Threats Tagged 't1003.002'

Three exposed directories on infrastructure at 45.142.193[.]132 revealed an AI-orchestrated campaign targeting PaperCut NG/MF print management software. The exposed workbench contained AI-agent instructions, exploit code, operational logs, and post-exploitation tooling. Attackers exploited CVE-2026-81578 and CVE-2026-82078 through a Tapestry vulnerability chain, and developed a second RCE path via XML-RPC API abuse. The campaign deployed automated exploitation at scale using hundreds of AI agents running through OpenAI Codex and DeepSeek models. Post-exploitation activity included Windows credential harvesting, LSA secret extraction, reverse SOCKS5 pivoting using chisel, Metasploit automation, and Active Directory domain compromise. The actor's files documented 1,005 hosts across 45 countries in their reconnaissance pool, with 46 confirmed Active Directory domain compromises and 45 targets maintaining live internal access pivots at time of discovery.

This report details the first confirmed incident where AI-driven agents executed a complex attack on an Apache Tomcat server running Spring Batch. Attackers exploited an exposed job-submission endpoint that required no authentication or zero-day vulnerabilities. Using the open-source Cairn AI agent orchestration platform, the attackers executed commands via JavaScript through the Nashorn engine, extracting data in small chunks over many requests. They obtained plaintext database credentials, enabled xp_cmdshell, and escalated privileges to SYSTEM using known tools such as PrintSpoofer and GodPotato. The attackers extracted registry hives, created administrator accounts, and deleted artifacts. The attack was characterized by automated, rapid command execution and structured output formatting, indicating machine-driven orchestration.

In Q3 2026, attackers targeted Windows-based MS-SQL and MySQL database servers using brute-force, dictionary attacks, and vulnerability exploitation. They deployed cryptocurrency miners (XMRig), backdoors (GotoHTTP), SoftEther VPN infrastructure, and various web shells for persistence. Additional tools included VShell for remote command execution, HackBrowserData for credential theft, Fscan for reconnaissance, and Cloudflared for port exposure. Attackers created backdoor RDP accounts and used SoftEther VPN servers as command and control infrastructure. The attacks mainly exploited weak passwords, poor account management, and insufficient security on exposed database servers.

Two multi-stage network intrusion campaigns are actively targeting organizations in Latin America, specifically in Mexico, Ecuador, and Brazil. The Mexican campaign targets transportation and government entities using living-off-the-land techniques and self-hosted NextChat instances. The Brazilian campaign targets financial organizations with custom remote access trojans (RATs) and tunneling tools, including a Go-based SOCKS5 proxy. Both campaigns leverage AI tools such as Claude and GPT-4.1 to generate scripts and troubleshoot operations. Operational security failures by attackers, including exposed staging directories and unsecured interfaces, have allowed defenders visibility into their activities. Indicators include multiple duckdns.org domains, an IP address, and various file hashes. There are no known exploits in the wild or confirmed active threat actors at this time.

MediumCampaignBrazilEcuadorMexico#phishing campaign#socktz#nextchat

An exposed open directory at a staging server revealed an active intrusion by operators linked to The Gentlemen ransomware group. The operation involved establishing persistent access through privileged account creation, credential theft via LSASS dumping, and lateral movement across a Windows domain. Attackers deployed multiple implants including EtherRAT, which retrieves command-and-control domains from an Ethereum smart contract, alongside Sliver and custom Go reverse shells. Lateral movement was achieved through remote scheduled tasks distributing MSI payloads, while security products were disabled and reverse tunnels established for persistent access. The infrastructure and tactics align with previously documented The Gentlemen campaigns, including a ClickFix operation deploying EtherRAT.

Since late 2025, government and diplomatic entities in Southeast Asia have been targeted by sophisticated attacks involving GoSerpent, a Go-based RAT with proxy capabilities. The malware receives encrypted arguments and deploys additional tools for data collection and credential dumping. GoSerpent has been active since 2021, with newer variants using AES-CBC encryption and ChaCha20 for communications. The campaign involves multiple stages: initial deployment of GoSerpent and ThumbcacheService to collect sensitive files, credential dumping via Mimikatz and QuarksDumpLocalHash, followed by deployment of Stowaway RAT in May 2026 and TmcLoader/TmcPayload for stealthy data exfiltration through network shares. The integrated toolset demonstrates sophisticated operational planning, with attackers leveraging Alibaba Cloud and UCLOUD HK infrastructure while exhibiting possible connections to the TetrisPhantom threat actor.

A previously unseen ransomware family named Spirals was deployed in a double extortion attack against an IT services company in South Asia in June 2026. The Rust-based payload demonstrated sophisticated capabilities including defense evasion, encryption, lateral movement, and privilege escalation. Attackers gained initial access through a compromised internet-facing IIS web server via an ASP.NET web shell, moving rapidly to deploy ransomware within 24 hours. They established persistence using multiple tunneling tools, disabled endpoint security, harvested credentials through SAM hive and LSASS dumps, and deployed reverse-SOCKS proxies for covert command-and-control. The ransomware was distributed across the network using PsExec, encrypting files with AES-128 keys and threatening data publication within six days. The skilled execution suggests potential for wider campaigns, though the threat actor remains unidentified.

An exposed attacker server has unveiled FortiBleed, a large-scale credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways globally. This operation involved credential harvesting through reuse, brute force, and hash cracking using a distributed GPU infrastructure with approximately 36 rented GPUs via Hashtopolis. The exposed directory contained 319 files revealing scanning tools, cracking infrastructure, credential databases, post-exploitation toolkits, and active VPN configurations. While initially reported as affecting 21,632 domains, analysis of the attacker's own tooling reveals only 918 organizations showed evidence of internal network compromise, with merely 148 confirmed cases where credentials were fully cracked. The operation ultimately aimed to sell initial access to compromised networks, with victims spanning 194 countries, predominantly India, United States, and Taiwan.

MediumCampaignUnited StatesBritish Indian Ocean TerritoryColombia+3#vpn compromise#hash cracking#fortibleed

Iranian state-sponsored threat group Seedworm conducted a widespread espionage campaign in early 2026, compromising at least nine organizations across nine countries on four continents. Victims included a major South Korean electronics manufacturer, government agencies, an international airport in the Middle East, Southeast Asian industrial manufacturers, a Latin American financial services provider, and educational institutions. The attackers utilized DLL sideloading techniques with legitimately signed Fortemedia and SentinelOne binaries to execute malicious payloads, deployed Node.js-based implants for orchestration, and employed multiple PowerShell scripts for reconnaissance, credential theft, and privilege escalation. Data exfiltration was conducted through public file-transfer service sendit.sh to blend malicious traffic with legitimate cloud services. The campaign demonstrates Seedworm's evolved tradecraft and expanded targeting beyond traditional Middle Eastern focus areas.

An exposed command and control server on RouterHosting infrastructure revealed an active Iranian-nexus intrusion campaign targeting twelve Omani government ministries. The operation primarily focused on the Ministry of Justice and Legal Affairs, deploying custom webshells that provided persistent access through April 2026. Over 26,000 user records containing judicial case data, committee decisions, and registry hives were exfiltrated. The attacker utilized ProxyShell exploits, DotNetNuke vulnerabilities, and custom Python scripts targeting Exchange servers, SQL databases, and Oracle systems. Infrastructure analysis revealed connections to spoofed Iranian diaspora media and censorship circumvention tools, with tactical overlaps indicating MOIS-linked groups such as APT34 and MuddyWater. The campaign specifically targeted judicial records, immigration systems, and citizen identity data across multiple government entities.

MediumMalwareOman#proxyshell#apt34#iranian-nexus