[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f3rhbxtgv8taz8":56,"i-tabler:arrow-left":120,"i-tabler:tag":122},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":66,"html":67,"metaTitle":58,"metaDescription":68,"shareImage":69,"updatedAt":61,"author":73,"related":76},"midnight-blizzard-linked-server-was-still-serving-malware-weeks-after-exposure-reversinglabs-finds","Midnight Blizzard-Linked Server Was Still Serving Malware Weeks After Exposure, ReversingLabs Finds","ReversingLabs found a staging server in a campaign Microsoft ties to a Midnight Blizzard sub-cluster still serving a PowerShell stager on Oct 5, more than two months after disclosure. The campaign hijacks hotel Wi-Fi captive portals. Here is how to check your devices.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fmidnight_blizzard_threat_report.png","2026-10-18T18:12:39.000+08:00",[63],{"key":64,"label":65},"security","Security",5,"\u003Cp>Publishing a threat report does not switch off the attacker's servers. ReversingLabs has shown that plainly with a staging server tied to a Midnight Blizzard-linked campaign: on October 5, 2026, more than two months after Microsoft first described the operation, the server was still handing out malware to anyone who requested the right paths.\u003C\u002Fp>\u003Cp>The finding comes from \u003Ca href=\"https:\u002F\u002Fwww.reversinglabs.com\u002Fblog\u002Fhow-rl-mapped-a-midnight-blizzard-linked-campaign-from-two-hashes?ref=ghost.jdneer.com\">a new ReversingLabs (RL) analysis\u003C\u002Fa> by Igor Lasic, the company's SVP of Engineering. RL started from just two file hashes that Anthropic published in its \u003Ca href=\"https:\u002F\u002Fwww.anthropic.com\u002Fthreat-intelligence-report-september-2026?ref=ghost.jdneer.com\">September 2026 threat intelligence report\u003C\u002Fa> and worked outward through its own historical telemetry. Those two files led to the staging server at \u003Ccode>213.145.86[.]112\u003C\u002Fcode>, five more builds of the same PowerShell stager, two lure files built to launch it, and links between the campaign's phishing domains and its servers.\u003C\u002Fp>\u003Cp>The attribution comes with careful wording. \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F07\u002F31\u002Fcaptivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft\u002F?ref=ghost.jdneer.com\">Microsoft tracks the operation as CaptiveCrunch\u003C\u002Fa> and attributes it to Storm-2945, which it assesses is \"an operational sub-cluster of Midnight Blizzard,\" the Russia-based group the US and UK governments attribute to Russia's Foreign Intelligence Service (SVR). Anthropic describes its GTG-20006 operator as Russian-speaking, with attribution \"consistent with public reporting linking the actor to Midnight Blizzard.\" RL says its own file analysis neither confirms nor contradicts either vendor's attribution, so it calls the cluster \"Midnight Blizzard-linked,\" and adds that no file it found should be called \"Midnight Blizzard malware\" on its authority.\u003C\u002Fp>\u003Cp>Microsoft's July 31 report explains how victims get hit. Since early May 2026, Storm-2945 has manipulated DNS and HTTP traffic on hospitality networks served by captive portals, the sign-in pages travelers see on hotel Wi-Fi. Microsoft says the group redirects users to phishing sites that imitate Microsoft 365, abuses the device code sign-in flow in Microsoft Entra ID, and serves malware dressed up as browser or operating system updates, often through ClickFix pages that talk the user into running it themselves. Microsoft cites ReliaQuest as finding the activity at conference centers and other shared venues as well as hotels, aimed at the accounts of corporate travelers. In an October 5 update, Microsoft said the campaign resumed on September 29, now including a Rust variant of its backdoor.\u003C\u002Fp>\u003Cp>The two seed files are a PowerShell stager Microsoft calls ChocoShell and a Go backdoor it calls CornFlake. According to Microsoft, ChocoShell steals browser cookies, saved passwords, Microsoft 365 single sign-on tokens and Wi-Fi credentials, beacons to \u003Ccode>\u002Ft\u002Fpixel.gif?m=\u003C\u002Fcode> on the staging server, and sends stolen data to \u003Ccode>\u002Ft\u002Fevent\u003C\u002Fcode>. CornFlake is a full remote access trojan that installs itself as \u003Ccode>svchost32.exe\u003C\u002Fcode>, registers a Windows service named \"svchost32\" with the display name \"Cloud Sync Service,\" and adds Run keys and scheduled tasks for backup persistence. RL independently saw the backdoor read Edge, Chrome and Firefox profile data and the Microsoft Teams cache.\u003C\u002Fp>\u003Cp>RL had both files in its telemetry weeks before anyone published, first seeing the backdoor on July 6 and the stager on July 10. Its platform classified them as malicious on August 1, the day after Microsoft's report, and RL is upfront that this verdict was not independent of Microsoft. A YARA hunt on the stager's beacon labels, \u003Ccode>stage2_entry\u003C\u002Fcode> and \u003Ccode>stage2_ctx_\u003C\u002Fcode>, turned up five rebuilt stagers with different hashes but an identical 35-item capability profile, arriving between July 9 and August 3. RL says that pattern is consistent with Anthropic's account of the operator using Claude to rebuild implants after they were detected, though its data cannot show what produced them.\u003C\u002Fp>\u003Cp>Two of RL's finds show why antivirus scores alone missed this. The lure files are 60-byte Windows Internet Shortcut (\u003Ccode>.url\u003C\u002Fcode>) files that contain nothing but a link to a stager path on the server, so none of 37 antivirus engines flagged them. The servers fared little better: when RL checked in late September, 13 of the 14 servers Anthropic listed were flagged by 0 to 5 of roughly 49 reputation sources, and the staging server itself by 6 of 50. On October 5, the stager download path \u003Ccode>\u002Fs\u003C\u002Fcode>, a shortcut's \u003Ccode>\u002Fs?r=7ed4bb1d\u003C\u002Fcode> link and a fake JavaScript bundle path all answered HTTP 200 and each delivered a file RL classifies as malicious. RL notes this is a dated snapshot, not proof the server is still up today. Several phishing domains also still answered, while the Outlook Web Access lookalike \u003Ccode>owa-ms365[.]com\u003C\u002Fcode> returned 403. Coverage from \u003Ca href=\"https:\u002F\u002Fgbhackers.com\u002Fmidnight-blizzard-malware\u002F?ref=ghost.jdneer.com\">GBHackers\u003C\u002Fa> matches RL's account.\u003C\u002Fp>\u003Cp>\u003Cstrong>Are you affected?\u003C\u002Fstrong> These checks come from the indicators in the ReversingLabs and Microsoft reports. The malware targets Windows, so run the PowerShell checks on laptops, especially those of staff who travel. A hit means investigate, not proof of compromise.\u003C\u002Fp>\u003Cul>\u003Cli>Look for the CornFlake service. Microsoft gives the name svchost32 and the display name \"Cloud Sync Service\":\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>Get-Service -Name svchost32 -ErrorAction SilentlyContinue |\n  Format-List Name, DisplayName, Status\nGet-CimInstance Win32_Service |\n  Where-Object DisplayName -eq 'Cloud Sync Service'\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Look for the backdoor binary. Microsoft gives the path as \u003Ccode>%APPDATA%\\svchost32\\svchost32.exe\u003C\u002Fcode>, and RL observed \u003Ccode>%LOCALAPPDATA%\\Microsoft\\svchost32\\svchost32.exe\u003C\u002Fcode>, so check both:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>Test-Path \"$env:APPDATA\\svchost32\\svchost32.exe\"\nTest-Path \"$env:LOCALAPPDATA\\Microsoft\\svchost32\\svchost32.exe\"\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Check Run keys and scheduled tasks for anything launching svchost32.exe:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>Get-ItemProperty 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' |\n  Format-List\nGet-ScheduledTask |\n  Where-Object {{ $_.Actions.Execute -match 'svchost32' }}\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Compare file hashes against the two published samples:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>Get-FileHash -Algorithm SHA256 <suspect-file>\n# ChocoShell stager:\n# be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\n# CornFlake backdoor:\n# 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Look for small \u003Ccode>.url\u003C\u002Fcode> shortcuts pointing at the staging server in Downloads and on the desktop:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>Get-ChildItem \"$env:USERPROFILE\\Downloads\", \"$env:USERPROFILE\\Desktop\" `\n  -Filter *.url -ErrorAction SilentlyContinue |\n  Select-String -Pattern '213\\.145\\.86\\.112'\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Search proxy, firewall and DNS logs for the network indicators in the table, plus requests to \u003Ccode>\u002Ft\u002Fpixel.gif?m=\u003C\u002Fcode>, \u003Ccode>\u002Ft\u002Fevent\u003C\u002Fcode> and \u003Ccode>\u002Fcdn\u002Fchunks\u002F\u003C\u002Fcode> on the staging server.\u003C\u002Fli>\u003Cli>Review Microsoft Entra ID sign-ins for device code authentication, and block the device code flow with Conditional Access where your business allows it. Both RL and Microsoft recommend this.\u003C\u002Fli>\u003Cli>Treat any captive portal or Wi-Fi sign-in page that offers a browser update, system update, certificate or tool, or asks you to paste and run a command, as hostile. Microsoft advises against downloading anything presented through captive portals and recommends checking for updates through the operating system itself.\u003C\u002Fli>\u003C\u002Ful>\n\n\u003Ctable>\u003Cthead>\u003Ctr>\u003Cth>Indicator (defanged)\u003C\u002Fth>\u003Cth>Role, per source\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\n\u003Ctr>\u003Ctd>213.145.86[.]112\u003C\u002Ftd>\u003Ctd>Staging server, ChocoShell C2 (RL, Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>107.189.26[.]194\u003C\u002Ftd>\u003Ctd>ChocoShell C2, DNS resolver (Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>31.57.243[.]154\u003C\u002Ftd>\u003Ctd>Phishing host for owa-ms365 (RL, Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>104.145.210[.]184\u003C\u002Ftd>\u003Ctd>Device code phishing server (RL)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>38.146.28[.]75, 104.194.159[.]150\u003C\u002Ftd>\u003Ctd>AitM infrastructure (Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>38.146.28[.]132\u003C\u002Ftd>\u003Ctd>DNS resolver (Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>154.29.75[.]245, 149.3.170[.]186\u003C\u002Ftd>\u003Ctd>Infrastructure seen Sep 29 to Oct 1 (Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>ms365-live[.]com, ms365-device[.]com\u003C\u002Ftd>\u003Ctd>Device code phishing redirects (Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>owa-ms365[.]com, m365-owa[.]com\u003C\u002Ftd>\u003Ctd>AitM phishing (Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>cdn-gstat[.]com, sslcdnhost[.]com\u003C\u002Ftd>\u003Ctd>Redirects seen Sep 30 (Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>network-privacy[.]com\u003C\u002Ftd>\u003Ctd>Redirect seen Oct 1 (Microsoft)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>wa-meeting[.]com, chamber-ua[.]org\u003C\u002Ftd>\u003Ctd>Lookalike domains (RL)\u003C\u002Ftd>\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\n\n\u003Cp>RL also lists \u003Ccode>192.142.52[.]31\u003C\u002Fcode> as a hunting lead, not a confirmed indicator. It assesses with moderate confidence that the backdoor uses this address and advises validating it before blocking. RL's broader lesson for defenders is to query every new vendor report's indicators against historical logs the day it lands, and not to assume that disclosure took the infrastructure offline.\u003C\u002Fp>","ReversingLabs found a staging server in a campaign Microsoft ties to a Midnight Blizzard sub-cluster still serving a PowerShell stager on Oct 5, more than...",{"src":60,"width":70,"height":71,"type":72},1600,900,"image\u002Fpng",{"name":74,"url":75,"owner":13},"Aiko Tanaka",null,[77,89,100,111],{"slug":78,"title":79,"excerpt":80,"image":81,"publishedAt":82,"topics":83,"readMinutes":88},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[84,87],{"key":85,"label":86},"advisories","Advisories",{"key":64,"label":65},1,{"slug":90,"title":91,"excerpt":92,"image":93,"publishedAt":94,"topics":95,"readMinutes":88},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[96,99],{"key":97,"label":98},"guides","Guides",{"key":64,"label":65},{"slug":101,"title":102,"excerpt":103,"image":104,"publishedAt":105,"topics":106,"readMinutes":88},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[107,110],{"key":108,"label":109},"opinion","Opinion",{"key":64,"label":65},{"slug":112,"title":113,"excerpt":114,"image":115,"publishedAt":116,"topics":117,"readMinutes":88},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[118,119],{"key":108,"label":109},{"key":64,"label":65},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":121},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]