Cyble Research & Intelligence Labs (CRIL) tracked 1,158 vulnerabilities last week. Of these, 251 vulnerabilities already have publicly available Proof-of-Concept (PoC) exploits, significantly increasing the likelihood of real-world attacks. 

A total of 94 vulnerabilities were rated critical under CVSS v3.1, while 43 were rated critical under CVSS v4.0.

In parallel, CISA issued 15 ICS advisories covering 87 vulnerabilities affecting industrial environments. These vulnerabilities impacted vendors including Siemens, Yokogawa, AVEVA, Hitachi Energy, ZLAN, ZOLL, and Airleader. 

Additionally, 8 vulnerabilities were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, reflecting confirmed exploitation in the wild. 

The Week’s Top Vulnerabilities 

CVE-2025-40554 — SolarWinds Web Help Desk (Critical) 

CVE-2025-40554 is a critical authentication bypass vulnerability affecting SolarWinds Web Help Desk versions prior to 2026.1. The flaw allows unauthenticated remote attackers to invoke privileged functionality without valid credentials, potentially leading to full compromise of helpdesk systems. 

Cyble observed this vulnerability being discussed on underground forums shortly after disclosure, and a public PoC is available. The vulnerability’s presence in enterprise environments increases the risk of initial access and lateral movement. 

CVE-2026-1340 — Ivanti Endpoint Manager Mobile (Critical) 

CVE-2026-1340 is a critical code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM). A remote, unauthenticated attacker can exploit the flaw to achieve arbitrary remote code execution without user interaction. 

The vulnerability has been captured in dark web discussions and has a publicly available PoC , significantly lowering the barrier to exploitation. 

CVE-2026-21509 — Microsoft Office (High Severity, Actively Exploited) 

CVE-2026-21509 is a feature-bypass vulnerability in Microsoft Office that allows crafted documents to circumvent built-in security protections. Attackers can deliver malicious Office files that execute payloads once opened by the victim. 

The flaw has been actively exploited by threat actors including APT28 and RomCom , highlighting its operational impact. 

CVE-2026-1529 — Keycloak (High Impact) 

CVE-2026-1529 affects Red Hat’s Keycloak and involves improper validation of JWT invitation token signatures. Attackers can manipulate trusted token contents to gain unauthorized access to organizational resources. 

A PoC is available, and the vulnerability surfaced on underground forums shortly after disclosure. 

CVE-2026-23906 — Apache Druid (Critical) 

CVE-2026-23906 is a critical authentication bypass vulnerability in Apache Druid, enabling unauthorized access to sensitive data stores. 

CVE-2026-0488 — SAP CRM & SAP S/4HANA (Critical) 

CVE-2026-0488 is a critical code injection vulnerability affecting SAP CRM and SAP S/4HANA. An authenticated attacker can exploit improper function module calls to execute arbitrary SQL statements, potentially resulting in full database compromise. 

Vulnerabilities Added to CISA KEV 

CISA added 8 vulnerabilities to the KEV catalog during the reporting period. The most important of these were: 

• CVE-2026-24423 — SmarterTools SmarterMail unauthenticated RCE 

• CVE-2026-21510 — Microsoft Windows Shell protection mechanism bypass 

KEV additions reflect confirmed exploitation in the wild and often signal heightened ransomware or espionage activity. 

Critical ICS Vulnerabilities 

CISA issued 15 ICS advisories covering 87 vulnerabilities, with the majority rated high severity. 

CVE-2026-25084 & CVE-2026-24789 — ZLAN5143D (Critical) 

These critical vulnerabilities in ZLAN Information Technology Co.’s ZLAN5143D device involve missing authentication for critical functions. 

Successful exploitation could allow attackers to bypass authentication controls or reset device passwords, potentially enabling unauthorized configuration changes and interference with industrial communications. Researchers also identified internet-facing instances, increasing exposure risk. 

CVE-2025-52533 — Siemens SINEC OS (Critical) 

CVE-2025-52533 is a critical out-of-bounds write vulnerability in Siemens SINEC OS before version 3.3, potentially enabling memory corruption and system compromise in industrial network environments. 

CVE-2026-1358 — Airleader Master (Critical) 

CVE-2026-1358 is a critical, unrestricted file-upload vulnerability in Airleader Master systems. Successful exploitation could allow attackers to upload malicious files, potentially resulting in remote code execution in OT environments. 

Impacted Critical Infrastructure Sectors 

Analysis of the ICS advisories shows that Critical Manufacturing and Energy sectors appear in 98.9% of reported vulnerabilities, showcasing concentrated exposure in these environments. 

The cross-sector nature of these vulnerabilities underscores the interdependencies between Energy, Manufacturing, Transportation, Water, and Food systems. 

Conclusion 

The convergence of high-volume IT vulnerabilities and significant ICS exposure highlights the continued expansion of the attack surface across enterprise and industrial environments. With over 250 PoCs publicly available and multiple KEV additions confirming active exploitation, organizations must prioritize rapid remediation and risk-based vulnerability management. 

Security best practices include: 

• Prioritizing vulnerabilities based on risk and exploit availability 

• Protecting web-facing and internet-exposed assets 

• Implementing strict IT/OT network segmentation 

• Deploying multi-factor authentication and strong access controls 

• Conducting regular vulnerability assessments and penetration testing 

• Monitoring underground forums and KEV updates for early warning signals 

• Establishing ransomware-resistant backup strategies 

• Maintaining OT-specific incident response procedures 

Cyble’s comprehensive attack surface management solutions help organizations continuously monitor internal and external assets, prioritize remediation, and detect early warning signals of exploitation. Additionally, Cyble’s threat intelligence and third-party risk intelligence capabilities provide visibility into vulnerabilities actively discussed in underground communities, enabling proactive defense against both IT and ICS threats.

The post The Week in Vulnerabilities: SolarWinds, Ivanti, and Critical ICS Exposure appeared first on Cyble.

Cyble – ​Read More

By Beenu Arora, Co-Founder and CEO, Cyble 

I believe we’re witnessing the most significant event India has ever experienced. The nation stands at the cusp of a major global shift, and I want to share why I’m so bullish about India’s role in the AI revolution—and the critical security challenges we must address together. 

India: Right Place, Right Time 

No country will prosper without making significant changes in their AI capabilities. India is uniquely positioned to lead this transformation. We’ve already pioneered the entire FinTech ecosystem, processing payments for more than half a billion people globally. This foundation puts India at the perfect intersection of technological capability and market opportunity to ride the AI wave. 

At the same time, scale brings responsibility. As AI becomes embedded across financial systems, digital public infrastructure, enterprise workflows, and citizen services, the attack surface expands alongside innovation. If India is to lead the AI revolution, we must lead in securing it as well. 

Cyble’s Commitment to India’s AI Future 

At Cyble, we’re incredibly excited to invest and continue growing our AI capabilities from India—from infrastructure to applications to talent. We’re not just talking about supplying talent to the world; we’re building core infrastructure, services, and capabilities right here. That’s why we’ve invested millions of dollars and will continue doing so. India’s potential extends far beyond being a service provider—we’re becoming a global AI powerhouse. 

As we build, I am also conscious that AI is not just another infrastructure layer. It is increasingly a cognitive system — capable of reasoning, contextual learning, and autonomous decision-making. That means it must be secured differently. Protecting AI systems requires thinking beyond traditional perimeter defenses and anticipating new risk categories such as model manipulation, data poisoning, prompt injection, AI-assisted reconnaissance, and sensitive data leakage. 

The AI Security Challenge: A New Battlefield 

But let me be candid about the challenge ahead. AI has fundamentally changed the game—it’s a massive structural shift. The threat landscape has evolved dramatically: 

The Democratization of Cyber Attacks 

What once took hours to execute—a basic phishing attack—now happens at scale with high contextual accuracy and perfect timing. 

AI agents continuously monitor user activities on LinkedIn and social media, knowing exactly who you are, what interests you, and who you communicate with. 

We’re seeing over 100,000 deepfake videos being created. With apps like Grok, anyone can generate a convincing deepfake in just 60 seconds. 

I’ve seen this shift firsthand. 

Three years ago, a member of my leadership team received a WhatsApp call that convincingly mimicked my voice and requested a financial transaction. It was a deepfake attempt. We identified it only after careful scrutiny. 

At the time, such attacks were considered sophisticated and relatively rare. 

Recently, my eight-year-old son wrote a simple program that deepfaked my own mother. 

The point is not novelty. It is accessibility. 

What once required specialized expertise and resources is now democratized. Consumer-grade AI systems can generate convincing synthetic audio with minimal effort. The barrier to entry has collapsed. Cybercrime is being industrialized. 

Phishing has entered a new era as well. For decades, phishing attempts were often detectable through poor grammar, awkward phrasing, or generic messaging. That signal has largely disappeared. AI-driven agents now scrape publicly available information, analyze behavioral patterns, and craft highly personalized messages tailored to specific individuals and roles. These agents continuously learn, retain context, and refine their attacks. Precision has replaced volume as the dominant strategy. 

The Defender’s Dilemma 

AI is already democratized. Bad actors have access to the same technologies as defenders. This fight will be relentless. I believe attackers will initially gain the upper hand because AI systems weren’t designed with security in mind from the beginning. 

Consider this: $4.6 trillion has been invested in building AI infrastructure, applications, and toolkits. Security, as always, is catching up. 

Beyond social engineering, AI is influencing technical intrusion methods as well. AI systems are increasingly capable of identifying and chaining vulnerabilities across systems, discovering weaknesses with notable efficiency. In controlled environments, AI-assisted approaches have demonstrated the ability to map exploit pathways faster than traditional methods. This compresses the time between vulnerability discovery and exploitation, shrinking defensive response windows and amplifying attacker efficiency. 

AI is not simply another tool in the attacker’s arsenal. It is a multiplier. 

And while organizations rapidly integrate AI into customer experiences, analytics platforms, and internal decision-making systems, security investments do not always scale proportionately.  

AI is often treated as infrastructure rather than as a cognitive system requiring dedicated protection mechanisms. This creates exposure across model integrity, training data pipelines, inference layers, and external integrations. 

The enterprise attack surface is expanding — and becoming more intelligent. 

Hope on the Horizon 

Despite these challenges, I’m optimistic. As defenders gain access to the right governance frameworks and infrastructure, we’ll be positioned to make these systems better and safer for everyone. This is exactly why Cyble exists—to bridge that gap and protect organizations in this new AI-driven world. 

Defending against AI-driven threats requires more than traditional controls. It requires continuous external threat intelligence, early detection of impersonation campaigns, dark web visibility into emerging AI-enabled tactics, proactive attack surface management, and context-aware anomaly detection. 

The race is on, and India is ready to lead not just in AI innovation but in AI security. The question isn’t whether we’ll rise to this challenge—it’s how quickly we can mobilize our talent, infrastructure, and innovation to secure the AI future. 

About the Author

Beenu Arora is the Co-Founder and CEO of Cyble, a leading AI-powered threat intelligence company investing heavily in India’s cybersecurity and AI infrastructure. 

The post India’s AI Revolution: Why This Is India’s Most Significant Moment appeared first on Cyble.

Cyble – ​Read More

Every security alert represents a decision point. Act too slowly, and a threat becomes a breach. Act without context, and analysts drown in noise. At the center of both failure modes is a single, often underestimated process: alert enrichment. 

Key Takeaways

• Alert enrichment is the operational multiplier. Its quality determines the effectiveness of every other SOC investment — detection tools, SIEM rules, and analyst headcount all underperform when enrichment is slow or fragmented. 

• Manual enrichment is a structural problem, not a skills problem. Even experienced analysts lose 20–30 minutes per alert to fragmented, multi-platform investigations. 

• Static intelligence and live behavioral analysis cover different failure modes. Threat Intelligence Lookup handles known indicators at speed. The Interactive Sandbox handles the unknown with depth. 

• Enrichment improvements are directly measurable in business terms. MTTD, MTTR, false positive rate, and analyst retention are all affected by enrichment quality.  

The Seconds That Define a Breach 

Alert enrichment is the practice of layering contextual intelligence onto raw security alerts (IP reputation, domain history, file behavior, attacker TTPs) so that analysts can make fast, accurate decisions. It sounds operational. But its downstream effects are deeply strategic: mean time to respond, analyst capacity, false-positive rates, and ultimately, whether the security function is perceived as a cost center or a competitive asset. 

For the business, the difference is simple: enriched alerts lead to faster containment and fewer incidents. Poorly enriched alerts lead to delays, escalations, and avoidable losses. 

From Raw Alerts to Actionable Decisions

Alert enrichment sits at the crossroads of detection, analysis, and response. It connects telemetry from SIEM, EDR, email security, and network controls with external and internal context such as indicators, attacker behavior, infrastructure, and historical activity. 

When enrichment works well: 

• Tier 1 analysts understand what they are seeing; 

• Tier 2 can quickly validate intent and scope; 

• Tier 3 focuses on root cause and prevention, not data gathering. 

Considering business objectives, effective enrichment directly affects: 

• Mean time to triage and respond, 

• Incident escalation rates, 

• Analyst productivity and burnout, 

• Cost of incidents and downtime, 

• Confidence in SOC reporting. 

In short, alert enrichment defines how efficiently security investments translate into risk reduction.  

Leadership increasingly demands that security spend be justified in operational terms. Alert enrichment is one of the most concrete levers available. It is measurable, improvable, and its effects cascade through the entire security operation. Organizations that treat it as a background task, rather than a core process deserving investment and optimization, consistently underperform on every metric that matters. 

Where SOCs Go Wrong with Alert Enrichment

Many SOCs struggle because enrichment is: 

• Fragmented across multiple disconnected sources; 

• Manual and time-consuming; 

• Focused only on static indicator reputation; 

• Performed too late in the escalation chain; 

• Lacking behavioral validation; 

• Without behavioral evidence, analysts often guess severity. 

The business consequences of poor enrichment practices compound over time. The most direct impact is an extended breach window. Organizations with slow enrichment workflows consistently show longer dwell times before threat detection and containment.  

Beyond breach economics, there are workforce consequences. Analyst teams experiencing enrichment bottlenecks burn out faster, make more errors under time pressure, and escalate inappropriately.  

Finally, poor enrichment undermines executive reporting. When MTTR and false positive rates are poor, security teams struggle to demonstrate value to the board. This erodes confidence in the function and creates pressure for headcount reductions at precisely the moment when operational capacity is already strained. 

Transforming Alert Enrichment into a Business-Aligned Efficiency Driver 

The path from dysfunctional enrichment to a streamlined, high-performance process runs through threat intelligence. High-performing SOCs enrich alerts with two types of validation: 

• Historical attack data, 

• Live behavioral analysis. 

ANY.RUN offers two distinct but deeply complementary capabilities that, together, cover the full spectrum of SOC enrichment needs: the Interactive Sandbox for live behavioral analysis of unknown threats, and Threat Intelligence Lookup for instant, structured context on known indicators. 

Understanding each one, and how they interconnect, is key to applying them effectively across SOC tiers. With intelligence-backed and behavior-validated enrichment: 

• Tier 1 gains confidence in decision-making; 

• Tier 2 reduces investigation time; 

• Tier 3 identifies patterns faster; 

• Automation rules become safer; 

• Executive stakeholders receive clearer risk assessments. 

The SOC shifts from reactive investigation to structured decision-making. 

Interactive Sandbox: Live Analysis When Intelligence Doesn’t Exist Yet 

The ANY.RUN Interactive Sandbox is a cloud-based malware analysis environment that executes suspicious files and URLs and captures every aspect of their behavior in real time. It allows analysts to interact with the execution clicking through installer dialogs, entering credentials on a phishing page, following multi-stage execution chains. 

Check a real-world case inside sandbox 

In this sample, a QR code hidden in a phishing email leads to a CAPTCHA-protected page and then to a fake Microsoft 365 login designed to steal credentials. The sandbox detonates the full chain, reveals the phishing infrastructure, and confirms credential theft behavior in seconds. 

A sandbox session generates a rich analytical output that invests in alert enrichment and aligns with business objectives:  

• Faster mean time to respond (MTTR), minimizing breach dwell time and data loss; 

• Reduced false positives by 35-60%, lowering analyst fatigue and operational costs; 

• Cost savings from prevented incidents and long-term ROI through proactive defense. 

When one analyst runs a new sample, the resulting data immediately becomes available to the entire community and feeds directly into TI Lookup’s dataset.  

The Interactive Sandbox is accessible via API, allowing orchestration platforms to trigger sandbox submissions automatically when incoming files or URLs meet defined criteria and to attach the resulting behavioral analysis directly to the incident ticket. 

ANY.RUN Threat Intelligence Lookup: Structured Context at Investigation Speed

Threat Intelligence Lookup is a search-driven intelligence platform built specifically to support the investigative and enrichment needs of SOC analysts. It centralizes structured, current intelligence in a single queryable interface. 

The platform aggregates data from ANY.RUN’s Sandbox. Analysts can query by over 40 parameters including IP address, domain, URL, file hash, YARA rule, or MITRE ATT&CK technique and receive structured, actionable results in seconds. 

domainName:”whitepepper.su” 

Here we can see an actionable verdict on a domain that triggered alerts: it’s malicious, associated with Lumma stealer, spotted in the very recent attacks that mostly target telecom, IT, and healthcare sectors across Europe.  

TI Lookup answers the question: have we (or has anyone in the security community) seen this indicator before, and what do we know about it? The Interactive Sandbox answers the question: what does this artifact do when it runs, right now, in a real environment? 

Just switch to the “Analyses” tab in TI Lookup results to see a selection of fresh malware samples featuring the artifact in question and to view analyses for full attack chains, IOCs and TTPs.  

Both capabilities are designed for operational integration. TI Lookup is accessible via a web interface for direct analyst use and via API for integration into SIEM, SOAR, and ticketing platforms, enabling automated pre-enrichment of alerts before they reach a human reviewer.  

• Enhances detection accuracy and reduces false positives; 

• Cuts investigation time and effort, boosting SOC productivity and minimizing breach impacts; 

• Supports compliance and employee training with rich, pre-processed data on malware behaviors and trends. 

One Process, Organization-Wide Impact 

Alert enrichment is not an isolated activity that affects only the analyst who performs it. It sits at the center of the SOC’s operational cycle, and its efficiency (or inefficiency) propagates through every tier and every metric. When enrichment is slow, fragmented, or dependent on stale intelligence, every downstream process suffers: triage is less accurate, investigation takes longer, containment is slower, and leadership receives metrics that tell a story of organizational underperformance. 

By integrating TI Lookup and the Interactive Sandbox into the enrichment workflow, organizations address the root cause of this underperformance. Together, these capabilities cover the full surface area of enrichment need: instant structured context for known indicators, and live behavioral evidence for the unknown. The former get handled at speed, and the latter are exposed in depth. Neither replaces a professional’s judgment: both elevate it while being integrated into the analyst’s existing workflows.

When enrichment velocity increases, the key metrics that define SOC value to the business improve in tandem: MTTD drops because contextual data enables faster threat recognition; MTTR drops because analysts spend less time on data collection and more time on decision-making; false positive rates fall because richer context enables more accurate triage; and analyst capacity increases because the same team can handle greater alert volume without compromising quality. 

Conclusion: Enrichment as the Multiplier 

Alert enrichment defines whether a SOC operates reactively or strategically. When alerts are supported by real attack intelligence and validated through dynamic analysis, analysts stop guessing and start deciding. 

ANY.RUN’s Threat Intelligence Lookup and Interactive Sandbox together provide both precedent and proof. And when enrichment is grounded in both, security becomes faster, clearer, and more aligned with business objectives. 

About ANY.RUN  

ANY.RUN is part of modern SOC workflows, integrating easily into existing processes and strengthening the entire operational cycle across Tier 1, Tier 2, and Tier 3.  

It supports every stage of investigation, from exposing real behavior during safe detonation, to enriching analysis with broader threat context, and delivering continuous intelligence that helps teams move faster and make confident decisions.  

Today, more than 600,000 security professionals and 15,000 organizations rely on ANY.RUN to accelerate triage, reduce unnecessary escalations, and stay ahead of evolving phishing and malware campaigns.  

To stay informed about newly discovered threats and real-world attack analysis, follow ANY.RUN’s team on LinkedIn and X, where weekly updates highlight the latest research, detections, and investigation insights. 

FAQ

The post One Process, Every Metric: How Better Alert Enrichment Transforms SOC Performance appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Malware campaigns targeting Latin America (LATAM) are evolving. While the final payloads, often commodity RATs like XWorm, remain consistent, delivery mechanisms are becoming increasingly sophisticated to bypass region-specific defenses and increase the chance of reaching real business users. 

In this analysis, we dissect a recent campaign targeting Brazilian users. What starts as a deceptive “banking receipt” quickly turns into a multi-stage infection chain that leverages steganography, Cloudinaryabuse, and a dedicated .NET persistence module designed to bypass traditional schtasks monitoring, reducing early visibility for security teams and prolonging dwell time. 

Key Takeaways 

Built to blend into finance workflows: A “receipt” lure is optimized for real corporate inboxes and shared drives across LATAM.

High click potential in real operations: Payment and receipt themes map to everyday processes, which raises the chance of execution on work machines.

The chain is designed to stay quiet: WMI execution, fileless loading, and .NET-based persistence reduce early detection signals and increase dwell time. 

One endpoint can become an identity problem: XWorm access can lead to credential/session theft and downstream compromise of email, SaaS, and finance systems. 

Trusted services and binaries are part of the evasion: Cloud-hosted payload delivery and CasPol.exe abuse help the activity blend in.

Early detection is an operational advantage: Better monitoring + faster triage + regional hunting can keep his attack from escalating into fraud, data exposure, or ransomware.

Stage 1: The Deceptive Delivery 

This campaign begins with a classic but effective technique aimed at Brazilian users: a malicious file masquerading as a bank receipt (“Comprovante-Bradesco…”). While it abuses the double-extension trick (.pdf.js) to look like a document, it is, in reality, a Windows Script Host (WSH) dropper designed for direct execution 

Although the file size is unusually large (~1.2MB) for a simple script, this is intentional. The attackers padded it with junk data to inflate entropy and evade static analysis scanners that may skip larger files, helping the lure pass through initial controls and delaying detection. 

Analyzing the Obfuscated JavaScript 

Upon opening the file, there’s no readable code. Instead, the script uses heavy obfuscation via Unicode “junk injection.” The malicious logic is buried inside massive string variables packed with emojis, homoglyphs, and other non-ASCII characters 

As seen above, the script uses a delimiter-based reconstruction method. Rather than relying on complex cryptography, it applies a simple .replace() function at runtime to strip away the injected Unicode noise (the delimiters) and reconstruct the payload 

Deobfuscation and Payload Extraction 

To understand the dropper’s intent, we replicated the deobfuscation logic using CyberChef. By stripping the specific Unicode delimiters and decoding the resulting Base64 and UTF-16LE text, we revealed the core payload. 

The deobfuscated payload confirms that this is a pure dropper. It constructs a PowerShell command responsible for downloading the next stage. 

Evasion via WMI Execution 

An interesting aspect of this sample is how it executes the payload. Instead of using the noisier WScript.Shell.Run, it leverages WMI (Windows Management Instrumentation) via GetObject(“winmgmts:root\cimv2”) and Win32_Process.

This technique allows the attacker to set ShowWindow = 0, spawning the PowerShell process in a hidden window to avoid alerting the user. The script also implements a hardcoded Sleep(5000) delay, likely to ensure the system is ready and to bypass simplistic sandbox heuristics that expect immediate malicious behavior. 

Stage 2: PowerShell, Steganography, and Argument Decoding 

Upon decoding the PowerShell command launched by the JavaScript dropper, we find a script designed to act as a stealthy bridge. It performs three critical tasks: downloading a disguised resource, extracting a fileless loader(Stage 3), and preparing the configuration for the final infection.

Abusing Cloudinary for Evasion 

The script initializes a `System.Net.WebClient` and sets a specific User-Agent to mimic a legitimate browser. It then reaches out to a hardcoded URL hosted on Cloudinary, a popular image hosting service.

The URL is constructed at runtime using a simple replace function (.Replace(‘#’, ‘h’)) to evade static string detection. To the network perimeter, this trafficlooks like a user downloading a standard JPEG image. 

Steganography and In-Memory Loading 

The downloaded file (optimized_MSI_lpsd9p.jpg) carries a hidden payload. The PowerShell script does not save this file to disk as an image. Instead, it readsthe data stream and searches for specific markers: BaseStart- and -BaseEnd. 

The data between these markers is a Base64-encoded .NET assembly (Stage 3). The script extracts this blob and loads it directly into memory using[Reflection.Assembly]::Load(). This “fileless” technique ensures that theStage 3 loader never touches the hard drive, evading traditional antivirus scans. 

Deciphering the Configuration Arguments 

Before invoking the loaded assembly, the PowerShell script prepares a massive argument string (`$argsBase64`). This is where the malware’s true intent is revealed.

Deobfuscating this string (Base64 → UTF-16LE) yields a comma-separated list of parameters that control the behavior of the next stages. Most notably, the first argument appears to be a random string: ‘0hHduAjMxQjNwYTMxAjNyAjMf9mdpVXcyF2LyJmLt92YuM3byZXasJXZsV3b29yL6MHc0RHa’

Upon closer inspection, this string is actually Reversed Base64. By reversing the string order and decoding it, we uncover the URL for the final XWorm payload (Stage 4): https://voulerlivros.com.br/arquivo_20260116064120. txt

The other arguments confirm the injection target and installation paths: 

• Injection Target: CasPol (defined twice in the arguments) 

• Install Directory: C:UsersPublicDownloads 

• Fallback URL: …/bkp 

With these arguments prepared, the script invokes the Main method of the in-memory assembly, passing the configuration that drives the final phase of the attack. 

Stage 3: The Persistence Module (A Dedicated .NET DLL) 

Contrary to what one might expect in a simple infection chain, the payload extracted from the image file is not the XWorm RAT itself. Instead, it is a specialized VB.NET DLL designed with a single purpose: Survival.

This stage acts as a dedicated persistence module. It does not communicate with a C2, nor does it download files. Its job is to ensure that the infection survives a reboot by registering a Scheduled Task. 

Evading Detection via .NET APIs 

Most commodity malware takes the easy route: spawning cmd.exe /c schtasks /create…. This is “noisy” and easily flagged by EDRs monitoring child processes.

This sample takes a stealthier approach. It abuses the Task Scheduler Managed Wrapper, interacting directly with the Windows Task Scheduler via COM interfaces (TaskService, TaskDefinition) within the.NET framework.

By doing this, the malware leaves no command-line artifacts. To a defender looking at process logs, the task appears to “materialize” without a corresponding execution command.

The Infection Loop 

The persistence mechanism reveals the modular nature of this campaign. The scheduled task created by this DLL does not launch XWorm directly. Instead, it isconfigured to re-execute the Stage 2 PowerShell loader. 

Stage 4: The XWorm Payload & CasPol Abuse 

Following the configuration passed by the PowerShell loader, the final payload is retrieved from the URL https://voulerlivros…/arquivo_20260116064120. txt.

Despite the .txt extension, the content is not plain text. It is a reversed Base64 string. This lightweight obfuscation technique can still be effective against content scanners that expect standard Base64 patterns. Once reversed and decoded, the resulting binary is a .NET executable identified as XWorm v5.6.

Living off the Land: CasPol.exe Injection 

The malware does not execute as a standalone process. Instead, it injects itself into CasPol.exe (Code Access Security Policy Tool), a legitimate binary located at C:WindowsMicrosoft.NETFrameworkv4.0.30319CasPol.exe. 

By abusing this “Living off the Land” binary (LOLBIN), the malware attempts to blend in with trusted system processes. However, in the ANY.RUN sandbox, this anomaly is immediately flagged due to the suspicious network activity originating from a trusted utility.

Cracking the Crypto (Static Analysis) 

A deep dive into the payload using dnSpy reveals a critical flaw in the malware’s design. The configuration is encrypted using AES, but the implementation is weak.

• Key derivation: The AES key is generated by taking the MD5 hash of the Mutex string.

• Mode of operation: It uses AES-ECB (Electronic Codebook) mode. 

Because the Mutex is hardcoded in the binary (or passed via arguments), the encryption is deterministic. This allows us to decrypt the configuration offline without needing to run the malware.

Decrypted configuration: 

• C2 Server: jholycf100.ddns.com.br (152.249.17.145) 

• Port: 7000 

• Mutex: V2r1vDNFXE1YLWoA 

• Splitter: <Xwormmm> (A unique fingerprint for XWorm) 

Behavioral Confirmation (Dynamic Analysis) 

The static findings are fully corroborated by the runtime behavior observed in ANY.RUN.

• Mutex Creation: The sandbox logs show the creation of the mutex V2r1vDNFXE1YLWoA, confirming the exact seed used for our decryption. 

• C2 Traffic: The process CasPol.exe initiates a TCP connection to jholycf100.ddns.com.br on port 7000. 

• Protocol: The traffic stream contains the <Xwormmm> delimiter, matching the decrypted configuration. 

Business Impact: What This Means for Companies 

This isn’t “just another XWorm.” The risk comes from how reliably the chain can reach corporate endpoints and how quietly it can stay there. A fake receipt is the kind of lure that fits normal finance and ops workflows, and the delivery stack (WMI-spawned PowerShell, cloud-hosted content, fileless loading, and task-based persistence via .NET APIs) is built to reduce the early signals many teams depend on.

• Credential and session theft → downstream compromise: Once a workstation is controlled, attackers can harvest browser sessions and credentials and pivot into email, SaaS, and finance tooling, turning a single click into an identity-driven incident.

• Higher blast radius, faster: With persistence in place, the operator can take time, map the environment, and expand access, raising the likelihood of lateral movement and follow-on payloads.

• Cost of delayed detection: “Lower-noise” tradecraft tends to inflate MTTR because the initial event looks benign (image download, PowerShell in the background, no obvious dropped binary), while real impact surfaces later.

• Operational risk, not just endpoint risk: The outcomes aren’t limited to one infected machine. The realistic worst cases are business email compromise, fraudulent payments, data access, or ransomware staging, each with direct financial and reputational consequences.

The takeaway is simple: this kind of campaign rewards fast, evidence-based validation at the first suspicious touchpoint (script/PowerShell execution + abnormal cloud-hosted “image” responses) and strict monitoring of LOLBIN abuse (e.g., CasPol.exe producing outbound traffic). Catching it early is what keeps a workstation event from becoming a business threat.

How to Set Up Early Detection of XWorm Attacks 

Early detection of XWorm usually depends on how well the SOC operational cycle is working day to day. When monitoring, triage, and threat hunting are tightly connected, commodity RAT activity is far more likely to be contained before it turns into a real business incident. 

1. Monitoring: Strengthen Visibility with TI Feeds 

The first signal often appears in external infrastructure or newly observed indicators. ANY.RUN’s TI Feeds help by continuously surfacing fresh XWorm-related domains, hashes, and behavioral patterns, based on telemetry and submissions coming from 15,000+ organizations and 600,000+ security professionals.  

This makes it easier to spot suspicious activity earlier and push relevant IOCs directly into SIEM or EDR controls. 

2. Triage: Enrich and Validate Alerts in Minutes 

Once an alert or suspicious artifact appears, speed becomes critical. 

• TI Lookup provides immediate enrichment, showing reputation, related samples, network relationships, and historical context around a file, hash, or domain. 

• Interactive sandbox analysis allows teams to safely execute suspicious files or URLs and observe real runtime behavior, confirming XWorm activity within minutes rather than hours. 

Fast, evidence-based triage reduces uncertainty and prevents unnecessary escalation while still catching real threats early. 

3. Threat Hunting: Track Active Regional Campaigns 

The next step in the cycle is proactive visibility. Using structured TI Lookup queries such as: threatName:”xworm” AND submissionCountry:”br” SOC teams can surface the latest XWorm samples observedin Brazil, review delivery techniques, and pivot into related infrastructure. This makes detection logic more relevant to the current regional threat landscape, not just historical global data. 

When these three motions operate as a continuous cycle rather than isolated tasks, XWorm shifts from a late discovery to an early, manageable security event, reducing response time, investigation cost, and overall business risk. 

Conclusion 

This campaign highlights a clear trend in LATAM-focused malware: pairing high-volume delivery vectors with established commodity RATs. While the XWorm payload itself relies on relatively basic cryptography (AES-ECB), the overall delivery chain is built for resilience.

By combining HTML/LNK delivery, Cloudinary abuse, steganography, and modular persistence (via .NET Task Scheduler APIs), the attackers have created a lower-noise infection chain that can bypass superficial defenses.

For defenders, detection opportunities exist at multiple stages: 

• Delivery: Monitor for LNK/JS files spawning PowerShell. 

• Network: Flag traffic to image hosting services (Cloudinary) where responses contain non-image headers or BaseStart markers.

• Endpoint: Alert on CasPol.exe initiating outbound network connections. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, fits naturally into modern SOC workflows, strengthening the day-to-day operational cycle across Tier 1, Tier 2, and Tier 3.

It supports every step of an investigation, from safely detonating suspicious files and links to see real behavior, to enriching indicators with broader context, to delivering fresh intelligence that helps teams act faster and with fewer blind spots.

Today, more than 600,000 security professionals across 15,000+ organizations use ANY.RUN to speed up triage, cut unnecessary escalations, and keep pace with fast-moving phishing and malware campaigns. 

Bring speed and clarity to your SOC with ANY.RUN 

Appendix: Indicators of Compromise (IOCs) 

Network Indicators 

• C2 Domain: jholycf100[.]ddns[.]com[.]br 

• C2 IP: 152[.]249[.]17[.]145 

• Port: 7000 

• Payload URL 1 (Stego Loader): res[.]cloudinary[.]com/…/optimized_MSI_lpsd9p.jpg 

• Payload URL 2 (XWorm): voulerlivros[.]com[.]br/arquivo_20260116064120.txt 

Host-Based Indicators 

• Mutex: V2r1vDNFXE1YLWoA 

• File Path: C:UsersPublicDownloads 

• Target Process: CasPol.exe 

• File hash: 7befeacf0b3480fb675d0cab7767b5b9697edc9d0e05982025a06ead0054afd5 

• Powershell: Assembly.Load 

Detection Oportunities – YARA Rules 

YARA – Javascript Dropper: 

This rule is designed as a medium-to-high confidence hunting rule, prioritizing behavioral and structural indicators rather than brittle IOCs..

rule JS_WSH_Unicode_Padded_Dropper 

    meta: 

        description = "WSH JavaScript dropper with Unicode padding and repeated assignment patterns" 

        author = "0xOlympus" 

        confidence = "medium-high" 

    strings: 

        $assign = "this." ascii 

        $pad = { 

            74 68 69 73 2E 76 61 74 66 75 6C 20 2B 3D 20 22 

            E0 B2 92 E2 9C 96 C8 B7 

        } 

        $wsh = "Scripting.FileSystemObject" ascii nocase 

    condition: 

        /* Exclude PE files */ 

        uint16(0) != 0x5A4D and 

        /* Script-sized payloads (not tiny JS snippets) */ 

        filesize > 1000KB and 

        /* Must be WSH-based */ 

        $wsh and 

        /* Obfuscation indicators */ 

        ( 

            $pad or 

            $assign 

        ) 

}

Key detection components: 

• Non-PE filtering 
  The check uint16(0) != 0x5A4D ensures that only script-based files are evaluated, preventing false positives on executable payloads. 

• File size heuristic 
  The condition filesize > 1000KB targets scripts that abuse entropy padding. Legitimate JavaScript files are rarely this large, especially when used as WSH droppers. 

YARA – Xworm 5.6 Payload: 

This rule targets the final XWorm RAT binary, using protocol and cryptographic fingerprints that are stable across XWorm versions. 

rule XWorm_PE_v56 

{ 

    meta: 

        description = "XWorm RAT v5.6 .NET payload" 

        author = "0xOlympus" 

        family = "XWorm" 

        version = "5.6" 

        confidence = "very high" 

    strings: 

        // Protocol splitter (strong family fingerprint) 

        $splitter = "<Xwormmm>" ascii 

        // Cryptographic implementation 

        $crypto1 = "RijndaelManaged" ascii 

        $crypto2 = "MD5CryptoServiceProvider" ascii 

        $crypto3 = "CipherMode.ECB" ascii 

        // Network functionality 

        $net1 = "System.Net.Sockets" ascii 

        $net2 = "NetworkStream" ascii 

    condition: 

        uint16(0) == 0x5A4D and 

        filesize < 5MB and 

        $splitter and 

        2 of ($crypto*) and 

        1 of ($net*) 

}

Note: The <Xwormmm> splitter combined with AES-ECB + MD5 key derivation provides a near-unique signature for XWorm, resulting in very low false-positive risk.

The post LATAM Businesses Hit by XWorm via Fake Financial Receipts: Full Campaign Analysis  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More