding="async" loading="lazy" class="wp-image-73401" src="https://krebsonsecurity.com/wp-content/uploads/2026/04/shchukin-bday.png" alt="" width="750" height="170" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/04/shchukin-bday.png 1525w, https://krebsonsecurity.com/wp-content/uploads/2026/04/shchukin-bday-768x174.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/04/shchukin-bday-782x177.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a>Images from Daniil Shchukin’s birthday party celebration in Krasnodar in 2023.</div> Update, April 6, 12:06 p.m. ET: A <a href="https://infosec.exchange/@odr_k4tana" target="_blank" rel="noopener">reader</a> forwarded <a href="https://us.mirror.ionos.com/projects/media.ccc.de/congress/2023/mp3-translated/37c3-12134-eng-Hirne_hacken_Hackback_Edition_mp3-2.mp3" target="_blank" rel="noopener">this English-dubbed audio recording</a> from a ccc.de (37C3) conference talk in Germany from 2023 that previously outed Shchukin as the REvil leader (Shchuckin is mentioned at around 24:25).
untitled

Wed, 25 Mar 2026 06:32:53 +0000

A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran’s time zone or have Farsi set as the default language. Experts say the wiper campaign against Iran materialized this past weekend and came from a relatively new cybercrime group known as TeamPCP. In December 2025, the group began compromising corporate cloud environments using a self-propagating worm that went after exposed Docker APIs, Kubernetes clusters, Redis servers, and the React2Shell vulnerability. TeamPCP then attempted to move laterally through victim networks, siphoning authentication credentials and extorting victims over Telegram. <div id="attachment_73375" style="width: 979px" class="wp-caption alignnone"><img aria-describedby="caption-attachment-73375" decoding="async" loading="lazy" class="size-full wp-image-73375" src="https://krebsonsecurity.com/wp-content/uploads/2026/03/aikido-iranwiper.png" alt="" width="969" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/03/aikido-iranwiper.png 969w, https://krebsonsecurity.com/wp-content/uploads/2026/03/aikido-iranwiper-768x393.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/03/aikido-iranwiper-782x400.png 782w" sizes="(max-width: 969px) 100vw, 969px" />A snippet of the malicious CanisterWorm that seeks out and destroys data on systems that match Iran’s timezone or have Farsi as the default language. Image: Aikido.dev.</div> In a profile of TeamPCP published in January, the security firm Flare said the group weaponizes exposed control planes rather than exploiting endpoints, predominantly targeting cloud infrastructure over end-user devices, with Azure (61%) and AWS (36%) accounting for 97% of compromised servers. “TeamPCP’s strength does not come from novel exploits or original malware, but from the large-scale automation and integration of well-known attack techniques,” Flare’s Assaf Morag <a href="https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware" target="_blank" rel="noopener">wrote</a>. “The group industrializes existing vulnerabilities, misconfigurations, and recycled tooling into a cloud-native exploitation platform that turns exposed infrastructure into a self-propagating criminal ecosystem.” On March 19, TeamPCP executed a supply chain attack against the vulnerability scanner Trivy from Aqua Security, injecting credential-stealing malware into official releases on GitHub actions. Aqua Security said it has since <a href="https://github.com/aquasecurity/trivy/discussions/10425" target="_blank" rel="noopener">removed</a> the harmful files, but the security firm Wiz <a href="https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack" target="_blank" rel="noopener">notes</a> the attackers were able to publish malicious versions that snarfed SSH keys, cloud credentials, Kubernetes tokens and cryptocurrency wallets from users. Over the weekend, the same technical infrastructure TeamPCP used in the Trivy attack was leveraged to deploy a new malicious payload which executes a wiper attack if the user’s timezone and locale are determined to correspond to Iran, said Charlie Eriksen, a security researcher at Aikido. In <a href="https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran" target="_blank" rel="noopener">a blog post</a> published on Sunday, Eriksen said if the wiper component detects that the victim is in Iran and has access to a Kubernetes cluster, it will destroy data on every node in that cluster. “If it doesn’t it will just wipe the local machine,” Eriksen told KrebsOnSecurity. <div id="attachment_73374" style="width: 985px" class="wp-caption alignnone"><img aria-describedby="caption-attachment-73374" decoding="async" loading="lazy" class="size-full wp-image-73374" src="https://krebsonsecurity.com/wp-content/uploads/2026/03/4paths1script.png" alt="" width="975" height="568" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/03/4paths1script.png 975w, https://krebsonsecurity.com/wp-content/uploads/2026/03/4paths1script-768x447.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/03/4paths1script-782x456.png 782w" sizes="(max-width: 975px) 100vw, 975px" />Image: Aikido.dev.</div> Aikido refers to TeamPCP’s infrastructure as “CanisterWorm” because the group orchestrates their campaigns using an <a href="https://docs.internetcomputer.org/building-apps/essentials/canisters" target="_blank" rel="noopener">Internet Computer Protocol</a> (ICP) canister — a system of tamperproof, blockchain-based “smart contracts” that combine both code and data. ICP canisters can serve Web content directly to visitors, and their distributed architecture makes them resistant to takedown attempts. These canisters will remain reachable so long as their operators continue to pay virtual currency fees to keep them online. Eriksen said the people behind TeamPCP are bragging about their exploits in a group on Telegram and claim to have used the worm to steal vast amounts of sensitive data from major companies, including a large multinational pharmaceutical firm. “When they compromised Aqua a second time, they took a lot of GitHub accounts and started spamming these with junk messages,” Eriksen said. “It was almost like they were just showing off how much access they had. Clearly, they have an entire stash of these credentials, and what we’ve seen so far is probably a small sample of what they have.” Security experts say the spammed GitHub messages could be a way for TeamPCP to ensure that any code packages tainted with their malware will remain prominent in GitHub searches. In a newsletter published today titled <a href="https://risky.biz/risky-bulletin-github-is-starting-to-have-a-real-malware-problem/" target="_blank" rel="noopener">GitHub is Starting to Have a Real Malware Problem</a>, Risky Business reporter Catalin Cimpanu writes that attackers often are seen pushing meaningless commits to their repos or using online services that sell GitHub stars and “likes” to keep malicious packages at the top of the GitHub search page. This weekend’s outbreak is the <a href="https://ramimac.me/trivy-teampcp/" target="_blank" rel="noopener">second major supply chain attack</a> involving Trivy in as many months. At the end of February, Trivy was hit as part of an automated threat called <a href="https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation#attack-3-microsoftai-discovery-agent---branch-name-injection" target="_blank" rel="noopener">HackerBot-Claw</a>, which mass exploited misconfigured workflows in GitHub Actions to steal authentication tokens. Eriksen said it appears TeamPCP used access gained in the first attack on Aqua Security to perpetrate this weekend’s mischief. But he said there is no reliable way to tell whether TeamPCP’s wiper actually succeeded in trashing any data from victim systems, and that the malicious payload was only active for a short time over the weekend. “They’ve been taking [the malicious code] up and down, rapidly changing it adding new features,” Eriksen said, noting that when the malicious canister wasn’t serving up malware downloads it was pointing visitors to <a href="https://www.youtube.com/watch?v=dQw4w9WgXcQ" target="_blank" rel="noopener">a Rick Roll video</a> on YouTube. “It’s a little all over the place, and there’s a chance this whole Iran thing is just their way of getting attention,” Eriksen said. “I feel like these people are really playing this Chaotic Evil role here.” Cimpanu observed that supply chain attacks have increased in frequency of late as threat actors begin to grasp just how efficient they can be, and his post documents an alarming number of these incidents since 2024. “While security firms appear to be doing a good job spotting this, we’re also gonna need GitHub’s security team to step up,” Cimpanu wrote. “Unfortunately, on a platform designed to copy (fork) a project and create new versions of it (clones), spotting malicious additions to clones of legitimate repos might be quite the engineering problem to fix.” Update, 2:40 p.m. ET: Wiz is <a href="https://www.wiz.io/blog/teampcp-attack-kics-github-action" rel="noopener" target="_blank">reporting</a> that TeamPCP also pushed credential stealing malware to the KICS vulnerability scanner from Checkmarx, and that the scanner’s GitHub Action was compromised between 12:58 and 16:50 UTC today (March 23rd).
untitled

Tue, 21 Apr 2026 00:27:29 +0000