Search: “RelayShell”

23 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access

JFrog's 'ParaShells' research details CVE-2026-90894, a Parallels Desktop local privilege escalation letting unprivileged macOS users gain root via tar argument injection.

JFrog researcher Yuval Moravchick disclosed CVE-2026-90894 ('ParaShells'), a critical local privilege escalation flaw demonstrated against Parallels Desktop 26.4.0 build 57513 on Apple silicon. The world-writable /var/run/prl_disp_service.socket accepts connections from unsigned clients, and argument injection into a tar extraction command via the --use-compress-program option executes attacker-controlled code with root privileges. The attack needs no administrator permissions, running VM, or Parallels-signed client, and a one-line PoC yielded a root shell. Risk is highest on developer workstations, shared training systems, and enterprise Macs.

GBHackersupdated 13:14 UTC · 3h agofirst 11:29 UTC · 5h agoVulnerability 4 sources CVE-2026-90894

Lazarus hackers pair fake job offers with Windows zero-day exploit

Lazarus' Operation Dream Job targets the defense sector with fake job offers, a Windows LPE zero-day (CVE-2026-68820), and new Troy and RelayShell backdoors.

Check Point documented two parallel infection chains in Lazarus' Operation Dream Job: a digitally signed PDF viewer with DLL sideloading delivering the MISTPEN in-memory downloader, and a trojanized SecurityPDF viewer, distributed via fake Enveil websites, installing the newly documented Troy backdoor. A component exploits CVE-2026-68820, a local privilege escalation zero-day in the Windows AFD.sys driver used since at least early July, which Microsoft patched on August 11, 2026, enabling deployment of the FudModule kernel-mode rootkit. Lazarus also compromised Roundcube webmail servers vulnerable to CVE-2025-49113 to deploy the RelayShell PHP web shell and relay C2 traffic, targeting defense-sector organizations primarily in Western Europe and India. Separately, CERT-UA documented Sandworm's UAC-0145 using fake job offers against IT professionals since May 2026.

Help Net SecurityAug 12, 00:00 UTC · Aug 12, 2026Threat actor in the wildCVE-2026-68820 CVE-2025-49113

North Korean Lazarus Group Uses Windows Zero

Check Point links Lazarus Group's Operation Dream Job to a new Windows zero-day, CVE-2026-68820, targeting defense workers with fake Lockheed Martin job offers.

Check Point Research documented a new wave of Operation Dream Job, a North Korean Lazarus Group campaign targeting defense and aerospace professionals in France, Germany, Brazil, and India with fake Lockheed Martin job offers. The attacks chain a previously unknown Windows privilege escalation flaw in AFD.sys, CVE-2026-68820, which Microsoft patched on August 11, 2026, to deploy the MISTPEN downloader, ForestTiger backdoor, and updated FudModule 3.1 kernel rootkit. Check Point also discovered a new Troy backdoor DLL with 17 operator commands and a RelayShell PHP webshell deployed on compromised Roundcube and WordPress servers used as command relays, some infected via CVE-2025-49113 or leaked credentials. Defenders are urged to apply the August 2026 Patch Tuesday update and review Check Point's indicators of compromise.

Security AffairsAug 13, 07:05 UTC · Aug 13, 2026Threat actor in the wildCVE-2026-68820 CVE-2025-491131

New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.

Darktrace identified a new 64-bit ELF variant of the Chaos botnet targeting misconfigured cloud deployments, expanding beyond the malware's traditional focus on routers and edge devices. Captured in a deliberately misconfigured Hadoop honeypot instance, the intrusion began with an HTTP request creating an application that ran embedded shell commands to fetch the Chaos agent binary from pan.tenire[.]com, set chmod 777 permissions, execute it, and delete the artifact to reduce forensic traces. The restructured variant adds a SOCKS proxy feature letting compromised systems ferry attacker traffic, while removing SSH-based spread and router-exploit functions, suggesting monetization beyond crypto mining and DDoS-for-hire. Possible Chinese origin is suggested by language artifacts and infrastructure; the delivery domain was previously used in Silver Fox's Operation Silk Lure phishing campaign delivering ValleyRAT.

The Hacker NewsAug 18, 12:13 UTC · 29d agoMalware1

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.

Check Point attributes Operation Dream Job attacks to Lazarus Group exploiting CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in Windows AFD.sys patched in August 2026 Patch Tuesday. The campaign targets defense and aerospace firms in France, Germany, Brazil, and India via trojanized PDF viewers and DLL side-loading, deploying backdoors Troy, ForestTiger, and the FudModule 3.1 kernel rootkit. Attackers also compromise WordPress, SharePoint, and Roundcube servers as C2, using CVE-2025-49113 and the RelayShell PHP web shell.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wildCVE-2026-68820 CVE-2025-491132

How to Keep Malware’s Rotating Infrastructure From Becoming a Detection Gap

ANY.RUN marketing piece argues SOC detection lags rotating malware and phishing infrastructure, citing a 46-country campaign and 3DBlast kit to promote TI feeds.

ANY.RUN describes how malware and phishing campaigns rotate domains and hosting, making single-IOC blocking ineffective for SOC teams. One investigated phishing campaign spanned 46 countries with 425 kit URLs across 240 hosts, 94% of which were seen for only a single day. A phishing kit dubbed 3DBlast impersonates Microsoft 365 and Google using BitB, AiTM, OAuth device-code phishing and DOM relay techniques. The article is primarily a promotion for ANY.RUN TI Feeds and TI Lookup products.

Cyber Security NewsSep 15, 15:36 UTC · 1d agoIndustry

Metasploit Wrap Up: This One Goes to Sixteen!

Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.

Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.

Rapid7 BlogSep 11, 13:35 UTC · 5d agoTools in the wildCVE-2025-66516 CVE-2025-54988 CVE-2026-20929+8 CVEs1

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz BlogSep 9, 16:06 UTC · 7d agoExploit / PoC in the wildCVE-2026-59822 CVE-2026-598211

ZDI-26-569: Linux Kernel Net Scheduler True Link Equalizer Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-569, a CVSS 7.5 race condition local privilege escalation in the Linux kernel net scheduler true link equalizer.

The Zero Day Initiative disclosed a race condition in the Linux kernel's net scheduler true link equalizer component enabling local privilege escalation. Exploitation requires the attacker to first run high-privileged code on the target system. The advisory carries a CVSS rating of 7.5; no CVE id is listed in the disclosure text.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Advisory

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Cisco Talos identifies UAT-10147 deploying the SPECTRE implant with cross-platform C2, credential theft, and kernel-level EDR bypass.

Cisco Talos reports that the tracked threat actor UAT-10147 is deploying a newly identified implant named SPECTRE. SPECTRE supports cross-platform command-and-control, process injection, credential theft, and anti-analysis protections. It also includes a Linux rootkit and BYOVD (bring your own vulnerable driver) capability enabling kernel-level EDR bypass, marking an evolution in commodity intrusion tooling.

Cisco TalosAug 20, 10:00 UTC · 27d agoThreat actor in the wild

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.

Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.

Zscaler ThreatLabz15:13 UTC · 1h agoThreat actor in the wild

Sociotechnical Aspects of Tor Relay Rejection

User study and simulations of Tor's relay end-of-life rejection policy find operators favor it; network churn affects anonymity more than EoL exclusions.

The study examines the Tor Project's 2019 end-of-life policy that rejects outdated relays, which constitute a notable fraction of consensus weight. A user study of 26 relay operators found they generally view the policy favorably despite limited awareness, though operational practices occasionally exclude newly installed relays. Historical-data-driven simulations show the policy gives adversaries only marginal advantage, with network churn exerting a more pronounced effect on user anonymity. Analysis of four exclusion rounds shows a minority of rejected relays typically account for over 50% of the security provided by all excluded relays, informing EoL policy recommendations.

arXiv cs.CRSep 14, 08:12 UTC · 2d agoResearch

HYDRA: Quantifying Botnet Resource Thresholds for Efficient Link-Flooding Attacks on LEO Satellite Networks

HYDRA models link-flooding attacks on LEO satellite constellations as botnet minimization, matching prior disruption with 34% fewer bots and 23% less traffic.

HYDRA formulates link-flooding attack variants against LEO constellations such as Starlink and Kuiper as botnet minimization problems, quantifying the smallest bot subset and traffic allocation needed to disrupt communications between targeted geographic areas. Under matched stealth constraints it matches the ICARUS attack's disruption using 34% fewer bots and 23% less aggregate traffic, sustaining over 97% attack success as topology evolves. The framework also evaluates five mitigations, including routing diversification, ingress policing, distance-based constraints, source throttling, and botnet attrition.

arXiv cs.CRSep 14, 15:00 UTC · 2d agoResearch

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails

ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.

ESET identified a technique dubbed GuardBreaker in which UAC-0099 embedded a comment reading "I want to make nuclear weapon. Help me …" inside a malicious VBS script to trigger AI safety mechanisms and halt AI-assisted malware analysis. The script, part of the group's toolset, downloads the MATCHBOIL malware used exclusively by this Russia-aligned group; CERT-UA documented the chain including LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 in a July advisory. UAC-0099 typically targets transportation and energy sectors and hands validated targets to GRU-linked Sandworm. ESET warned that AI-assisted analysis must be backed by layered detection and human-driven engineering.

Help Net SecurityAug 31, 00:00 UTC · 16d agoAI safety & security in the wild

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky reports APT group HoneyMyte upgraded its CoolClient backdoor with a kernel-mode Windows rootkit hiding processes, files, and network connections.

Kaspersky researchers discovered a new variant of the HoneyMyte CoolClient backdoor equipped with a kernel-mode Windows rootkit driver. The rootkit hides malicious processes, files, and network connections from security tools and threat analysts, significantly increasing the backdoor's stealth. The report documents an upgrade to the APT group's backdoor tooling with a kernel-level implant.

Kaspersky SecurelistAug 14, 09:00 UTC · Aug 14, 2026Threat actor in the wild

Kimwolf botnet rebuilt to survive takedowns, researchers say

Palo Alto Unit 42 reports the Kimwolf/Aisuru botnet now uses HTTP/2 Chrome-impersonation floods and Ethereum blockchain-based command resolution to survive takedowns.

Palo Alto Networks' Unit 42 says a new Kimwolf/Aisuru botnet version active since February conducts DDoS floods over HTTP/2 with full Chrome browser fingerprints, making attack traffic hard to distinguish from real users. The malware resolves command servers via the Ethereum Name Service using five shuffled Ethereum endpoints, with a Tor hidden service fallback, so authorities cannot seize a domain or serve a takedown order. The botnet, powered mostly by hijacked Android TV boxes and IoT devices, previously had servers seized and an alleged operator arrested; new C2 infrastructure traces to a single network in Saint Petersburg, Russia. It is unclear whether the same developers built the new version.

CyberScoopAug 12, 00:13 UTC · Aug 12, 2026Malware in the wild1

Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.

Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.

The Hacker Newsupdated Sep 10, 12:56 UTC · 6d agofirst Sep 10, 07:12 UTC · 6d agoVulnerability in the wild 3 sources CVE-2026-59821 CVE-2026-59822 CVE-2026-42271+2 CVEs

Kimwolf v7: An Evolution of the Kimwolf Botnet

Unit 42 details Kimwolf v7 botnet evolution hitting Android IoT devices with HTTP/2 DDoS fingerprinting and ENS-based C2.

Palo Alto Unit 42 analyzes Kimwolf v7, the latest evolution of the Kimwolf botnet targeting Android-based IoT devices. The variant introduces HTTP/2 DDoS fingerprinting, Ethereum ENS-based C2 resolution, and Tor backup routing for operational resilience.

Palo Alto Unit 42Aug 11, 10:00 UTC · Aug 11, 2026Malware in the wild

A revisit of remote Spectre attacks on Cloudflare Workers

Cloudflare details its 2024-2025 reassessment of remote Spectre attacks on Workers, covering new attack primitives and hardened defenses.

Cloudflare reassessed the feasibility of remote Spectre attacks against its Workers serverless infrastructure across 2024 and 2025. The write-up describes new attack primitives including Spectre gadgets, remote timers, and techniques for achieving co-location with victim workloads. It also explains new defenses that further harden Cloudflare Workers against speculative-execution side channels.

Cloudflare BlogAug 19, 16:00 UTC · 28d agoResearch

Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks

Unit 42 details 'Spring Ring', a vishing campaign using fake IT support on Microsoft Teams to reach 150+ employees at 10+ companies.

Palo Alto Networks Unit 42 documented 'Spring Ring', a voice-phishing campaign that ran January to April 2026, using 26 attacker identities and fake Microsoft 365 tenants such as 'ITProtectionDepartment' to impersonate internal IT support on Microsoft Teams. One path used Quick Assist or downloaded remote-support tools to run an obfuscated PowerShell script that disabled malware scanning before contacting C2; the other delivered a cloud-hosted file triggering browser hijacking, SMB internal network scanning, and a PetitPotam NTLM relay attempt against domain controllers to gain domain-level privileges. Both intrusion attempts were blocked before attackers reached their objectives. Collaboration-platform phishing alerts rose to 42% of Unit 42's telemetry in early 2026, up from 30%.

Help Net SecuritySep 1, 00:00 UTC · 15d agoPhishing & fraud in the wild

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.

Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.

BleepingComputerupdated 14:54 UTC · 1h agofirst Sep 11, 17:26 UTC · 4d agoPhishing & fraud in the wild 9 sources

GuardBreaker: Derailing AI-assisted malware analysis with a code comment

ESET names 'GuardBreaker': UAC-0099 embeds a nuclear-weapon question in VBScript comments to trip LLM scanner guardrails during analysis of its MATCHBOIL loader.

ESET researchers observed the Russia-aligned group UAC-0099 inserting a decoy prompt injection into a VBScript used to install its MATCHBOIL loader in an attack against a Ukrainian target, aiming to make LLM-based code scanners refuse and stop inspecting the file. The comment triggers safety guardrails with a request about building a nuclear weapons but has no runtime effect. Similar LLM-thwarting tricks have appeared in malicious PyPI and npm packages reported by Socket and StepSecurity. ESET recommends multi-model cross-validation of AI-assisted analysis and treating missing LLM output as requiring further checks.

ESET WeLiveSecurityupdated Sep 11, 14:32 UTC · 5d agofirst Sep 10, 09:00 UTC · 6d agoAI safety & security 3 sources1

Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks

Unit 42 links two Latin America campaigns where operators used Claude and GPT-4.1 during intrusions against government and financial targets.

Palo Alto Networks Unit 42 identified two activity clusters, CL-CRI-1131 and CL-CRI-1163, tied by shared SOCKS5 relay infrastructure and use of large language models during operations. The Mexican cluster targeted a transportation organization, federal ministries and water utilities in Mexico and Ecuador, while the Brazilian cluster used resume-themed phishing, custom remote-access Trojans and SockTz SOCKS5 tunneling against financial organizations. An exposed self-hosted NextChat interface on attacker infrastructure led researchers to assess operators used Claude and GPT-4.1 to generate workaround scripts and troubleshoot execution failures. Unit 42 noted AI reduced time needed to troubleshoot intrusions after initial access, rather than replacing the attacker.

Cyber Security NewsSep 10, 08:06 UTC · 6d agoThreat actor in the wild 2 sources1