Expel

Microsoft says Storm-0940 used ARTEX, an open-source AI attack framework, in the #ConnectWise Cloud Backup compromise. A stolen app credential let it sign in to Microsoft 365 tenants as the app, with no user login needed. We’ve seen the same infrastructure go after #Okta. (1/3)

In one customer’s Okta environment, the attacker used self-service registration to create at least five accounts of its own, enrolled Okta Verify on three within about a minute, then started signing in to apps via SSO. We haven’t seen this in public reporting yet. (2/3)

expel.comStorm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-ups | ExpelStorm-0940 used ARTEX AI agents to abuse ConnectWise apps and Okta self-registration. Get the IOCs, detection guidance, and steps to take now.

If you’ve ever had a ConnectWise Cloud Backup or SkyKick app in Microsoft 365, disable it (don’t delete it) and check every app for secrets added since Oct. 13 that you didn’t create. Then hunt in all your identity providers. IOCs and details (3/3): expel.com/blog/storm-0...

By now you’ve probably seen php2shell: two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) that can let attackers run code without logging in. Here’s what defenders need to know. (1/5)

No confirmed IOCs yet. Watch for: → PHP or web server processes launching shells or download tools → New or changed PHP files in web directories → Unexpected outbound traffic from web servers Clean logs don’t prove you’re safe. Some exploit paths may not log predictably. (4/5)

expel.comPhp2Shell: Two critical PHP flaws let attackers run code without logging inPHP shipped emergency fixes for two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619). Here's what's confirmed, and what to do now.

expel.com/blog/php2she... (5/5)

By now you’ve probably seen php2shell: two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) that can let attackers run code without logging in. Here’s what defenders need to know. (1/5)

PHP says every install serving web requests is affected, and rates Apache mod_php highest risk. The fix: update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restart every PHP worker. Running processes keep the old code. On 8.1 or older? Upgrade or use a backport. (2/5)

Also: → Find all your PHP: CMS, control panels, containers, vendor products → Can’t patch yet? PHP’s partial mitigations reduce exposure but don’t make a system safe → Exploit code is circulating. None is verified, some may be malicious. Don’t run it. (3/5)

Cute: QuartzLine’s C2 paths read like a geology glossary (/quarry/geode, /quarry/talc, /quarry/sinter). Less cute: Stone-cold social engineering. #QuartzLine hides a backdoor inside a working PDF viewer, then quietly mines Chrome data and drops a RAT. (1/2)

expel.comQuartzLine: A working PDF viewer with a backdoor insideQuartzLine is a working PDF viewer with a backdoor inside, spread in part through Google Ads. See what it does in real environments, plus IOCs.

(2/2) What we saw in real environments, plus IOCs, detection tips, and cleanup steps: expel.com/blog/quartzl...

On August 18, we caught a malware loader we believe to be novel. Entry point: a threat actor phished a client’s user through Microsoft Teams, posing as the IT help desk. We named it SynkLoader. (1/7)

The attackers went hands-on-keyboard, running commands in real time, until they realized our “network” wasn’t real. Then they disconnected. (6/7)

expel.comSynkLoader: when you throw in everything but the kitchen sinkDiscover a new malware family, SynkLoder. See how we reverse-engineered its phishing tactics to expose its attack chain.

Our read, medium confidence: this toolkit belongs to a ransomware group or an initial access broker feeding one. Full breakdown, every module we received, and IOCs on the blog: expel.com/blog/synkloa... (7/7)

We reverse engineered it, fed it fake data to look like a huge corporate network, and waited. The attackers took the bait and sent down several modules for us to examine. (4/7)

One module throws up a fake Windows lock screen to steal the user’s real password. It even reclaims focus so the victim can’t escape it. Can you spot the fake? (5/7)

The attacker got the user to install an MSI billed as a “PowerShell Cleaner,” hosted on legit-looking Microsoft Azure storage. (2/7)

The loader chains Python, C#, C++, and PowerShell to dodge EDR. Everything but the kitchen sink. 😉 (3/7)

A self-propagating npm supply chain worm compromised keyv, cacheable, flat-cache, file-entry-cache, and 800+ downstream packages—stealing CI/CD, cloud, and API credentials along the way. (1/6)

➡️ Audit lockfiles for affected package versions and pin to known-clean releases ➡️ Rotate every secret on any host or CI/CD runner that touched a compromised package ➡️ Check GitHub Actions and npm publishing logs for unauthorized activity (5/6)

expel.comChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and cacheableA self-propagating npm worm hit keyv, cacheable, and hundreds of dependent packages to steal CI/CD, cloud, and API credentials. Here's what to do now.

More on the blog: expel.com/blog/chaindr... (6/6)

A self-propagating npm supply chain worm compromised keyv, cacheable, flat-cache, file-entry-cache, and 800+ downstream packages—stealing CI/CD, cloud, and API credentials along the way. (1/6)

Running npm install on an affected package launches a hidden preinstall script (setup.mjs), which pulls a temporary Bun runtime and runs an obfuscated payload (Math_Symbol.js). No extra user interaction required. (3/6)

The payload harvests npm, GitHub, AWS, Kubernetes, and Vault credentials, plus SSH keys, .env files, database strings, and API keys for services like Slack and Stripe—then encrypts and exfiltrates them to GitHub repos and Ethereum smart contracts. (4/6)

A self-propagating npm supply chain worm compromised keyv, cacheable, flat-cache, file-entry-cache, and 800+ downstream packages—stealing CI/CD, cloud, and API credentials along the way. (1/6)

It started with a compromised GitHub account. Attackers pushed malicious code straight to the main branches, triggering GitHub Actions to build and publish infected updates to npm—complete with valid signatures. (2/6)

In April 2026, a Chinese cybercrime group accessed a support rep's device at DigiCert—then used that access to steal code-signing certificates meant for DigiCert customers. We're calling the actors CylindricalCanine. 🧵 1/4

The original Gh0st RAT’s source code became public in 2008. We’re calling this custom version Golden Gh0st RAT. It uses WebSocket and a custom encryption. In the blog, we share tools to decrypt the network traffic and Suricata rules to detect it. 3/4

expel.comIntroducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incidentCylindricalCanine is a new threat group within GoldenEyeDog, and they're actively using their malware for email phishing. Here's what you need to know.

Full technical breakdown, decryption tools, and IOCs here: expel.com/blog/introdu... 4/4

CylindricalCanine is a part of a larger group known as GoldenEyeDog. The malware they used in the intrusion—and used the certificates to sign—is a malware we’re calling Golden Gh0st Loader. Golden Gh0st Loader decrypts and loads a custom version of Gh0st RAT. 2/4

expel.comThe “first” fully agentic ransomware is here, but we aren’t panicking (yet): Meet JadePufferAnalysis of agentic ransomware JadePuffer: human operator, LLM agent limits, and why fundamentals still protect defenders.

6 July

Researchers at Sysdig found JadePuffer used an LLM agent to conduct a ransomware attack. Is this future of ransomware? In this case, a human still steered it and struggled with the basics. expel.com/blog/the-fir...

The Gentlemen ransomware, in a BYOVD attack, used a zero-day exploit to kill EDRs before deploying their payload. The driver they abused wasn't on any public blocklist. Here's our analysis of their techniques. 🧵

What helps: → Windows 11 (build 10.0.26100.32690+): cross-signing disabled blocks ktapi.sys → VBS + memory integrity: kills shellcode execution → WDAC: best option—allowlist only approved kernel drivers (7/8)

expel.comNot very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRsHow the threat group used a zero-day vulnerability to disable the target's EDR, preventing it from intervening in their ransomware attack.

IOCs—block by filename, driver version may vary: → ktapi.sys (SHA-256: 7ee17efef04bb7c9de90d5210263ed6993f867e5a11f86e65e3bb1362c7de237) → was.exe (SHA-256: c277ae5a4dd62f51de5278790796cd2700de7f77ea17762e97729f27872d076b) Full breakdown by Marcus Hutchins: expel.com/blog/not-ver... (8/8)

Kernel code execution without triggering PatchGuard: hijack two Win32k syscall stubs that KPP doesn't protect. SMAP is bypassed via KUSER_SHARED_DATA's kernel mapping; SMEP via shellcode written to RWX kernel pool memory. (5/8)

The result: full kernel-mode function calls from user space. They call PsTerminateProcess directly—bypassing Protected Process and EDR self-defense—in a loop targeting Windows Defender, ESET, Cortex XDR, and SentinelOne. (6/8)

The driver: ktapi.sys, from hardware vendor Kontron. Before our research, it had one Google result. No known abuse. A zero-day at time of publication—absent from every public vulnerable driver blocklist. (3/8)

The exploit abuses a vulnerable IOCTL in ktapi.sys to map arbitrary physical memory into the calling process. It then scans the system’s RAM for its own PML4 page table and uses it to assist in reading/writing kernel memory directly from user mode. (4/8)

The Gentlemen emerged in July 2025 and rely heavily on BYOVD attacks—load a legitimate-but-vulnerable kernel driver, use it to kill endpoint security, then run ransomware. We caught them doing exactly this in early April. (2/8)

youtube.comMini Shai-Hulud: the wormable attack targeting your supply chainYouTube video by Expel

13 May

Need a high-level overview of the latest Mini Shai Hulud? Aaron Walton breaks down how the latest supply chain attack happened, what defenders should do now, and prepare for the next one. www.youtube.com/shorts/7x9t6...

By now you've probably seen the Mini Shai Hulud supply chain story. TeamPCP compromised 170+ npm and PyPI packages—TanStack, Mistral AI, OpenSearch, and more. Here's what you need to know if you're responding right now. (1/7)

If you suspect compromise: containment before rotation. Disable unauthorized services first, then rotate GitHub PATs, npm publish tokens, AWS access keys, and HashiCorp Vault tokens. Pin your dependencies to verified hashes going forward. (6/7)

expel.comMini Shai Hulud: Cross-ecosystem supply chain worm targeting npm & PyPlA supply chain worm compromised 170+ npm and PyPI packages. Here's what happened, the IOCs to watch for, and how to respond.

Full breakdown—IOCs, attack chain, and step-by-step remediation—on the Expel blog: expel.com/blog/mini-sh... (7/7)

IOCs to hunt for: Domains: filev2.getsession[.]org, api.masscan[.]cloud, git-tanstack[.]com Files: router_init.js, setup.mjs, transformers.pyz Hash: ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c IP: 83[.]142[.]209[.]194 (4/7)

Start here if you think you're affected: → Check node_modules for router_init.js → Check .vscode/tasks.json and ~/.claude/settings.json for unauthorized hooks → Disable gh-token-monitor.service if present → DNS-block api.masscan[.]cloud (5/7)

The payload (router_init.js or setup.mjs) profiles the environment and targets: → AWS IAM keys → GitHub Personal Access Tokens → HashiCorp Vault tokens → Kubernetes secretsData exfiltrated via Session Protocol to evade DNS-based blocking. (2/7)