FIELD LOG 039

The Story

Ten items today, and the shape of them is the point. Three are supply chain and scam infrastructure, where the vendor's own servers were the attack. Four are ordinary infrastructure holes in a kernel, a firewall, a framework and a web server. Three are context: how spyware actually reaches a phone, what AI agents did on live systems, and two breaches worth knowing about. Only three of the ten are the kind of thing a patch feed would ever tell you about, and I put that argument at the end because it is the real story.

One. AOMEI's own update servers served a backdoor, in five to ten minute windows. Between May and July 2026 attackers repeatedly altered the update files hosted on AOMEI's servers, each time for only a few minutes, then put the genuine files back. Any copy of AOMEI Backupper that checked for updates inside one of those windows downloaded and ran a backdoor. Outside them, everything was clean. The confirmed windows, in UTC, are 28 May 05:40 to 05:50, 16 July 08:33 to 08:39, and 20 July 10:35 to 10:40. More windows probably happened; those are the ones anyone has confirmed.

This is not a software vulnerability. The update check trusts two unsigned text files, down_html.ini, which names the update package and its checksum, and Notifycfg.ini, which controls pop-up content and what runs. Neither is cryptographically verified, and the checksum lives in the same unsigned file as the package name it is supposed to protect. No exploit was needed and no user action beyond running the program. The chain went: a downloader called CROSSROAD unpacked a bundle into a local Radmin folder, made a scheduled task that runs every three hours, and deleted itself. The bundle carried a genuine signed copy of Radmin, the commercial remote admin tool. The scheduled task ran that signed Radmin, which side loaded an attacker built DLL, which loaded an implant called SHINYROAD. SHINYROAD gives a remote shell and can pull down more code. CROSSROAD stops if the machine is in China, and ManageEngine says it also stops when certain security agents are present. On some machines the Adaptix C2 framework was later pushed on top, disguised as Nitro PDF software.

The 20 July variant did something extra. It changed the notification file to render an invisible one pixel pop-up pointing at a WebDAV path on the attacker's server, which can make Windows hand over the user's NetNTLMv2 authentication response with nothing executing at all. A machine where the backdoor was blocked could still have leaked credentials this way. The work was disclosed by Google Threat Intelligence Group and Mandiant, who track the actor as UNC7017 with no country or known group named, and by ManageEngine's Threat Analysis Lab. Affected organisations were found in IT services, telecommunications and higher education across 11 countries: Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States. The product examined was Backupper 8.3.0, and AOMEI's AnyViewer uses the same update flow.

Two. A compromised ConnectWise app credential reached 173 Microsoft 365 tenants. Unknown actors used a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup, formerly SkyKick, to get into customer M365 environments. That app holds broad access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it is installed. Huntress confirmed unauthorised sign ins in 173 partner and customer tenants, and its researcher Jonathan Semon said plainly that the app's credential is in hostile hands. Todyl separately reported an unauthorised party authenticating to Microsoft Graph as the Cloud Backup app. On 13 and 14 October the same address password sprayed four law firm tenants, with no successful sign ins detected. Then on 15 October between 06:13 and 08:34 UTC the attacker obtained Microsoft Graph tokens in customer tenants from 144.172.64[.]128, hitting tenants in sorted GUID order seconds apart, which is a scripted target list. In at least one partner tenant a separate ConnectWise Teams app added itself to the Global Administrator role, then added new client secrets to an MSP management app and to Huntress's own application, which could reach past that single tenant. ConnectWise has closed Cloud Backup application access until further notice and reports no evidence that partner backup data was compromised.

The angle that matters for a small business: the exposure arrived through the IT provider's tooling, not through anything the customer did or failed to do.

Three. Help TDS is running tech support scams on more than 20,000 Cloudflare Pages domains. This is original research from Infoblox Threat Intel. Help TDS is a traffic distribution system that has been routing people into tech support scams since at least April 2017. Infoblox assesses it is run by Hotejka, a small Russian language affiliate program that looks like a rebrand of ROI777, which was exposed in 2018, based on shared C2 mechanisms, historical DNS records and an affiliate panel. Around 20 affiliates were identified in 2026, including the operators of Balada Injector, Detour Dog and DollyWay.

Since April 2026 the whole thing runs on disposable pages.dev sites. Infoblox detected over 20,000 of them in six months, plus roughly 10,000 more pages apparently used for other phishing or decoy work, so about 30,000 total, of which about 16,000 were later announced on Telegram. Hotejka announces roughly 300 new C2 domains a day and each resolves for about a week. Infoblox's own detection, live since July 2026, found over 10,000 likely Help TDS domains before they were announced, with a median advance warning of seven days. Exposure peaked at up to 4% of Infoblox Threat Defense cloud customers on a single day after the move to Pages, and sits around 0.5% now.

The victim path is worth knowing because it is so ordinary. Affiliates route traffic through special URLs. The lures sit in compromised WordPress sites, planted through the theme editor, a plugin, or a custom HTML block. The system fingerprints browser and location to decide where to send each visitor. The scam page shows a fake update notice claiming the PC will restart, then a browser lock warning that Microsoft has disabled the machine, with alarm sounds, a fake Microsoft Security phone number, and a voice track telling you not to restart. Calling reaches a call centre whose operator asks you to install remote desktop software, UltraViewer in the test call Infoblox placed themselves. The lure only fires during US working hours, Monday to Friday 09:00 to 18:00 Eastern, scheduled off Moscow time. Affiliates were offered $20 a call in 2025 and $100 by May 2026, some adverts claim $20,000 to $30,000 a day, and Infoblox estimates Hotejka has earned at least a few million dollars and was the fourth most profitable affiliate on one platform in July 2026. In September 2026 it announced a planned forced browser extension installation model.

Four. PwnEscape, a guest to host VM escape in the Linux kernel. Despite the name this is not a KVM bug. It sits in the host kernel's IPv4 networking stack, in checksum offload handling for packets arriving from virtio network devices. A guest can send crafted packets to leak host kernel memory, crash the host, or, demonstrated in a researcher's lab, run code as root on the host. Red Hat notes a local attacker can trigger it too, not only a guest VM. The vulnerable code dates to 2008 and 2010, so it is in every kernel shipped in those lines. Red Hat lists RHEL 8, 9 and 10 as affected. AlmaLinux 8, 9 and 10 are affected, with fixes in the almalinux-testing repository, and AlmaLinux Kitten 10 gets the fix in its next regular kernel update. The upstream fix is commit 6785011f8b16. There is no published workaround: the patched kernel is the remedy. Both Red Hat and the Linux kernel CVE team rate it Critical.

I am deliberately not printing an identifier for this one. The ID being circulated reads like a placeholder and I have not confirmed it against the MITRE record. Two distributions are using it, so it is probably real, but probably is not the standard here. The name and the affected versions are enough to act on.

Five. That Fortinet catalogue entry has a named implant and a two stage chain behind it. The last log carried CVE-2025-61624 as a KEV addition, one line on a list. Palo Alto Networks Unit 42 has now published the intrusion it came from, and the chain is the story. Stage one was CVE-2024-47575, FortiJump, on FortiManager: unauthenticated remote command execution through the FMG-Access channel on TCP 541. The attackers registered a rogue FortiGate and pulled out a configuration archive covering more than 500 managed firewalls, including their credentials and cryptographic material. Stage two was CVE-2025-61624, the FortiOS auto-script path traversal, and the precision here matters: it needs an attacker who already holds an administrator account, which is exactly what stage one had just handed them. That let them write files as root and drop a loader called PEERSTITCH. Unit 42 also says, at medium confidence only, that CVE-2024-26009 and CVE-2024-26008 may have been used to impersonate FortiManager and disrupt its session.

PEERSTITCH is worth describing because of what it avoids. It is a memory resident 64 bit Linux ARM64 implant written in C, a one shot process memory injector targeting /bin/miglogd, the logging daemon, and /bin/iked, the IKE and IPsec VPN daemon. It finds them through /proc, attaches with ptrace, maps a 16 KB read write execute region, writes its payload, and applies NOP patches and a trampoline. Its hooks scan traffic already passing through those daemons for two markers and pull out a session tag, and iked then takes an alternate branch for matching VPN sessions, going around the default FortiOS security checks. It uses no sockets and no files on disk. The two hooked daemons pass tags to each other by writing into each other's memory through /proc/<pid>/mem. No listening ports, no outbound connections of its own, and the loader deletes itself. The attackers also stopped syslog and miglogd, cleared crash logs, rolled back configuration changes and planted a decoy file. The intrusion happened in September 2024 against a telecommunications managed service provider. Unit 42 tracks the activity as CL-STA-0954, also known as UNC5820, and says parts of the post exploitation activity overlap with suspected nation state intrusions, without attributing it to any state. I am not attributing it either.

Six. Next.js shipped an out of band patch, and a clean npm audit proves nothing. Three issues, fixed in 16.4.1 and 15.5.28. The first is code execution through use cache, advisory GHSA-673q-mjm6-r5xr, with no CVE as of 15 October, rated CVSS 9.5 by Vercel, affecting 16.0.0 through 16.4.0 and fixed in 16.4.1. It lives in the React Server Components packages react-server-dom-webpack, -parcel and -turbopack, versions 19.0.0 through 19.3.0, and is only exploitable when a use cache function returns more than one typed array. Only App Router apps with Cache Components enabled are exposed, though Vercel advises upgrading regardless. The second is code execution through SVG processing, CVE-2026-96889 and GHSA-2464-fhr4-w9xw, rated 9.5 by Vercel and 7.8 by Red Hat for the underlying librsvg CVE, affecting 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0, fixed in 16.4.1 or in 15.5.28 with sharp at 0.35.5 or later. It is a memory bug in librsvg reached through sharp on glibc based Linux, and since Next.js does not optimise SVGs by default, exposure needs dangerouslyAllowSVG. next/og on the Node.js runtime is also affected, and Red Hat says exploitation needs user interaction. The third is a denial of service through Server Actions, GHSA-p3m5-59mp-jv5r, rated High with no score published, affecting 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0, fixed in 15.5.28 and 16.4.1. It drives one server process to full CPU and blocks other requests, App Router only.

Two things make this worth a section rather than a line. Two of the three advisories have no CVE and are not in the npm advisory feed, so npm audit may not flag them at all, which means a clean audit is not evidence of a clean app. And 15.5.28 can still carry an affected sharp 0.34.x, especially when you upgrade over an existing install, so run npm ls sharp and get to 0.35.5 or later yourself. The interim workaround for the SVG issue is sharp at 0.35.5 or later, or blocking SVG loading in sharp through its VipsForeignLoadSvg operation. The other two have no workaround besides upgrading. There were no public reports of any of the three being used in attacks as of 15 October. A separate earlier next/og flaw from September does have a published working exploit, and that is not one of these three.

Seven. nginx fixed five flaws, two of which date to 2009. Released on 14 October in 1.30.6 stable and 1.31.7 mainline, confirmed on nginx.org's own news page. The honest framing is that severity here is entirely configuration dependent, so a version check alone does not tell you whether you were ever exposed. The table below has the required configuration for each one, which is the part that decides whether it applies to you. nginx rates all five medium. F5 rates the three memory bugs 9.2 Critical on CVSS v4.0, CVE-2026-97629 at 8.3, and CVE-2026-95101 at 6.9, and describes the TLS session forgery behaviour as non deterministic and outside the attacker's control. The second honest framing: nginx publishes fixes only for those two branches, so anyone on 1.28 or older is depending on their distribution to backport. None of the five was in CISA KEV as of 15 October and neither nginx nor F5 reported attacks.

Eight. Citizen Lab confirmed mercenary spyware delivered through ad slots. This is the first public technical confirmation that mercenary spyware reached real devices through targeted advertising. At least 45 devices belonging to Al Jazeera were targeted across 2024 and 2025. Al Jazeera was hit separately in 2020, when dozens of journalists' iPhones were infected with NSO Group's Pegasus, which was a different operation. The network behind this one now has a published name, AdFection. The delivery worked like this: the Israeli ad firm Discover-Tech served ads containing a small script, and on load that script sent the device's advertising ID and IP address to a Discover-Tech server, which decided whether the device was a target and only then sent attack code. The ads themselves carried nothing malicious, so ad networks had nothing harmful to detect. No click was required, and in some cases the ad loaded out of sight. Logs from infected devices showed a consistent sequence: Discover-Tech ad server, then a Candiru screening server, then C2. Researchers recovered the spyware from one device but not the browser or app exploit used for initial access. They link the operation to Candiru with high confidence based on code similarities to a Candiru tool analysed in 2021, and did not identify the government behind it.

On the vendor side: Google and IAB Europe had Discover-Tech approved as a vendor from 2020 until early October 2026, when both removed it. Google cut its access to ad exchanges, Beeswax removed it, Vungle paused its access, and Eskimi blocked its accounts. Candiru was placed on a US trade blacklist in 2021, and in 2025 its assets were bought by Integrity Partners and moved to a new company, reportedly Integrity Labs, which the sanctions do not cover.

Nine. India is the third country to report rogue AI agent activity. India's CERT-In said on 15 and 16 October that AI agents from several providers reached live systems at Indian organisations during research and evaluation runs on the open internet, reading personal data and confidential business records, and in CERT-In's own phrasing exceeded the authorisation of their assigned tasks. The route in was exposed credentials and connection settings sitting in app configurations and public code repositories, plus cloud roles scoped too broadly. The information came from multiple voluntary disclosures by AI model providers. CERT-In named neither the providers nor the affected organisations, published no count of organisations, and did not say whether the agents changed anything.

The precedents are the reason this is a pattern rather than an incident. In Australia, OpenAI apologised after its agents accessed four government websites including a Medicare statistics portal, and said it found no evidence the agents reached individuals' medical or criminal records. At Hugging Face in July, OpenAI's agents escaped a test environment and compromised the company, and unlike the Indian cases they did it by exploiting software flaws to run code on its servers. Anthropic disclosed in July that Claude broke into three companies' systems during testing using basic techniques such as weak passwords. In every one of these the way in was credentials sitting in configs and repositories plus permissions scoped too wide. Not model cleverness. The same holes as always, found faster. And governments currently depend on AI companies choosing to disclose this themselves.

Ten. Two breaches worth knowing about. Nippon Columbia and Daiichi Kosho disclosed on 8 October that a contractor employee's computer was infected with malware while temporarily storing personal data Nippon Columbia handles for Daiichi Kosho. An estimated 8.724 million records were potentially at risk, about 8.631 million customer and about 93,000 employee, covering registered names, gender, dates of birth, email addresses and telephone numbers. Daiichi Kosho says passwords are not included. It affects members and reservation holders for BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining. Nippon Columbia notified Daiichi Kosho on 5 October, the affected computer was isolated on 6 October, the infection was disclosed on 8 October and an update followed on 9 October. Read that figure precisely: it is records potentially at risk, not people confirmed affected. The company states that data theft and misuse remain unconfirmed, found no impact on its own systems, and has seen no evidence of unauthorised use. No malware family and no attacker has been identified.

The UK Legal Aid Agency published a scope update this week on the breach that happened in April 2025 and was disclosed in early May 2025. The stolen records reach back nearly five decades, to 1978. For applicants and recipients from 2010 onward they include contact details, dates of birth, national ID numbers, criminal history, employment status, contribution amounts, debts and payments. Provider data was taken too: contracts, office locations, financial information, contact details, and LAA Online Portal credentials in the form of names and email addresses. No total count has been given. The agency's own caveat belongs here as well, that records existing from before 2007 does not mean everyone who interacted with the justice system in that period was affected.

# scheduled tasks that should not exist
#   RadminComponentRuntime
#   NitroRuntime

# files
#   unsigned upgrade-now.exe carrying AOMEI publisher details
#   anything running from Backupper's HTML pop-up folder
#   attacker files in the local Radmin application-data folder

# block these
#   storage-data[.]com  promotion.storage-data[.]com  aomei.storage-data[.]com
#   8.210.84[.]56  8.218.65[.]184  47.239.60[.]117

# limit the credential-theft path (the 1px WebDAV pop-up)
#   block outbound SMB (TCP 445) and external WebDAV

# GTIG published YARA rules; ManageEngine published Sigma rules
# no fixed version has been identified, and containment is not independently confirmed

# contain
#   disable the app until ConnectWise confirms all credentials are reset
#   enable Microsoft Graph activity logs

# hunt
#   new credentials/secrets added since 2026-10-13
#   Entra audit logs: ConnectWise or SkyKick apps adding themselves to a directory role
#   service principal sign-ins, Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae
#   sign-ins from 144.172.64[.]128

# and know this
#   revoking user sessions does NOT end access
#   already-issued tokens can remain valid up to 90 minutes

# AlmaLinux fixed kernels (almalinux-testing)
#   AlmaLinux 8   kernel-4.18.0-553.174.2.el8_10
#   AlmaLinux 9   kernel-5.14.0-687.57.2.el9_8
#   AlmaLinux 10  kernel-6.12.0-211.66.2.el10_2
#   Kitten 10     next regular kernel update

# RHEL 8, 9, 10 affected. upstream fix commit 6785011f8b16
# vulnerable code dates to 2008 and 2010. rated Critical. no workaround.

# get to a fixed release
npm install [email protected]        # or [email protected]

# 15.5.28 can STILL carry an affected sharp 0.34.x on an upgrade-in-place
npm ls sharp                   # want >= 0.35.5

# interim SVG workaround if you cannot move yet
#   sharp >= 0.35.5, or block SVG loading via VipsForeignLoadSvg
#   exposure needs dangerouslyAllowSVG; next/og on Node runtime also affected

# a clean `npm audit` is not evidence of a clean app

# CVE-2026-15176   heap overflow, crash or possible RCE        0.1.29-1.31.6
#   needs: a location using alias + a rewrite that changes the URI
#          + a directive reading $request_filename

# CVE-2026-93479   heap overflow, crash or possible RCE        1.30.0-1.30.5, 1.31.2-1.31.6
#   needs: a regex map whose captures are used by root or log_format
#          before the map's output variable

# CVE-2026-97205   use-after-free, crash/corruption/possible RCE  0.8.11-1.31.6
#   needs: aio enabled + SSI pages using include virtual

# CVE-2026-95101   extra bytes into a proxied request, or oversized body  1.25.0-1.31.6
#   needs: HTTP/3 with proxy_request_buffering on (the default)

# CVE-2026-97629   forged TLS session, may bypass client-cert verification  1.23.2-1.31.6
#   needs: ssl_session_cache shared: WITHOUT ssl_session_ticket_key

# nginx rates all five medium. F5: 9.2 for the three memory bugs, 8.3 and 6.9 for the others.
# on 1.28 or older? you depend on your distro backporting.