标签：#threatintel

VeloCloud Orchestrator CVE-2026-16812: Unauthenticated OS Command Injection Actively Exploited 1. Basic Information Article Title : Arista patches VeloCloud Orchestrator zero-day exploited in attacks Source : BleepingComputer (Primary Source: Arista Security Advisory 0144) Publication Date : 2026-07-27 Original URL : https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/ Related Sources : https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog Related Entities : CVE-2026-16812, CWE-78, VeloCloud Orchestrator (VCO) On-Premises, VeloCloud Edge, CISA KEV Severity : Critical IOCs : 8.19.75.217 , 206.72.242.124 , 206.72.242.162 2. Summary This is a CVSS 10.0 vulnerability. It allows an unauthenticated attacker to access the Web UI of an internet-reachable on-premises VCO. The attacker can execute OS commands through internal-only functions. Active exploitation has been confirmed. 3. Attack Flow An attacker searches for a VCO Web interface. The attacker sends a crafted request without authentication to reach internal-only functions. The attacker executes commands on the VCO host via OS command injection. The attacker may access configurations, device lists, credentials, certificates, keys, and databases. The attacker proceeds to create files, export databases, create archives, perform outbound communications, and change management configurations. Inference : The attacker can abuse the authentication and configuration paths to Edge devices managed by the VCO, expanding the impact to the entire SD-WAN. 4. Attacker Position and Execution Location The attacker is an external host with network access to the VCO Web UI. The initial request targets the web layer. Commands execute on the on-premises VCO host. Hosted and Dedicated VCOs are already patched. VeloCloud Gateways

Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence 1. Basic Information Article Title : Steam forum ClickFix attacks infect gamers with XMRig cryptominers Publisher : BleepingComputer Publication Date : July 25, 2026, 18:37 EST / July 26, 2026, 07:37 JST Original Source : https://www.bleepingcomputer.com/news/security/steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers/ Related Information Sources : At the time of publication, no alternative primary sources providing a detailed analysis of this campaign were identified. Related Malware, Threat Groups, CVEs, and Products : XMRig ClickFix PowerShell Microsoft Defender Windows Firewall Windows Task Scheduler Steam Discussion Forums Unknown Threat Group No CVE Related IOCs : Domain: msfconfig[.]icu URL: https://msfconfig[.]icu:443/tmp/system.txt Directory: C:\Windows\Background Executable: C:\Windows\Background\system.exe Scheduled Task: XMRig-[computer name] Defender Exclusion: C:\Windows\Background Severity : Medium Reason for Selection : The attack chain is highly specific and realistic: a ClickFix scenario where a user pastes a command into an administrator PowerShell, progressing from disabled certificate validation, Defender exclusions, Firewall allowances, and XMRig retrieval, to a SYSTEM-privileged Scheduled Task. Such behavior can easily translate to enterprise settings where employees copy commands from forums or generative AI responses. 2. Executive Summary Attackers reply to Steam technical support threads disguised as "repair methods," instructing users to run administrator PowerShell commands. Upon execution, the script adds Microsoft Defender exclusions and Firewall rules on the victim's machine, downloads XMRig, and establishes persistence via a SYSTEM-privileged Scheduled Task in a classic ClickFix attack. 3. Attack Flow Chain A: XMRig Infection via Steam Forums The attacker creates a randomized Steam account. They search for existing threads discussing game crash

Originally published on satyamrastogi.com Seqrite Labs identifies multi-stage DcRAT campaign impersonating India's Income Tax Department. Attackers exploit tax professional workflows to deliver remote access trojans capable of data exfiltration and lateral movement. Operation DragonReturn: DcRAT Deployment via Fake ITR Utilities Executive Summary A China-nexus threat cluster is actively exploiting the predictable workflows of Indian tax professionals, corporate finance teams, and individual taxpayers through phishing campaigns distributing DcRAT (Dark Crystal Remote Access Trojan). Operation DragonReturn, as tracked by Seqrite Labs, demonstrates sophisticated understanding of Indian taxation cycles and organizational structures - critical operational intelligence required for high-success-rate social engineering. From an attacker's perspective, this campaign is methodologically sound: it targets a specific, predictable event (tax filing deadlines), uses trusted entity impersonation (Income Tax Department), and deploys a mature RAT with established evasion capabilities. The selection of DcRAT indicates access to commodity malware-as-a-service (MaaS) infrastructure, likely from Chinese underground forums where such tools are actively monetized and continuously updated. Attack Vector Analysis This operation chains multiple MITRE ATT&CK techniques into a cohesive infection chain: Initial Compromise: Spear-Phishing with Pretexting Attackers execute T1566.002 (Phishing - Spearphishing Attachment) by crafting emails impersonating legitimate Indian Income Tax Department communications. The social engineering layer leverages T1598.003 (Phishing - Spearphishing Link) with URLs pointing to malicious tax filing utilities. Pretexting is enhanced through T1589.001 (Gather Victim Identity Information - Credentials) , as attackers likely harvested tax professional contact lists from public records, LinkedIn OSINT, or previous data breaches. The timing of campaigns around Indian fis

Originally published on satyamrastogi.com Three malicious npm packages masquerading as PostCSS tools delivered Windows RAT payloads. Analysis of supply chain attack mechanics, payload delivery chains, and detection gaps in dependency management. Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT Executive Summary This is a textbook supply chain attack leveraging npm's trust model. Three packages published in June 2026 - aes-decode-runner-pro , postcss-minify-selector , and postcss-minify-selector-parser - delivered Windows RAT payloads to developers. The attack demonstrates why automated dependency management without behavioral validation is a critical vulnerability. What makes this particularly effective: PostCSS is a legitimate, widely-used build tool. Developers hunting for PostCSS plugins via search or copy-pasting dependency names from tutorials become easy prey. The attacker didn't need zero-days, social engineering sophistication, or exploit kits. Just npm account registration and package uploads. This follows the exact pattern we've seen in credential theft campaigns prioritizing convenience over complexity . Low barrier to entry, high payoff. Attack Vector Analysis MITRE ATT&CK Framework Mapping This attack chains multiple techniques: T1195.001: Compromise Third-Party Software Supply Chain - Malicious package publication on npm registry T1566.002: Phishing - Spearphishing Link - Package discovery and recommendation (implicit trust) T1059.003: Command and Scripting Interpreter - Windows Command Shell - RAT payload execution T1105: Ingress Tool Transfer - Initial RAT download mechanism T1571: Non-Standard Port - C2 communication channels (typical) Kill Chain Breakdown Stage 1: Reconnaissance & Naming Attacker identifies PostCSS as high-value target (builds present in thousands of projects) Creates names that blend legitimacy with search results: postcss-minify-selector exploits incomplete package searches The aes-decode-runner-pro variant sug