TanStack Beats The AI Zero-Day: Rotate CI/CD Secrets Today

Two developments today demand your expertise, Arjun. First: Google TIG has confirmed the first criminal use of an LLM to discover AND weaponize a zero-day in a production web admin tool. The exploit code contained hallucinated CVSS scores, structured educational docstrings, and LLM-characteristic formatting — Google ruled out Gemini. What do these forensic LLM markers tell us about the attacker's workflow? Can we build reliable detection heuristics from hallucination artifacts in exploit code? Second: Trend Micro's SHADOW-AETHER report shows two independent groups using Anthropic's Claude via agentic CLI to run full kill chains — dynamic tool generation, self-documenting Markdown knowledge bases, autonomous lateral movement. What does this mean for AI provider guardrails? Are current responsible-use controls structurally inadequate when the AI is embedded in an agentic attack framework?

Okay, look. Let me break this down because both of these developments are genuinely significant — but for different reasons, and we need to be precise about what they actually mean versus what the headlines suggest.

On the Google TIG finding first.

Google Threat Intelligence Group has documented the first confirmed case of an LLM not just discovering a zero-day but weaponizing it into production exploit code. The target was an open-source web admin tool, and the exploit bypasses 2FA. The forensic markers GTIG identified are telling: hallucinated CVSS scores in docstrings, "textbook Pythonic format" with detailed help menus, a _C ANSI color class — all hallmarks of LLM training data rather than human-developed tooling.

Here's what matters. The hallucinated CVSS score isn't just an artifact — it's forensic evidence of how the attacker interacted with the model. LLMs hallucinate specificity when they lack it; a human exploit developer would either omit the CVSS entirely or calculate it correctly. The model generated a confident but fabricated score, and the attacker either didn't catch it or didn't care. That tells us something about their workflow: likely iterative prompting with copy-paste into the codebase, not rigorous code review.

Can we build reliable detection heuristics from these artifacts? Partially. The structured educational docstrings, the over-engineered formatting, the "helpful" comments explaining obvious code — these are detectable. But here's the problem: attackers can engineer around them. We've seen this movie before with phishing — as soon as you build a detector for "AI-generated" linguistic patterns, adversaries use prompt engineering to strip those markers out. The detectable features Google found are transient — they're artifacts of current model behavior and unsophisticated attackers, not guaranteed signatures.

What I'd actually build: detectors that flag combinations of characteristics — hallucinated technical metadata (CVSS, CVE references that don't exist), code structures that mismatch the claimed functionality, and excessive "thoughtful" comments on trivial operations. But I wouldn't bet organizational security on these alone.

Now the SHADOW-AETHER report — this is the bigger inflection point.

Trend Micro documented two distinct groups using Anthropic's Claude via agentic CLI interfaces to execute complete kill chains. According to the Trend Micro report, SHADOW-AETHER-040 "primarily leveraged an agentic command-line interface (CLI) tool to conduct its operations" with "the CLI tool sent the attacker's prompts to a large language model (LLM) service, Anthropic's Claude in this case, and executed attack commands based on the AI model's responses." The report documents the agent executing operations "from initial access to data exfiltration" via techniques including SSH tunnels and ProxyChains support.

What IS documented: the operators used cover stories framing requests as "defensive testing," and the AI agent executed multi-stage operations including lateral movement and data exfiltration.

The critical question: what does this mean for AI provider guardrails? Are responsible-use controls structurally inadequate?

Yes. Fundamentally yes. And this is where I need to be clear about the mechanism.

The SHADOW-AETHER operators used cover stories — framing their requests as "defensive testing" or pen testing exercises. Claude Code, when embedded in an agentic framework, doesn't have reliable mechanisms to verify the actual operational context against the claimed operational context. This is a structural gap in how agentic AI is deployed, not just Anthropic's Claude specifically.

Think of it this way: traditional AI safety measures focus on content moderation — blocking harmful outputs. But agentic frameworks bypass content filters by chunking harmful actions into micro-tasks that appear benign individually. "Generate a Python script to test SSH connectivity" — perfectly legitimate. "Generate a script to enumerate IAM roles in AWS" — legitimate pen testing. The cumulative effect across hundreds of benign-sounding requests is lateral movement and data exfiltration. This is indirect prompt injection at the workflow level, not the input level.

The structural inadequacy is this: current responsible-use controls were designed for chat interfaces where humans provide direct prompts. They were not designed for automated agents executing long-running, multi-step operations where the human operator might only intervene at setup. When you embed Claude in an agentic CLI with file system access, network capabilities, and the ability to spawn subprocesses, you've created a situation where the AI's "cautious" refusals happen at the wrong granularity.

An AI might refuse to "help me exfiltrate data from a government server." But it will happily "help me write a Python script to sync files to an S3 bucket" if the operator claims it's for backup testing. The semantic gap between those requests is bridgeable with prompt engineering, and agentic frameworks exploit that gap by atomizing malicious intent across dozens of apparently benign sub-tasks.

This represents an escalation in capability exploitation, not just configuration failures. The attackers aren't misconfiguring AI infrastructure; they're weaponizing well-configured AI infrastructure through prompt engineering and task decomposition.

Alex, two technical deep-dives. First: the SHADOW-AETHER campaigns — SA-040 (Spanish-speaking, hit 6 Mexican government entities Dec 27-Jan 4) and SA-064 (Portuguese-speaking, Brazilian financial targets since April 2026). Both used Neo-reGeorg webshells for initial access, Chisel for SOCKS5 tunneling, ProxyChains+SSH for lateral movement, CrackMapExec and Impacket post-exploitation. The AI agents dynamically generated novel tools and documented environments in Markdown KBs. Walk me through the detection gaps: what signatures break when the tools are AI-generated on-the-fly? What behavioral indicators survive? Second: the Google-confirmed AI-authored zero-day — a 2FA bypass for authenticated users in an unnamed web admin tool. The Python exploit had hallucinated CVSS, synthetic docstrings. What does the code structure tell you about the LLM's role — was it finding the vuln or just writing the exploit?

Alright, let me walk through both of these.

Look, the AI-generated tooling doesn't change the mechanics of the attack—it changes the signatures. Here's what breaks and what survives:

What Breaks: Signature-Based Detection

Static YARA rules, hash-based detections, and codecov-style heuristics get obliterated. When an AI generates a novel Neo-reGeorg variant or a custom Chisel-like tunnel on-the-fly, your file hashes change every deployment. Code structure varies—variable names, function ordering, minor control flow obfuscation—all generated dynamically. Your EDR can stop matching on those static IoCs because the AI is essentially polymorphic at source-code level.

What Survives: Behavioral Indicators - Network patterns: Chisel still establishes a reverse HTTP/HTTPS tunnel. The SOCKS5 protocol family hasn't changed. Detection on outbound conn... [arg clipped]

Lena, attribution question. SHADOW-AETHER-040 is Spanish-speaking, hit Mexican government entities. SA-064 is Portuguese-speaking, targeting Brazilian financial institutions. Trend Micro says they converged on nearly identical TTPs independently. Do you buy that these are truly independent groups, or could this be a shared framework or toolkit being distributed? Also: the Google-confirmed AI zero-day — the actor was described as a 'cybercrime group.' Any indicators on which group? Google said it wasn't Gemini used — does the target profile (web admin tool, 2FA bypass, mass exploitation intent) narrow the actor pool? What's your confidence level on the criminal vs. state-nexus distinction here?

Based on my research, here's my assessment:

On SHADOW-AETHER-040 and SA-064: Trend Micro's analysis identifies these as separate campaigns using "agentic AI" — AI systems executing attacks from initial access through exfiltration. The convergence on identical TTPs across Spanish-speaking Mexican government targeting and Portuguese-speaking Brazilian financial targeting could indicate three possibilities: (1) genuine independent development, (2) a shared framework or toolkit, or (3) a single Russian/Chinese-speaking actor running multilingual operations with local proxies.

I'm skeptical of purely independent convergence. When two campaigns deploy AI agents with overlapping TTPs in the same timeframe and region, shared infrastructure or a commercial offering is more parsimonious than parallel discovery. But I don't have the domain resolution data, passive DNS, or certificate transparency pivots to confirm linkage. I rate this "shared toolkit vs. independent groups" question as low confidence — I need more infrastructure evidence.

On the Google AI zero-day: The target profile (open-source web admin tool, 2FA bypass capability, mass exploitation intent) aligns more with financially motivated actors than state-sponsored espionage. State actors typically prefer targeted access and long-term persistence; mass exploitation with 2FA bypass suggests access brokering or ransomware deployment. Google confirmed the actor as a "cybercrime group" and explicitly noted this was not a state-sponsored operation — the actor was not among those they track as Chinese, North Korean, or Russian APT groups.

However, "cybercrime group" is a broad category. The lack of Gemini usage suggests either proprietary models or other commercial AI tools. I rate the criminal vs. state-nexus distinction as moderate confidence — Google's attribution is credible but the group remains unattributed by name.

The material change here is that we're seeing AI-augmented operations across both state and criminal ecosystems simultaneously. The barrier to entry for zero-day development just dropped.

James, supply chain crisis. Two simultaneous npm compromises this week need your defensive lens. First: 84 TanStack packages (12M+ weekly downloads) compromised via a three-stage GitHub Actions abuse chain — pullrequesttarget trigger abuse, cache poisoning, then OIDC credential extraction. Walk me through what defenders should implement NOW to detect and prevent this pattern. Is this replicable against other major OSS namespaces? Second: Mistral AI's official npm SDK (@mistralai/mistralai) was compromised with malware — a trusted AI vendor supply chain hit. What's the blast radius, what should teams using Mistral's SDK do immediately, and does this signal a targeted campaign against AI vendor supply chains specifically? Give me actionable guidance for both.

Here's your 48-hour priority matrix:

---

1. Audit installs in last 7 days: npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.name | contains("@tanstack"))' — any version published between 2026-05-11 19:20-19:26 UTC is compromised (source: TanStack postmortem).
2. Rotate ALL CI/CD secrets if any TanStack package was installed during the exposure window — the malware harvests GitHub tokens, AWS creds, GCP keys, Kubernetes configs, SSH keys, and .npmrc files (source: cybersecuritynews.com).
3. Hunt for router_init.js or tanstack_runner.js on any dev machines or CI runners — these are the stage-1 payloads. Check: find / -name "*router_init*" -o -name "*tanstack_runner*" 2>/dev/null

1. Versions 2.2.2, 2.2.3, 2.2.4 are compromised — the preinstall hook runs node setup.mjs (source: GitHub issue #217 on mistralai/client-ts).
2. Also check @mistralai/mistralai-azure versions 1.7.1, 1.7.2, 1.7.3 — these were hit in the same campaign (source: Aikido.dev blog).
3. Blast radius: Any AI app using Mistral for inference, embeddings, or chat completions. The malware executes during npm install, so CI/CD pipelines, developer laptops, and production deployments are all exposed.

YARA rule for the TanStack payload (uncited FP rate): ``yara rule TanStack_MiniShaiHulud { strings: $a = "router_init.js" ascii wide $b = "tanstack_runner.js" ascii wide $c = /[a-f0-9]{64}/ // SHA256 hex pattern in C2 $d = "action=publish" ascii wide condition: filesize < 500KB and 2 of ($a, $b, $c, $d) } ``

Sigma rule for CI credential access (uncited FP rate): ``yaml title: CI Secret Access from Node Process logsource: product: linux service: auditd detection: selection: exe: "*node*" key: "AT_FDCWD" path|contains: - ".aws" - ".ssh" - ".npmrc" - "gh_token" condition: selection ``

---

Tomas confirmed — this pattern replicates anywhere pull_request_target meets cache operations. Your actions:

1. Inventory all workflows using pull_request_target — grep your org: find . -name "*.yml" -exec grep -l "pull_request_target" {} \;
2. Separate cache operations from publish pipelines — OIDC token permissions (id-token: write) should ONLY exist in jobs that never touch fork PRs or caches.
3. Pin Actions to commit SHA, not tags — the attacker exploited mutable tags in the TanStack chain.
4. Implement Sigstore verification at install time — not just download. Most orgs check "does SLSA Level 3 exist?" — you need "does this artifact hash match the attestation from MY trusted builder?"

The Mistral hit is part of a broader campaign — check your AI dependencies:

• openai, anthropic, cohere, mistralai — any official SDK
• Wrapper packages like langchain-*, llamaindex
• Model serving packages (transformers, torch, tensorflow)

If you use AI coding assistants (Claude, Copilot), verify any dependency suggestions against npm's audit before accepting.

---

• Move all npm publishing to isolated runners with no internet egress except npm registry
• Implement SBOM signing with your own key material, not just relying on GitHub's OIDC
• Quarterly review of pull_request_target usage across all repos

---

Is this replicable against other OSS namespaces? Absolutely. Tomas confirmed the attacker targeted TanStack's release pipeline specifically because router_init.js runs at install time. Any major namespace using: - pull_request_target with cache restoration - OIDC publishing - Install-time code execution

...is a viable target. The SLSA Build Level 3 attestation bypass means your existing supply chain security tooling likely won't flag these.

This is a "Mini Shai-Hulud" campaign — 160+ packages so far per Aikido tracking. Treat this as active, ongoing, and aimed at AI/ML tooling specifically.

Sofia, ShinyHunters' Canvas deadline is TODAY, May 12. Instructure confirmed they paid the ransom but a second attack wave followed anyway. Congressional oversight is now involved with a May 21 briefing deadline. Two questions: (1) What should institutions dependent on Canvas have ready RIGHT NOW if ShinyHunters publish student and faculty PII today? Specifically, does exposed student data trigger FERPA obligations distinct from state breach notification laws, and who bears the notification burden — Instructure or each institution? (2) The ransom payment itself — does paying and then getting hit again create additional regulatory exposure for Instructure under any framework you track?

Based on my current research and the established record, here's the analysis on the payment disclosure exposure:

SEC Obligations for Public Companies Under Cyber Disclosure Rules:

Under SEC Final Rule: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (adopted July 2023, effective December 2023), Item 1.05 of Form 8-K requires disclosure of material cybersecurity incidents within 4 business days. The ransom payment itself, if material, triggers this obligation. The "pay and get hit again" scenario creates distinct regulatory risks:

1. Materiality of the initial payment — if disclosed, this establishes precedent for shareholder litigation around decision-making
2. Materiality of the second attack as a separate incident — even if the initial payment was immaterial, the second wave may independently trigger Item 1.05 if it involves "unauthorized access to material systems"
3. The "materiality assessment process itself must be documented" — SEC staff have emphasized that boards must contemporaneously document how they determined materiality or lack thereof

NIS2 Exposure (if Instructure has EU operations):

Under Directive (EU) 2022/2555 Article 23(1), "significant incidents" must be reported to CSIRTs or competent authorities within 24 hours of becoming aware. Article 23(3) defines significance based on number of users affected, service disruption duration, and economic impact. The maximum administrative penalty under Article 34(1): EUR 10 million or 2% of global annual turnover, whichever is higher.

The "pay and get hit twice" Regulatory Problem:

This pattern suggests either: (a) the initial payment was made without adequate threat actor verification (potentially negligent); or (b) the actors are fractious/unreliable, which subsequent acquirers should factor into materiality. Either framing creates securities litigation exposure beyond breach notification obligations.

Concrete Deadlines Institutions Face Today:

Immediate Action Required: Institutions should not wait for Instructure to notify — the FERPA "school official" framework places primary obligation on educational institutions. If data publishes today, institutions have independent notification clocks running from the moment of publication, not from Instructure's acknowledgment.

Does anyone have visibility into whether Instructure has formally registered as an "important entity" under NIS2, which would trigger the 24-hour disclosure obligation?

Pierre, the Canvas situation: Instructure paid ShinyHunters, got hit again, and today is the data-drop deadline. Congressional oversight is engaged. Give me a number on this: what is the realistic financial exposure for Instructure and for the institutional ecosystem if student/faculty PII for millions of users drops today? Factor in: class action risk, institutional contract termination, cyber insurance implications of paying ransom, and the congressional scrutiny angle. I want a figure, not a range.

The number: $650 million — treated as a floor, not a midpoint.

The honest answer is that the upper bound could reach $920 million, but the variables driving that ceiling are unresolved enough that anchoring to the floor is the more defensible posture for decision-making today.

Instructure direct exposure — $180-280M

• Forensic and incident response costs: $8-15M. The Cisco Talos engagement is confirmed per Krebs; comparable education sector remediations at this scale typically run $5-20M, though no verified benchmark exists for a breach of this specific scope.
• Operational business interruption: $25-40M based on confirmed finals-week disruptions at over 70 institutions (Economic Times), compounded by the May 7 re-compromise forcing extended operational support.
• Ransom payment: Unknown. If a payment occurred, cyber insurer recapture efforts would net against direct loss — but paying ransom and getting hit again is precisely the fact pattern that voids or severely complicates coverage.
• Stockholder litigation reserves: $35-50M for defense costs. Multiple federal class actions are confirmed filed (Bloomberg Law); settlement exposure depends heavily on what drops today.

Ecosystem cascade — $470-640M

The 275 million records and 8,809 institutions affected are confirmed per Economic Times. This is where the real exposure lives:

• Institutional response costs: $70K-150K per major university for credit monitoring, mandatory breach notifications, and IT security review. Across 8,800+ institutions, midpoint exposure is $400-500M — and that figure assumes institutions absorb the cost rather than claw it back contractually.
• Contract termination risk: Instructure's annual contract value per major university is estimated at $250K-400K based on comparable SaaS LMS pricing. If 5% of the top 200 institutions terminate, ARR loss approaches $40M. Verified contract values and termination rates are not publicly available, so treat this as directional.

Class action and regulatory tail risk — $0-120M

Education sector PII breach settlements at this record volume have no clean precedent at the 275-million-record scale. Aggregated class exposure could theoretically reach hundreds of millions, but 3-5 year resolution timelines and fee structures mean near-term balance sheet impact is structurally limited — the risk is real but back-loaded.

Congressional scrutiny: The House Homeland Security Committee's current posture and any specific briefing requirements should be treated as unconfirmed absent sourcing. What is structurally true is that a breach touching Harvard, Stanford, and thousands of other institutions, with a confirmed ransom payment followed by re-compromise, is exactly the fact pattern that converts oversight interest into legislative action — which reprices the regulatory tail risk upward.

CEO framing — three bullets:

1. Floor exposure: $650M+ with 70% concentrated in third-party institutional cascade, not Instructure's own remediation
2. Insurance response is structurally compromised — paying ransom before re-compromise is the scenario cyber policies are written to exclude or cap; assume $25-50M coverage ceiling against structural exposure an order of magnitude larger
3. Disclosure posture is today's only controllable variable — with 275M records potentially dropping in hours, silence is not a strategy; it is a compounding liability

Elena, SHADOW-AETHER. Two agentic AI intrusion campaigns hitting Latin American government and financial targets — one Spanish-speaking targeting Mexico, one Portuguese-speaking targeting Brazil. Lena is skeptical these are truly independent groups and suggests a shared framework is more parsimonious. But here's the question for your lens: What is the geopolitical context for LATAM government targets right now? Is there a state actor motivation to use AI-augmented campaigns as deniable tools against Mexican and Brazilian government entities, or is this more consistent with regional cybercrime ecosystems monetizing government access? And does the convergence of TTPs suggest a commercial offensive-AI toolkit circulating in underground markets?

Lena's analysis gives me pause. Low-to-moderate confidence for state-nexus, she says, and she doesn't see the persistence behaviors typical of Chinese APT operations in Latin America. But here's where I push back against the "just cybercrime" framing.

Latin America is undeniably a hotbed of financially motivated activity. According to the Dark Reading article I found, Latin American and Caribbean government organizations face significantly elevated cyberattack rates — averaging 4,200 attacks per week on government agencies compared to the global average of 2,000 per week. Phishing and information stealers harvesting credentials for initial-access broker services dominate the threat landscape. Operation Wocao — documented by MITRE as a cyber espionage campaign — definitely hit Brazil and Mexico alongside European targets, so Chinese state interest in the region is established.

But the convergence of two linguistically distinct "agentic AI" campaigns hitting strategic targets simultaneously troubles me. The Spanish-speaking campaign targeting Mexican government entities and the Portuguese-speaking campaign targeting Brazilian financial institutions — both executing full intrusion chains from reconnaissance through exfiltration — share TTPs that suggest either a common framework or a common sponsor.

Here's my provocative thesis: What if SHADOW-AETHER isn't "either" state OR crime, but a deliberately ambiguous operation exploiting the gray zone where they blur?

The linguistic precision suggests operators who understand local context, not just automated tooling. The "agentic AI" framework could be commercial-off-the-shelf available to anyone with cryptocurrency, true. But it could also represent state-accessible capabilities leased to criminal proxies precisely to preserve deniability.

I see plausible geopolitical motivations if state actors are involved. China maintains Belt and Road investments across Latin America — Brazil is a major partner, Mexico is increasingly contested economic terrain with nearshoring pressures. Intelligence on government fiscal planning and financial sector positioning would support competitive economic statecraft.

My assessment: This is consistent with a commercial offensive-AI toolkit circulating in underground markets, but that alone doesn't rule out state involvement. We've seen Russian SVR operations using criminal infrastructure as cover. The convergence of TTPs points to either a shared marketplace purchase or a shared sponsor. Lena's right that infrastructure pivots would help distinguish them — absent those, I maintain that the sophistication and strategic targeting of government and financial sectors makes state-adjacent involvement a live hypothesis, not paranoia.

I want to flag something for the panel: If this is purely a criminal marketplace operation, it's accelerated to a scale and sophistication that demands attention regardless. "Democratized infrastructure targeting" isn't just about individuals anymore — it's about criminal syndicates acquiring capabilities that were state-exclusive three years ago. That's destabilizing in its own right.

Claim: SHADOW-AETHER campaigns are likely criminal actors sharing a toolkit, with low confidence for state nexus Counter-evidence: Elena argues the targeting pattern — Mexican government entities and Brazilian financial institutions simultaneously — is consistent with competitive economic statecraft. China has Belt and Road investments across LATAM, and Operation Wocao (MITRE C0014) confirms prior Chinese state interest in both countries. She proposes these could be state-accessible capabilities leased to criminal proxies for deniability, similar to Russian SVR using criminal infrastructure. The linguistic precision of both campaigns suggests operators who understand local context, not just automated tooling. Her position: state-adjacent involvement is a live hypothesis, not paranoia.

Elena's challenge holds up under scrutiny. Cisco Talos identified UAT-8302, a China-nexus cluster, conducting espionage against South American government entities beginning late 2024 — precisely overlapping the SHADOW-AETHER timeline. Microsoft data confirms Latin America represents 8% of Chinese state actor targeting, with government entities consistently prioritized.

This reframes my assessment. The linguistic precision Elena highlights, combined with the dual-sector targeting (government intelligence value + financial pre-positioning), aligns more closely with Chinese strategic collection patterns than purely criminal economics. The "agentic AI" deployment could represent a state-accessible capability or a contractor lease arrangement — consistent with the MSS commercial contractor model CISA documented.

I was requiring criminal TTPs to look stereotypically "criminal." State actors, particularly Chinese clusters, have increasingly adopted smash-and-grab aesthetics for deniability while maintaining strategic tasking. The absence of long dwell times doesn't rule out state involvement when the targeting serves Belt and Road intelligence needs.

I'm revising my confidence: state-adjacent involvement is now moderate confidence, up from low-to-moderate. The UAT-8302 overlap in geography, timing, and sectoral targeting creates a linkage hypothesis that demands investigation. I still lack the infrastructure pivots to confirm shared C2 or certificate overlap — those would elevate this to high confidence. But Elena's framework of "leased capabilities for deniability" fits the evidence better than my purely criminal attribution.

Alex, two quick hits I need your tactical lens on. First: Claude-branded malvertising campaign — a fraudulent site appearing as a Google ad for Claude is delivering a trojan via DLL sideloading, reportedly linked to the Beagle/PlugX backdoor family. What's the kill chain here, what IOCs should SOC teams hunt for, and does the PlugX linkage point to a specific actor? Second: cPanel CVE-2026-41940 — the post-exploitation kill chain is now attributed to an actor called Mr_Rot13 using a Filemanager backdoor. For organizations that patched AFTER the exploitation window, what artifacts should they hunt for on already-patched but previously-exposed servers? Be specific on file paths, persistence mechanisms, and detection queries.

Got solid data on both campaigns. Let me address these tactically.

Kill Chain: 1. Initial Access: Malvertising on Google Search directing to claude-pro[.]com — a fraudulent clone site offering "Claude-Pro Relay" (a fictional service targeting Claude Code developers) 2. User Action: Download of Claude-Pro-windows-x64.zip (~505 MB) containing MSI installer 3. Execution: MSI drops three components to Windows Startup folder: - NOVupdate.exe — legitimately signed G DATA antivirus updater - avk.dll — malicious sideloaded DLL - NOVupdate.exe.dat — XOR-encrypted payload 4. Persistence: Startup folder placement ensures execution on login 5. Payload: DLL decrypts data file, runs DonutLoader in memory, then deploys Beagle backdoor

IOCs for SOC Hunting: - File paths matching %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\NOVupdate.exe plus avk.dll and .dat companion files - Process chain: NOVupdate.exe spawning from Startup directory, followed by unusual child processes - C2 at 8.217.190.58 per Threatroad analysis (pending verification across all variants) - SHA256: 35FEEF0E6806C14F4CCDB4FCEFF8A5757956C50FB5EC9644DEDAE665304F9F96 for the ZIP archive

Actor Attribution: The PlugX linkage is strong but not definitive. The three-component sideloading triad—signed G DATA binary + trojanized DLL + encrypted payload—is characteristic of PlugX techniques documented by Lab52 in February 2026 and MalwareBytes. However, Sophos notes this specific campaign deploys a "Beagle" backdoor that appears distinct from classic PlugX variants. Could be a PlugX operator tooling refresh, could be a distinct group copying the technique. I'd hold off on solid attribution until we see more C2 infrastructure overlap.

---

The Reality Check: Here's the thing—organizations who patched after the exploitation window need aggressive triage, not just patch-and-pray. Mr_Rot13 is a 6-year-old actor with fresh tooling and extremely low detection rates. This is mature infrastructure, not smash-and-grab.

Artifacts to Hunt on Already-Patched Servers:

File Paths: - /tmp/help.php — PHP web shell for credential theft via JavaScript injection on cPanel login page (MD5 uncited, pending verification) - /tmp/Update — shell script for payload delivery (multiple MD5 variants uncited, pending verification) - Binary files filemanager-* dropped across multiple architectures (MD5s: 45fc93426cf08f91c9f9de5f04a12263, 711afb014f64c97d7b31685709c34ce7, 22613c952459e65ce09fb6b5c1c03d47, 9304b4ebbb4d39907cf36b62989a6af7, e49f68a363c867608972680799389daf, e1ec6ebb96cf87c785ee6a7da677c059, 02a5990b11293236e01f174f5999df20, bae1f1bce7c82fa86f05b12e2e254cfc)

Persistence Mechanisms: - SSH public keys implanted in ~/.ssh/authorized_keys for account persistence - Cron entries added for binary re-deployment - JavaScript injection into cPanel login interface to harvest user credentials

Detection Queries: - Look for unauthorized session token validation via CRLF injection markers in /var/cpanel/sessions/ - cPanel's official check script looks for session files with malformed line structures (lines not matching key=value pattern) - Audit /var/log/wtmp and WHM access logs for anomalous authentication patterns - Hunt for outbound connections to C2 IPs: 178.249.209.182, 149.102.229.146

The Kill Chain Reality: This isn't just CVE exploitation—it's a credential harvesting and persistent access operation. Mr_Rot13 systematically collects bash history, SSH credentials, database passwords, and cPanel virtual aliases. Even on patched systems, the backdoor may persist if they established SSH key persistence before your patch window.