Wambua Thyaka
@thyakaCompletionist
2 followers44 downloads653 copies19 likes10,806 views
27 detections
Filters
Last updated
All Time
Detection languages
27
Categories
1
1
1
Platforms
4
1
1
Products / Services
1
MITRE Techniques
5
4
4
3
3
CVEs
1
1
1
1
CVE-2026-85706 is a critical path traversal vulnerability affecting both GitLab Community Edition (CE) and Enterprise Edition (EE).
The Flaw: The issue originates in the repository commits/files API. The API processes file paths and reads them from the disk before verifying user authentication or restricting the path to the designated repository folder.
The Impact: A remote attacker can exploit this weakness with a single HTTP request. Because it requires zero credentials and no user interaction, attackers can easily read arbitrary, potentially sensitive files directly from the host GitLab server.
The Flaw: The issue originates in the repository commits/files API. The API processes file paths and reads them from the disk before verifying user authentication or restricting the path to the designated repository folder.
The Impact: A remote attacker can exploit this weakness with a single HTTP request. Because it requires zero credentials and no user interaction, attackers can easily read arbitrary, potentially sensitive files directly from the host GitLab server.
MacSync Stealer (formerly known as Mac.c) is a macOS information stealer offered as a Malware-as-a-Service (MaaS). On May 5, 2026, researchers identified a new C2 domain (jacksonvillemma[.]com) delivering the malware's Stage 2 loader. Notably, this new infrastructure was active just days after the operator's previous C2 domain was publicly exposed, highlighting the threat actor's agility in rotating their delivery architecture.
Proofpoint has observed OAuth client ID spoofing emerging as a novel technique, increasingly leveraged in cloud campaigns. Microsoft Entra ID returns different responses depending on whether a supplied OAuth client ID is valid and whether it corresponds to a registered application. This behavior enables account enumeration without a registered OAuth application and allows attackers to infer password validity or account state without generating a successful sign‑in event. Researchers observed multiple campaigns at scale abusing spoofed OAuth application identifiers, with distinct tooling, infrastructure, and execution patterns indicating independent adoption by multiple threat actors.
To detect similar activity, defenders should monitor sign-in logs for events without an application name, which may indicate spoofed client IDs.
To detect similar activity, defenders should monitor sign-in logs for events without an application name, which may indicate spoofed client IDs.
RMM: ScreenConnect
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Detects the RoguePlanet zero-day exploit chain by correlating the creation of the explicit PoC Alternate Data Stream (wermgr.exe:WDFOO) with a suspicious SYSTEM shell spawned from Windows Error Reporting or Microsoft Defender processes within a 15-minute window.
Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal systems, and abused enterprise administrative tools for covert data exfiltration. The threat actor had broad collection aspirations, including sensitive defense intelligence related to national security, Indo-Pacific command operations, artificial intelligence, uncrewed vehicle systems, cyber offensive programs, and medical research.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Huntress has observed Tiflux being used in attacks that aim to establish persistence, transmit screenshots, and run commands to collect system profiling information.
Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system.
Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system.
Page 1 of 3