@ExpelSecurity
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
The leader in agentic MDR.
Joined August 2016
- Tweets4.2K
- Following281
- Followers12.9K
- Likes2.2K
Expel retweeted
Your AI Risk Isn’t Unknown: It’s Unowned hubs.li/Q04wbq0m0 Written by Dave Merkel of @expelsecurity
On August 18, we caught a malware loader we believe to be novel. Entry point: a threat actor phished a client’s user through Microsoft Teams, posing as the IT help desk. We named it SynkLoader. (1/7)
The attackers went hands-on-keyboard, running commands in real time, until they realized our “network” wasn’t real. Then they disconnected. (6/7)
Our read, medium confidence: this toolkit belongs to a ransomware group or an initial access broker feeding one. Full breakdown, every module we received, and IOCs on the blog: expel.com/blog/synkloader-wh… (7/7)
Based on our analysis, GoldenEyeDog has separate teams with dedicated resources and targets, and these separate teams can be distinguished based on code-signing certificate usage and tactics.
1/2
We’re tracking these two groups as CylindricalCanine (Expel-TA-0002) and CuboidalCanine (Expel-TA-0003). This blog, part two of the series, is dedicated to understanding their differences and diving into CuboidalCanine.
expel.com/blog/cylindricalca…
2/2
In this version, CylindricalCanine still downloads the second stage from a text file hosted in the CDN. However, the files don't have normal extensions anymore.
Looking in the directory shared by @elasticseclabs, we found two new certificates of interest.
🧵1/5
Elastic Security Labs is tracking Golden Gh0st RAT targeting Western companies, expanding beyond its previously documented targeting of financial organizations in the Asia-Pacific region.
Same TTPs as @ExpelSecurity CylindricalCanine research post: go.es.io/3TEZ0G6
The initial payload was delivered as a fake screenshot with a .pif extension, signed with a revoked certificate and hosted on myphotos[.]s[.]gy.
Follow-on payloads were staged in a public Google Cloud Storage bucket at storage[.]googleapis[.]com/nikeupdat/.
Multiple stages, and every one is either validly code-signed or never exists on disk as an executable.
Abused code-signing certificates, all valid at time of use.
Two are EV, same CA, both dated 2026-07, issued to two different "Private Organization" subjects:
- 杭州思维宇宙科技有限公司 (Hangzhou Siwei Yuzhou Technology), thumbprint: 14E0FCA3F0F656D1AF6EA66E1B2B7C6B4ACD8E2D
- Dongguan Jieshan Technology Co., Ltd, thumbprint: C29C3C494A348EA879ABFF50DD56B85E9CB6366A
IOCs:
api[.]probref[.]com:5188 (C2)
storage[.]googleapis[.]com/nikeupdat/
myphotos[.]s[.]gy
5ef6019fb6ee1db1201ee479a68669b47eb0d5d82770dbd30b05f46ccbc68f4f
b6cb6d5de2c62aa1351b1b240dc223c3d6fa95083cf43b2866d84a8a6c4d0446
The previous file was signed with the stolen Tencent certificate (thumbprint: 67DE1A4FB2174930244B306B14E2D7BF67CD05F0);
SHA256: f39979afbaaad749121ed74bdc84480106d8f61b276fec890480d64f46542ee9
We've reported the Monarch and Chengdu certificates for revocation.
4/5
We explained the main attack technique in greater detail in this blog. From what we are seeing, only small details have changed in this latest campaign: expel.com/blog/introducing-c…
5/5
Expel retweeted
It takes a village to organise and run a village. We would like to thank our 2026 sponsors whose support funds our activities.
Platinum: @hackthebox_eu
Gold: DeepTempo, Detection Engineering Weekly, @ExpelSecurity, @FRSecure & @tryhackme
blueteamvillage.org/
Expel retweeted
Elastic Security Labs is tracking Golden Gh0st RAT targeting Western companies, expanding beyond its previously documented targeting of financial organizations in the Asia-Pacific region.
Same TTPs as @ExpelSecurity CylindricalCanine research post: go.es.io/3TEZ0G6
The initial payload was delivered as a fake screenshot with a .pif extension, signed with a revoked certificate and hosted on myphotos[.]s[.]gy.
Follow-on payloads were staged in a public Google Cloud Storage bucket at storage[.]googleapis[.]com/nikeupdat/.
Multiple stages, and every one is either validly code-signed or never exists on disk as an executable.
Abused code-signing certificates, all valid at time of use.
Two are EV, same CA, both dated 2026-07, issued to two different "Private Organization" subjects:
- 杭州思维宇宙科技有限公司 (Hangzhou Siwei Yuzhou Technology), thumbprint: 14E0FCA3F0F656D1AF6EA66E1B2B7C6B4ACD8E2D
- Dongguan Jieshan Technology Co., Ltd, thumbprint: C29C3C494A348EA879ABFF50DD56B85E9CB6366A
IOCs:
api[.]probref[.]com:5188 (C2)
storage[.]googleapis[.]com/nikeupdat/
myphotos[.]s[.]gy
5ef6019fb6ee1db1201ee479a68669b47eb0d5d82770dbd30b05f46ccbc68f4f
b6cb6d5de2c62aa1351b1b240dc223c3d6fa95083cf43b2866d84a8a6c4d0446
A self-propagating npm supply chain worm compromised keyv, cacheable, flat-cache, file-entry-cache, and 800+ downstream packages—stealing CI/CD, cloud, and API credentials along the way. (1/6)
➡️ Audit lockfiles for affected package versions and pin to known-clean releases
➡️ Rotate every secret on any host or CI/CD runner that touched a compromised package
➡️ Check GitHub Actions and npm publishing logs for unauthorized activity (5/6)