Get SCALR AI for Free!

TIGR Threat Watch

Threat Watch Feed

🚩 – IOCs Added

The red flag indicates that Indicators of Compromise (IOCs) have been added to SRA’s Threat Feed used by CyberSOC clients. Articles may not be flagged if IOCs are not available at the time or are not applicable to the article.

ESET Uncovers MythicRatatoskr, a Yggdrasil-based Backdoor Deployed By Russia-Aligned UAC-0099 in an Intrusion that Culminated in a Destructive Sandworm Attack Against a Ukrainian Grain Logistics Company.

Oct 22, 2026

On October 22, 2026, ESET Research disclosed MythicRatatoskr, a previously undocumented Go-based backdoor identified during a coordinated intrusion involving Russia-aligned threat groups UAC-0099 and Sandworm. On July 16, 2025, UAC-0099 gained initial access to a Ukrainian grain logistics company through a spearphishing email containing a malicious attachment. The infection chain involved a scheduled task named pdfopentask, which executed PowerShell from %TEMP%\temporarydoc.txt, followed by the MATCHBOIL downloader and MATCHWOK backdoor. On July 17, attackers deployed MythicRatatoskr and subsequently distributed additional samples to other systems using OpenSSH SFTP. ESET assesses with high confidence that UAC-0099 handed off access to Sandworm, which conducted a destructive data-wiping attack on September 17, 2025, using SDelete deployed through Active Directory Group Policy. However, researchers could not determine whether UAC-0099 or Sandworm primarily operated MythicRatatoskr.

MythicRatatoskr communicates with its command-and-control (C2) server through Yggdrasil, a decentralized mesh network providing end-to-end-protected IPv6 communications. The malware uses a user-space networking implementation based on yggstack, connects to three randomly selected public peers from an embedded list of 32, and communicates with its C2 server at 201:b479:2771:8df4:b5eb:d007:63b0:2838 over HTTPS on port 443. Its capabilities include remote command execution through cmd.exe, file transfer, screenshot capture, system reconnaissance, and reverse SOCKS5 proxying. Persistence is established through a Windows service named ieupdate, while encrypted configuration files are stored at locations such as C:\Windows\Temp\.updatecache. Some samples introduce a 10-minute startup delay to reduce immediate detection. Researchers also identified a separate Go-based SOCKS5 server listening on 127.0.0.1:33690, likely deployed through MythicRatatoskr, and found artifacts suggesting a possible Linux variant, although its existence remains unconfirmed.

Impact: The intrusion demonstrates how coordinated threat actors can combine initial access, persistent remote control, internal network access, and destructive operations against strategically important organizations. MythicRatatoskr enables attackers to execute commands, collect system information, capture screenshots, transfer files, and route traffic through compromised environments. Its use of Yggdrasil complicates network-based detection because the C2 server resides within an encrypted IPv6 mesh rather than being contacted directly over conventional internet infrastructure. The confirmed deployment of SDelete through Active Directory Group Policy demonstrates the potential for widespread data destruction after an attacker obtains sufficient administrative control. While ESET documented this activity against a Ukrainian grain logistics company, the report does not establish broader MythicRatatoskr deployment across other organizations.

Recommendation:

  • Strengthen email security controls to identify malicious spearphishing attachments and investigate suspicious document-triggered PowerShell execution, particularly scheduled tasks such as pdfopentask launching scripts from %TEMP%.

  • Hunt for MATCHBOIL and MATCHWOK activity, including the UpdateMonitor registry value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and communications with uztickets[.]com or egyptanimals[.]com/animals/photoalbum.

  • Monitor Windows service creation and execution for unauthorized services named ieupdate, particularly those launching executables such as ieupdate.exe, updater.exe, WindowsDefenderSvc.exe, or krbtman.exe.

  • Inspect suspicious executable locations, including C:\Windows\System32\, %LOCALAPPDATA%\Microsoft\OneDrive\, and %LOCALAPPDATA%\Internet Explorer\, for unauthorized binaries matching the identified MythicRatatoskr artifacts.

  • Hunt for encrypted configuration files at C:\Windows\Temp\.updatecache, C:\Windows\System32\.updatecache, and %LOCALAPPDATA%\Temp\.crond, correlating file creation with suspicious service execution.

  • Monitor outbound connections to Yggdrasil public peers, particularly unusual TLS, TCP, or QUIC traffic associated with the peer infrastructure documented by ESET. Investigate unauthorized use of Yggdrasil networking components.

  • Investigate communications involving the identified Yggdrasil C2 address 201:b479:2771:8df4:b5eb:d007:63b0:2838, including HTTPS on port 443 and reverse proxy activity on port 8080 where mesh-network telemetry is available.

  • Hunt for unauthorized SOCKS5 proxy services, including processes listening on 127.0.0.1:33690, and investigate suspicious network tunneling, port forwarding, and internal proxy activity.

  • Monitor Active Directory Group Policy modifications for unauthorized software deployment, suspicious administrative activity, and attempts to distribute destructive utilities such as SDelete across domain-joined systems.

  • Validate backup and recovery protections by restricting backup administration, maintaining isolated or immutable recovery copies, and testing restoration procedures against destructive attacks involving centralized administrative deployment.

Group-IB Identifies SiriusQT, a Windows RAT with Hidden Desktop Control, Credential Theft, and Persistence Capabilities used in Multiple Malicious Campaigns.

Oct 22, 2026

Group-IB disclosed an analysis of SiriusQT, a Windows remote access trojan (RAT) distributed through a malware-as-a-service (MaaS) model. The malware has been advertised on underground forums, with at least 30 users purchasing valid licenses. Researchers identified more than 280 SiriusQT client samples associated with different campaigns, including activity targeting the United Kingdom, Germany, France, Spain, Italy, and the Netherlands. The malware provides attackers with remote access, credential theft, keylogging, cryptocurrency wallet collection, and browser interaction capabilities.

SiriusQT uses Hidden Virtual Network Computing (HVNC) to provide attackers with a concealed desktop session, allowing interaction with applications without displaying activity on the victim’s normal desktop. The malware also supports process injection, anti-analysis checks, encrypted command-and-control (C2) communications, and multiple persistence mechanisms, including registry Run keys, scheduled tasks, Startup folder shortcuts, and logon scripts. Additional persistence options can modify the Windows BootExecute registry value or the Default User profile. Group-IB confirmed malicious campaigns involving SiriusQT samples and identified instances where the malware was delivered as a final-stage payload through the UpCrypter loader. However, the analyzed standalone client exhibited high detection rates, potentially limiting its effectiveness without additional evasion techniques.

Impact: SiriusQT poses a risk to organizations through unauthorized remote access, credential compromise, and sensitive information theft. Its HVNC functionality enables attackers to interact with browsers and applications through hidden desktop sessions, potentially facilitating fraudulent activity without obvious user-visible indicators. Credential theft, keylogging, and cryptocurrency wallet collection can expose corporate accounts and financial assets. Multiple persistence mechanisms increase the likelihood of continued unauthorized access, while encrypted C2 communications and process injection may complicate detection and investigation.

Recommendation:

  • Organizations should review Group-IB’s research and assess their exposure to SiriusQT and associated delivery mechanisms. Recommendations include:

  • Deploy and maintain updated endpoint detection and response (EDR) protections capable of identifying RAT activity, process injection, credential theft, and suspicious remote desktop behavior.

  • Monitor Windows registry Run keys, particularly HKCU\Software\Microsoft\Windows\CurrentVersion\Run, for unexpected entries or executables masquerading as Windows Update components.

  • Review scheduled task creation and modification events, including suspicious use of schtasks.exe and tasks named Windows Update that execute from unusual locations.

  • Monitor Startup folder shortcuts, UserInitMprLogonScript registry modifications, and unauthorized changes to the BootExecute value under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager.

  • Restrict administrative privileges and monitor unauthorized modifications to the Windows Default User profile, including C:\Users\Default\NTUSER.DAT.

  • Investigate suspicious outbound connections to unfamiliar C2 infrastructure, including indicators published by Group-IB. Review connections to cloud-hosted infrastructure when accompanied by suspicious endpoint behavior.

  • Hunt for unusual process injection activity, hidden desktop creation, and unauthorized browser automation that may indicate SiriusQT’s HVNC functionality.

  • Monitor for suspicious access to browser credential stores, cryptocurrency wallet data, and other sensitive application files.

  • Restrict execution of untrusted software and investigate suspicious loaders, packed executables, and unexpected files downloaded through email, messaging platforms, or unverified websites.

  • If SiriusQT is detected, isolate affected endpoints, investigate persistence and lateral activity, and rotate potentially compromised credentials after containment.

GitLab Releases Patches for CVSS 10.0 Unauthenticated Code Execution Flaw Affecting Self-Managed Instances Back to Version 7.0.

Oct 22, 2026

GitLab disclosed CVE-2026-110264, a flaw rated 10.0 on the CVSS scale affecting GitLab Community Edition and Enterprise Edition. Self-managed GitLab installations are affected on all versions before the fixed release for their branch, back to 7.0. GitLab.com is already patched, and GitLab Dedicated is covered on builds 19.3.5-internal0, 19.4.2-internal0, or later.

The flaw is an integer overflow in GitLab’s Regular Expression Compiler, the background engine that parses regular expressions in configuration files. Under conditions that GitLab has not described, an unauthenticated remote attacker could send a specially crafted regular expression and execute arbitrary code on the server. GitLab reports no evidence that the flaw has been exploited.

Impact: Exploitation requires no authentication, and GitLab has not defined the preconditions, so administrators cannot yet rule themselves out through configuration. A successful attack would give an attacker code execution on the server, which could expose the secrets, pipeline data, and repositories that GitLab instances hold. Shadowserver tracks more than 2,700 internet-exposed GitLab CE instances, though it does not indicate how many are already secured or are honeypots.

Recommendations:

  • Upgrade GitLab CE/EE self-managed instances to the fixed release for your branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13.

  • Deploy the two GitLab-published detections, “Onigmo native worker crash” and “Org mode render error burst,” against your GitLab application logs to look for exploitation attempts.

  • If an exposed instance may have been targeted before patching, consider reviewing logs and rotating credentials and CI/CD secrets stored on the server.

k0t Exploits Fortinet and Palo Alto Edge Devices to Steal Credentials and Establish Persistent Access

Oct 21, 2026

On October 21, 2026, Group-IB and NyxLab disclosed a large-scale intrusion campaign associated with k0t, targeting internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect devices across organizations worldwide. Researchers identified more than 70,000 exposed credentials and related records, including network-device credentials and LDAP dumps, with FortiGate compromises observed primarily between February and June 2026. The campaign relies on bulk reconnaissance using FOFA, ZoomEye, and similar scanning services rather than targeting specific industries. Initial access methods include exploitation of CVE-2025-64446, a FortiWeb path traversal vulnerability enabling unauthorized administrative actions, and CVE-2026-0257, an authentication bypass affecting vulnerable GlobalProtect configurations. Operators also conduct FortiGate credential brute-forcing using a custom Python tool named FortiGate Security Scanner. Successful FortiWeb exploitation enables the creation of unauthorized administrator accounts, while compromised FortiGate configurations are downloaded and decrypted using a known default AES key associated with CVE-2019-6693 to recover stored LDAP, Active Directory, and administrative credentials. GlobalProtect exploitation involves forged authentication-override cookies that enable VPN access through OpenConnect.

Following initial access, operators conduct hands-on-keyboard reconnaissance, credential theft, privilege escalation, and lateral movement using tools including NetExec, Impacket, Mimikatz, Kerbrute, and PetitPotam. Researchers observed attempts to obtain domain-administrator privileges through the noPac exploit chain involving CVE-2021-42278 and CVE-2021-42287. Persistence and remote access are established through OpenConnect VPN connections, MeshCentral/MeshAgent, AdaptixC2, and legitimate remote management tools such as Atera, AnyDesk, and ngrok. Investigators identified 84 compromised devices across 28 active MeshCentral device groups, communicating with mesh[.]buttruyen[.]com, while AdaptixC2 infrastructure included 64[.]94[.]85[.]14:4321. Data exfiltration was observed through Rclone transfers to Wasabi S3 buckets and MEGA cloud storage. Several compromised organizations subsequently appeared on ransomware leak sites associated with Qilin and The Gentlemen, suggesting a possible initial access broker operation. However, direct affiliation with these ransomware groups remains unconfirmed. Researchers also identified possible connections to the broader FortiBleed activity cluster, although the credential datasets showed negligible overlap and common operator control has not been established.

Impact: Successful exploitation of internet-facing security appliances could allow attackers to bypass perimeter defenses, obtain privileged network access, and compromise enterprise identity infrastructure. The theft of FortiGate configuration files presents additional risks because stored LDAP, Active Directory, and administrative credentials may be recoverable and subsequently used for lateral movement or privilege escalation. Persistent access through legitimate remote management software and VPN connections can enable attackers to maintain control while blending into authorized administrative activity. Confirmed data exfiltration to external cloud storage creates confidentiality risks, while observed overlaps with ransomware victims raise concerns about potential downstream extortion or ransomware deployment. However, the investigation does not establish that k0t directly conducted ransomware attacks or transferred access to specific ransomware operators.

Recommendation:

  • Prioritize remediation of CVE-2025-64446 on FortiWeb and CVE-2026-0257 on affected Palo Alto GlobalProtect deployments, verifying that vulnerable authentication-override configurations are addressed.

  • Restrict FortiGate, FortiWeb, and GlobalProtect administrative interfaces to trusted management networks and eliminate unnecessary direct internet exposure.

  • Review FortiWeb logs for suspicious requests targeting /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi, particularly those associated with forged CGIINFO headers or unauthorized administrator creation.

  • Audit FortiGate administrative authentication for password spraying, repeated login failures, 60-second lockout-and-retry patterns, and unexpected configuration exports.

  • Enable FortiGate private-data-encryption with an administrator-defined key to prevent configuration secrets from relying on the publicly known default encryption key associated with CVE-2019-6693.

  • Rotate potentially exposed administrator, LDAP, Active Directory bind, and service-account credentials, particularly where appliance configurations may have been accessed or exported. Revoke suspicious VPN sessions and enforce MFA where supported.

  • Investigate GlobalProtect authentication logs for forged or unusual authentication-override cookie activity, unexpected VPN sessions, and suspicious connections associated with OpenConnect clients.

  • Hunt for unauthorized MeshAgent, MeshCentral, AdaptixC2, Atera, AnyDesk, Teramind, and ngrok deployments, particularly where remote access tools lack an approved administrative purpose.

  • Monitor Active Directory environments for suspicious NetExec, Impacket, Mimikatz, Kerbrute, and PetitPotam activity, including credential dumping, abnormal Kerberos requests, NTLM relay attempts, and unexpected domain-administrator access.

  • Investigate unusual Rclone execution and outbound transfers to Wasabi S3 or MEGA, particularly following credential theft, broad file enumeration, or suspicious VPN access.

  • Block or investigate confirmed campaign infrastructure, including mesh[.]buttruyen[.]com, agent[.]afahimsa[.]top, 64[.]94[.]85[.]14:4321, 168[.]100[.]11[.]99, 162[.]33[.]178[.]213:8888, and sthyjk[.]com:8443, while correlating network indicators with endpoint and identity telemetry.

Critical PHP2Shell Vulnerabilities Enable Unauthenticated Remote Code Execution and Memory Disclosure

Oct 21, 2026

On October 21, 2026, Wiz Research disclosed PHP2Shell, a collection of critical memory-safety vulnerabilities in the core PHP engine tracked under CVE-2026-109618 and CVE-2026-109619, with severity reaching CVSS 9.2. The vulnerabilities affect PHP versions dating back to 5.4, with every PHP version released over the past decade affected by at least one identified issue. The flaws originate from improper handling of fatal errors, particularly out-of-memory conditions, which can leave corrupted internal state that is reused during subsequent requests. Researchers demonstrated unauthenticated remote code execution against WordPress, Drupal, and Joomla deployments, as well as application-independent disclosure of PHP worker memory. Because the vulnerabilities exist within PHP itself rather than individual web applications, even websites running otherwise secure application code may be exposed. Wiz Research discovered the issues beginning August 19, 2026, and coordinated remediation with the PHP security team before patched releases became available on October 21.

The vulnerabilities involve multiple memory-corruption primitives, including use-after-free conditions in PHP session upload-progress processing and fatal-error backtrace handling, alongside an OPcache type-confusion issue. CVE-2026-109618 includes an attack path in which malformed multipart requests trigger out-of-memory conditions, leaving stale session state that can expose PHP process memory through unexpectedly large or malformed PHPSESSID response cookies. Researchers also chained memory disclosure with heap manipulation to achieve unauthenticated RCE against WordPress, Drupal, and Joomla. CVE-2026-109619 involves stale fatal-error backtrace references and inconsistent OPcache shared-state management, which researchers exploited to achieve RCE against Drupal and WordPress. Successful exploitation may require repeated requests and adjustments to target-specific memory layouts. Wiz reported that frontier AI models significantly accelerated vulnerability discovery, exploit development, and patch verification. However, the article documents researcher-controlled exploitation and does not establish active exploitation by threat actors in the wild.

Impact: Successful exploitation of PHP2Shell could allow unauthenticated attackers to execute arbitrary code on vulnerable web servers, potentially resulting in complete compromise of affected PHP application environments, unauthorized access to sensitive information, website defacement, and disruption of hosted services. The memory-disclosure vulnerability could expose passwords, authentication tokens, API keys, certificates, and information belonging to other requests without requiring code execution. Because PHP underpins widely deployed platforms such as WordPress, Drupal, Joomla, and MediaWiki, the vulnerabilities create substantial exposure across enterprise websites, cloud-hosted applications, and shared hosting environments. Their location within the PHP engine also means that application-level security controls and secure application code alone cannot eliminate the underlying risk.

Recommendation:

  • Update PHP to the security releases published October 21, 2026, ensuring deployed versions contain fixes for CVE-2026-109618 and CVE-2026-109619.

  • Inventory all PHP installations across web servers, containers, cloud workloads, and development environments, prioritizing internet-facing applications and systems running older or unsupported PHP versions.

  • Assess WordPress, Drupal, Joomla, MediaWiki, and custom PHP applications for vulnerable PHP runtimes, recognizing that updating application components alone does not remediate the underlying engine vulnerabilities.

  • Review web server and application logs for unusual multipart/form-data requests, particularly repeated or malformed uploads associated with PHP memory exhaustion.

  • Monitor for repeated HTTP 500 responses, PHP fatal out-of-memory errors, and abnormal PHP-FPM worker crashes, restarts, or process churn that may indicate attempted exploitation.

  • Investigate unexpectedly large or malformed PHPSESSID response cookies, particularly when associated with multipart upload requests or memory-limit errors.

  • Deploy available protections from web application firewalls, CDN providers, and cloud security platforms as temporary risk-reduction measures when immediate PHP patching is not possible.

  • Monitor PHP worker processes for unexpected child process execution, suspicious outbound connections, unauthorized file modifications, or other behavior consistent with successful remote code execution.

  • Validate remediation by confirming the patched PHP runtime is active across all application instances and restarting or redeploying affected workers and containers to eliminate vulnerable running processes.

Compromised eMudhra CA Keys Threaten HTTPS Certificate Trust Across Browsers and Applications

Oct 21, 2026

On October 17, 2026, Mozilla received a report confirming the compromise of private keys associated with eight eMudhra intermediate certificate authority (CA) certificates. A researcher identified as Wayne demonstrated possession of the keys by signing a verification message with each compromised private key, providing cryptographic evidence of unauthorized signing capability. These intermediate certificates chained to roots trusted by major browser and operating system ecosystems, including Mozilla, Microsoft, Apple, and Chrome. An attacker possessing the compromised keys could potentially issue fraudulent HTTPS certificates for domains they do not control, enabling website impersonation and interception of encrypted communications against clients that continue to trust the affected certificate chains. The method used to obtain the private keys remains unknown, and the available disclosures do not establish active exploitation or a practical cryptographic attack capable of recovering the keys in seconds.

Mozilla received the initial report at 20:06 UTC on October 17 and completed emergency blocking of the affected intermediate certificates through OneCRL by 22:59 UTC, protecting standard Firefox configurations without requiring a restart or software update. According to the incident reporting, Chrome blocked the certificates on October 17, Apple implemented protections on October 19, and Microsoft followed on October 20. eMudhra also revoked the compromised intermediates. Mozilla subsequently released Firefox 158.0.1, ESR 115.43.1, and ESR 153.5.1 for configurations that might not receive OneCRL updates, while NSS 3.131.1 removed trust in the signing root to protect applications relying on Mozilla’s certificate store. Additional ecosystem updates included Go 1.27.3 and 1.26.10, Python certifi 2026.10.19, and Rust webpki-roots 1.0.10. However, applications using outdated certificate bundles or failing to enforce certificate revocation may remain exposed despite browser-level protections.

Impact: A threat actor in possession of any of the compromised certificates would be able to sign a malicious website as legitimate, bypassing some of the otherwise most used and most trusted internet security measures.

Recommendation: eMudhra has already revoked the eight compromised certificates, and have been blocked as well by Apple and Microsoft. Mozilla and Google have also removed the emSign ECC Root CA. In addition, we recommend the following.

  • Update Firefox to 158.0.1, ESR 115.43.1, or ESR 153.5.1, as applicable, particularly on systems where OneCRL delivery may be restricted or disabled.

  • Update applications relying on Mozilla’s Network Security Services (NSS) to 3.131.1 or a later version containing the relevant trust-store changes.

  • Review application dependencies and certificate bundles, including Go 1.27.3/1.26.10, Python certifi 2026.10.19, and Rust webpki-roots 1.0.10, where applicable.

  • Identify applications, embedded systems, and services that maintain independent CA trust stores or do not automatically receive browser and operating system certificate updates.

  • Verify that TLS clients properly enforce certificate revocation checks and reject revoked certificates, including configurations where revocation information is unavailable.

  • Review Mozilla’s published impacted-intermediates.json and roots.json to identify affected certificate chains and determine whether intermediate blocking or root trust removal is required.

  • Test critical applications against the incident’s published certificate chains and validation endpoints to confirm that affected certificates are rejected.

  • Identify production services relying on certificate chains affected by root removal and coordinate replacement certificates or alternative trusted chains to prevent service disruption.

  • Monitor certificate validation failures, unexpected certificate-chain changes, and suspicious HTTPS interception activity, particularly on systems that have not yet received the relevant trust-store protections.

Sign up here!

To receive the TIGR Threat Watch email bulletin and critical vulnerability notifications, simply complete the form below.

 

Follow on Twitter

@SRA_ThreatWatch will keep you up to date with the most recent posts on your social media feed.

Subscribe to the RSS

Just copy and add this link to your RSS app and be notified immediately when new intel is posted.

How to use RSS

Following the RSS feed is easy. RSS can be added in your Outlook desktop app, and there are many free RSS readers available for your mobile device.

To follow using Outlook:

  • In Outlook, right-click the RSS Feeds folder and choose Add a New RSS Feed.
  • In the New RSS Feed dialog box, enter the URL of the RSS Feed: https://sra.io/category/tigr/feed

(click here for detailed instructions and additional options for Outlook)

Popular mobile RSS reader apps include:

  • Feedly
  • NewsBlur
  • RSS Reader
  • Inoreader

After installing your preferred RSS reader, you will be able to add this feed by entering the URL: https://sra.io/category/tigr/feed

Threat Bulletin Archive

See full archive here

About TIGR Threat Watch

Our Threat Intelligence Gathering & Research (TIGR) team is focused on threat intelligence and curates a daily intelligence report, TIGR Threat Watch, with information collected from several industry intel sources. We also create and publish ad-hoc critical vulnerability notifications in case of critical and time-sensitive vulnerabilities or threats. These notifications include details and recommendations for mitigation/remediation.