Cavern Manticore, an Iran-MOIS-linked APT group, deploys a modular .NET C2 framework targeting Israeli government and IT organizations. The framework uses three compilation formats (Mixed-Mode C++/CLI, NativeAOT, .NET Framework) as an anti-analysis layer, with DLL sideloading via WinDirStat.exe for initial execution. Post-exploitation modules provide DPAPI decryption, LDAP brute-forcing, SQL browsing, network reconnaissance, and SOCKS5 tunneling, with C2 traffic XOR-encrypted over HTTPS/WebSocket channels.
Microsoft Edge
15 posts
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework ToddyCat: your hidden email assistant. Part 2 ToddyCat APT developed a tool called Umbrij that automates the theft of Google OAuth authorization codes by launching Chromium-based browsers in headless mode with remote debugging ports enabled. The tool copies the victim's browser profile to a backup directory, launches the browser invisibly with the stolen session, and uses Puppeteer Sharp to automate the Google OAuth consent flow using legitimate Google Workspace Migration/Sync client IDs. The resulting authorization code is exfiltrated and exchanged for an access token, enabling API-level access to the victim's Gmail, Drive, Calendar, and Contacts without traditional credential theft.
Cyber Centre Daily Advisory Digest — 2026-06-29 (8 advisories) The Canadian Centre for Cyber Security published a daily advisory digest on 2026-06-29 containing 8 security advisories covering Ubuntu, Red Hat, CISA ICS, Dell, IBM, Microsoft Edge, Oracle, and Apple products. The most critical item is Oracle CVE-2026-46817, which open-source reporting indicates is being actively exploited, affecting Oracle Database Server, E-Business Suite, Communications Unified Assurance, Hospitality OPERA 5, and REST Data Services. Organizations should prioritize patching Oracle products and review all applicable advisories for their environment.
Edgecution: Malicious Edge Extension Backdoor | ThreatLabz ThreatLabz identified a new attack campaign deploying 'Edgecution,' a malicious Microsoft Edge browser extension used by an initial access broker affiliated with Payouts King ransomware. The malware abuses the Chrome native messaging protocol to bridge a headless browser extension with a Python-based backdoor, enabling arbitrary code execution and filesystem access while evading traditional browser sandboxes.
Cyber Centre Daily Advisory Digest — 2026-06-12 (4 advisories) The Canadian Centre for Cyber Security released a daily digest highlighting critical security updates for Microsoft Edge, Spring framework components, Google Chrome, and Moxa industrial computers. Notably, the Microsoft Edge update addresses CVE-2026-11645, a vulnerability with a known exploit available in the wild, necessitating urgent patching.
Pwn2Own Berlin 2026: On the Ground With TrendAI™ ZDI's Biggest AI Showdown Yet At Pwn2Own Berlin 2026, security researchers demonstrated 47 unique zero-day vulnerabilities across AI platforms and traditional enterprise software. Notable exploits included root-level code execution in AI agents via trust boundary failures, a SYSTEM-level RCE in Microsoft Exchange, a pre-authentication RCE in SharePoint, and a cross-tenant guest-to-host escape in VMware ESXi.
Cyber Centre Daily Advisory Digest — 2026-05-29 (2 advisories) The Canadian Centre for Cyber Security issued a daily digest highlighting recent security updates from Microsoft and Oracle. The advisories cover vulnerabilities in Microsoft Edge and critical flaws across several Oracle enterprise products, urging administrators to apply the latest patches to prevent potential exploitation.
Cyber Centre Daily Advisory Digest — 2026-05-22 (6 advisories) The Canadian Centre for Cyber Security released a daily digest of six security advisories. Notably, a highly critical SQL injection vulnerability in Drupal Core (CVE-2026-9082) is currently being exploited in the wild, and F5 has disclosed a critical vulnerability (CVE-2026-9256) affecting multiple NGINX products.
Cyber Centre Daily Advisory Digest — 2026-05-19 (2 advisories) The Canadian Centre for Cyber Security (CCCS) released a daily digest highlighting recent security advisories for various Industrial Control Systems (ICS) and Microsoft Edge. Organizations are advised to review the specific CISA ICS advisories for products from ABB, Siemens, and others, and to update Microsoft Edge to version 148.0.3967.70 or later.
Kazuar: Anatomy of a nation-state botnet Kazuar is a sophisticated, modular P2P botnet attributed to the Russian state-sponsored actor Secret Blizzard. It utilizes a tripartite architecture (Kernel, Bridge, Worker) and a leader election mechanism to minimize external C2 traffic, relying on Mailslots, Window Messaging, and Named Pipes for internal communication and HTTP, WSS, or EWS for external C2.
Cyber Centre Daily Advisory Digest — 2026-05-01 (1 advisories) The Canadian Centre for Cyber Security issued an advisory (AV26-411) regarding unspecified vulnerabilities in Microsoft Edge Stable Channel versions prior to 147.0.3912.98. Administrators are advised to review the Microsoft release notes and apply the necessary updates to mitigate potential exploitation.
Cyber Centre Daily Advisory Digest — 2026-04-27 (9 advisories) The Canadian Centre for Cyber Security released a daily digest of nine security advisories covering critical vulnerabilities across enterprise software, Linux kernels, and industrial control systems (ICS). Organizations are urged to apply patches for affected products from vendors including IBM, Dell, Ubuntu, Red Hat, Moxa, VMware, Notepad++, and Microsoft to prevent potential exploitation.
Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite Google Threat Intelligence Group identified UNC6692, a threat actor utilizing Microsoft Teams phishing and email bombing to deploy a custom modular malware suite. The attack chain leverages a malicious Chromium extension (SNOWBELT), a Python tunneler (SNOWGLAZE), and a Python bindshell (SNOWBASIN) to establish persistence, move laterally, and exfiltrate sensitive Active Directory data via legitimate cloud services.
Cyber Centre Daily Advisory Digest — 2026-04-17 (3 advisories) The Canadian Centre for Cyber Security released a daily digest highlighting recent security updates for Microsoft Edge, HashiCorp Vault, and JetBrains YouTrack. Organizations are advised to apply the necessary patches to address vulnerabilities including Denial-of-Service and Server-Side Request Forgery.
Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government Unit 42 identified a coordinated cyberespionage campaign targeting a Southeast Asian government entity, involving three distinct China-aligned threat clusters. The attackers utilized a variety of tools including USB worms, custom loaders, and multiple remote access Trojans (PUBLOAD, Masol, Gorem, FluffyGh0st) to establish persistent access, evade detection via DLL sideloading, and exfiltrate sensitive data.
