Three unrelated intrusions and one research publication worked this week attacked the evidence a responder reconstructs afterwards rather than the sensor watching at the time — and two of the week's victims proved the same point from the defending side
Defence evasion is normally about the moment: stay under the rule, out of the signature, off the callback. Four disclosures this pipeline carried this week are about something else — they leave the alarm alone and corrupt the account of what happened, which is the thing a responder relies on days later when the question is scope rather than presence.
CrowdStrike's ESXi research is the cleanest statement of the class because the defect is not a bug at all. Testing obfuscation against a live host, the team catalogued "21 distinct techniques across six categories, for which no public tooling or proof-of-concept frameworks previously existed" — but the finding that matters for defenders is a property of the platform's logging: "The critical insight is that ESX shell logs capture commands during the parsing stage, before expansions occur." A command assembled from hexadecimal escapes executes identically to its plain form while the log entry preserves the obfuscated version, and CrowdStrike states the consequence plainly: "Any detection strategy that searches for the keyword \"esxcli\" would miss this command entirely" (CrowdStrike, 2026-08-07). The log is not missing. It is present, complete, and wrong about what ran — on the platform ransomware operators reach for when they want to encrypt an estate in one action.
Group-IB's case does the same thing to the identity axis. Investigating a covert Monero-mining intrusion that began through a trusted third-party relationship, its DFIR team found an actor who escalated to root once and then, rather than operating as root, abused the pam_rootok policy — which lets root use su without a password — to move between multiple low-privileged users, spreading redundant cron persistence across those unmonitored accounts so that remediating the root compromise alone would let the implant regenerate. Group-IB describes the operators as having "actively suppressed system visibility by disabling logging services and removing authentication logs to blind standard file-based monitoring" (Group-IB, 2026-07-30). The inversion is the point: a responder reading that authentication trail sees ordinary users doing ordinary things, which is precisely what a root-level intruder wanted it to say.
Sophos supplies the third variant, and it is the most uncomfortable, because the camouflage is the responder's own toolkit. In a March 2026 Interlock intrusion its incident-response team observed the operator capture a full physical-memory image with WinPmem — a legitimate acquisition tool — and then run Volatility3's windows.hashdump.Hashdump and windows.cachedump.Cachedump plugins offline against that image, rather than pointing a commodity credential dumper at the live host. Sophos states the difficulty directly: "In a legitimate use scenario, use of this command could be expected as part of a DFIR investigation, a security assessment, or malware analysis" (Sophos X-Ops, 2026-08-07). Its own discriminator in the engagement was not technical at all — the customer knew of no legitimate use. The fourth case moves the corruption into the authentication record itself: the six-agency joint advisory on the Gunra ransomware-as-a-service operation records that in one case the actors edited the authentication-processing files on a victim's VDI authentication portal so that one attacker-chosen one-time-password value always validated, a durable multi-factor bypass that survives password resets (FBI, CISA, DC3, NSA, USSS and Republic of Korea National Police Agency, 2026-08-10). An authentication log downstream of that edit records a successful second factor, truthfully and uselessly.
Two European public bodies demonstrated the defending side of the same problem in the same week, with no attacker sophistication involved. France's Direction générale des Finances publiques detected intrusions in June and July, cut the accounts, and ran access reviews that did not reveal that data had been stolen; the theft of records on 678,000 individuals and businesses was established only after the actor publicly claimed the access on 12 and 13 August (Ministère de l'Économie et des Finances, 2026-08-14). NHS Blood and Transplant, having broadcast transplant-patient names, dates of birth and clinical risk factors over an unencrypted paging network, cannot say who received them or how many people are affected, because pager broadcasts are one-way and receivers cannot be tracked (BBC News, 2026-08-14).
Triage: for the DFIR-tooling case, the discriminator Sophos used generalises — memory-acquisition and memory-analysis binaries have a legitimate profile that is narrow and knowable, so the test is whether the execution matches a known engagement rather than whether the tool is malicious. Concretely: acquisition tooling running on an endpoint with no open investigation, launched by an account that is not the incident-response team's, writing its image to a path outside the team's normal working location, or followed by credential-plugin execution against that image on the same host — legitimate practice usually moves the image to an analysis system rather than parsing it in place. For the identity-shuffle case, the signal is a sequence rather than an event: a root-level authentication followed by su transitions into several unrelated low-privileged accounts within a short window, with no corresponding interactive logon for those users and no change ticket — normal administrative work escalates toward privilege and stays there, it does not fan out downward across unrelated ordinary users. For the fixed-OTP backdoor, the discriminator is repetition where uniqueness is guaranteed by design: the same one-time-password value validating more than once, across sessions or accounts, is a property no working one-time-password implementation can produce.
The critical insight is that ESX shell logs capture commands during the parsing stage, before expansions occur.
Any detection strategy that searches for the keyword "esxcli" would miss this command entirely.
The campaign operators actively suppressed system visibility by disabling logging services and removing authentication logs to blind standard file-based monitoring.
In a legitimate use scenario, use of this command could be expected as part of a DFIR investigation, a security assessment, or malware analysis.
ATT&CK mapping
12 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Execution TA0002
T1053.003Scheduled Task/Job: Cron
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.
T1059.004Command and Scripting Interpreter: Unix Shell
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Persistence TA0003
T1053.003Scheduled Task/Job: Cron
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Privilege Escalation TA0004
T1053.003Scheduled Task/Job: Cron
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
T1070.003Indicator Removal: Clear Command History
In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1140Deobfuscate/Decode Files or Information
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
T1564.013Hide Artifacts: Bind Mounts
Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access.
Defense Impairment TA0112
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log
Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation. This data is used by security tools and analysts to generate detections.
T1685.006Disable or Modify Tools: Clear Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:
Credential Access TA0006
T1003.002OS Credential Dumping: Security Account Manager
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.
T1003.005OS Credential Dumping: Cached Domain Credentials
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.