Front Page

Supply Chain

Poisoned at the Source: 400+ Arch Linux Packages Spiked With an eBPF Rootkit and Credential Stealer

A campaign disclosed this week poisoned more than 400 packages in the Arch User Repository, planting a Linux ELF binary that pairs a credential stealer with an eBPF-based rootkit able to run in kernel space and hide its own processes. The operator spoofed a trusted maintainer and hijacked at least 20 orphaned packages by quietly rewriting their PKGBUILD files.

The stealer rakes in GitHub credentials, SSH keys, HashiCorp Vault tokens, browser cookies, and chat data from Slack, Discord, Teams, and Telegram before exfiltrating over HTTP. Because the rootkit can survive ordinary cleanup, Sonatype and IFIN researchers tell responders to rotate every secret and rebuild affected hosts from scratch. Forensic priority: capture PKGBUILD and pre-install-script changes, hunt eBPF program loads and hidden-PID discrepancies, and treat any developer secret exposed to an infected machine as burned.

AI Threat

Ransomware, Assembled by Agents: Sophos Finds an 80-Module Attack Toolkit Built With AI Coding Assistants

Investigating a customer intrusion, Sophos uncovered a sprawling, AI-assembled attack framework — roughly 80 modules tested against more than 70 evasion techniques and against Sophos, CrowdStrike, and Microsoft EDR. It automates Active Directory discovery and bundles Cobalt Strike profiles, Telegram-bot command-and-control, Python shellcode injectors, and Cloudflare Workers redirectors.

Most striking is the assembly line behind it: a Claude Opus 4.5 agent coordinated the R&D while specialized agents handled coding, OPSEC hardening, proxy testing, and documentation of bypass research lifted from major vendors, generating payloads in Rust and Go. Russian-language scripts, a Git repo holding an AD-discovery panel, and Cobalt Strike operator logs referencing ransom notes and leak sites round out the evidence. Forensic priority: preserve developer-tool and AI-agent artifacts, profile the Rust/Go loaders, and watch for Telegram and Cloudflare Workers egress.

Threat Bulletin

ACTIVE EXPLOIT
CVE-2026-35273

Oracle PeopleSoft Enterprise PeopleTools — an unauthenticated SSRF-to-RCE flaw in the Environment Management Hub (PSEMHUB) lets a remote attacker run code over HTTP with no credentials and no user interaction; CVSS 9.8. Mandiant tracked zero-day exploitation by ShinyHunters (UNC6240) from May 27, with stolen university data posted to the group's leak site on June 9; CISA KEV June 12. Forensic Note: Review PSEMHUB and web-server logs for unauthenticated requests, hunt exfiltration staging and web shells, and inventory PeopleTools 8.61/8.62 builds.

CRITICAL
CVE-2026-20253

Splunk Enterprise — an unauthenticated PostgreSQL sidecar service (added in v10 and proxied through the web port) accepts any credentials on its /v1/postgres/recovery backup and restore endpoints, letting an attacker write arbitrary files and chain a malicious database restore into code execution; CVSS 9.8. Internet-facing instances, especially on AWS, are immediately at risk. Forensic Note: Audit access to the postgres recovery endpoints, hunt attacker-written .py files and unexpected DB restores, and confirm upgrade to 10.0.7 or 10.2.4.

Malware Spotlight

Backdoor.Turn — DragonForce Teams-Relay C2

DragonForce — a cartel-structured ransomware operation linked to Scattered Spider — is deploying Backdoor.Turn, a RAT that tunnels its command-and-control through Microsoft Teams TURN relay servers. By grabbing an anonymous Teams visitor token and riding legitimate Microsoft relay infrastructure, its traffic blends into ordinary conferencing and slips past egress filtering; the implant runs commands, scans networks, captures TLS certificates, searches LDAP/AD, and steals credentials. Forensic Note: Hunt unexpected processes negotiating TURN sessions, correlate Teams-relay connections from servers that never host meetings, and pull Symantec's published IOCs.