🚨 We’ve identified a new cluster of lookalike domains registered through NiceNic within hours of one another. We assess with moderate confidence that the domains are part of a coordinated courier-themed social-engineering campaign. The domains combine common delivery and logistics terms—such as courier, carrier, tracking, and transit—with short action-oriented words, likely to impersonate package-delivery or return-label notifications. This type of domain impersonation is widely used by financially motivated cybercriminal groups to create convincing phishing pretexts, direct targets to credential-harvesting pages, collect payment or personal information, and support follow-on social engineering. With the holiday season approaching, delivery-themed lures provide particularly effective cover for this activity. Hunt telemetry for newly registered, hyphenated delivery-themed domains, particularly those sharing the observed registration and naming patterns, and block confirmed malicious matches.

🚨 ReliaQuest has observed a signed application branded as the “QuartzLine” PDF viewer deploying a backdoor, creating scheduled-task persistence, and communicating with C2 infrastructure. Browser telemetry links its delivery to a suspected malvertising chain involving redirects through beatramiro[.]com and softwareslizards[.]com, followed by an installer downloaded from an AWS S3 bucket. After installation, QuartzLine deploys an additional payload and creates the scheduled tasks QuartzlineUpdateCheck and CairaServiceCheck. The resulting activity communicates with westbeavers[.]com and topsmagnificentgrade[.]com. Because scheduled execution may continue after the initial file is detected, quarantining the installer alone may not fully remediate the compromise. Organizations should hunt for QuartzLine and Paperline identifiers, related scheduled tasks, and process-linked connections to the listed infrastructure. Remove unauthorized tasks and payloads, and reimage affected endpoints if complete cleanup cannot be confirmed. Avoid broadly blocking AWS S3 or other shared infrastructure. ReliaQuest assesses that additional related files and activity will likely be identified over the next two to four weeks, potentially under different viewer or installer names. IOCs: beatramiro[.]com softwareslizards[.]com westbeavers[.]com topsmagnificentgrade[.]com motherotters[.]com

🚨 A new alleged cybercrime collective, ShinyEquation Cartel, appears to have emerged, with announcements circulating across Shiny-affiliated Telegram channels. Its membership and claim of stealing Orange S.A. data remain unverified, and the group has not yet established a dedicated data-leak site. If substantiated, reported links to individuals associated with ShinyHunters, LAPSUS$, HellCat, and LockBit could combine significant expertise in social engineering, data theft, extortion, and ransomware. Even if the affiliations are partly promotional, amplification through established channels gives the group immediate visibility among existing cybercriminal communities, making it worth monitoring.

🚨 ReliaQuest continues to observe active exploitation of CVE-2026-0257, an authentication bypass affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. Multiple threat groups, including the Qilin and Settra ransomware operations, are exploiting the flaw to establish unauthorized VPN sessions and gain initial access to internal networks. Because this access originates through an organization’s own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft, or ransomware deployment is underway. ReliaQuest has also observed Cobalt Strike, BloodHound, and SharpHound in related activity. Organizations should immediately upgrade affected deployments, disable authentication override cookies where they are not required, terminate all active GlobalProtect sessions after patching, and investigate unexpected connections, including sessions using hostnames such as “kali.” Patching alone may not remove access established before remediation. ReliaQuest assesses that exploitation is highly likely to continue over the next three months as ransomware groups and initial access brokers target unpatched systems. IOCs: 216.245.184[.]150 216.245.184[.]47 216.245.184[.]110 216.245.184.0

🚨 ReliaQuest investigated an incident in which an attacker exploited an unauthenticated job-management feature and used what we assess with high confidence was an LLM-driven agent workflow to gain full administrative control of a server in under 24 hours. The activity involved rapid command execution, structured output collection, and repeated error correction, while the attacker’s infrastructure hosted a live open-source AI agent orchestration platform. The attacker executed code within the exposed application, recovered credentials from configuration files, enabled operating-system commands through SQL Server, escalated privileges with public tools, and extracted credential material. Similar activity could enable credential theft, persistence, lateral movement, and complete server compromise—while allowing attackers to target more organizations simultaneously. AI orchestration platforms are legitimate and should not be treated as inherently malicious. Organizations should require authentication on internet-facing management endpoints, retain job history, secure stored credentials, and monitor for rapid job sequences, script-engine execution, and repeated error-driven command revisions. IOCs/observables: 204.194.55[.]189 204.194.54[.]240 94.177.131[.]113 /tmp/out_.txt /var/tmp/.x/ /var/tmp/kvragent C:\Windows\Temp\ps.b64 → C:\Windows\Temp\ps.exe C:\Windows\Temp\gp.b64 → C:\Users\Public\g.exe Read more: reliaquest.com/blog/threat-s…

🚨 ReliaQuest has been investigating recent exploitation of CVE-2026-88771 and CVE-2026-88772 affecting Citrix NetScaler ADC and Gateway. What stood out in the activity we analyzed was a post-exploitation implant that adds a dormant superuser account to the appliance configuration. The account activates after a restart—including the restart required to complete an upgrade. Review appliance configurations for unrecognized administrator accounts before patching, not after. Assess exposed appliances directly. If compromise is suspected, rotate SSL certificates and private keys even without definitive confirmation: the observed tooling can exfiltrate configuration data and private key material.

🚨 ReliaQuest observed vishing activity directing users to domains using the .report and .team TLDs. By combining less common, work-related TLDs with support or account-themed wording, attackers can make fraudulent domains appear credible during phone-based social engineering. If successful, this activity could lead to credential theft, MFA compromise, unauthorized account access, malicious remote-access tool deployment, and data theft. These TLDs are not inherently malicious, and organizations should not block them based on the TLD alone. Instead, verify unexpected support calls through known channels, avoid links provided by unsolicited callers, monitor newly registered domains for brand impersonation, and consider defensively registering high-risk domain variants where appropriate.

Data-extortion groups are not just stealing data—they are analyzing it for maximum leverage. Titan, a newly emerged RaaS group, claims its “zero-touch” engine can classify stolen documents, identify high-impact findings, map exposure across 50+ regulatory frameworks, and draft notifications to regulators, law enforcement, and the media. The message for defenders: stolen data is being read, understood, and weaponized. Review retention practices, prepare to rotate exposed credentials at scale, and audit persistent access paths such as OAuth grants. Listen to the latest #ShadowTalk to learn more: reliaquest.com/shadowtalk/

🚨 ReliaQuest observed that an empty SMTP envelope sender can bypass RejectDirectSend, a Microsoft 365 control intended to block unauthenticated Direct Send emails. By using an empty envelope, an external sender can avoid the control’s domain check while retaining an internal-looking From address—without credentials or a lookalike domain. We’ve seen attackers use this technique with file-sharing, payment, and procurement lures, often targeting leadership and business-facing users. This is not a Microsoft software vulnerability, but a limitation in the control’s scope. Organizations should use IP-restricted inbound connectors, review filtering exceptions, and monitor for empty envelope senders paired with internal From addresses. Read our analysis: reliaquest.com/blog/threat-s…

🚨 ReliaQuest has identified a new toolkit, Gryxa, used by a financially motivated threat actor to establish persistent remote access, steal browser credentials, and target cryptocurrency wallets. We assess with high confidence that substantial portions of the toolkit and its management console were built using a commercial AI coding agent. The actor’s console listed 324 hosts, 69 of which were reporting online during analysis. Gryxa maintains access through multiple scheduled tasks, a permanent WMI event subscription, and redundant file copies that can restore deleted components within minutes. It also monitors remediation by collecting and uploading Windows logs and host artifacts after defenders remove the visible RMM implant. Partial containment can trigger Gryxa to disable or uninstall endpoint protection within approximately 10–13 minutes. Organizations should block the actor’s infrastructure first, then remove the RMM service, persistence mechanisms, Defender exclusions, and working directories in a coordinated action. Potentially exposed credentials should be rotated, sessions terminated, and hosts re-imaged if complete removal cannot be confirmed. IOCs: wirbe[.]com world[.]wirbe[.]com cdn[.]wirbe[.]com ver[.]wirbe[.]com mesh[.]wirbe[.]com seczio[.]com debian[.]seczio[.]com gryxa[.]com ui[.]gryxa[.]com update[.]gryxa[.]com sevrz[.]com ui[.]sevrz[.]com update[.]sevrz[.]com 144.172.107[.]56 209.145.55[.]189 Read the report here, which also features an interactive walkthrough of Gryxa: reliaquest.com/blog/threat-s…

🚨 ReliaQuest is tracking SynkLoader, a hash-gated PowerShell loader distributed through social-engineering campaigns involving vishing and Microsoft Teams messages impersonating IT support personnel. Despite variations in the initial contact method, the observed delivery chains lead victims to a fraudulent “PowerShell Cleaner” MSI hosted on legitimate Azure Blob Storage. Our analysis found that SynkLoader decrypts its payload in memory and verifies its cryptographic hash before executing it. If the payload has been modified or improperly extracted, the loader fails silently rather than continuing execution. This integrity check can complicate automated analysis and prevent sandboxes from observing the complete infection chain. SynkLoader deploys a Python backdoor named ss[.]py, which retrieves its operational capabilities from command-and-control (C2) infrastructure at runtime rather than embedding them within the initial file. This modular design reduces the functionality visible during static analysis and can cause the backdoor to appear inactive when its C2 infrastructure is unavailable. The campaign combines trusted cloud-hosting infrastructure, IT-support impersonation, in-memory PowerShell execution, and dynamically retrieved Python components to reduce visibility across traditional email, network, and sandbox-based controls. Organizations should restrict unnecessary external Microsoft Teams communications, independently verify unsolicited IT-support requests, monitor MSI execution from user-controlled directories and cloud-storage URLs, and investigate unusual PowerShell or Python activity. Hosts that executed the fraudulent installer should be isolated and investigated for additional payloads and command-and-control activity. IOCs: SHA-256: d150c70d2732df17aa77991b9ebf4c896f044445e900978581d9598dfa5dc98 Filename: ss[.]py neversoftmain[.]net rootfarmapp[.]net tripinupdate[.]net

🚨 ReliaQuest discovered a custom web shell highly likely linked to Clop, deployed following exploitation of CVE-2026-12569 in PTC Windchill. Our analysis found that the implant is not a generic command shell, rather, it is a purpose-built data-theft and extortion platform developed with detailed knowledge of Windchill’s APIs, database schema, keystore, and file-vault structure. The web shell can map sensitive engineering files, read and transfer arbitrary data, and decrypt every credential stored in the Windchill keystore, including LDAP, administrative, and object-storage credentials. It also contains a custom Java class loader that can execute attacker-supplied code directly in memory, enabling follow-on activity such as lateral movement, persistence, ransomware deployment, and further data theft. The implant uses Windchill’s own application classes and database identity, delivers commands through the custom X-windchill-req HTTP header, and compresses responses with GZIP. These techniques allow its activity to resemble legitimate application traffic and reduce visibility across traditional network and database monitoring. Organizations should immediately patch CVE-2026-12569, hunt for suspicious JSP files in Windchill codebase directories, and rotate all credentials stored in the Windchill keystore on any server suspected of compromise. IOCs: 321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf 5.180.41[.]35 78.128.113[.]10 104.194.9[.]14 104.243.35[.]63 185.227.83[.]236 209.222.98[.]44 216.152.151[.]204 Read more: reliaquest.com/blog/clop-ret…

🚨 ReliaQuest is observing active compromise tied to an npm supply-chain worm impacting the keyv, @cacheable, flat-cache, file-entry-cache, and cacheable-request families, along with 800+ additional packages through worm propagation. We've observed poisoned versions introducing setup.mjs and Math_Symbol.js alongside a preinstall entry that invokes node setup.mjs, executing a credential stealer targeting npm and GitHub tokens, cloud credentials, Kubernetes and Vault secrets, SSH keys, and AI service API keys. We've also observed follow-on outbound TLS activity consistent with credential validation and exfiltration staging to cloud APIs and secrets-management endpoints. The tradecraft closely resembles the "Shai-Hulud" npm worm. Because compromised versions can be pulled in transitively, organizations may be exposed without a direct dependency on any impacted package. If your pipelines run npm install without dependency review or lifecycle-script restrictions, an attacker already has an install-time path to your dev, cloud, and AI credentials.

Attackers are turning SQL Server access into Windows command execution by abusing xp_cmdshell. While not a new technique, ReliaQuest has observed a resurgence in this abuse, followed by reconnaissance activity, including enumeration of accounts, hosts, network configurations, drives, application directories, and outbound access. xp_cmdshell provides a direct bridge from a compromised database to the underlying Windows server, opening the door to credential theft, lateral movement, and malware deployment. If xp_cmdshell isn't needed, disable it. Where it's required, restrict execution permissions, use a least-privileged proxy account, and monitor for SQL Server spawning Command Prompt, PowerShell, curl, or other system utilities.

ReliaQuest has observed a spike in Microsoft Teams vishing beginning in late Q2 and continuing into Q3, with activity peaking in June. The campaign primarily targets sales and customer-facing employees, who routinely communicate with external contacts. Threat actors posing as “IT Service Desk” or “HelpDesk” initiate Teams calls, request screen sharing, and convince victims to execute PowerShell commands. Those commands deploy a persistent Python backdoor that runs through pythonw.exe, communicates with hardcoded C2 domains, and performs host and LDAP-based domain reconnaissance. The tradecraft closely resembles activity previously associated with Black Basta and BlackFile affiliates, although definitive attribution has not been established. If external Teams users can freely message and call your employees, attackers already have a direct path to your most accessible targets. Is your organization restricting external Teams communication to approved partner tenants?

The DNS poisoning campaign we flagged hijacks Microsoft 365 accounts through hotel and conference Wi-Fi. We've traced it to compromised gateways across multiple US cities, India, and Saudi Arabia, and it's still active. We haven't confirmed the actor behind these attacks, but the tradecraft we're observing shares characteristics with previous APT28 (Fancy Bear/Forest Blizzard, Russian GRU) campaigns targeting routers and network infrastructure. This likely extends beyond hotels and conference venues. Any operator of a captive portal network—airports, co-working spaces, universities, health care facilities—faces a structurally similar attack surface. Read more:reliaquest.com/blog/threat-s…

Update on CVE-2026-12569 / Cl0p / PTC Windchill It is likely that Cl0p is actively exploiting CVE-2026-12569 in PTC Windchill. The deployed webshells use a custom HTTP header (X-windchill-req) as their authentication mechanism, running within Windchill's own process context to blend into legitimate application traffic, while spawning background SQL threads that enumerate the full Windchill file vault to map data ahead of exfiltration. A built-in custom Java class loader allows attackers to execute arbitrary compiled code server-side via Base64-encoded ZIPs, without ever modifying the webshell again. The webshell also harvests and decrypts LDAP credentials directly from Windchill's keystore, enabling follow-on access well beyond the initial foothold. Given Cl0p's history of rapid, widespread campaigns and the speed at which copycat actors replicate their techniques, organizations using PTC Windchill and PTC FlexPLM should treat this CVE with the highest priority.

Attackers are using hotel & conference Wi-Fi captive portals to access Microsoft 365 accounts—no malware or phishing needed. Travelers: use always-on, full-tunnel VPN. See how agentic defense helps: reliaquest.com/blog/threat-s…

ReliaQuest has observed threat actors actively exploiting CVE-2026-12569, a critical unsafe deserialization vulnerability (CVSS 9.3) affecting PTC Windchill and FlexPLM. Exploitation enables unauthenticated remote code execution and JSP web shell deployment for remote command execution and sensitive product data exfiltration. The actor behind these attacks remains unconfirmed. however, the observed tradecraft shares characteristics with previous Cl0p campaigns targeting enterprise applications and high-value data repositories. Immediate mitigations: 🔴 Apply PTC's vendor patch (CS473270) 🔴 Place Windchill and FlexPLM interfaces behind a VPN or trusted access gateway where possible 🔴 If exploitation is suspected, isolate the affected server, preserve forensic artifacts, and rotate exposed credentials before restoring service

622 vulnerabilities. One week. Two actively exploited zero-days. Microsoft just broke its own record while defenders are struggling to keep up. New #ShadowTalk drops today. 🎧linktr.ee/ReliaQuestShadowTa…