DFIR Radar

CVE-2026-123158 in OpenSSH on musl-based systems is actively exploited, with confirmed root access on a honeypot. Search /var/log/messages for "Accepted password for" on accounts lacking a password hash, then patch and restart sshd. #DFIR_Radar

CVE-2026-123158 (CVSS 8.1) in OpenSSH on musl-based Alpine Linux exploitation observed within 9 hours. Hunt /var/log/messages for "Accepted password" on asterisk-hash accounts, then patch to 10.6p2. #DFIR_Radar

ARTEX, an AI-driven C2 framework, shows 1,465 exposed consoles globally, linked to Chinese 🇨🇳 Storm-0940 and Crafty Falcon. Check for ARTEX co-hosted with Cobalt Strike or Vshell. #DFIR_Radar

CVE-2025-20701 in Beats Studio Buds let a nearby attacker win a case-open pairing race, bond persistently, and extract the Identity Resolving Key. Update to firmware 1B211; treat unexpected audio routing changes as an investigation trigger. #DFIR_Radar

AI-powered autonomous pentesting framework ARTEX, developed in China 🇨🇳, was used in financially motivated breaches hitting seven South Korean 🇰🇷 financial institutions, exposing data on roughly 66,000-67,000 individuals and 2,200 corporations. Key findings: - CrowdStrike assessed with moderate confidence that a single Chinese-speaking individual, not an established threat group, ran the campaign for financial gain. ARTEX is an open-source autonomous penetration testing framework licensed under AGPL-3.0, with its GitHub repository and Docker image removed October 11 though forks remain. The primary ARTEX console sat at 38.244.50[.]120 on Cogent's Los Angeles network, with 15 open ports, the login page on 443 and 8090, plus a Gemini2API admin console and Tinyproxy server. The reseller domain xcai[.]pro routed AI model traffic, and a Hong Kong jump server at 23.248.226[.]250 on AS138415 held 42 files across 105 MB, including credentials for DeepSeek, Zhipu AI GLM models, and a rotating proxy pool. - The AI harness is the most operationally significant detail. Claude Code version 2.1.221 served as the agent frontend, started 510 times since August 4, but it never spoke to Anthropic. A local shim, ds-models-shim[.]py, faked the model discovery endpoint and routed requests through xcai[.]pro to api.deepseek[.]com/anthropic, with DeepSeek v4.1 Flash as primary and GLM 5.3 and Grok 4.6 as backups. A second shim, xcai-effort-shim[.]py, injected a reasoning parameter the backend would otherwise skip. This chain let one operator run multiple large language models across a single campaign without direct API contracts. - The state file logged 19 custom agent skills with 147 recorded uses covering code audit, reconnaissance, web injection, WAF bypass, authentication testing, JNDI and LDAP exploitation, CAPTCHA bypass, and payment logic testing. Three self-registered test accounts with cash-in deposit API tokens dated September 12 sat next to the payment skill, with a comment labeling them an authorized self-built test. That setup fits insecure direct object reference testing against Korean loan and inquiry services, the technique CrowdStrike and Genians described. A separate directory at 23.248.226[.]250:8001 held a staged JNDI and LDAP exploitation kit retrieved October 5 at 03:42 UTC, confirming command execution through DNS callback. - ARTEX is not a single-operator tool. Hunting its certificate issuer returned 19 IPs including 38.244.50[.]120. Matching the console page title returned roughly 1,300 IPs across 30 countries, with 21 title string variants in English, Chinese 🇨🇳, Korean, Japanese 🇯🇵, Russian 🇷🇺, Portuguese 🇵🇹, and Vietnamese 🇻🇳. An AttackCapture malware-name search yielded 280 results with open directories, including a Seoul host at 130.94.31[.]86:18888 and 156.251.11[.]39 running an SMB recon toolkit whose test script writes a file named artex_probe_11876.txt. Other recovered hosts carried DedeCMS and FangCMS exploitation kits, RuoYi and Spring admin console exploits, and CAPTCHA-based login automation. - Other tooling recovered from the open directory included Linux privilege escalation exploits, iOS probe source code, Android kernel and firmware utilities, and scripts targeting a cryptocurrency exchange's admin session and withdrawal functions. Hunt[.]io has not confirmed their connection to the Korean breaches. A FOFA asset search script using a backup API key was also present, with a comment noting the primary membership had expired. Hunt for ARTEX exposure in your environment by checking for unexpected processes proxying requests to api.deepseek[.]com, outbound DNS callbacks paired with LDAP or JNDI traffic, and reverse SSH tunnels with names like grok2api. Search internet-facing hosts for the ARTEX console page title and audit any exposed directories for credentials files, shim scripts, or tunnel maintenance scripts. The Hunt[.]io report includes IOCs: rotate any API keys, proxy credentials, and SSH passwords that may have appeared in exposed files before anything else. #DFIR_Radar

CVE-2026-123158 (CVSS 8.1) lets attackers bypass password auth on Alpine Linux OpenSSH via musl without PAM. Search /var/log/messages for "Accepted password for" on affected hosts, then restart sshd after patching. #DFIR_Radar

CISA and FBI warned that default passwords and unsecured internet exposure let attackers manipulate European supermarket and blood-storage refrigeration systems. Audit OT cold-chain controllers for public internet exposure and default credentials. #DFIR_Radar

Plex2Shell (CVE-2026-96652 through CVE-2026-96656, all CISA KEV) is actively compromising internet-exposed QNAP NAS devices running Plex Media Server. Treat exposed NAS as compromised, reinstall QTS clean, then reset credentials. #DFIR_Radar

CVE-2026-83844, a CVSS 8.1 out-of-bounds read in Microsoft Store Paint, enables network RCE with no privileges or user interaction needed. Run Get-AppxPackage -AllUsers to confirm build 11.2609.401.0 on managed endpoints. #DFIR_Radar

RODC attack paths deep-dived: scriptPath abuse, managedBy delegation, and RBCD chain to domain Administrator across a segmented internal DC via forged golden tickets. Key findings: - The initial foothold abuses a misconfigured SYSVOL scripts directory where the IT Support group member j.arbuckle has write access despite netexec reporting the share as READ only. Writing rev.bat to \\DC01.garfield[.]htb\SYSVOL\garfield.htb\scripts and setting the scriptPath attribute on CN=Liz Wilson via bloodyAD delivers a shell as l.wilson when that user logs in. The scriptPath attribute on user objects in LDAP is the artifact to audit: unexpected values pointing to SYSVOL scripts are a persistence and lateral movement indicator. - BloodHound CE (collected with RustHound-CE) reveals ForceChangePassword from l.wilson to l.wilson_adm, and WriteAccountRestrictions from l.wilson_adm to RODC01$. The box also exposes that RODC Administrators grants WriteProperty on managedBy, msDS-RevealOnDemandGroup, and msDS-NeverRevealGroup on the RODC01 computer object, which is the pivot to local admin on the RODC. These ACEs are inherited by child objects and can be missed if tooling only resolves direct ACEs: Get-DomainObjectAcl with -ResolveGUIDs against the full domain object set is the reliable enumeration path. - Two independent paths reach administrator on RODC01: setting managedBy on RODC01$ to l.wilson_adm grants full local admin privileges on that machine (confirmed via PSSession); or configuring resource-based constrained delegation (RBCD) using a fake computer account (MachineAccountQuota: 10), then running getST[.]py with S4U2Proxy to impersonate the domain Administrator to cifs/RODC01.garfield[.]htb, and executing via wmiexec[.]py over a Chisel SOCKS tunnel from Linux. - The RODC's msDS-RevealedUsers attribute already contains cached credentials for the domain Administrator account despite the Administrator group being listed in msDS-NeverRevealGroup. This is the core detective artifact: querying msDS-RevealedUsers via ldapsearch and decoding the binary metadata (attribute ID, version, timestamp) reveals which credential material is cached and when it was last replicated. The RODC copy is at version 7 (September 2025) while DC01 carries version 9 (October 2025), confirming the cached hash is stale but the policy violation itself is a critical finding. - Once admin on RODC01, the attack chain rewrites msDS-RevealOnDemandGroup to allow the domain Administrator to be cached, then forces replication or forges an RODC golden ticket using the krbtgt_8245 key (linked via msDS-KrbTgtLink on RODC01's object) to authenticate as domain Administrator against DC01. The krbtgt_8245 account naming pattern (krbtgt_<number>) is the LDAP signal that an RODC exists in the environment even when it is hidden on an internal subnet. Hunt tip: in any AD environment with RODCs, query msDS-RevealedUsers on every RODC computer object and decode the cached account list. Cross-reference against msDS-NeverRevealGroup members: any overlap is an unauthorized credential cache that could be exploited. Also audit scriptPath on all user objects for unexpected values, especially paths pointing into SYSVOL scripts directories writable by non-admin groups. #DFIR_Radar