Elektrine
Log in Register

#ifin

15 posts · Last used Sep 23

IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 1mo ago
Two Check Point critical vulnerabilities are now listed as exploited in the wild. https://ifin.network/t/cve-2026-85102-and-93616-check-point-security-gateway-rce-path-traversal-exploited/853 #ThreatIntel #ThreatIntelligence #IFIN
CVE-2026-85102 and 93616 - Check Point Security Gateway RCE/Path Traversal Exploited
ifin.network

CVE-2026-85102 and 93616 - Check Point Security Gateway RCE/Path Traversal Exploited

Last updated: 2026-09-22T20:07:55Z (UTC) CVSSv3: 9.8 What’s Happening In what’s-old-is-new-again news, two CVEs were released today for Checkpoint Security Gateway management toolsets, including a pre-auth remote code execution and a path traversal in the management web service. Here are Check Points internal support center details: Since I started writing this Check Point posted notification of exploitation on their blog. Both CVEs have been added to CISA KEV. Actions Check the advi

2
0
2
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 3mo ago
Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples. https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698 #ThreatIntel #ThreatIntelligence #IFIN
New AUR Attack Prompts Adoption Lock
discourse.ifin.network

New AUR Attack Prompts Adoption Lock

Last Updated: 2026-08-03T16:19:14Z (UTC) What’s Happening A new round of Arch User Repository malware has prompted the disabling of package adoption. The first package with confirmed malware appears to be openconnect-sso. User ysf has performed initial analysis of the payloads. Stage 1: AUR validator.malware (stage 1) · GitHub Stage 2: AUR validator.malware (stage2 agent linux x86_64) · GitHub Interestingly, many of the behaviors (especially Tor exfil) look similar to the last campaig

16
4
30
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 3mo ago
We've compiled the latest information regarding the Minnesota water systems attacks. https://discourse.ifin.network/t/minnesota-water-system-suffers-a-breach-due-to-exposed-access-keys/695 #ThreatIntel #ThreatIntelligence #IFIN
Minnesota water system suffers a breach due to exposed access keys
discourse.ifin.network

Minnesota water system suffers a breach due to exposed access keys

Last Updated: 2026-07-30T15:57:44Z (UTC) What’s Happening On July 27, 2026, threat actors exploited a known vulnerability on a Rockwell Automation device and disrupted water treatment facilities in four counties in Minnesota, US. Shieldworkz has a detailed writeup: Tenable also has a decent writeup, providing broader threat context. This activity is consistent with prior activity with Iran-aligned actors under the guise of “CyberAv3ngers,” although no direct evidence has yet emerged t

8
0
5
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 3mo ago
We caught a sample of ACR Stealer and went deep on it. Lots of sophistication for "just" an infostealer. https://discourse.ifin.network/t/acr-stealer-clickfix-etherhiding-and-stego-oh-my/694 #ThreatIntel #ThreatIntelligence #IFIN
ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My!
discourse.ifin.network

ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My!

Last Updated: 2026-07-29T21:28:50Z (UTC) What’s Happening Earlier this month, Microsoft reported on ACR Stealer, a new campaign leveraging both Steganography and Etherhiding techniques for delivery. Yesterday, I caught myself a sample. Mine doesn’t have Etherhiding, but the rest makes for a fun exploration anyhow. Let’s dive in. ▶ Recommended Musical Accompaniment Disclaimer: A LLM assisted with deobfuscation/decryption of later stages. Stage 1: Initial Access via ClickFix While the infe

15
0
14
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 3mo ago
Following up on a Fediverse tip, we found a new use for fake software download sites: the referral program hustle. Mirror FOSS, get cash. There are almost certainly more of these out there. https://discourse.ifin.network/t/pdf-arranger-and-terabox-referrals-lamer-than-malware/683 #ThreatIntel #ThreatIntelligence #IFIN
PDF Arranger and TeraBox Referrals: Lamer Than Malware
discourse.ifin.network

PDF Arranger and TeraBox Referrals: Lamer Than Malware

Last Updated: 2026-07-24T20:39:21Z (UTC) What’s Happening PDF Arranger, a legitimate FOSS application, has picked up a fake download site at pdfarranger[.]net. The site is of course using SEO Poisoning to get into top search results for the project. We’ve seen instances before of fake installer sites. Usually the payload is directly observable. Not so in this case. In fact, the hashes for the downloaded files match what’s on GitHub. So what’s the catch? The linked downloads files

9
1
13
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 3mo ago
With confirmed exploit sources, we've now added this one to our MISP feed. https://discourse.ifin.network/t/microsoft-sharepoint-cve-2026-50522/678/2 #ThreatIntel #ThreatIntelligence #IFIN
Microsoft SharePoint CVE-2026-50522
discourse.ifin.network

Microsoft SharePoint CVE-2026-50522

CTI from the raw TLP:CLEAR sources. Everything related to a time between 2026-07-19 and 2026-07-22. Indicator Indicator type Comments 45.63.58.216 ipv4-addr Exploit source IPv4. AS20473 Vultr 103.114.161.6 ipv4-addr Exploit source IPv4. AS142036 Hosteons Pte. Ltd. 146.19.216.119 ipv4-addr Exploit source IPv4. AS134677 Dromatics Systems Pte Ltd. 77.110.123.40 ipv4-addr Exploit source IPv4 and callback IPv4. AS203273 NetCrafters OU 149.102.254.84 ipv4-addr Exploit source IPv4. AS2

4
1
4
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 3mo ago
If you pirate games, you should expect malware. That's a tale as old as 1970-01-01T00:00:00.000Z. But using Etherhiding as the second stage source? Well that's slightly newer. In case you couldn't tell, we're declaring war on #Etherhiding. More to come. https://discourse.ifin.network/t/pirated-games-come-with-a-side-of-amatera-stealer/675 #ThreatIntel #ThreatIntelligence #IFIN
Pirated Games Come with a Side of Amatera Stealer
discourse.ifin.network

Pirated Games Come with a Side of Amatera Stealer

Last Updated: 2026-07-20T16:00:07Z (UTC) What’s Happening Malwarebytes is reporting on a new infostealer campaign using pirated games (shocker) as a watering hole. What’s notable about this campaign is the continued use of Etherhiding for second-stage loading. We’re going to be talking a lot about Etherhiding in the next couple of weeks. Some other fun malware analysis in the post as well for those interested. Actions Don’t pirate games! Don’t let your employees pirate games! Pro tip: if y

17
0
14
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 3mo ago
The latest supply chain attack has some novelty, but the techniques should have long been mitigated in your network. IPFS, cryptocurrency, and Nostr have no place in a professional network. https://discourse.ifin.network/t/latest-miasma-attack-uses-blockchain-garbage-you-should-have-already-blocked/663 #ThreatIntel #ThreatIntelligence #IFIN
Latest Miasma Attack Uses Blockchain Garbage You Should Have Already Blocked
discourse.ifin.network

Latest Miasma Attack Uses Blockchain Garbage You Should Have Already Blocked

Last Updated: 2026-07-14T22:16:54Z (UTC) What’s Happening I was trying to come up with a framing for this story other than “Oh look another supply chain attack, whoopty-doo.” But yeah, asyncapi packages were hit today. Actions Of course you want to do the usual package checks, rotations, say three Hail Marys, turn around three times and throw salt over your shoulder. But also, this payload presents some good reminders about goofy attacker techniques that should not survive a mature netwo

14
3
12
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 4mo ago
An IFIN community member caught this #ClickFix campaign, followed it, reversed the payload, and brought the IOCs. This is the juice right here. A perfect example that #ThreatIntelIsMutualAid https://discourse.ifin.network/t/compromised-website-hosting-clickfix-payload-leads-to-netsupport-rat-infection/633 #ThreatIntel #ThreatIntelligence #IFIN
Compromised Website Hosting ClickFix Payload Leads to NetSupport RAT Infection
discourse.ifin.network

Compromised Website Hosting ClickFix Payload Leads to NetSupport RAT Infection

Last Updated: 7/1/2026 What’s Happening A recent trending post by a Mastodon user caught my attention since I actively track ClickFix campaigns: BLUF: The website wavesandwild[.]com was compromised with the ClickFix social engineering technique to trick victims into executing malicious commands injected into their clipboard which installs and runs NetSupport RAT, a remote access tool. NetSupport RAT is based on NetSupport Manager, a legitimate tool which is frequently used by bad actors for

23
0
17
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 4mo ago
If you're running a SimpleHelp server, it's patch o'clock. Also maybe incident-response-o'clock. (It's always incident-response-o'clock somewhere) https://discourse.ifin.network/t/stealers-exploit-cve-2026-in-simplehelp-attack/629 #ThreatIntel #ThreatIntelligence #IFIN
Stealers Exploit CVE-2026-48558 in SimpleHelp Attack
discourse.ifin.network

Stealers Exploit CVE-2026-48558 in SimpleHelp Attack

Last Updated: 2026-06-30T19:15:57Z (UTC) What’s Happening Blackpoint Cyber has identified two separated malware samples exploiting CVE-2026-48558 (CVSS 10), an auth bypass in the SimpleHelp remote access tool. Affected versions are SimpleHelp 5.5.15 and prior and 6.0 pre-release. The CVE has been added to CISA’s Known Exploited Vulnerabilities list. Actions Running a SimpleHelp server? Patch immediately. Version 6.0 (release) and 5.5.16 are patched. Review Blackpoint’s advisory for ind

15
2
10
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 4mo ago
Maaaaybe just block the whole dot garden top-level domain. https://discourse.ifin.network/t/garden-tlds-change-to-a-bad-neighborhood/627 #ThreatIntel #ThreatIntelligence #IFIN
.garden TLD's change to a bad neighborhood
discourse.ifin.network

.garden TLD's change to a bad neighborhood

Last Updated: 2026-06-29T19:00:03Z (UTC) What’s Happening About a month ago, Dave Piscitello from Interisle was looking for information on why the .garden TLD seemed so unfriendly. Accidentally fell off my radar, but I started looking this morning. TLD(R) is: a voluminous increase in registrations for .garden this year, and AliDNS correlates with much higher risk scores, as nearly half the 2026 dataset. In particular, AliDNS nameservers and Dominet registration accounted for an average risk sc

16
1
10
0
IFIN - The Independent Federated Intelligence Network @ifin@infosec.exchange
· 4mo ago
If you're running Lantronix gear on the internet, you might want to check your logs for suspicious logins and command execution. https://discourse.ifin.network/t/lantronix-openwrt-luci-attacks/625 #ThreatIntel #ThreatIntelligence #IFIN
Lantronix/OpenWRT LuCI Attacks
discourse.ifin.network

Lantronix/OpenWRT LuCI Attacks

Last Updated: 2026-06-26T19:06:23Z (UTC) What’s Happening Forescout reports on a recently-active exploitation campaign targeting Lantronix and OpenWRT LuCI endpoints. The observed attacks came from two putatively distinct sources—one which was exploiting CVE-2025-67038, an authenticated command injection vulnerability in Lantronix/OpenWRT LuCI, and another which was performing brute force authentication against the endpoints, but without attempted exploitation of the same vulnerability. Mor

16
0
17
0
You've seen all posts