Securonix (Organization): news timeline & CVEs

Check Point hacked: The security software protecting your network has become a prime attack target

Attackers are exploiting two pre-authentication Check Point firewall flaws rated CVSS 9.8.

Check Point said attackers are actively exploiting CVE-2026-85102, a pre-authentication remote code execution flaw in Spark small-business firewalls triggered by a malicious certificate during VPN negotiation, and CVE-2026-93616, a pre-authentication path-traversal zero-day in the Security Management web service that can execute scripts and load an arbitrary Java class. Both are rated CVSS 9.8. Targeted attacks on the management flaw were observed on 23 July, with a fix about two months later; the Spark bug was patched on 9 September and exploited by 12 September. Both were added to the known-exploited vulnerability catalog, and Check Point urges immediate patching plus hunts for anomalous certificate logins and internal scans.

CSO Onlineupdated Sep 25, 10:30 UTC · 1d agofirst Sep 24, 02:05 UTC · 3d agoExploit / PoC in the wild 15 sources CVE-2026-85102 CVE-2026-93616

Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page

Three Elsevier domains, including manuscript portal submit.elsevier.com, redirected for 78 minutes to a LAPSUS$ extortion page taunting the FBI.

On September 21, 2026, elsevier.com, evolve.elsevier.com and submit.elsevier.com redirected to a page branded 'LAPSUS$ GROUP, Chapter II' carrying a signed statement mocking the FBI and counting down to a future victim. Cloudscope researchers say the redirect ran at least 78 minutes (7:49pm to before 10:09pm CT) and was likely caused by a DNS record, CDN redirect rule, or management-account change; a Chinese forum post claiming altered Cloudflare redirect rules could not be verified. Elsevier has offered no explanation or statement on possible credential theft. Securonix found no evidence of personnel continuity with the original 2021-2022 LAPSUS$ cluster, though a 2026 LAPSUS$-branded leak site named Virta Health, Vodafone Germany and AYA Bank.

Help Net Securityupdated Sep 23, 15:08 UTC · 3d agofirst Sep 22, 13:46 UTC · 4d agoData breach in the wild 3 sources

New TASK#STOMP Backdoor Uses PowerShell to Steal Documents and Wi-Fi Passwords

Securonix documents new TASK#STOMP PowerShell backdoor stealing documents, Wi-Fi passwords, clipboard data and screenshots with layered persistence.

Securonix analyzed TASK#STOMP, a Windows backdoor delivered by a randomly named VBS installer that deploys hidden PowerShell branches using runtime C# compilation via csc.exe. It searches fixed drives for Word, PDF, PowerPoint, Excel and archive files changed within the past year (skipping files over 500 MB), uploads them to C2 servers corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz, dumps stored Wi-Fi keys with netsh, and copies clipboard content and screenshots. Persistence uses four scheduled tasks built from XML files plus a Startup-folder VBS, with file timestamps changed to January 15, 2024 and failover between two C2 channels that accept invalid TLS certificates.

Cyber Security NewsSep 22, 13:45 UTC · 4d agoMalware in the wild 4 sources

TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands

TASK#STOMP Windows backdoor combines VBScript, PowerShell, scheduled tasks, and runtime C# compilation for resilient document theft and remote command execution.

Securonix documented TASK#STOMP, a Windows backdoor whose VBScript installer stages under %LOCALAPPDATA%\WinDefendSvc, registers four scheduled tasks, and drops a Startup-folder script that can restore removed components on sign-in. Two hidden PowerShell modules search fixed drives for business documents (Office files, PDFs, archives under 500 MB), capture screenshots, extract Wi-Fi passwords via netsh, harvest clipboard data, and execute arbitrary PowerShell via Invoke-Expression. Stolen data goes to dual token-authenticated C2 servers (corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz), and an Add-Type-compiled C# helper disables TLS certificate validation. The initial access vector is unconfirmed.

GBHackersupdated Sep 22, 13:45 UTC · 4d agofirst Sep 22, 11:34 UTC · 4d agoMalware in the wild 4 sources

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

Securonix details TASK#STOMP, a PowerShell backdoor stealing documents, Wi-Fi passwords, and clipboard data.

Securonix researchers disclosed TASK#STOMP, a campaign that uses wscript.exe to run an encoded VBScript and install a PowerShell backdoor. The malware harvests business documents, Wi-Fi passwords, clipboard contents, and screenshots, watches for new files, and accepts remote commands. Persistence uses disguised scheduled tasks plus a Startup-folder script, with redundant command-and-control at corecloudfileshare.xyz and attachmentsharingdrive.xyz. Initial access is unclear, though phishing is possible, and the chain later opens an Iranian government tenders site in Chrome.

The Hacker Newsupdated Sep 22, 13:45 UTC · 4d agofirst Sep 21, 14:15 UTC · 5d agoMalware in the wild 4 sources

FBI's CJIS v6.1: What Security Teams Need to Know.

FBI’s CJIS v6.1 policy updates encryption and vulnerability management requirements with no direct impact on exploits.

FBI’s CJIS v6.1 policy updates encryption and vulnerability management requirements, with no direct impact on exploits or security incidents.

BleepingComputerSep 21, 14:02 UTC · 5d agoOther

The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files

Securonix dissects TASK#STOMP, a Windows backdoor exfiltrating business documents, Wi-Fi passwords, screenshots, and clipboard data via five persistence footholds.

Securonix researchers Akshay Gaikwad and Aaron Beardslee analyzed TASK#STOMP, a Windows backdoor that starts from a VBScript and plants four scheduled tasks mimicking Windows components plus a Startup-folder copy. Two hidden PowerShell modules steal documents in priority order (Word, PDF, PowerPoint, Excel, then archives), maintain a C2 channel with a backup server, and restart each other; the malware also grabs saved Wi-Fi passwords, clipboard text, and screenshots. Attribution is withheld, but an 'IranTenders'-themed decoy domain suggests procurement or Iran-related trade targeting, and a static hardcoded authentication token is a high-confidence network IOC. Likely delivery is a phishing email with ZIP or ISO/IMG attachments.

Help Net Securityupdated Sep 22, 13:45 UTC · 4d agofirst Sep 21, 14:00 UTC · 5d agoMalware 4 sources

Securonix

Timeline7 articles

Related CVEsby mentions

Appears with