Threat Watch Feed
🚩 – IOCs Added
The red flag indicates that Indicators of Compromise (IOCs) have been added to SRA’s Threat Feed used by CyberSOC clients. Articles may not be flagged if IOCs are not available at the time or are not applicable to the article.
Critical Vulnerabilities in Anthropic’s Claude Code Allow RCE and API Key Exfiltration via Malicious Project Configurations
Check Point Research disclosed that it identified critical vulnerabilities in Anthropic’s Claude Code that could allow remote code execution and theft of Anthropic API credentials through malicious, repository-controlled project configurations. The issues are tracked as CVE-2025-59536 and CVE-2026-21852 and rely on attackers placing malicious configuration in project files that are executed or processed when users clone and open untrusted repositories. Check Point states it coordinated with Anthropic to remediate the issues and that all reported problems were patched prior to publication. The report describes three main abuse paths. First, untrusted project Hooks defined in .claude/settings.json could execute shell commands automatically during Claude Code initialization after the user proceeded past a trust prompt, without the expected per-command confirmation. Second, repository-controlled settings could bypass MCP server consent and cause commands in .mcp.json to execute immediately, including execution occurring before a user could meaningfully review or respond to the trust dialog. Third, Claude Code’s project-level ability to set environment variables could be used to override ANTHROPIC_BASE_URL, causing the client to send API requests including the victim’s API key to an attacker-controlled endpoint before the user confirmed trust, enabling API key exfiltration.
Impact: These issues create a supply chain risk for developer workflows where configuration files are treated as “project metadata.” A malicious repository or commit could trigger command execution on a developer machine and expose API credentials, which Check Point notes could then be abused for costs and access to Workspace resources associated with the compromised key. Because execution and key exposure could occur during tool initialization, users may have limited opportunity to detect the behavior before compromise. Check Point states the issues have been patched, but unpatched installations or risky trust practices around untrusted repositories can still elevate exposure.
Recommendation: Organizations should verify that all instances of Claude Code are updated to the latest version, as Anthropic has patched these specific vulnerabilities. Developers must treat repository configuration files, such as .claude/settings.json and .mcp.json, with the same level of security scrutiny as executable source code. Implement policies to inspect tool-specific configuration directories before opening unknown projects and enforce strict review processes for configuration changes within internal repositories.
🚩 StegaBin Campaign Deploys 26 Malicious npm Packages Using Pastebin Steganography and Nine-Module Infostealer
Socket researchers discovered 26 malicious npm packages published February 25-26, 2026 deploying a multi-stage credential harvesting operation attributed to North Korea-aligned FAMOUS CHOLLIMA threat actor associated with Lazarus Group’s Contagious Interview campaigns. All packages share a malicious file that uses character-level steganography to extract command and control URLs from three Pastebin pastes. The decoder strips zero-width Unicode characters, reads five-digit length markers, calculates evenly-spaced character positions, and extracts hidden infrastructure addresses resolving to 31 Vercel-hosted domains. Socket detected the first package within two minutes of publication and flagged all 26 within six minutes each.
Impact: The VSCode persistence module injects tasks.json files with commands preceded by 186 spaces to push payloads off-screen, configured with runOn folderOpen triggers and presentation settings suppressing all visual feedback. The keylogger implements platform-specific capture using SetWindowsHookEx low-level hooks on Windows, xinput test-xi2 on Linux, and CGEventTap on macOS, annotating events with active window titles and extracting browser URLs when foreground applications are Chrome, Edge, Firefox, Brave, Opera, or Vivaldi. The cryptocurrency wallet stealer targets 86 extension IDs by copying LevelDB stores to temporary directories. The Git module recursively walks filesystems collecting repository metadata, extracting credentials from git-credentials files, parsing authentication tokens from remote URLs, and uploading SSH keys from .ssh directories.
Recommendation: Inspect VSCode tasks.json files for entries with excessive leading whitespace or runOn folderOpen triggers. Block identified IOCs. Monitor Pastebin access for systematic character extraction from pastes CJ5PrtNk, 0ec7i68M, and DjDCxcsT. Rotate all SSH keys, Git credentials, browser passwords, and cryptocurrency wallet seeds on compromised systems. Deploy package manager security scanning detecting install scripts executing from scripts/test directories or loading vendor/scrypt-js paths. Enable threat detection to flag obfuscated code and abnormal install behavior.
Juniper Networks Issues Out-of-Cycle Patch for Critical Unauthenticated Root RCE Flaw in PTX Series Routers
On February 25, 2026, Juniper Networks released an out-of-cycle security bulletin addressing a critical vulnerability (CVE-2026-21902) in its Junos OS Evolved operating system running on PTX Series routers. The flaw resides within the On-Box Anomaly Detection framework and carries a maximum CVSS 3.1 score of 9.8. This component is inherently designed to be accessible only to internal processes over the internal routing instance. However, an incorrect permission assignment (CWE-732) inadvertently exposes the framework over an externally accessible port. Because the service is enabled by default and requires no specific configuration, an unauthenticated, network-based attacker can remotely interact with it to execute arbitrary code with root privileges. The vulnerability was discovered during internal security testing, and the Juniper Security Incident Response Team is not currently aware of any active exploitation in the wild.
Impact: Successful exploitation of this vulnerability allows an unauthenticated remote attacker to gain complete administrative control over the affected PTX Series router. Because PTX Series hardware typically functions as high-performance core and peering routers in internet service provider, telecommunication, and cloud data center environments, a full device takeover poses severe, cascading risks. An attacker could manipulate routing tables, intercept or modify high-volume network traffic, disrupt internet connectivity on a massive scale, and establish a stealthy, persistent foothold to pivot deeper into the critical infrastructure networks that rely on these specific core devices.
Recommendation: Organizations operating Juniper PTX Series routers should determine if they are running the affected Junos OS Evolved 25.4 versions. Administrators should prioritize applying the official vendor updates, upgrading affected systems to version 25.4R1-S1-EVO, 25.4R2-EVO, or later releases. If immediate patching is not feasible, teams should implement strict access control lists or firewall filters to restrict access to the vulnerable port, ensuring only explicitly trusted management networks and hosts can connect. Alternatively, defenders can temporarily eliminate the attack surface by completely disabling the vulnerable service via the command line using ‘request pfe anomalies disable’ on the affected hardware.
🚩 Google Threat Intelligence Group Disrupts Global Cyber Espionage Campaign Leveraging Novel GRIDTIDE Backdoor
Google Threat Intelligence Group reported that they disrupted a global cyber espionage campaign targeting telecommunications and government organizations across dozens of countries. GTIG attributes the activity to UNC2814, a suspected PRC-nexus espionage group tracked since 2017, and states the disruption followed confirmed intrusions affecting 53 victims in 42 countries, with suspected infections in at least 20 additional countries. GTIG emphasizes this activity is not due to a vulnerability in Google products, but rather abuse of legitimate Google Sheets API functionality for command-and-control. The campaign leveraged a novel C-based backdoor tracked as GRIDTIDE, which uses Google Sheets as a high-availability C2 channel by embedding commands and data in specific spreadsheet cells and communicating through legitimate cloud API requests. GTIG reports GRIDTIDE uses a service account to authenticate to attacker-controlled spreadsheets, clears spreadsheet rows to reset prior activity, fingerprints infected hosts, and supports command execution plus file upload and download via spreadsheet cell ranges. Observed post-compromise activity included lateral movement via SSH using a service account, persistence via a systemd service, and deployment of SoftEther VPN Bridge to establish outbound encrypted connectivity. GTIG states the initial access vector was not determined, though UNC2814 has a history of exploiting and compromising web servers and edge systems.
Impact: By routing malicious command-and-control traffic through legitimate SaaS applications like Google Sheets, UNC2814 successfully bypassed standard network security filters and maintained stealthy, persistent access to compromised environments. The threat actors targeted endpoints containing highly sensitive personally identifiable information, including national IDs, voter IDs, and full contact details. This deep access within telecommunications infrastructure enables the clandestine surveillance, tracking, and monitoring of specific individuals of interest, posing privacy and national security risks.
Recommendation: Organizations should review the source material and assess exposure. Validate whether enterprise telemetry includes visibility into Google Sheets API usage and hunt for non-browser processes initiating outbound connections to sheets.googleapis.com, especially calls consistent with spreadsheet manipulation patterns described in the report such as batchClear, batchUpdate, or formula rendering behaviors. Review Linux systems for suspicious execution from /var/tmp, unexpected systemd services created for persistence, and unusual SSH-based lateral movement using service accounts. Monitor for indicators associated with GRIDTIDE host artifacts (including xapt, related service and configuration files) and for unusual VPN tooling consistent with SoftEther VPN Bridge usage. Where Google SecOps is in use, apply the hunting queries and detection content referenced by GTIG and incorporate the published IOCs into alerting and investigation workflows.
🚩 Four Malicious NuGet Packages Deploy JIT Hooking and Localhost Proxy to Exfiltrate ASP[.]NET Credentials
Socket researchers discovered four malicious NuGet packages targeting ASP.NET developers in February 2026, though the packages were originally published between August 12-21, 2024 by threat actor hamzazaheer and have accumulated over 4,500 total downloads. The delayed discovery highlights common challenges in supply chain security where malicious packages can remain undetected for extended periods while actively compromising development environments. NCryptYo acts as a stage-1 dropper that typosquats the legitimate NCrypto package and establishes a localhost proxy on port 7152, while companion packages DOMOAuth2_ and IRAOAuth2.0 exfiltrate ASP.NET Identity data including user accounts, role assignments, and permission mappings. NCryptYo presents non-functional public API methods that return null unconditionally while executing malicious functionality through JIT compiler manipulation. The complex attack architecture required extensive reverse engineering to uncover, including decrypting multiple encryption layers, analyzing JIT compiler hooks, and reverse engineering .NET Reactor obfuscation to understand the two-stage payload deployment. The stage-2 payload establishes a localhost proxy relaying traffic between companion packages and external command and control servers, keeping infrastructure details out of static artifacts and complicating detection efforts.
Impact: NCryptYo hijacks the .NET runtime’s compilation pipeline by modifying the JIT compiler’s compileMethod vtable entry, importing native functions including VirtualAlloc, mmap, and mprotect to allocate executable memory and deploy platform-specific shellcode for x64, x86, and ARM64 processors. The package embeds five encrypted resources including a 126 KB executable that decrypts using AES-256-CBC with hardcoded keys, deploying the stage-2 proxy on localhost:7152. DOMOAuth2_ and IRAOAuth2.0 integrate through dependency injection, exposing four methods that exfiltrate Identity data to endpoints including get-permissions and update-role-permissions. The packages return C2 responses through dynamic-typed fields enabling permission injection attacks that grant attackers admin-level access by manipulating authorization rules. SimpleWriter_ beacons to the localhost proxy on every ConvertHtmlToPDF call, then unconditionally writes arbitrary file content and executes binaries with hidden windows regardless of network connectivity.
Recommendation: Audit NuGet dependencies for typosquatting patterns by verifying package names and author identities before installation. Decompile suspicious packages to check for obfuscation markers including SuppressIldasm attributes and method bodies returning null unconditionally. Monitor localhost connections on non-standard ports, treating persistent connections to localhost:7152 as compromise indicators. Enable NuGet package signature verification and configure sources to require signed packages from trusted publishers. Block packages importing native memory manipulation APIs including VirtualAlloc, WriteProcessMemory, and mmap when combined with anti-debugging checks. Implement behavioral monitoring detecting static constructor execution patterns where initialization logic runs before developer interaction. Uninstall NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_ packages, audit build artifacts for localhost:7152 references, rotate credentials for ASP.NET Identity systems, and review authorization configurations for unauthorized modifications.
🚩 Threat Actor Repeatedly Exploited CVE-2023-46604 in Apache ActiveMQ to Deploy Modified LockBit Ransomware Built From a Leaked Builder
The DFIR Report published an analysis detailing a near two-month intrusion where a threat actor exploited a known Remote Code Execution (RCE) vulnerability (CVE-2023-46604) in an internet-facing Apache ActiveMQ server. The initial compromise occurred in mid-February 2024, utilizing a malicious Java Spring XML configuration file to execute a Metasploit stager via Windows CertUtil. Despite losing access on the second day, the threat actor successfully exploited the same unpatched vulnerability 18 days later to regain entry. Upon regaining access, the attacker utilized a privileged service account, previously dumped from LSASS memory, to move laterally via SMB and RDP. They deployed AnyDesk for persistence and utilized tools like Advanced IP Scanner and PowerShell to map the network and execute payloads in memory. The intrusion culminated in the deployment of two distinct ransomware binaries (LB3_pass.exe and LB3.exe). The Time to Ransomware (TTR) was approximately 419 hours (19 days) from the initial breach. Analysis indicates the ransomware was generated using the leaked LockBit Black builder, as evidenced by a customized ransom note directing victims to the Session private messaging app rather than official LockBit infrastructure.
Impact: The exploitation of CVE-2023-46604 granted the threat actor SYSTEM-level privileges, enabling unrestricted credential theft and widespread lateral movement. The deployment of the modified LockBit ransomware resulted in the encryption of file and backup servers, effectively crippling operational availability. Furthermore, the threat actor’s specific targeting of backup infrastructure severely impaired the organization’s ability to restore systems without paying the ransom.
Recommendation: Organizations should prioritize the remediation of CVE-2023-46604 on all internet-facing Apache ActiveMQ instances. Monitor or hunt for CertUtil misuse, such as downloading executables to the TEMP directory, along with the creation of suspicious services and unauthorized RDP configuration changes. Enforce strict access controls on LSASS process memory, utilize endpoint detection and response solutions to block memory dumping, and ensure backup infrastructure is segmented and immutable to withstand targeted ransomware attacks.
Sign up here!
To receive the TIGR Threat Watch email bulletin and critical vulnerability notifications, simply complete the form below.
Follow on Twitter
@SRA_ThreatWatch will keep you up to date with the most recent posts on your social media feed.
Subscribe to the RSS
Just copy and add this link to your RSS app and be notified immediately when new intel is posted.
How to use RSS
Following the RSS feed is easy. RSS can be added in your Outlook desktop app, and there are many free RSS readers available for your mobile device.
To follow using Outlook:
- In Outlook, right-click the RSS Feeds folder and choose Add a New RSS Feed.
- In the New RSS Feed dialog box, enter the URL of the RSS Feed: https://sra.io/category/tigr/feed
(click here for detailed instructions and additional options for Outlook)
Popular mobile RSS reader apps include:
- Feedly
- NewsBlur
- RSS Reader
- Inoreader
After installing your preferred RSS reader, you will be able to add this feed by entering the URL: https://sra.io/category/tigr/feed
Threat Bulletin Archive
About TIGR Threat Watch
Our Threat Intelligence Gathering & Research (TIGR) team is focused on threat intelligence and curates a daily intelligence report, TIGR Threat Watch, with information collected from several industry intel sources. We also create and publish ad-hoc critical vulnerability notifications in case of critical and time-sensitive vulnerabilities or threats. These notifications include details and recommendations for mitigation/remediation.