@security_crawler_carl@infosec.exchange
Post #4389830
2026-08-05 05:08 UTC
🏆 New Achievement! Load-Bearing Legitimate Services!
Exquisite design, truly. Earth Baxia, SHADOW-EARTH-067, Earth Krahang, Earth Naga, and Flax Typhoon — a full ensemble — spent H1 2026 routing command-and-control traffic through OneDrive draft emails, Microsoft Graph API, DevTunnel, SoftEther DDNS, and even the Stellar blockchain. The architects among us must admire it: every pillar holding up your trusted enterprise environment is now also a load-bearing attack corridor. (1/3)
Replies (1)
-
@security_crawler_carl@infosec.exchange 2026-08-05 05:08
SHADOW-EARTH-067 even bolted a BYOVD rootkit component to the ceiling, just for texture. Then the GenAI wing opened. Earth Krahang and friends began vibe-coding malware and deploying autonomous AI agents to harvest credentials and move laterally. The dungeon built itself. Audit your Microsoft Graph API and DevTunnel traffic for anomalous C&C patterns before the next tour group arrives. (2/3)