Thursday, 3 September 2026

A Teams helpdesk-impersonation campaign installs a Node.js implant (Microsoft detection name: EtherRatz) via a silent MSI, then pivots over WinRM straight to domain controllers and certificate authorities

Microsoft Threat Intelligence documents a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or helpdesk personnel, pretexts include "Microsoft Security Update," "Spam Filter Update" and "Account Verification," sometimes reinforced with a phone call, and socially engineers the victim into approving a "request control" prompt during a Teams screen-share, or into opening Quick Assist and reading back a connection code (Microsoft Threat Intelligence, 2026-09-02). Once remote control is granted through the legitimate support tool, the operator uses PowerShell inside that same session to silently pull a malicious MSI, disguised with update-themed names and hosted on a widely used cloud-storage platform to blend with legitimate traffic, and installs it via msiexec /qn. The MSI stages a portable Node.js runtime plus a separately encrypted implant file; a deferred MSI custom action launches hidden bootstrap code that decrypts the implant and hands it to Node.js via standard input or a temporary script file, evading controls keyed on unsigned executables or conventional script extensions (Microsoft Threat Intelligence, 2026-09-02). Per-user persistence uses an HKCU Run value or Startup-folder shortcut, both named "EdgeUpdate." The implant polls its command-and-control over randomised HTTPS long-polling and executes returned JavaScript dynamically, performing sandbox and antivirus discovery, periodic screenshot capture, and ADSI-based Active Directory sweeps, enumerating domain-joined servers and harvesting user object and description-attribute content, with randomised sleep jitter to stay quiet. A dormant capability in the analysed implants queries an Ethereum smart contract for an updated command-and-control URL, disabled in the recovered builds, which fall back to a hard-coded server instead (Microsoft Threat Intelligence, 2026-09-02). Microsoft's own Defender detection names for the implant are Trojan:JS/EtherRatz.A!MTB and Trojan:JS/EtherRatz.B!MTB its article does not otherwise name the campaign or the implant. The same detection table names the MSI/loader stage Trojan:JS/SynkLoader.SA and Trojan:Win32/SynkLoader.SA, the family behind a near-identical Teams helpdesk-impersonation chain documented separately on 2026-08-24 (Expel), a detection-level overlap on the loader stage, distinct from the Node.js implant this entry otherwise describes.

The intrusion's most consequential step is lateral movement: operator-issued tasking through the Node.js implant initiates internal WinRM connections on TCP 5985 to a large set of domain-joined systems, explicitly including domain controllers and certificate authorities, activity Microsoft frames as the hallmark of an intrusion that precedes large-scale data theft, extortion or ransomware deployment (Microsoft Threat Intelligence, 2026-09-02). The Node.js/dormant-Ethereum-smart-contract-C2 mechanism overlaps the malware family already tracked as EtherRAT from Red Canary's August monthly round-up, though Microsoft's own reporting never uses that name for this implant; the connection is a mechanistic overlap this entry records, not an identity Microsoft itself asserts.

Triage: an external Microsoft Teams chat or call that leads to a screen-share "request control" approval or a Quick Assist connection-code exchange, particularly one impersonating internal IT, is the point at which this campaign is still stoppable; legitimate internal helpdesk workflows do not typically originate from an external tenant. Downstream, a WinRM connection to a domain controller or certificate authority originating from a non-administrative PowerShell process, or a node.exe process reading a script staged under a user's AppData directory and launched by wscript.exe, are both behaviours normal administrative tooling does not produce.

Builds on: 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · 2026-08-24/synkloader-teams-helpdesk-impersonation-six-module-loader

Kimsuky's seafood-invoice LNK campaign abuses Backblaze B2 cloud storage as C2 and exfiltration infrastructure, keyed by victim BIOS serial number

AhnLab ASEC attributes a new malicious-LNK campaign to Kimsuky based on code and behavioural overlap with prior Kimsuky LNK operations: matching PowerShell extraction syntax, the same fixed-offset method of extracting data embedded in the LNK, and the same Task Scheduler registration pattern (AhnLab ASEC, 2026-09-01). The lure is a spearphishing attachment named "[Royal Hotel Seoul] Request for Review of Seafood Ingredient Purchases.LNK." Running it uses PowerShell to extract embedded data: it drops a legitimate-looking decoy .hwp document at the same path, displayed to the victim, while simultaneously writing an XOR-encrypted ZIP to C:\ProgramData\systmp\sunshine containing a PowerShell script (termsvc.ps1) and a JScript file, saved separately as C:\ProgramData\systmp\ping_<first-4-UUID-digits>.js (AhnLab ASEC, 2026-09-01). Persistence is a Scheduled Task named MicrosoftOffice2016_<first-4-UUID-digits> that runs the JS file via wscript.exe roughly every 14 minutes; the obfuscated script checks for the presence of termsvc.ps1 and bypasses the PowerShell execution policy to run it hidden (AhnLab ASEC, 2026-09-01). termsvc.ps1 collects OS name and architecture, system timezone, public IP (queried via api.ipify.org), username, domain, the running-process list, and computer name, then authenticates to the Backblaze B2 API and uploads the collected data to a per-victim path keyed on the BIOS serial number, a legitimate cloud-storage service used as command-and-control infrastructure rather than attacker-registered domains (AhnLab ASEC, 2026-09-01). It then polls the same B2 path for a follow-up command file, saves it under an arbitrary name as a .cmd in %TEMP%, executes it hidden via cmd.exe /c, and deletes the local copy roughly 120 seconds later. The actor deletes the original LNK and the intermediate ZIP during execution, leaving only the components needed for the persistence loop.

Triage: authenticated outbound HTTPS traffic to Backblaze B2 API endpoints from a workstation with no legitimate backup or storage use case, alongside a Scheduled Task invoking wscript.exe against a script under C:\ProgramData on a short (~14-minute) interval, is the reusable detection hook, it generalises beyond this campaign to "legitimate cloud storage abused as C2," a pattern increasingly common across unrelated actors, not only Kimsuky.

MoiClient: an invoice-themed backdoor chains an RPC-based UAC bypass with a vulnerable Lenovo PC Manager driver to kill security products and steal browser credentials

AhnLab's ASEC documents MoiClient (named for the "moimoi" string in its BYOVD component) distributed as a .vhdx file disguised as an invoice email attachment. The archive contains Invoice.Pdf.Exe, actually the legitimate SumatraPDF viewer, used to DLL-sideload a same-directory malicious uxtheme.dll, plus hidden support files (AhnLab ASEC, 2026-09-01). Execution moves into a legitimate process via classic process hollowing: MoiClient spawns explorer.exe suspended and overwrites its entry point with shellcode from a co-located data.dat. For privilege escalation, MoiClient connects over ncalrpc to the RPC interface of the AppInfo Service, launches winver.exe as a debug target to acquire a debug-object handle, then drives ComputerDefaults.exe (a system binary that auto-elevates) through the same RPC path, clones its process handle, and sets that cloned handle as the parent of subsequent sc.exe and PowerShell processes so they inherit elevated privileges with no UAC prompt shown (AhnLab ASEC, 2026-09-01). With elevated rights, MoiClient drops a vulnerable Lenovo PC Manager kernel driver, version 2.5.30.11281 of BootRepair.sys, under the name moimoi.sys in the %Public% path, registers it as a kernel service, and uses its device interface to pass process IDs of running security products for forced termination, targeting Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG and McAfee by process name (AhnLab ASEC, 2026-09-01). A separate technique specifically neutralises Windows Defender: MoiClient downloads defendnot.dll and defendnot-loader.exe from its command-and-control server and runs them through the elevated PowerShell session. Persistence is a Task Scheduler job named MicrosoftWindowsUpdateTask<4-digit-number> (or the existing name with a trailing period appended on a collision) that fires every 30 minutes, re-launching the renamed SumatraPDF binary to re-trigger the DLL-sideload chain (AhnLab ASEC, 2026-09-01). The final payload, "MoiXD Stealer," runs in memory and uses a ChromeElevator-style technique to steal browser-stored passwords.

Triage: the RPC-based UAC bypass, cloning a process handle obtained through winver.exe as a debug target and attaching it as the parent of sc.exe or PowerShell, resembles a technique class Google Project Zero documented in 2019 against the AppInfo Service; a sc.exe or PowerShell process whose parent-process chain traces back through winver.exe or ComputerDefaults.exe rather than a normal interactive shell is not typical UAC-elevation behaviour and is the observable signature the mechanism supports.

CVE-2026-83548 / CVE-2026-83549 (SonicWall SMA1000: a pre-auth SSRF through an undocumented Work Place access path chains into post-auth command injection in the Management Console) both under active exploitation

SonicWall's SMA1000 is a secure remote-access appliance family used by enterprises and government agencies to front VPN, SSL-VPN and application-proxy access for remote users. SonicWall's advisory SNWLID-2026-0016 (updated 2026-09-01) discloses two flaws it states it has investigated as actively exploited (SonicWall PSIRT). CVE-2026-83548 (CVSS 3.0 10.0) is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface, arising from an unintended alternate access path (CWE-918 SSRF, CWE-441 Confused Deputy); a remote, unauthenticated attacker uses it to reach functionality normally gated behind authentication (SonicWall PSIRT). CVE-2026-83549 (CVSS 3.0 7.8) is a post-authentication OS command injection in the Appliance Management Console (AMC), letting an attacker who already holds administrative access execute arbitrary operating-system commands (SonicWall PSIRT). Chained, the SSRF supplies the unauthorized access the command injection then turns into code execution, SecurityWeek and BleepingComputer both report the flaws are being exploited together, with the appliance considered fully compromised once both stages complete (SecurityWeek, 2026-09-02). Affected: SMA1000 physical and virtual models 6210, 7210 and 8200v on any release before the fixed hotfixes below; the SMA 100 Series and SonicWall firewall SSL-VPN are explicitly not affected (SecurityWeek, 2026-09-02). Fixed in hotfix 12.4.3-03526 or 12.5.0-02952 (SecurityWeek, 2026-09-02). Shadowserver tracks more than 400 SMA1000 appliances exposed to the internet, some of which may already be patched (BleepingComputer, 2026-09-02). CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-09-02 (CISA Known Exploited Vulnerabilities catalog, 2026-09-02).

This is the second SMA1000 zero-day chain disclosed in seven weeks: a 2026-07-14 entry covers CVE-2026-15409/CVE-2026-15410, an SSRF-to-command-injection pair on a different endpoint pair, exploited for weeks before disclosure and later abused by ransomware affiliates per CISA. No source ties this new chain to the same UTA0533 cluster or any other named actor; the recurrence is in the vulnerability class and product line, not in a confirmed shared operator.

SonicWall's own remediation guidance where indicators of compromise are found is unusually direct: re-image or re-deploy the appliance, change every user and administrator password, and reset TOTP tokens, treating successful exploitation as compromising stored credentials and MFA seeds, not just the appliance itself (SonicWall PSIRT). Triage: requests to the Work Place interface that trigger outbound connections to internal-only services, or AMC command-execution audit entries not tied to an interactive administrator session, are the observable signature the mechanism supports, a legitimate Work Place session has no reason to originate internal service-to-service traffic.

Builds on: 2026-07-14/sonicwall-sma1000-ssrf-cve-2026-15409-actively-exploited

CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables

Langflow is a self-hosted AI-workflow/agent-building platform whose custom-component validate endpoint has now produced several distinct remote-code-execution CVEs in 2026. CVE-2026-0768 (CVSS 9.8, CWE-94 code injection) sits in the endpoint's handling of the code parameter: the flaw lacks proper validation of a user-supplied string before using it to execute Python code, with no authentication required and execution running as root. Disclosed by Trend Micro's Zero Day Initiative (ZDI-26-034) in January 2026, it is a genuinely separate vulnerability from CVE-2026-0770, a companion 0-day disclosed by the same research team on the same date, hitting the exec_globals parameter on the same endpoint via a different CWE class (untrusted-sphere inclusion), and has been KEV-listed since July (Zero Day Initiative, ZDI-26-036). VulnCheck's honeypots (via Caitlin Condon) recorded at least 50 exploitation attempts against CVE-2026-0768 over one weekend, primarily from Russian source traffic, rising to 360 total attacks as of BleepingComputer's reporting, with no known public proof-of-concept (BleepingComputer, 2026-09-01). Post-exploitation requests query environment variables LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS* and AWS_SECRET*, read /root/.cache/langflow/secret_key, and check .ssh access and .bash_history size, a hunt signature that generalises to Langflow-adjacent exploitation regardless of which specific CVE is chased (BleepingComputer, 2026-09-01). heise's follow-up the next day independently confirms sustained, rising attack volume (heise Security, 2026-09-02). The current Langflow release is 1.12.0 (heise Security, 2026-09-02), which superseded 1.11.6 (the version BleepingComputer's 2026-09-01 report names as current) released later the same day per Langflow's own GitHub release history (Langflow GitHub Releases); the underlying fix for CVE-2026-0768 applies to any version after the affected 1.4.2 baseline, so 1.12.0 is simply the latest of many fixed releases rather than where the fix was newly introduced.

Triage: requests to the validate endpoint's code parameter that immediately follow with reads of /root/.cache/langflow/secret_key or environment-variable enumeration are the observable exploitation-and-harvest sequence; a legitimate custom-component workflow does not chain those two actions together.

Builds on: 2026-07-22/langflow-cve-2026-0770-exploited-ncsc-nl-15-cve-batch

CVE-2026-9586, Sangoma Switchvox: an unauthenticated XML phone-notification endpoint reaches PostgreSQL COPY TO PROGRAM, and honeypots caught exploitation nearly seven weeks after the patch shipped

Sangoma Switchvox is a VoIP/unified-communications platform built on Asterisk. It exposes an unauthenticated HTTP endpoint, /pa, handled by PhoneAppsHandler.pm, meant to let supported desk phones receive call-event notifications. The handler validates only that the POST body starts with the literal string <PolycomIPPhone>, no further sanitisation, before parsing it as XML via XML::Simple::XMLin() and extracting the PhoneIP field with no validation, concatenating it directly into an unparameterized SQL string executed against PostgreSQL (Horizon3.ai, 2026-09-01). Because the database connection runs with enough privilege to invoke COPY (...) TO PROGRAM, the injection reaches arbitrary operating-system command execution, not just data disclosure (Horizon3.ai, 2026-09-01). Horizon3.ai reported the flaw to Sangoma on 10 April 2026; a fix shipped in Switchvox 8.4.0.2 on 14 July 2026, and the finding was independently co-discovered by Security Risk Advisors, who published their own advisory on 17 July 2026 (Horizon3.ai, 2026-09-01). Horizon3 deployed internet honeypots from 8 May 2026 (before the patch shipped) specifically to watch for zero-day use; the first genuine exploitation attempt tripped them on 30 August 2026, nearly seven weeks after the patch was already available, from a single source IP dropping reverse shells and enumerating running processes via a base64-encoded top -bn1 pipeline exfiltrated over HTTP (Horizon3.ai, 2026-09-01). CISA added CVE-2026-9586 to its Known Exploited Vulnerabilities catalog on 2026-09-02 (CISA Known Exploited Vulnerabilities catalog, 2026-09-02), and Help Net Security's same-day update reports the same actor has since deployed a second-stage payload that "on a cursory look appeared to be a cryptominer," with dozens of additional source IPs joining in simple scanning and further second-stage installation (Help Net Security, 2026-09-02). Roughly 4,000 Switchvox instances are visible on Shodan, mostly in the United States (Horizon3.ai, 2026-09-01). Horizon3's own researcher assesses the appliance's value to attackers goes beyond the box itself: some deployments hold integration secrets that could let an attacker pivot from external to internal networks using stolen credentials (Help Net Security, 2026-09-02).

The exploitation mechanism generalises beyond this one product: a database role permitted to write server-side files or execute programs via COPY TO PROGRAM turns an ordinary SQL injection into command execution without any xp_cmdshell-style stored-procedure abuse, worth checking for on any PostgreSQL-backed application, not only this one. Triage: the vendor's own component writes injected payloads into /var/log/switchvox/db-quirks.log, which is not a file ordinary phone-notification traffic ever touches; its presence with unfamiliar SQL content is a high-confidence sign of exploitation attempts regardless of whether they succeeded.

CVE-2026-59822, BerriAI LiteLLM: a failed key check on the MCP gateway substitutes an empty auth object instead of rejecting the request, so a fabricated Bearer token opens a live MCP session

LiteLLM is a widely deployed proxy/gateway that lets an organisation front many LLM providers behind one API and, via the Model Context Protocol (MCP), let connected AI agents call external tools through it. Its MCP Streamable HTTP endpoint supports an OAuth2-passthrough mode for upstream MCP servers; the flaw sits in what happens when the gateway's own key check fails. Instead of rejecting the request, the fallback path replaces the failed validation with an empty UserAPIKeyAuth() object, which the rest of the request pipeline treats as a legitimately authenticated session (BerriAI, via OSV.dev). An attacker who sends any fabricated Authorization: Bearer value (no valid LiteLLM key required) therefore establishes a working MCP session and can list and invoke every MCP tool and connected service the gateway exposes (BerriAI, via OSV.dev). CISA's KEV addition on 2026-09-02 confirms this is under active exploitation, not merely disclosed (CISA Known Exploited Vulnerabilities catalog, 2026-09-02). Fixed in 1.84.0; where an immediate upgrade is not possible, BerriAI's own guidance is to block /mcp/ and related MCP endpoints at the reverse proxy or API gateway in front of LiteLLM (BerriAI, via OSV.dev).

This is a distinct code path from two other recently covered LiteLLM/MCP-surface flaws: CVE-2026-42271 was a command injection through MCP stdio test endpoints, chained with the Starlette host-header bypass CVE-2026-48710 in a real production intrusion Microsoft documented in August. CVE-2026-59822 hits the Streamable HTTP transport's OAuth2 fallback logic instead, a different mechanism on the same class of MCP-facing attack surface, not a re-run of the earlier bug.

Triage: an MCP session that never completed a valid key check but is nonetheless treated as authenticated is the tell; any environment logging MCP-gateway auth decisions should flag sessions where the presented Bearer token does not match an issued LiteLLM key yet the request pipeline proceeds past the auth stage.

Builds on: 2026-06-09/cve-2026-42271-berriai-litellm-low-privilege-command-injecti · 2026-08-31/ai-infrastructure-litellm-ragflow-kestra-intrusions

GitSpawn (CVE-2026-72718); a hostile repository's own git config runs arbitrary commands during AI coding agents' routine startup housekeeping, before any trust prompt

Manifold Security's GitSpawn research starts from an operational fact about how CLI AI coding agents behave: on opening a folder, several gather repository context by running ordinary git commands (git status, git diff) before the agent has received a prompt, shown a workspace-trust dialog, or in some cases completed authentication (Manifold Security, 2026-09-01). Any git command that refreshes the index honours the repository's own .git/config, including core.fsmonitor, a performance hook where git hands the index refresh off to an external helper program named in that config file. A hostile .git/config setting [core] fsmonitor = <arbitrary command> turns the agent's own routine startup housekeeping into unconditional command execution, with no approval prompt and nothing shown on screen (Manifold Security, 2026-09-01). Delivery is narrower than a typical supply-chain vector: cloning, fetching or pulling from a hostile URL does not carry .git/config across, so the repository has to arrive as files with its .git directory already present, a shared zip, a sync folder, a shared drive, or a USB stick, the way colleagues and consultants routinely hand off projects (Manifold Security, 2026-09-01).

Manifold reports eight findings across seven agents, four of which remain unpatched at publication. Confirmed patched: Goose's git diff sink during goose review (CVE-2026-72718, CVSS 4.0 7.0, fixed in 1.44.0), Claude Code's core.fsmonitor sink (fixed in 2.1.196), OpenAI Codex, and Cursor. OpenAI separately disclosed and patched three of its own CVEs for a distinct Codex helper mechanism in the same vulnerability class, crediting three unrelated research groups; only CVE-2026-19592 is named in the cited reporting, describing a helper that runs outside Codex's command sandbox without a user-approval prompt and can read, change or delete the user's files (The Hacker News, 2026-09-02). Confirmed unpatched as of Manifold's 1 September 2026 recheck: Claude Code carries a second, separate sink in claude ultrareview, "not core.fsmonitor ... a different git setting of the same kind, one the review path does not strip," per Manifold, which withholds the specific config key while it remains unfixed; Qwen Code's git status fires at startup, before authentication; Grok Build's payload fires on the first keystroke, with an earlier July report on the same class closed by xAI as "informative"; and Hermes Agent's git status on first message remains unpatched despite six contact attempts across five channels, with VulnCheck assigning CVE-2026-71963 in the vendor's place (Manifold Security, 2026-09-01; The Hacker News, 2026-09-02). Manifold states the underlying pattern is not limited to the named agents and spans both major AI labs and large software companies (heise Security, 2026-09-02).

Mitigation is two-sided: a defender receiving a repository as files should inspect .git/config before opening it in any agent (any entry naming an external program is suspicious) and an agent vendor's own fix is to sanitise the git config on context-gathering calls, e.g. git -c core.fsmonitor=false status (Manifold Security, 2026-09-01). Triage: a git subprocess spawned by an AI coding agent that itself spawns a further, unrelated child process, particularly one launched before the agent has logged any user prompt or shown a trust dialog, is not normal agent startup behaviour and is the observable signature the mechanism supports.

Gambling Goblin (Earth Berberoka overlap): a Chinese-speaking cluster compiles malicious Apache modules on compromised Brazilian .gov.br servers, borrowing their search-engine trust for a global gambling-SEO fraud network

Check Point Research documents Gambling Goblin, a Chinese-speaking cluster it assesses with medium-to-high confidence overlaps Earth Berberoka, first documented by Trend Micro in 2022 targeting gambling platforms serving Chinese-speaking users. Active against Brazilian organisations since mid-2025, primarily government and educational institutions, the operation's distinguishing move is weaponising the search-engine trust of compromised .gov.br domains: navigation tiles on the resulting fraud pages point to dozens of real domains spanning a federal ministry, a national public agency, a state legislative assembly, state courts of accounts, a state utility, and numerous municipal administrations (Check Point Research, 2026-09-02). The technique (compromising a government web server to graft attacker content onto its own trusted domain) is directly transferable to any public-sector web-hosting estate, at any administrative tier, regardless of region.

On an already-compromised Linux host, a Bash installer confirms root, fingerprints the distribution, patches a missing macro, and compiles a custom Apache module (opsproxy.c) via apxs, then deletes the build artefacts and timestomps the resulting .so and its load configuration to match legitimate modules such as mod_ssl or mod_suexec (Check Point Research, 2026-09-02). The module registers at Apache's name-translation stage and inspects every incoming request for a small set of hardcoded URL prefixes (/wps, /bmw, /card in the analysed samples); a match rewrites the request into a reverse proxy to a hardcoded upstream, so the visitor is silently relayed to attacker infrastructure while the request still appears, from the outside, to originate from the legitimate compromised domain (Check Point Research, 2026-09-02). The module also strips the site's own Content-Security-Policy header and replaces it with a permissive one allowing inline/eval'd scripts and third-party assets, so the injected phishing content renders unrestricted. A second, separate Apache module disguises itself as a basic filter, decrypts an RC4-protected ruleset keyed on path/referrer/User-Agent/client-IP, locates the page body via a compiled-in <body.*?> regex, and injects fetched remote content via ap_rwrite, classic SEO-cloaking and content-injection behaviour, distinct from the reverse-proxy module (Check Point Research, 2026-09-02). The upstream phishing pages impersonate Google Play, Microsoft Store and Amazon with fabricated ratings and schema.org metadata, pushing gambling and sports-betting content.

Beyond the Apache modules, the group runs an internet-facing reconnaissance agent (a Go ELF binary wrapping dirprobe, httpx, naabu, nuclei v3, subfinder and whatweb over gRPC C2) to map attack surface, plus a downloader (DownPro) that stages the rest of the toolkit, blending its drop paths into names mimicking legitimate system binaries. Two backdoors carry Check Point's own attribution basis: oRAT, a Go RAT with an embedded SSH/SFTP server that persists as a systemd service disguised as the legitimate xtables-addons netfilter package, disables SELinux enforcement (setenforce 0) as part of its setup routine, and masquerades its process as sshd: root@pts/0, sharing the same orat/cmd/agent codebase and REST-style operator routes Check Point tied to Earth Berberoka in 2022 (Check Point Research, 2026-09-02). AlphaAgent, a modular Go backdoor using gRPC-over-HTTPS with browser-fingerprint mimicry (or a DNS covert channel) and bundling a SOCKS5 proxy and Ligolo-style relay for pivoting, was recovered from the same archive as tools already attributed to Earth Berberoka, placing it directly alongside the group's known toolset (Check Point Research, 2026-09-02). A third attribution point is infrastructure: the group's command-and-control shares Earth Berberoka's historical Amazon ASN (AS16509) (Check Point Research, 2026-09-02). A credential stealer built on the open-source 3snake project intercepts sshd/sudo/su/ssh/passwd/kinit/ login executions via netlink process-event monitoring and ptrace, masquerading as one of roughly 29 fake kernel-thread process names. Check Point states the model is already exported beyond Brazil: parallel phishing templates localised for Vietnamese, Spanish and English audiences, with daily domain generation.

No source describes how the group obtains its initial foothold on a target web server, the reporting begins from already-established root access. Defenders should read this as post-compromise infrastructure abuse, not an exploitation narrative to patch against.

Triage and hunting: a sudden absence of Content-Security-Policy headers on specific URL paths of a public-sector web server is a strong signal of injected reverse-proxy behaviour (Check Point Blog, 2026-09-02). Audit installed Apache modules for .so files timestamped to match legitimate modules such as mod_ssl or mod_suexec; a mismatch between a module's claimed identity and its actual behaviour is the core detection concept, not any single file name (Check Point Blog, 2026-09-02). Further behavioural artefacts a defender can hunt for without treating them as fixed indicators: a systemd service claiming to be xtables-addons that does not match the real package's binary; a process presenting as sshd but running from an unexpected path; unexplained apxs/module-compilation activity on a production web server outside a maintenance window; and process names drawn from common kernel-worker naming conventions (kworker, ksoftirqd, watchdog, journald) that do not correspond to genuine kernel threads when inspected further.