30
30
45
30
35
30
45
30
30
45
45
30
30
30
Tracking OceanLotus’ new Downloader, KerrDown
Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.
Unit 42 tracks KerrDown, a previously undocumented downloader family used by OceanLotus (APT32) since at least early 2018, primarily targeting Vietnam or Vietnamese-speaking individuals. Delivery uses macro-laced Microsoft Office documents embedding base64-encoded 32-bit and 64-bit DLLs, and RAR archives containing a legitimate program abused for DLL side-loading. KerrDown is dropped as main_background.png, downloads a DES-encrypted payload from a URL, and executes it directly in memory. Researchers used Jaccard-index similarity analysis to identify the new family, connect campaign samples, and infer patterns in the group's working hours and days.
52
30
30
30
ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.
The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.
12
45
45
Attackers Japan Cobalt Strike
Attackers reportedly used Cobalt Strike in a campaign targeting organizations in Japan.
Infosecurity Magazine's headline indicates attackers used Cobalt Strike in attacks against targets in Japan. Cobalt Strike is a commercial post-exploitation framework widely abused for command and control by both criminal and espionage threat actors. The headline provides no further detail on victims, scope, or attribution.
40
30
45
30
30
30
45
45
45
35
30
45
30
30
30
30
30
30
35