We've got one word for it, and it's usually the wrong one
Cisco Talos disclosed a complex WebDAV infection chain linked to a Russian threat actor (UAT-10820) targeting a Ukrainian government organization. The campaign delivers the Amatera stealer along with secondary payloads such as ZigCryptoStealer and NetSupport Manager. This operation appears opportunistic and broad-based, focusing on cryptocurrency and credential theft rather than a highly targeted attack. Attackers use creative delivery and evasion techniques, including abusing legitimate infrastructure like the BNB Smart Chain for bulletproof hosting and fake CAPTCHA prompts to bypass web filters. Secondary payloads include a vulnerable driver to terminate endpoint detection and response (EDR) software and unauthorized remote access tools, enabling persistent control over infected systems. Security teams are advised to monitor for unusual WebDAV activity and suspicious DLL execution via rundll32.exe ordinal calls, educate users about fake verification prompts, and ensure endpoint solutions have robust memory scanning capabilities. No patch information is provided for this threat. The disclosure also includes a broader discussion on cybersecurity workforce mental health but is unrelated to the technical threat.
AI Analysis
Technical Summary
Cisco Talos investigated an incident involving a complex infection chain exploiting WebDAV, attributed to the Russian threat actor UAT-10820. The campaign delivers the Amatera stealer and secondary payloads like ZigCryptoStealer and NetSupport Manager to steal cryptocurrency and credentials. The attackers leverage legitimate infrastructure such as the BNB Smart Chain for bulletproof hosting and use fake CAPTCHA prompts to evade detection by traditional web filters. Secondary payloads include a vulnerable driver to disable EDR software and unauthorized remote access tools, granting attackers deep and persistent system control. The operation is assessed as opportunistic and broad-based rather than highly targeted. Defenders should monitor WebDAV activity and suspicious rundll32.exe DLL executions, educate users against fake prompts, and enable memory scanning on endpoints. No specific affected software versions or patches are detailed in the disclosure.
Potential Impact
The threat enables attackers to steal cryptocurrency and credentials from infected systems, potentially leading to financial loss and unauthorized system access. The use of a vulnerable driver to terminate EDR software and deployment of unauthorized remote access tools increases the risk of persistent compromise and evasion of security controls. The campaign's opportunistic nature suggests a broad impact rather than targeted espionage or sabotage. No direct information on exploitation in the wild or patch availability is provided.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Security teams should monitor for unusual WebDAV activity and the execution of disguised DLLs through rundll32.exe using suspicious ordinal calls. User education is critical to prevent falling for fake CAPTCHA and verification prompts used in the attack. Endpoint security solutions should be configured for robust memory scanning to detect in-memory payloads like Amatera. Follow Cisco Talos advisories for updated indicators of compromise (IOCs) and mitigation recommendations.
We've got one word for it, and it's usually the wrong one
Description
Cisco Talos disclosed a complex WebDAV infection chain linked to a Russian threat actor (UAT-10820) targeting a Ukrainian government organization. The campaign delivers the Amatera stealer along with secondary payloads such as ZigCryptoStealer and NetSupport Manager. This operation appears opportunistic and broad-based, focusing on cryptocurrency and credential theft rather than a highly targeted attack. Attackers use creative delivery and evasion techniques, including abusing legitimate infrastructure like the BNB Smart Chain for bulletproof hosting and fake CAPTCHA prompts to bypass web filters. Secondary payloads include a vulnerable driver to terminate endpoint detection and response (EDR) software and unauthorized remote access tools, enabling persistent control over infected systems. Security teams are advised to monitor for unusual WebDAV activity and suspicious DLL execution via rundll32.exe ordinal calls, educate users about fake verification prompts, and ensure endpoint solutions have robust memory scanning capabilities. No patch information is provided for this threat. The disclosure also includes a broader discussion on cybersecurity workforce mental health but is unrelated to the technical threat.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Cisco Talos investigated an incident involving a complex infection chain exploiting WebDAV, attributed to the Russian threat actor UAT-10820. The campaign delivers the Amatera stealer and secondary payloads like ZigCryptoStealer and NetSupport Manager to steal cryptocurrency and credentials. The attackers leverage legitimate infrastructure such as the BNB Smart Chain for bulletproof hosting and use fake CAPTCHA prompts to evade detection by traditional web filters. Secondary payloads include a vulnerable driver to disable EDR software and unauthorized remote access tools, granting attackers deep and persistent system control. The operation is assessed as opportunistic and broad-based rather than highly targeted. Defenders should monitor WebDAV activity and suspicious rundll32.exe DLL executions, educate users against fake prompts, and enable memory scanning on endpoints. No specific affected software versions or patches are detailed in the disclosure.
Potential Impact
The threat enables attackers to steal cryptocurrency and credentials from infected systems, potentially leading to financial loss and unauthorized system access. The use of a vulnerable driver to terminate EDR software and deployment of unauthorized remote access tools increases the risk of persistent compromise and evasion of security controls. The campaign's opportunistic nature suggests a broad impact rather than targeted espionage or sabotage. No direct information on exploitation in the wild or patch availability is provided.
Defensive Guidance
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Security teams should monitor for unusual WebDAV activity and the execution of disguised DLLs through rundll32.exe using suspicious ordinal calls. User education is critical to prevent falling for fake CAPTCHA and verification prompts used in the attack. Endpoint security solutions should be configured for robust memory scanning to detect in-memory payloads like Amatera. Follow Cisco Talos advisories for updated indicators of compromise (IOCs) and mitigation recommendations.
Technical Details
- Classification
- {"confidence":0.3,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/","fetched":true,"fetchedAt":"2026-09-10T18:03:59.332Z","wordCount":1435}
Threat ID: 6aa2f10f555a9c51620a92ae
Added to database: 09/10/2026, 18:03:59 UTC
Last enriched: 09/10/2026, 18:04:06 UTC
Last updated: 09/10/2026, 19:31:03 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.