Saturday, 16 May 2026

BKA arrests Dream Market lead administrator "Speedstepper" in Germany, cryptocurrency-to-physical-gold OPSEC failure after seven years at large

Owe Martin Andresen, a 49-year-old German national alleged by US and German prosecutors to be "Speedstepper" (the lead administrator of the Dream Market darknet narcotics marketplace from 2013 until its 2019 voluntary shutdown) was arrested in Germany on 2026-05-07 and publicly identified on 2026-05-13–14 (The Record, 2026-05-14 · US DEA, 2026-05-13). The action was a coordinated multi-agency operation: the Bundeskriminalamt and the Zentrale Kriminalinspektion Oldenburg for the German side, with the US DEA Miami, IRS-CI Cyber Crimes Unit, FBI, USPIS, and HSI executing in parallel. A US federal grand jury in the Northern District of Georgia had returned a sealed indictment on 2026-01-13 charging Andresen with six counts of international concealment money laundering and six counts of concealment money laundering (240 years aggregate maximum); German charges carry up to five years. The OPSEC failures that closed the seven-year gap were operational, not technical: in late 2022 Andresen allegedly accessed Dream Market's dormant cryptocurrency wallets (an action only the holder of the original private keys could perform) and consolidated the contents into a single wallet, providing prosecutors with a definitive on-chain link; and in August 2023 he used an Atlanta-based cryptocurrency-to-physical-asset service to purchase gold bars that were shipped directly to his home address in Germany, providing the geographic and identity link. At arrest, German authorities seized approximately USD 1.7 million in gold bars, USD 23,000 in cash, and approximately USD 1.2 million in cryptocurrency. Three Dream Market co-administrators ("Oxymonster", "KITT3N", "GOWRON") had been convicted previously. The case is operationally interesting to public-sector intelligence liaisons because it illustrates that long-tail attribution of darknet operators is increasingly driven by post-cessation financial behaviour (wallet reactivation, regulated-service touchpoints, physical-asset conversion) rather than on-platform OPSEC; the seven-year delay between the marketplace's closure and the arrest is the operational signal.

node-ipc npm package backdoored via expired-domain account takeover: three malicious versions steal developer and CI credentials, flagged about three minutes after publication

On 2026-05-14, three malicious versions of the node-ipc npm package (9.1.6, 9.2.3 and 12.0.1) were published at the same time by a co-maintainer account with no prior publish history on the package (StepSecurity, 2026-05-14). The account's email domain had expired on 2025-01-10 and was re-registered on 2026-05-07, a week before the attack (The Hacker News, 2026-05-14). Socket assesses that the new domain owner could then trigger a standard npm password reset and gain publish rights without touching the maintainer's own infrastructure (Socket Security, 2026-05-14). CSO counts almost 700K weekly downloads and 424 dependent projects, while StepSecurity reports over 10 million weekly downloads (CSO Online, 2026-05-14 · StepSecurity, 2026-05-14). The 9.x releases are fabricated from the 12.x package structure, so projects on ^9, ~9.1.x, ~9.2.x, ^12 or ~12.0 ranges received a malicious build on their next install or lockfile refresh (StepSecurity, 2026-05-14). When StepSecurity published, npm's latest tag pointed to 12.0.1, so an unpinned npm install node-ipc pulled the compromised tarball (StepSecurity, 2026-05-14).

The payload is an 80 KB obfuscated function appended to the CommonJS bundle node-ipc.cjs. It runs on every require('node-ipc') and uses no npm lifecycle hook, so tools that only scan preinstall and postinstall scripts miss it (StepSecurity, 2026-05-14). ESM-only consumers do not load the malicious file unless another dependency or a direct require loads node-ipc.cjs (Socket Security, 2026-05-14). The payload forks a detached child Node process that collects cloud provider credentials, SSH keys, Kubernetes tokens, GitHub CLI configuration, Terraform state, CI workflow files, .env files, shell history and macOS Keychain databases, gzips them and exfiltrates them (Socket Security, 2026-05-14 · StepSecurity, 2026-05-14). Four stacked obfuscation layers (string-array shuffling, control-flow flattening, dead-code injection and a custom reversed-nibble base-16 encoding) resist static analysis (StepSecurity, 2026-05-14). Socket found no persistence and no second-stage download, and its scanner flagged the publish within roughly three minutes (Socket Security, 2026-05-14).

Contradiction: the analyses disagree on payload details. StepSecurity and The Hacker News describe 90+ file-path patterns, an HTTPS POST channel alongside DNS TXT exfiltration, and a SHA-256 targeting gate that leaves 12.0.1 inert except on one targeted project (StepSecurity, 2026-05-14 · The Hacker News, 2026-05-14). Socket counts 113 macOS and 127 Linux patterns, says the payload uses DNS TXT queries and not HTTP, HTTPS or TLS for exfiltration, and finds the same malicious file in all three versions, with a hash gate that only changes what the module exports (Socket Security, 2026-05-14). Treat all three versions as active stealers.

GTIG: UNC6671 "BlackFile" vishing → AiTM → rogue-MFA → programmatic SharePoint exfiltration (1M+ files from one victim); DLS shutdown signals possible rebrand

Google Threat Intelligence Group published on 2026-05-15 an analysis of UNC6671, a financially motivated extortion cluster that adopted the "BlackFile" brand by February 2026 and has targeted dozens of organizations across North America, Australia and the UK (Google Threat Intelligence Group, 2026-05-15). Callers hired by the actor phone employees' personal mobile numbers, pose as internal IT or helpdesk staff citing a passkey migration or MFA update, and send the victim to a lookalike single sign-on portal on Tucows-registered domains, lately as organization-named subdomains with "passkey" or "enrollment" themes (Google Threat Intelligence Group, 2026-05-15). The operator relays the credentials and the MFA code or push approval to the real SSO provider in real time, then immediately registers a new attacker-controlled MFA device for persistence (Google Threat Intelligence Group, 2026-05-15). GTIG stresses that these compromises come from social engineering, not a vendor vulnerability (Google Threat Intelligence Group, 2026-05-15).

After access, the actor moves into connected SaaS applications (SharePoint, OneDrive, Zendesk, Salesforce), searches for strings such as "confidential" and "SSN", and exfiltrates with Python requests and PowerShell scripts through Microsoft Graph and direct HTTP GET requests against document URLs, reusing session cookies (for example FedAuth) captured during the vishing phase (Google Threat Intelligence Group, 2026-05-15). In one case the script downloaded more than a million files from SharePoint and OneDrive (Google Threat Intelligence Group, 2026-05-15). The direct-fetch method is often logged as FileAccessed rather than FileDownloaded, so it slips past SOCs that treat FileAccessed as benign (Google Threat Intelligence Group, 2026-05-15). In early intrusions the FileDownloaded records carried a spoofed Microsoft Office ClientAppId, which GTIG says served to bypass basic conditional access filters, while the user-agent showed python-requests or WindowsPowerShell (Google Threat Intelligence Group, 2026-05-15). In later intrusions the FileAccessed records named python-requests as the client application in AppAccessContext (Google Threat Intelligence Group, 2026-05-15). The sessions came from commercial VPN exit nodes and hosting providers (Google Threat Intelligence Group, 2026-05-15).

The BlackFile leak site went offline in late April 2026, came back on 2026-05-11 with a message that BlackFile "is shutting down… under this name", and was inaccessible at publication (Google Threat Intelligence Group, 2026-05-15). GTIG reads this as a possible transition phase rather than a permanent cessation, noting that extortion clusters commonly rebrand or disperse after shutdowns (Google Threat Intelligence Group, 2026-05-15). GTIG assesses UNC6671 as independent of ShinyHunters (UNC6240), although UNC6671 co-opted the ShinyHunters brand at least once (Google Threat Intelligence Group, 2026-05-15).

Triage: an Office client identity paired with a scripting-library user-agent is the mismatch GTIG found, and GTIG reads it as scripted access rather than a person using SharePoint (Google Threat Intelligence Group, 2026-05-15). A session source on a commercial VPN or hosting provider that is unusual for the user adds weight (Google Threat Intelligence Group, 2026-05-15).

CVE-2026-44112 / CVE-2026-44113 / CVE-2026-44115 / CVE-2026-44118, OpenClaw "Claw Chain": four chainable flaws in autonomous-agent platform enable sandbox escape → credential leak → privilege escalation → file disclosure

Cyera Research published on 2026-05-15 four chained vulnerabilities in OpenClaw (also marketed as Clawdbot), an autonomous AI-agent platform released in late 2025 with integrations including Microsoft Agent 365 (Cyera Research, 2026-05-15 · The Hacker News, 2026-05-15). All four CVEs are fixed by the OpenClaw release dated 2026-04-23, addressed under GitHub Security Advisories GHSA-5h3g-6xhh-rg6p, GHSA-wppj-c6mr-83jj, GHSA-r6xh-pqhr-v4xh, and GHSA-x3h8-jrgh-p8jx. The defender-relevant detail is that an attacker who can obtain code execution inside the OpenClaw managed sandbox (achievable via a malicious plugin, prompt injection into the agent context, or supply-chain compromise of an OpenClaw plugin) can chain the four primitives to a full sandbox-escape → credential-harvest → owner-level agent control → file-disclosure sequence whose steps each mimic normal agent behaviour and so evade controls calibrated to "human-attacker" indicators. CVE-2026-44112 (CVSS 9.6, Critical) is a TOCTOU race in the OpenShell sandbox backend that lets the sandbox process win the filesystem write race and redirect writes outside the intended mount root, enabling host-filesystem tampering and persistent backdoor placement. CVE-2026-44115 (CVSS 8.8, High) is an incomplete allowlist in OpenClaw's command parser, shell-expansion tokens embedded in environment-variable names bypass the validation gate, leaking API keys, tokens, and credentials at execution time. CVE-2026-44118 (CVSS 7.8, High) trusts a client-controlled senderIsOwner flag in MCP loopback messages without validating against the authenticated session, allowing privilege escalation to owner-level agent control. CVE-2026-44113 (CVSS 7.7, High) is the companion TOCTOU read escape enabling file disclosure outside the sandbox root. Exposure is broad: Cyera cites ~65 K (Shodan) and ~180 K (ZoomEye) publicly accessible OpenClaw instances as of May 2026, summing to an estimated ~245 K exposed servers. No in-the-wild exploitation reported at disclosure. Detection: alert on the agent process writing files outside designated sandbox mount directories; flag MCP loopback messages with senderIsOwner=true from sources not matching the authenticated session; alert on environment-variable expansion in command strings at agent execution time.

AMD-SB-7052 / CVE-2025-54518, AMD Zen 2 µop-cache corruption / SoC isolation failure: local privilege escalation (CVSS 7.3), microcode mitigation in May 2026 Windows update and Xen XSA-490

AMD disclosed AMD-SB-7052 (CVE-2025-54518, CVSS 7.3 on the CVSS 4.0 scale, CWE-1189 Improper Isolation of Shared Resources on System-on-Chip) affecting Zen 2-based processor models on 2026-05-12, with NCSC-NL flagging the advisory on 2026-05-15 (AMD Product Security, 2026-05-12 · NCSC-NL NCSC-2026-0158, 2026-05-15). The flaw allows a local attacker with code execution on the target system to corrupt the CPU operation (µop) cache and thereby cause instructions to execute at a higher privilege level than intended, enabling local privilege escalation and, in virtualisation contexts, potential degradation of hypervisor-level isolation. Mitigation is delivered as microcode integrated into the May 2026 Microsoft Windows cumulative update (the same window as the previously-covered CVE-2026-41089 / 41096 Patch Tuesday set); Fedora has issued separate kernel + microcode updates (advisory IDs per NCSC-NL CSAF references) and Xen has published XSA-490 for bare-metal hypervisor operators. Lenovo has published a product-security advisory covering affected ThinkPad / ThinkStation / Workstation models for BIOS / UEFI guidance. Attack class: T1068 Exploitation for Privilege Escalation, with elevated relevance in confidential-compute and multi-tenant virtualisation contexts (VDI estates, cloud-hosted VMs on Zen 2 hosts, shared university compute clusters). No in-the-wild exploitation confirmed. Detection / verification: confirm the May 2026 Windows CU includes the AMD microcode revision via the relevant KB and wmic cpu get name, dataWidth, processorId; for Linux hypervisors apply distro kernel + microcode updates and reboot; for Xen apply XSA-490; for Lenovo hardware check BIOS / UEFI update guidance per LEN-216977. The local-only attack vector limits external risk; the priority is multi-tenant and virtualisation contexts where guest-to-hypervisor or container-to-host isolation is part of the security boundary.

CVE Summary Table

SentinelOne: "Living Off the Pipeline", CI/CD subversion taxonomy with three real intrusion cases (TeamCity, GitLab service-account pivot, Contagious Interview)

SentinelOne published on 2026-05-15 a practitioner-focused taxonomy of CI/CD pipeline subversion techniques, illustrated with three real intrusion case studies that are immediately useful for SOC and DevSecOps teams running JetBrains TeamCity, GitLab, or GitHub Actions (SentinelOne, 2026-05-15). Case 1: an unpatched TeamCity server (CVE-2023-42793) exploited to deploy backdoors via privileged build tasks, remaining undetected for 12+ months. Case 2: a GitLab service-account token compromise enabling creation of malicious Ansible playbooks that were then automatically executed by pipelines, a clean demonstration of how service-account over-privilege translates directly into production code execution. Case 3: the Contagious Interview campaign using fraudulent job offers directing developer victims to fake skill-assessment sites that deploy malware silently to developer workstations. Additional vectors covered include attacker-registered self-hosted runners, workflow triggers from repository discussion comments, dependency poisoning with reconnaissance preinstall scripts, and maintainer-account compromise appending malicious code; the article cross-links a separate SentinelOne analysis of the "Sha1-Hulud" NPM compromise as a related supply-chain case. MITRE ATT&CK: T1195.002, T1547 (rogue runner registration as persistence), T1555 (pipeline secret extraction), T1204 (user execution via fake job-offer social engineering), T1072 (software-deployment-tool abuse via Ansible). Defender monitoring priorities surfaced in the report: GitHub / GitLab audit logs for runner.registered events with unfamiliar names or unexpected source IP ranges; new or modified pipelines authored by service accounts; suspicious child-process spawn from build agents (cmd.exe, powershell.exe, curl, wget outside baseline); credential-access and reverse-tunnel traffic originating from build infrastructure; and secret-injection patterns in workflow-config modifications. Single-source, SentinelOne only.

Unit 42: Gremlin Stealer evolved with .NET-resource XOR obfuscation, real-time crypto-clipper, and WebSocket browser-process session-hijack module

Palo Alto Networks Unit 42 published on 2026-05-15 an analysis of evolved variants of the Gremlin information stealer, adding three new capability tiers operationally relevant to defenders running endpoint detections tuned for older Gremlin samples (Palo Alto Networks Unit 42, 2026-05-15). Obfuscation has shifted to embedding encrypted payloads in .NET resource sections (XOR-keyed) combined with single- or double-character identifier renaming and a runtime string-decoder function (_003CModule_003E.c()), defeating static signature analysis of string literals that previous-generation Gremlin samples used. A new crypto-clipper component continuously monitors the system clipboard and replaces Bitcoin and Ethereum wallet addresses with attacker-controlled equivalents in real time, T1115. The most operationally interesting addition is a WebSocket-based session-hijack module that reads active browser process memory (Chrome-based browsers) to extract session tokens directly from running processes, bypassing the cookie-encryption mitigations modern browsers apply at disk, T1185 Browser Session Hijacking. Credential scope includes browser cookies, session tokens, saved passwords, payment-card details, FTP and VPN credentials, Discord tokens (dedicated regex scanner), clipboard content, and cryptocurrency wallet files. Exfiltration is HTTPS POST to a private web panel; a Telegram Bot API channel is the secondary channel. Detection: Sysmon EID 10 (process access) targeting chrome.exe or msedge.exe (and other Chrome-based browser processes) from unexpected parent processes; clipboard-monitoring hook registration from non-standard processes (generic Windows clipboard-listener API surface). Hardening: browser isolation for high-value sessions; clipboard-API access audited in EDR telemetry. Single-source, Unit 42 only; flagged for verification.

Microsoft Exchange CVE-2026-42897: Active Exploitation Without a Patch

Background. On-premises Microsoft Exchange has been a sustained, high-value target for advanced and opportunistic actors for the entire 2021–2026 window. ProxyLogon (CVE-2021-26855 + chain) in March 2021 was exploited at scale by Hafnium and dozens of follow-on clusters before mitigations stuck; ProxyShell (CVE-2021-34473 + chain) repeated the pattern in August 2021 (Microsoft Threat Intelligence, 2021-03-02 · CISA Alert AA21-321A, 2021-11-17). The Exchange Emergency Mitigation Service (EEMS), introduced in Exchange Server 2016 CU22 and 2019 CU11, was Microsoft's explicit response to that pattern: a small auto-update mechanism that ships URL-rewrite rules to live Exchange front-ends in the gap between an in-the-wild zero-day and a permanent CU (Microsoft, 2021-09-28). CVE-2026-42897 is the first 2026 case where EEMS (not a Patch Tuesday CU) is the line of defence against active exploitation; the deep dive that follows is therefore as much about EEMS verification and bypass conditions as about the XSS itself.

Vulnerability mechanics. CVE-2026-42897 is classified by Microsoft as a spoofing vulnerability (impact category) underpinned by CWE-79, improper neutralisation of input during web-page generation, in the Outlook Web Access (OWA) component (Microsoft MSRC, 2026-05-14). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N describes a network-deliverable XSS that requires the victim to open the malicious message in OWA: no authentication is required of the attacker, only of the recipient. Microsoft assesses severity Critical despite the 8.1 base score, the "Critical" label reflects the impact reach (session-token theft, content tampering in the OWA session, downstream phishing from a now-trusted internal mailbox), not the base metric. Microsoft has not published the precise attacker-controlled fragment that delivers the JavaScript payload (consistent with Exploitation Detected status, the team is withholding payload format pending the permanent SU) but the MSRC FAQ confirms the chain shape: crafted email → OWA render → script execution → spoofing actions taken under the victim's authenticated OWA context. Affected versions are Exchange Server 2016 (all CU levels), Exchange Server 2019 (all CU levels), and Exchange Server Subscription Edition (RTM and current CUs); Exchange Online is unaffected.

Exploitation status and attribution. Microsoft confirmed Exploitation Detected on 2026-05-14 with the published advisory (Microsoft MSRC, 2026-05-14). The NCSC Switzerland Cyber Security Hub independently restated the active-exploitation finding in advisory #12577 on 2026-05-15 (NCSC-CH Security Hub #12577, 2026-05-15). CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-05-15 with a federal civilian-branch remediation deadline of 2026-05-29; per PD-13 in this brief series, that deadline has no jurisdictional weight in Switzerland or the EU and is recorded here only as confirmation of the exploitation signal; defenders should drive the remediation timeline off the Microsoft-confirmed active exploitation, not the BOD 22-01 date. No named threat-actor attribution has been published; Microsoft notes the scale and identity of the exploitation activity are not yet detailed publicly (The Hacker News, 2026-05-15).

Attack chain. From the limited disclosure, the operationally credible kill chain is:

1. T1566.001 Phishing: Spearphishing Attachment: attacker delivers a specifically crafted email to a target whose mailbox is hosted on a vulnerable on-premises Exchange Server.
2. T1059.007 Command and Scripting Interpreter: JavaScript: when the target opens the message in OWA, browser-side JavaScript executes in the OWA origin's context.
3. T1185 Browser Session Hijacking: payload reads OWA session cookies / auth tokens and exfiltrates to attacker-controlled infrastructure.
4. T1078 Valid Accounts: attacker re-uses the exfiltrated session material to issue authenticated OWA requests as the victim, with full mailbox read/send privileges.
5. T1534 Internal Spearphishing: onward phishing from the now-trusted internal sender to high-value recipients (executives, finance, identity admins), spreading the access.

EEMS; what it does, when it doesn't apply. The Exchange Emergency Mitigation Service is a small Windows service installed by the Exchange setup process on Exchange 2016 CU22 / Exchange 2019 CU11 and later; it polls a Microsoft-hosted Office Config Service endpoint hourly for new mitigation rules and applies URL-rewrite rules to the IIS configuration when one matches the server's installed Exchange version. For CVE-2026-42897, Microsoft has published Mitigation M2, which rewrites the specific request format the in-the-wild exploit uses to deliver the XSS payload; the mitigation does not require an Exchange restart and applies automatically on any internet-connected, EEMS-enabled Exchange server (Microsoft Exchange Team, 2026-05-14). EEMS does not apply automatically in the following operationally common configurations: (a) Exchange Server 2013, on which EEMS is not available; (b) Exchange servers with no outbound HTTPS connectivity to officeclient.microsoft.com (air-gapped networks, segmented DMZs, environments with strict egress controls); (c) Exchange servers where EEMS has been manually disabled (Set-OrganizationConfig -MitigationsEnabled $false, Set-Server -MitigationsEnabled $false, or via Group Policy); (d) Exchange servers that have been hardened with custom IIS rewrite rules that conflict with the EEMS rule placement. For all four cases, operators must run the Exchange On-Premises Mitigation Tool (EOMT) (downloadable from aka.ms/UnifiedEOMT) via the Exchange Management Shell as Administrator, which applies the same URL-rewrite Mitigation M2 manually.

EEMS verification; what to actually run on every Exchange server. The canonical check is:

• Get-ExchangeDiagnosticInfo -Server <server> -Process MSExchangeHMWorker -Component EemsMitigation -SettingName MitigationsApplied and confirm the Mitigation M2 identifier published in the MSRC advisory appears in the output.
• Get-OrganizationConfig | Select-Object MitigationsEnabled and Get-Server <server> | Select-Object MitigationsEnabled should both return True.
• IIS Manager → Default Web Site → URL Rewrite should show the EEMS-injected rewrite rule corresponding to CVE-2026-42897.

If any check fails, run EOMT immediately; do not wait for the next EEMS poll cycle.

Permanent-patch availability, the Period 2 ESU constraint. Microsoft has signalled that the permanent fix will ship as a CU for Exchange Server Subscription Edition (publicly available SU) and as a security update for Exchange 2016 CU23 and Exchange 2019 CU14 / CU15, but the Exchange 2016 / 2019 updates will only be distributed to organisations enrolled in the Period 2 Exchange Server Extended Security Update programme (Microsoft Exchange Team, 2026-05-14). Any Swiss or European public-sector organisation running Exchange 2016 / 2019 in production today should verify ESU enrolment status with its Microsoft licensing partner before relying on the permanent update path; organisations that are not enrolled face a structural constraint where EEMS Mitigation M2 is the permanent operational mitigation, not the bridge.

Hunt and detection concepts. The mitigation prevents future exploitation; it does not retroactively detect or remediate prior exploitation. Defenders should look back to 2026-05-09 (a generous overlap window prior to public disclosure):

• IIS access logs (front-end Exchange role): /owa/ URLs with <script>, javascript:, or HTML-encoded equivalents in query strings; OWA URLs with anomalous referrer headers from external mail-rendering paths.
• Exchange transport logs: emails with HTML bodies that embed encoded JavaScript fragments delivered to mailboxes whose owners are OWA users (cross-correlate with Get-CASMailbox -OWAEnabled $true).
• EDR telemetry on Exchange front-end servers: w3wp.exe (IIS worker process, Exchange app pool) spawning unexpected children (cmd.exe, powershell.exe, cscript.exe, browser launchers) is the post-exploitation tell of XSS-to-execution chains observed in prior Exchange compromises.
• Exchange Application Event Log EID 4 (MSExchange Management): for EEMS mitigation-state changes; flag any disable / re-enable cycle that does not correspond to a documented change.
• OWA session anomalies: Get-MailboxAuditLog for unusual mailbox-folder reads or message-send activity from sessions whose source IP differs from the user's established pattern.

Hardening and mitigation. The non-negotiable immediate action is verifying EEMS Mitigation M2 is applied on every Exchange Server 2016, 2019, and SE in the estate and applying EOMT where it is not. Beyond that, defenders should: (a) confirm Period 2 ESU enrolment for any Exchange 2016 / 2019 production deployment that is not on a migration path to SE or Online; (b) restrict OWA access at the perimeter to users behind Conditional Access compliant-device policy where possible, reducing the population of XSS-deliverable mailboxes; (c) plan migration to Exchange Server SE or Exchange Online; repeated EEMS-only mitigations across the 2021–2026 Exchange CVE history are the operational signal that on-premises Exchange has become structurally expensive to defend on the 2016 / 2019 codebases.