CTIPilot

ShadowPad

malware · malware:shadowpad

Modular backdoor widely used by China-nexus threat actors; deployed by UNK_LateNight via DLL sideloading following BlueMoon exploit-kit compromise, unhooking network-monitoring functions and beaconing over HTTPS with a binary C2 protocol (Proofpoint, 2026-09-08).

Coverage timeline
4
first 2026-05-14 → last 2026-09-10
Peak priority
high
2 high · 2 notable
Sources cited
12
10 hosts
Sections touched
3
active-threats, deep-dive, research
Co-occurring entities
8
see Co-occurring entities below
ATT&CK techniques
28
pinned v19.2 · see below

Hunting pivots

ATT&CK techniques
T1071.001 ×2T1189 ×2T1027T1036T1053.005T1055T1056.001T1068T1071.004T1105T1176T1203T1539T1566.002T1574.001T1620
Affected products
Google ChromeMicrosoft EdgeMicrosoft Windows
Tags
china-nexus ×4espionage ×4nation-state ×4actively-exploitedcloudzero-day

ATT&CK techniques

28 techniques observed across 4 entries, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

T1189Drive-by Compromise×2

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-07-10/e-government-portal-watering-hole-cms-implant-espionage · ATT&CK page ↗

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-22/red-lamassu-calypso-bronze-medley-showboat-jfmbackdoor-telco · 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

T1566.002Phishing: Spearphishing Link×1

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Execution TA0002

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1059.001Command and Scripting Interpreter: PowerShell×1

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-05-22/red-lamassu-calypso-bronze-medley-showboat-jfmbackdoor-telco · ATT&CK page ↗

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×3

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-05-22/red-lamassu-calypso-bronze-medley-showboat-jfmbackdoor-telco · 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

Persistence TA0003

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

T1176Software Extensions×1

Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

Privilege Escalation TA0004

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1036Masquerading×1

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Evidence: 2026-07-10/e-government-portal-watering-hole-cms-implant-espionage · ATT&CK page ↗

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-05-22/red-lamassu-calypso-bronze-medley-showboat-jfmbackdoor-telco · ATT&CK page ↗

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×3

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-05-22/red-lamassu-calypso-bronze-medley-showboat-jfmbackdoor-telco · 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

T1620Reflective Code Loading×1

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Evidence: 2026-07-10/e-government-portal-watering-hole-cms-implant-espionage · ATT&CK page ↗

Credential Access TA0006

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1539Steal Web Session Cookie×1

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Lateral Movement TA0008

T1021.001Remote Services: Remote Desktop Protocol×1

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

T1021.002Remote Services: SMB/Windows Admin Shares×1

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Evidence: 2026-05-14/famoussparrow-three-wave-intrusion-of-an-azerbaijani-energy · ATT&CK page ↗

Collection TA0009

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1560Archive Collected Data×1

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Evidence: 2026-05-22/red-lamassu-calypso-bronze-medley-showboat-jfmbackdoor-telco · ATT&CK page ↗

Command and Control TA0011

T1001.002Data Obfuscation: Steganography×1

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.

Evidence: 2026-05-22/red-lamassu-calypso-bronze-medley-showboat-jfmbackdoor-telco · ATT&CK page ↗

T1071.001Application Layer Protocol: Web Protocols×2

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-07-10/e-government-portal-watering-hole-cms-implant-espionage · ATT&CK page ↗

T1071.004Application Layer Protocol: DNS×1

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

T1090.001Proxy: Internal Proxy×1

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.

Evidence: 2026-05-22/red-lamassu-calypso-bronze-medley-showboat-jfmbackdoor-telco · ATT&CK page ↗

T1102.001Web Service: Dead Drop Resolver×1

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Evidence: 2026-05-22/red-lamassu-calypso-bronze-medley-showboat-jfmbackdoor-telco · ATT&CK page ↗

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Story timeline

  1. 2026-09-10BlueMoon: four separate state-nexus actor clusters independently weaponize a shared Chrome V8 + Windows kernel zero-day chain within one week
    active-threatsFour espionage clusters ran the identical click-to-SYSTEM exploit kit within days of each other, Proofpoint calls it the same code, not parallel development
  2. 2026-07-10Espionage actors weaponise a citizen-facing e-government complaint portal as a watering hole, serving a fake 'portal update' that reflectively loads a RAT
    researchSentinelLabs: a nation-state actor turned a citizen-and-staff e-government portal into a watering hole with a disguised 'portal update' RAT loader
  3. 2026-05-22Red Lamassu (Calypso/Bronze Medley): Showboat + JFMBackdoor telco espionage implant pair
    deep-dive
  4. 2026-05-14FamousSparrow Three-Wave Intrusion of an Azerbaijani Energy Operator: ProxyNotShell Re-exploitation and a Wave-1 DLL-Sideload Loader That Overrides Two Hamachi Exports to Defeat Sandbox Analysis
    deep-diveFamousSparrow Three-Wave Intrusion of an Azerbaijani Energy Operator: ProxyNotShell Re-exploitation and a Wave-1 DLL-Sideload Loader That Overrides Two Hamachi

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

used by

Where this entity is cited

  • deep-dive2
  • research1
  • active-threats1

Source distribution

  • thehackernews.com3 (25%)
  • bitdefender.com1 (8%)
  • bleepingcomputer.com1 (8%)
  • github.com1 (8%)
  • lumen.com1 (8%)
  • proofpoint.com1 (8%)
  • pwc.com1 (8%)
  • sentinelone.com1 (8%)
  • other2 (17%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (12)

Entries about ShadowPad (4)

2026-09-10 · view entry permalink →

HIGHCVE-2026-85046 +1exploitedNATOB2

BlueMoon: four separate state-nexus actor clusters independently weaponize a shared Chrome V8 + Windows kernel zero-day chain within one week

Proofpoint documents BlueMoon, a newly named exploit kit chaining a Chrome V8 JIT type-confusion bug (CVE-2026-85046) with an uncredentialed V8 sandbox escape and a Windows kernel ALPC/WNF heap-overflow local-privilege-escalation flaw (CVE-2026-85880) into a single click-to-SYSTEM chain (Proofpoint, 2026-09-08). The V8 bugs were a patch-gap zero-day: "the change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026" (Proofpoint, 2026-09-08), a nearly four-week window during which the public upstream diff let an exploit developer reverse-engineer and weaponize the bug before Chrome's stable channel shipped it; CVE-2026-85880 was separately patched by Microsoft as part of its September 2026 Patch Tuesday updates (The Hacker News, 2026-09-09); the referenced 2026-09-09 Windows entry covers Microsoft's own MSRC confirmation that it was exploited in the wild. After the browser-side chain achieves code execution and escapes the renderer sandbox, a reflectively loaded DLL fingerprints the host to decide whether to run the kernel LPE against a specific list of Windows builds, Proofpoint's own table names Windows 10 1809/2004/20H2/21H1/21H2/22H2, Windows 11 21H2's initial release build, and Server 2019/2022, a wider list than Microsoft's own advisory for this CVE, which describes the legacy line only and states it does not affect Windows 11 (Contradiction, unresolved here), then a process-injection stub runs an operator-supplied command inside the Chrome broker process, by default a plain curl download-and-execute, a deliberately crude step Proofpoint reads as evidence the developer traded stealth for speed. Four distinct espionage clusters adopted the identical kit within days of each other, each with its own delivery and payload: TA412/APT31 (from 2026-08-28) used student-internship and academic-conference spearphishing against US NGOs, mining and commodity-trading firms to install a malicious Chromium extension disguised as "Google Gemini" (GemStone), using an HMAC-forgery technique, named GhostChrome-X by outside researchers (The Hacker News, 2026-09-09), against Chrome's Secure Preferences integrity check so the extension survives the browser's own unauthorized-extension protection; GemStone keylogs, steals cookies/session storage, screenshots on keyword match and polls its C2 every 30 seconds to 60 minutes. UNK_LateNight (from 2026-09-02) targeted US aerospace/defense firms with B2B/RFQ lures to sideload the ShadowPad backdoor via a scheduled task. UNK_DoubleCheck (from 2026-09-02) phished a Vietnamese manufacturer from a compromised Southeast Asian government mailbox, obfuscating its loader and staging a second DLL from a Cloudflare R2 bucket. UNK_QuietRacket (from 2026-09-03) targeted government, consulting and financial-sector organizations in Indonesia and Singapore with conference-themed lures, resolving C2 entirely through DNS-over-HTTPS TXT-record lookups to a Cloudflare Worker. A Proofpoint researcher assessed the near-identical, simultaneous adoption as deliberate distribution rather than independent discovery: "there's no way that this is parallel development. The code is practically identical, even the variable naming, the commentary. It's the same kit. One hundred percent" (Mark Kelly, Proofpoint, via The Record, 2026-09-09). Patching Chrome and Windows closes the entry vector but removes nothing already installed, the GemStone extension, ShadowPad's DLL-sideload persistence, and the other clusters' scheduled tasks all survive a patch untouched.

Triage: a process tree rooted at the browser (browser → command shell → curl or a download utility → a newly dropped executable) is the chain's own crude final stage and a strong discriminator on its own; a scheduled task created immediately following a browser-initiated download narrows it further, since legitimate browser activity does not normally create scheduled tasks.

The change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026.

Proofpoint Threat Research 2026-09-08

While CVE-2026-85046 was patched by Google last week, CVE-2026-85880 was addressed by Microsoft as part of its September 2026 Patch Tuesday updates.

The Hacker News 2026-09-09

There’s no way that this is parallel development. The code is practically identical, even the variable naming, the commentary. It’s the same kit. One hundred percent.

The Record (Recorded Future News) 2026-09-09

Builds on: 2026-09-04/cve-2026-85046-chrome-v8-type-confusion-exploited · 2026-09-09/windows-september-2026-two-exploited-lpe-zero-days-kev

threat10 Sep 04:50Zmulti-sourceOpen finding ↗
Sources: Proofpoint Threat Research · The Record (Recorded Future News) · The Hacker News

2026-07-10 · view entry permalink →

NOTABLENATOB3

Espionage actors weaponise a citizen-facing e-government complaint portal as a watering hole, serving a fake 'portal update' that reflectively loads a RAT

SentinelLabs documented sustained, independent cyberespionage between February 2024 and April 2026 against several Pakistani law-enforcement bodies, and while the victim class carries no direct European nexus, one technique is squarely relevant to any government running citizen-facing digital services: a suspected China-nexus actor planted custom implants directly in a public-facing Complaint Management System (CMS) (a portal used by both police staff and ordinary citizens) turning it into a watering hole (T1189, SentinelLabs, 2026-07-09). The compromised web applications were part of an EU-supported "Smart Police Station" digitalization programme, so the case is a concrete illustration of trusted e-government infrastructure being weaponised against its own users. Two implant variants were deployed: a Rust stager and a .NET executable masquerading as security/portal-update software (T1036) that displays "Update Complete! Please refresh the page" to the victim; the .NET variant reflectively loads AsyncRAT (T1620) configured against separate command-and-control infrastructure (T1071.001). SentinelLabs ties the CMS-implant samples to a Chinese-speaking developer through a shared build-path artefact across related samples, and separately attributes a converging India-nexus intrusion set at the same targets to the actor tracked as Bitter (registry: actor:bitter; aka TAG-179 / Mysterious Elephant / APT-C-08) using Remcos, alongside commodity PlugX, ShadowPad and Cobalt Strike activity (SentinelLabs, 2026-07-09; corroborated by The Express Tribune, 2026-07-09). Per this pipeline's no-IOC policy, the report's C2 addresses are not reproduced here; the transferable content is the technique class, not the indicators.

A suspected China-nexus actor planted implants in one of the web applications, which serves both police staff and citizens, weaponizing a tool of Pakistan's police digitalization against its users.

Many of the web applications hosted on the affected servers are part of the Smart Police Station initiative, an EU-supported effort to modernize Balochistan policing and improve how it serves the public through digitalization.

SentinelLabs (SentinelOne) 2026-07-09
research10 Jul 04:36Zmulti-sourceOpen finding ↗
Sources: SentinelLabs (SentinelOne) · The Express Tribune

2026-05-22 · view entry permalink →

NOTABLE

Red Lamassu (Calypso/Bronze Medley): Showboat + JFMBackdoor telco espionage implant pair

Background. Calypso (also tracked as Red Lamassu and Bronze Medley) is a China-aligned espionage cluster active since at least mid-2022 based on Lumen's binary upload and victim telemetry, the Showboat/JFMBackdoor campaign dates to this period. The group has previously been linked to intrusions against government entities, energy companies, and telecommunications operators in Central Asia, South Asia, and the Middle East using commodity and bespoke tooling including PlugX and ShadowPad variants. Lumen Black Lotus Labs and PwC Threat Intelligence disclosed the Showboat/JFMBackdoor toolset on 2026-05-21 based on infrastructure analysis, binary upload telemetry, and victim telemetry (Lumen Black Lotus Labs, 2026-05-21 · PwC Threat Intelligence, 2026-05-21).

Linux implant: Showboat. Showboat is a modular post-exploitation ELF binary. On disk, the process name is kworker, directly impersonating Linux kernel worker threads to evade basic process-list inspection (T1036.005 Masquerade: Match Legitimate Name or Location). The implant contacts its C2 server, collects basic system information, and encodes the beacon data as Base64 inside PNG image field bytes, blending C2 beaconing with image-format traffic (T1001.002 Steganography). Functional modules provide: (1) remote shell (T1059.004 Unix Shell); (2) bidirectional file transfer; (3) SOCKS5 proxy and port-forwarding (T1090.001 Internal Proxy), enabling the attacker to tunnel through the compromised telecom server into internal network segments without direct external access to those targets; (4) a hide command that fetches a rootkit payload from a Pastebin or forum-style dead-drop at runtime (T1102.001 Dead Drop Resolver), pulling additional capability after initial deployment rather than shipping it on disk. C2 infrastructure is geolocated to Chengdu, Sichuan province, consistent with prior Calypso campaigns. X.509 certificate SAN/CN clustering links the campaign's confirmed victim set.

Windows implant: JFMBackdoor. JFMBackdoor is delivered via DLL sideloading (T1574.002 Hijack Execution Flow: DLL Side-Loading): a batch script drops a legitimate vendor-signed executable alongside a malicious DLL in a writable path; the signed binary loads the DLL, providing the attacker with remote shell, file operations, SOCKS5 proxy, screenshot capture, and self-removal capability. The use of a vendor-signed loader binary defeats application allowlisting based on signing alone.

Kill-chain pattern. Initial access vector is not publicly confirmed; the long-running nature (mid-2022 to 2026) and focus on network-exposed telecom infrastructure suggest exploitation of public-facing services (T1190) or credential-based entry. Post-access, Showboat provides the persistent Linux bridgehead; from there SOCKS5 tunnels are used for lateral movement into internal segments (T1090.001). Data collection via T1560 Archive Collected Data and exfiltration via the C2 covert channel completes the chain.

Detection for EU/telco SOCs. (1) Linux: kworker processes whose parent is not kthreadd (PID 2) are anomalous; legitimate kernel workers are exclusively children of kthreadd; any kworker-named process with a user-space parent (e.g., bash, sshd, any application binary) is high-confidence suspicious. Enumerate via auditd EXECVE rules or Sysmon for Linux EID 1 with parent-pid cross-check. (2) Linux: SOCKS5 connection establishment from application-layer daemon processes (not expected proxy services) to non-standard ports is a lateral-movement pivot indicator. (3) Linux: DNS queries or HTTP GET to pastebin.com from processes running as root or as non-web-facing service accounts are anomalous; no production daemon should be fetching Pastebin content. (4) Windows: Sysmon EID 7 (ImageLoad) showing a signed process binary loading an unsigned DLL from a writable user-controlled path (e.g., AppData, Temp, or any path not under %SystemRoot%) warrants investigation. (5) Network: X.509 certificate attribute hunting against the Chengdu IP ranges described by Lumen Black Lotus Labs; if your threat-intel platform supports cert-fingerprint or SAN searches, use the campaign's known certificate clustering pattern as a pivot.

Hardening. On Linux telecom servers: (a) enforce process-name uniqueness checks via auditd rules that alert on EXECVE where comm matches kworker but ppid != 2; (b) egress-filter server processes to block outbound connections to hosting services (Pastebin, paste sites, general code-hosting) from root-context processes. On Windows: (c) require DLL signature enforcement via Windows Defender Application Control (WDAC) RequireSignedCode policy; (d) restrict writable paths in the DLL search order through AppLocker or WDAC deny-list rules on AppData\Roaming, Temp, and user-writable directories. Across the estate: (e) enforce strict outbound firewall rules on telecom infrastructure servers limiting egress to known management and update destinations.

threat22 May 05:00Zmulti-sourceOpen finding ↗
Sources: Lumen Black Lotus Labs, 2026-05-21 · PwC Threat Intelligence, 2026-05-21 · BleepingComputer, 2026-05-21 · The Hacker News, 2026-05-21

Earlier coverage (1)

2026-05-14HIGHFamousSparrow Three-Wave Intrusion of an Azerbaijani Energy Operator: ProxyNotShell Re-exploitation and a Wave-1 DLL-Sideload Loader That Overrides Two Hamachi Exports to Defeat Sandbox AnalysisDeep dive, FamousSparrow (UAT-9244) ran a three-wave intrusion against an Azerbaijani oil & gas operator December 2025–February 2026, re-exploiting the same ProxyNotShell Exchange chain across all three waves despite the victim's attempted remediation, and in Wave 1 deployed Deed RAT via a novel DLL-sideloading technique against a signed LogMeIn Hamachi binary, overriding two specific exported functions (Init, ComMain) and patching StartServiceCtrlDispatcherW so payload execution only fires when the legitimate application's own start-up flow runs. Bitdefender characterises Azerbaijan as a strategic post-Ukraine-transit gas supplier whose deliveries have expanded to 13 European countries (including new flows to Germany and Austria), making Azerbaijani energy infrastructure a high-value collection target for Chinese state actors monitoring European energy supply dependencies (Bitdefender Labs, 2026-05-13; The Hacker News, 2026-05-13).