A malicious file identified by the SHA-256 hash 59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5 was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28 and July 15, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Germany and the United Kingdom. No known exploits or threat actors are currently linked to this indicator. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7 was observed in attacker activity between 2026-06-28 and 2026-07-15. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was detected by OffSeq Mirage honeypot sensors. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. Organizations are advised to match this hash against files in their environments and security tools.
A malicious file identified by the SHA-256 hash dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9 was observed by OffSeq Mirage honeypot sensors in attacker activity between 2026-06-28 and 2026-07-15. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This indicator can be used to detect or block the malicious payload in affected environments.
A malicious file identified by the SHA-256 hash 3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28 and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-06-28 and 2026-07-06. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB, DE. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 6 time(s) in attacker activity between 2026-06-24 and 2026-07-04. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in IT, KR, IR. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 38 time(s) in attacker activity between 2026-06-24 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in VN, SG, HK, BD, NZ, BR, MO, CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2,357 time(s) in attacker activity between 2026-06-24 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in IR, IN, MX, JP, BR, TW, PK, TR. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
Four coordinated npm supply chain campaigns were active during May and June 2026, targeting the npm ecosystem with various sophisticated techniques including dependency confusion, namespace compromise, scope confusion, and typosquatting. These campaigns employ multi-stage postinstall execution chains that fetch and run platform-specific payloads, aiming to steal environment variables, CI/CD secrets, cloud metadata service tokens, and other sensitive credentials. The campaigns affect multiple platforms (Windows, macOS, Linux) and cloud environments (GCP, Azure). Detection relies on identifying version sentinels, cloud metadata endpoint access patterns, and characteristic postinstall behaviors. An open-source scanner with detection capabilities for these campaigns is available for community use.
This entry references a Reddit post titled "I’ve got 99 problems, and IOCX isn’t one," linked to the IOCX project on GitHub. The content is categorized as security news related to malware and indicators of compromise (IOC), but it lacks technical details, affected versions, or exploit information. There is no evidence of active exploitation or vulnerability. The severity is noted as medium, but no CVSS score or patch information is provided.
IOCX is a security tool designed for deterministic extraction of Indicators of Compromise (IOCs) from files. It operates statically, is aware of Portable Executable (PE) file formats, and supports plugin extensibility. The tool was shared on the Reddit Malware subreddit and is intended for cybersecurity use. There is no indication that IOCX itself is a vulnerability or threat. No affected versions or exploits in the wild have been reported. The tool is not a cloud service and no patches or remediations apply.
This report discusses deterministic PE structural validation in IOCX version 0.7.3, referenced from a Reddit post in the Malware subreddit. The information is limited and primarily newsworthy rather than a detailed vulnerability or exploit analysis. There are no affected versions specified, no known exploits in the wild, and no patch or remediation details provided. The threat is categorized as medium severity based on the source data but lacks technical depth or confirmed impact.
IOCX version 0.7.1 is a security tool update focusing on improving robustness against malformed Portable Executable (PE) files, hostile strings, and enhancing static-analysis hardening. This update aims to strengthen the tool's resilience and reliability when analyzing potentially malicious files. There is no indication of a vulnerability or exploit associated with this update. The update is informational and relates to the tool's internal improvements rather than a security threat. No known exploits or active threats are linked to this version. The update is not a cloud service and no patch or remediation is applicable as this is a tool enhancement. The severity is assessed as medium based on the provided metadata, reflecting the importance of robustness in malware analysis tools but not indicating an active threat.
This information describes an update to a publicly available STIX feed used for sharing cyber threat intelligence indicators. The update improves the feed's structure by implementing proper STIX 2.1 object hierarchies, including IPv4Address SCOs with deterministic UUIDs and relationships linking indicators to malware families. This enhancement facilitates better integration and deduplication when used alongside multiple threat feeds, improving the accuracy and usability of threat intelligence platforms like OpenCTI. There is no direct security vulnerability or exploit described, and no known active exploitation in the wild. The update is a technical improvement to a threat intelligence feed rather than a new malware or attack vector. European organizations relying on threat intelligence feeds can benefit from more precise and interoperable data, but this does not represent a direct threat. The suggested severity is low since this is an intelligence feed improvement without direct impact on confidentiality, integrity, or availability.
A newly discovered Rust-based DDoS botnet exploits exposed Docker APIs on port 2375 to recruit compromised hosts. The malware uses asynchronous Rust libraries and obfuscation techniques to evade detection, with no antivirus engines initially detecting it. Its command-and-control (C2) protocol is weakly secured, lacking encryption and using predictable nonces and hardcoded credentials. The botnet infrastructure is centralized on a single server, which serves both malware distribution and C2 functions. The researcher developed a honeypot that impersonates infected bots to monitor ongoing DDoS targets in real time. This threat highlights the risks of exposed Docker APIs and the challenges traditional detection tools face with modern Rust-based malware. European organizations running Docker with exposed APIs are at risk of compromise and subsequent participation in DDoS attacks. Mitigation requires immediate restriction of Docker API exposure, network segmentation, and deployment of custom detection rules based on provided YARA and Snort signatures. Countries with high Docker adoption and significant internet infrastructure are most likely affected. The threat is assessed as medium severity due to moderate impact and exploitation complexity but notable evasion capabilities.
Operation PCPcat is a large-scale credential theft campaign that compromised approximately 59,000 Next.js servers within 48 hours by exploiting two remote code execution vulnerabilities (CVE-2025-29927 and CVE-2025-66478). Attackers extracted sensitive files such as . env files, SSH keys, and cloud credentials, installed persistent backdoors, and operated a publicly exposed command and control infrastructure. The campaign involves exploitation, data exfiltration, and backdoor installation. Organizations running Next.js in production are advised to patch vulnerable systems immediately and rotate all potentially compromised credentials. The threat is assessed as medium severity with potentially widespread impact due to the scale and sensitivity of data targeted. European organizations using Next.js may be particularly at risk.
RedTail cryptominer malware has been observed targeting exposed Docker APIs on port 2375/tcp, marking a new evolution in its attack surface. Previously known for exploiting PHP vulnerabilities, PAN-OS, and Ivanti products, this is the first public evidence of RedTail leveraging unsecured Docker endpoints. The malware communicates with a command and control server at IP 178.16.55.224 using a distinctive User-Agent string "libredtail-http. " There is no prior public documentation of RedTail targeting Docker, suggesting either a blind spot in threat intelligence or a recent tactical shift as of November 2025. Exploiting exposed Docker APIs allows attackers to deploy cryptominers directly on container hosts, potentially leading to resource exhaustion and operational disruption. European organizations using Docker with unsecured APIs are at risk, especially those in sectors with high container adoption. Mitigation requires immediate restriction of Docker API exposure, network segmentation, and enhanced monitoring for unusual Docker activity.
RondoDox v2 is a significantly evolved botnet variant that has expanded its exploit capabilities by 650%, now leveraging over 75 CVEs across 16 different architectures. Originally targeting DVRs and routers, it has broadened its scope to include enterprise systems, indicating a shift towards more valuable targets. The botnet employs new command and control (C&C) infrastructure hosted on compromised residential IP addresses, complicating detection and takedown efforts. Although no known exploits are currently observed in the wild, the botnet's increased sophistication and scale pose a high risk. The threat actor is identifiable by an open signature email, and detailed technical analysis including dropper behavior, binary decoding, and detection rules are available. European organizations face heightened risk due to the targeting of enterprise systems and the widespread use of vulnerable devices. Mitigation requires targeted patch management, network segmentation, deployment of YARA and IDS/IPS rules, and enhanced monitoring of residential IP traffic. Countries with large enterprise sectors and significant IoT device usage, such as Germany, France, Italy, and the UK, are most likely to be affected. Given the high impact on confidentiality, integrity, and availability, ease of exploitation, and broad scope, this threat is assessed as high severity.
RondoDox v2 is an advanced IoT botnet that has significantly expanded its attack surface, now supporting over 15 exploitation vectors and targeting enterprise environments beyond consumer devices. It supports 16 different CPU architectures and uses XOR obfuscation to evade detection. Command and control infrastructure is hosted on compromised residential IPs and multiple AWS EC2 instances, indicating a sophisticated and distributed setup. This evolution from a simple DDoS botnet to an enterprise-ready threat raises concerns about its potential impact on critical infrastructure and business networks. Detection rules and IOCs are available, including YARA and Snort/Suricata signatures. Although no known exploits in the wild have been reported yet, the high number of exploit vectors and expanded target scope make it a high-severity threat. European organizations, especially those with extensive IoT deployments and cloud infrastructure, should be vigilant. Countries with large enterprise sectors and significant AWS usage are particularly at risk. Immediate mitigation steps include deploying updated detection signatures, network segmentation, and enhanced monitoring of IoT devices and cloud assets.
Mateusz Lewczak explains how the AFD.sys driver works under the hood on Windows 11. In Part 1 [1], he demonstrates how to use WinDbg and the NtCreateFile call to manually craft a raw TCP socket, bypassing the Winsock layer entirely.
Part 2 of the series [2] dives into the bind and connect operations implemented via AFD.sys IOCTLs. Mateusz shows how to intercept and analyze IRP packets, then reconstruct the buffer needed to perform the three‑way TCP handshake by hand in kernel mode.
[1] https://leftarcode.com/posts/afd-reverse-engineering-part1/
[2] https://leftarcode.com/posts/afd-reverse-engineering-part2/
