35
Search: “US Special Operations Command”
161 stories
45
Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.
The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.
45
35
30
30
30
30
Risky Bulletin: Expired cards can be used for new transactions
Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.
University of Massachusetts Amherst researchers built an NFC man-in-the-middle rig that updates a card's expiration date in transit and relays the modified payment to POS terminals, reviving expired contactless cards; Visa terminals and the backends of all five banks studied failed to catch the manipulation. The same roundup reports Iranian hackers shut down a small UK power plant for four days, Lazarus breached South Korea's Presidential Office as part of a campaign exceeding 100 victims, and French telecom SFR suffered a breach affecting over 2.1 million customers.
55
30
30
A Deep Dive Into Attempted Exploitation of CVE-2023
Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.
Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.
52
30
MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies
Unit 42 names MILE TEA, a cyber-espionage campaign since 2011 targeting Japanese and Taiwanese businesses and government agencies with e-ticket phishing lures and Elirks-family malware.
Unit 42 tracks the MILE TEA espionage campaign, observed as early as 2011, targeting Japanese trading, petroleum, and mobile companies, a Beijing office of a Japanese public organization, and a Taiwanese government agency. The primary infection vector is spear-phishing emails with attachments, mostly custom executable installers posing as flight e-tickets, dropping Elirks, Micrass, or Logedrut as initial bridgehead malware. Elirks and Logedrut retrieve encrypted C2 addresses from attacker-posted blog articles, decoded with Base64 and TEA or DES ciphers. The campaign's focus shifted from Taiwan to Japan around 2013.
45
30
30
30
45
BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
Group-IB details BraZetsu, a modular Python Windows malware that monetizes compromised-host access through the Infected Marketplace for initial access brokers.
Group-IB attributes BraZetsu to the Exilware threat actor, believed to be native Portuguese speakers targeting Iberian and Latin American e-commerce, financial, industrial, and law enforcement victims. The framework, first observed in early May 2026, uses generative AI for data triage and target prioritization, steals browser histories and digital certificates, and hunts Brazilian CNAB financial remittance files. Access to compromised hosts is sold on the Infected Marketplace from roughly $5.80, letting buyers remotely deploy secondary payloads over WebSocket-linked infrastructure. Some samples evaded detection on VirusTotal; delivery likely uses VBS loaders from a domain also used to distribute the Ousaban banking trojan.
45
30
35
30
30
Anthropic: AI Misuse Is Entering a New Phase: From Cybercrime to Surveillance, Propaganda and Weapons
Anthropic's threat intelligence report documents AI misuse scaling cybercrime, surveillance, propaganda, and weapons development from December 2025 to August 2026.
Anthropic's September 2026 threat intelligence report covers malicious activity disrupted between December 2025 and August 2026, spanning cyber operations, influence campaigns, surveillance, fraud, and weapons. One operator (aliases MeowSHA/frkoo/blazespider) ran a credential-harvesting pipeline on 10 AWS EC2 workers that downloaded and scanned 1.8 million Android APKs for hardcoded secrets, feeding confirmed breaches. Claude was abused to build malware, phishing tools, and a mass-interception platform used by Malian national security authorities, with actors linked to China, Iran, and West Africa.
65
30
30
The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia
Unit 42 uncovers the Fractured Block campaign using the CARROTBAT dropper to deliver SYSCON and OceanSalt malware in cryptocurrency-themed attacks across Southeast Asia.
Unit 42 identified 29 CARROTBAT dropper samples used in the Fractured Block campaign, delivering decoy documents on cryptocurrencies, exchanges, and Korean political topics. Early samples delivered the SYSCON RAT, which uses FTP for command and control, while later ones dropped the previously reported OceanSalt malware. CARROTBAT supports 11 decoy file formats and uses certutil to download and execute payloads. Initial discovery stemmed from a December 2017 spear phishing attack on a British government agency, with infrastructure overlap tying the campaign to KONNI activity.
42
30
30
30
45
30
30
30
30
35
30
45
45
30