Sunday, 16 August 2026

Evooo1Bot: a Mirai-derived Linux botnet whose exploit arsenal reaches Confluence, WSO2 and Kubernetes ingress-nginx, and whose SSH dictionary is stocked with enterprise service accounts rather than router defaults

FortiGuard Labs has documented Evooo1Bot, a previously undocumented Mirai-derived Linux botnet named after a hardcoded string present in every sample and active since at least July 2026 on the firm's own intrusion-prevention telemetry (FortiGuard Labs, 2026-08-13). It reuses the leaked Mirai denial-of-service engine, but the researchers' summary is that it extends that framework with encrypted command-and-control, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer and an integrated exploit arsenal (BleepingComputer, 2026-08-15).

The reason this is not just another Mirai fork is what the exploit module can reach. Most of its chain is the expected consumer and small-office set — NETGEAR, Tenda, TP-Link and D-Link routers and network storage, Hikvision cameras, Telesquare gateways, and an OT remote terminal unit from Mitsubishi Electric. But three of its modules target enterprise-class, internet-facing systems that sit inside European public-sector and critical-infrastructure estates: the Atlassian Confluence OGNL injection (CVE-2022-26134), the WSO2 unrestricted-file-upload path to code execution (CVE-2022-29464), and the Kubernetes ingress-nginx admission-controller flaw (CVE-2025-1974), alongside PHP-CGI argument injection on Windows (CVE-2024-4577) and a Zyxel firewall command injection (FortiGuard Labs, 2026-08-13). One module is a false alarm and worth naming so nobody rediscovers it and panics: the bundled Progress MOVEit Transfer code passes a payload argument without performing the upload procedure, and FortiGuard states such modules are non-exploitable as shipped (FortiGuard Labs, 2026-08-13).

The credential dictionary points the same way. FortiGuard records over 150 entries, and notes that beyond typical IoT defaults the list carries service-account names — jenkins, postgres, oracle, nagios, deploy — that are more common in enterprise and operations-technology environments than on consumer routers (FortiGuard Labs, 2026-08-13). The brute-forcer also screens its targets twice: it compares the SSH banner against a hardcoded list of research honeypot frameworks before attempting credentials, then after login runs a short probe reading kernel version and process-one command line and listing known honeypot install paths, aborting if the host does not answer like a real system (FortiGuard Labs, 2026-08-13).

What the operator does with a foothold is the second half. The bot runs a SOCKS5 relay — a direct listener plus a reverse mode that separates a persistent encrypted control channel from per-session proxy data — and an HTTP credential sniffer that parses the kernel's TCP connection table to lift Basic-Auth and cookie headers into a local log. FortiGuard's framing is that transforming a compromised router into a persistent proxy lets attackers conceal their true origin and pivot into internal networks (FortiGuard Labs, 2026-08-13). Command-and-control is encrypted and runs over TCP/443, a port FortiGuard notes is chosen to blend in with expected HTTPS traffic at the network perimeter; the researchers do not name the cipher that channel uses, though they do describe AES-256-CTR, ChaCha20 and XOR-based key derivation protecting the sample's own strings, with each key split into two constants combined at runtime. Persistence is stacked deliberately: a systemd unit impersonating an Apache cache-manager service with automatic restart, a SysV init script, a cron entry re-fetching the loader every five minutes, a profile.d injection and an rc.local append, with the process raising its own out-of-memory score adjustment and holding the watchdog device open to survive reboots and memory pressure (FortiGuard Labs, 2026-08-13).

Triage: the discriminators are placement rather than signature. An application server or an ingress controller is built to receive connections, so the anomaly is that host originating outbound sessions on 443 that do not correspond to any configured integration — inbound-only services initiating egress is the signal, and the encrypted transport means content inspection will not help. On embedded appliances, the persistence stack itself is the tell: a device that normally carries no cron entries, no profile.d scripts and no custom systemd units suddenly carrying all of them at once is far outside its own baseline, and the impersonating service name is designed to survive a quick eyeball rather than a comparison against what that appliance actually runs. In authentication logs, a single source cycling many distinct enterprise service-account names separates this from legitimate automation, which authenticates as one expected account. One caution for teams running SSH deception: this component fingerprints honeypots before and after login and aborts when it detects one, so silence from a deception asset is not evidence that scanning has stopped.

CVE-2026-71362 — Adobe Commerce and Magento Open Source: an unauthenticated attacker switches a customer session to another customer's account (CVSS 9.1), and a WAF vendor reports it is already blocking attempts

Adobe's 2026-08-11 bulletin APSB26-92 fixes seven vulnerabilities in Adobe Commerce, Adobe Commerce B2B and Magento Open Source, five of them rated Critical (Adobe PSIRT, 2026-08-11). The one that matters operationally is CVE-2026-71362, an incorrect-authorization flaw (CWE-863) which Adobe's own vulnerability table scores at CVSS 9.1 and records as requiring no authentication, no administrator privileges and no user interaction (Adobe PSIRT, 2026-08-11). Sansec, which reviewed the patch, describes the effect concretely: the flaw lets an attacker switch a customer session to another customer account, giving access to that account and its private customer data, and Adobe's fix changes the way Magento handles customer identity in the account session (Sansec, 2026-08-11).

The exploitation picture depends on who is speaking, and both readings belong in a triage decision. Adobe states in the bulletin that it is not aware of any exploits in the wild for any issue in the update (Adobe PSIRT, 2026-08-11). Sansec states that its Shield web application firewall already blocks exploitation attempts against this flaw (Sansec, 2026-08-11), and BleepingComputer reports that attempts to exploit CVE-2026-71362 have been detected (BleepingComputer, 2026-08-12). Nobody reports a confirmed compromised store, so this sits between "patched, quiet" and "actively exploited" — which for a pre-authentication account takeover on an internet-facing storefront is close enough to the latter to act on.

The deployment detail is what will actually cost teams time. APSB26-92 ships as isolated patch files rather than a new security release or new Composer packages, and merchants must be running the latest -p release for their supported release line before the corresponding isolated patch can be applied (Sansec, 2026-08-11). A store several -p releases behind therefore has a two-step upgrade in front of it, not a patch. The affected ranges differ by product and the difference matters for inventory: Adobe Commerce is listed from 2.4.9-2026-jul down to 2.4.4-2026-jul, Adobe Commerce B2B from 1.5.3-2026-jul down to 1.3.3-2026-jul, and Magento Open Source only from 2.4.9-2026-jul down to 2.4.6-2026-jul, each "and earlier", with the fixes in the corresponding -2026-aug builds of each line (Adobe PSIRT, 2026-08-11).

For this constituency the exposure is narrower than a general Magento advisory suggests but is real: public-sector bodies that run ticketing, publication or fee-payment storefronts on Commerce or Magento hold exactly the customer records this flaw hands over, and the payment-adjacent data in those accounts is what makes a session takeover worth automating.

Detection, in vendor-neutral terms: because the flaw operates on session identity rather than injecting code, the signal is in application and web-access logs rather than on the host. Look for requests where a session identifier is presented against a customer account other than the one it was issued to, for a single session identifier or source address touching multiple distinct customer account contexts in quick succession, and for account-area page views and order-history reads that arrive without the preceding authentication sequence that normally establishes them. There is no file to find and no process to spot — a successful attack looks like an ordinary logged-in customer, which is why the post-patch session invalidation matters as much as the patch.

CVE-2026-65400 (macOS Screen Sharing) crosses into confirmed exploitation — NCSC-NL reports root obtained and a Monero miner planted on multiple systems with port 5900 reachable from the internet

UPDATE · originally covered UPDATE — CVE-2026-65400 is remote root, not just an auth bypass: two independent pre-auth bugs sat in screensharingd, working exploits were rebuilt from the patch in four hours, and the two research accounts disagree on which mechanism the CVE names (2026-08-11)

the flaw this pipeline reported twice as carrying no confirmed exploitation — first on Apple's advisory line alone, then on 2026-08-11 with the finding that the daemon runs as root and that working exploits had been rebuilt from the patch diff in about four hours — is now confirmed to be exploited. The Dutch national cyber security centre revised advisory NCSC-2026-0280 on 2026-08-12 to state that it had received a notification showing active abuse of the vulnerability observed on multiple systems where port 5900 was reachable from the internet, and that in all of those cases root access was obtained on the affected system and a Monero cryptocurrency miner was planted (NCSC-NL, 2026-08-12). The revision note the advisory carries for that version — that public proof-of-concept code is available and active abuse is known — ties the escalation directly to the public exploit work the 2026-08-11 entry described (NCSC-NL, 2026-08-12).

This closes the gap the prior entry left open. That entry set out the exposure — a pre-authentication path to root in a daemon that answers on 5900, exploits reconstructed from the binary diff within hours, a researcher scan finding roughly 40,000 Macs with Screen Sharing reachable from the internet, and hosted bare-metal Mac providers that had not folded the fix into their provisioning images — and could only say that no exploitation had been confirmed. It now has been, against exactly that population: internet-reachable port 5900.

Two things are worth holding steady against the temptation to escalate further. The observed outcome is cryptomining, not data theft or ransomware — which says something about who moved first, not about what the primitive permits, since the same pre-auth root gets an operator anything they want on the host. And the remediation has not changed: the fixed builds are macOS 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, the same ones named on 2026-08-08 (BleepingComputer, 2026-08-14). Where an update cannot be applied immediately, disabling Screen Sharing in System Settings where it is not needed remains the vendor-path control (BleepingComputer, 2026-08-14).

Detection: neither source discloses a miner process name, pool infrastructure or persistence mechanism, so there is no artifact to hunt for beyond the generic. What does carry over is the sourced telemetry discriminator from the 2026-08-11 entry — a successful Screen Sharing attach whose authentication type is the weaker of the two the protocol offers, or whose session user resolves to root or to no user at all — which was a concern about a proof-of-concept when it was written and is now a description of activity someone has actually performed. On the outcome side, a Mac sustaining high processor load from a process with no corresponding user session, on a host that accepts connections on 5900, is the shape the confirmed cases took.

Triage: Screen Sharing sessions are ordinary on managed Mac fleets, and remote-support tooling produces them all day. The separators here are reachability and identity rather than the connection itself: a session sourced from outside the corporate network to a host whose 5900 listener is internet-facing, and a session that authenticates without resolving to a named user account. Legitimate administrative screen sharing arrives from known internal ranges or a VPN concentrator and binds to a real operator identity; neither holds for the confirmed cases, where the whole point of the flaw is authenticating without valid credentials.

CVE-2026-58231 (SAP Commerce Cloud) — exploitation attempts reached honeypots three days after patch day with no public proof-of-concept, and NCSC-NL has issued a national advisory

UPDATE · originally covered CVE-2026-58231 — SAP Commerce Cloud: an unauthenticated request to the Data Hub Adapter import endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy (2026-08-12)

the Commerce Cloud flaw this pipeline recorded as carrying no exploitation from any party is being attacked. Threat-intelligence firm Defused reported on 2026-08-14 that the first exploitation attempts against CVE-2026-58231 were arriving at its honeypot sensors three days after SAP's 2026-08-11 patch day, and stated in the same report that the vulnerability has no public proof-of-concept (BleepingComputer, 2026-08-14). Those two facts together are the operationally interesting part: whoever is sending these requests built a working exploit without published research to copy, on a three-day clock, against a component whose remediation is slower than a patch install. On 2026-08-15 the Dutch national cyber security centre published advisory NCSC-2026-0302, which records that attackers are actively scanning for and seeking out vulnerable Data Hub Adapter systems (NCSC-NL, 2026-08-15).

The mechanism is unchanged from the original entry and is worth restating precisely because it shapes what an exposed request looks like: SAP describes the flaw as allowing an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to functions that lack sufficient validation, reaching arbitrary code execution (BleepingComputer, 2026-08-14). The exposure is real rather than theoretical: Shadowserver tracks over 4,200 IP addresses carrying a SAP Commerce Cloud fingerprint, most of them in Europe and North America, though the same reporting is explicit that it cannot say how many of those are honeypots or already remediated (BleepingComputer, 2026-08-14).

Calibrate the status honestly. What is confirmed is exploitation attempts against sensors (BleepingComputer, 2026-08-14) and scanning for vulnerable systems (NCSC-NL, 2026-08-15) — no party reports a compromised production instance, and SAP has not flagged the flaw as exploited in its own advisory (BleepingComputer, 2026-08-14). That distinction matters for triage effort, not for patch priority: the interval between a public fix and a working exploit has collapsed to days on this component, and the remediation is a rebuild-and-redeploy cycle measured in change windows.

Detection, in vendor-neutral terms: in web-access and application logs for the Data Hub Adapter, look for unauthenticated requests to the adapter's import functions that present the default authentication client rather than a customer-provisioned one, and for import-job invocations that do not line up with a scheduled integration run — an import that no ETL schedule accounts for is the anomaly, since this component's legitimate traffic is machine-generated and predictable. Pair that with egress review from the Commerce Cloud application tier, because arbitrary code execution here runs inside a host that normally talks only to its own data-integration peers. Hardening remains the vendor's own path: Onapsis, which works with SAP on its patch cycle, records that customers must patch to the fixed Commerce Cloud release levels referenced in the note and then re-build and re-deploy the updated version, and that configuring an IP Filter Set in Commerce Cloud to restrict access to the vulnerable endpoint is the temporary workaround that reduces exposure meanwhile (Onapsis, 2026-08-11).

ExfilSquad's claims check out: Fortra validated the published data for 13 victims, and puts the leading access theory on Power Pages portals granting the Anonymous Users role read access to Dataverse tables

UPDATE · originally covered UK Department for Education confirms a breach of two public-facing portals and a police legal database, claimed by ExfilSquad — a five-day-old extortion brand whose other 14 claims look fabricated (2026-07-31)

the open question across this pipeline's ExfilSquad coverage has been whether the group's claims were real and how it obtained the data. A second intelligence team has now answered the first and narrowed the second. Fortra's intelligence and research team reviewed the data samples the group made public and concluded that its claim to hold sensitive data is correct, tying at least 13 victims to leaked data across government, education, financial services and manufacturing (Infosecurity Magazine, 2026-08-14). The archive was published by torrent on 2026-08-07 after the group said those organisations did not meet its terms, totalling 382.64 GB and 27 million records across the 13 (Infosecurity Magazine, 2026-08-14). Two organisations from the original list of 15 — a bank and a semiconductor manufacturer — were absent from the dump.

The victim set is broader than the UK public-sector cases this pipeline has carried. Alongside the UK Department for Education and the Police National Legal Database, it includes the City of Atlanta and District of Columbia Public Schools, where 60,000 records containing student names, dates of birth and unique student identifiers were leaked in a version the group said it had censored (Infosecurity Magazine, 2026-08-14).

On the access path, Fortra's finding is a narrowing rather than a confirmation, and the distinction is worth preserving: its leading theory is misconfigured Power Pages portals allowing public read access, with the leaked data structures consistent with Dataverse exports and no evidence found of a vulnerability being exploited or ransomware deployed (Infosecurity Magazine, 2026-08-14; Cybersecurity Dive, 2026-08-14). Fortra reasons that because the campaign reached roughly 15 victims rather than tens of thousands, a platform vulnerability is unlikely to be the source — a configuration error reproduces per tenant, a product flaw would not (Infosecurity Magazine, 2026-08-14).

What is new against this pipeline's 2026-08-04 and 2026-08-05 entries is the mechanism stated at field precision and the exposure counted. The known Power Pages issue Fortra points to is that when the Anonymous Users web role is assigned to a table permission, that table's data can be read by anyone visiting the site, reachable through the portal's own API path, and Microsoft's documentation advises against using that role on publicly exposed sites (Infosecurity Magazine, 2026-08-14). Fortra reports it was able to identify over 10,000 potential Power Pages instances accessible to the public, and notes that automated scanning for exposed Power Pages sites is a known technique — victims were likely found by crawling for misconfigured portals rather than targeted (Infosecurity Magazine, 2026-08-14).

Triage: for an estate running these portals, alert-side evidence of this activity is close to absent by construction — an anonymous read through the portal API is indistinguishable in authentication telemetry from a legitimate public page view, and neither a failed-logon spike nor a new-account artifact appears. The available signals are volumetric rather than behavioural: sustained sequential requests to the portal's API path from a single source, request patterns that walk table or record identifiers in order, and response sizes far larger than the site's ordinary page traffic. Treat an absence of alerts here as uninformative, and settle the question from the permission configuration instead.

Jewelbug: one script tag in a shared government webmail template put a watering hole on 15+ ministry tenants at once, and the browser extension it drops escapes the sandbox through a native-messaging host named after Microsoft Edge

Symantec's Threat Hunter Team has published the results of a months-long investigation into Jewelbug, a China-based hack-for-hire group that runs two missions from one set of hands: espionage against government ministries and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency-fraud business aimed at Chinese-speaking victims. Both are administered from a single control panel called XG-Web, a browser-centric remote-access and information-stealing framework built as a React panel over a Node.js backend with a MySQL database that doubles as the rendezvous point for victim implants; its developers describe it in their own documentation as a "penetration-testing platform", while its internal function names include browser hijacking, data theft and man-in-the-middle attack (Symantec, 2026-08-13). Symantec assesses with high confidence that the fraud and search-engine-optimisation arm is run by the sole legal representative of a registered Changsha company, on the basis of government-issued identity documents, a business licence and a signed authorisation letter recovered from the operators, and considers it most likely that the SEO business supplied access, infrastructure and delivery to the espionage operation rather than one person performing both roles (Symantec, 2026-08-13).

The access pattern is the finding. In its largest espionage operation, Jewelbug did not attack ministries individually. It compromised the shared web-hosting platform run by a Middle Eastern state telecommunications provider and national network-services agency, obtained write access to the common webmail installation, and added one script tag — planting a watering hole on every government tenant on that platform at once, in a single campaign that spanned more than 15 tenants (Symantec, 2026-08-13). Symantec infers the tag sat in the shared template rather than being delivered per user because the hook fired on the login page and on every mailbox view. The group also hooked the hosting provider's own administrators to harvest the credentials that granted that write access, which closes the loop: the platform operator's identity was the key to every tenant behind it.

The chain that follows is short and entirely conventional in its parts, which is what makes it worth mapping. When a ministry staff member logged in, the injected script opened a WebSocket to command-and-control, completed a handshake and reported in; a cookie module exfiltrated the page's cookies, and a labelling module read the username straight out of the webmail interface and tagged the new victim with their government email address. Only then did the operators push a lure module, which checked that the address ended in one of nine targeted government domains, that the account was not already compromised, and that the host was Windows, before overlaying a fake Adobe Flash update prompt (Symantec, 2026-08-13). That server-side qualification step is a defensive problem in itself — the malicious behaviour a visiting analyst or a sandbox sees is a cookie read and a WebSocket, because the payload stage never fires for a visitor who fails the filter.

Clicking the prompt downloaded the Antino backdoor, delivered as a fake Adobe Flash or Adobe installer and using the Microsoft Graph API as its command-and-control channel so its traffic sits inside legitimate Microsoft cloud services. Antino also side-loaded the "PDF Viewer" extension into the victim's browser profile, dropped a native-messaging helper and wrote the registry value that enabled it (Symantec, 2026-08-13). The extension is the group's primary implant and requested, in Symantec's words, effectively every dangerous permission the browser exposes — cookies, scripting, debugger access, web-request interception, download monitoring and native messaging across all sites. A background service worker gave the operator a full bridge into the browser API: any Chrome or Firefox function invocable by name, arbitrary JavaScript injected into any page, credentials harvested by hooking login forms, the full cookie jar exfiltrated, live cookie-change events subscribed to so new session tokens are stolen in near real time, plus history, bookmarks, screenshots, clipboard and intercepted traffic. A clipboard module able to swap a copied cryptocurrency address for the attacker's was present and active on victims, but Symantec records that no address-replacement rules were deployed, so the swap was not used during the observed period.

The sandbox escape is the part defenders should take away. To reach the host, the extension talked to a Windows helper registered as a native-messaging host under the misleading name com.microsoft.runedge, which ran operator commands through the Windows command interpreter and returned output to the panel; Antino wrote the enabling registry value under the current user's own hive (Symantec, 2026-08-13). Native messaging is a documented, legitimate browser feature — it is how password managers and document tools talk to their desktop components — and that is precisely why it works here. For at least one victim the bridge carried authenticated traffic to an internal virtualisation-management interface, so browser access became reach into the network behind it.

The group's toolset extends past the browser. Symantec counts 37 builds of a Rust implant the developers call ClientKing, reaching servers and network devices rather than browsers, supporting five command-and-control transports including a custom DNS tunnel, and offering an interactive shell, SOCKS pivoting and the ability to load kernel modules directly from memory; a companion toolkit adds a kernel-module rootkit and a malicious authentication module hooked into su and sudo to steal credentials, across x86-64 servers, ARM64 devices and consumer routers (Symantec, 2026-08-13). For payload delivery the backend created public Google Documents, wrote an obfuscated payload into the body and had implants fetch and execute it, which resolves to Google-owned infrastructure that reputation filtering is unlikely to block, and the group disguised its command-and-control hostnames as typosquats of common web resources such as font services. A scheduled job checked the group's own domains against a public multi-scanner every twelve hours so operators could rotate away from anything flagged.

Scale, in the group's own bookkeeping: the victim database holds more than one million implant check-in rows, more than 580,000 stolen browser cookies, several thousand captured credentials and more than 2,300 exfiltrated email bodies (Symantec, 2026-08-13). Symantec also notes builds configured to beacon through the internal corporate proxy of a major US aerospace and industrial manufacturer, so the tooling is not confined to government estates.

Triage: a native-messaging host registered under HKCU\SOFTWARE\<browser>\NativeMessagingHosts\<reverse-domain-name> is normal on its own — legitimate password managers, document viewers and enterprise agents use this exact mechanism. Three discriminators separate this from that baseline, and they derive from the mechanics the source describes rather than from any indicator: a host name asserting a Microsoft identity while being written per-user under HKCU by a downloaded executable, where a genuine Microsoft browser component arrives through a signed machine-wide installer; the command interpreter appearing with a native-messaging host executable as its parent, a process-lineage pair that legitimate browser-helper traffic does not produce; and an extension whose manifest requests native messaging together with debugger access, web-request interception and all-sites cookie access, a permission combination a document reader has no use for. The extension side-loads into the browser profile rather than arriving from a store, so an extension inventory built only from store IDs will not see it.

Builds on: 2026-05-04/uat-8302-china-nexus-talos-se-european-government-victims