114,000 OSS artifacts per day. Around 4,618 reach LLM triage. Roughly 100 reach an analyst. In our latest blog post, @marius_benthin explains how we combine THOR Thunderstorm with LLM triage to monitor ten package registries and extension marketplaces without sending the complete feed to a model. - THOR Thunderstorm ⚡️ scans the full feed using deterministic detection logic - Only artifacts with THOR findings enter LLM triage 🤖 - The initial LLM stage costs an average of $2.88 per day - Suspicious or inconclusive cases reach an analyst - RuneAI is available on demand for deeper analysis of selected files The article covers the architecture, operating numbers, limitations and a real malicious VS Code extension detected by the pipeline. nextron-systems.com/2026/06/…

We found a Ukraine-targeted campaign using two very different lures: an “air raid alert” document aimed broadly at Ukrainian users, and a military-specific unit property inventory. Both lead to a Telegram-controlled VBScript RAT capable of credential theft, screenshots, command execution and targeted file collection. The second lure pushes the campaign back to at least 26 August 2026. What stands out is the collection focus: CAD, BIM, GIS, LiDAR and weather-model data, combined with per-host tasking and date-based file harvesting. Full technical analysis + IOCs: github.com/NextronSystems/io…

Our THOR Thunderstorm-based artifact scanning pipeline identified a coordinated npm campaign hiding malicious behavior inside packages presented as runtime, process, layout, and image utilities. When imported, the packages launch a hidden Node.js process that retrieves and executes code from the JSON storage "npoint". The payload collects system and network details, steals Chrome extension data, monitors the clipboard, and can activate a Windows keylogger. IOCs: api.npoint[.]io/24c25d5f5fcbb0992a4f api.npoint[.]io/33e8d008c334b060adad api.npoint[.]io/641d37178a880b1e8b8f api.npoint[.]io/ddae72efbb6714fae922 api.npoint[.]io/37c0a0c68bf7a94ed731 103.170.217[.]184:8787 Packages: [email protected] [email protected] [email protected] [at]biz44/[email protected] [at]vibecheck-polid/[email protected] @biz44/[email protected] [email protected] [at]railone/[email protected]

We identified a Rust-based ELF RAT with no existing detection on VirusTotal. The agent is configured entirely through command-line arguments rather than a static configuration blob. Observed required flags include: C2 connectivity: --callback, --beacon, --secret Tunneling: --socks_port, --local_fwd, --remote_fwd Persistence and monitoring: --watchdog_pid Evasion: --jitter, --stealth Key Capabilities: - Command Execution: Implements remote shell capabilities - Pivoting: Integrated SOCKS proxying and port forwarding logic. - Credential Access: Targets zshrc, ssh/config, and Brave browser data - Environmental Discovery: Reads hosts and services file, and resolv.conf for network mapping. Use our THOR Scanner to detect the threat in your environment. IOCs: github.com/NextronSystems/io…

We detected fresh samples related to the ongoing #OceanLotus (APT-C-00 / APT32) campaign. The samples use a custom XOR-cipher shellcode loader that decrypts and executes shellcode directly from memory. The loader has been observed in recent disc-image (ISO/IMG) delivery chains and continues to show low detection rates across antivirus engines. Check our rules on Valhalla to find all recently detected samples: valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… New samples: 74236629c068cf2e5de53eabec9a93eb0efe7de38abc721dc5bca5d040f2ba20 07429b8ad51ef42911c152921a392911c083a175ee28e817a1f9283c3c38911b 2ec75dc4d5bff995ec58c211edaedfec150c4c02c6d6b3820b9e960dfeceb3e9 2cb31d6f254f736381ce61e68e0d93bafd8ae073c23671c0748d026702d10f7d e7de0f35607a4251237adab2128510007ea25fc00a500749940e054f067ac75d

We found a heavily obfuscated, WHQL-signed malicious kernel driver with very low detections on VirusTotal. PlugPlayService.sys - MD5: a26abe238cc339da81f4853ab16e1a6a The driver provides arbitrary memory access and directly accesses RAID devices. It also makes heavy use of control-flow obfuscation, with similarities to techniques recently documented in our blog post on RegPhantom. Samples similar to PlugPlayService.sys have also been observed dropped by xigmapper. While investigating, We identified 9 additional xigmapper UEFI samples, all with no AV detection. xigmapper executes before the OS, disables SMEP/WP and patches ntoskrnl.exe in memory via egg hunting. Of particular interest: zenither.efi - MD5: 924c410a520e6dc9aa1118474d9eb354 This specific xigmapper sample has been observed deploying kernel drivers similar to PlugPlayService.sys. Full xigmapper UEFI sample set + IOCs: github.com/NextronSystems/io… Blog post on RegPhantom nextron-systems.com/2026/03/…

Back in June we analyzed a SideCopy / Transparent Tribe infection chain targeting Indian defense personnel, using an LNK + BAT/PowerShell chain to deliver CrimsonRAT 360's Advanced Threat Research Institute has now published additional activity from the same actor, showing similar LNK + BAT tradecraft, further CrimsonRAT samples, and a separate Go-based RAT Their report also shows infrastructure reuse between the CrimsonRAT and Go-based campaigns Report: mp.weixin.qq.com/s?__biz=MzU…

🚨 Our THOR Thunderstorm-based artifact scanning pipeline identified the open-source research project BindsNET as compromised in activity linked to the DPRK-associated NullReceiver campaign. BindsNET is an established Python/PyTorch library for simulating spiking neural networks, with 1.7k GitHub stars. Three days ago, threat actors used a force-push with backdated commit timestamps to add a malicious VS Code task and an obfuscated Node.js loader disguised as a Font Awesome file. The tradecraft is consistent with known PolinRider activity. Affected commit: github.com/BindsNET/bindsnet… IOCs: 780abb9d268a2b1890bf4873d0d89d21fc86be44da685b932a54a738d2699810 (public/fonts/fa-solid-400.woff2) ETH: 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Security warning: github.com/BindsNET/bindsnet…

Update on the #Virtualizor compromise. If you've never heard of Virtualizor before: it's a VPS management platform used by many hosting providers to deploy and manage virtual servers on KVM, Xen, LXC, OpenVZ, Proxmox and other virtualization platforms. It is not some tiny admin panel either. Virtualizor publicly lists hundreds of NOC partners worldwide, and according to its own documentation a single master server can manage hundreds of virtualization nodes. So this sits pretty high up in the infrastructure. The vendor has now confirmed what happened: Attackers hijacked the BGP route for Virtualizor/Softaculous infrastructure, obtained a valid Let's Encrypt certificate and used that position to serve a malicious Virtualizor update. The ugly part: the Virtualizor update clients did not cryptographically verify the downloaded packages. BGP hijack + valid TLS certificate was therefore enough to get attacker code executed as root on affected hypervisors. Virtualizor says only a small number of installations are known to have received the malicious update. But they cannot tell exactly which ones, so they recommend treating every Virtualizor server as in scope and checking it. There is currently no evidence that customer VPS guests themselves were modified. Still, once the hypervisor is compromised as root, everything running on it has to be considered at risk. Vendor report: virtualizor.com/blog/securit… Our Nextron Research team has prepared IOCs and YARA rules for the known artifacts and payload: github.com/Neo23x0/signature… The merge is done. Our internal QA pipelines are still running; the signatures should hit the update servers and THOR Cloud Lite within the next hour. You can use both THOR Lite and THOR Cloud Lite for free to check your systems: nextron-systems.com/thor-lit… nextron-systems.com/thor-clo… If you run Virtualizor: scan the hypervisor, not the VPS guests.

🚨 We've identified "pybitjs", the first NullReceiver package we’ve observed on PyPI. This is an intentionally crafted malicious package, not a legitimate project that was compromised. It uses a .pth startup hook, an obfuscated Node.js loader, and Ethereum-based C2 resolution to retrieve and execute payloads. virustotal.com/gui/file/71fc…

The REDSHELL payload is now disguised as "math.mjs", replacing the previously used .dat and .bin extensions. Our artifact scanner detected it in the npm package "hydration-vli-ui" (v1.0.0), triggering two additional YARA rules designed to flag executables masquerading as script files.

We identified malicious DOC samples with technical and thematic similarities to recent #CloudAtlas activity described by Positive Technologies. The campaign targeted Russian and Iraqi victims through phishing emails delivering Microsoft Office documents using malicious template injection. The samples we identified include document-themed filenames such as "Виды_помощи_Форма.doc" and "О_конкурсе_Человек_Дела_–_2026.doc". The similarities are particularly notable because the reported CloudAtlas campaign combines several distinctive techniques in the same infection chain: malicious Office documents, HTA and multi-stage VBS execution, WMI usage, registry-based persistence, and payload retrieval through oEmbed requests to legitimate WordPress sites rather than direct connections to malicious infrastructure. The reported chain begins with a malicious Office document that retrieves an HTA dropper, which extracts "WebCachea54.vbs", "WebCachea54.jfm", and "WebCachea54tmp0.vbs". The VBS stages decode additional scripts, collect host information, and use an oEmbed-based delivery chain to retrieve and XOR-decode the next-stage payload. The final stages deploy CloudAtlas tools including VBShower and PowerCloud, which use Google Sheets for C2 and data exfiltration. A separate VBS component also removes HTA and cache artifacts to clean up traces of the infection. Report: habr.com/ru/companies/pt/art… Samples: 653520c24e3ad044c00503e3debccefaac3a6fdf76c5ca40b47b937fdbd389a7 (Виды_помощи_Форма.doc) 8be68dea337a1e7ab1224a10c3c6ca640d55292d135194a5e5ec9454b3bda906 47adb40e9ee04ee3a50e099fecd488f6eaf78a6e3abb9653d346cc5ae4648126 (О_конкурсе_Человек_Дела_–_2026.doc)

We identified multiple LNK samples showing strong technical and thematic overlap with recent #Kimsuky activity described by ENKI WhiteHat. The campaign targeted South Korean and Japanese victims through phishing emails delivering OneDrive-hosted ZIP archives containing malicious LNK files. The identified LNK samples use suspicious command-line execution, embedded/script-like content, URL-based payload retrieval, and in several cases unusually large LNK files. Further pivoting uncovered multiple samples matching the THOR/Valhalla rule: SUSP_LNK_SuspiciousCommands_Jan23_3 The overlap is particularly interesting because the reported Kimsuky chain uses a malicious LNK to execute PowerShell and curl, download logo.png as bot.vbe into %APPDATA%, and execute the VBScript. The broader campaign then establishes persistence through a scheduled task and deploys additional PowerShell-based capabilities for system discovery, Thunderbird/Outlook email collection, keylogging, and installation of legitimate remote-access tools including Chrome Remote Desktop and AnyDesk. Several of the samples we identified also use Japanese/Korean-themed filenames and exhibit LNK characteristics including url-pattern, long-command-line-arguments, large-file, high-entropy, and executes-dropped-file. Valhalla / THOR Rules: SUSP_LNK_SuspiciousCommands_Jan23_3 valhalla.nextron-systems.com… SUSP_LNK_Dec24 valhalla.nextron-systems.com… SUSP_LNK_Curl_Download_Jul22_2 valhalla.nextron-systems.com… SUSP_LNK_Big_Link_File valhalla.nextron-systems.com… SUSP_Dir_Ref_in_File_AppData valhalla.nextron-systems.com… Report: enki.co.kr/en/media-center/b… Samples: 6e6addf3e7287cf160054ef4647f8c67754f3cdc6efbdf21f117cb98c4c95534 49000d685f7c2ae1ddd5d40ca754562318e49c3a2534540951490f22756a3227 44dc1939dcaea681f5c39ed6f5f81a80ca5f59e72be7f938ac3afe5adb484042 018c31af135a0bc5e068df26d866440b28164aa4a659ea7df47bcbaab4a898cd 864ed6df1ba1b615f2db460666e2aee72a025754f5d78be3d83ec8e3c41d4a09 169586b6eb36b17520ef5afd206da86c4de89eb01d6294ba9631414271ba752f

The Rust project has published an advisory on the "arrayref" supply-chain attack, which deployed the malicious crates we previously identified: "proc-macro1" (v1.0.107) and "proc-macro-en" (v1.0.10). Advisory: blog.rust-lang.org/2026/08/2…