Troy

Troy Hunt: a 24.9M-address ShinyHunters/Carhartt breach-claim collapses to 12.9M real records once TPC-DS synthetic benchmark data and several duplicate/test-account patterns are filtered out, a reusable methodology for verifying inflated breach-claim record counts

Following ShinyHunters' 2026-08-13 claim to have stolen 50GB+ of Carhartt customer data, Troy Hunt's initial Have I Been Pwned processing run found 24,876,077 unique email addresses in the dump. Using an AI chat assistant he calls "PwnedClaw" to help work through the corpus, while directing every step and validating each finding against the raw data himself; Hunt ran domain-frequency analysis, TLD pattern checks, and birth-country and birth-year distribution analysis, and found the bulk of the corpus was TPC-DS retail-analytics-benchmark synthetic test data that had been sitting in the same Databricks schema ShinyHunters exfiltrated, which the actor, and, per Hunt, "every aggregator after them", failed to distinguish from real customer records before publishing.

The diagnostic signals were all independently conclusive. PwnedClaw's frequency analysis found 97.6% of domains in the corpus appeared exactly once: "97.6% of domains appear exactly once, that's not a long tail, that's a signature. Real breach data from a retail company would have thousands of addresses on corporate domains, hundreds on ISP domains, a natural power law. Instead you have 10.1M singleton domains. That's pure TPC-DS generation" (PwnedClaw, quoted by Troy Hunt, 2026-08-25). An initial 32% of addresses used syntactically plausible names on gibberish .edu/.org domains, and the same pattern was found to extend across .com and every TLD once Hunt pushed further: 54.8% of addresses (13.6M) sat on domains appearing 100+ times (real), against 45.2% (11.25M) on domains appearing under 100 times, the synthetic share, not the initially-estimated 32%. Birth-country data was perfectly uniform across all 211 ISO country codes (roughly 380–420 records per country, with the US tied with Canada and dwarfed by e.g. Antigua and Barbuda and Lesotho) rather than concentrated in Carhartt's actual US/European customer base. Birth-year distribution was mathematically flat from 1924–1992: "birth year stats are conclusive. The distribution runs 1924-1992 and is perfectly flat, roughly 1,050-1,194 per year, every single year without exception. That's not population data, that's a random number generator with a fixed range" (PwnedClaw, quoted by Troy Hunt, 2026-08-25), no weighting toward a plausible customer-age curve.

Corroborating evidence the real customer data is present and genuinely breached: internal @carhartt.com employee addresses (15,057 of them), 32-character hex-prefixed internal aliases and the internal carharttdonotship.com domain (none of which an external actor could fabricate or scrape) plus a 70% hit rate against HIBP's existing freemail dataset and purchase-tagged sub-addresses (+carhartt, +paypal, and similar). PwnedClaw's synthesis: "the conclusion is pretty solid: this is a real Carhartt Databricks breach, but the TPC-DS benchmark data was co-located in the same schema and ShinyHunters (and every aggregator after them) grabbed it all without knowing what they were looking at" (PwnedClaw, quoted by Troy Hunt, 2026-08-25).

Excluding the identified TPC-DS synthetic chunk files (600 plus a further 1,200) dropped the count from 24.9M to 13,306,258, a 47% reduction, and still not the final figure. Hunt's own further manual review, again assisted by PwnedClaw, found and removed several more inflation sources: 5,736 Microsoft-365 domain-alias triplicates (the same mailbox counted three times across carhartt.com, carhartt.onmicrosoft.com and carhartt.mail.onmicrosoft.com); 285,808 deactivate--prefixed soft-delete duplicates (with 3,174 renamed back to their active form where no duplicate existed); and 48,787 wctest.com plus 32,514 carharttdonotship.com addresses, both internal performance-test domains identified by a shared perftest alias pattern rather than real customers. The final published figure (which Hunt's own tweet states directly) is 12,933,413 unique addresses: "New breach: Carhartt was the target of a ShinyHunters extortion campaign earlier this month. Data allegedly obtained from the company was later published, including 12.9M unique email addresses. 83% were already in @haveibeenpwned" (Troy Hunt, 2026-08-25), a little over half of ShinyHunters' implied headline scope.

The methodology is region-agnostic: Carhartt itself is a US retailer, but the finding is a reusable verification methodology for any SOC or CTI team triaging leak-site record-count claims, not a victim-specific disclosure. It is also a case study in AI-assisted analysis discipline: an AI assistant's confident, well-phrased analytical output is not automatically fact, and PwnedClaw's own intermediate 13.3M figure was itself superseded by further manual review, the analyst directing it still owns validating every claim and every number against the underlying data before publishing.

Lazarus burned a Windows AFD.sys zero-day (CVE-2026-68820) on European defence targets, FudModule v3.1 blinds the endpoint, and the C2 is other people's Roundcube and WordPress servers

Check Point Research published the technical analysis behind Microsoft's only exploitation-detected August Patch Tuesday entry on 2026-08-11, and the campaign behind it lands squarely on European defence organisations: the firm states its latest Operation Dream Job wave "focuses on the defense sector in Europe and India" and records "successful targeting observed in Western Europe, including France and Germany", with a compromised organisation headquartered in France subsequently reused by the operators to send spear-phishing to further targets worldwide (Check Point Research, 2026-08-11). Check Point attributes the campaign to the DPRK-linked Lazarus group and is careful about the entry point: it says the exact method used to approach victims in this wave remains unclear, and only assesses (from earlier documented Dream Job activity) that targets were likely approached through professional networking platforms or messaging apps (Check Point Research, 2026-08-11).

Background. Operation Dream Job is a long-running recruitment-lure campaign, and the driver at the centre of this intrusion is repeat ground: Check Point notes that FudModule was reported abusing CVE-2024-38193, a use-after-free in the same afd.sys driver, back in 2024, and that this build's post-exploitation behaviour is otherwise close to the FudModule v3 that Gen Digital documented that year, 94 of its hardcoded ETW-provider kill GUIDs match the first 94 entries of Gen's published 95-GUID list, in identical order (Check Point Research, 2026-08-11). What is new is the exploit chain, not the rootkit.

Two delivery chains run in parallel. In the first, the victim opens an encrypted archive holding a legitimate signed PDF-viewer executable, a malicious libmupdf.dll loaded by side-loading, and an encrypted payload carrying a .pdf extension; launching the executable displays a decoy document (Check Point's example impersonates a Lockheed Martin job description) while the DLL decrypts and runs the MISTPEN in-memory downloader, which uses the Microsoft Graph API against OneDrive to pull further modules. In the second and newer chain, victims receive offers impersonating the privacy-technology company Enveil and download "SecurityPDF", a trojanised MuPDF-based viewer whose File→Open and drag-and-drop paths were modified to look for a fixed marker string in any opened PDF, XOR-decrypt the embedded payload with a single-byte key, write it to %TEMP% and launch it as a child process; that stage reflectively loads the previously undocumented Troy backdoor, a 64-bit DLL with 17 operator commands. Check Point identified at least three websites impersonating Enveil distributing the viewer, some ranking at the top of search results, and states explicitly that Enveil itself was neither targeted nor compromised (Check Point Research, 2026-08-11).

The privilege-escalation step is the part with a CVE. After reconnaissance and persistence modules confirm the host is worth keeping, MISTPEN loads an in-memory local privilege-escalation module targeting afd.sys, the Windows Ancillary Function Driver for WinSock. Microsoft's own record describes the flaw as a use-after-free allowing an authorised attacker to elevate privileges locally, scores it CVSS 7.0 with high attack complexity, and marks it exploited but not publicly disclosed before the patch (MSRC, 2026-08-11). Check Point withholds full detail but describes the mechanism: the driver keeps a small piece of per-socket state, and under specific concurrent conditions two of its own code paths operate on that state simultaneously without synchronisation, so one path can access memory the other has already released, a race that yields a kernel read/write primitive and then SYSTEM. It confirmed on a fully patched Windows 11 system that this is a distinct, previously undocumented bug rather than the superficially similar CVE-2025-60719, and dates in-the-wild use to at least early July 2026; the sample carries an explicit minimum-version check for build 26100 (24H2) with support for 26200 (25H2). Check Point reported the issue on 28 July, Microsoft confirmed it on 31 July, assigned the CVE on 5 August and fixed it on 11 August (Check Point Research, 2026-08-11). CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11 (CISA, 2026-08-11); Rapid7, writing before that listing appeared, noted the CVSS stayed at 7.0 largely because a stable exploit has to win the race (Rapid7, 2026-08-11).

What FudModule v3.1 does with SYSTEM is the reason this matters more than a 7.0 suggests. Check Point records the full telemetry teardown carried over from v3 (process, thread and image notify callbacks, object and registry callbacks, minifilter removal by altitude band, termination of the NT Kernel Logger, crash-dump suppression first) plus privileged-handle forgery and a two-hop spawn through services.exe into a SYSTEM msiexec.exe. The dedicated Microsoft Defender stage from v3 is gone; Defender is now blinded through the same generic security-product suppression path as any other vendor. The genuinely new capability is Smart App Control tampering: inside that SYSTEM-level msiexec.exe child, the remote stub zeroes a code-integrity policy state value and invokes NtSetSystemInformation with a specific information class to force an in-place reload of the code integrity policy (Check Point Research, 2026-08-11). The final payload differs by chain, ForestTiger, a backdoor Check Point describes as widely attributed to Lazarus, on the sideloading chain; Troy on the trojanised-viewer chain.

The command-and-control choice is deliberate and is where a defender's network telemetry has a chance. Rather than attacker-registered infrastructure, the operators run through compromised Roundcube webmail and content-management servers, reaching the Roundcube instances by combining leaked credentials with the already-public CVE-2025-49113, and plant RelayShell, a PHP webshell that repurposes those servers as relay nodes. Check Point's stated reasoning is that defence-sector networks are heavily monitored, so blending into ordinary web traffic beats standing up new domains (Check Point Research, 2026-08-11).

Detection concepts follow from the mechanics rather than from indicators. The rootkit stage produces a near-simultaneous collapse of kernel-sourced telemetry (callback registrations dropping, ETW providers stopping, minifilters unregistering) and the discriminator is what preceded it: a signed security product's own uninstaller doing this is routine maintenance, the same pattern following a document-viewer process or a SYSTEM msiexec.exe spawned two hops from services.exe is not. MISTPEN's channel is Microsoft Graph against OneDrive, so the anchor is cloud audit and identity telemetry (an endpoint process that has no business calling Graph authenticating to it) not a network signature, since the destination is legitimate Microsoft infrastructure. On the web-server side, RelayShell never executes operator commands in the request path; it splits into victim and operator modes and passes messages through files on disk, so webshell detections that key on command execution inside the HTTP request will not fire, while repeated small POSTs to a plausible-looking static-asset path plus unexplained file churn in the web root will.

Triage: a burst of ETW provider stops, callback deregistrations and minifilter removals is normal when a security product is being upgraded or uninstalled, check the parent process and the account. A vendor-signed uninstaller running under an admin session at a change window is benign; the same teardown originating from a PDF viewer's process tree, or from a SYSTEM msiexec.exe whose grandparent is services.exe with no corresponding software-deployment record, is the signal. Similarly, Graph API calls to OneDrive are ubiquitous; the discriminator is the calling process, not the destination.

7-Eleven confirms ShinyHunters breach of 600,000+ Salesforce franchise-application records, same campaign as Instructure, Vimeo, Wynn Resorts, Vercel, Medtronic

7-Eleven, Inc. confirmed on 2026-05-18 that an unauthorised third party accessed systems storing franchisee documents on 2026-04-08, in a breach claimed by ShinyHunters on or around 2026-04-17 (SecurityWeek, 2026-05-18; Security Affairs, 2026-05-18). ShinyHunters listed over 600,000 Salesforce CRM records covering personal and corporate data from franchise applications, initially demanding a ransom with a 2026-04-21 deadline and then offering the data for sale at $250,000 on a hacker forum. 7-Eleven filed a Maine Attorney General notification dated 2026-05-01 confirming 24 months of IDX identity-theft protection for affected individuals (Maine AG breach notification, 2026-05-01). The Maine filing lists only 2 Maine residents but the ShinyHunters claim covers 600,000+ records globally. SecurityWeek attributes the broader campaign, Instructure (Canvas), Vimeo, Wynn Resorts (21,000 employees), Vercel and Medtronic among confirmed co-victims, not to Salesforce-product vulnerabilities but to phishing, third-party-integration abuse, and customer-side misconfiguration of Salesforce Connected Apps.

Why it matters to us: ShinyHunters is the same actor that hit Instructure last week, with the broader Salesforce-targeting campaign continuing across sectors. The campaign vector is identity-side rather than Salesforce-product-side, Connected App OAuth grant abuse, phishing of admin sessions, mis-scoped third-party SaaS integrations. EU/CH public-sector and finance tenants using Salesforce for partner / supplier / case-management data should audit Connected App OAuth grants (particularly to third-party AI SaaS integrations), enable Salesforce Event Monitoring with alerts on bulk Report Export events and high-volume SOQL API calls, enforce IP-range / Trusted-IP session policies, and consider Salesforce Shield field-level encryption for PII. T1078.004 (Cloud Accounts), T1530 (Data from Cloud Storage Object), T1567.002 (Exfiltration to Cloud Storage).