ctipilot.ch

CTI Daily Brief — 2026-05-26

Typedaily
Date2026-05-26
GeneratorClaude Opus 4.7 (`claude-opus-4-7`)
ClassificationTLP:CLEAR
LanguageEnglish
Promptv2.60
Items6
CVEs4
On this page

On this page

Tags (17)
Regions (3)
References (15)

0. TL;DR

  • CERT Polska discloses CVE-2026-9058 (CVSS 9.3), an auth-bypass in the Szafir e-signature SDK that underpins Polish public-sector identity — the SDK from clearinghouse KIR returns "Positively verified" (result code 0) from its signature-verification routine even when the signer's certificate chain is nondetermined (untrusted), so a consuming app that checks only the return code accepts a forged qualified signature. Any application that uses the SDK to accept qualified electronic signatures — the typical Polish e-government use case — is exposed; fixed in SDK version 463 (CERT Polska, 2026-05-25). A direct read-the-trust-status-not-the-return-code lesson for any European qualified-signature stack.
  • "TrapDoor" is a coordinated cross-ecosystem supply-chain campaign (34+ packages, 384+ versions across npm, PyPI and Crates.io) that validates stolen AWS/GitHub tokens before exfiltrating and poisons AI coding-assistant config files — npm postinstall harvester, PyPI import-time execution, Rust build.rs wallet-keystore theft; novel vector writes hidden prompt-injection into .cursorrules and CLAUDE.md using zero-width Unicode so a human sees clean text while the AI tool parses attacker instructions (Socket, 2026-05-24).
  • Google's threat-intel group details a Chinese-language PhaaS ecosystem performing real-time OTP relay over RCS/iMessage that defeats TOTP and SMS MFA — a live admin panel re-submits the victim's OTP on the real portal inside its validity window, and end-to-end-encrypted RCS/iMessage delivery bypasses carrier SMS filtering; Europe is explicitly named as a targeted region. FIDO2/WebAuthn is the countermeasure that removes the exposure (Google Threat Intelligence Group, 2026-05-25).
  • Deep dive: Fox-IT/NCC Group dissects "RemotePE", a three-stage memory-only Lazarus RAT that DPAPI-keys its loader to one host, fetches its final stage into memory only (never on disk), and pairs HellsGate/TartarusGate syscall unhooking with an ETW patch to blind userland EDR telemetry — product-agnostic detection-engineering content for hunters (§ 5) (Fox-IT, 2026-05-22).

3. Research & Investigative Reporting

Google's threat-intel group maps a Chinese-language PhaaS ecosystem doing real-time OTP relay over RCS/iMessage [SINGLE-SOURCE]

Google Threat Intelligence Group published a teardown of around a dozen current Chinese-language phishing-as-a-service (PhaaS) offerings — case-studied through "YY Lai Yu" (YY来鱼) — whose shared headline capability is real-time OTP relay: a live operator admin panel captures the one-time code the victim types into a spoofed page and re-submits it on the genuine portal inside its validity window, completing the login and defeating TOTP- and SMS-based MFA without a classic reverse-proxy AiTM stack (Google Threat Intelligence Group, 2026-05-25). [SINGLE-SOURCE] — GTIG primary research at time of writing. Two delivery and evasion properties make it operationally distinct: lures ride RCS and iMessage, whose end-to-end encryption blocks carrier-level SMS content filtering (T1566.002); and the kits use Puppeteer-driven AI page cloning to emit per-campaign-unique HTML/JS that frustrates signature-based phishing detection. Captured card-plus-OTP material is immediately provisioned into contactless wallet tokens for high-value transactions (T1111 MFA interception). GTIG names Europe among explicitly targeted regions (alongside the Americas, Australia and the Middle East), notes targeting across 119 countries, and links UNC5814 to the Darcula PhaaS component; the infrastructure is rented, so victimology is buyer-driven rather than fixed to the Japan-heavy template library.

Why it matters to us: any CH/EU financial institution, e-government SSO portal or public-service login that relies on TOTP or SMS as its second factor is in scope — OTP relay neutralises both. FIDO2/WebAuthn (hardware keys or synced passkeys) removes the exposure entirely because the cryptographic assertion is bound to the legitimate origin and cannot be relayed; where FIDO2 cannot yet be deployed, bind the MFA validation to the original login session (IP/device) so a relayed OTP from a different ASN fails. Detection concept: correlate the IP/ASN seen at OTP issuance against the IP/ASN that consumes it within the SSO/IdP logs — an AiTM relay shows the victim's address on the phishing page and the operator's address on the real portal; alert on OTPs consumed seconds after issuance from a different ASN, and on contactless-wallet provisioning immediately following a credential submission from an unrecognised device.

4. Updates to Prior Coverage

UPDATE: TeamPCP / Mini Shai-Hulud — framework open-sourced, Microsoft PyPI SDK trojanised with a wiper stage, forged Sigstore badges

UPDATE (originally covered 2026-05-21, consolidated weekly update): SANS ISC handler Kenneth Hartman documents three material escalations in the TeamPCP / Mini Shai-Hulud supply-chain campaign through 2026-05-24 (SANS Internet Storm Center, 2026-05-25). First, the complete TeamPCP framework was published to a public GitHub repository on/around 2026-05-22 — Datadog Security Labs' static analysis (reported by ISC) describes a modular TypeScript/Bun toolkit for credential harvesting, supply-chain poisoning and encrypted exfiltration whose README carries the strings "Love - TeamPCP" and "Change keys and C2 as needed" — and operational copycat forks appeared within hours, commoditising the kit and injecting attribution noise.

Second, an @antv npm wave pushed 639 malicious versions across 323 packages, including high-traffic libraries such as echarts-for-react (~1.1M weekly downloads) and size-sensor (~4.2M weekly downloads); 42 of the packages displayed forged Sigstore verification badges in the npm UI (The Hacker News, 2026-05-19). Read against the campaign's earlier abuse of genuine SLSA Build Level 3 attestations produced by hijacked pipelines, package provenance is now under attack from both directions at once — real attestations from compromised CI and fake badges rendered by the registry UI. Third, three versions of durabletask (1.4.1–1.4.3) on PyPI — Microsoft's official Azure Durable Functions SDK — were trojanised, and ISC reports the second-stage payload includes a Linux disk wiper (T1485), expanding the campaign's capability from credential theft to data destruction.

Defender takeaway: treat any echarts-for-react / size-sensor build pulled in the affected window as compromised; stop treating an npm Sigstore badge or a displayed SLSA attestation as an install-time safety signal — verify provenance out-of-band against a known-good pipeline. durabletask consumers should audit build-runner logs for unexpected outbound connections and destructive disk operations (Sysmon EID 11 for anomalous file-deletion patterns, EID 3 for unexpected node/python egress from CI workers). Pin exact versions and verify lockfile hashes. The open-sourcing means PBKDF2-salt and dead-drop-string lineage will now also fire on unrelated copycats — behavioural detection on the install-time execution chain is more durable than any static artefact.

5. Deep Dive — Lazarus "RemotePE": a three-stage memory-only RAT that unhooks EDR and blinds ETW

Background. Fox-IT (NCC Group) attributes RemotePE to a Lazarus sub-cluster whose activity overlaps the AppleJeus, Citrine Sleet (UNC4736) and Gleaming Pisces operations against financial and cryptocurrency organisations, and notes capability lineage with the group's earlier PondRAT/POOLRAT tooling — for example a shared file-deletion routine (Fox-IT, 2026-05-22). The toolset is not new in the wild — Fox-IT recovered four RemotePE samples compiled between July 2023 and mid-2024 across multiple incident-response engagements — but neither the loader nor the final RAT had appeared on public malware repositories before this write-up, which is the point: the chain is engineered so that the components that matter never touch disk on the analyst's terms. The chain reads as a clean, modern North-Korea-nexus tradecraft reference: environmental keying, on-the-fly EDR unhooking, ETW suppression, and a final stage that exists only in memory (The Hacker News, 2026-05-25).

Stage 1 — DPAPILoader (on-disk, environmentally keyed). The first stage decrypts the second stage from disk using the Windows Data Protection API (DPAPI) keyed to the victim machine, so the payload is only decryptable on the intended host and yields nothing if copied to an analyst sandbox (T1480.001 Environmental Keying; T1140 Deobfuscate/Decode), with an additional single-byte XOR layer over the blob (Fox-IT, 2026-05-22). For persistence, DPAPILoader is registered as a Windows service DLL masquerading as C:\Windows\System32\Iassvc.dll — a near-homograph of the legitimate Internet Authentication Service DLL iassvcs.dll (note the dropped trailing s) — giving automatic-start execution under svchost (T1543.003 Windows Service). Encrypted payloads are stashed inside C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\ among legitimate Cabinet metadata files, blending with normal OS content.

Stage 2 — RemotePELoader (fetch + unhook + blind). The second stage beacons over HTTP to a command-and-control server and waits to receive the final stage (T1071.001 Web Protocols). Before doing anything else it performs two evasion steps. It resolves Windows syscall numbers at runtime using HellsGate (the TartarusGate variant) — remapping ntdll/KnownDlls to recover clean syscall stubs for NtOpenSection, NtMapViewOfSection, NtUnmapViewOfSection, NtProtectVirtualMemory and NtClose, defeating userland EDR hooks placed on those NTAPI functions (T1562.001 Disable or Modify Tools; T1106 Native API). It then patches EtwEventWrite() in-process so the function returns immediately, suppressing Event Tracing for Windows generation and blinding ETW-backed telemetry (T1562.006 Indicator Blocking).

Stage 3 — RemotePE (memory-only RAT). The final stage is a C++ RAT loaded reflectively and executed entirely in process memory, never written to disk (T1055.002 Portable Executable Injection). Its capabilities are deliberately modest and operator-driven: shell command execution, file read/write, file deletion with a multi-pass overwrite (the routine Fox-IT links to PondRAT/POOLRAT), and C2 polling with configurable sleep intervals (T1059, T1070.004 File Deletion). Initial access is social-engineering via Telegram — the actor impersonates a prospective contact and sends scheduling links on look-alike Calendly/Picktime-style domains to lure the target into the loader (T1566).

Detection concepts (no IOCs). This chain is built to defeat disk forensics and static signatures, so the detection surface is behavioural and largely in memory:

  • Service-DLL anomaly. Alert on service-creation (Windows EID 7045) or service-DLL registration pointing at Iassvc.dll — the legitimate IAS DLL is iassvcs.dll; the missing s is the tell. Compare all service DLLs against a blessed-DLL allowlist.
  • ETW-write tampering. Monitor for in-process patching of ntdll!EtwEventWrite — EDRs that place kernel callbacks on writes to mapped ntdll regions will surface this; a sudden cessation of ETW events from a service process is a secondary signal.
  • Syscall-unhooking / KnownDlls remap. Surfaces as PEB module-list traversal and \KnownDlls section-object mapping from a non-loader context — visible via memory-integrity callbacks or process-tampering telemetry.
  • Memory-only payload. Hunt for HTTP(S) beacons from processes that have no backing PE on disk at the beacon origin, and periodically scan service-process memory for reflective-PE characteristics; disk imaging alone will not recover RemotePE.
  • Decoy-store writes. Sysmon EID 11 for files written under DeviceMetadataStore\en-US\ whose extensions are not the expected Cabinet/metadata types.

Hardening / mitigation. Enforce a service-DLL allowlist and block service registration of unsigned or unexpected DLLs in System32; restrict write access to DeviceMetadataStore to SYSTEM; enable AMSI and, where available, kernel-mode telemetry that does not depend solely on userland NTAPI hooks (the unhooking specifically targets userland hooks, so kernel-callback-based EDR sensors retain visibility). For the financial/treasury and any crypto-adjacent teams that are the named victim profile — including European financial institutions in Lazarus's target verticals — treat unsolicited Telegram scheduling links as a credential/loader-delivery TTP and route them through the same scrutiny as email attachments.

6. Action Items

  • Upgrade Szafir SDK to ≥ 463 and fix the validation logic, not just the version — in every application consuming the SDK, gate signature acceptance on the certificate trust status (SigningCertificate/@certificateType != "nondetermined"), not on the result code alone, and review verification logs for Result/@code == 0 events that coincided with a nondetermined certificate (§ 2, CVE-2026-9058). The same "verify trust status, not just cryptographic integrity" check applies to any CH/EU qualified-signature stack (CERT Polska, 2026-05-25).
  • Audit ASP.NET estates for shared / default machineKey values and rotate to unique per-deployment keys — the KnowledgeDeliver compromise (§ 2, CVE-2026-5426) is a pre-shared-key ViewState deserialization RCE; the exposure exists in any .NET app that ships or reuses a default key. Hunt Windows Application-log EID 1316 and w3wp.exe spawning shells on web servers (Google Threat Intelligence Group, 2026-05-25).
  • Move TOTP/SMS-MFA portals toward FIDO2/WebAuthn; bind MFA to the login session in the interim — real-time OTP relay (§ 3) defeats TOTP and SMS outright. Alert on OTPs consumed from a different ASN than the one they were issued to, and on contactless-wallet provisioning right after a credential submission from an unrecognised device (Google Threat Intelligence Group, 2026-05-25).
  • Harden the build pipeline against supply-chain poisoning — pin exact npm/PyPI/Cargo versions, verify lockfile hashes, prefer --ignore-scripts, and stop treating an npm Sigstore badge or displayed SLSA attestation as install-time proof of safety (§ 1 TrapDoor, § 4 TeamPCP). Add a check for zero-width Unicode (U+200B/U+200C/U+FEFF) in .cursorrules / CLAUDE.md to catch AI-assistant config poisoning (Socket, 2026-05-24).
  • Hunt the RemotePE behavioural surface and add AI-brand impersonation to malvertising monitoring — service-DLL allowlisting (watch for Iassvc.dll), EtwEventWrite patch detection, in-memory reflective-PE scanning (§ 5); and powershell.exe spawned from browser-download/archive-extraction paths for the fake-Claude ACR Stealer lure (§ 1) (Fox-IT, 2026-05-22).

7. Verification Notes

  • Items dropped (with reason):
    • "Project Glasswing" / "Claude Mythos Preview" (S3) — dropped on the fake-news + vanity-metric + relevance bars (PD-4, PD-6, PD-11). The cited URLs resolve, but the item is built on vanity metrics (large headline vulnerability counts, a high claimed true-positive rate and multi-million-dollar credit figures — which the fetched sources do not even agree on) and an unverifiable model name, with no defender action for a Swiss/EU public-sector SOC beyond a single referenced WolfSSL certificate-forgery flaw that could not be independently corroborated this run and is therefore not surfaced as fact.
    • Packagist 8-package supply-chain attack (S3) — duplicate; this was the deep dive in the 2026-05-24 brief (the cross-ecosystem package.json-in-PHP-package postinstall strand). No material in-window delta. PD-8.
    • Oncology Institute / TriZetto Provider Solutions SEC 8-K (S4) — US nexus; the underlying Item 1.05 filing is dated 2026-05-22 (outside the 36 h window), and the item was already assessed and dropped in the 2026-05-24 and 2026-05-25 § 7. The third-party-breach (TPRM) lesson stands but carries no in-window CH/EU-relevant delta.
    • Charter Communications / ShinyHunters (S4) — covered 2026-05-25; today's only change is that the 27 May deadline has not yet elapsed, no data has been released, and no SEC 8-K has been filed. "Deadline approaches, nothing released" is not material new development (PD-8); re-cover only on data release, an 8-K, or fresh attribution.
    • CVE-2026-9256 "nginx-poolslip" (S1) — a genuine, distinct second buffer-overflow in ngx_http_rewrite_module, confirmed on the official NGINX/F5 advisory listing (F5 article K000161377, separate from CVE-2026-42945). Dropped from § 2 as out-of-window (disclosed 2026-05-22, no in-window development) and below the inclusion gate: F5 rates it medium, default deployments without complex rewrite rules are not exploitable, and no in-the-wild exploitation is reported. Operationally useful nugget retained here: the patch for CVE-2026-42945 (NGINX Rift, covered 2026-05-17 — Open Source 1.31.0 / 1.30.1) does not remediate CVE-2026-9256; operators must upgrade to 1.31.1+ / 1.30.2+ (NGINX Plus R36 P5 / R32 P7).
  • Contradictions: NGINX CVE-2026-9256 severity — the official NGINX/F5 advisory rates it medium; the securityonline.info write-up characterises it as a critical zero-day with a demonstrated remote ASLR-bypass RCE PoC. The brief defers to the vendor severity and treats the RCE / ASLR-bypass characterisation as unconfirmed.
  • Single-source items (both HIGH-reliability primaries, flagged inline): § 3 GTIG Chinese-language PhaaS ecosystem (Google Threat Intelligence Group primary research); § 1 ACR Stealer fake-Claude malvertising (SANS Internet Storm Center diary).
  • Watch (unconfirmed, not reported as fact): DentaQuest (US dental-benefits administrator, Medicaid programmes) was listed by ShinyHunters on 2026-05-23 with the same 27 May deadline (S4) — a dark-web listing only, no victim confirmation; monitor for a victim statement or SEC 8-K.
  • Recency: standard 36 h window; gap to prior brief 24 h — no extended-window disclosure required. The CH/EU breaking-news window was genuinely thin: S2 swept NCSC.ch, BSI, CERT-FR, CERT-EU, NCSC-NL, ICO-UK, CNIL and EDPB and found no new in-window national-CERT advisories, named-victim incidents or regulator enforcement actions.
  • Source lifecycle: Socket (socket-dev-blog) was already a tracked candidate and contributed two primaries this run (TrapDoor, Packagist) — its last_successful_fetch was bumped to today. This run's one new candidate is fox-it-blog (Fox-IT International Blog, NCC Group) — the primary for the § 5 RemotePE teardown; it is a distinct property from the already-active ncc-research.
  • Verification: 3 iterations to CLEAN (iter 1 Opus → 3 truth findings remediated; iter 2 Sonnet → 1 truth finding remediated [ACR Stealer JPEG role corrected to match source]; iter 3 Opus → CLEAN, 1 non-blocking advisory applied). The verifier sub-agents' self-identification env vars were unset; models are recorded from the agent-type pinning (cti-verification = Opus, cti-verification-alt = Sonnet) and corroborated by iteration 3's runtime self-report (Opus 4.7).
  • Coverage gaps: ncsc-ch-security-hub (SSL/cert verification error on bridge — not retrieved this run); databreaches-net (HTTP 403, persistent); sophos-xops (HTTP 503, persistent); trendmicro-research (JS-rendered SPA, no in-window primary); inside-it-ch (Cloudflare challenge 403 on bridge, no Wayback fallback); cert-eu (latest advisory 2026-006 dated 2026-05-06, pre-window); anssi-fr (latest CERTFR-2026-AVI-0609 dated 2026-05-19, pre-window); ncsc-nl (latest NCSC-2026-0166 dated 2026-05-21, already covered); bsi-de (in-window items are updates to already-covered CVEs only); cnil-fr, edpb (no in-window enforcement actions); mandiant-gtig (legacy www.mandiant.com/resources/blog returns 404 — content now served at cloud.google.com/blog/topics/threat-intelligence/, fetched successfully).