Investigation on the EmEditor Supply Chain Cyberattack

A recent supply chain attack targeting EmEditor users has been uncovered, involving watering hole tactics. The investigation reveals multiple domains masquerading as EmEditor-related sites, all registered through NameSilo LLC in December 2025. The domains resolve to various IP addresses, with some changes observed in February 2026. Additional domains with similar patterns were discovered, along with peculiar HTTP header behavior. A potential early stage of the campaign was identified, sharing similar characteristics with the initial report. The attackers continued their activities even after exposure, utilizing PowerShell scripts and various domains for command and control purposes. The analysis provides a comprehensive list of indicators, including domain names, IP addresses, and file hashes associated with the attack.

• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsMalware2026-10-22
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsMalware2026-10-21
• LiteLLM supply chain compromiseCampaign2026-10-22
• Dissection of Operation FlashHole, a complex attack by LazarusMalware2026-10-21
• AOMEI Backupper update servers hijacked to push malware: Check your PCMalware2026-10-19