Sunday, 23 August 2026

Three Russia-nexus espionage clusters compromise European diplomats and academics without malware — by talking targets through app passwords, device-code approvals and WhatsApp device-linking, all of which are legitimate features working as designed

Google Threat Intelligence Group published research on 2026-08-20 covering three suspected Russia-nexus espionage clusters that share a method rather than infrastructure: they compromise accounts by driving legitimate authentication features, not by delivering malware (Google Threat Intelligence Group, 2026-08-20). The reported target set puts this constituency inside the blast radius directly — "individuals working in academia, aerospace and defense, governments and think tanks across Europe", alongside US academia and think tanks. GTIG assesses with high confidence that all three possess a Russian nexus, and with moderate confidence that two of them are sub-clusters of the actor it tracks as ICE RELIC — the cluster more widely known as Midnight Blizzard — handling initial access.

Application passwords (UNC6293). An application-specific password is an account-level passcode issued so that a legacy client can authenticate without going through the second factor. The cluster sends a diplomatic or conference-themed lure — a PDF containing screenshots that walk the target through creating a password under a specific, official-looking name and sharing it back. Nothing is exploited and no code runs; the victim performs the whole operation, and the resulting credential is designed not to prompt for a second factor. Campaigns are deliberately small, typically fewer than five targets at a time. By mid-2026 the cluster had added a variation asking targets to share a verification code or post-login URL after authenticating legitimately to an external provider.

Device codes and WhatsApp linking (UNC7005, tracked here as Storm-2945, the cluster behind the CaptiveCrunch hospitality-WiFi captive-portal activity). The device-code flow exists so that input-constrained devices can authenticate: one device shows a short code, the user approves it on another. Phished, it becomes a way to have the victim authorise the attacker's session. This cluster delivers those prompts through emailed links to domains impersonating real conferences — GTIG documents a spoof of a European security forum reusing a template from an earlier embassy-invitation operation — and the pages fingerprint the browser with client-side JavaScript to detect automated scanners and headless browsers, withholding the code entirely until the visitor looks like a real person. That last detail matters operationally: a security team detonating the link in a sandbox may see a benign page.

The WhatsApp technique is the same idea applied to a messaging platform. The page asks for the target's phone number, the attacker's backend uses it to generate a genuine device-linking request, and the resulting code is displayed to the victim with instructions to approve it — linking the attacker's device to the victim's account through the vendor's own supported mechanism. The page then offers a voice call, encrypted chat or file share; if the victim joins the call, browser JavaScript captures microphone and camera through the standard media-capture interface and uploads the recording while the call is presented as having failed.

OAuth token harvesting (UNC5976). Assessed as operationally distinct from the other two, this cluster buys file-sharing-themed domains, creates a cloud project for each, and serves a fake file-share login. A target choosing to continue with their existing identity provider is sent through a genuine consent flow and then redirected to the attacker's own cloud-project URL, where a script captures the resulting token. GTIG disrupted the operation by disabling the malicious cloud projects; the cluster stood up at least twelve new domains within roughly three months and began moving hosting elsewhere. It has separately distributed a malicious spreadsheet plugin GTIG names HEADRUSH, observed in April 2026 and leading to an HTML Application downloader — a scripted payload executed through the built-in Windows host binary rather than as a conventional executable — delivered through a domain impersonating a Ukrainian research institute.

Detection concepts, telemetry class first. The unifying property is that none of this produces endpoint malware telemetry on the way in — the compromise completes in the identity plane, so that is where it must be caught. In identity and sign-in telemetry: creation of an application-specific password, which for most organisations should be a rare or extinct event and is trivially alertable; completion of a device-code authorisation, particularly where the approving session and the resulting access originate from different networks or geographies; and new OAuth consent grants to applications outside an approved inventory. In mail and web telemetry, conference-themed invitations linking to newly registered lookalike domains are the delivery pattern, though the browser fingerprinting means automated detonation may return a clean verdict — treat a link that renders differently for a sandbox than for a user as suspicious in itself rather than as a false positive. On the messaging side, the observable is the account's own linked-device list, which is user-visible and rarely inspected.

A hijacked crates.io account added the first dependency arrayref has taken in ten years, and that dependency ran a backdoor at compile time — every machine that built an affected project during a ninety-minute window must be treated as compromised

The mechanism here is the whole story, and it is one Rust shares with every ecosystem that lets packages run code at install or build time. Build scripts execute during compilation, ahead of the parent crate's own code, so there is no "use the library carefully" defence: compiling was execution.

On 2026-08-20 an attacker with a compromised crates.io publisher account pushed malicious releases of three widely used crates. Wiz's summary: "On August 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. The malicious crates added a typosquatted dependency (proc-macro1) whose build script downloads and executes a remote binary. Notably, proc-macro1 was the first dependency added to arrayref in its ten-year history" (Wiz Research, 2026-08-20). That last clause is the tell that this was an account takeover rather than a maintainer turning hostile — a crate that has taken no dependency in a decade suddenly taking one, and taking one whose name is a single character away from the ubiquitous proc-macro2. The Rust Security Response Team reached the same conclusion: "We do not believe the author of arrayref to be acting maliciously" (The Rust Project, 2026-08-20), and credits discovery to the research team at Nextron Systems.

The exposure windows were short and are published per crate — "arrayref@0.3.10: published at 2026-08-20T07:15:00Z, deleted at 2026-08-20T08:41:40Z. Online for 86 minutes." — with internment online 90 minutes and append-only-vec 107 minutes, the three publications staggered across about 23 minutes rather than landing together. The team also removed the typosquat dependency and five further attacker-controlled crates, and locked the publisher account.

What ran. The build script reconstructs its command-and-control URL from encoded fragments, disables certificate validation for its own callback, and pulls a platform-specific second stage for 64-bit Linux, Windows and macOS including Apple silicon. The implant beacons over HTTPS, collects host and user details, enumerates installed applications, and queries the SQLite stores Chrome, Brave and Edge use for saved logins. That last point deserves precision, because Wiz corrected itself on it: "Edit: A prior version of this piece mistakenly stated that browser credentials were stolen. The queries only enumerate saved logins, they do not retrieve the encrypted credential material." Enumeration of which sites a developer has credentials for is materially different from taking the credentials, and this entry follows the corrected claim. Persistence is a registry run key on Windows, a launch agent on macOS or a user-scoped systemd service on Linux, and the command set covers reconfiguring the channel, running scripts synchronously or in the background, and terminating. Its resilience feature is worth noting for hunting: "Falls back to a Domain Generation Algorithm if the primary C2 is unreachable, generating 10 algorithmic .com domains every 5 days. Currently, the relevant domains do not appear to be registered." Unregistered today means the sinkhole opportunity is open and the blocking opportunity is not.

Attribution, per claiming vendor. Wiz states "The arrayref infrastructure substantially overlaps with operations attributed to recent North Korean actors", resting it on a beacon endpoint previously seen in the Mastra npm campaign, a shared TLS certificate issuer with Mastra infrastructure, a victim-reported address appearing in Google's analysis of the axios npm compromise, and both campaigns sitting in one hosting provider's address range. The attributions themselves belong to other vendors and should be carried as theirs: Microsoft says of Mastra that "Microsoft assesses with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector" (Microsoft Security Blog, 2026-06-17), while Google Threat Intelligence Group attributes the axios compromise to UNC1069 (Google Threat Intelligence Group, 2026-03-31). Those two designations resolve to the same cluster this store already tracks, so the overlap is with one actor seen twice rather than two whose relationship is itself unproven — which strengthens the read. Wiz's contribution is the infrastructure linkage, not the attribution.

Scope. Wiz puts arrayref's reach at "over 35% of all environments" and "used in ¾ of all environments where Rust is present" — figures worth carrying with the caveat that the article does not say what population it measures, so they are best read as its own scanning estate rather than a universal claim. Either way the crate is a near-ubiquitous transitive dependency, which is what makes a ninety-minute window consequential.

Detection concepts, telemetry class first. The distinctive signal is in build-time process telemetry: a compiler or package-manager process spawning a network client, or a toolchain process executing a freshly downloaded binary out of a temporary directory. Neither has a legitimate counterpart in most builds, and both are cheap to alert on in CI. Correlate with persistence-creation telemetry in the minutes after a build — a new registry run key, launch agent or user systemd unit appearing on a build host is close to definitive. In egress telemetry, build agents reaching hosts that are not package registries or artefact stores is the broader pattern worth baselining, since CI runners generally have a small and enumerable set of legitimate destinations.

SPECTRE unlinks EDR's kernel callbacks one at a time using a two-driver BYOVD toolkit and an offset table for thirteen Windows builds — and its Linux half hides through ftrace rather than the syscall table

Cisco Talos published an analysis on 2026-08-20 of SPECTRE, a cross-platform C backdoor run by a Chinese-speaking intrusion actor it designates UAT-10147, which compromises internet-facing IIS and Linux web servers and monetises them through search-engine fraud (Cisco Talos, 2026-08-20). The Windows build implements 45 commands, the Linux build 29. The interesting half is not the command set but how each variant makes itself unobservable, and both answers are instructive for tooling choices rather than for signature lists.

Blinding the endpoint on Windows. SPECTRE downloads one of two long-known vulnerable drivers from its command-and-control server — MSI's RTCore64.sys (CVE-2019-16098) or Dell's DBUtil_2_3.sys (CVE-2021-21551) — writes it to the temporary directory, installs it as a transient kernel service through the Service Control Manager, and opens a device handle to it. Neither is a new flaw; both are being reused as an arbitrary kernel read/write primitive. With that primitive it locates the kernel image in memory through a documented system-information call, then consults a hardcoded offset table covering thirteen Windows versions to compute where the notification-callback arrays live, and performs targeted writes: "By performing targeted kernel writes, the SPECTRE safely unlinks each registered EDR callback from its doubly-linked list". The three callback classes it removes are process creation, thread creation and image load — the events most endpoint products depend on to see anything happen at all. Talos names the affected class as "kernel-callback-dependent security products such as CrowdStrike Falcon, SentinelOne, Microsoft Defender", alongside other unnamed vendors. The blinding lasts for the remainder of the session, which matters for response scoping: it is not a permanent modification, and a reboot restores callback registration, but everything the implant does after that point produced no callback-derived telemetry.

Execution, privilege and credentials. Talos also documents the implant's injection tradecraft — standard process hollowing, targeting a common Windows service host by default, and an asynchronous-procedure-call injection variant executed early in a target process's lifetime. Escalation is named-pipe impersonation — the implant creates a pipe under a predictable per-thread name and acquires a SYSTEM token from a client that connects to it. Credential access is then deliberately built to avoid the one place defenders watch hardest: with SYSTEM in hand it saves the SAM, SYSTEM and SECURITY registry hives to disk for offline hash extraction, enumerates stored Windows credentials by capturing the output of the built-in credential-manager listing utility — Talos emphasises this happens without any LSASS access — and copies Chrome and Edge login-data and local-state files for offline DPAPI decryption with a named public post-exploitation tool. No process ever opens a handle to LSASS, so a detection strategy anchored on LSASS access sees none of it.

Command-and-control that survives blocking. The C2 configuration is stored in an alternate data stream on the Windows hosts file. Talos's framing of why: "This strategy allows the threat actor to easily update the C2 configuration by modifying the ADS, thereby circumventing firewall blocklists without needing to recompile the binary." The evasion value is specifically against static, hash-keyed and recompile-triggered detection rather than against telemetry that observes stream creation.

The Linux half. Persistence is a systemd unit presenting itself as a hardware performance monitor, and the detail worth carrying is its ordering directive: the unit is configured to start before the system initialisation target, which Talos states ensures the rootkit loads on every boot ahead of any security tooling. The kernel module masquerades as the legitimate ACPI processor power-management module. Hiding is implemented through ftrace with the instruction-pointer-modify flag, redirecting six entry points covering TCP socket enumeration for both IPv4 and IPv6, the three signal-delivery syscalls and directory enumeration. Talos's own explanation of why this choice matters: because ftrace is a legitimate kernel debugging interface, hooking through it produces minimal noise in kernel integrity checks — which is to say it specifically defeats tools that watch the syscall table for patching but do not watch ftrace registration state. Control is exercised by sending signals to a magic process id: one signal unlinks a task structure from the kernel process list so its /proc entry disappears, another unlinks the module itself from the kernel module list so it vanishes from module listings, a third rewrites the calling process's credential structure to grant it root, and a fourth serves as a module-load acknowledgement handshake.

On the AI claim, at the source's own confidence. Talos makes three separate and differently-hedged statements here, and they should not be collapsed. Scoped to the Linux rootkit's source code specifically, it states: "Talos investigated the source code of the Specter rootkit and assesses with medium confidence that UAT-10147 leveraged a combination of AI-assisted development and human expertise in the creation of this rootkit, which is designed to be invoked directly by SPECTRE." It rests that on four observations — an opening comment block that reads like a generated feature list narrating what the code is about to do, decorative separators of machine-like uniformity across more than ten sections, pedagogical inline comments explaining basic kernel concepts a developer would not explain to themselves, and three redundant implementations explicitly labelled as alternative methods where a human targeting one kernel would pick one. That last observation is the most portable: producing every known approach rather than selecting one is a completeness reflex, and it is a heuristic that works independently of this actor. Separately and without a confidence qualifier, Talos assesses the actor is gradually incorporating AI-assisted development more broadly, extending the suggestion to the SPECTRE backdoor itself without the same enumerated evidence. And separately again, build-path strings inside the actor's custom privilege-escalation tools reference an "AI" directory, which Talos describes only as strongly suggesting AI assistance in developing those tools — weaker wording, different tools, and not part of the medium-confidence rootkit assessment.

A Zurich business school tells students their bank details and sick-leave records were stolen — not from its own systems, but through the infrastructure of an IT service provider whose leak-site listing names seven other Swiss customers alongside it, and does not close the list

HWZ Hochschule für Wirtschaft Zürich, a Zurich university of applied sciences business school, wrote to its students and alumni to confirm that an analysis of stolen data had identified personal information belonging to them — names, addresses and phone numbers, records from student administration, bank details, and data from sick-leave notifications (Inside Paradeplatz, 2026-08-22). On where it came from, the school is specific and, notably, exculpatory of its own estate: "Nach aktuellem Untersuchungsstand erfolgte ein Angriff über die Infrastruktur des Dienstleisters" — according to the current state of the investigation, an attack took place via the service provider's infrastructure — and it states separately that HWZ's own local IT infrastructure was not affected. The school has involved the police and asked recipients not to circulate unconfirmed information.

Two days before that letter was reported, the extortion group Payload listed a Swiss data-centre operator on its leak site, claiming roughly 490 GB of data and naming eight affected customer domains — the school's among them, alongside seven other organisations. The listing gives only domain names; no cited source describes what those other customers do, and this entry does not guess. The timing is consistent with a single underlying event, and the school's own description of a provider-side compromise matches the shape of the listing. But the connection is not independently established: no source other than the leak-site listing itself links that named provider to HWZ. The school names no provider. Neither outlet covering the story names one through its own reporting. This entry therefore does not name the company either — naming a firm as breached on the unverified assertion of the group extorting it is exactly the failure mode this pipeline's sourcing rules exist to prevent, and a different provider name circulating in the primary's reader comments is speculation with no sourcing at all.

What is established is the structure, and it is the reason a Swiss federal SOC should care about a business school's mailing list. One managed-IT or hosting compromise produced simultaneous personal-data exposure at several independent organisations that had no intrusion of their own, no security failure of their own to remediate, and — in HWZ's case — no ability to tell affected people anything until the provider's investigation reached them. The named customer set is seven organisations plus one higher-education institution — and the listing ends that enumeration with "etc.", so eight is a floor rather than the full extent. That is the ordinary shape of a regional IT provider's book of business, and therefore the ordinary shape of this blast radius: the organisations that know they are affected are the ones the attacker chose to name.

A Valais commune's secretariat mailbox was compromised on 10 August and sat quiet until the attacker used it on 18 August to mail roughly 450 of the commune's own contacts — the send is what triggered detection

The commune of Martigny-Combe, in the Bas-Valais, disclosed on 2026-08-20 that the professional mailbox of its municipal secretariat had been accessed without authorisation. Its own communiqué is brief and gives a detection date — "L'incident a été détecté le 18 août 2026" — the mailbox was blocked immediately, external specialists were engaged, the federal cybersecurity office and the Valais cantonal data protection and transparency commissioner were notified, and a criminal complaint with the Valais cantonal police was recorded as in progress rather than filed (Commune de Martigny-Combe, 2026-08-20).

The part that makes this worth a defender's time is in Le Nouvelliste's reporting rather than the communiqué, and it is attributed to the commune's own external IT-security contractor: "L'entreprise externe gérant la sécurité informatique de la commune a pu identifier que le piratage remontait au 10 août. Une personne avait alors ouvert un mail contaminé reçu sur la messagerie du secrétariat communal, sans s'en rendre compte" — the external firm managing the commune's IT security established that the compromise dated back to 10 August, when someone opened a contaminated email received on the communal secretariat's mailbox without realising it (Le Nouvelliste, 2026-08-20).

That gives the incident a shape worth naming: eight days of access that produced no detectable signal, ended by the attacker's own outbound activity. On 18 August the mailbox was used to send a fraudulent message to roughly 450 people — the commune's own correspondents, receiving mail from a genuine communal address — and it is that send, not any monitoring control, that surfaced the intrusion. The commune president is quoted on the record saying that to the commune's knowledge two recipients had clicked the fraudulent link at the time of reporting. Around 300 emails and their attachments were taken from the mailbox, which he characterises as confidential and in places containing sensitive data; that figure is the newspaper's own count, and the commune's communiqué gives none. The commune says it will maintain a year-long watch for the stolen data appearing online.

CVE-2026-72529 and CVE-2026-72530 — a pre-auth chain on TrueConf Server's port 4307 reaches SYSTEM, and the operators use it to replace the client installer the server hands to everyone who joins a meeting

CISA added both halves of this chain to its Known Exploited Vulnerabilities catalogue on 2026-08-20, and ENISA's EU Vulnerability Database independently records each as exploited since the same date. The chain is entirely pre-authentication and sits behind one port. CVE-2026-72529 is a missing-authentication flaw: "An unauthorized attacker can connect to TrueConf server versions 5.3.X before 5.3.9, 5.4.X before 5.4.9, 5.5.X before 5.5.5, as well as earlier versions (our internal analysis showed that all TrueConf server versions released since 2022 are vulnerable) via port 4307/TCP (open by default, according to TrueConf documentation) and execute a malicious script on the server by calling an undocumented function" (Kaspersky ICS CERT, 2026-08-12). That parenthesis matters more than the version list around it: the vendor-stated affected ranges understate the real exposure, so an older build outside the published ranges is not safe by omission.

The script lands inside a sandbox that deliberately withholds the dangerous standard libraries, which is where CVE-2026-72530 comes in — a flaw in the sandbox's own code-generation logic. Kaspersky describes the join: "The uploaded malicious script is executed in an isolated environment, where potentially hazardous libraries (io, os, etc.) are unavailable. However, attackers can exploit another vulnerability (assigned internal Kaspersky identifier KLCERT-26-058) to execute arbitrary code on the server with NT AUTHORITY\SYSTEM privileges" (Kaspersky ICS CERT, 2026-08-12). Both were fixed together on 2026-06-18 in 5.3.9, 5.4.9 and 5.5.5 — roughly two months before the exploitation listing, which is the usual and uncomfortable shape: the patch was available throughout the observed campaign.

What the operators do with it. Kaspersky attributes the activity to Head Mare, and records a classification change worth carrying because it sets expectations about intent: "Previously, we classified them as hacktivists, but now we define them as an APT group due to the sophistication of their TTPs and the absence of destructive activity (encryption, wiping) in the targeted infrastructures" (Kaspersky Securelist, 2026-08-11). With SYSTEM in hand they overwrite a PHP file that sits in the server's public script directory with a web shell — the file's extension is .php even though the directory is named for JavaScript, which matters for anyone building the hunt — and delete the corresponding TrueConf event-log entries, then work from the shell — fingerprinting the environment over PowerShell, reaching the server database with elevated privileges, dumping LSASS memory through the built-in COM services library, and standing up an SSH reverse tunnel (Kaspersky Securelist, 2026-08-11).

Then the step that changes who is exposed: "Most importantly, during the attack, the attackers replace the TrueConf client distribution file located at C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_windows_client_x64.exe" (Kaspersky ICS CERT, 2026-08-12). Meeting participants who accept the resulting update prompt install the genuine client alongside the PhantomCore backdoor, which unpacks into the user's local application-data tree under a filename mimicking a Windows C-runtime component and auto-launches from a registry class registration. Kaspersky notes the replaced installers carried no valid signature — "The malicious distributions we detected did not have a valid digital signature" (Kaspersky Securelist, 2026-08-11) — which is the cheapest available check for anyone who has taken a server-offered client update recently. Kaspersky states the consequence directly: "Even if your organization does not use a TrueConf server, your employees may connect to compromised TrueConf servers of contractors to participate in online meetings and download infected installation packages."

On the server the group also installs PhantomGraph, a two-module Windows-service backdoor Kaspersky describes as a backup channel — the primary control path stays the web shell and remote PowerShell — which, in Kaspersky's words, uses "an account on Microsoft OneDrive cloud storage as their command-and-control (C2) server". Neither cited source says whether that account was compromised or attacker-registered, so this entry does not either. Kaspersky assesses the two service installs were split across separate encoded PowerShell commands deliberately, "to make it harder to detect using EDR tools". On \*nix TrueConf servers the group installs two distinct backdoors: a rootkit that hides its own files and intercepts TrueConf's network functions to receive commands smuggled inside the TrueConf protocol itself, and a separate backdoor that uses GitHub as its command-and-control channel. Kaspersky's detection names for the pair are PhantomHook and PhantomReact; no source states which name belongs to which implant, so this entry does not assert the mapping. Its published artefact list also shows both persisting as systemd units under attacker-chosen service names, which is the \*nix counterpart to the Windows service persistence above.

All observed victims are Russian organisations, in instrument manufacturing, electronics, transportation, energy, IT and software development; no source reports targeting elsewhere. This entry is here for the exposure path rather than the victim list — a European organisation is reachable through the contractor-meeting vector regardless of whose servers the operators are currently choosing.

Detection concepts, telemetry class first. In file-write telemetry on the server, an unexpected write to the public script directory or to the client-installer path outside a vendor-update window is the highest-fidelity signal, and Kaspersky's own published rule names key on exactly those two events plus an unsigned installer. In egress telemetry, a videoconferencing server process making outbound HTTPS calls to a consumer cloud-storage service, or a \*nix TrueConf host calling code-hosting API endpoints, is anomalous for the appliance's role. In endpoint process telemetry, watch for the client installer's process tree loading a library from the user's local TrueConf directory whose name mimics a system component, and for new class registrations under the current user's registry hive. In credential-access telemetry, the COM-services LSASS dump technique and new outbound SSH sessions originating from the server are both worth alerting on.

Three misp-stix flaws put the CTI pipeline itself in scope: a crafted STIX document can set its own MISP distribution and sharing fields, kill a long-running importer, or bleed data into the next event

Three CVEs published on 2026-08-21 against misp-stix — the Python library MISP and other threat-intelligence platforms use to convert between MISP's own format and STIX 1 / STIX 2 — sit in the ingestion path of the intelligence pipeline rather than in an internet-facing service, which is what makes them relevant to a constituency whose national CERTs, ISACs and sector sharing communities run MISP.

The one that changes a trust assumption is CVE-2026-77710 (CVSS 4.0 base 6.9). The import logic chose between the internal-MISP parser and the external-STIX parser using metadata carried in the document itself: MISP-specific tool labels for STIX2, the document title for STIX1. The advisory states plainly that "These classification indicators are fully controlled by the STIX producer and therefore cannot constitute a trusted indication of the document's origin" (MISP Project advisory, 2026-08-21). When a document was accepted as an internal export, attributes inside an x-misp-object were converted by copying the entire x_misp_attributes dictionary straight into add_attribute(), so a crafted bundle could supply fields outside the expected round-trip format — the advisory names distribution, sharing_group_id and tags specifically. The consequence it draws is the one that matters operationally: imported intelligence could be given sharing restrictions or classification the importing organisation never chose, "potentially causing information to be shared contrary to the importing organization's policy", or could carry attacker-chosen tags that downstream automation keys on. The fix introduces an explicit classification parameter so the caller decides, and restricts assignment to an allow-list.

CVE-2026-77755 (8.7) is the availability half. The importer used sys.exit() on several parse and load failures; because SystemExit inherits from BaseException rather than Exception, those failures walked straight past the except Exception handlers a calling application would normally wrap an import in, so "a malformed STIX document could terminate a long-running importer process instead of returning a recoverable parsing error" (MISP Project advisory, 2026-08-21). Separately, no size limit was applied before parsing, and the advisory puts memory use during conversion at roughly two to seven times the input size — so a large crafted document degrades or kills the service during deserialisation. The fixes replace the exits with catchable exceptions and add a size ceiling, defaulting to 100 MB, that callers can adjust or disable.

CVE-2026-77761 (6.3) is narrower and depends on how the library is called. Several STIX1 and STIX2 parser components kept per-document state across a reset — galaxy and galaxy-cluster data, references, passive DNS bookkeeping, package titles, dates and timestamps — so reusing one parser instance across independent documents could produce an event carrying information that was only present in an earlier one. The advisory notes an attacker who can influence what such a long-lived parser processes "could potentially cause information from one conversion to contaminate a subsequent MISP event", and flags that where consecutive documents carry different distribution scopes the retained state can disclose a little of the earlier one (MISP Project advisory, 2026-08-21). Entry points that instantiate a fresh parser per file are not affected.

None of the three is reported as exploited, and each carries an EPSS below 0.4% on its own record — 0.29 for the trust-boundary flaw (ENISA EU Vulnerability Database, 2026-08-21), 0.30 for the denial of service (ENISA EU Vulnerability Database, 2026-08-21) and 0.37 for the state-contamination flaw (ENISA EU Vulnerability Database, 2026-08-21). The reason they still warrant attention is the remediation state: the last affected version is 2026.7.8 and no tagged release yet carries any of the fixes — remediation today means applying individual commits.

CVE-2026-69836 — Microsoft corrected its own Entra ID CVSS 10.0 record from exploited to not-exploited within a day, and ENISA's exploited feed still says otherwise two days later

Microsoft published CVE-2026-69836 on 2026-08-20 as a deserialization-of-untrusted-data flaw (CWE-502) in Entra ID, rated CVSS 3.1 base 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C and described in a single sentence: "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network" (Microsoft Security Response Center, 2026-08-21). No mechanism, no affected component and no attack path is published beyond that line. This is one of Microsoft's cloud-service CVEs, issued for transparency rather than to drive customer action — its own FAQ states the flaw "has already been fully mitigated by Microsoft. There is no action for users of this service to take", and the record's customerActionRequired field is false (Microsoft Security Response Center, 2026-08-21). There is nothing to patch, nothing to configure, and no version boundary to check.

What makes it worth a defender's attention is the exploitation field, and the fact that two authorities currently give different answers about it. Microsoft's revision history shows the record published at version 1 on 2026-08-20 and revised at version 1.1 the following day with the note "This vulnerability was not exploited in the wild. This is an informational change only" — a correction of the Exploited field (Microsoft Security Response Center, 2026-08-21). The wording only makes sense if the field briefly held some other value during the day the record was live before the correction. The current record is internally consistent with not-exploited: the exploitability assessment reads "Exploitation Less Likely", and the CVSS vector Microsoft itself publishes carries E:U — exploit-code maturity "Unproven".

ENISA's EU Vulnerability Database has not followed. Its record for this CVE (EUVD-2026-63693) was last updated on 2026-08-22, a day after Microsoft's correction, and still carries an exploitedSince value of 2026-08-21 on its exploited-vulnerabilities feed, alongside an EPSS of 1.37 (ENISA EU Vulnerability Database, 2026-08-22). The only reference that record cites is the Microsoft page that now says the opposite. The same feed carries the same field, correctly, for the actively exploited TrueConf Server pair — so the mechanism works; this specific record simply did not get the correction. CISA's Known Exploited Vulnerabilities catalogue does not list the CVE at all, and no research lab or managed-detection vendor has published exploitation telemetry of its own.

An intrusion crew's AI-written playbook records why time-based blind testing fails against ViewState deserialization — and that a successful exploit returns HTTP 500, which is what most error-rate alerting is tuned to ignore

Cisco Talos's companion piece to its SPECTRE implant analysis, published the same day, covers how UAT-10147 works rather than what it deploys, and it is unusually well-evidenced because the actor left an open, browsable directory on a download server holding its own operational material (Cisco Talos, 2026-08-20). That in itself is a reminder worth a sentence: an operator's exposed staging directory remains one of the richest intelligence sources available, and Talos found the campaign by following a compromised host's traffic to it. Talos's assessment is stated at its own confidence level: "Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale."

Scale and target selection. The recovered material includes roughly 170,000 candidate URLs, which the actor had split into seventeen files of about ten thousand each because scanning the whole list at once was inefficient. Initial access is mass exploitation of long-public flaws rather than anything novel: a Zimbra Collaboration Suite flaw Talos labels an unauthenticated remote code execution path (CVE-2022-27925), an AjaxPro deserialization flaw (CVE-2021-23758), a pair of Nacos flaws chaining an authentication bypass into script-engine code execution (CVE-2021-29441 and CVE-2021-29442), and the well-known Telerik UI for ASP.NET AJAX deserialization flaw (CVE-2019-18935). A Linux privilege-escalation set covers Dirty Pipe, Baron Samedit and four older kernel and utility flaws. Every one is years old and patched; the novelty is entirely in the automation wrapped around them.

The finding that transfers. The AI-generated playbook is a nine-section document for ViewState deserialization attacks, and its most defender-relevant passage is a lesson the actor learned the hard way. Talos quotes it directly: "Time-based blind testing (e.g., ping -n 10 or timeout /t 10) is entirely ineffective for confirming ViewState RCE." The reason follows in the next sentence: "Because Process.Start() is asynchronous and returns immediately, no execution delay is observable from the HTTP response." Having established that, the playbook pivots to out-of-band confirmation — HTTP callbacks issued through the certificate utility or PowerShell, and DNS lookups polled against a public webhook service — to establish that code ran.

The second half of that lesson is the one to act on. The playbook records that a successful ViewState exploitation attempt returns an HTTP 500 carrying a cast exception, which proves the signing key was correct and the payload deserialized. Talos states the consequence plainly: "This inverted success condition is a defensive blind spot: network monitoring tools that alert on 5xx responses may generate excessive noise, while the actual exploit succeeds silently in the error stream." Most mature web-monitoring configurations suppress or aggregate 5xx noise precisely because it is noisy; against this technique that suppression removes the successful attempts and leaves the failures.

Post-exploitation. Four AI-generated Python scripts automate baseline write-capability testing, web-root permission enumeration and physical-path discovery through the IIS management utility, implant deployment with post-transfer verification of file presence and size, two-step web-shell staging, and encoded reconnaissance. Privilege escalation uses a renamed potato-family binary staged under an innocuous archive name. The actor then adds both IIS module directories to Defender's exclusion list, redundantly — once through the PowerShell preference cmdlet and once by writing the exclusion paths directly into the registry — before dropping its search-fraud module, creating a rogue local account placed in both the Administrators and Remote Desktop Users groups, and registering a deceptive scheduled task named after a browser start routine, set to run at every logon with highest privileges. Talos names two AI tools installed on the actor's own management server. The first is DeepAudit, a source-code vulnerability-scanning framework, of which it says "Consequently, we assess with high confidence that they intend to use it to identify vulnerabilities within target website source code or third-party package libraries" — a higher confidence than the campaign-level assessment, and worth keeping distinct from it. The second is PentestGPT, an AI-driven penetration-testing tool used to scan web servers and run proof-of-concept exploits. Victims named span government, university, media, technology and gaming organisations in Brazil, Bolivia, China, Canada and Vietnam.

Dead-drop command-and-control went commodity: three of four new entrants on Red Canary's monthly list resolve their C2 from a dead drop, two of them from a public blockchain, and the fourth is a GUI for Entra ID device-code phishing

Red Canary's monthly threat round-up, published 2026-08-20 against July 2026 telemetry, is useful here not for its rankings but for what the new arrivals have in common: three of the four resolve their command-and-control address from a dead drop rather than from a hardcoded domain or IP, and two of those read that dead drop off a public blockchain (Red Canary, 2026-08-20). The technique — querying a smart contract whose stored value is the current C2 URL, which Red Canary calls EtherHiding and dates to first reporting in 2023 — has been documented for a while; what this round-up records is its arrival in commodity tooling — Red Canary counts three of its top ten using it this month, two of them new arrivals.

The mechanics are worth stating precisely because they determine what a defender can and cannot block. Phexia, a macOS remote-access tool and stealer delivered through malicious copy-and-paste lures, queries public Polygon RPC endpoints for a smart contract's value, decodes the ABI-encoded response to extract a URL, posts to it and pipes the reply into osascript; it keeps Telegram and Steam profiles as redundant dead-drop channels and persists with a LaunchAgent that sets both KeepAlive and RunAtLoad. EtherRAT is "a Node.js-based remote access trojan observed targeting Windows workstations via social engineering and Linux servers via exploitation of server-side vulnerabilities", polling one or more public Ethereum RPC endpoints for a C2 URL held at a predefined contract address, with modules for credential theft, lateral movement and web-server hijacking. CastleRAT resolves its dead drop through steamcommunity.com or adversary-controlled domains. Red Canary's own summary of why this matters operationally: "The technique makes traditional C2 blocking challenging, since the URL can be updated dynamically by adversaries" — the operator rewrites one contract value and the change propagates to every installation without redistributing the malware.

The fourth entrant is a different problem. GraphSpy is an open-source initial-access and post-exploitation tool for Entra ID and Microsoft 365 that, in Red Canary's words, "runs a local web server that presents a browser-based GUI, which enables less technical adversaries to engage in Entra ID attacks". It centralises device-code phishing, primary refresh token theft and abuse, Windows Hello for Business key registration, MFA method manipulation, and exfiltration from SharePoint, OneDrive, Outlook and Teams. Red Canary notes it is the third device-code phishing tool to reach its top ten in 2026, after GraphRunner in May and Kali365 in June — three separate toolkits in four months packaging the same identity attack behind progressively lower skill requirements.

Detection concepts, telemetry class first. For the dead-drop families the signal is in egress telemetry: an outbound HTTPS session from an endpoint or server to a public blockchain RPC endpoint, made by a process that has no business speaking to one — the request itself is ordinary-looking JSON-RPC to a widely used, reputable host, so the discriminator is the process and the host role, not the destination's reputation. On macOS, correlate it with process-lineage telemetry showing osascript executing content received from a network read, and with persistence artifacts — a newly written LaunchAgent whose program arguments carry an encoded payload. For GraphSpy the surface is identity telemetry rather than endpoint: device-code authentication events for users and locations that have no workflow requiring that flow, primary refresh token issuance followed by access from an unfamiliar device, and new Windows Hello for Business key or MFA method registration on an account that did not request it. Red Canary's own mitigation for the device-code half is to revoke the affected user's refresh tokens and active sessions, reset credentials, force re-authentication, and restrict the device-code flow through Conditional Access policies "for users and locations that do not require it".

Windows Defender ships its own kernel write primitive: BTR.sys, the signed boot-time remediation driver, takes an encrypted job list from an alternate data stream and will delete or create any file or registry value asked of it

Background. This is not the first time Defender's own remediation driver has drawn scrutiny, and not the first time a legitimate built-in Windows driver has been turned into a kernel-mode weapon against endpoint security. In February 2021 SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a local privilege-escalation flaw in the same BTR.sys file that let an unprivileged user overwrite arbitrary files through a hard link planted at the driver's log path; Microsoft patched it on 2021-02-09, and Dekel's own explanation for why it had gone unnoticed for years is the same property that makes the driver interesting now — it is normally absent from disk entirely, dropped under a random name only when needed and purged afterwards, so routine static scanning never sees it (The Hacker News, 2026-08-21). Separately, FIN7's AvNeutralizer tooling previously demonstrated the same class of move — repurposing genuinely built-in Windows drivers rather than importing a known-vulnerable third-party one — against endpoint security software (The Hacker News, 2026-08-21). What Check Point adds is a fully documented, general-purpose primitive in a component every Windows install carries.

What the driver is. BTR.sys — "Boot Time Removal Tool" — is a genuine Microsoft-signed kernel driver embedded as a PE resource inside MpEngine.dll. Defender extracts it to System32\drivers under a randomised filename, with a matching randomised service name, only when a remediation action cannot complete without a reboot, such as deleting a file held under an exclusive lock. It is a one-shot design: it loads, executes a queued list of transactions, writes a status report, and requests its own unload. Check Point's researcher found it by accident during an incident response, where telemetry that looked like attacker kernel-loader tradecraft — a randomly named driver, a transient service, RC4 routines, alternate-data-stream interaction and self-cleanup — turned out to be this legitimate Defender mechanism (Check Point Research, 2026-08-20). The framing question the research opens with is the whole finding: "What if a signed Microsoft remediation driver could be instructed to execute arbitrary file and registry operations from Ring 0 – without exploits, vulnerabilities, or memory corruption?"

How it takes instructions. The driver exposes no IOCTL interface. At load time it reads the Args value of its own transient service registry key, which points at an NTFS alternate data stream on the driver file itself — the configuration is hidden data attached to the driver's own file object rather than a separate visible file. That stream holds an RC4-encrypted transaction blob. Check Point assembled eighteen unique Microsoft-signed 64-bit builds of the driver — collected from a public Windows-binary index and a malware-sample service, then de-duplicated — and reports that all of them share the same hard-coded 256-byte key, noting "a remarkable consistency in the internal BTR.sys codebase" across that set. That is a best-effort sample collection rather than a census of every build ever shipped, but it spans a long enough range for the reuse to be the point. Integrity uses a modified CRC-32 in which the final inversion step is omitted, applied independently to each of the four structures in the format rather than cumulatively, so tampering with one structure cannot be compensated for in a later one. On completion the driver returns STATUS_DELETE_PENDING rather than success — the code that tells the kernel to unload it immediately and mark its object for deletion, so it does not linger for a live-response kernel-module enumeration to find.

The primitive. The decrypted transaction is a list of items, each carrying a four-byte action ID, and Check Point enumerates six: delete file (kernel-level, bypassing exclusive locks), delete directory, move or quarantine, delete registry key, delete registry value, and set registry value. Two of the six are the ones that matter. Of the move action, Check Point writes: "Weaponization: If Dest Path is empty, this acts as a Delete operation. If Dest Path is valid, this allows Arbitrary File Write/Move (e.g., dropping a malicious DLL into System32)." Of the set-value action: "Weaponization: Can be used to establish persistence (Run keys, Services) or disable security controls (Tamper Protection, EDR configs). Creates not only a value but possibly the registry key path itself." Everything else in the chain is ordinary administrative work.

Why no blocklist helps. The driver carries a real signature, so signature enforcement is simply not engaged — "BTR.sys carries a valid Microsoft signature, meaning it would normally pass signature enforcement, though this does not guarantee permanent trust or classification as \"Known Good\" in all contexts." Adding it to Microsoft's Vulnerable Driver Blocklist or blocking it under WDAC would disable Defender's own boot-time remediation on every Windows install, which is why neither control has been applied. Check Point's own conclusion is blunt: "Recognize that the Microsoft Vulnerable Driver Blocklist (WDAC) does not protect against the abuse of functionally intended drivers like BTR.sys." This is the distinction between bring-your-own-vulnerable-driver and living-off-the-land-driver technique: BYOVD depends on a third-party signed driver that can be blocklisted once identified, whereas here the driver is extracted from the machine's own MpEngine.dll each time, leaving no external binary or hash for a blocklist to key on.

The boot-order window. Check Point found the driver cannot run at SERVICE_BOOT_START, because its entry routine needs file I/O before the Object Manager has established the SystemRoot symbolic link and the storage stack is ready — "empirical testing confirms a hard architectural constraint: BTR.sys cannot function as a SERVICE_BOOT_START (Start=0) driver." Staged instead as SERVICE_SYSTEM_START in the "Boot Bus Extender" load-order group — exactly as MpEngine.dll stages it legitimately — it lands early in the next phase. Check Point's own boot-time trace on a fully patched Windows 11 25H2 puts execution roughly 0.32 seconds after Defender's minifilter loads, about 56 milliseconds before the User Choice Protection driver, and some 34 seconds before the user-mode Defender service starts. In that window the minifilter is present but operating without user-mode intelligence behind it, and the service that would lock and self-protect Defender's own binaries has not started. Check Point's tests in that window deleted the minifilter, the Defender service binary and the network-inspection driver before the service could start, and deleted Defender service registry keys at runtime despite Tamper Protection being active — because Tamper Protection is enforced primarily against user-mode processes, and these operations originate from a signed kernel driver.

Vendor position. Following disclosure, per Check Point's account, "MSRC confirmed that these findings do not meet the criteria for immediate servicing, as the technique relies on pre-existing administrative privileges (SeLoadDriverPrivilege)." No CVE has been assigned. Check Point frames the underlying issue as an architectural trust boundary crossable by an attacker who already holds administrative rights rather than a vulnerability in the traditional sense. A separate claim that no patch is planned comes from the researcher's own tool documentation as relayed by The Hacker News, which notes Microsoft has not confirmed it publicly. A proof-of-concept implementing the full pipeline has been published under an open-source licence; this entry does not link it.

Detection. Check Point's own detection opportunities are behavioural and, unusually, apply to a technique with no in-the-wild use yet — "During our analysis across all collected samples and telemetry sources, we did not observe evidence of real-world abuse of BTR.sys in the manner demonstrated in this research. This suggests the technique is currently unknown or unused by threat actors, making proactive detection engineering feasible before weaponization appears in the wild." Leading with the telemetry class: in file-stream creation telemetry (Sysmon event ID 15), alert on an alternate data stream named :changelist created on a .sys file — Check Point calls this high fidelity, and its stated discriminator between legitimate and abusive use is where the feedback report is written, since Defender's own usage directs it to a standalone file under a protected ProgramData path while the research tool directs it to a second stream on the driver file. In driver-load telemetry (event ID 6), the anchor is lineage: a legitimate load is dropped and registered by the Defender service, so a matching driver loaded by a shell, a script host or an unknown binary is the signal. In registry telemetry (event IDs 12 and 13), a service key whose Args value references a :changelist stream and whose group is "Boot Bus Extender" is notable specifically for what does not accompany it — no service-installation event (Windows event ID 7045), because creating the key directly and loading through the undocumented syscall bypasses the Service Control Manager entirely. In file-deletion telemetry (event ID 23), correlate deletions attributed to the System process immediately following such a driver load, and watch for the rapid creation and deletion of the driver's hardcoded boot-clean log, which fires regardless of caller.