GraphStrike

GraphStrike リリースブログ: GraphStrike: Microsoft Graph API を使用して Beacon トラフィックを消失させる 開発者ブログ: GraphStrike: 攻撃的ツール開発の解剖 はじめに GraphStrike は、Cobalt Strike の HTTPS Beacon が C2 通信に Microsoft Graph API を使用できるようにするツールスイートです。すべての Beacon トラフィックは、攻撃者の SharePoint サイトに作成された2つのファイルを介して送信され、Beacon からのすべての通信は...

Hunt-Sleeping-Beacons

Hunt-Sleeping-Beacons 이 프로젝트는 대부분 언패킹되거나 인젝션된 C2 에이전트를 나타내는 IOC를 식별하려는 콜스택 스캐너입니다. 모든 검사는 C2 에이전트가 콜백 사이에 대기하면서 비컨 스레드를 유휴 상태로 만든다는 관찰에 기반하며, 이 도구는 잠재적으로 스레드를 유휴 상태로 만든 원인을 분석하는 것을 목표로 합니다. 여기에는 언백된 메모리나 스톰프된 모듈과 같은 전통적인 IOC가 포함되지만, APC 또는 타이머를 사용하는 슬립마스크의 여러 구현을 감지하려고 시도합니다. 후자는 콜스택 분석과 사용자 영역에서...

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics ZBT, each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTE...

MAL-2026-14431 Malicious code in hydration-ui-dim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64f9565680b71c54ed88e29ed3950f1561764f4b86a260a3ebb5eadb528edfa3 On import 'hydration-ui-dim', dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via...

Malicious code in hydration-ui-dim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64f9565680b71c54ed88e29ed3950f1561764f4b86a260a3ebb5eadb528edfa3 On import 'hydration-ui-dim', dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via...

MAL-2026-14183 Malicious code in lodhash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73ad64f6c3a93b504c64c10175e325463652fafd741c36cfad433bed93f24cc8 lodhash-cli is a lodash-typosquat whose main entry index.js exports an empty object; the package's only behavior is a postinstall dropper...

Malicious code in lodhash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73ad64f6c3a93b504c64c10175e325463652fafd741c36cfad433bed93f24cc8 lodhash-cli is a lodash-typosquat whose main entry index.js exports an empty object; the package's only behavior is a postinstall dropper...

MAL-2026-14168 Malicious code in chalk-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4 [email protected] is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm...

Malicious code in axious-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25 axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte...

MAL-2026-14162 Malicious code in axious-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25 axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte...

MAL-2026-13915 Malicious code in kit-map-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc On import of kit-map-vim, dist/index.mjs unconditionally spawns dist/internal/calc-math.dat as a detached child process after a SHA-256 self-check...

Malicious code in @years19/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2ee90541bcb630e80a800d961efa8a534f59200943e7aa09c57f8d4972157f The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches multiple tarballs mhddos,...

MAL-2026-13894 Malicious code in @years19/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2ee90541bcb630e80a800d961efa8a534f59200943e7aa09c57f8d4972157f The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches multiple tarballs mhddos,...

Malicious code in @years18/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3cd688f6f3a7075db2ae860db719600fda1fdd23485262a9f72de758834a582 The package presents itself as an n8n community node but ships a hostile payload in both callback.js invoked from scripts.postinstall and index.js...

Malicious code in streak-math-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f98537ccfd6214a3970375d9c210e83853153b35b19193b4b1850fe6450ed4f The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spawns it detached with piped...

MAL-2026-10780 Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

Malicious code in pylogora (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfecc686b83d148b0b68acd99fe38f484c035c5b9c59fb7623378866e8e307cc pylogora/init.py invokes a at module top level, so any import pylogora triggers the payload. a base64-decodes hidden URLs and filesystem paths,...

MAL-2026-10688 Malicious code in log-guru (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...

Malicious code in @marketfront/dynamicpageparams (npm)

The @marketfront/dynamicpageparams package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and u...

MAL-2026-4993 Malicious code in @cloudplatform-single-spa/timescale-db (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...