Intelligence Center

Key Takeaways

• Phishing has reclaimed its position as the top initial access vector in Q1 2026.
• Adversaries are leveraging Softr, an AI-powered web development tool, to rapidly generate credential-harvesting pages.
• Threat actors are abusing legitimate developer tools like TruffleHog and native cloud APIs to hunt for exposed secrets.
• UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to deploy the FIRESTARTER backdoor on Cisco Firepower devices.
• Ransomware deployments hit zero in Q1 due to swift mitigation, though pre-ransomware activity accounted for 18% of engagements.

Affected Systems

• Cisco Firepower devices
• Cloud APIs
• macOS
• Windows Defender
• Lantronix and Silex serial-to-IP converters

Vulnerabilities (CVEs)

• CVE-2025-20333
• CVE-2025-20362

Attack Chain

Adversaries initiate attacks primarily through phishing, utilizing AI-powered tools like Softr to rapidly generate credential-harvesting pages. Once initial access is achieved, actors abuse legitimate developer tools such as TruffleHog and native cloud APIs to quietly hunt for exposed secrets and escalate privileges. In specific campaigns, threat actors exploit n-day vulnerabilities (e.g., CVE-2025-20333) to gain unauthorized access to perimeter devices and deploy custom backdoors like FIRESTARTER for persistence.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No specific detection rules or queries are provided in the article.

Detection Engineering Assessment

EDR Visibility: Medium — EDR can detect TruffleHog execution and LOTL techniques, but may struggle with cloud API abuse and network device backdoors. Network Visibility: Medium — Network monitoring can identify anomalous API calls and communication with known malicious IPs, but encrypted phishing traffic may be obscured. Detection Difficulty: Moderate — Abuse of legitimate tools like TruffleHog and native cloud APIs blends in with normal administrative activity, requiring behavioral baselining.

Required Log Sources

• Cloud API logs
• Authentication logs
• Network flow logs
• Endpoint process execution logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for unexpected execution of TruffleHog or similar secret-scanning tools on endpoints or cloud environments by non-developer accounts.	Endpoint process execution logs, Cloud API logs	Credential Access	Medium
Monitor for anomalous spikes in self-service MFA device enrollments, which may indicate account takeover following a successful phishing campaign.	Authentication logs, Identity Provider (IdP) logs	Persistence	Low

Control Gaps

• Lack of centralized logging (SIEM)
• Permissive self-service MFA enrollment

Key Behavioral Indicators

• Execution of TruffleHog by non-developer accounts
• Anomalous cloud API calls hunting for secrets
• Unexpected self-service MFA device registrations

False Positive Assessment

• Medium

Recommendations

Immediate Mitigation

• Restrict self-service MFA enrollment to prevent attackers from registering new devices.
• Ensure robust patch management for perimeter devices, specifically addressing CVE-2025-20333 and CVE-2025-20362.

Infrastructure Hardening

• Implement centralized logging via a SIEM to ensure forensic evidence remains intact.
• Lock down the perimeter and audit exposed cloud APIs.

User Protection

• Deploy properly configured multi-factor authentication (MFA) across all user accounts.

Security Awareness

• Train users to identify sophisticated, AI-generated phishing and credential-harvesting pages.

MITRE ATT&CK Mapping

• T1566 - Phishing
• T1555 - Credentials from Password Stores
• T1190 - Exploit Public-Facing Application
• T1078.004 - Valid Accounts: Cloud Accounts

Additional IOCs

• File Hashes:
  • 2915b3f8b703eb744fc54c81f4a9c67f (MD5) - Prevalent malware file from Talos telemetry (Win.Worm.Coinminer::1201)
  • aac3165ece2959f39ff98334618d10d9 (MD5) - Prevalent malware file from Talos telemetry (W32.Injector:Gen.21ie.1201)
  • c2efb2dcacba6d3ccc175b6ce1b7ed0a (MD5) - Prevalent malware file from Talos telemetry (Auto.90B145.282358.in02)
  • a2cf85d22a54e26794cbc7be16840bb1 (MD5) - Prevalent malware file from Talos telemetry (W32.5E6060DF7E-100.SBX.TG)
  • d749e0f8f2cd4e14178a787571534121 (MD5) - Prevalent malware file from Talos telemetry (W32.3C1DBC3F56-90.SBX.TG)
• File Paths:
  • VID001.exe - Example filename for Win.Worm.Coinminer::1201
  • d4aa3e7010220ad1b458fac17039c274_63_Exe.exe - Example filename for W32.Injector:Gen.21ie.1201
  • APQ9305.dll - Example filename for Auto.90B145.282358.in02
  • a2cf85d22a54e26794cbc7be16840bb1.exe - Example filename for W32.5E6060DF7E-100.SBX.TG
  • KitchenCanvas_753447.exe - Example filename for W32.3C1DBC3F56-90.SBX.TG