2 verified findings from 1 run · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01Akira reboots a SonicWall-VPN victim into Safe Mode to strip EDR — and starves its own encryptor. Huntress documents the first Akira intrusion it has observed using a Safe Mode with Networking reboot to take endpoint defences offline. After a credential spray resolved into a successful login on a SonicWall SSL VPN with no multi-factor authentication, the operator wrote its own AnyDesk service into the Safe Mode service allow-list, forced a reboot through msconfig, and worked from 06:29 UTC until 08:10 UTC on a host where neither the EDR agent nor Microsoft Defender real-time protection could start. The encryptor then failed — Safe Mode's constrained virtual memory starved the process tree — but Active Directory dumps and archived file shares had already left, so the intrusion stayed extortion-viable, and Huntress is explicit that the failure was the attacker's own memory-budget mistake rather than a defence to rely on. →
02Espionage implants run command-and-control through the Google Sheets API and persist by rewriting browser shortcuts. Acronis Threat Research Unit documents three previously undocumented implants sharing one operator's infrastructure against Afghan telecom providers and South Asian critical infrastructure: PATCHCORD, a C/C++ backdoor delivered by fake Afghan Telecom VPN and ministry installers, SHEETCORD, a Go implant whose command-and-control runs entirely through the Google Sheets API v4 using a hardcoded cloud service account and a per-victim spreadsheet tab, and HACKERAI C2 Agent, which does the same job through GitHub Gists. All three persist by hijacking browser shortcuts so the implant launches first and then starts the real browser, and PATCHCORD executes operator-supplied shellcode entirely in memory. The targeting is South Asian, but the tradecraft is not: two of the three channels terminate on Google- and GitHub-owned endpoints that most egress policy treats as benign. →
An Akira affiliate took a compromised Windows host into Safe Mode with Networking to strip its endpoint defences, which Huntress reports is the first time it has observed this operator using the technique — Snatch and AvosLocker have abused Safe Mode for years, but not Akira (Huntress, 2026-08-12). Everything around that step is the operator's familiar chain. From roughly 03:45 UTC on 4 August the SonicWall logged a burst of failed logins against multiple usernames from several external addresses, and about seven minutes later one succeeded against an SSL VPN with no multi-factor authentication in front of it; nearly two hours passed before any hands-on-keyboard activity (Huntress, 2026-08-12). The operator then reached the domain controller over RDP, spawned an elevated command shell, and ran full-property Get-ADUser and Get-ADComputer exports to files under C:\ProgramData — prefixed with $formatenumerationlimit = -1 so PowerShell's default four-item truncation would not clip multi-valued attributes such as group membership. Collection followed on an application server: WinRAR was installed mid-intrusion and used to recursively archive mapped file shares with the same flag string Huntress has documented in earlier SonicWall-entry Akira cases, and the archives went out to cloud object storage.
The evasion itself is three cheap steps. AnyDesk was installed as a service to carry both hands-on control and payload delivery; because third-party services do not start in Safe Mode — including the attacker's own — the operator first wrote that service into the Safe Mode allow-list with a single reg.exe add against HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network, then ran msconfig.exe at 06:29:21 UTC and forced the reboot. The host came back with Kernel-Boot event 27 recording a SAFEBOOT:NETWORK load option and Kernel-General event 12 recording BootMode = 2. Windows Defender logged event 3002 seconds into the boot, and Huntress states plainly that "For the entire Safe Mode window, the host had no working EDR, and AV was blinded" (Huntress, 2026-08-12).
What the operator did not anticipate is that the same stripped-down environment starved the ransomware. The encryptor launched at 06:34:29 UTC, and within about two minutes the host logged System event 26 for virtual-memory exhaustion and a cascade of PowerShell stack failures; it never encrypted. A scheduled Defender scan identified the binary at 07:43:50 UTC but its cleanup routine failed repeatedly because real-time protection was down, and quarantine only succeeded at 08:12:28 UTC — after the attacker rebooted back to normal operation at 08:10:38 UTC and thereby restored the very protection they had removed (Huntress, 2026-08-12). Huntress calls that "a lucky side effect of the attacker's own mistake in these circumstances, not a defence you can plan around", and notes that a host with more memory or a larger page file, or a retooled encryptor with a lighter footprint, could carry the same play to completion (Huntress, 2026-08-12).
Triage: Safe Mode with Networking is a legitimate diagnostic boot mode, so a lone Safe Mode boot is not the signal and IT-driven troubleshooting will generate them. The discriminators are what surrounds it: a SafeBoot Minimal or Network registry write naming a remote-access tool rather than a core Windows driver, a boot-configuration change made from an interactive session that traces back to an external VPN logon minutes earlier, and third-party security services stopping without a corresponding maintenance window. A genuine support-driven Safe Mode boot carries none of those, and the registry write in particular has no benign reason to name a remote-support binary.
Ransomware families like Snatch and AvosLocker have abused Safe Mode for years, but this is the first reported tie to Akira that Huntress has observed.
For the entire Safe Mode window, the host had no working EDR, and AV was blinded.
Alert on boot-configuration changes and Safe Mode boots: msconfig.exe / bcdedit activity, Kernel-Boot EID 27 with a SAFEBOOT load option, Kernel-General EID 12 BootMode=2, and third-party security services stopping (System EID 7036).
That's a lucky side effect of the attacker's own mistake in these circumstances, not a defence you can plan around.
Acronis Threat Research Unit has published an analysis of three previously undocumented implants that share one operator's infrastructure and one design idea: put the command-and-control channel somewhere the network already trusts (Acronis TRU, 2026-08-13). The named targeting is Afghan telecom providers and South Asian government, defence and energy organisations, reached through sector-specific lures — Inno Setup installers impersonating an Afghan Telecom service-management tool and VPN client, an archive themed on a second Afghan operator, and an installer and decoy document themed on Afghanistan's Ministry of Communications and Information Technology.
PATCHCORD, the C/C++ implant, is the baseline. It hides its console window, establishes persistence, fingerprints the host and enters a polling loop against a hardcoded server. Its persistence is the part worth reading twice: it enumerates .lnk files across five locations including the taskbar, Quick Launch, Start Menu and both desktop folders, resolves each shortcut's real target through the IShellLinkW and IPersistFile COM interfaces to confirm it points at a genuine Microsoft Edge, Google Chrome or Mozilla Firefox binary, backs the original up, then rewrites the shortcut to launch the implant with the real browser path passed as an argument — preserving the original icon so nothing looks changed. Clicking the browser runs the implant first, which then silently starts the real browser so the user notices nothing. Its most consequential command decodes and decrypts an operator-supplied payload, allocates memory with VirtualAlloc, flips it to PAGE_EXECUTE_READ with VirtualProtect and runs it via CreateThread; Acronis notes that "the shellcode itself is never written to disk, making this a fully in-memory execution chain that leaves minimal forensic artifacts on the victim's machine" (Acronis TRU, 2026-08-13).
SHEETCORD is the Go successor and the reason this cluster matters outside its own region. Rather than calling a server the operator has to keep alive, it authenticates to the Google Sheets API v4 with a hardcoded cloud service-account credential embedded in the binary and creates a per-victim tab in the operator's spreadsheet for two-way tasking and results — a design Acronis says is "consistent with the documented SHEETCREEP implant" it references from prior research (Acronis TRU, 2026-08-13). It also diverges from PATCHCORD in ways that matter for detection: it runs commands through powershell -Command with script-block wrapping instead of cmd.exe /c, collects markedly less host information, widens the shortcut hijack from three browsers to six by adding Brave, Opera and Vivaldi, and generates a temporary VBScript to rewrite those shortcuts rather than using COM. It adds a persistence layer PATCHCORD lacks — a VBScript dropped into the user's Startup folder that launches the implant with a hidden window at every logon, plus a matching HKCU Run key written by shelling out to reg.exe. The third family, HACKERAI C2 Agent, was distributed from the cluster's earliest domain and shares the fingerprinting, remote-execution and shortcut-hijacking behaviour, but moves its tasking and exfiltration into GitHub Gists — a third distinct channel across one operator's toolset (Acronis TRU, 2026-08-13).
A different PATCHCORD variant appears in what Acronis calls an earlier campaign, observed in March 2026 against India's energy sector behind a fuel-conservation-client lure, and it carries an anti-analysis suite the Afghan-telecom sample does not: checks for VirtualBox and VMware device handles, a floor on processor count and installed memory, both IsDebuggerPresent and the PEB debug flag, a scan of active TCP connections for ports associated with intercepting proxies, a process-name check against a hardcoded list of analysis tools, and cursor-movement monitoring — falling into a randomised 30-to-90-second sleep when any check fires, which Acronis describes as designed to exhaust sandbox timeouts without the process termination that would itself be suspicious. On attribution Acronis is careful, and this entry keeps its wording: it "assesses with moderate confidence that the activity overlaps with the broader APT36 (Transparent Tribe) cluster or a closely related Pakistan-linked threat actor", resting on sustained Afghan telecom and government targeting, a browser-credential harvesting tool previously seen in APT36 operations, a C2 framework independently documented as part of that group's toolkit, and the Google Sheets channel's resemblance to earlier work attributed at medium confidence to the same cluster (Acronis TRU, 2026-08-13). Where an infrastructure fingerprint matched tooling previously attributed to a different, China-nexus operation, Acronis states that "these observations alone are insufficient to support an attribution" and does not carry the link forward (Acronis TRU, 2026-08-13).
Triage: browser shortcuts are legitimately rewritten by installers, enterprise deployment tooling and the browsers' own updaters, so a changed .lnk is not the signal on its own. The discriminator the mechanism supplies is that a hijacked shortcut points at a non-browser executable while carrying the real browser path as an argument and keeping the original icon, and that a .backup copy of the original sits next to it — an updater rewrites the target in place and leaves neither. Likewise, scripted Google Sheets access is ordinary in an organisation that automates reporting; what is not ordinary is a workstation or server authenticating to the Sheets API with a service-account credential that does not belong to any provisioned integration.
TRU assesses with moderate confidence that the activity overlaps with the broader APT36 (Transparent Tribe) cluster or a closely related Pakistan-linked threat actor based on targeting, malware similarities, infrastructure and operational tradecraft.
The SHEETCORD implant uses the Google Sheets API v4 with a hardcoded GCP service account for authentication and creates per-victim tabs in the operator's spreadsheet for bidirectional communication, all of which are consistent with the documented SHEETCREEP implant.
the shellcode itself is never written to disk, making this a fully in-memory execution chain that leaves minimal forensic artifacts on the victim's machine.
these observations alone are insufficient to support an attribution
Sweep Windows event logs across servers and workstations for Kernel-Boot EID 27 carrying a SAFEBOOT load option and Kernel-General EID 12 with BootMode=2, and for writes under HKLM\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal or \\Network that name a remote-access tool rather than a core OS driver; treat any hit with no change-ticket behind it as a live intrusion, because in Safe Mode the endpoint agent that would normally have told you was not running.
2026-08-17T0413Z-intel· Opus 5 · window 24 h · 2 entries published
Verification & coverage notes
A genuinely quiet window. Two of the four research passes returned nothing at all: the vulnerability and national-CERT surface carried no in-window disclosure that was not already published here, and the Swiss and European home-region sweep found no new incident, advisory or regulator action in the last 24 hours. The two entries this run publishes both come from the coverage backlog — verified items an earlier fire surfaced but could not publish — and both were re-researched and re-read from their primaries before composition rather than carried over on the earlier fire's word.
Both are recency-exempt backlog rows, which is why entries dated today rest on sources published on 12 and 13 August: the reason they were unpublished is a pipeline race, not staleness, and each carries its own event date so the reader is not misled about freshness.
Coverage backlog: two rows published, three struck, two left open. Published — the Safe Mode ransomware case as 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn, and the Google Sheets command-and-control cluster as 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack. Struck — the ransomware-as-a-service brand row, on relevance after re-reading its primary (claimed victims are concentrated in the United States and Turkey in dental practices, technology and financial services, with no home-region, coverage-focus or profiled-sector nexus; its named tradecraft is ground this store already holds, and its residual insight is an analytic caveat the store's own campaign coverage already carries). The other two struck rows were struck per their own instructions — the operational-technology edge-gateway framing belongs to the weekly's strategic lens with both component vulnerabilities already published, and the browser trust-bridge class row's only concrete step is already published in the 2026-08-16 browser-extension entry.
Backlog rows still open: the AI-generated-patch study, still marginal on today's facts and inside its own thirty-day window; and the UK critical-infrastructure infostealer report, retried this run without success — the reporting outlet refuses every transport, the reader proxy is still credit-exhausted, and the vendor's own site carries no matching publication, so the victim count and sector breakdown remain unverifiable. It is not published on headline-level specifics.
borderline-drop: French software-as-a-service enterprise-resource-planning vendor cascading extortion campaign — the regional nexus is real but there is no public-sector, government or critical-infrastructure victim, and none of the four out-of-nexus limbs is met: the scale is one vendor's customer base rather than global significance; the mechanism is a vendor-side authorization defect exposed while an old and a new version of a customer portal ran in parallel during a migration, which is a product defect rather than new or materially evolved attacker tradecraft; the extortion handles have no reported targeting of European government or critical infrastructure; and there is no shared imminent exposure. A responder here has no product to patch, no telemetry to hunt and no decision to change. Sourcing is also two lower-reliability breach trackers quoting the vendor's own statement.
Both published entries carry single-source rather than multi-source. Each rests on one assessor — an incident-response team and a malware-analysis lab respectively — with two further publishers reporting that same research rather than observing independently. The credibility number is set to 2 for the same reason: extra publishers do not corroborate an assessment, only republish it.
Deep dive: none. No candidate reached active in-the-wild exploitation with exposure for this constituency. The strongest candidate clears only the substantive-new-analysis criterion, and its category was used on 2026-08-11, inside the seven-day rotation window, which demotes it a rank and below the bar. Depth was not manufactured to fill an open slot.
Two corrections applied during the deep read of the malware-cluster primary, both against the surfacing pass's own summary: the first implant hijacks three browsers through component-object-model interfaces and runs commands through the Windows command interpreter, while the second widens the hijack to six browsers using a generated script and runs commands through PowerShell — the surfacing summary had transposed these. The deep read also recovered a third implant the backlog row did not name, which moves the same tasking into a developer code-sharing service, giving the cluster three distinct command-and-control channels rather than two.
Attribution is carried at the level the discovering lab states: a moderate-confidence overlap with a named espionage cluster or a closely related actor, recorded as an overlap edge in the entity registry rather than an attribution. A separate infrastructure fingerprint the lab explicitly declines to treat as an attribution link is reported as such and creates no edge.
The reader proxy was credit-exhausted for the third consecutive fire, with all seven configured keys returning a balance error and the anonymous tier refused. This is now the dominant coverage constraint: it is the last rung of the documented fetch ladder, and four sources were lost outright because their recipes depend on it. Both primaries this run publishes were reached through the generic bridge transport instead. This needs operator attention — no run-side recipe change can substitute for the missing credit.
The ransomware entry shares its actor key with three earlier in-window entries — a review of a ransom payment at a defence-industry subsidiary, a catalogue of shell command obfuscation on virtualisation hosts, and a quarterly ransomware report. The non-update decision is deliberate and confirmed here: none of the three describes this intrusion, this initial-access route or this evasion step, so a delta note would have had nothing to be a delta on. The shared key is co-occurrence, which the site derives at render time; it is not duplicated coverage.
Verification ran three iterations across both models and ended on a confirmed clean result — two consecutive clean verdicts from two different models. The first iteration caught two real defects in the espionage entry, both in the same direction of carelessness about what a source actually says: a citation dated two days off its own publication stamp, and a sentence that inverted the chronology of two campaigns, which would have told a reader the operator's newer samples carry an anti-analysis suite the lab in fact places in the older one. Both were corrected against the saved captures, and the inverted wording was corrected in the entity registry in the same edit. The remaining fixes were a missing technique id for a behaviour the body already described, a sentence saying victims where the source says targeting and names no compromised organisation, and a graph edge connecting an existing campaign record to the actor key registered this run.
Source-health sweep: 185 sources probed, three flagged for repair, none demoted. Two were probe artefacts — the Swiss national authority's focus page and a Swiss trade-press site both returned full content to a serial re-probe or to a research pass in the same run, through the transport already recorded on each. The third is the Spanish national CERT, whose every direct transport returned an empty body and whose working transport is the credit-exhausted reader; that is a quota condition, which never demotes. Eight further sources were classed reader-quota by the sweep, the same root cause.
Essential-coverage: missed=cisa-advisories (direct refusal, reader pool exhausted), cisa-directives (same condition, third consecutive run).
Coverage gaps: cisa-advisories, cisa-directives, cisa-news, siemens-productcert-csaf (all direct refusal with the reader fallback exhausted); ccb-belgium (recipe pinned to the exhausted reader); venarix (client-rendered listing, feed path 404); swisspost-cybersecurity (listing renders to a video asset with no dated articles); group-ib, nozomi-networks, claroty-team82 (listing pages returned content but carry no per-item publication dates, so recency could not be established — a recipe gap, not a transport failure); google-tag (landing page resolves to the general vendor security blog, a known recipe gap); ec-digital-strategy-newsroom (the direct transport succeeded this run, contradicting its reader-only pin, but the listing carries no per-item dates).