❌

Normal view

Received — 28 October 2026 ⏭
Received — 22 October 2026 ⏭

#StopRansomware: SafePay Ransomware

✇CISA Alerts
By: CISA
19 October 2026 at 21:18

Advisory at a Glance

Title #StopRansomware: SafePay Ransomware
Original Publication  October 20, 2026
Executive Summary

This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. 

Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection. Next, they encrypt the victim’s files, making them inaccessible, and leave a ransom note demanding payment in cryptocurrency. This advisory urges organizations to follow recommended security measures to reduce the risk and impact of SafePay ransomware attacks.
Affected Products
Key Actions
  • Regularly patch and update systems, especially firewalls, and other edge devices.
  • Implement Zero Trust Principle.
  • Restrict administrative tools and privileges to necessary users only.
  • Strengthen account security by implementing identity, credential, and access management (ICAM) policies and multifactor authentication (MFA).
Indicators of Compromise

For a downloadable copy of indicators of compromise, see: 
Intended Audience

Organizations: Government; Federal Civilian Executive Branch (FCEB); State, Local, Tribal, and Territorial (SLTT); Critical Infrastructure

Roles: Defensive cybersecurity analysts, vulnerability analysts, security systems managers, and operational technology (OT) owners and operators

Introduction

Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. 

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), United States Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency, and the United Kingdom’s North West Regional Organised Crime Unit—hereafter referred to as the authoring agencies—are releasing this joint advisory to disseminate known SafePay ransomware TTPs and IOCs identified through FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations as recently as August 2026.

Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.

The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents.

Download the PDF version of this report:

For a downloadable copy of IOCs, see:

AA26-293A-STIX XML (XML, 40.23 KB )
AA26-293A-STIX JSON (JSON, 37.49 KB )

Technical Details

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 20. See MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

Initial Access

The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access. SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products:

Additionally, the authoring agencies observed SafePay threat actors exploiting the following vulnerabilities across internet-exposed systems [T1190] for initial access through automated scripts:

Execution, Persistence, Stealth, and Defense Impairment

After SafePay threat actors gain access to a victim network, they establish persistence by gaining administrative privileges on existing accounts [T1098], or on newly created accounts [T1136], using built-in administrative tools consistent with living off the land (LOTL) techniques. Once SafePay threat actors establish a foothold in a victim’s network, they use LOTL binaries (LOLBins) [T1218], such as PsExec [T1021.002] and Windows Remote Management (WinRM) [T1021.006], to execute commands on remote systems. In several instances, SafePay threat actors used ShareFinder.ps1—a PowerShell script function used for enumerating network file shares in Windows Active Directory environments—to identify valuable assets for exfiltration [T1059.001, T1059.003]. Additionally, SafePay threat actors used SharpShares.exe, a tool used to identify and enumerate network file shares.

As SafePay threat actors prepare for lateral movement, they commonly disable security software [T1685] to avoid detection. In some cases, the threat actors changed the passwords of system users, making valid logins impossible. SafePay threat actors have also been observed using software packing or virtual machine software protection to conceal their code [T1027.002].

Privilege Escalation

The authoring agencies observed SafePay threat actors using a User Account Control (UAC) Bypass Privilege Escalation technique [T1548.002] that creates an elevated process through a specified component object model, enabling the execution of malicious commands or binaries [T1059]. SafePay threat actors have also been observed using token impersonation methods [T1134.001].

Lateral Movement

To pivot laterally through a network and identify files for exfiltration [TA0010] and encryption, SafePay threat actors use legitimate tools like PsExec, WinRM, and Remote Management and Monitoring [T1569.002] software. They also employ Remote Desktop Protocol (RDP) [T1021.001, T1133] to expand their presence within the compromised network [T1021]. As SafePay threat actors move laterally through a network, they look for credentials to gain admin access and will create accounts, if needed.

Collection, Exfiltration, and Impact

SafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [T1560.001], and WinSCP and RClone to facilitate the exfiltration of data [T1048] from the compromised network to actor-controlled accounts. In some instances, SafePay threat actors use OneDrive to exfiltrate data [T1567]. In other instances, the SafePay threat actors installed legitimate remote desktop tools like AnyDesk or TeamViewer on the victim’s systems. SafePay threat actors use these tools to transfer ransomware and other software onto a victim’s system. Additionally, SafePay threat actors halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts [T1490].

Following exfiltration, SafePay threat actors encrypt files [T1486] using a sophisticated hybrid encryption scheme to lock data. This involves combining a ChaCha20 stream cipher with an RSA public-key cryptosystem for a fast and secure key exchange. This multilayered approach customizes encryption methods based on file type and size and enables full or partial encryption. Data encrypted with the SafePay ransomware variant (appended with .SafePay) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software. SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. To put pressure on the victim, a representative makes phone calls on behalf of the ransomware group. If the victim does not pay, SafePay posts the exfiltrated data to their SafePay leak website, which is linked in the ransom note. Following encryption, SafePay may delete itself from the victim’s filesystem [T1070.004].

Leveraged Tools

Table 1 lists publicly available tools and applications used by SafePay threat actors, including legitimate tools repurposed for their operations.
Note: These tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.

Table 1. Tools Leveraged by SafePay Threat Actors
Tool Name Description
7-Zip An open source software that enables users to compress various file formats. SafePay threat actors maliciously use 7-Zip for data packaging and movement.
FileZilla An open source client that enables users to transfer files between servers. SafePay threat actors use FileZilla maliciously for data exfiltration.
Mimikatz A credential dumper that enables users to view and save authentication credentials, such as Kerberos tickets [T1550.002]. SafePay threat actors use Mimikatz for password exfiltration.
PowerShell A cross-platform task automation solution used for various malicious activities, including command execution. It is composed of a command-line shell, a scripting language, and a configuration management framework—which runs on Windows, Linux, and macOS. 
PsExec A tool designed to run programs that SafePay threat actors use to execute commands on remote systems.
RClone A legitimate command-line program used to sync files with cloud storage services, such as Mega. SafePay threat actors maliciously use RClone for data packaging and movement.
ScreenConnect A remote support, access, and meeting software that allows users to control devices remotely over the internet. SafePay threat actors use ScreenConnect for persistence and access.
ShareFinder.ps1 A PowerShell script used to scan an Active Directory network for shared folders. SafePay threat actors use ShareFinder.ps1 for exfiltration hunting.
WinRAR Archive utility used to split compromised data into segments and to compress [T1560.001] files into a .RAR format prior to exfiltration. SafePay threat actors use WinRAR for data packaging and movement.
WinRM A Windows-based protocol designed to facilitate remote management and automation. SafePay threat actors use WinRM for command execution.
AnyDesk and TeamViewer Legitimate remote desktop tool used for accessing and controlling computers over the internet. SafePay threat actors use AnyDesk and TeamViewer to transfer malware to the victim’s system.
AcronisDiskDirector A legitimate disk management tool.
SharpShares.exe A network scanning tool used for host discovery and enumeration.
NetExec A legitimate network assessment tool to enumerate systems, validate credentials, and manage remote operations across private networks.
Backblaze A command-line tool for file management within Backblaze B2 cloud storage. SafePay threat actors executed commands via b2.exe to exfiltrate a victim’s data.

Indicators of Compromise

Table 2 through Table 5 list IOCs associated with SafePay ransomware that allowed for the identification of malicious activity.
Disclaimer: The authoring agencies recommend organizations investigate or verify IP addresses prior to taking action, such as blocking. These IOCs were observed between November 2024 and August 2026.

Table 2. IP Addresses
IP Address Description
104.26.2[.]223 SafePay victim intrusion
140.82.114[.]4 SafePay victim intrusion
185.199.108[.]133 SafePay victim intrusion
77.37.49[.]40 SafePay victim intrusion
173.194.194[.]94 Hosting victim data
167.235.225[.]149 Client login panels
5.255.11[.]134 Used in exfiltration
88.119.167[.]239 soc.dll command and control
37.10.71[.]188 Used in exfiltration


Note: Some of these files are legitimate tools. The authoring organizations recommend organizations investigate or verify tool use prior to taking action, such as blocking.

Table 3. Malicious Files
Filename Description
1 - Copy.bat A batch script likely used to copy, stage, or move files during lateral movement or data collection.
CCleaner.exe/ CCleaner64.exe A legitimate system utility; however, it is suspicious if deployed in enterprise environments for file cleanup or anti-forensics.
CCleaner*.exe / *.dll A file used for potential masquerading or abuse of CCleaner components for execution or persistence.
dcsync.exe A tool used to perform DCSync operations to extract Active Directory credentials; high-confidence credential theft activity.
domains.txt An output file likely containing enumerated domain information.
DYRasWtb.exe A suspected malicious executable.
libsmb2.dll A library associated with Server Message Block (SMB) communication; may support lateral movement or file transfer.
Libwa*.dll A suspicious library set; likely part of a custom toolset or malware framework; requires further analysis.
License.txt A benign file that may accompany tool packages or be used for masquerading. In one instance, it accompanied the tool “S.P_Network Scanner.”
locker.dll A potential ransomware or encryption-related component.
netscan.exe A network scanning tool used for host discovery and enumeration.
netscan.lic / netscan.xml Output or configuration files associated with network scanning activity.
netscanNEW.zip Archive file potentially used to stage or transfer scanning tools.
nltest.exe Legitimate Windows tool used for domain trust enumeration; suspicious when used outside admin workflows.
oui.txt A MAC address vendor lookup output—network reconnaissance artifact.
ping.txt An output file from network connectivity testing.
portable.dat A potential configuration or staging file (context-dependent).
scan.xml An output file from scanning/enumeration tools.
sharefinder.ps1 A PowerShell script used to enumerate network shares (reconnaissance).
Socks.exe A tool used to establish SOCKS proxy for tunneling traffic.
Socks_werfault.exe A binary likely masquerading to blend with Windows processes.
subs.txt A possible staging file or list of targets/data for exfiltration.
svchost.exe A legitimate Windows process; suspicious if located outside System32 or used for masquerading.
wa_3rd_party_host_*.exe A file of suspicious binaries—likely part of SafePay threat actor toolset or masquerading components.
winrar.exe A legitimate archiving tool frequently used for data staging prior to exfiltration.
AnyDesk.exe A legitimate remote desktop tool for accessing and controlling computers over the internet; most of the time it is used to transfer malware to a victim’s system.
SharpShares.exe A network scanning tool used for host discovery and enumeration.
AcronisDiskDirector-12.5 / acro.exe / DiskDirector.exe / Acronis.exe A legitimate disk management tool.
b2.exe A command-line tool for data exfiltration to Backblaze B2 cloud storage.
nxc.exe The executable for NetExec, a legitimate network assessment tool used to enumerate systems, validate credentials, and manage remote operations across private networks.
Table 4. SHA-1 Hash Values
Hash File/Description
07353237350c35d6dc2c8f143b649cd07c71f62b 1.exe (ransomware binary)
b498a2683640c983bb069fa2ea9e67cef4a3797d Locker.dll PE32 executable
BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081 locker.dll
d711a5af5aed48a3b36b98f4fcf52809aebef7a2 nxc
Table 5. SHA-256 Hash Files
Hash File/Description
921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae soc.dll
6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a RunPE bundled DLL
e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346 Injected PE
327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 locker.dll PE32 executable
a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 locker.dll
BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41 SharpShares.exe

The following are IOC hostnames:

  • WIN-SBOE3CPNAL
  • WIN-3IUUOFVTQAR
  • WIN-DK18BI83M0S
  • WIN-I1HRRJHCEIV

MITRE ATT&CK Tactics and Techniques 

See Table 6 through Table 16 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool. 

Table 6. Initial Access
Technique Title ID Use
External Remote Services T1133 SafePay threat actors use external remote services, such as VPNs or other tools, to externally connect to an internal network.
Exploit Public-Facing Application T1190 SafePay threat actors attempt to exploit a vulnerability within a system to gain access. Common vulnerabilities include software bugs, glitches, or misconfigurations.
Table 7. Execution
Technique Title ID Use
Command and Scripting Interpreter: PowerShell T1059.001 SafePay threat actors use PowerShell, an interactive command-line interface and scripting environment contained within Windows, to identify code within a targeted network.
Command and Scripting Interpreter: Windows Command Shell  T1059.003 SafePay threat actors use the Windows command shell prompt to gain control of a component on a system that requires specific permissions depending on the command executed.
System Services: Service Execution T1569.002 SafePay threat actors use tools, such as PsExec, to execute commands on remote systems.
Command and Scripting Interpreter T1059 SafePay threat actors use Windows UAC to elevate a program’s privileges, enabling the execution of malicious commands or binaries.
Table 8. Persistence
Technique Title ID Use
Account Manipulation T1098 SafePay threat actors establish persistence by gaining administrative privileges on existing accounts.
Table 9. Privilege Escalation
Technique Title ID Use
Abuse Elevation Control Mechanism: Bypass User Account Control  T1548.002 SafePay threat actors use Windows UAC to elevate a program’s privileges and execute a task on an administrator-level permission scale.
Table 10. Stealth
Technique Title ID Use
Obfuscated Files or Information: Software Packing T1027.002 SafePay threat actors use software packing to conceal malicious code by means of encrypting an executable to avoid detection.
Indicator Removal: File Deletion T1070.004 SafePay threat actors delete files associated with the intrusion activity to minimize their digital footprint and obfuscate malicious activities.
System Binary Proxy Execution T1218 SafePay threat actors proxy the execution of malicious content with a trusted binary, often a Microsoft-signed file, to bypass signature-based network defenses.
Table 11. Defense Impairment
Technique Title ID Use
Disable or Modify Tools  T1685 SafePay threat actors disable security features, modify or delete registry keys or configuration files to impair functionality, and disable updates such as security patches on a system or network.
Table 12. Credential Access
Technique Title ID Use
Brute Force T1110 SafePay threat actors gain access to accounts by implementing brute force password attacks.
Table 13. Lateral Movement
Technique Title ID Use
Remote Services: Remote Desktop Protocol T1021.001 SafePay threat actors gain access to a valid account using RDP and typically disable cybersecurity features, such as Windows Defender, while using LOLBins.
Remote Services: SMB/Windows Admin Shares T1021.002 SafePay threat actors gain access to a valid account using SMB to enable lateral movement throughout a network.
Remote Services T1021 SafePay threat actors employ remote services to expand their presence within the compromised network.
Remote Services: Windows Remote Management T1021.006 SafePay threat actors use tools, such as WinRM, to execute commands on remote systems.
Table 14. Collection
Technique Title ID Use
Archive Collected Data: Archive via Utility T1560.001 SafePay threat actors use utilities to compress or encrypt collected data prior to exfiltration to change the format of the data to one compatible for transportation.
Archive Collected Data: Archive via Library T1560.002 SafePay threat actors use credential dumpers, such as Mimikatz, for password exfiltration.
Table 15. Exfiltration
Technique Title ID Use
Exfiltration Over Alternative Protocol T1048 SafePay threat actors exfiltrate data over an alternative protocol, including file transfer protocol, simple mail transfer protocol, HTTP/S, domain name system, SMB, or another network protocol variation that is not the main or current command and control channel.
Exfiltration Over Web Service T1567 SafePay threat actors exfiltrate data over web services, such as OneDrive.
Table 16. Impact
Technique Title ID Use
Data Encrypted for Impact  T1486 SafePay threat actors encrypt data on targeted systems to disrupt access to a particular system or network service. They then demand a ransom payment in exchange for a decryption key.
Inhibit System Recovery  T1490 SafePay threat actors disable services designed to assist in recovery of a corrupted system. In some cases, SafePay threat actors deleted all network-attached backups of company data.

Incident Response

If a potential compromise is detected, but ransomware actors have not (yet) encrypted items, organizations should take the following actions:

  1. Determine which hosts were compromised and isolate them by quarantining or taking them offline.
  2. Initiate threat hunting activities to scope the intrusion. Collect and review relevant artifacts, logs, and other data to identify threat actor TTPs, compromised devices and accounts, a timeline of activity, etc.
  3. Report the suspected compromise to the FBI and other agencies as appropriate (if located within the U.K., report the compromise to Report Fraud or local police force) (see the Reporting section for contact information).
  4. Apply eviction countermeasures, including those listed below, to contain the incident and eradicate the threat actor from the network (Note: Start applying countermeasures after collecting enough threat hunting data to inform effective countermeasure selection; this will likely overlap with threat hunting activities). 
    1. Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan—the tool comprises Playbook-NG (a web application) and COUN7ER (a database of post-compromise countermeasures mapped to adversary TTPs). 
      1. Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool fact sheet.
  5. Harden the network to prevent additional malicious activity (see Mitigations for guidance).

If compromise is detected and items have been encrypted, see the “Ransomware and Data Extortion Response Checklist” in CISA’s joint #StopRansomware Guide.

Mitigations

The authoring agencies recommend organizations implement the mitigations below to improve their cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

Organizations should implement the following mitigations:

  • Prioritize remediating known exploited vulnerabilities (KEVs) and keep all operating systems, software, and firmware up to date, as timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats; specifically, prioritize patching KEVs in internet-facing systems. [CPG 2.B].
    • Additionally, using Binding Operational Directive 26-04 offers a framework for patch prioritization based on technology type and steps for forensics triage. Under its implementation guidance, it offers guidance and steps to perform forensic triage for severe vulnerability cases.
  • Implement identity, credential, and access management (ICAM) policies across the organization and require MFA for all services to the greatest extent possible—particularly for webmail, VPNs, and accounts that access critical systems [CPG 3.F].
  • Require all accounts with password logins (e.g., service accounts, admin accounts, and domain admin accounts) to comply with NIST’s digital identity guidelines; require employees to use long passwords and consider not requiring recurring password changes, as these can weaken security [CPG 3.B].
    • Use longer passwords consisting of at least 15 characters and no more than 64 characters in length.
    • Store passwords in a hashed format using industry-recognized password managers.
    • Add password user “salts” to shared login credentials.
    • Avoid reusing passwords [CPG 3.C].
    • Implement multiple failed login attempt account lockouts [CPG 3.E].
    • Disable password “hints.”
    • Refrain from requiring password changes more frequently than once per year.
      Note: NIST guidance suggests favoring longer passwords instead of requiring frequent password resets. Frequent password resets are more likely to result in users developing password patterns cyber threat actors can easily decipher.
  • Maintain offline backups of data and regularly test and maintain backup and restoration processes [CPG 3.O]; implementing this practice helps organizations avoid severe operational interruptions and prevents scenarios in which data is irretrievable.
  • Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [CPG 3.K].
  • Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drives, storage devices, or the cloud) [CPG 3.I, 3.O, 1.C].
  • Segment networks to prevent the spread of ransomware, as network segmentation can help control traffic flows between, and access to, various subnetworks and restrict adversary lateral movement [CPG 3.I].
  • Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a network monitoring tool [CPG 4.B].
    • To aid in detecting ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network.
    • Endpoint Detection and Response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.
  • Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems—this prevents threat actors from directly connecting to remote access services that they have established for persistence.
  • Review domain controllers, servers, workstations, and Active Directories for new, unactive and/or unrecognized accounts.
  • Disable unused ports.
  • Consider adding an email banner to emails received from outside of your organization. 
  • Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [CPG 3.G].
  • Implement time-based access for accounts set at the admin level and higher; for example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust Maturity Model).
    • This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need.
    • Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.
  • Disable command-line and scripting activities and permissions, since privilege escalation and lateral movement often depend on software utilities running from the command line; if threat actors cannot run these tools, they will have difficulty escalating privileges and moving laterally [CPG 3.M].

These mitigations align with principles provided in the joint guide Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software. CISA urges software manufacturers to take ownership of improving the security outcomes of their customers by applying these and other secure by design tactics. By implementing secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to make additional configuration changes, purchasing product security add-in software and logs, monitoring, and making frequent security updates.

Validate Security Controls

In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.

To get started:

  1. Select an ATT&CK technique described in this advisory (see Table 6 to Table 16).
  2. Align your security technologies against the technique.
  3. Test your technologies against the technique.
  4. Analyze your detection and prevention technologies’ performance.
  5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
  6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Resources

Reporting

Your organization has no obligation to respond or provide information to the FBI and other authoring agencies in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI or other authoring agencies, reporting must be consistent with applicable state and federal laws.

The FBI and other authoring agencies are interested in any information, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.

Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.

The authoring agencies do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI’s Internet Crime Complaint Center (IC3), a local FBI field office, a local USSS Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (contact@cisa.dhs.gov) or by calling 1-844-Say-CISA (1-844-729-2472).

In the U.K., report incidents of a cybercrime or fraud at the UK’s Home for Reporting Cyber Crime & Fraud or 0300-123-2040, your local police force, or use the non-emergency number 101.

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA and the FBI/USSS do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, or USSS.

The authoring agencies recognize that infrastructure used for malicious activity may be hosted on cloud or virtualized platforms where IP addresses can be dynamically or temporarily assigned. As a result, an address associated with malicious activity at one point in time may later be reassigned to benign services. Accordingly, these indicators should be interpreted as historically observed infrastructure within the activity window and should be corroborated with current network telemetry or additional intelligence sources when used for defensive or investigative purposes.

Version History

October 20, 2026: Initial version.

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

✇CISA Alerts
By: CISA
6 October 2026 at 18:22

Advisory at a Glance 

Title 

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data 

Original Publication 

October 8, 2026 

Executive Summary 

Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts. To help mitigate against this activity, organizations should prioritize disabling unused services and ports, sanitizing web application inputs to prevent injection attacks, implementing multifactor authentication for all services, and applying timely patches to reduce risks of compromise. 

Affected Products 

Key Actions 
  • Disable unused services and ports, such as automatic configuration, remote access, or file sharing protocols. 
  • Sanitize user input in web applications to prevent possible cross-site scripting (XSS) payload injection. 
  • Implement identity, credential, and access management (ICAM) policies, and then require multifactor authentication (MFA) for services (to the extent possible). 

Indicators of Compromise 

For a downloadable copy of indicators of compromise, see: 

Intended Audience 

Organizations: Government; Federal Civilian Executive Branch (FCEB); State, Local, Tribal, and Territorial (SLTT); Critical Infrastructure. 

Sectors: Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. 

Introduction 

Integrity Technology Group, a China-based company with links to the Chinese government, enables China-linked threat actors to exploit US and foreign organization networks across multiple sectors using various tools and techniques. This advisory provides an analysis of tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) from Integrity Technology Group and the threat actors they enable (hereafter referred to as “the threat actors”). The analysis in this advisory provides network defenders with detection and mitigation guidance to reduce the risk of threat actors compromising critical data. 

The threat actors use a unique combination of large-scale botnets, virtual private network (VPN) infrastructure, living-off-the-land (LOTL) techniques, and repositories of computer network exploitation (CNE) tools. Although these techniques are not unique to Chinese threat actors, this advisory details how the threat actors use them to support CNE activity. 

The threat actors targeted victims across multiple US critical infrastructure sectors, including: Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. The actors also targeted victims in US law enforcement, education, and religious organizations, as well as organizations across Southeast Asia, Africa, and North America. 

The information in this advisory originates from technical evidence recovered from, and observed during, multiple Federal Bureau of Investigation (FBI) investigations related to Integrity Technology Group. 

The FBI, Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), United Kingdom National Cyber Security Centre (NCSC-UK), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (Cyber Centre), Japan’s National Police Agency (NPA) and National Cybersecurity Office (NCO), New Zealand’s National Cyber Security Centre (NCSC-NZ), and Spain’s Centro Nacional de Inteligencia (CNI), hereafter referred to as “the authoring organizations”—are releasing this joint cybersecurity advisory to urge network defenders from government and relevant organizations to: 

  • Hunt for potential compromises from this activity. 
  • Better protect against this threat activity and other Chinese government-linked cyber targeting. 

This advisory also provides our US federal, state, local, territorial, and tribal (FSLTT) government agencies, and international and industry partners, with the indicators and details necessary to proactively defend their networks against this threat and protect critical data. 

For more information on People’s Republic of China (PRC) state-sponsored malicious cyber activity in general, see the FBI’s Cyber Threat Overview: China webpage. For more information on China-linked malicious cyber activity, see CISA’s People’s Republic of China Threat Overview and Advisories webpage. 

The authoring organizations encourage network defenders to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of these incidents. 

Download the PDF version of this report:

For a downloadable copy of IOCs, see: 

AA26-281A STIX (JSON, 1,021.16 KB )
AA26-281A STIX XML (XML, 658.87 KB )

Threat Actor Background 

Integrity Technology Group (Integrity Tech) is a China-based for-profit company with links to the Chinese government. Integrity Tech employs individuals who support malicious cyber activity in different ways, including acquiring or building cyber tools for use and sale, acquiring and hosting infrastructure, and compromising networks across global victims, which the authoring organizations track as China-based malicious cyber activity. The services provided by Integrity Tech also contribute to the larger Chinese cyber ecosystem, which aims to exfiltrate sensitive data from victims around the world.

Notably, the threat actors enabled by Integrity Tech use TTPs consistent with the cyber activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett, among others. However, these threat actors may also perform activity not associated with Integrity Tech. 

Note: Cybersecurity companies have different methods of tracking and attributing cyber actors and these may not be a 1:1 correlation to the US Government's methodology and understanding for all activity related to these groupings. 

Technical Details 

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 19. See Appendix A: Indicators of Compromise and the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

Reconnaissance  

The threat actors use a variety of open source scanning tools to find vulnerabilities in networks and web-based applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan [T1595.002]. See Appendix A: Indicators of Compromise for a complete list of scanning tools. 

Some of these tools contain features useful for fingerprinting remote applications, testing remote authentication protocols, or enumerating the pages of a website. The use of open source tools typically found on GitHub suggests the threat actors tend to look for more vulnerable targets. In general, the threat actors focus on scanning ports 21 (file transfer protocol [FTP]), 22 (SSH), 53 (domain name system [DNS]), 80 (HTTP), 443 (HTTPS), and 1080 (SOCKS). When scanning websites with dirsearch, the threat actors attempt to enumerate PHP and ASP (.NET) pages. 

MicroScan 

As early as 2017, these threat actors have also used a malicious application known as “MicroScan.” This Python-based web application contains over 1,300 penetration testing scripts written to scan websites for specific vulnerabilities. The threat actors used these scripts to target services including OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. See Appendix B: Observed Common Vulnerabilities and Exposures for a list of successfully exploited common vulnerabilities and exposures (CVEs) recovered from penetration testing scripts. Figure 1 shows a MicroScan account dashboard displaying detected vulnerabilities.

Figure 1. MicroScan Account Dashboard Showing Detected Vulnerabilities
Figure 1. MicroScan Account Dashboard Showing Detected Vulnerabilities

Initial Access and Execution 

Since at least mid-January 2021, the threat actors have gained access to victim networks and cloud-based services primarily through command line utilities built on exploit codes written in popular programming languages, such as Python and Go [T1059.006]. Additionally, the threat actors have used JavaScript [T1059.007] and HTML code to execute cross-site scripting (XSS) attacks. XSS vulnerabilities allow malicious actors to use unwitting third-party applications vulnerable to XSS to modify content on a webpage [T1189] and target other victims. 

During the investigations, the FBI recovered an XSS payload used by the threat actors. When executed on a vulnerable website running JavaScript, this payload modifies webpage content to display username and password fields, facilitating user credential harvesting (see Figure 2).

Figure 2. Executed XSS Payload
Figure 2. Executed XSS Payload

After a user enters any username and password, the executed XSS payload page generates a link to download a password-protected .zip file. The .zip file’s contents originate from encoded bytes within the XSS payload and contain the executable file live700_v1.exe. 

Analysis of live700_v1.exe demonstrated the executable begins a process named DiagTrack.exe, which shares its name with legitimate Windows software [T1036.003]. DiagTrack.exe then establishes encrypted communications over the HTTP protocol with the domain dns.studiocloud.xyz, which the FBI attributes to Integrity Tech. Given that the executable also contains functions designed to query data from user mailboxes, the FBI assesses the malware likely targets user email data for exfiltration. 

EBurst 

The threat actors use EBurst, an open source Python-based tool, to target accounts in the Microsoft Office365 Cloud environment. The tool compromises email accounts on Microsoft Exchange servers using multiple interfaces for password spraying [T1110.003] and password guessing [T1110.001] against each supplied email address. Based on the open source EBurst ReadMe file, these interfaces include:

  • Exchange Control Panel (ECP); 
  • Exchange Web Services (EWS); 
  • Offline Address Book (OAB); 
  • Outlook Web Access (OWA); 
  • Remote Procedure Call (RPC); 
  • Application Programming Interface (API); 
  • Messaging Application Programming Interface (MAPI); 
  • PowerShell; 
  • Autodiscover; and  
  • Microsoft-Server-ActiveSync. 

Network defenders should include these interfaces when defending against EBurst. 

Persistence 

To establish persistence, the threat actors install virtual private network (VPN) software clients on victim devices [T1133] to obfuscate command and control (C2) communications or other actions, further preventing victims from attributing malicious network activity. 

The threat actors typically download SoftEther installers onto victim devices from threat actor-controlled infrastructure using PowerShell or LOTL binaries for Windows Systems [T1059.001]. For Linux/Unix distributions, the threat actors download SoftEther installers via curl or wget. For either operating system, the actors configure the SoftEther client to automatically reconnect on startup. They often name the installers conhost.exe or dllhost.exe to appear as common Windows executables [T1036.003]. Additionally, endpoint detection software is less likely to flag SoftEther because it is a legitimate VPN software. 

In some observed cases, the threat actors stored the SoftEther program directly on the server. Analysis of these servers revealed victim domains and subdomains that hosted the SoftEther connections: 

  • 98aiblog[.]com; 
  • hmbcloud[.]com; 
  • hmbcloud[.]net; 
  • hmbiplc-01[.]com; 
  • iepl.node[.]cm;  
  • javacheck.ooguy[.]com; 
  • javaupdate.giize[.]com; 
  • sexytube0[.]com; and 
  • twimg.co[.]uk. 

The threat actors use SoftEther to maintain persistent remote access to victim devices to enable data exfiltration. The FBI observed the threat actors installing the client on the end-user’s system, which connected to the C2 server using one of the identified domains, subdomains, or the server’s IP address. The threat actors also accessed other targets, including cybersecurity websites, connected to these hubs. 

Collection and Exfiltration 

The FBI observed the threat actors downloading databases or manually pulling data from the victim emails and staging the exfiltration data with discreet file names to minimize detection of the MySQL email dump. Some of these names include: 

  • 001.gif; 
  • All_scanner_vXX.pl.gz (XX represents either a one- or two-digit number); 
  • Css.js; 
  • Include.png; 
  • M2k.js; 
  • M2k_list.js; and 
  • M2k_ui_adm.js. 

Curlc4.txt 

The FBI observed that the threat actors created a bot using the PHP script Curlc4.txt to obtain emails from victims. The script is specifically designed to interface with the Microsoft EWS API, which allows the threat actors to access email and content items, such as calendars and contacts [T1114.002]. 

Based on observations, the script appears to be stand-alone rather than installed on a compromised device. The script uploaded emails to a remote server [T1020], obfuscating many of the directories and files it created, and changed the name of the child process to crypto. 

The script downloaded the original file from https://upl.natcloudservice[.]com using IP address 149.28.132[.]137. The main C2 domain for the bot was natcloudservice[.]com, and the domain communicated with https://natcloudservice[.]com/ews and upl.natcloudservice[.]com/ews. Before exfiltration, the bot compressed emails. In some instances, the threat actor also used a password to encrypt emails using RC4 or AES-128-CBC [T1560.003]. 

The PHP script took up to two command-line arguments. The first argument appeared to be the root directory where the scripts execute. If the first argument was not supplied, then the script searched for a writeable directory [T1074.001] to use as its directory. The script searched the directories listed in Table 1 until it found a writeable one. The script stored the second command-line argument in a variable saved to the targeted system.

Table 1. Directories Searched by Curlc4 

Directory to Search 

Subdirectories to Skip 

/ 

/bin, /boot, /dev, /etc, /run, /proc, /sys, /var, /tmp, /usr 

/home 

 

/var/www 

 

/usr 

 

/var/tmp 

 

The following is a list of unique strings found in the script:

  • $dir/storage/fm/.run; 
  • $dir/.run; 
  • public $password='jh4jnryw76ikmh'; 
  • public $file='/var/tmp/.sess.zip';
  • https://upl.natcloudservice[.]com.ews; 
  • public $key='rhnr5m54pk65wertc'; 
  • $this->enc="r";this->cipher="rc4";this->iv=""; 
  • $this->enc="a";this->cipher="aes-128-cbc";this->iv="1111111111111111"; 
  • https://natcloudservice[.]com/ews; and 
  • curl_setopt($this->ch, CURLOPT_HTTPHEADER,array("X-Id: $clientid")). 

Other directories and files that indicate this script may be executed on a system include: 

  • RUNNING_DIRECTORY/storage/fm; 
  • RUNNING_DIRECTORY /storage/fm.run (file); 
  • RUNNING_DIRECTORY /.run; 
  • RUNNING_DIRECTORY/clientid (file); and 
  • RUNNING_DIRECTORY/cp (file). 

DC.exe

The threat actors used DC.exe to execute the DCSync replication technique [T1003.006] to copy sensitive information from the Active Directory (AD), including account credentials, group membership details, and trust relationships. DC.exe used a Remote Procedure Call (RPC) binding to the victim’s domain controller. The file then used the Directory Replication Service to retrieve data from the victim’s AD. Specifically, it retrieved a handle to the local security policy object, which is used to query the domain controller for the DNS domain name, domain security identifier (SID), and domain replication epoch. The file also used the following object IDs to retrieve information about Active Directory attributes and configurations: 

  • 1.2.840.113556.1.2.48; 
  • 1.2.840.113556.1.4.1; 
  • 1.2.840.113556.1.4.125; 
  • 1.2.840.113556.1.4.129; 
  • 1.2.840.113556.1.4.133; 
  • 1.2.840.113556.1.4.135; 
  • 1.2.840.113556.1.4.146; 
  • 1.2.840.113556.1.4.159; 
  • 1.2.840.113556.1.4.160; 
  • 1.2.840.113556.1.4.221; 
  • 1.2.840.113556.1.4.27; 
  • 1.2.840.113556.1.4.302; 
  • 1.2.840.113556.1.4.55; 
  • 1.2.840.113556.1.4.609; 
  • 1.2.840.113556.1.4.656; 
  • 1.2.840.113556.1.4.8; 
  • 1.2.840.113556.1.4.90; 
  • 1.2.840.113556.1.4.94; and 
  • 1.2.840.113556.1.4.96. 

Data Exfiltration 

The FBI recovered an archived email database the threat actors used to target email accounts of victim organizations. The threat actors collect account credentials and exfiltrate victim email data from on-premise systems and cloud-based services. Observed victims of email data theft included government organizations, law enforcement agencies, healthcare systems, and religious institutions located in Southeast Asia. In some instances, the threat actors restricted access to the exfiltrated data to only IP addresses from Xiamen, China. 

Office-cli Program

The threat actors use a command-line utility office-cli [T1059.004] to continuously target and access Microsoft Outlook 365 email accounts to exfiltrate emails across different time periods. The threat actors occasionally update these accounts and swap them for the most recent accounts. The threat actors use office-cli to automate access and exfiltration of mail content using configuration files, such as client_id, tenant_id, and secret.

The FBI observed the threat actors executing office-cli from the command line or by running it from a Bash script. In both instances, the threat actors place the JSON files required to access the mailboxes in the config directory. Additionally, office-cli saves data gathered from the victims in a subdirectory of the dump directory. The threat actors evade detection when using this program by using legitimate access methods.

The threat actors maintain a custom web application that provides third-party access to stolen email content. Users of this application can pass specific arguments in URLs to see email content for specific accounts.

Indicators of Compromise

See Appendix A: Indicators of Compromise for a list of all observed indicators.

MITRE ATT&CK Tactics and Techniques

See Table 2 to Table 9 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 2. Reconnaissance 

Technique Title 

ID 

Use 

Active Scanning: Vulnerability Scanning 

The threat actors leverage several scanning tools to find vulnerabilities in networks and web-based applications. 
Table 3. Initial Access 

Technique Title 

ID 

Use 

Drive-by Compromise 

T1189 

The threat actors execute XSS attacks to leverage an unwitting third-party application to modify content on a webpage. 
Table 4. Execution 

Technique Title 

ID 

Use 

Command and Scripting Interpreter: PowerShell 

The threat actors typically download SoftEther installers onto victim devices from threat actor controlled infrastructure using PowerShell. 

Command and Scripting Interpreter: Unix Shell 

The threat actors use office-cli, a Linux-based binary, to continuously target and access Microsoft Outlook 365 accounts. Office-cli automates exfiltration of mail content using configuration files, including account credentials. 

Command and Scripting Interpreter: Python 

The threat actors gain access to victim networks and cloud-based services primary through command-line utility tools based on exploit codes written in Python. 

Command and Scripting Interpreter: JavaScript 

The threat actors use JavaScript to execute XSS attacks. 
Table 5. Persistence 

Technique Title  

ID 

Use 

External Remote Services 

T1133 

The threat actors install VPN software clients on victim devices to establish persistence and obfuscate C2 communications. 
Table 6. Defense Evasion 

Technique Title  

ID 

Use 

Masquerading: Rename Legitimate Utilities 

The threat actors run executables with the same name of a known, legitimate Windows software and installers to evade detection. 
Table 7. Credential Access 

Technique Title  

ID 

Use 

OS Credential Dumping: DCSync 

The threat actors use DC.exe to execute the DCSync replication technique to copy sensitive information from the Active Directory. 

Brute Force: Password Guessing 

The threat actors use eburst.py to conduct password guessing to compromise email accounts on Microsoft Exchange servers. 

Brute Force: Password Spraying 

The threat actors use eburst.py to conduct password spraying to compromise email accounts on Microsoft Exchange servers. 
Table 8. Collection 

Technique Title  

ID 

Use 

Email Collection: Remote Email 

The threat actors use the PHP script to interface with the Microsoft EWS API, enabling them to access email and content items. 

Archive Collection Data: Archive via Custom Method 

The threat actors use a custom bot to compress, and in some cases encrypt, files prior to exfiltration. 

Data Staged: Local Data Staging 

The PHP script searches for a writeable directory to use as its directory. 

Table 9. Exfiltration 

Technique Title  

ID 

Use 

Automated Exfiltration 

T1020 

The threat actors leverage the PHP script to automatically upload emails to a remote server. 

Incident Response

If a potential compromise is detected, organizations should take the following actions: 

  1. Determine which hosts were compromised and isolate them by quarantining or taking them offline.  
  2. Initiate threat hunting activities to scope the intrusion.  
    1. Collect and review relevant artifacts, logs, and other data to identify threat actor TTPs, compromised devices and accounts, a timeline of activity, etc.  
  3. Follow national guidelines and requirements in your country on reporting cyber incidents (see Contact Information). 
  4. Apply eviction countermeasures to contain the incident and eradicate the threat actor from the network.
    1. Start applying countermeasures after collecting enough threat hunting data to inform effective countermeasure selection; this will likely overlap with threat hunting activities): 
    2. Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan—the tool comprises Playbook-NG (a web application) and COUN7ER (a database of post-compromise countermeasures mapped to adversary TTPs).  
      1. Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors.  
      2. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool Fact Sheet. 
  5. Harden the network to prevent additional malicious activity (see Mitigations for guidance). 

Mitigations

The authoring organizations recommend network defenders and organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections. 

The authoring organizations recommend network defenders and organizations implement these mitigations:

  • Disable unused services and ports, such as automatic configuration, remote access, or file sharing protocols. 
    • Configure applications to reveal as little information as possible when serving login pages or banner information in response to external requests. 
    • Consider using an attack surface management service or web-based search platforms that search the internet to identify exposed services or ports [CPG 3.S]. For additional support, follow CISA’s Internet Exposure Reduction Guidance and NSA’s Attack Surface Management. 
  • Sanitize user input in web applications to prevent possible XSS payload injection. 
  • Implement identity, credential, and access management (ICAM) policies across the organization and then require multifactor authentication (MFA) [CPG 3.F] for all services (to the extent possible), particularly for webmail, VPNs, and accounts that access critical systems. 
  • Replace default passwords with strong passwords [CPG 3.A]. 
    • Limit and audit user accounts with administrative privileges and configure access controls with least privilege in mind.  
    • Ensure only users that need administrator privileges are granted these privileges, and regularly review access to assess whether it is still required [CPG 3.G]. 
  • Enable download and domain reputation screening in web browsers, along with protective DNS resolution, to block downloads of known malware and connections to websites and domains with unsafe reputations. 
  • Monitor for signs of unauthorized use of LOTL tools and unexpected Active Directory replication [CPG 4.B]. 
  • Implement network segmentation to ensure a compromised device has no access to sensitive resources of another organizational unit [CPG 3.I]. 
    • Use the principle of least privilege to provide just enough connectivity for devices to perform their intended functions [CPG 3.H]. 
    • For a less resource constrictive mitigation, organizations may segment edge devices internally. 
  • Monitor cloud accounts for connected applications that can access sensitive data in file systems and email data. 
  • Review web application access logs for signs of exploitation attempts, such as malicious directory traversal attempts, command injection attempts, or enumeration attempts [CPG 3.Q]. 
  • Apply patches and updates, including software and firmware updates (regular patching mitigates many high-risk security vulnerabilities) [CPG 2.B]. 
    • If available, use automatic update channels from trusted network locations. 
    • Do not trust email messages claiming to provide software updates as attachments or via links to untrusted websites. 
  • Install and regularly update antivirus software on all hosts and enable real time detection. 
  • Monitor for abnormal and high volumes of unexpected traffic (scanning) using firewalls and/or intrusion detection systems [CPG 4.B]. 
    • Since an attempted compromise using a distributed denial of service (DDoS) technique may appear as normal traffic, it is critical for organizations to define, monitor, and prepare for abnormal traffic volumes. 
  • Monitor for high volumes of outbound or upload traffic from workstations or other devices that usually have low volumes of uploads compared to downloads. 
  • Monitor logs and investigate unusual IP addresses and ports in command lines, registry entries, and firewall logs to identify other hosts that are potentially involved in actor actions [CPG 3.Q]. 
    • Review perimeter firewall configurations for unauthorized changes and/or entries that may permit external connections to internal hosts. 
  • Monitor for abnormal account activity, such as logons outside of normal working hours and impossible time and distance logons (e.g., a user logging on from two geographically separated locations at the same time) [CPG 4.B]. 
  • Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, or the cloud) [CPG 1.C]. 
  • Regularly back up data and password protect backup copies offline [CPG 3.O]. 
    • Ensure copies of critical data are not accessible for modification or deletion from the system where data resides. 
  • Replace end-of-life products with supported alternatives that are included in vendor support plans. 
  • Ensure systems use the strongest feasible form of authentication [CPG 3.B; CPG 3.F]. 
  • Harden authentication protocols and access lists [CPG 3.H]. 
    • Regularly rotate keys for your service accounts, use strong key lengths to enhance security and minimize the risk of key compromise, and implement role-based access control (RBAC) to avoid granting excess privileges. 
  • Provide cyber security awareness and training [CPG 3.J]. 
    • Regularly train users on information security principles and techniques, as well as overall emerging cybersecurity risks and vulnerabilities (e.g., ransomware and phishing scams). 
  • Regularly engage reputable and skilled penetration testing services to evaluate your public attack surface and remediate the most commonly exploited vulnerabilities used by these actors. 

Validate Security Controls 

In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory. 

To get started: 

  1. Select an ATT&CK technique described in this advisory (see Table 2 to Table 9). 
  2. Align your security technologies against the technique. 
  3. Test your technologies against the technique. 
  4. Analyze your detection and prevention technologies’ performance. 
  5. Repeat the process for all security technologies to obtain a set of comprehensive performance data. 
  6. Tune your security program, including people, processes, and technologies, based on the data generated by this process. 

The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Resources 

Contact Information  

US organizations are encouraged to report suspicious or criminal activity related to information in this advisory to the FBI, CISA, and/or NSA: 

  • File a claim with FBI’s Internet Crime Complaint Center (IC3) or contact your local FBI field office, or contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). When available, please include the following information regarding the incident: 
    • Date, time, and location of the incident; 
    • Type of activity; 
    • Number of people affected; 
    • Type of equipment used for the activity; and 
    • Name of the submitting company or organization, and a designated point of contact. 
  • For NSA cybersecurity guidance inquiries, contact CybersecurityReports@nsa.gov. 

United Kingdom organizations: Report a significant cyber security incident at ncsc.gov.uk/report-an-incident (monitored 24 hours) or, for urgent assistance, call 03000 200 973. 

Australian organizations: Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.

Canadian organizations: Report incidents by emailing the Canadian Centre for Cyber Security (Cyber Centre) at contact@cyber.gc.ca, (613) 949-7048, or 1-833-CYBER-88. 

Japan organizations: Report an incident to the National Cybersecurity Office (NCO) via email at first-team@cyber.go.jp or the National Police Agency’s (NPAs) web portal at https://www.npa.go.jp/bureau/cyber/soudan.html. 

New Zealand organizations: Visit ncsc.govt.nz or call 0800 114 115 to report cyber security incidents. 

Disclaimer 

The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the authoring organizations. 

Version History 

October 8, 2026: Initial version. 

Appendix A: Indicators of Compromise

See Table 10 to Table 15 for a list of observed IOCs. The IOCs listed in the appendices may or may not be addressed in detail in the body of this document; however, endpoint detection systems can ingest all of these IOCs to help mitigate threat activity. 

Disclaimer: Several of the observed IOCs date back to as early as 2016. The authoring organizations recommend investigating or vetting these IOCs prior to taking action, such as blocking. 

Note: The first and last dates are included in this table, with an asterisk (*) denoting the WHOIS registry expiration date specified within. 

Table 10. Domain Names 

Domain 

First Seen 

Last Seen 

_msdcs.cktime.ooguy[.]com 

12/26/2023 

7/30/2024 

067[.]cz 

12/6/2018 

1/16/2021 

1421.client.96html[.]com 

1/18/2019 

1/18/2027* 

1421.cloud.96html[.]com 

1/18/2019 

1/18/2027* 

1421.support.96html[.]com 

1/18/2019 

1/18/2027* 

154-119-131-252-103-58-216-162-36.m.secshow[.]net 

6/26/2023 

6/26/2026* 

20656.hus1.ptps[.]tk 

12/5/2019 

7/24/2021 

20656.hus3.ptps[.]tk 

12/5/2019 

7/24/2021 

2-12-44-140-78-81-211-109-241.h.secshow[.]net 

6/26/2023 

6/26/2026* 

22852.careers.96html[.]com 

1/18/2019 

1/18/2027* 

22852.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

22852.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

23175.careers.96html[.]com 

1/18/2019 

1/18/2027* 

23175.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

24280.hus1.ptps[.]tk 

12/5/2019 

7/24/2021 

2637596418.softether[.]net 

9/22/2023 

6/22/2024 

28394.careers.96html[.]com 

1/18/2019 

1/18/2027* 

28394.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

28394.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

28733.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

28733.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

30773.hus2.ptps[.]tk 

12/5/2019 

7/24/2021 

30773.hus3.ptps[.]tk 

12/5/2019 

7/24/2021 

35584.careers.96html[.]com 

1/18/2019 

1/18/2027* 

35584.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

35584.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

39583.b.alitagotest[.]cf 

1/27/2020 

12/7/2021 

3w.feeee[.]io 

2/8/2024 

2/8/2025 

44673.careers.96html[.]com 

1/18/2019 

1/18/2027* 

44673.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

47298.96html[.]com 

1/18/2019 

1/18/2027* 

47298.client.96html[.]com 

1/18/2019 

1/18/2027* 

47298.cloud.96html[.]com 

1/18/2019 

1/18/2027* 

47298.support.96html[.]com 

1/18/2019 

1/18/2027* 

50669.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

51640.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

51943.hus1.ptps[.]tk 

12/5/2019 

7/24/2021 

51943.hus3.ptps[.]tk 

12/5/2019 

7/24/2021 

54-2-32-236-208-2-40-107-38.h.secshow[.]net 

6/26/2023 

6/26/2026* 

60928.hus1.ptps[.]tk 

12/5/2019 

7/24/2021 

66-37-178-96-110-2-40-107-38.h.secshow[.]net 

6/26/2023 

6/26/2026* 

74788.careers.96html[.]com 

1/18/2019 

1/18/2027* 

74788.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

77692.careers.96html[.]com 

1/18/2019 

1/18/2027* 

77692.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

77692.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

82262.careers.96html[.]com 

1/18/2019 

1/18/2027* 

82262.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

85005.careers.96html[.]com 

1/18/2019 

1/18/2027* 

85005.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

85005.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

88783.hus1.ptps[.]tk 

12/5/2019 

7/24/2021 

90174.careers.96html[.]com 

1/18/2019 

1/18/2027* 

90174.careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

96976.careers.96html[.]com 

1/18/2019 

1/18/2027* 

96976.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

96cee[.]com 

1/7/2016 

5/9/2024 

96html[.]com 

1/18/2019 

9/3/2024 

98aiblog[.]com 

3/11/2024 

3/12/2026* 

a.alitagotest[.]cf 

1/27/2020 

12/7/2021 

a.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

admin.dellme[.]ml 

3/20/2020 

8/8/2020 

alitagotest[.]cf 

1/27/2020 

12/7/2021 

arforcex[.]com 

3/5/2019 

5/11/2021 

asean.twimg.co[.]uk 

9/21/2024 

12/15/2024 

az.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

b.alitagotest[.]cf 

1/27/2020 

12/7/2021 

bailbonding[.]info 

1/3/2020 

1/3/2022 

bbs.sunmoon[.]website 

9/20/2023 

9/20/2024 

bj-hk.hmbcloud[.]net 

3/29/2021 

3/29/2021 

bj-jp.hmbcloud[.]net 

4/10/2021 

5/7/2021 

blog.98aiblog[.]com 

7/12/2024 

8/14/2024 

bsnl.twimg.co[.]uk 

6/17/2024 

7/7/2024 

careers.96html[.]com 

1/18/2019 

1/18/2027* 

careers.trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

cch.ooguy[.]com 

10/11/2024 

10/11/2024 

check.96html[.]com 

1/18/2019 

1/18/2027* 

checkapi[.]tk 

1/6/2022 

4/10/2023 

checkinfo[.]tk 

9/22/2012 

12/14/2022 

chr0mail[.]com 

6/23/2021 

6/23/2026* 

cktime.ooguy[.]com 

12/26/2023 

7/30/2024 

client.96html[.]com 

1/18/2019 

1/18/2027* 

cloud.96html[.]com 

1/18/2019 

1/18/2027* 

csrfproxy.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

dasxcyb[.]ga 

1/29/2021 

1/29/2021 

dc-29465b27aa45.96html[.]com 

1/18/2019 

1/18/2027* 

dc-4fe9871cb224.96html[.]com 

1/18/2019 

1/18/2027* 

dc-582fc0f46da9.96html[.]com 

1/18/2019 

1/18/2027* 

dc-843d98722400.96html[.]com 

1/18/2019 

1/18/2027* 

dc-bb503834b7dc.96html[.]com 

1/18/2019 

1/18/2027* 

dc-c11a983d7f83.96html[.]com 

1/18/2019 

1/18/2027* 

dellme[.]ml 

3/20/2020 

8/8/2020 

dns.studiocloud[.]xyz 

12/10/2021 

5/9/2024 

dns361[.]tk 

2/7/2022 

11/19/2023 

dsdsei[.]com 

4/10/2018 

4/10/2025 

eck.giize[.]com 

9/28/2024 

9/30/2024 

eg.twimg.co[.]uk 

9/22/2024 

12/14/2024 

etechhosting.twimg.co[.]uk 

9/21/2024 

12/16/2024 

fcchk.twimg.co[.]uk 

9/21/2024 

12/14/2024 

feeee[.]io 

2/8/2024 

2/8/2025 

findfindx[.]com  

1/6/2022 

8/10/2023 

fukua[.]org 

11/24/2017 

11/24/2027* 

gate.sinica.edu.tw.checkapi[.]cf 

1/6/2022 

4/10/2023 

googles.ddns[.]net 

10/22/2021 

10/22/2021 

gz-hk.hmbcloud[.]net 

12/28/2020 

1/22/2021 

h.secshow[.]net 

6/26/2023 

6/26/2026* 

h5.feeee[.]io 

2/8/2024 

2/8/2025 

halloween.checkapi[.]cf 

1/6/2022 

4/10/2023 

helpuself.ptps[.]tk 

12/5/2019 

7/24/2021 

hgiga.96html[.]com 

1/18/2019 

1/18/2027* 

honey1314520[.]com 

11/23/2020 

11/23/2022 

hook.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

hus1.ptps[.]tk 

12/5/2019 

7/24/2021 

hus3.ptps[.]tk 

12/5/2019 

7/24/2021 

hw1.ptps[.]tk 

12/5/2019 

7/24/2021 

ica.96html[.]com 

1/18/2019 

1/18/2027* 

im.arforcex[.]com 

3/4/2019 

3/5/2026* 

imap.sunmoon[.]website 

9/20/2023 

9/20/2024 

info.96html[.]com 

1/18/2019 

1/18/2027* 

integritytoch[.]com 

12/11/2020 

12/11/2022 

iplc-hk.hmbcloud[.]com 

11/30/2020 

12/8/2020 

javacheck.ooguy[.]com 

12/22/2023 

6/25/2024 

javaupdate.giize[.]com 

12/22/2023 

6/15/2024 

just.checkapi[.]cf 

1/6/2022 

4/10/2023 

kk.dasxcyb[.]ga 

1/29/2021 

1/29/2021 

leicc009[.]ga 

5/24/2020 

4/24/2021 

live.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

ls.twimg.co[.]uk 

9/21/2024 

12/14/2024 

m.secshow[.]net 

6/26/2023 

6/26/2026* 

ma.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

mail.bailbonding[.]info 

1/3/2020 

1/3/2022 

mail.sunmoon[.]website 

9/20/2023 

9/20/2024 

masaplus[.]club 

7/22/2021 

7/22/2024 

microscan[.]me 

12/10/2017 

12/10/2018 

mitt.96html[.]com 

1/18/2019 

1/18/2027* 

ms.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

msedge[.]store 

11/9/2023 

11/9/2025 

mx.sunmoon[.]website 

9/20/2023 

9/20/2024 

natcloudservice[.]com 

9/8/2023 

9/8/2024 

nikoes[.]gq 

6/15/2021 

3/22/2023 

np.twimg.co[.]uk 

9/21/2024 

11/25/2024 

ns1.alitagotest[.]cf 

1/27/2020 

12/7/2021 

ns1.honey1314520[.]com 

11/23/2020 

11/23/2022 

ns1.nikoes[.]gq 

6/15/2021 

3/22/2023 

ns2.nikoes[.]gq 

6/15/2021 

3/22/2023 

one.hmbiplc-01[.]com 

4/2/2022 

4/2/2022 

payment.feeee[.]io 

2/8/2024 

2/8/2025 

pdc._msdcs.cktime.ooguy[.]com 

12/26/2023 

7/30/2024 

ptps[.]tk 

12/5/2019 

7/24/2021 

puc.checkapi[.]tk 

1/6/2022 

4/10/2023 

purple76[.]com 

11/11/2021 

11/11/2026* 

pw.sexytube0[.]com 

8/6/2021 

4/18/2024 

pw2.sexytube0[.]com 

10/7/2017 

10/8/2027* 

random.cktime.ooguy[.]com 

12/26/2023 

7/30/2024 

s3crts.softether[.]net 

3/25/2021 

7/27/2022 

scallpay[.]com 

7/3/2023 

7/3/2024 

search.96html[.]com 

1/18/2019 

1/18/2027* 

secretr.feeee[.]io 

2/8/2024 

2/8/2025 

secshow[.]net 

6/26/2023 

6/26/2026* 

senate.twimg.co[.]uk 

9/21/2024 

12/14/2024 

server.feeee[.]io 

2/8/2024 

2/8/2025 

sexytube0[.]com 

10/7/2017 

10/8/2027* 

shifuj[.]com 

6/3/2019 

6/5/2019 

sh-jp.hmbcloud[.]net 

4/10/2021 

4/25/2021 

shop.96html[.]com 

1/18/2019 

1/18/2027* 

shopify.feeee[.]io 

2/8/2024 

2/8/2025 

smtp.sunmoon[.]website 

9/20/2023 

9/20/2024 

streescans[.]com 

5/10/2022 

3/4/2025 

studiocloud[.]xyz 

12/10/2021 

5/9/2024 

sunmoon[.]website 

9/20/2023 

9/20/2024 

supper.feeee[.]io 

2/8/2024 

2/8/2025 

support.96html[.]com 

1/18/2019 

1/18/2027* 

szxcm-hkg01.iepl.node[.]cm 

12/7/2020 

1/8/2021 

t.checkinfo[.]tk 

9/22/2012 

12/14/2022 

teyan.microscan[.]me 

12/10/2017 

12/10/2018 

tj.twimg.co[.]uk 

9/21/2024 

12/14/2024 

traffic.96html[.]com 

1/18/2019 

1/18/2027* 

trendmicro.96html[.]com 

1/18/2019 

1/18/2027* 

trust[.]feeee 

2/8/2024 

2/8/2025 

tsedws[.]com 

6/1/2020 

6/1/2026* 

txt.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

update.96html[.]com 

1/18/2019 

1/18/2027* 

upgrate.checkapi[.]cf 

1/6/2022 

4/10/2023 

upl.natcloudservice[.]com 

9/8/2023 

9/8/2024 

v3.streescans[.]com 

5/10/2022 

3/4/2025 

vnpt.sexytube0[.]com 

10/7/2017 

10/8/2027* 

vpn21.arforcex[.]com 

3/4/2019 

3/5/2026* 

vpn328433596.softether[.]net  

3/28/2023 

10/17/2024 

vpn614174689.softether[.]net 

9/2/2023 

9/2/2023 

vpn677190427.softether[.]net 

4/17/2024 

4/30/2024 

vpn718535264.softether[.]net 

3/11/2022 

3/11/2022 

vpn823494147.softether[.]net 

6/26/2023 

6/26/2023 

wanfang.accesscam[.]org 

9/18/2024 

9/26/2024 

webdisk.bailbonding[.]info 

1/3/2020 

1/3/2022 

webmail.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

well.96html[.]com 

1/18/2019 

1/18/2027* 

ws.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

wss.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

www.96html[.]com 

1/18/2019 

1/18/2027* 

www.alitagotest[.]cf 

1/27/2020 

12/7/2021 

www.chr0mail[.]com 

6/23/2021 

6/23/2026* 

www.cktime.ooguy[.]com 

12/26/2023 

7/30/2024 

www.dns361[.]tk 

2/7/2022 

11/19/2023 

www.feeee[.]io 

2/8/2024 

2/8/2025 

www.javacheck.ooguy[.]com 

6/17/2024 

7/25/2024 

www.leicc009[.]ga 

5/24/2020 

4/24/2021 

www.msedge[.]store 

11/9/2023 

11/9/2025 

www.mx.sunmoon[.]website 

9/20/2023 

9/20/2024 

www.purple76[.]com 

11/11/2021 

11/11/2026* 

www.smtp.sunmoon[.]website 

9/20/2023 

9/20/2024 

www.sofeter[.]ml 

3/13/2023 

3/13/2023 

www.studiocloud[.]xyz 

12/31/2021 

12/3/2024 

www.sunmoon[.]website 

9/20/2023 

9/20/2024 

www.www.smtp.sunmoon[.]website 

9/20/2023 

9/20/2024 

www.www.sunmoon[.]website 

9/20/2023 

9/20/2024 

xassxxdns.alitagotest[.]cf 

1/27/2020 

12/7/2021 

ximmd.sexytube0[.]com 

7/14/2020 

10/31/2020 

zerogravity1986.softether[.]net 

12/9/2023 

12/9/2023 
 
Table 11. IP Addresses 

IP Address 

First Seen 

Last Seen 

1.34.140[.]5 

3/15/2023 

3/20/2023 

2.58.242[.]74 

12/2/2024 

12/2/2024 

5.188.34[.]134 

8/30/2024 

9/12/2024 

5.188.230[.]69 

8/7/2023 

4/19/2024 

8.219.119[.]5 

9/12/2024 

9/12/2024 

14.1.98[.]160 

3/22/2024 

4/28/2024 

14.128.33[.]8 

12/4/2023 

1/9/2024 

14.1.98[.]223 

6/20/2023 

10/9/2023 

27.154.215[.]126 

7/11/2023 

7/11/2023 

27.154.105[.]36 

2/3/2024 

2/3/2024 

27.149.115[.]78 

3/22/2023 

3/22/2023 

27.149.79[.]35 

3/23/2023 

3/23/2023 

31.232.221[.]35 

5/14/2024 

5/17/2024 

36.112.10[.]102 

9/4/2023 

9/12/2024 

36.112.188[.]119 

8/13/2023 

8/13/2023 

36.112.186[.]135 

8/14/2023 

8/14/2023 

36.112.206[.]121 

8/12/2023 

8/13/2023 

36.249.156[.]117 

11/29/2023 

11/29/2023 

36.249.156[.]122 

11/15/2023 

11/18/2023 

36.249.156[.]159 

5/31/2023 

6/5/2023 

36.249.156[.]178 

5/22/2023 

12/6/2023 

36.249.156[.]205 

11/13/2023 

11/13/2023 

36.249.156[.]206 

11/23/2023 

11/24/2023 

36.249.156[.]220 

6/7/2022 

6/7/2022 

36.249.156[.]226 

5/8/2023 

5/13/2023 

36.112.200[.]35 

8/9/2023 

8/10/2023 

36.249.156[.]51 

11/20/2023 

11/22/2023 

36.112.198[.]68 

8/13/2023 

8/13/2023 

36.249.156[.]69 

5/31/2023 

5/31/2023 

36.112.10[.]99 

9/19/2024 

9/19/2024 

39.72.220[.]221 

3/20/2023 

3/20/2023 

42.73.98[.]232 

5/13/2024 

5/13/2024 

45.123.189[.]19 

11/16/2021 

2/14/2022 

45.32.140[.]182 

1/8/2021 

1/8/2021 

45.32.232[.]146 

12/18/2020 

12/25/2020 

45.63.123[.]142 

6/4/2021 

7/25/2024 

45.63.116[.]190 

11/20/2019 

11/20/2019 

45.131.69[.]197 

3/31/2023 

3/31/2023 

45.76.169[.]12 

5/11/2020 

5/13/2020 

45.77.195[.]169 

6/12/2020 

6/16/2020 

45.32.61[.]246 

11/11/2024 

12/16/2024 

45.77.231[.]209 

1/25/2024 

6/5/2024 

45.76.37[.]168 

12/20/2019 

12/20/2019 

45.63.59[.]121 

3/19/2020 

3/19/2020 

45.77.11[.]47 

9/29/2020 

9/29/2020 

45.32.84[.]223 

4/23/2020 

5/9/2020 

45.63.62[.]217 

10/28/2020 

11/4/2020 

45.63.48[.]36 

1/10/2020 

1/10/2020 

45.76.43[.]37 

2/17/2020 

2/27/2020 

45.76.66[.]19 

4/16/2024 

5/6/2024 

45.76.243[.]67 

7/1/2020 

7/9/2020 

45.63.17[.]9 

5/9/2024 

6/19/2024 

45.77.28[.]77 

12/5/2021 

4/3/2023 

45.76.194[.]89 

11/22/2021 

9/25/2023 

45.76.37[.]85 

2/10/2020 

2/10/2020 

45.63.95[.]62 

4/10/2020 

4/13/2020 

45.63.94[.]71 

9/30/2019 

12/16/2024 

45.77.86[.]70 

12/21/2019 

12/23/2019 

49.93.136[.]14 

3/25/2024 

3/25/2024 

49.93.184[.]194 

3/25/2024 

3/25/2024 

59.120.144[.]153 

5/24/2023 

5/25/2023 

59.124.120[.]178 

2/20/2023 

9/27/2023 

59.120.167[.]25 

1/15/2024 

1/15/2024 

59.125.128[.]54 

3/30/2023 

10/7/2023 

59.120.58[.]176 

3/8/2022 

3/8/2022 

60.250.199[.]112 

11/15/2022 

12/1/2022 

60.250.146[.]19 

11/17/2022 

12/18/2023 

60.251.155[.]19 

1/4/2023 

9/23/2023 

60.248.152[.]204 

5/11/2023 

5/16/2023 

59.120.82[.]67 

11/22/2023 

1/8/2024 

60.184.242[.]224 

3/23/2023 

3/23/2023 

60.251.205[.]37 

12/20/2021 

12/23/2021 

60.220.43[.]193 

10/3/2023 

10/3/2023 

60.251.58[.]145 

6/8/2023 

1/22/2024 

60.248.1[.]64 

12/8/2022 

4/23/2023 

60.251.201[.]8 

5/16/2023 

3/5/2024 

60.248.88[.]151 

6/8/2023 

2/26/2024 

60.248.110[.]97 

3/31/2023 

1/4/2024 

60.249.239[.]86 

9/18/2021 

1/5/2022 

61.220.112[.]137 

5/25/2023 

5/26/2023 

60.220.84[.]41 

2/9/2024 

2/9/2024 

61.247.165[.]27 

4/8/2022 

4/11/2022 

60.220.84[.]63 

10/1/2023 

10/1/2023 

61.220.35[.]15 

5/24/2023 

9/7/2023 

61.221.55[.]4 

5/24/2024 

11/13/2024 

61.222.245[.]73 

4/11/2023 

7/25/2023 

61.219.118[.]99 

12/1/2022 

11/23/2023 

61.216.74[.]97 

1/29/2024 

1/29/2024 

64.176.38[.]35 

8/30/2024 

12/16/2024 

65.20.97[.]251 

1/25/2024 

6/5/2024 

66.42.103[.]188 

11/26/2019 

11/26/2019 

66.42.42[.]109 

7/11/2024 

8/20/2024 

66.42.40[.]189 

9/4/2024 

12/16/2024 

66.42.36[.]236 

2/28/2024 

7/25/2024 

66.42.60[.]242 

2/23/2024 

12/16/2024 

66.42.77[.]138 

2/9/2022 

6/19/2024 

77.111.226[.]5 

4/19/2023 

4/19/2023 

78.141.221[.]241 

2/29/2020 

3/10/2020 

78.141.238[.]97 

1/25/2024 

6/5/2024 

84.17.57[.]40 

4/4/2023 

4/4/2023 

89.187.163[.]216 

9/19/2024 

9/19/2024 

95.179.189[.]106 

6/4/2020 

6/4/2020 

95.179.235[.]135 

1/27/2021 

1/27/2021 

95.179.186[.]251 

2/2/2021 

2/2/2021 

98.159.37[.]4 

7/4/2024 

7/4/2024 

103.107.198[.]117 

9/26/2023 

9/26/2023 

103.16.231[.]220 

3/7/2022 

7/4/2024 

103.16.231[.]254 

11/9/2022 

2/10/2023 

103.233.253[.]197 

3/19/2023 

9/6/2023 

103.25.254[.]210 

10/28/2019 

11/26/2019 

103.149.200[.]44 

4/25/2023 

10/11/2023 

103.179.45[.]203 

9/23/2024 

12/16/2024 

103.73.160[.]232 

3/17/2023 

3/17/2023 

103.77.211[.]193 

5/8/2024 

5/8/2024 

103.106.230[.]88 

6/25/2024 

6/25/2024 

103.172.80[.]35 

11/26/2022 

11/30/2022 

104.238.149[.]146 

3/6/2020 

7/8/2024 

104.238.182[.]153 

6/24/2020 

7/1/2020 

104.238.152[.]209 

2/24/2022 

4/2/2022 

103.51.145[.]98 

4/26/2023 

5/28/2023 

103.73.162[.]99 

3/17/2023 

11/20/2023 

104.156.231[.]98 

5/29/2020 

6/2/2020 

106.53.181[.]231 

5/31/2024 

5/31/2024 

106.122.171[.]92 

1/31/2024 

1/31/2024 

108.61.181[.]104 

7/11/2024 

12/12/2024 

108.61.177[.]81 

1/25/2024 

6/5/2024 

110.42.10[.]148 

4/10/2021 

5/5/2021 

110.85.170[.]125 

2/10/2020 

2/10/2020 

111.203.153[.]245 

11/5/2023 

11/5/2023 

110.74.172[.]80 

10/29/2021 

2/17/2022 

111.55.138[.]141 

7/4/2024 

7/4/2024 

111.55.137[.]40 

7/5/2024 

7/5/2024 

111.203.153[.]95 

11/5/2023 

11/5/2023 

112.5.168[.]102 

2/21/2022 

2/21/2022 

112.5.168[.]104 

3/29/2021 

3/29/2021 

112.5.145[.]154 

6/29/2023 

6/29/2023 

112.5.143[.]161 

6/27/2023 

6/27/2023 

112.5.168[.]138 

4/24/2022 

4/24/2022 

112.5.168[.]151 

7/20/2023 

8/4/2023 

112.5.168[.]160 

10/31/2023 

11/9/2023 

112.54.132[.]162 

7/3/2023 

7/5/2023 

112.5.168[.]187 

8/27/2021 

8/27/2021 

112.5.168[.]218 

8/31/2023 

9/1/2023 

112.5.168[.]231 

8/16/2023 

8/17/2023 

112.5.168[.]234 

6/5/2023 

6/16/2023 

112.5.168[.]238 

4/6/2023 

5/18/2023 

112.51.26[.]151 

6/26/2023 

6/29/2023 

112.66.108[.]16 

8/14/2023 

8/14/2023 

112.5.168[.]29 

11/11/2021 

11/11/2021 

112.51.44[.]102 

7/10/2023 

7/18/2023 

112.51.44[.]142 

6/16/2023 

6/16/2023 

112.51.44[.]143 

11/21/2023 

11/21/2023 

112.51.44[.]188 

12/15/2022 

12/20/2022 

112.51.44[.]189 

12/4/2023 

12/4/2023 

112.51.44[.]20 

11/27/2023 

11/29/2023 

112.51.44[.]206 

9/6/2023 

9/22/2023 

112.51.44[.]217 

8/6/2022 

8/6/2022 

112.51.44[.]234 

4/24/2022 

5/5/2022 

112.5.168[.]65 

3/18/2022 

3/21/2022 

112.51.44[.]37 

7/21/2023 

8/2/2023 

112.80.50[.]138 

6/5/2024 

6/5/2024 

112.51.44[.]57 

7/4/2023 

7/5/2023 

112.5.168[.]93 

3/26/2020 

3/26/2020 

113.76.136[.]171 

3/23/2023 

3/23/2023 

114.246.237[.]111 

6/4/2024 

6/4/2024 

114.255.70[.]18 

6/30/2022 

9/1/2023 

114.255.70[.]20 

9/24/2023 

7/16/2024 

114.255.70[.]30 

5/26/2023 

7/14/2023 

114.246.93[.]103 

4/18/2023 

4/18/2023 

114.246.94[.]102 

11/19/2023 

1/11/2024 

114.35.122[.]83 

3/28/2024 

12/13/2024 

114.246.94[.]154 

6/9/2024 

6/10/2024 

114.246.92[.]58 

6/8/2023 

6/8/2023 

114.246.92[.]71 

8/23/2023 

9/11/2023 

117.133.51[.]176 

3/21/2024 

3/21/2024 

117.61.244[.]135 

10/15/2020 

10/15/2020 

117.56.214[.]246 

6/8/2023 

7/4/2023 

117.132.198[.]70 

7/5/2024 

7/5/2024 

117.92.127[.]132 

3/24/2023 

3/24/2023 

117.130.201[.]90 

3/21/2024 

3/21/2024 

118.163.217[.]199 

3/12/2024 

4/17/2024 

118.163.197[.]241 

5/12/2023 

10/16/2023 

118.163.31[.]226 

5/16/2024 

5/28/2024 

118.163.104[.]67 

3/11/2024 

12/6/2024 

118.163.142[.]80 

3/20/2024 

3/22/2024 

118.163.3[.]76 

3/18/2024 

10/29/2024 

119.116.159[.]217 

3/24/2023 

3/24/2023 

119.13.79[.]145 

3/20/2023 

3/21/2023 

120.233.10[.]212 

4/2/2022 

4/2/2022 

120.36.251[.]100 

12/21/2023 

12/21/2023 

120.36.248[.]104 

1/2/2024 

1/2/2024 

120.42.128[.]165 

3/19/2023 

3/19/2023 

120.36.250[.]103 

10/20/2023 

5/31/2024 

120.36.254[.]100 

8/19/2021 

8/19/2021 

120.36.248[.]109 

5/11/2021 

5/11/2021 

120.36.253[.]106 

1/12/2023 

1/12/2023 

120.36.255[.]105 

10/29/2021 

11/1/2021 

120.36.251[.]110 

3/7/2024 

3/7/2024 

120.36.251[.]11 

6/12/2024 

6/13/2024 

120.36.249[.]114 

3/7/2022 

3/10/2022 

120.36.251[.]114 

1/4/2024 

1/8/2024 

120.36.254[.]112 

12/26/2022 

12/26/2022 

120.36.249[.]121 

6/19/2024 

6/19/2024 

120.36.249[.]122 

9/28/2022 

9/28/2022 

120.36.254[.]119 

8/19/2021 

8/19/2021 

120.36.254[.]120 

10/25/2023 

10/27/2023 

120.36.249[.]127 

2/10/2023 

2/14/2023 

120.36.251[.]130 

10/18/2021 

10/21/2021 

120.36.255[.]127 

8/5/2022 

8/6/2022 

120.36.252[.]13 

3/31/2023 

3/31/2023 

120.36.250[.]133 

7/11/2022 

7/14/2022 

120.36.250[.]134 

7/15/2021 

7/15/2021 

120.36.250[.]135 

2/25/2022 

3/3/2022 

120.36.254[.]131 

6/30/2023 

6/30/2023 

120.36.254[.]135 

8/27/2021 

8/27/2021 

120.36.251[.]141 

12/13/2022 

12/13/2022 

120.36.250[.]142 

1/12/2024 

1/12/2024 

120.41.125[.]225 

7/11/2023 

7/11/2023 

120.36.253[.]148 

8/5/2021 

8/11/2021 

120.36.250[.]152 

5/23/2024 

5/24/2024 

120.36.252[.]151 

11/15/2023 

11/15/2023 

120.36.253[.]152 

4/12/2021 

5/19/2023 

120.36.254[.]151 

3/21/2024 

3/22/2024 

120.36.255[.]153 

9/25/2023 

9/26/2023 

120.36.252[.]157 

1/28/2023 

1/28/2023 

120.37.162[.]246 

3/21/2023 

3/21/2023 

120.36.252[.]166 

9/6/2024 

9/6/2024 

120.36.249[.]172 

10/17/2022 

10/21/2022 

120.36.253[.]169 

12/10/2021 

12/10/2021 

120.36.252[.]175 

2/23/2023 

2/23/2023 

120.36.254[.]175 

5/31/2022 

5/31/2022 

120.36.251[.]179 

5/17/2021 

5/24/2021 

120.36.253[.]178 

4/28/2021 

4/29/2021 

120.36.252[.]18 

5/9/2024 

5/9/2024 

120.36.252[.]181 

4/21/2021 

4/27/2021 

120.36.248[.]185 

2/26/2024 

2/26/2024 

120.36.253[.]180 

5/15/2024 

5/17/2024 

120.36.255[.]179 

3/19/2024 

3/20/2024 

120.36.253[.]186 

2/27/2024 

3/4/2024 

120.36.253[.]187 

9/24/2021 

9/24/2021 

120.36.250[.]19 

10/9/2021 

10/9/2021 

120.36.251[.]19 

5/24/2021 

5/24/2021 

120.36.251[.]190 

8/29/2023 

8/31/2023 

120.36.255[.]189 

6/21/2023 

6/27/2023 

120.41.244[.]15 

1/25/2024 

1/25/2024 

120.36.254[.]192 

7/6/2021 

7/7/2021 

120.36.249[.]197 

8/13/2021 

8/16/2021 

120.36.248[.]200 

11/17/2022 

11/17/2022 

120.36.253[.]195 

11/22/2023 

11/24/2023 

120.36.251[.]2 

3/4/2022 

3/4/2022 

120.36.251[.]20 

4/25/2022 

4/25/2022 

120.36.255[.]196 

6/3/2024 

6/3/2024 

120.36.251[.]202 

12/24/2021 

12/24/2021 

120.36.254[.]202 

8/23/2021 

8/25/2021 

120.36.250[.]207 

7/14/2023 

7/19/2023 

120.36.250[.]210 

12/15/2023 

12/15/2023 

120.36.249[.]213 

5/9/2022 

5/13/2022 

120.36.251[.]213 

10/13/2023 

10/16/2023 

120.36.253[.]212 

4/24/2022 

4/24/2022 

120.36.251[.]215 

4/19/2023 

4/19/2023 

120.36.252[.]215 

9/8/2022 

9/8/2022 

120.36.255[.]214 

10/7/2023 

10/7/2023 

120.36.250[.]221 

11/2/2023 

11/2/2023 

120.36.255[.]22 

3/26/2024 

3/28/2024 

120.36.251[.]230 

12/4/2023 

12/4/2023 

120.36.255[.]228 

11/8/2021 

11/11/2021 

120.36.253[.]23 

11/7/2023 

11/7/2023 

120.36.253[.]231 

12/1/2022 

12/1/2022 

120.36.251[.]234 

10/12/2021 

10/12/2021 

120.36.248[.]237 

12/28/2021 

12/28/2021 

120.36.253[.]232 

3/31/2023 

3/31/2023 

120.36.253[.]233 

4/15/2024 

4/20/2024 

120.36.249[.]238 

9/20/2022 

9/22/2022 

120.36.251[.]237 

2/18/2022 

2/24/2022 

120.36.255[.]233 

2/6/2024 

2/6/2024 

120.36.255[.]237 

6/15/2022 

6/21/2022 

120.36.249[.]245 

5/24/2022 

5/25/2022 

120.36.252[.]242 

3/5/2024 

3/6/2024 

120.36.255[.]24 

9/8/2023 

9/8/2023 

120.36.249[.]248 

7/23/2021 

7/23/2021 

120.36.250[.]247 

11/25/2021 

11/30/2021 

120.36.253[.]247 

5/6/2021 

5/6/2021 

120.36.253[.]248 

4/19/2021 

4/20/2021 

120.36.251[.]25 

6/7/2024 

6/11/2024 

120.36.251[.]254 

3/22/2021 

3/28/2021 

120.36.249[.]28 

10/24/2022 

10/28/2022 

120.36.251[.]3 

12/8/2021 

12/8/2021 

120.36.251[.]30 

1/19/2022 

1/21/2022 

120.36.254[.]3 

6/30/2021 

7/5/2021 

120.36.254[.]32 

7/30/2024 

7/30/2024 

120.36.249[.]33 

11/7/2022 

11/7/2022 

120.36.250[.]4 

3/31/2021 

3/31/2021 

120.36.250[.]43 

6/8/2021 

6/8/2021 

120.36.249[.]47 

1/3/2023 

1/3/2023 

120.36.248[.]48 

3/15/2021 

3/18/2021 

120.36.250[.]48 

5/25/2023 

5/25/2023 

120.36.249[.]52 

5/16/2022 

5/20/2022 

120.36.250[.]53 

1/22/2024 

1/22/2024 

120.36.249[.]54 

9/13/2022 

9/15/2022 

120.36.251[.]54 

7/8/2021 

7/9/2021 

120.36.249[.]55 

4/7/2024 

4/7/2024 

120.36.251[.]56 

11/16/2022 

11/17/2022 

120.36.248[.]57 

6/5/2023 

6/5/2023 

120.36.250[.]58 

3/22/2022 

3/25/2022 

120.36.250[.]6 

1/14/2022 

1/19/2022 

120.36.253[.]6 

8/11/2021 

8/12/2021 

120.36.254[.]63 

3/30/2023 

6/11/2024 

120.36.250[.]65 

9/5/2023 

9/6/2023 

120.36.251[.]65 

6/22/2022 

6/23/2022 

120.36.250[.]67 

5/27/2021 

5/27/2021 

120.36.252[.]69 

4/8/2024 

4/12/2024 

120.36.248[.]73 

8/17/2021 

8/17/2021 

120.36.255[.]74 

11/19/2021 

11/25/2021 

120.36.250[.]76 

6/5/2024 

6/6/2024 

120.41.222[.]74 

11/4/2023 

11/4/2023 

120.36.248[.]80 

10/11/2022 

10/12/2022 

120.36.251[.]80 

7/27/2021 

7/28/2021 

120.36.251[.]84 

7/5/2022 

7/5/2022 

120.36.252[.]90 

4/24/2024 

4/25/2024 

120.36.249[.]91 

4/6/2021 

4/9/2021 

120.36.251[.]91 

9/29/2022 

9/29/2022 

120.36.252[.]91 

6/24/2022 

6/27/2022 

120.36.254[.]92 

9/15/2023 

9/20/2023 

120.36.254[.]94 

11/12/2021 

11/18/2021 

120.36.248[.]97 

3/14/2022 

3/18/2022 

120.36.251[.]97 

8/19/2021 

8/19/2021 

120.36.249[.]98 

2/1/2023 

2/3/2023 

120.36.252[.]98 

4/13/2022 

4/15/2022 

121.207.60[.]123 

3/19/2023 

3/19/2023 

122.116.33[.]118 

5/12/2023 

3/5/2024 

122.232.149[.]231 

3/23/2023 

3/23/2023 

122.201.241[.]230 

5/23/2023 

8/3/2023 

122.116.159[.]52 

5/22/2023 

9/25/2023 

122.116.102[.]93 

5/21/2024 

5/21/2024 

123.121.157[.]240 

4/12/2022 

4/12/2022 

123.51.237[.]194 

4/8/2024 

11/4/2024 

123.252.121[.]7 

2/26/2024 

3/4/2024 

123.252.122[.]7 

2/28/2024 

3/4/2024 

123.12.90[.]227 

1/26/2023 

1/26/2023 

123.60.61[.]104 

9/12/2024 

9/12/2024 

124.126.158[.]130 

2/21/2024 

2/21/2024 

124.126.139[.]199 

5/31/2023 

5/31/2023 

124.127.17[.]171 

8/10/2023 

8/11/2023 

124.127.220[.]223 

8/21/2023 

8/21/2023 

124.150.135[.]3 

9/7/2023 

9/7/2023 

123.51.223[.]96 

3/14/2023 

4/18/2023 

124.64.22[.]13 

12/11/2023 

12/11/2023 

124.126.141[.]74 

4/23/2023 

4/23/2023 

124.127.78[.]22 

8/15/2023 

8/16/2023 

124.127.72[.]52 

8/12/2023 

8/12/2023 

125.227.147[.]106 

11/1/2023 

12/5/2023 

125.227.140[.]168 

3/18/2024 

11/12/2024 

125.227.1[.]220 

5/25/2023 

11/14/2023 

125.227.196[.]157 

1/19/2024 

1/29/2024 

125.227.219[.]145 

3/6/2024 

7/1/2024 

125.228.239[.]13 

4/2/2024 

12/2/2024 

125.227.218[.]2 

5/16/2024 

5/16/2024 

124.64.23[.]80 

7/7/2023 

7/7/2023 

125.229.172[.]48 

5/23/2024 

5/23/2024 

125.227.136[.]60 

5/11/2023 

2/28/2024 

137.220.34[.]137 

12/16/2020 

12/17/2020 

137.220.39[.]222 

1/21/2021 

1/25/2021 

137.220.43[.]47 

7/17/2020 

7/24/2020 

137.220.36[.]87 

3/16/2023 

7/7/2024 

138.199.62[.]148 

12/5/2024 

12/14/2024 

139.180.137[.]219 

1/25/2024 

6/5/2024 

139.180.217[.]19 

6/5/2024 

6/19/2024 

139.180.158[.]51 

12/13/2021 

7/8/2024 

139.84.174[.]129 

6/17/2024 

12/16/2024 

140.82.27[.]163 

1/2/2020 

1/8/2020 

140.82.50[.]151 

3/5/2021 

3/17/2021 

141.164.41[.]128 

4/11/2023 

7/8/2024 

140.82.48[.]6 

7/13/2020 

7/17/2020 

141.164.55[.]227 

9/4/2024 

12/16/2024 

141.164.56[.]93 

6/20/2025 

6/20/2025 

144.202.26[.]205 

5/14/2020 

5/14/2020 

144.34.171[.]162 

3/29/2023 

11/28/2023 

144.202.33[.]164 

9/17/2020 

9/27/2020 

144.202.62[.]109 

10/16/2019 

10/28/2019 

144.202.91[.]107 

10/19/2020 

10/27/2020 

144.202.94[.]216 

8/17/2020 

8/18/2020 

144.202.98[.]41 

11/18/2020 

11/18/2020 

147.139.133[.]246 

5/26/2023 

6/6/2023 

149.28.132[.]137 

2/23/2024 

7/5/2024 

149.28.132[.]161 

5/17/2024 

7/4/2024 

149.28.201[.]146 

11/20/2020 

12/11/2020 

149.28.188[.]184 

11/21/2019 

11/21/2019 

149.248.34[.]100 

6/5/2020 

6/5/2020 

149.28.149[.]29 

4/30/2024 

4/30/2024 

149.28.252[.]19 

11/18/2019 

11/18/2019 

149.248.38[.]179 

6/3/2020 

6/3/2020 

149.248.39[.]202 

6/8/2023 

2/29/2024 

149.248.44[.]191 

2/23/2024 

5/10/2024 

149.248.51[.]22 

1/25/2024 

6/5/2024 

149.28.72[.]106 

2/24/2023 

3/2/2023 

155.138.155[.]170 

2/4/2021 

2/4/2021 

155.138.136[.]190 

12/5/2019 

12/16/2019 

155.138.151[.]225 

6/5/2024 

6/5/2024 

155.138.133[.]56 

1/25/2024 

6/5/2024 

156.146.45[.]152 

9/21/2024 

9/21/2024 

156.146.45[.]194 

9/19/2024 

9/19/2024 

158.247.197[.]28 

6/25/2023 

9/26/2023 

159.138.152[.]61 

3/16/2023 

3/22/2023 

162.14.178[.]86 

3/29/2021 

5/7/2021 

167.172.33[.]16 

4/14/2023 

4/14/2023 

167.179.87[.]215 

11/21/2022 

6/20/2025 

167.179.97[.]121 

12/14/2022 

3/20/2023 

171.120.88[.]137 

9/27/2023 

9/27/2023 

178.62.208[.]162 

4/14/2023 

4/14/2023 

180.122.149[.]177 

3/22/2023 

3/22/2023 

182.34.19[.]234 

3/23/2023 

3/23/2023 

183.240.139[.]216 

12/7/2020 

1/8/2021 

183.253.28[.]104 

2/27/2024 

2/27/2024 

183.253.29[.]110 

5/6/2024 

5/10/2024 

183.253.28[.]121 

12/6/2023 

12/14/2023 

183.250.213[.]20 

4/3/2023 

4/3/2023 

183.253.29[.]189 

8/9/2024 

8/9/2024 

183.250.213[.]55 

9/26/2023 

10/11/2023 

183.253.29[.]66 

3/25/2024 

3/28/2024 

183.253.28[.]67 

10/12/2024 

10/12/2024 

183.250.213[.]80 

3/3/2023 

3/31/2023 

183.250.213[.]83 

3/24/2023 

3/24/2023 

183.166.90[.]97 

3/20/2023 

3/20/2023 

185.216.118[.]71 

6/7/2024 

7/2/2024 

185.135.73[.]192 

1/4/2022 

1/5/2022 

185.213.82[.]239 

6/27/2024 

7/3/2024 

185.213.82[.]243 

6/28/2024 

6/28/2024 

185.213.82[.]55 

10/16/2024 

10/16/2024 

185.213.82[.]65 

9/21/2023 

9/21/2023 

190.92.241[.]15 

3/20/2023 

3/27/2023 

191.232.188[.]144 

6/23/2022 

6/23/2022 

193.42.24[.]68 

11/28/2024 

11/28/2024 

193.42.25[.]73 

3/24/2024 

7/11/2024 

198.13.38[.]211 

7/5/2024 

7/5/2024 

202.182.109[.]151 

6/1/2024 

9/13/2024 

202.101.145[.]22 

3/23/2023 

3/23/2023 

202.182.106[.]31 

1/25/2024 

7/2/2024 

202.39.151[.]239 

3/8/2024 

12/5/2024 

202.99.19[.]250 

7/10/2023 

7/10/2023 

202.99.19[.]254 

7/13/2023 

7/13/2023 

203.74.126[.]20 

3/28/2023 

3/31/2023 

203.69.36[.]122 

4/1/2024 

12/12/2024 

207.246.118[.]144 

10/21/2022 

12/15/2022 

207.246.117[.]149 

3/24/2020 

3/27/2020 

207.246.114[.]173 

10/30/2019 

10/30/2019 

207.148.68[.]131 

1/25/2024 

6/5/2024 

207.148.122[.]69 

1/25/2024 

6/5/2024 

207.148.67[.]146 

1/6/2021 

1/20/2021 

207.246.108[.]64 

1/16/2020 

1/16/2020 

207.246.127[.]64 

9/12/2019 

9/6/2024 

207.148.73[.]238 

6/14/2023 

9/13/2024 

207.148.92[.]220 

4/25/2024 

7/5/2024 

207.148.4[.]96 

9/30/2019 

5/18/2023 

208.72.154[.]55 

4/24/2022 

5/17/2022 

210.242.152[.]155 

3/26/2024 

12/12/2024 

210.242.38[.]241 

3/14/2023 

1/15/2024 

210.243.225[.]41 

5/14/2024 

11/29/2024 

210.66.220[.]39 

10/18/2021 

10/21/2021 

210.242.76[.]32 

5/23/2024 

5/23/2024 

210.71.166[.]50 

6/3/2024 

6/11/2024 

211.20.144[.]116 

5/16/2024 

5/19/2024 

211.20.104[.]187 

5/21/2024 

5/21/2024 

211.21.19[.]11 

3/6/2024 

4/2/2024 

211.22.143[.]228 

7/27/2023 

7/27/2023 

211.20.115[.]60 

2/27/2023 

3/5/2024 

211.20.154[.]60 

3/18/2024 

4/1/2024 

211.20.100[.]78 

12/21/2023 

12/22/2023 

211.20.100[.]79 

12/22/2023 

12/22/2023 

211.99.103[.]102 

12/1/2020 

12/8/2020 

211.21.61[.]46 

4/2/2024 

4/29/2024 

211.75.185[.]37 

10/30/2023 

1/4/2024 

211.99.103[.]243 

12/28/2020 

1/22/2021 

212.107.28[.]16 

9/9/2022 

9/9/2022 

212.107.28[.]22 

9/9/2022 

9/9/2022 

212.107.28[.]23 

9/9/2022 

9/9/2022 

211.78.84[.]17 

12/27/2023 

12/27/2023 

211.20.91[.]77 

4/17/2024 

4/18/2024 

211.99.100[.]90 

4/8/2021 

4/8/2021 

211.99.100[.]91 

4/9/2021 

4/9/2021 

211.99.98[.]197 

11/30/2020 

11/30/2020 

216.128.149[.]106 

12/15/2022 

2/22/2023 

216.128.128[.]238 

2/21/2021 

2/21/2021 

218.26.159[.]254 

10/5/2023 

10/5/2023 

218.5.173[.]137 

3/22/2023 

3/22/2023 

218.5.157[.]171 

3/20/2023 

3/20/2023 

218.66.163.188 

3/24/2023 

3/24/2023 

219.143.179[.]250 

7/10/2023 

7/13/2023 

220.128.108[.]164 

10/28/2022 

7/19/2023 

220.130.153[.]127 

4/3/2023 

12/18/2023 

220.130.176[.]23 

12/18/2023 

3/1/2024 

220.128.125[.]3 

3/8/2023 

5/9/2023 

220.130.254[.]251 

12/13/2023 

12/13/2023 

219.92.229[.]53 

5/15/2023 

5/15/2023 

220.162.9[.]150 

3/20/2023 

3/23/2023 

220.250.44[.]62 

6/28/2023 

6/29/2023 

221.218.143[.]112 

2/29/2024 

3/11/2024 

221.218.136[.]12 

7/16/2023 

8/9/2023 

221.218.138[.]123 

5/23/2024 

5/23/2024 

221.218.143[.]122 

6/4/2023 

7/3/2023 

221.218.143[.]184 

7/5/2023 

7/12/2023 

221.218.136[.]192 

10/8/2023 

11/15/2023 

221.216.116[.]238 

4/24/2024 

4/24/2024 

221.218.137[.]229 

6/4/2024 

6/4/2024 

221.218.139[.]248 

1/18/2024 

1/24/2024 

221.216.208[.]188 

6/19/2023 

6/19/2023 

221.218.142[.]26 

5/9/2024 

5/13/2024 

221.218.141[.]96 

4/2/2024 

4/3/2024 

222.92.153[.]125 

6/6/2024 

6/6/2024 

223.104.40[.]128 

4/16/2024 

4/16/2024 

223.104.41[.]13 

4/18/2024 

4/18/2024 

223.104.40[.]142 

4/17/2024 

4/17/2024 

223.104.40[.]204 

4/19/2024 

4/19/2024 

223.27.34[.]132 

4/10/2024 

12/13/2024 

223.104.55[.]183 

7/3/2024 

7/3/2024 

223.104.39[.]82 

7/11/2023 

7/11/2023 

 

Table 12 shows observed domain names attributed to this threat activity and obfuscation network hosts.  

Table 12. Domain Names Attributed to Threat Activity and Obfuscation Network Hosts 

Name 

Type 

First Seen 

Last Seen 

96cee[.]com 

Infrastructure 

6/29/2020 

5/9/2024 

asean.twimg.co[.]uk 

SoftEther Host 

9/21/2024 

12/15/2024 

bj-hk.hmbcloud[.]net 

SoftEther Host 

3/29/2021 

3/29/2021 

bj-jp.hmbcloud[.]net 

SoftEther Host 

4/10/2021 

5/7/2021 

blog.98aiblog[.]com 

SoftEther Host 

7/12/2024 

8/14/2024 

bsnl.twimg.co[.]uk 

SoftEther Host 

6/17/2024 

7/7/2024 

dns.studiocloud[.]xyz 

Infrastructure 

12/10/2021 

5/9/2024 

eg.twimg.co[.]uk 

SoftEther Host 

9/22/2024 

12/14/2024 

etechhosting.twimg.co[.]uk 

SoftEther Host 

9/21/2024 

12/16/2024 

fcchk.twimg.co[.]uk 

SoftEther Host 

9/21/2024 

12/14/2024 

gz-hk.hmbcloud[.]net 

SoftEther Host 

12/28/2020 

1/22/2021 

iplc-hk.hmbcloud[.]com 

SoftEther Host 

11/30/2020 

12/8/2020 

javacheck.ooguy[.]com 

SoftEther Host 

12/22/2023 

6/25/2024 

javaupdate.giize[.]com 

SoftEther Host 

12/22/2023 

6/15/2024 

ls.twimg.co[.]uk 

SoftEther Host 

9/21/2024 

12/14/2024 

np.twimg.co[.]uk 

SoftEther Host 

9/21/2024 

11/25/2024 

one.hmbiplc-01[.]com 

SoftEther Host 

4/2/2022 

4/2/2022 

pw.sexytube0[.]com 

SoftEther Host 

8/6/2021 

4/18/2024 

senate.twimg.co[.]uk 

SoftEther Host 

9/21/2024 

12/14/2024 

sh-jp.hmbcloud[.]net 

SoftEther Host 

4/10/2021 

4/25/2021 

studiocloud[.]xyz 

Infrastructure 

12/10/2021 

5/9/2024 

szxcm-hkg01.iepl.node[.]cm 

SoftEther Host 

12/7/2020 

1/8/2021 

tj.twimg.co[.]uk 

SoftEther Host 

9/21/2024 

12/14/2024 

ximmd.sexytube0[.]com 

SoftEther Host 

7/14/2020 

10/31/2020 

 

Table 13 contains known webshells from the threat actor’s repository of CNE tooling, which may appear on a compromised system. The threat actors have used these webshell files for unauthorized access to victim environments. 

Table 13. Leveraged Webshells 

Name 

Hashes 

b374.php 

MD5: 48ca18a25424a0f52276290b619a7a83 

SHA-256: 72c6af6a4be99e31c4a7a0aa4f01750792788e7f6f9749243a9f2c47c14a708f 

back.pl 

MD5: 38f5ff8169423e2c756848c02e8cac3b 

SHA-256: 456586ababa08f70216c4459f4d6375676166ebfddd98a33b447ceb5099e8dc5 

error.jsp 

MD5: d61326c4e6d24aa9b67e2b7a3ef7cedf 

SHA-256: 2f5c406eb64ad8902c8e30610d43fd3efc05a14cdb8fb158818953eaf3dc6a81 

file_back. 
aspx 

MD5: f8de2e99dc7523d2c83d1a48e844c5ff 

SHA-256: 5782ff2c835c88cc1ee521d2e8c523cfad73db3f9a29c93b40c4223f0338ade9 

gf.phtml 

MD5: 5b5a2c7fa705d8b1eb04da5db900b0d7 

SHA-256: 0e6fecb2d369b0eae63731616a3daada52036634885ab1b85b115af6bc5bcb86 

yaml-payload.jar 

MD5: 655cd134976d3e80c521708aa8be418b 

SHA-256: 36f3b7645609ef40444dbc68f01d26c543d67689eda4937272ea5cfa4df1b522 

 

Table 14 contains known binaries and scripts from the threat actor’s repository of CNE tooling. The threat actors used these utilities to perform various scanning or computer intrusion tasks.

 
Table 14. Leveraged Binaries and Scripts 

Name 

Category 

Hashes 

ksubdomain 

Enumeration 

MD5: dae8f50ea44225fae3ba1f160b42bfdc 

SHA-256: 670fa10a2ddde21fd594c4fef86b554d864089ed2de7153b472e921c623403ae 

ksubdomain_linux 

Enumeration 

MD5: fdece34bc084f1e252aeae274650eb8d 

SHA-256: 645f6f2667af01a94d04a9d7a71916a13d9426835d636b4ceee2e25ccb34e525 

oneforall.py 

Enumeration 

MD5: 596b990b0b389d906a8f4384837c1878 

SHA-256: 4d488f21269b18e37aaca93ac2a61707c9b611e506cdb3b287277746e94636b5 

subDomainsBrute.py 

Enumeration 

MD5: a73eca669fe80628dbbd2c7d9bb14c8f 

SHA-256: a14844e982f172d0f23910558c3f390a9d4c45dc32db825c2af7cf0ed8631db2 

office-cli 

Information dump 

MD5: be121e707f817aa9392c55af1e7ec2aa 

SHA-256: add7dd142e4f7e2873bc8f7b7fb6308063608e0b49a773dea93abad4047f1489 

JuicyPotato.exe 

Privilege escalation 

MD5: 7ce68f0dd85355ba2897a68521167e56 

SHA-256: e7e727458f573dded05537baddac2867d2801db1c3c74410398d063dfd6f6575 

BBScan.py 

Scanning 

MD5: f82694de2f19e1bff333c27bb7eb7a56 

SHA-256: 8e1b56ef51ba70aa4c4cfd4430820f20875b354588d5d723ba4d3940ea6c924b 

dirmap.py 

Scanning 

MD5: 1933c314041415939331fce183939547 

SHA-256: 46e59172c40c95d83c3a6f24f801fc2265653c8b575b66a726463e2a4eebd7f2 

dirsearch.py 

Scanning 

MD5: 8829f6f1cc5fc0aab2f6e71bfd7dc53d 

SHA-256: 752b14c6e6936991d51fcd5ebf40d303e657c2372893604f96044848ad9a5f24 

fscan.exe 

Scanning 

MD5: cf903e4a1629aa0582fd0363b5786676 

SHA-256: 7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9 

nbtscan.exe 

Scanning 

MD5: f01a9a2d1e31332ed36c1a4d2839f412 

SHA-256: c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e 

nbtscan_linux 

Scanning 

MD5: ef713447f18f5b7ee16af4ac37ec4133 

SHA-256: 2fbcb1995c458e5affd5fb8f1f979a08ddce21714a2e413aa3d5dc44f9f245fe 

PackerFuzzer.py  

Scanning 

MD5: 8dcc4f9ccc6b6adf7eeeb3f51c95afad 

SHA-256: 33790218d5871af646feef5be29e0596d4703a45ce675c1eb2ca00140b3a1bde 

ShuiZe.py 

Scanning 

MD5: b04375cca637f0702bf27feaff22a92d 

SHA-256: c7f86a4623db5c90273cea041d43207849c5c6b0060c370b2095f13871b1366d 

sqlmap.py 

Scanning 

MD5: bcacc7ca999980d26c186ef791242fb5 

SHA-256: 2ecb51d7fa3bc3fa7ad7df64c6d0cd1f4ff2b37ed6839d3cff529fb08af49fb0 

wpscan 

Scanning 

MD5: 1b8e29b6b7972fb124425aaa257f8f6d 

SHA-256: efb0437e6a6a0f07169952f1a8b734299ec9a8b1faadbed811fe017f2cf54976 

 

Table 15 contains known files that the threat actors dropped onto victim systems and used to install unauthorized software, dump sensitive information, or enable other follow-on activity from within a victim’s network. 

Table 15. Potentially Dropped Files 

Name 

Category 

Hashes 

curlc4.txt 

Malware 

MD5: 4f61b9ab907f351bb40b37b10f4974d0 

SHA-256: 8b869a5edaff74ff18bca3658a519a19771e66d00ff7849af7a142dd6fc8da85 

DiagTrack.exe  

Malware 

MD5: 6d57c42dee8bd7789969e2dd28671162 

SHA-256: 804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d 

live700_v1.exe 

Malware 

MD5: 776807750280daad05348f931a33e4ef 

SHA-256: c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec 

conhost.exe 

SoftEther 

MD5: a973c0ab904c1b74655a906b99b76850 

SHA-256: b1552703ff0035f197c22cdb3a514bb6aa45ec98de3ef5409faab0978f18c35e 

dllhost.exe 

SoftEther 

MD5: f62cbbbdf35c7790909c26c7c5fbce05 

SHA-256: 8a592e22c51311d482272ec5aba0103c9cd0cfd78e5b5ba75dfa8f1c56926672 

dllhost.exe 

SoftEther 

MD5: a05cdf6afcbb107961307f59cbab5e4f 

SHA-256: 86f1cfa6a2e0a8cb6fc1fbee28472308e6467932f8658a6a4885e29ed8c34a67 

b.exe 

Information dump 

MD5: 7d5a182f70bed0e4fa2f8615aba070de 

SHA-256: e93244080a749b521f63476343ce3c81cc8c1b672fa0d9e67359aee37544c784 

dc.exe 

Information dump 

MD5: 1bcaef76b2063f1b80b0fa0d277ec9c5 

SHA-256: 9dc85f9569a15eaf51c7d34254767ea30dd67b2178cec4cc7125288b9544fe00 

secretsdump.exe 

Information dump 

MD5: 4d33bfb75e27fefaa72526899604d557 

SHA-256: 644decbc6ce8c52382f4755fa6fc2cb4d89a0e7ec0e574c11b398a6f2eed04b1 

secretsdump.py 

Information dump 

MD5: fc6e8ca41cf4f6100177352660e520b4 

SHA-256: 67db57a1f957031b78f29aa91e2e87780eae3835290259eff846d8f14afb794b 

 

Appendix B: Observed Common Vulnerabilities and Exposures

Table 16 displays successfully exploited common vulnerabilities and exposures (CVEs). The asterisk (*) indicates CVEs that were newly added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog. 

Table 16. Successfully Exploited CVEs 

CVE 

Vendor 

Product 

Versions Affected 

Vulnerability Type 

GNU 

Bash 

Through 4.3 bash43-026 

Remote code execution 

ProFTPD 

Proftpd 

1.3.5 

Unauthorized read 

ISC 

BIND 9.x 

Before 9.9.7-P2 and 9.10.x before 9.10.2-P3 

Denial of service 

Apache 

Struts 

2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28 

Remote code execution 

Pulse Secure 

Pulse Connect Secure 

8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 

Unauthorized read 

GitLab 

GitLab 

All versions starting from 11.9 

Remote code execution 

ONLYOFFICE 

DocumentServer 

5.1.5 through 5.6.2 

Unauthorized write 

Strapi 

Strapi 

Up to 4.5.5 

Information disclosure 

 

Received — 29 September 2026 ⏭

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

✇CISA Alerts
By: CISA
4 September 2026 at 18:12

Executive summary

China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy. While “distillation” is recognized as a legitimate and useful technique in AI research, China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary functionalities and capabilities of U.S. frontier AI models. The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) (hereafter referred to as the authoring agencies) are releasing this joint Cybersecurity Advisory to alert organizations about these malicious activities and techniques and recommend mitigations to reduce their potential impact. 

Likely with Chinese government awareness, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024. DeepSeek has conducted organized campaigns since at least 2024 targeting reasoning capabilities, specialized optimizations, and domain-specific functions to train its R1 and V3 models. Alibaba leveraged industrial-scale distillation to improve the company’s Qwen family of AI models. Moonshot AI, MiniMax, Stepfun, and Z.AI also engaged in malicious knowledge distillation of U.S. AI companies’ models. 

China-based AI companies route distillation requests through multiple pathways to gain unauthorized access, consequently violating U.S. AI companies’ terms of use. These pathways include native application programming interfaces (APIs), remote cloud providers, and third-party aggregators that automatically obfuscate user metadata to avoid detection. Further, China-based AI companies use a gray market of proxies known as “transfer stations” to bypass U.S. AI companies’ geographic restrictions, breach terms of use, evade safeguards, and undermine traceability. China-based AI companies achieve cost savings for their industrial-scale distillation campaigns through bulk procurement of the U.S. AI companies’ premium subscriptions shared across teams of developers. Advanced industrial-scale distillation tactics include chain-of-thought (CoT) reasoning extraction, automated failover between pathways during blocking attempts, and sophisticated quality evaluation frameworks to detect defensive countermeasures. China-based AI companies that conduct industrial-scale distillation against U.S. AI models see significantly shorter AI development timelines and reduced financial expenditures in training a frontier model.

China-based AI companies deliberately distribute operations across multiple providers, platforms, and pathways to avoid single-point detection. They also attempt to distill the best capabilities and proprietary features of each U.S. frontier model to train their China-based AI models. This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership. Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. Government, private industry, and allied nations.

The authoring agencies recommend U.S. AI companies take three immediate actions: 

  1. Implement comprehensive detection and mitigation: Detect anomalous and malicious prompts, accounts, networks, and behaviors. Additionally, monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns.
  2. Deploy targeted response changes: Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.
  3. Establish cross-organization intelligence sharing: Correlate activity across model providers, cloud platforms, and API aggregators to reveal distributed campaigns.

Attribution

Since at least late 2024, China-based AI companies, including DeepSeek (DeepSeek Artificial Intelligence Technology Research Co., Ltd.), Moonshot AI (Beijing Moonshot Technology Co., Ltd.), Alibaba Group, MiniMax (Shanghai MiniMax Co., Ltd.), StepFun (Shanghai Jieyue Xingchen Intelligence Technology Co., Ltd.), and Z.AI, have conducted high-volume knowledge distillation campaigns against several U.S. AI companies. The sheer scale of these campaigns and their sophistication indicate that distillation is not a supplement to these companies’ AI model development, but the critical core of it. 

Likely with the knowledge of the Chinese government, the China-based AI sector has turned to a comprehensive distillation strategy in an attempt to bridge the technological and performance gaps between their AI models and U.S. frontier AI models. To access U.S. AI companies’ application programming interfaces (APIs), China-based AI companies use a gray market of API proxies known as “transfer stations” to bypass U.S. AI companies’ regional restrictions, breach terms of use, evade safeguards, and undermine traceability. 

DeepSeek

DeepSeek has been conducting an organized distillation campaign against U.S. AI companies’ frontier AI models since at least late 2024 to generate synthetic training data for its models, including R1, released in early 2025. The company targeted specific knowledge domains to extract proprietary functionality and reasoning capabilities to reduce their compute and research costs. DeepSeek’s publicly quoted training costs of $5.6M are misleading as it does not include the true cost of the data acquired through extensive malicious distillation.1 

Between late 2024 and mid-2025, DeepSeek distilled specialized training data and capabilities from the following U.S. frontier AI company models to train their R1 and V3 models: 

  • Claude 3.7 
  • Claude Sonnet 4
  • Claude Sonnet 4.5
  • Claude Opus 4.1
  • Gemini 2.5 Pro Preview
  • Gemini 2.5 Flash Preview
  • GPT-4
  • GPT-4o
  • GPT-4 Mini
  • GPT-4 Nano
  • GPT-5
  • Grok 4

The specific knowledge and capabilities distilled included: 

  • Legal specialization optimization
  • API rule-driven tasks
  • Writing using CoT drafts
  • Agentic functions
  • Question and answer optimization
  • Coach/assistant capabilities
  • Functional creation optimization
  • Supervised fine-tuning (SFT) optimization
  • Creative and occupational writing optimization

Moonshot AI 

Moonshot AI has conducted a widespread distillation campaign against U.S. frontier AI companies since at least mid-2025. Notably, Moonshot AI extracted significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data to train its Kimi-K2 model. The company has used the following models to distill SFT optimization, reinforcement learning (RL), software engineering, and math capabilities:

  • Claude Opus 4.1
  • Claude Sonnet 3.7
  • Claude Sonnet 4
  • Claude Sonnet 4.5
  • Claude Sonnet 4.5 Thinking
  • Claude Fable 5
  • GPT-oss-20b
  • GPT-3
  • GPT-4o
  • GPT-4o mini
  • GPT-5
  • GPT-5 Codex
  • GPT-5 Pro
  • Gemini 2.5 Flash
  • Gemini 2.5 Flash-Image
  • Gemini 2.5 Pro
  • Nano Banana
  • Grok Code Fast-1

Other companies

Several other China-based AI companies, including Alibaba, MiniMax, StepFun, and Z.AI have also leveraged distillation techniques to build their AI models. In late 2025, Alibaba distilled Claude-4, Claude Opus, Claude Sonnet, and GPT-5 to improve their AI models’ software engineering skills, customer service dialogue functionality, image/character creation, and integration of RL, SFT, and distillation capabilities.

In late 2025, MiniMax distilled CoT reasoning, RL, SFT, and software engineering capabilities to improve its M2 model from Claude Code, Claude Sonnet 4, Claude Opus, Gemini 1, Gemini 2.5 Pro, and Gemini 3 Pro. MiniMax used Claude Code for internal software development tasks, including code generation, analysis, and refinement. MiniMax even used prompt injections to try to trick Claude Code into believing it was a MiniMax product.

Between late 2025 and early 2026, StepFun distilled data from Claude Opus 4.1 and 4.5, Claude Sonnet 4.5, Claude Haiku 4.5, GPT-5 Mini, GPT-5 Pro, GPT-5.1, GPT-5.1 Codex, and GPT-5.2 to improve its Step 4 model’s coding and agentic functions. By mid-2026, Z.AI had distilled billions of tokens of GPT-5.5 data and Claude Opus 4.8 data to develop the CoT reasoning capabilities of its model.

Table 1: China-based AI Companies Engaged in Knowledge Distillation Against U.S. AI Companies (From at least 2024-2026) 

China-based AI Company 

U.S. AI Models Distilled 

Functionalities and Domains Distilled 

DeepSeek 

(DeepSeek Artificial Intelligence 

Technology Research Co., Ltd.) 

深度求索AI基础技术研究有限公司
  • Claude Sonnet 3.7 
  • Claude Sonnet 4 
  • Claude Sonnet 4.5 
  • Claude Opus 4.1 
  • Gemini 2 
  • Gemini 2.5 Pro Preview 
  • Gemini 2.5 Flash Preview  
  • GPT-4 
  • GPT-4o 
  • GPT-4 Mini 
  • GPT-4 Nano 
  • GPT-5 
  • Grok 3 Mini  
  • Grok 4 
  • Legal specialization optimization 
  • API rule-driven tasks 
  • Writing using CoT drafts 
  • Question and answer optimization 
  • Coach/assistant capabilities 
  • Functional creation optimization 
  • SFT optimization 
  • Agentic capabilities 
  • Creative and occupational writing optimization 

 

 

 

 

 

Moonshot AI 

(Beijing Moonshot Technology Co., Ltd.) 

北京揽月星辰科技有限公司 
  • Claude Opus 4.1 
  • Claude Sonnet 3.7 
  • Claude Sonnet 4 
  • Claude Sonnet 4.5 
  • Claude Sonnet 4.5 Thinking 
  • Claude Fable 5 
  • GPT-oss-20b; 
  • GPT-3 
  • GPT-4o mini 
  • GPT-5 
  • GPT-5 Codex 
  • GPT-5 Pro 
  • Gemini 2.5 Flash 
  • Gemini 2.5 Flash-Image 
  • Gemini 2.5 Pro 
  • Nano Banana 
  • xAI Grok Code Fast-1 
  • SFT 
  • RL 
  • Software engineering 
  • Math capabilities 

 

 

Alibaba 

阿里集团 
  • Claude 4 
  • Claude Sonnet 
  • GPT-5 

 
  • Customer service dialogue 
  • Virtual character creation 
  • SFT, RL, and distillation training 
  • Evaluating and training datasets 
  • End-to-end agentic workflows 
  • Software engineering 

MiniMax 

(Shanghai MiniMax Co., Ltd.) 

上海稀宇极智科技有限公司 
  • Claude Code 
  • Claude Sonnet 4 
  • Claude Opus 4.5 
  • Gemini 1 
  • Gemini 2.5 Pro 
  • Gemini 3 Pro 
  • GPT-5 
  • CoT reasoning 
  • Agentic functionality 
  • Code review 
  • SFT dataset refinement 
  • Software engineering tasks 

StepFun 

(Shanghai Jieyue Xingchen 

Intelligence Technology Co., Ltd.) 

上海阶跃星辰智能科技有限公司
  • Claude Opus 4.1 
  • Claude Opus 4.5 
  • Claude Sonnet 4.5 
  • Claude Haiku 4.5 
  • GPT-5 Mini 
  • GPT-5 Pro 
  • GPT-5.1 
  • GPT-5.1 Codex 
  • GPT-5.1 Codex Mini 
  • GPT-5.2 
  • Code development 
  • Agentic functions 

 

Z.AI

北京智谱华章科技有限公司 
  • GPT-5.5 
  • Claude Opus 4.8 
  • CoT reasoning 

Tactics, techniques, and procedures

China-based AI companies employ sophisticated tactics, techniques, and procedures (TTPs). These TTPs map to the MITRE® ATLAS™2 framework, progressing through multiple adversary lifecycle phases from initial access through exfiltration. The China-based AI companies using these techniques include DeepSeek, Moonshot AI, MiniMax, StepFun, Z.AI, and other China-based AI companies targeting U.S. frontier AI models.

Table 2: MITRE ATLAS Mappings 

TTP Title 

ID 

Description 

Resource Development 

Acquire Infrastructure 

China-based entities establish and maintain sophisticated infrastructure supporting sustained extraction operations through tiered budget management and diverse supplier relationships. 

China-based entities circumvent both Chinese and U.S. AI access controls through a large gray market of API proxies, or “transfer stations,” which resell access to frontier models at a fraction of the official price. In doing so, they create a scalable mechanism for evading provider safeguards and eroding traceability. 

AI Model Access 

AI Model Inference API Access 

China-based entities have been exploiting AI model inference APIs through the creation of fraudulent accounts that are not registered to legitimate users. These actors leverage multiple accounts with similar registration details and payment methods, frequently switch between various AI models, and utilize third-party API aggregator services. Additionally, they execute highly coordinated queries featuring identical or similar prompt texts, demonstrating a sophistication indicative of advanced AI research. The sheer volume of requests, ranging from thousands to millions on similar topics, far exceeds legitimate use, raising significant concerns about potential misuse and compromising the integrity of AI systems. 

 

Execution / Privilege Escalation / Defense Evasion 

LLM Prompt Injection 

 

LLM Jailbreak  

 

 

China-based entities have conducted prompt injection techniques against large language models (LLMs) by inserting prompts specifically designed for jailbreaking.  

China-based entities craft prompts forcing models to reveal their hidden CoT reasoning (CoT or step-by-step internal reasoning that enables greater capabilities) despite U.S. models restricting CoT output visibility to users. DeepSeek employed prompts instructing models to imagine and articulate the internal reasoning behind completed responses and write it out step by step. This CoT data teaches student models, not just factual knowledge, but reasoning methodologies for complex agentic tasks, coding challenges, and logical proofs. 

Discovery 

Discovery 

China-based entities employ aggressive, adaptive discovery to systematically identify valuable extractable data. 

China-based entities demonstrate rapid operational adaptation. MiniMax redirected exchanges to a new Claude model within 24 hours of release, demonstrating real-time provider monitoring and pre-positioned infrastructure for immediate retargeting. 

 

AI Attack Staging 

Verify Attack 

China-based entities deploy production-grade automated quality assurance pipelines with multi-modal validation, enabling rapid detection of degraded outputs and differentiation of service issues from defensive data degradation. 

Collection 

Collection 

China-based entities systematically collect outputs to generate synthetic training datasets through continuous API querying, targeting specific knowledge domains rather than indiscriminate gathering. 

Moonshot AI used millions of exchanges targeting agentic reasoning/tool use, coding/data analysis, computer-use agent development, and computer vision, evolving from text-based distillation to extracting logical frameworks, enabling tool interaction and visual processing. 

DeepSeek used queries targeting reasoning capabilities, rubric-based grading tasks (reward model function), and censorship-safe query rewriting, extracting how U.S. models evaluate response quality. 

Campaigns span days to months with query volumes in the thousands to millions per domain, far exceeding legitimate research or development use cases. 

Exfiltration 

Exfiltration via AI  

Inference API: Extract AI Model 

China-based entities have been collecting U.S. frontier LLMs’ inferences into datasets, which can be used to train their models to mimic the behavior and performance of these LLMs. 

Impact 

External Harms 

China-based entities inflict financial harm through systematic extraction of proprietary functionality and capabilities, causing significant economic losses. Extracting capabilities worth billions in development costs while undermining competitive advantages represents a strategic economic threat to fair technological competition and U.S. technological leadership. 

Novel TTPs

China-based AI companies leverage techniques not in MITRE ATLAS, demonstrating significant organizational investment, operational maturity, and adaptive capability development distinguishing these campaigns from opportunistic exploitation.

Novel TTP 1: Regional restriction evasion and subscription exploitation

Some U.S. frontier AI models are restricted for use; however, China-based AI companies access U.S. frontier AI models by employing various means to bypass the regional restrictions.

After bypassing the restriction, China-based AI companies create user accounts obfuscating their country of origin and subsequentially procure bulk premium AI subscription services.

StepFun structured access around pools of accounts with employees running multiple concurrent sessions, implementing load distribution to prevent quota depletion. Daily budget allocations per automated agent started at moderate levels, scaling significantly as operations matured.

Detection indicators include:

  • shared accounts from multiple IPs/user agents, 
  • 24/7 sustained usage without human variation/idle periods, 
  • anomalous subscription-to-API usage ratios, and 
  • new subscriptions immediately at maximum usage as opposed to gradual AI adoption.

Novel TTP 2: Centralized request routing infrastructure

China-based AI companies deploy sophisticated tools that enable unified control and scalable implementation for evasion at scale. This provides model/provider abstraction, real-time health monitoring, centralized quota enforcement, and automated sanitization.

China-based AI companies manage routing systems to external AI models for distillation. These routing systems direct requests through multiple pathways: native APIs, cloud providers, third-party aggregators, third-party relays, and vendor account pools.

Detection indicators include:

  • consistent operational patterns across diverse account pools and 
  • correlated timing/behavior across different pathways indicating unified orchestration.

Novel TTP 3: Automated request metadata sanitization

China-based AI companies implement automated sanitization to systematically remove organizational identifiers. This differs from AML.T0065 (LLM Prompt Crafting) by operating at an infrastructure layer with automated enforcement instead of manual modification.

Detection indicators include:

  • sudden behavioral changes following disclosures/sharing, especially abrupt disappearance of previously consistent metadata; 
  • absence of expected markers in high-volume campaigns where scale suggests institutional activity; and 
  • generic/randomized patterns replacing consistent organizational indicators.

Novel TTP 4: Systematic quota and cost optimization

China-based AI companies systematically minimize API costs through pathway selection prioritizing cost-efficiency, centralized quota allocation/budget alignment, and account segmentation by purpose.

Detection indicators include:

  • new accounts with anomalously high immediate hit rates suggesting bulk deployment with pre-engineered templates, 
  • usage optimized for cache maximization versus task diversity, and 
  • coordinated pathway switching responding to pricing/rate changes indicating centralized decision-making.

Mitigations

Coordinated, ecosystem-wide responses extending beyond individual company measures can help address knowledge distillation campaigns. The mitigations below incorporate mitigations from the MITRE ATLAS and National Institute of Standards and Technology (NIST) AI frameworks. Collaboration across the broader AI ecosystem, including cloud providers, API aggregators, and infrastructure providers, can enable a coordinated defense against malicious knowledge distillation campaigns.

Behavioral detection and monitoring

China-based AI companies leverage premium subscriptions to U.S. frontier models for knowledge distillation campaigns and code development. U.S. companies should strengthen identity verification for accounts and track individual subscriptions with enterprise-scale throughput, accounts deviating from legitimate patterns, and new accounts immediately at maximum usage versus a gradual ramp-up or with consistent quota exhaustion. 

Response alteration for suspected distillation activity

Employing targeted changes in response to high-confidence malicious distillation requests can impose meaningful costs on knowledge distillation campaigns. Response changes, such as including differential privacy or using less sophisticated “downgraded” models to respond to distillation requests, can help protect U.S. proprietary functionalities and capabilities and reduce payoffs from distillation attempts. 

Implementation strategies

When suspecting a malicious distillation campaign, consider varying changes to responses across requests to complicate response quality evaluations, such that the subtle changes avoid triggering obvious alerts. Reducing reasoning depth, presenting correct information with different reasoning, or stylistic inconsistencies may evade detection while reducing training usefulness.

Avoid informing China-based AI company users suspected of distillation campaigns of a switch to a downgraded model. Informing malicious distillers would enable them to improve their defense evasions and indicate when to roll back training. Instead, alter responses to users confirmed to be querying frontier models specifically for malicious knowledge distillation campaigns without informing them. In contrast, AI safety researchers and third-party evaluators should be informed of model changes while still applying strong distillation mitigations.

Cross-organization information sharing and ecosystem coordination

Sharing information about distillation campaigns, such as indicators of infrastructure distributing operations across multiple providers, platforms, and pathways, can improve individual companies’ detection efforts. Industry disclosures document proxy networks managing tens of thousands of fraudulent accounts simultaneously, mixing distillation with unrelated customer requests across multiple providers. Community collaboration could provide defenders with more comprehensive visibility across the native APIs, cloud endpoints, and aggregators.

Sharing information about distillation enables and enhances correlation otherwise unachievable by individual organizations, through sharing infrastructure indicators (IPs, domains, third-party service providers) and behavioral indicators (timing correlations, query volume patterns).

Multi-source correlated activity enables more confident attribution of malicious knowledge distillation campaigns, justifying response degradation with lower-to-no legitimate user risk.

Sharing infrastructure and behavioral indicators between cloud providers, model aggregators, and model providers can make distributed infrastructure visible as coordinated campaigns versus isolated anomalies. Additionally, sharing can provide cloud and routing companies with actionable indicators for identifying and mitigating malicious activity.

MITRE ATLAS mitigations 

  • AML.M0015 - Predictive AI Adversarial Input Detection: Detect/block atypical queries deviating from benign patterns, exhibiting previous adversary technique characteristics, or originating from malicious IPs.
  • AML.M0004 - Limit AI Service Query Volume and Rate: Per-key/IP quotas, rate limits, progressive throttling. Adversaries seem to be sensitive to rate limits since they implement sophisticated strategies to work within constraints. 
  • AML.M0019 - Control Access to AI Models and Data in Production: User verification, authenticated API access, policy monitoring. This addresses fraudulent account pool exploitation. 
  • AML.M0024 - AI Telemetry Logging: Log inputs/outputs for threat detection/forensics. This is foundational for behavioral detection and enables correlation with intelligence. 
  • AML.M0002 - Predictive AI Output Obfuscation: Reduce fidelity of responses (withhold logits/confidences, shorten responses, targeted redaction). Balance security with user experience. 
  • AML.M0035 – AI Red Team: Adversarial testing, extraction simulation, telemetry monitoring. Validates detection efficacy. 
  • AML.M0015 - Predictive AI Adversarial Input Detection: Sanitize/validate inputs preventing prompt injections. This addresses jailbreak and injection attempts to elicit reasoning traces and system prompts. 
  • AML.M0000 - Limit Public Information Release: Limit disclosure of architecture, prompt templates, and system instructions. 
  • AML.M0001 - Limit Model Artifact Release: Limit release of data, algorithms, architectures, and model checkpoints. 
  • AML.M0003 - Predictive AI Model Hardening: Use adversarial training and defensive distillation to increase jailbreak difficulty. 
  • AML.M0006 - Predictive AI Ensembles: Use multiple models so extracting one yields a less usable clone. 

NIST AI 100-2e2025: Adversarial machine learning mitigations

Mitigations in NIST’s “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations” (NIST AI 100-2e2025) also apply to malicious distillation, including differential privacy, pre- and post-training interventions, and prompt instruction/formatting.

Differential privacy

Differential Privacy (DP) provides mathematically rigorous protection against inference and distillation techniques by adding calibrated noise to model outputs and preventing malicious actors from extracting training data membership information and other sensitive model information, such as decision boundaries or signals that could help reconstruct private data. This protection is governed by privacy parameters that define a finite privacy budget, where each query consumes part of the model's available privacy protection and repeated querying steadily reduces the remaining privacy reserve. 

As that budget is consumed through accumulated queries, the model must either add more noise to preserve privacy, restrict further queries, or accept reduced privacy protection. This creates a fundamental noise-versus-utility tradeoff, where stronger privacy protection requires more noise, which can lower prediction precision and business usefulness, while less noise improves utility but increases vulnerability to compromise techniques, such as membership inference, model extraction, or inversion. 

In practice, the right balance requires careful tuning and empirical auditing, because theoretical privacy settings do not always predict real-world accuracy impact, particularly for complex models or high-dimensional outputs that require substantially more noise to achieve equivalent protection, or when facing adaptive actors. As a result, DP is often strengthened with complementary controls such as query rate limiting, response aggregation, and monitoring.

Pre/post-training interventions

A range of training strategies have been proposed to increase the difficulty of accessing harmful capabilities through prompt injection, including safety training during pre-training or post training, adversarial training methods, and other methods to make jailbreak techniques more difficult.

Prompt instruction/formatting

Model instructions can cue the model to treat user input carefully, such as by wrapping user input in XML tags, appending specific instructions to the prompt, or otherwise attempting to clearly separate instructions from user prompts to mitigate distillation and make prompt injection or jailbreaking less effective.

Footnotes

1 Publicly quoted training costs are from “DeepSeek-V3 Technical Report”

2 MITRE is a registered trademark of The MITRE Corporation. MITRE ATLAS is a trademark of The MITRE Corporation.

References

Disclaimer of endorsement

The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

Purpose

This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Contact

  • National Security Agency
    Cybersecurity Report Feedback: CybersecurityReports@nsa.gov
    Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov
    Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov
  • Cybersecurity and Infrastructure Security Agency
    CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or by calling 1-844-Say-CISA (1-844-729-2472).
  • Federal Bureau of Investigation
    If you or someone you know has fallen victim to this campaign, file a complaint with IC3.
     
Received — 8 September 2026 ⏭
Received — 5 September 2026 ⏭

A Tale of Two SOCs: Insights From Two Red Team Assessments

✇CISA Alerts
By: CISA
20 August 2026 at 18:32

Advisory at a Glance

Title A Tale of Two SOCs: Insights From Two Red Team Assessments
Original Publication  August 25, 2026
Executive Summary

The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity, but Organization B rapidly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model.

This advisory details the red team’s activity and organizations’ defensive actions, offering lessons learned and mitigations to help critical infrastructure organizations strengthen detection, response, and protections in IT, cloud, and operational technology (OT) environments.
Lessons Learned
  • Untuned detection tools lead to missed threats. Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm network defenders.
  • Organizational silos and bureaucratic hurdles prevent effective incident response. Detection tools are only as effective as the people, processes, and procedures supporting them; fragmented communication, unclear responsibilities, and limited defender authority hinder effective incident response.
  • Cloud environments are often an underestimated risk. Organizations often lack security controls for cloud environments and processes for responding to a cloud compromise.
Key Actions
  • Establish and continuously maintain a baseline and reduce alert noise by fine tuning.
  • Break down silos and empower network defenders.
  • Implement Conditional Access policies for workload identities and monitor for excessive or unused permissions.
  • Establish and regularly review comprehensive procedures for detecting, remediating, and revoking access/refresh tokens in the event of a cloud compromise.
Intended Audience

Organizations: Federal Civilian Executive Branch agencies; state, local, tribal, and territorial governments; critical infrastructure.

Roles: System administrators, incident responders, defensive cybersecurity analysts, vulnerability analysts, network operators, security systems managers, and all network defenders.

Introduction

The Cybersecurity and Infrastructure Security Agency’s (CISA’s) red team simulates real‑world malicious cyber operations to assess an organization’s ability to detect, investigate, and respond to malicious cyber activity. Emulating cyber threat actor tradecraft, the red team attempts to gain and maintain persistent access to an organization’s network and sensitive business systems (SBSs) while avoiding detection.

CISA conducted two simultaneous red team assessments using similar tradecraft but observed different defensive responses. In one organization (Organization A), the team gained initial access to multiple workstations, gained elevated privileges over the domain, and moved laterally to SBSs and cloud resources undetected. In the second organization (Organization B), network defenders quickly detected the initial compromise and quarantined the affected systems.

Because Organization B detected the initial compromise, the red team moved to an assume breach model, where Organization B trusted agents (TAs) provided access to a host that replicated the level of access the red team would have had if defenders had not detected their activity. From there, the red team escalated privileges and moved laterally to SBSs, cloud resources, and a bastion host in the OT demilitarized zone (DMZ), where defenders again detected activity and isolated the system.

In coordination with the assessed organizations, CISA is releasing this Cybersecurity Advisory to describe the red team’s activity and the organization’s defensive responses and to share lessons learned that critical infrastructure organizations can use to strengthen their IT, cloud, and OT cybersecurity posture.

CISA encourages critical infrastructure organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of malicious cyber incidents.

Download the PDF version of this report:

Technical Details

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 19. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the red team’s activity mapped to MITRE ATT&CK tactics and techniques.

Overview

CISA is authorized—upon request—to provide analyses, expertise, and other technical assistance to critical infrastructure owners and operators and to provide operational and timely technical assistance to federal and non-federal entities, with respect to cybersecurity risks (see generally 6 U.S.C. §§ 652[c][5], 659[c][6]). CISA conducted two concurrent red team assessments: one at a Government Services and Facilities Sector organization (Organization A), and one at a Water and Wastewater Systems Sector organization (Organization B).

During CISA’s red team assessments, the red team simulates malicious cyber operations to assess an organization’s threat detection and response capabilities. The red team attempts to gain and maintain persistent access to an organization’s enterprise network, avoid detection, evade defenses, and access SBSs (applications, data stores, or infrastructure components where compromise would materially impact the organization's operations, finances, or customer data) selected by the organization. For the assessments described in this advisory, the team also attempted to gain access to cloud resources and to demonstrate their ability to access Organization B’s OT systems without actually doing so.

Organization A

Red Team Cyber Threat Activity

Initial Access and Active Directory Discovery

During reconnaissance, CISA’s red team identified a web application with default credentials [T1589.001] for multiple built-in user accounts that allowed the team to send emails from an internal email address. The team used the internal email address to send phishing emails [T1566] and gained initial access to four workstations.

From the workstations, the red team leveraged a modified BloodHound1 collector, customized to avoid static endpoint detection and response (EDR) signatures, to query and scrape Active Directory (AD) information. This information included AD users [T1087.002], computers [T1018], groups [T1069.002], access control lists, organizational units, and group policy objects (GPOs) [T1615]. The team found that one compromised workstation had the default Machine Account Quota (MAQ) of 10, allowing unprivileged users to add up to 10 computer accounts to the domain.

The red team also queried the organization’s Active Directory Certificate Service (ADCS) certificate templates. Misconfigured ADCS templates are common and can allow low-privileged accounts to request a certificate on behalf of other users and computers, including highly privileged accounts. The team identified multiple templates with an ESC1 misconfiguration, which allows any user to request certificates for all users and computer accounts (see scenario ESC1 in SpecterOp’s Certified Pre-Owned: Abusing Active Directory Certificate Services). The red team exploited the misconfigured MAQ to create a machine account [T1136.002] and then exploited a misconfigured ADCS template to request a certificate for the newly created machine account [T1649]. They could then obtain certificates for any user account, providing means for lateral movement.

Post Exploitation: Privilege Escalation and Lateral Movement
Sensitive Business Systems

After the red team gained elevated privileges over the domain, they began post-exploitation activities and attempted to access SBSs. To access the SBSs, the team needed to identify their network location and security controls.

The team’s plan to achieve SBS access included the following steps:

  1. Use previously acquired AD data to identify users and groups related to the SBS.
  2. Query system center configuration manager (SCCM) servers to enumerate user-device relationships and identify the workstations assigned to each user [T1033].
  3. Move laterally from the SCCM server to the target users’ workstations.
  4. Find credential material on the target user’s workstation to access the SBS.
  5. Verify administrative access to the SBS would allow compromise of the availability, integrity, and/or confidentiality of the system and its data.

For each SBS, the red team used similar discovery and initial access techniques but unique credential retrieval methods. For SBS 1, a database, the team located cleartext credentials on an administrative user’s workstation providing access to the system [T1552]. For SBS 2, also a database, the red team searched the targeted user’s workstations for connections.json and product-preferences.xml files for a Structured Query Language (SQL) developer tool. The team decrypted these files to obtain the cleartext password to the database [T1552.001]. For SBS 3, an automated processing system, the red team acquired long-lived static Amazon Web Service (AWS) identity and access management (IAM) user credentials saved in configuration files in targeted users’ home directories. These credentials do not expire because the organization had not configured credential expiration or rotation.

For SBS 2 and 3, the red team expanded access beyond users’ physical workstations to include their virtual desktops, which limited their access to the active, interactive sessions held by users. While virtual workstations add security controls, such as segmenting networks of sensitive systems to only allow virtual hosts, they are generally synchronized with a root drive of the distributed file system (DFS). The red team compromised the root DFS drive, granting them access to local files of all users’ virtual desktops, regardless of the existence of an active session. This allowed the team to quickly search for cloud configuration files containing credentials and database connection files for thousands of users.

The red team obtained administrative access to all targeted SBSs without defensive intervention by proxying tools [T1090.001] through compromised workstations and using the collected credentials.

Microsoft Entra Systems

After compromising the target SBSs, the red team attempted to compromise Organization A’s Microsoft cloud environment by compromising Organization A’s Microsoft Entra ID (formerly Azure AD) through applications. The team targeted Entra ID applications with Application permissions, which allow applications to access data without user consent (compared to Delegated permissions, which allow applications to access data with user consent). By compromising an application that had elevated Application permissions, the red team would gain the same permissions as the application because these applications operate outside the scope of traditional conditional access policies (CAPs) that provide controls for user access and activity.

Note: Microsoft’s Conditional Access for workload identities extends traditional CAPs to service principals (SPs) used by applications and governs Application permissions by allowing organizations to broadly apply access policies to applications. Implementing Conditional Access for workload identities would have protected against red team exploiting use of Application permissions; however, the red team never observed an organization using Conditional Access for workload identities.

The team compromised applications and used their permissions by:

  1. Enumerating the organization’s cloud resources using the publicly available tools, including AzureHound2 and ROADrecon,3 to gather information about applications, their permissions, and their owners [T1526] [T1588.002].
  2. Identifying applications with elevated permissions to the Microsoft Graph Resource application programming interface (API), including the following:
    1. Mail.Read – Read Outlook emails.
    2. Mail.ReadWrite – Read and write Outlook emails.
    3. Chat.Read.All – Access Teams messages.
    4. Files.Read.All – Access OneDrive.
    5. Application.ReadWrite.All – Add Client Secrets to any application or SP.
    6. AppRoleAssignment.ReadWrite.All – Lets an SP grant itself powerful Graph application permissions such as Chat.Read.All or RoleManagement.ReadWrite.Directory.
  3. Identifying the owner of an application with Mail.ReadWrite permissions.
  4. Moving laterally to the owner’s machine.
  5. Obtaining access to the user’s primary refresh token (PRT).
    1. A PRT is a secure artifact specifically issued to Microsoft first-party token brokers to enable single sign-on (SSO) across the applications used on those devices. For more information about PRT, see Microsoft’s Understanding Primary Refresh Token (PRT) in Microsoft Entra ID.
  6. Using the PRT to request access and refresh tokens for the targeted application’s owner.
    1. Access tokens are short-lived tokens issued by Entra ID that grant a client permission to access specific resources or APIs on behalf of a user.
    2. Refresh tokens are longer-lived tokens issued by Entra ID that allow a client to silently request new access tokens without requiring the user to sign in again.
  7. Using the access token to add a new client secret to the target application.
    1. A client secret is a confidential string used by the application to authenticate itself to Entra ID during token requests.
  8. Using the new client secret to request a new access token for the target application.
  9. Impersonating the application by using the access token [T1550.001] to retrieve and review target emails [T1114] via the Microsoft Graph API.

This allowed the red team to review security operations center (SOC) staff emails to see if SOC staff were aware of the compromise.

Organization A’s Response

The organization did not respond effectively to red team activity. The red team observed this during their engagement by accessing SOC personnel emails and moving laterally to SOC workstations where they captured screenshots [T1113], used keyloggers [T1056.001], and retrieved Microsoft Teams messages [T1213.005].

The red team observed that the SOC received medium- and low-severity EDR alerts related to the red team activity but did not respond to them. Thousands of false positive alerts corresponding to normal business operations, many with a higher severity, obscured the alerts triggered by red team activity.

Organizational silos further hindered detection and response. The organization had multiple SOCs and multiple EDR solutions. Staff did not communicate with staff from other SOCs or have visibility on their detection tools. SOC staff and system owners also did not communicate with each other.

This led to SOC staff not actioning alerts from red team activity. For example, red team members noted chat exchanges regarding an SCCM in which defenders tried and failed to identify the system owner, its function, and its typical use. The SOC team eventually flagged the alert as a false positive.

The red team believes this was because the SOC staff lacked standard operating procedures for escalating alerts and had limited personnel authority.

Organization B

Red Team Cyber Threat Activity

Initial Access

The CISA red team gained initial access to Organization B’s environment through a spearphishing campaign. The team gathered email addresses from public websites [T1589.002] and sent phishing emails that eventually led to three users clicking [T1204] on a malicious link, giving the red team access to three workstations.

Each payload execution generated a medium-severity alert: “An executable file loaded an unexpected DLL file.” SOC staff triaged these alerts and manually isolated all three workstations within 10, 2, and 20 minutes. This effectively terminated the team’s command and control (C2) communications with the workstations. Before staff isolated one workstation, the red team enumerated Organization B’s domain’s AD structure by executing various Lightweight Directory Access Protocol (LDAP) queries through the callback. The data gathered included all users, groups, computers, domains, GPO, and subsequent relationships for the entire domain.

Because the defenders removed their initial foothold, the red team switched to an assume breach model. Organization B’s TAs (organization IT staff who knew of the assessment and were in contact with the red team) executed a red-team-provided payload on a designated internal host. This host was associated with a standard user account with no administrative privileges, replicating the same level of access the red team would have maintained if Organization B’s defenders had not detected them.

Domain Compromise

With persistent access to the internal network, the red team searched for ways to escalate their privileges over the domain to facilitate lateral movement and access SBSs. The red team used the assume breach account to query the MAQ attribute of Organization B’s domain and discovered that all domain users were able to add accounts to the domain.

The red team created a new machine account with a hostname designed to resemble a legitimate host. The creation of the machine account provided the red team with a domain account and a password that they controlled. This allowed them to execute standalone tools from a red-team-controlled Linux workstation. The tool’s traffic was proxied through the assume breach host, circumventing restrictions imposed by host-based EDR.

The red team did not identify any escalation paths from the AD data; however, enumeration of SCCM distribution points led to the discovery of an XML file with cleartext credentials for a domain service account. AD data showed that the newly acquired service account had outbound object control over almost 1,000 accounts within the domain due to its group membership. Most notably, the service account had AllExtendedRights permission over a domain controller, which enabled the team to conduct a resource-based constrained delegation attack, granting them DCSync privileges [T1003.006] and the ability to obtain AD account credentials. The team used these credentials throughout the remainder of their assessment to access servers and workstations. One of the first accounts the red team DCSynced was the krbtgt account, which a malicious cyber actor could use to forge Golden Tickets that allow for impersonation of any user in Organization B’s domain.

Post Exploitation
Sensitive Business Systems

The TAs provided the names of two SBSs, one of which the red team successfully compromised. To do this, the team reviewed previously collected BloodHound data and identified a user account with access to an SBS web server that allowed Kerberos authentication. Because the red team had already compromised the on-premises (on-prem) AD environment, they could impersonate this user to access the server.

The team:

  1. Used DCSync to acquire the user’s AES256 password hash.
  2. Used the password hash to request a Kerberos ticket-granting ticket (TGT) for the user.
  3. Used the TGT to request a Kerberos service ticket [T1558] for the web server’s service principal name (SPN).

After requesting the Kerberos service ticket, the red team imported it into a Windows virtual machine (VM) on their infrastructure. The red team configured their VM to proxy any traffic to Organization B’s network through a SOCKS proxy that tunneled traffic through a compromised host.

Operational Technology Network

The red team wanted to gain visibility of the OT network and identify OT network subnets. To do this, they first identified an IT workstation with Remote Desktop Protocol (RDP) files, including a file named ics-[redacted]-org, signifying that the user likely had remote access to the OT network. The red team identified that the workstation had remote access to a bastion host. A bastion host—sometimes referred to as a jump box or jump server—is a specialized, highly secured system (often a server or dedicated workstation) that serves as the sole access point between a network segment (such as an internal IT network) and a protected internal network (like an OT environment).

The red team gained access to this bastion host using File Transfer Protocol (FTP) credentials to log in over Secure Shell (SSH) [T1021.004]. At this point, they had visibility over the OT network.

They attempted to gain a C2 session on the server by dropping several payload files on the host and executing them. However, the callback never reached red team infrastructure because the host blocked outbound internet connections. The payload execution triggered an alert that led SOC staff to quarantine the host.

Microsoft Entra Systems

The red team attempted to access Organization B’s cloud-based Entra ID infrastructure to find a way to move from on-prem AD to the cloud. Organization B had a hybrid environment, and user credentials automatically synchronized between on-prem AD and cloud Entra ID. Given this, the red team looked for the on-prem server responsible for synchronization.

Entra ID Connect (formerly Azure AD Connect) sets up an on-prem account with the prefix MSOL_ to synchronize credentials with Entra ID. The red team used the open source tool ADConnectDump4  to obtain cleartext credentials for the on-prem Microsoft Online (MSOL) account and the Entra ID account Sync_[redacted] [T1003]. With cleartext credentials for Sync_[redacted], the red team logged into the Azure portal. Sync_[redacted] was not intended for interactive logins and, in this case, did not have multifactor authentication (MFA) enabled. However, the red team used this account to obtain access tokens for use with AzureHound and ROADrecon to gather Entra ID data for Organization B’s tenant.

Note: The red team obtained cleartext MSOL credentials and logged into the Azure portal because MSOL accounts used to have a large number of permissions; Microsoft has since removed these permissions. See Microsoft’s Action required: MSOnline and AzureAD PowerShell retirement - 2025 info and resources and Important update: Deprecation of Azure AD PowerShell and MSOnline PowerShell modules for more information.

The interactive login from Sync_[redacted] triggered an automated alert from Microsoft, which sent the information to Organization B’s SOC staff, who then blocked the suspicious activity.

The red team identified a computer account containing AZURESSO in its name, located in the on-prem AD environment. This account is part of the Seamless SSO implementation and allows users to use Kerberos tickets as the first step in authenticating to Entra ID. To abuse Seamless SSO, the red team acquired encrypted credentials of a target user via DCSync and then used the Rubeus “asktgs” module to request service tickets used for SSO. The red team imported the service tickets to their workstation and proxied their traffic through Organization B’s network using a SOCKS proxy. This allowed them to browse to https://portal[.]azure[.]com, while using legitimate Kerberos tickets, and the traffic appeared to originate from a trusted IP address.

This approach allowed the red team to gain access to Entra ID as any user synced to AD without the user’s cleartext password. However, they could only use Kerberos tickets for the first phase of the sign-in process. If a user was set up to use MFA, then Entra ID would prompt the red team for a second factor during the sign-in process. Therefore, the red team was only able to log into any Entra ID account that did not have MFA enabled, which seemed limited to service accounts. They reviewed the previously obtained Entra ID data and looked for applications that had excessive permissions and were accessible to AD-synced service accounts.

The red team identified an application that had permission to read, write, and send emails for all users within Organization B’s tenant. The application was owned by an AD-Synced account that was disabled in AD. Using a compromised host in the on-prem environment, they re-enabled this account, DCSynced its credentials, and used the AES256 hash to request Kerberos tickets. The red team used the tickets to authenticate to Entra ID and were then able to add a client secret to the application. This gave them the ability to retrieve the emails of every user within Organization B’s environment from the public internet.

Organization B’s Response

Organization B quickly triaged and responded to alerts after the red team gained initial access, effectively terminating the team’s C2 communications with the workstations and leading the red team to move to an assume breach model. These actions demonstrated a mature, proactive security posture and helped prevent wider compromise.

When the red team gained access to a bastion host in the OT DMZ, Organization B had defensive controls that blocked outbound connections to red team infrastructure, and SOC staff quickly triaged and responded to an alert by isolating the host.

When the red team logged into the organization’s Azure portal via a compromised account, it triggered an automated alert from Microsoft, which led the staff to block the suspicious account. In addition, Organization B had custom detections Entra ID Risky User Alerts for “Unfamiliar sign-in properties” and “Suspicious API traffic” that alerted to the AzureHound user agent and to accounts exceeding predefined request thresholds to the Microsoft Graph API.

See Table 1 for Organization B’s defensive measures and associated response.

Table 1. Red Team Activity and Organization B SOC Response
Red Team Activity Defensive Measure SOC Response Outcome
C2 payload executed on a workstation. Payload execution generated a medium-severity alert. Staff quarantined workstation; staff analyzed and reimaged before putting workstation back online. Red team lost access to a workstation.
C2 payload executed on a second workstation. Payload execution generated a medium-severity alert. Staff quarantined workstation; staff analyzed and reimaged before putting workstation back online. Red team lost access to a workstation.
C2 payload executed on a third workstation. Payload execution generated a medium-severity alert. Staff quarantined workstation; staff analyzed and reimaged before putting workstation back online. Red team lost access to a workstation.
C2 payload executed on bastion host in the OT DMZ. Payload execution generated alerts. Staff quarantined the host. Red team lost access to the host.
Used compromised Entra ID account to log into Azure. Automated alert from Microsoft. Staff blocked the account. Red team compromised a different account and accessed Entra ID by abusing Seamless SSO.

Despite these strengths, Organization B had areas for improvement. The red team was eventually able to access Entra ID through a computer account that was part of the organization’s Seamless SSO implementation. The account did not have MFA and had overly permissive application permissions, indicating the need for more mature cloud security processes.

Additionally, Organization B had excessive permissions and misconfigurations in AD and service accounts, which the red team leveraged for privilege escalation. This highlights the importance of regular audits and strict enforcement of least privilege principles. Organization B could improve credential hygiene, as the red team found credentials for OT systems stored in plaintext on jump servers. Finally, while segmentation and egress controls were effective, ongoing review and tightening of IT/OT connectivity and access architectures would reduce opportunities for lateral movement.

Lessons Learned

The red team identified lessons learned based on each organization’s response. Organization A and Organization B contrasted significantly in their ability to quickly identify and respond to red team activity. However, similar gaps in both organizations contributed to the red team’s compromise of their cloud systems.

Untuned Detection Tools Lead to Missed Threats

Organization A did not tune their detection tools to reduce alert noise, leading to an unmanageable level of alerts for SOC staff to review and action. The same red team activity that triggered alerts and action for Organization B led to no response for Organization A because SOC staff did not identify the activity as potentially malicious amid the overwhelming volume of alerts. Organization B had an established baseline and a fine-tuned alert system, allowing defenders to effectively filter out routine business activity and false positives. As a result, anomalies stood out, enabling the SOC staff to quickly detect and respond to red team activity.

Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm defenders, obscuring real threats. Organizations that tune alerts to highlight anomalies and filter out normal business activity enable defenders to focus on genuine incidents and respond rapidly.

Organizational Silos and Bureaucratic Hurdles Prevent Effective Incident Response

In Organization A, lack of communication and visibility created by organizational silos (among multiple SOCs and between SOC staff and system owners) hindered effective incident response, resulting in missed opportunities for identification of a major breach.

Bureaucratic barriers arose because SOC staff managed systems without understanding their authorities as responsibilities and authorities varied across network segments. They had no escalation procedures and so defaulted to a “wait and see” approach.

In contrast, Organization B empowered its defenders to act decisively. Staff quickly triaged alerts, investigated root causes, identified misconfigurations, and coordinated remediation with engineering.

Detection tools are only as effective as the people, processes, and procedures supporting them. SOC staff should not operate in silos and should have clear authority unhindered by bureaucracy to effectively contain and resolve incidents.

Organizations Underestimate Risks in Cloud Environments

Both organizations underestimated the risks associated with cloud environments. They granted excessive permissions to cloud applications, allowing the red team to access cloud systems. They also lacked fully mature, defined processes for detecting and remediating compromise of cloud environments, allowing the red team to maintain access to cloud resources.

Use of Long-Lived User Identity and Access Management Credentials

Organization A used long-lived static IAM user credentials that were set to never expire. If a malicious actor obtains them, they will have all the user permissions, potentially enabling persistent, unrestricted access to the cloud environment.

Excessive Permissions

Both organizations lacked Conditional Access for workload identities. This feature extends Conditional Access beyond user accounts, covering non-human identities, such as applications. It allows organizations to broadly apply access policies to applications that control how and when the application is used to access resources. Instead, both organizations used broad application permissions for most apps, which the team was able to exploit for access to the environment. In both organizations, the team was able to exploit excessive permissions to read emails.

Lack of Mature Remediation Processes for Tokens

Both organizations lacked processes for revoking compromised access/refresh tokens. Without a well-defined, efficient process for remediating and revoking access/refresh tokens following a cloud compromise, malicious cyber actors evicted from on-prem environments may still leverage cloud access to regain entry. Organizations should establish mature procedures to detect and remediate compromises of cloud environments to prevent malicious cyber actors from reestablishing access.

Issues

The red team identified the following issues that contributed to their ability to maintain persistent access to Organization A and/or B and escalate privileges or move laterally:

  • Misconfigured ADCS templates.
    • In Organization A, the red team identified and exploited a certificate template with common template misconfiguration known as ESC1, an overly permissive certificate template where the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is enabled and low-privileged users can request certificates. This allows malicious actors to impersonate users. See SpecterOp’s Certified Pre-Owned: Abusing Active Directory Certificate Services for information about the ESC1 misconfiguration.
  • Workstations where MAQ was misconfigured.
    • In Organization A, the team gained access to a workstation where the MAQ was set to the default value of 10. This meant that unprivileged users could add up to 10 computer accounts to the domain.
    • In Organization B, the MAQ was set to 1,000 for all domain users, allowing any user to create a large number of machine accounts.
  • Service accounts with excessive permissions.
    • In Organization B, the red team identified a domain service account with AllExtendedRights permission over a domain controller. AllExtendedRights enables malicious cyber actors to perform DCsync attacks and potentially impersonate any account in the domain, leading to full domain compromise.
  • Cleartext credentials.
    • In Organization A, the red team found and used cleartext credentials to obtain administrative access to SBSs.
    • In Organization B, the red team identified a cleartext password in an XML file for a domain service account.
  • Endpoint management systems that lacked additional security controls.
    • In Organization A, the red team moved laterally from the SCCM server to users’ workstations. SCCM and other endpoint configuration managers (e.g., Jamf, BigFix) have broad administrative reach and are Tier 0 assets. If compromised, Tier 0 assets provide malicious actors with powerful escalation paths and control over the enterprise.

The red team identified an additional issue that was not exploited during the assessment but could be exploited by malicious cyber actors:

  • AD misconfigurations and user accounts with excessive permissions.
    • In Organization B, the red team discovered that standard user accounts were improperly assigned to privileged administrative groups within the AD.

MITRE ATT&CK Tactics and Techniques

See Table 2 to Table 11 for all referenced threat actor tactics and techniques in this advisory.  For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 2. Reconnaissance
Technique Title ID Use
Gather Victim Identity Information: Credentials T1589.001 The red team performed reconnaissance and identified a web application with default credentials.
Gather Victim Identity Information: Email Addresses T1589.002 The red team performed reconnaissance and gathered employee email addresses from public websites.
Table 3. Resource Development
Technique Title ID Use
Obtain Capabilities: Tool T1588.002 The red team used publicly available tools, including AzureHound and ROADrecon.
Table 4. Initial Access
Technique Title ID Use
Phishing T1566

The red team gained initial access to four Organization A workstations by sending phishing emails from an internal email address.

The red team gained initial access to three Organization B workstations via spearphishing emails that eventually led users to click on a malicious payload.
Table 5. Execution
Technique Title ID Use
User Execution T1204 The red team’s spearphishing emails eventually led to users clicking on a malicious payload.
Table 6. Persistence
Technique Title ID Use
Create Account: Domain Account T1136.002 The red team exploited misconfigured MAQs to create machine accounts on a workstation.
Table 7. Credential Access
Technique Title ID Use
Unsecured Credentials T1552

The red team located cleartext credentials on an administrative user’s workstation.

The red team used the open source tool ADConnectDump to obtain cleartext credentials for cloud accounts.
Unsecured Credentials: Credentials In Files T1552.001

The red team searched a targeted user’s workstations for connections.json and product-preferences.xml files for a SQL Developer tool. They then decrypted these files to obtain cleartext password to the database.

The red team acquired long-lived static AWS IAM user credentials in configuration files in users’ home directories.
OS Credential Dumping T1003 The red team obtained cleartext credentials for an on-prem MSOL account and Entra account.
OS Credential Dumping: DCSync T1003.006 The red team used DCSync to obtain AD account credentials.
Steal or Forge Authentication Certificates T1649 The red team could obtain certificates for any Organization A user account. This provided the means for lateral movement.
Steal or Forge Kerberos Tickets T1558

The red team used a Kerberos TGT to request a Kerberos service ticket for a web server’s SPN.

The red team used the Rubeus “asktgs” module to request service tickets used for SSO.
Table 8. Discovery
Technique Title ID Use
Account Discovery: Domain Account T1087.002 The red team used a BloodHound collector to query and scrape AD information, including AD users.
Remote System Discovery T1018 The red team used a BloodHound collector to query and scrape AD information, including computers.
Permission Groups Discovery: Domain Groups T1069.002 The red team used a BloodHound collector to query and scrape AD information, including groups.
Group Policy Discovery T1615 The red team used a BloodHound collector to query and scrape AD information, including GPOs.
System Owner/User Discovery T1033 The red team queried SCCM servers to enumerate user-device relationships and identify the workstations assigned to users.
Cloud Service Discovery T1526 The red team used publicly available tools to obtain a list of Entra applications, their permissions, and their owners.
Table 9. Lateral Movement
Technique Title ID Use
Use Alternate Authentication Material: Application Access Token T1550.001 The red team used an application access token to access and review cloud emails.
Remote Services: SSH T1021.004 The red team used FTP credentials to log into a bastion host over SSH.
Table 10. Collection
Technique Title ID Use
Email Collection T1114

The red team reviewed Organization A SOC staff cloud emails to see if SOC staff were aware of the compromise.

The red team had the ability to retrieve the emails of every user within Organization B’s environment from the public internet.
Screen Capture T1113 The red team took screenshots of SOC staff workstations.
Input Capture: Keylogging T1056.001 The red team used keyloggers on SOC staff workstations.
Data from Information Repositories: Messaging Applications T1213.005 The red team pulled Microsoft Teams messages from SOC staff workstations.
Table 11. Command and Control
Technique Title ID Use
Proxy: Internal Proxy T1090.001 The red team proxied through compromised workstations.

Mitigations

CISA recommends that organizations implement the mitigations below to strengthen their cybersecurity posture based on the Lessons Learned and identified Issues. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

Establish Baselines and Improve Monitoring

  • Establish and continuously maintain a baseline of installed tools and software, account behavior, and network traffic.
  • Reduce alert noise by refining monitoring tools and alerting mechanisms to differentiate between typical administrative actions and potential threat behavior.

Eliminate Silos and Bureaucratic Hurdles

  • Break down silos by encouraging regular communication and collaboration between IT, security, and business units.
    • Consider using joint exercises, shared tools, and creating cross-functional teams.
    • Integrate detection with incident response workflows to enable rapid containment and remediation.
  • Empower network defenders.
    • Develop and communicate policies [CPG 1.A, CPG 1.B] that support rapid, coordinated response and clarify when defenders can act independently versus when escalation is required.
      • Define clear roles and responsibilities so defenders know their authorities and escalation paths (if needed) during incidents.
      • Grant defenders the authority to take necessary actions (e.g., isolating systems, blocking traffic) without excessive approvals.
    • Conduct training and simulated incident response exercises to reinforce roles, improve coordination, and identify gaps in authorities or communication [CPG 6.A].

Enhance Cloud Security Controls

Note: While both organizations used Microsoft Entra ID and Organization B also used AWS, many of the techniques used by the red team are applicable across identity providers and cloud environments and not necessarily unique to Microsoft and AWS. CISA encourages all organizations using cloud environments to implement the recommendations below.

  • Secure and monitor access/refresh tokens and establish and regularly review comprehensive procedures for detecting, remediating, and revoking access/refresh tokens in the event of a cloud compromise.
    • Implement automated token revocation and access reviews and conduct periodic incident response exercises to validate the effectiveness of these processes.
    • Restrict access based on trusted network locations, device compliance, and risk signals (such as unusual activity or sign-in patterns).
    • Monitor sign-in logs and policy evaluation results for workload identities to detect suspicious activity.
    • Regularly check application permissions; make a risk-informed decision to identify and remove any that are not necessary, so each application only has the access it needs to function.
    • Regularly audit SP credentials and rotate secrets or certificates to reduce exposure.
  • Identify and disable legacy accounts.
  • Enable phishing-resistant MFA for all user, administrative, and privileged accounts in cloud platforms [CPG 3.F].
  • Protect keys and secrets by storing them securely and enforcing mandatory rotation schedules; apply cryptographic boundary controls to internal and third-party credentials.
  • Set up automated alerts for suspicious cloud application activity, such as abnormal API calls, and credential activity, such as login attempts from unusual locations.
  • Leverage user and entity behavior analytics to analyze and correlate activities across multiple data sources and identify unusual credential or token usage.
  • Continuously audit authentication and access logs for signs of replay or unauthorized access.
  • Implement just-in-time (JIT) access for privileged accounts, replacing standing administrative rights with temporary, time-bound privilege elevations.

For organizations using Entra ID:

  • Monitor and control who has access to application identities.
  • Integrate Entra ID tenant monitoring with on-prem security operations to promptly identify suspicious activity.
  • Regularly review and restrict application permissions (e.g., Mail.Read, Files.Read.All).
    • For guidance, see CISA’s Secure Cloud Business Applications (SCuBA) Project, which provides secure configuration baselines for Microsoft 365 (M365), including Microsoft Entra ID.
    • Use CISA’s ScubaGear, a no-cost assessment tool that verifies M365 tenant configuration alignment to the policies described in SCuBA’s secure configuration baselines.
  • Use certificate-based authentication certificates for application authentication instead of client secrets, when possible. See Microsoft’s Set Up Microsoft Entra CBA - Microsoft Entra ID.
  • Review newly created secrets and/or certificates on existing applications.
  • Limit secret lifetimes to a reasonable lifetime.

In AWS environments:

  • Mitigate the risks of long-lived IAM user credentials.
    • Identify and audit all existing access keys and disable/delete unused or unnecessary keys.
  • Require human users to use temporary AWS credentials through SSO.
  • Regularly review the environment to verify no long-lived credentials remain.

Secure Active Directory and Manage Credentials

  • Apply secure configurations to ADCS implementations.
    • Disable the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag from templates to prevent users from supplying and editing sensitive security settings within these templates.
    • Restrict accounts that can enroll in all certificate templates to only those necessary, especially templates with the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag.
    • Remove FullControl, WriteDacl, and Write property permissions from low-privileged groups, such as domain users, to certificate template objects, where such permissions are not needed.
    • Enforce manager approval for requested certificates.
    • Apply additional guidance from CISA’s joint Guidance Detecting and Mitigating Active Directory Compromises (see Mitigating AD CS compromise, pages 15–16).
  • Configure the MAQ to zero unless there is a specific operational need for non-administrative users to create computer accounts; this prevents standard user accounts from creating new machine accounts, reducing opportunities for malicious cyber actors to abuse this privilege.
    • If some standard user accounts need to create computer accounts, set MAQ to the lowest possible value and restrict this capability to only users or groups with a business justification.
  • Improve credential hygiene.
    • Scan network shares and workstations for plaintext credentials and remove any found.
    • Train staff on secure password storage practices and enforce policies prohibiting plaintext password storage.
    • Use encrypted password vaults for storing credentials and limit access to only those who require it.
    • Periodically audit credential stores and access logs for signs of misuse.
  • Periodically audit AD permissions for misconfigurations and excessively privileged groups and accounts.
    • Implement the principle of least privilege [CPG 3.H].
    • Grant standard user rights for standard user tasks such as email, web browsing, and using line-of-business applications.
    • Periodically audit standard user accounts and minimize privileged access.
    • Periodically audit AD permissions to verify that standard user accounts do not have excessive permissions and have not been added to admin groups.
    • Evaluate which administrative groups should administer specific servers and workstations.
    • Separate administrator accounts from standard user accounts [CPG 3.G].
      • Use designated workstations for administrators and standard users and prevent administrators from using admin workstations for non-admin purposes; this would reduce impact of credential theft from a user workstation.
      • Use designated administrative accounts exclusively for admin purposes.
      • If a standard user account needs administrative rights over their workstation, use a separate account that does not have administrative access to other hosts, such as servers.
    • Consider using a privileged access management (PAM) solution to manage access to privileged accounts and resources.
      • PAM solutions can log and alert usage to detect unusual activity, which could have alerted the assessed organizations when the red team accessed resources with admin accounts.
      • Note: Treat password vaults associated with PAM solutions as high value assets (HVAs) with additional restrictions and monitoring.
    • Configure time-based access for accounts set at the admin level and higher.
      • The just-in-time access method provisions privileged access when needed and can support enforcement of the principle of least privilege, as well as the zero trust model. A network-wide policy automatically disables administrator accounts at the AD level when the account is not needed. When standard user accounts need administrative access, they submit their requests through an automated process that enables access to a system, but only for a set timeframe to support task completion.

Secure Endpoint Configuration Managers

  • Treat endpoint management systems (such as SCCM) as HVAs with additional restrictions and monitoring because they provide elevated access to thousands of hosts.

Segment Operational Technology Networks

  • Implement strict firewall rules and access controls between IT and OT environments [CPG 3.I].
  • Limit jump server access to OT networks and require MFA for all connections.
  • Regularly review OT network architecture and access paths to minimize unnecessary connectivity.
  • Monitor OT network traffic for signs of lateral movement or unauthorized access.
  • Implement change management solutions to track and restrict modifications to OT components.

Validate Security Controls

In addition to applying mitigations, CISA recommends exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK Matrix for Enterprise framework in this advisory. CISA recommends testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

To get started:

  1. Select an ATT&CK technique described in this advisory (see Table 2 to Table 11).
  2. Align your security technologies against the technique.
  3. Test your technologies against the technique.
  4. Analyze your detection and prevention technologies’ performance.
  5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
  6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

CISA recommends continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Resources

Contact Information

Organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). When available, please include the following information regarding the incident:

  • Date, time, and location of the incident;
  • Type of activity;
  • Number of people affected;
  • Type of equipment used for the activity; and
  • Name of the submitting company or organization, and a designated point of contact.

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

Version History

August 25, 2026: Initial version.

Notes

1 “SpecterOps / Bloodhound,” GitHub, last modified July 15, 2026, https://github.com/SpecterOps/BloodHound.

2 “SpecterOps / AzureHound,” GitHub, last modified June 4, 2026, https://github.com/SpecterOps/AzureHound.

3 “ROADrecon,” GitHub, https://github.com/dirkjanm/ROADtools/tree/master/roadrecon.

4 “dirkjanm/adconnectdumb,” GitHub, last modified August 25, 2026, https://github.com/dirkjanm/adconnectdump.

Defending Against an Active Threat to Siemens S7 Series PLCs

✇CISA Alerts
By: CISA
14 August 2026 at 22:06

Executive summary

Note: This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape.

Top Mitigations

  • Inventory all Siemens S7 Series programmable logic controllers (PLCs)
  • Apply critical security patches 
  • Ensure PLCs are not accessible from the Internet
  • Strengthen access controls
  • Monitor for unauthorized activity
  • Harden PLC services, protocols, and ladder logic integrity 
  • Hunt for anomalies that may indicate a compromise

The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA)—hereafter referred to as the authoring agencies—are releasing this Cybersecurity Advisory to warn owners and operators of industrial control systems (ICSs) of an active cyber threat to Siemens S7 Series PLCs and provide relevant mitigations to protect and defend them. 

The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected. The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk—it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems. 

The authoring agencies urge all owners and operators of operational technology (OT) systems using Siemens S7 Series and other PLC devices to proactively check their systems:

  • are properly protected with all applicable security patches and updates, 
  • are isolated from the Internet wherever possible, 
  • have strong access controls, and 
  • employ security tooling to monitor ICS environments for anomalous or malicious activity.

These mitigations are particularly important for owners and operators who work with third-party service providers or system integrators who may have remote access to PLCs, as the asset owners may not realize that their systems are exposed and at risk.

Technical details

Note: This advisory uses the MITRE ATT&CK® Matrix for ICS1 framework, version 19, and the MITRE ATT&CK Matrix for Enterprise framework, version 19. This advisory also uses MITRE D3FENDTM, version 1.5.0. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and MITRE D3FEND tactics, techniques, and countermeasures.

Threat actor targeting

Threat actors are actively targeting the following Siemens PLC models:

  • S7-200 Series (all CPU variants)
  • S7-300 Series (all CPU variants including 314, 315, 317 models)
  • S7-400 Series (all CPU variants)
  • S7-1200 Series (CPU 1211C, 1212C, 1214C, 1215C, 1217C variants)
  • S7-1500 Series (all CPU variants, including F-series safety controllers)

Threat actors are using AI assistance to generate exploitation scripts using publicly available information on these Siemens S7 Series PLCs for initial access, credential access, denial of service, and other objectives. If these PLCs are exposed to the Internet or insufficiently segmented, then threat actors can exploit various critical and high severity known vulnerabilities in these PLCs.

Note: Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools. In addition, AI enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures. Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use AI-generated scripts to act on that information. If PLCs are exposed to the Internet, they are at high risk for exploitation. 

Threat actors are leveraging open source industrial automation libraries—specifically snap7.dll/python-snap7—combined with AI-assisted scripting to create custom tools that mimic legitimate OT monitoring solutions. These tools provide read/write access to Siemens S7 Series PLC memory, configuration data, and ladder logic programs via the S7comm protocol.

Threat actor techniques

Threat actors are:

  • Using Internet scanning services (e.g., Censys, ZoomEye) to identify Internet-exposed or insufficiently segmented Siemens S7 Series PLCs [T1596.005]
  • Rapidly iterating exploit code through AI-assisted development, lowering technical barriers to ICS attacks [T1587.004, T1588.007]
  • Taking advantage of insecure credentials to access exposed devices that have unconfigured (default) or minimally configured authentication [T1694]
  • Deploying AI-generated Python scripts that incorporate the snap7.dll library from public repositories [T0834] to gain read/write access to the PLC and mimic legitimate tools
  • Masquerading malicious scripts as legitimate monitoring tools to evade detection by security teams [T0849]
  • Conducting read/write operations on data blocks, potentially for reconnaissance, capability testing, or pre-positioning for effects operations [T0893, T0821]

The authoring agencies assess this activity pattern is likely intended as persistent reconnaissance in targeted sectors and facilities to develop capabilities and prepare to cause operational effects against critical infrastructure. For capability development, actors are testing and refining their exploitation techniques against specific PLC models to improve their ability to compromise the PLCs. To prepare for operational effects, actors are leveraging read access to understand target environments, enabling preparation and positioning for future write operations to cause disruption or other operational impacts.

Potential operational impacts

The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. Additionally, Siemens S7 Series PLCs are used in other sectors, including the Defense Industrial Base (DIB), and could be targeted there as well. Unauthorized access to PLCs could result in:

  • Disruption of critical industrial processes affecting production throughput, product quality, and public services
  • Safety incidents affecting personnel through manipulation of safety interlocks, emergency shutdown systems, or process parameters
  • Equipment damage and extended operational downtime from process upsets, improper sequencing, or forced equipment operation outside design parameters
  • Compromise of sensitive operational data, including proprietary process recipes, control strategies, and facility configurations
  • Cascading impacts across interconnected systems affecting supply chains, dependent facilities, and integrated business operations
  • Regulatory compliance violations and potential liability from process safety management failures

Mitigation actions

Since threat actors are developing capabilities using AI to compromise PLCs using known vulnerabilities, misconfigurations, and other weaknesses and then may use compromised PLCs to interfere with normal operations, the authoring agencies urge organizations to implement comprehensive defense-in-depth strategies, in addition to Common Vulnerabilities and Exposures (CVE) remediation, to protect and defend their PLCs.

Detection opportunities

Organizations should implement detection strategies and hunt for anomalies that may indicate a compromise, focusing on [D3-PM]:

  • Anomalous S7comm behavior: Connections from non-engineering workstations, unusual data block access patterns, or write operations outside change windows
  • Reconnaissance indicators: Sequential IP scanning on port 102, repeated connection attempts with varying parameters, or enumeration of CPU properties
  • Tool artifacts: Snap7.dll library usage outside approved engineering workstations, Python scripts with S7comm functionality, or unauthorized monitoring software installations
  • Temporal anomalies: S7comm activity during off-hours, unexpected connection patterns consistent with automated scripting rather than human operators, or configuration changes without corresponding work orders or change tickets
  • Geographic anomalies: Connections originating from unexpected countries or IP ranges not associated with vendors or integrators

Preventative hardening actions

To counter threats to PLCs, the authoring agencies recommend all PLC owners and operators follow the mitigations in joint guidance Primary Mitigations to Reduce Cyber Threats to Operational Technology.

To harden Siemens S7 Series PLCs, the authoring agencies strongly urge all owners implement the hardening steps below. Entities that rely on systems integrators or third-party managed service providers should share this advisory with those parties and request implementation of the following mitigations:

1. Conduct an immediate inventory of all Siemens S7 Series PLCs in your environment [D3-HCI]:

  • Verify current firmware versions for all S7-200, S7-300, S7-400, S7-1200, and S7-1500 controllers against backup gold copy
  • Identify any systems directly or indirectly accessible from untrusted networks
  • Map all engineering workstations with Totally Integrated Automation (TIA) Portal, STEP 7, or S7 programming access

2. Apply critical security patches as soon as possible [D3-SU]:

  • Update Siemens S7 Series PLC firmware to the latest versions that address known vulnerabilities
  • Prioritize Internet-facing or demilitarized zone (DMZ)-resident controllers
  • Update TIA Portal and STEP 7 software to current versions
  • Consult Siemens ProductCERT advisories for information on known vulnerabilities, along with relevant workarounds and mitigations
  • Test all updates in a development environment before production deployment

3. Verify network segmentation and ensure PLCs are NOT accessible from the Internet [D3-NI]:

  • Audit firewall rules for any exposed S7comm services (Transmission Control Protocol [TCP] port 102)
  • Block TCP port 102 at perimeter firewalls entirely
  • Implement a DMZ architecture that separates OT and IT networks
  • Deploy unidirectional gateways for data historian connections where appropriate
  • Verify there is no unauthorized routing between corporate and industrial networks

4. Review and strengthen access controls [D3-NAM, D3-CH]:

  • Restrict TIA Portal/STEP 7 access to authorized engineering workstations only by MAC/IP allowlisting on PLCs
  • Enable PLC password protection on all Siemens S7 Series controllers 
  • Configure protection levels (such as write protection and read/write protection) on Siemens S7 Series devices
  • Remove or change default SNMP community strings
  • Implement application allowlisting on all engineering workstations
  • Enable multi-factor authentication for all remote access to OT networks

5. Enable comprehensive logging and monitoring [D3-PM, D3-NTA]:

  • Deploy ICS-aware intrusion detection (e.g., Claroty, Dragos Platform, Nozomi Networks, or similar)
  • Monitor all S7comm traffic on TCP port 102 for connections outside maintenance windows
  • Alert on unauthorized PUT/GET operations, especially write commands to data blocks or configuration areas of memory
  • Log all TIA Portal/STEP 7 connections to PLCs with timestamps and source IPs
  • Establish a baseline for legitimate behavior and configure monitoring tools to alert on deviations
  • Monitor for Python processes with snap7.dll library imports on engineering workstations
  • Watch for sequential IP scanning patterns or block reads of configuration data

6. Implement S7-specific hardening measures [D3-ACH]:

  • Disable web servers on Siemens S7 Series devices if not operationally required
  • Disable unused communication protocols (such as Modbus TCP and PROFINET, if they are not required)
  • Configure connection resources to limit simultaneous S7comm sessions
  • Enable TIA Portal/STEP 7 “complete restart protection” and “know-how protection” features where available
  • Evaluate for ladder logic changes in online/offline modes

7. Contact Siemens for model-specific guidance:

  • Engage Siemens Technical Support for hardening recommendations specific to your CPU models and firmware versions
  • Verify patch compatibility with your specific operational environment and third-party integrations
  • Request assistance with protection level configuration and access control implementation

Conclusion

There is an active threat targeting Internet-exposed Siemens S7 Series PLCs. The combination of known vulnerabilities, accessible exploitation libraries, and AI-assisted development creates a high-probability attack scenario against inadequately protected PLC installations. Organizations should treat this Cybersecurity Advisory with urgency and coordinate response efforts across security, engineering, executive leadership, plant operations, and vendor support teams to implement the recommended detection and hardening actions.

Resources

Incident reporting 

U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA and/or the FBI. Contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). File a claim with FBI’s Internet Crime Complaint Center (IC3) or contact your local FBI field office. When available, please include the following information regarding the incident: 

  • Date, time, and location of the incident;
  • Type of activity;
  • Number of people affected;
  • Type of equipment used for the activity; and
  • Name of the submitting company or organization, and a designated point of contact.

Entities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact EnergySRMA@hq.doe.gov.

In addition, consider contacting Siemens ProductCERT via https://www.siemens.com/cert or email productcert@siemens.com. 

Disclaimer of endorsement
The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

Purpose
This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Contact
Cybersecurity Report Feedback: CybersecurityReports@nsa.gov

Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov

Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov

Contact Siemens ProductCERT for up-to-date information about the security of Siemens products or to report cybersecurity vulnerabilities at productcert@siemens.com. For support with increasing the security of installed Siemens PLCs, contact Siemens Industrial Cybersecurity Services at services.automation@siemens.com. See Siemens ProductCERT and Siemens CERT for more information.

Appendix A: MITRE ATT&CK tactics and techniques

See Table 1 for the threat actor tactics and techniques referenced in this advisory.

Table 1: MITRE ATT&CK tactics and techniques

Tactic

Technique Title

ID

Use
Reconnaissance Search Open Technical Databases: Scan Databases T1596.005 Using Internet scanning services to identify Internet-exposed or poorly segmented Siemens S7 Series PLCs
Resource Development Develop Capabilities: Exploits T1587.004 Developing exploits for known Siemens S7 Series PLC vulnerabilities
Resource Development Obtain Capabilities: Artificial Intelligence T1588.007 Rapidly iterating exploit code through AI-assisted development
Execution Native API T0834 Deploying AI-generated Python scripts incorporating the snap7.dll library
Execution Modify Controller Tasking T0821 Conducting write operations on data blocks, potentially for pre-positioning for effects operations
Evasion Masquerading T0849 Masquerading as legitimate monitoring tools to evade detection
Lateral Movement Insecure Credentials T1694 Accessing exposed devices that have unconfigured (default) or minimally configured authentication
Collection Data from Local System T0893 Conducting read operations on data blocks, potentially for reconnaissance

Appendix B: MITRE D3FEND countermeasures

See Table 2 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.

Table 2: MITRE D3FEND Countermeasures

Countermeasure Title

ID

Description
Hardware Component Inventory D3-HCI Conduct an immediate inventory of all Siemens S7 Series PLCs
Software Update D3-SU Apply critical security patches as soon as possible
Network Isolation D3-NI Verify network segmentation and ensure PLCs are not accessible from the Internet
Network Access Mediation D3-NAM Restrict TIA Portal/STEP 7 access to authorized engineering workstations only via MAC/IP allowlisting on PLCs
Credential Hardening D3-CH
  • Enable PLC password protection on all S7 controllers
  • Enable multi-factor authentication for all remote access to OT networks
Platform Monitoring D3-PM
  • Deploy ICS-aware intrusion detection
  • Alert on unauthorized PUT/GET operations
  • Monitor for unexpected behavior deviations
  • Monitor for snap7.dll library imports
  • Hunt for indicators of compromise
Network Traffic Analysis D3-NTA
  • Alert on unexpected S7comm traffic on TCP port 102 
  • Watch for sequential IP scanning patterns
Application Configuration Hardening D3-ACH
  • Disable unused web servers and protocols
  • Remove SNMP community strings
  • Watch for ladder logic changes

Notes

1 MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of the MITRE Corporation.

#StopRansomware: Gunra Ransomware

✇CISA Alerts
By: CISA
5 August 2026 at 14:27

Advisory at a Glance

Title #StopRansomware: Gunra Ransomware
Original Publication August 10, 2026
Executive Summary Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid. This advisory provides technical details of the activity, as well as tailored detection and mitigation guidance to protect at-risk organizations from Gunra.
Key Actions
  • Prioritize patching known exploited vulnerabilities in internet-facing systems, including virtual private network (VPN) gateways and remote desktop protocol (RDP)-exposed infrastructure.
  • Implement and test offline, immutable backups stored in a physically separate, segmented location to ensure recoverability without ransom payment.
  • Segment networks to restrict lateral movement from an initially compromised device to other systems in the organization.
Indicators of Compromise

For a downloadable copy of indicators of compromise, see:
Intended Audience

Organizations: Government, Critical Infrastructure

Sectors: Healthcare and public health, financial services and insurance, critical manufacturing and construction, transportation systems and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit services.

Roles: Cybersecurity architects, defensive cybersecurity analysts, vulnerability analysts, systems administrators, and security systems managers.

Introduction

Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Defense Cyber Crime Center (DC3), National Security Agency (NSA), U.S. Secret Service (USSS), and Republic of Korea’s National Police Agency (KNPA)—hereafter referred to as “the authoring agencies”—are releasing this joint advisory to alert organizations to the emerging Gunra ransomware threat and to provide detection and mitigation guidance.

Gunra first emerged in April 2025 as a sophisticated double-extortion ransomware variant derived from the leaked Conti1 ransomware source code. As of early 2026, Gunra expanded its operations through a structured ransomware-as-a-service (RaaS) affiliate program advertised on dark web forums to financially motivated cybercriminals. Gunra actors demand ransom via a customized, Tor-based negotiation portal and threaten to publish exfiltrated data on a dedicated leak site (DLS) if victims do not comply.

Gunra victims observed on the actors’ DLS span organizations across multiple sectors in the Americas, Europe, Middle East, Africa, and the Asia-Pacific.2 These sectors include:

The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to mitigate cyber threats related to Gunra ransomware, including:

  • Prioritizing patching known exploited vulnerabilities in internet-facing systems, including virtual private network (VPN) gateways and remote desktop protocol (RDP)-exposed infrastructure.
  • Implementing and testing offline, immutable backups stored in a physically separate, segmented location to ensure recoverability without ransom payment.
  • Segmenting networks to restrict lateral movement from an initially compromised device to other systems in the organization.

Download the PDF version of this report:

For a downloadable copy of IOCs, see:

AA26-222A STIX XML (XML, 54.18 KB )
AA26-222A STIX JSON (JSON, 61.00 KB )

Technical Details

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 19.1. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

Overview

The FBI originally observed Gunra ransomware in April 2025. The threat actors quickly established a DLS on the Tor network to list victims and publish exfiltrated data. As of January 2026, Gunra launched a formal RaaS affiliate program on dark web forums, providing affiliates with access to a management panel, a configurable ransomware builder, cross-platform locker payloads, and structured affiliate documentation.3  The FBI observed the group adopting new branding aliases (notably operating under the name Golden Community) to support this expansion. Gunra has further commercialized its platform by actively recruiting penetration testers and ethical hackers to serve as initial access brokers, offering a share of the ransom profits in exchange for enterprise network access.

Based on FBI observations, Gunra actors use a traditional double-extortion model, exfiltrating sensitive victim data prior to encryption and threatening to publish the leaked data on their DLS unless the ransom is paid. Victims receive a ransom note in every affected directory guiding them to a Tor-based negotiation portal where they are assigned a Client ID and an initial password. Subsequently, victims receive instructions to contact the Gunra actors via qTox (an encrypted messaging application) to negotiate ransom payments within five to seven days. If the ransom is not paid, Gunra actors threaten to sell victim data on the DLS.

Gunra ransomware appears to be based on, or significantly influenced by, the Conti ransomware source code leaked in 2022.4 Initially, Gunra actors’ campaigns focused on Windows environments; reporting in mid-2025 indicated the group introduced a Linux variant and moved toward broader cross-platform targeting.5 

Initial Access

The FBI observed Gunra actors obtaining initial access [TA0001] primarily through the exploitation of known vulnerabilities in internet-facing devices [T1190], including firewall and VPN appliances. The FBI observed exploits based on the following Common Vulnerabilities and Exposures (CVEs):

Additionally, for initial access, KNPA observed Gunra actors exploit credential-exposure and Secure Shell (SSH) access control vulnerabilities in internet-facing VPN gateways to gain unauthorized remote access.

Execution

Gunra’s Windows encryptor relies on native operating system (OS) application programming interfaces (APIs) to drive both execution and targeted encryption activity. The binary uses the FindFirstFileW/FindNextFileW API calls [T1106] to enumerate files and directories on all accessible drive letters (A through Z), enabling comprehensive traversal of the file system prior to encryption of victim data.

Persistence, Privilege Escalation, Lateral Movement, and Command and Control

Gunra actors regularly exploit Impacket libraries psexec.py and smbclient.py to move laterally across victim networks using the Server Message Block (SMB) protocol [T1021.002].

KPNA observed that against one victim, Gunra actors gained access to an administrator account for a secure socket layer (SSL)-VPN appliance [T1133] by exploiting default credentials when account lockout controls were not present [T1078.001][T1078.002]. The actors subsequently downloaded OpenSSH (an SSH tunneling tool) [T1105] from an external attacker-controlled server to establish connections between compromised systems and maintain persistence in the victim’s environment [T1572].

After gaining access to an internet-connected workstation used by a network administrator, Gunra actors accessed the SSL-VPN administrative web console and identified an unused account that had access to both the internet-facing and internal corporate networks. The actors modified the account configuration to bypass the mandatory password change requirement enforced on the account and subsequently leveraged it for malicious activities [T1098].

Using stolen session information, Gunra actors gained initial access to the internal virtual desktop infrastructure (VDI) environment and conducted lateral movement via RDP [T1021.001]. The actors pivoted to multiple critical systems, including the VDI authentication web server, the internal Active Directory (AD) server, and virtual desktops assigned to IT personnel.

Credential Access

The FBI observed multiple instances of Gunra actors using secretsdump.py (another Impacket library) to conduct OS credential dumping [T1003.003] against compromised domain controllers to extract password hashes of user accounts from the NT Directory Services (NTDS) file. This enabled pass-the-hash [T1550.002] or pass-the-ticket [T1550.003] attacks for lateral movement into other privileged systems.

For one victim, Gunra actors manipulated the network traffic control functionality of an SSL-VPN appliance to collect credentials and session information transmitted by users authenticating to a corporate VDI authentication portal [T1040]. The actors then used stolen session cookies to conduct session hijacking [T1539], impersonating legitimate users to gain access to the internal network.

For the same victim, the Gunra actors modified authentication processing files on the corporate VDI authentication portal server to allow successful authentication when a specific, Gunra-designated one time password (OTP) value was entered, thereby enabling the continuous bypass of multi-factor authentication (MFA) [T1556.006].

Additionally, the actors accessed a Hiware system access control server via SSH from a compromised virtual desktop and stole a symmetric encryption key stored on the server. The stolen key enabled the actors to decrypt passwords for enterprise server accounts stored within the database [T1555] and perform credential dumping of credentials associated with all enterprise servers [T1003].

Stealth, Defense Impairment, and Discovery

Gunra employs multiple stealth and defense impairment techniques to hinder detection and analysis. While active within victim networks, Gunra actors typically attempt to mask their presence by deleting system/network access logs [T1685] and clearing command history [T1070.003]. Additionally, to evade administrator detection, Gunra actors primarily conduct malicious activities and internal infrastructure reconnaissance [T1049] during late-night and early-morning hours (10:00 p.m. – 06:00 a.m.) [T1678].

The ransomware binary is self-contained and performs full volume encryption without observable network indicators (e.g., domain name system, HTTP).6 The Windows binary includes the IsDebuggerPresent API [T1622], which defends against reverse engineering by detecting if the application is being run in a debugger.7 

To avoid dedicating encryption resources to non-critical files, the binary includes filtering logic to exclude common system directories (e.g., C:\Windows, C:\Program Files, C:\Program Files (x86)) from the file system reconnaissance [T1679]. For files that pass the initial filter, the binary checks against a second set of filter rules that exclude file extensions related to system-critical files (e.g., .exe, .dll, .sys). Files with extensions consistent with user data (e.g., documents, databases, images, archives) are approved and added to the work queue for data encryption.8 

Prior to encryption, Gunra performs file and directory discovery across all accessible drive letters (A through Z) to identify victim data for targeting [T1083].9 

Collection and Exfiltration

Prior to data encryption, Gunra actors collect sensitive victim data as part of their double-extortion strategy. The FBI observed actors collecting files from victims that included business-critical documents, databases, personally identifiable information (PII), and internal email communications [TA0009][T1114]. Gunra actors’ custom support for filtering redundant system files during initial discovery/file system reconnaissance streamlines the actors’ collection of user-specific data from local victim machines [T1005].

The FBI observed Gunra actors use a malicious executable (main.exe) to exfiltrate victim data from Microsoft OneDrive and SharePoint [T1530]. For at least one known Gunra victim, the actors generated compressed archives with sensitive data [T1560] and exfiltrated the archives to the file-sharing service Mega [T1567]; the volume of exfiltrated data ranged up to tens of terabytes.10 

In addition to collecting business-critical documents, the KNPA identified a victim case in which Gunra actors connected to the VDI environments of IT personnel and collected sensitive documents containing system and network configuration information [T1005]. The actors then leveraged enterprise server credentials stolen from a system access control server to deploy ransomware to encrypt key assets, including database servers and network attached storage (NAS) systems [T1486].

The FBI observed several common open source tools on Gunra infrastructure that Gunra actors use to facilitate collection and exfiltration of data, including 7-Zip, RClone, and FileZilla [T1048] (see Leveraged Tools for a full list of tools used maliciously by Gunra actors).

Impact

Gunra’s double-extortion model relies on both data exfiltration and data encryption for optimal success. The binary achieves high speed file encryption of entire file systems by leveraging a multi-threaded architecture that supports parallel encryption of multiple files simultaneously using strong ChaCha20 + RSA-4096 encryption [T1486]. Upon successful encryption of a file, the binary renames the encrypted file with the file extension .ENCRT. Gunra also used the .CRYPT file extension in one documented sample from July 2025.11 

After the binary completes the encryption process for all files in a specific directory, Gunra actors write a static ransom note named R3ADM3.txt to the directory. To avoid unnecessary overhead, the binary also contains logic to prevent encryption of the ransom notes (R3ADM3.txt) and re-encryption of already encrypted files (.ENCRT).12 

In their ransom notes, Gunra actors typically demand that victims initiate negotiation discussions within five to seven days via a Tor-based negotiation portal or qTox, or risk having their data leaked on Gunra’s DLS. The FBI observed Gunra actors attempting to communicate directly with management staff at victim companies via email to solicit ransom payments with limited success. Gunra actors instructed victims to send ransom payments to specific cryptocurrency wallet addresses [T1657] and generally started negotiations at arbitrarily high ransom amounts (over tens of millions in US dollars).

If Gunra victims do not negotiate or pay ransom, the actors publicly disclose the victims on their DLS and offer a preview of victims’ leaked data. This preview typically includes a directory listing of a victim’s exposed OneDrive and SharePoint files, but not the content of the files. Between June and July of 2025, Gunra actors operated a clearnet mirror of their Tor-based DLS at domain datapub.news. By March 2026, Gunra had moved their original Tor-based DLS to a different .onion address. On Gunra’s current Tor-based DLS, the actors advertise the sale of datasets from specific victims and instruct interested parties to contact them via qTox for more information.

To increase the likelihood of ransom payment and prevent system recovery [T1490], Gunra actors also used Windows Management Instrumentation (WMI) [T1047] to initiate deletion of volume shadow copies prior to encryption, as demonstrated in the following example [T1059.003]:13  

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{guid of shadowcopy}'" delete

Additionally, against one Gunra victim, Gunra actors deleted backup and archived data stored on backup infrastructure at both the primary data center and disaster recovery center before and after the ransomware deployment [T1490].

Leveraged Tools

Table 1 lists publicly available tools and applications used by Gunra ransomware actors. If network defenders identify use of these tools on their network, they should investigate further to determine possible malicious activity.

Disclaimer: Use of these tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.

Table 1. Tools Used by Gunra Ransomware Actors
Tool Name Description
FileZilla Open source, cross-platform File Transfer Protocol (FTP) application that supports file transfers between devices and remote servers.
Amass Open source reconnaissance tool for network mapping and information gathering.
RClone Open source command-line program designed to manage files in cloud storage.
Sliver Penetration testing toolset that allows remote command and control of systems.
7-Zip Open source, cross-platform file archiver utility.
WinRAR Open source file archiver utility for Microsoft Windows.
DBeaver Open source database management tool for managing Structured Query Language (SQL) databases like MySQL, MariaDB, PostgreSQL, SQLite, etc.
Slack Cloud-based team communication and collaboration platform.
Microsoft Visual Studio Code Open source extendable source code editor.
MobaXterm Windows application with support for multiple remote computing protocols, including SSH, X11, RDP, virtual network computing (VNC), FTP, etc.
AnyDesk Common, legitimate remote monitoring and management (RMM) tool that can be used by a cyber actor to obtain remote access and maintain persistence. AnyDesk also supports remote file transfer.
Google Remote Desktop Web-based remote desktop software tool developed by Google that runs on a proprietary Google protocol.
Mimikatz Post-exploitation tool that allows users to access and exfiltrate authentication credentials from Windows systems.
Impacket Suite of networking utilities, including smbclient, psexec, secretsdump, etc. Gunra utilized several tools from this suite.

Indicators of Compromise

Table 2 lists IP addresses and domains associated with Gunra ransomware infrastructure since early 2025.

Disclaimer: Observed IP addresses/domains may be historical in nature. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.

Table 2. IP Addresses/Domains
IP Address/Domain First Seen Last Seen 
23.239.119[.]2  July 2025 Nov. 6, 2025
23.239.119[.]3 July 2025  Nov. 6, 2025
23.239.119[.]4   July 2025   Nov. 6, 2025
23.239.119[.]5 July 2025 Nov. 6, 2025
23.239.119[.]6 July 2025 Nov. 6, 2025
86.54.28[.]216 June 7, 2025 July 23, 2025
103.125.234[.]14 Nov. 2025 Dec. 2025
70.36.99[.]82 Nov. 2025 Dec. 2025
211.21.210[.]181 Nov. 2025 Dec. 2025
123.184.143[.]105 Nov. 2025 Dec. 2025
182.204.21[.]240 Nov. 2025 Dec. 2025
182.204.16[.]112 Nov. 2025 Dec. 2025
123.244.187[.]144 Nov. 2025 Dec. 2025
182.204.39[.]118 Nov. 2025 Dec. 2025
67.43.53[.]10 Nov. 2025 Dec. 2025
123.246.37[.]108 Nov. 2025 Dec. 2025
91.201.66[.]146 Nov. 2025 Dec. 2025
Datapub[.]news June 2025 July 2025
gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad[.]onion Apr. 2025 Feb. 2026
lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd[.]onion Mar. 2026 July 2026
nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd[.]onion Jan. 2026 Jan. 2026

 

Table 3 lists email addresses associated with Gunra actors.

Table 3. Gunra Email Addresses
Email Address Description
a00f105546345756@proton[.]me Ransom negotiation
4569f6322bc3b22e9@proton[.]me Ransom negotiation
ilovemycubscout@gmail[.]com Ransom negotiation
6449a3c1e612168526@proton[.]me Ransom negotiation

The following qTox IDs are associated with Gunra actors:

  • 2507312EC10BB44ED9DAA04E3C5C27E8C13154649B1A02E73ACFAE1681EE0208D05133A8FB22
  • 0FE87CED0C611AE97E049C64288557F49E8271E91399E849328B078DA789A573031783235BEF
  • 47829AF1C943D4C296C910706923AS199BDA4995B076ED9A9016F7DEF161D445DF00F13E6900
  • 9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47

Table 4 lists malicious files associated with Gunra ransomware.

Table 4. Malicious Files (SHA256)
Filename Hash (SHA256) Description
main.exe 2dc70a12d158d437e45a55b1d52f3d61c6082a1e1667573302ba3b62813e2751 Tool to exfil OneDrive and SharePoint
main.exe 834efe9b392c6c000877ea5613a079445affc16fe8af5997d68c55cafc95e5d1 Tool to exfil OneDrive and SharePoint
cryptor.exe 91f8fc7a3290611e28a35a403fd815554d9d856006cc2ee91ccdb64057ae53b0 Malicious executable
msmp.exe a82e496b7b5279cb6b93393ec167dd3f50aff1557366784b25f9e51cb23689d9 Malicious executable

Table 5 lists malicious accounts created by Gunra actors to gain initial access to victim Fortinet devices.

Table 5. Malicious Fortinet User Accounts
Username Details
forticloud-sync CVE-2024-55591 and CVE-2025-24472 allow threat actors to exploit scheduled tasks on vulnerable FortiOS firewall devices to create a new, malicious persistent user forticloud-sync with super user privileges and a hard-coded password.

MITRE ATT&CK Tactics and Techniques

See Table 6 to Table 18 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 6. Initial Access
Technique Title ID Use
Exploit Public-Facing Application T1190 Gunra actors exploited vulnerabilities in FortiGate firewall and SSL-VPN appliances to gain initial access to victim networks.
Table 7. Execution
Technique Title ID Use
Windows Management Instrumentation T1047 The Gunra ransomware binary contained specific WMI commands to delete volume shadow copies on victim machines.
Native API T1106 The Gunra ransomware binary utilized Native APIs (FindFirstFileW, FindNextFileW) for file system discovery.
Command and Scripting Interpreter: Windows Command Shell T1059.003 Gunra actors executed commands via cmd.exe on Windows to initiate the WMI command.
Table 8. Persistence
Technique Title ID Use
Account Manipulation T1098 Gunra actors gained access to an unused account for a victim network. They altered the account configuration to bypass the mandatory password change requirement, which allowed them to use the compromised account for subsequent malicious activities.
External Remote Services T1133 Gunra actors used external-facing remote services in combination with an administrator account to gain access.
Table 9. Privilege Escalation
Technique Title ID Use
Valid Accounts: Default Accounts T1078.001 Gunra actors compromised an SSL-VPN appliance by exploiting default credentials and the absence of account lockout controls to obtain administrator access to the victim network device.
Valid Accounts: Domain Accounts T1078.002 Gunra actors gained access to an administrator account for an SSL appliance.
Table 10. Stealth
Technique Title ID Use
Debugger Evasion T1622 The Gunra ransomware Windows encryptor binary contained the IsDebuggerPresent API to defend against reverse engineering and debugging activity.
Indicator Removal: Clear Command History T1070.003 Gunra actors cleared command history files on victim machines to prevent detection of their malicious activity.
Delay Execution T1678 Gunra actors strategically timed their reconnaissance and malicious network activities to late night or early morning to avoid detection by the victim.
Selective Exclusion T1679 The Gunra ransomware binary programmatically excludes certain directories and filetypes from encryption to ensure system critical files continue to function and that ransom notes are readable. In addition, the binary contains logic to prevent re-encryption of already Gunra-encrypted files.
Table 11. Defense Impairment
Technique Title ID Use
Disable or Modify Tools T1685 Gunra actors cleared system/network logs on victim machines to prevent detection of their malicious activity.
Table 12. Credential Access
Technique Title ID Use
OS Credential Dumping: NTDS T1003.003 Gunra actors used secretsdump.py on multiple victim domain controllers to extract password hashes for user accounts from the NTDS files.
Network Sniffing T1040 Gunra actors abused SSL-VPN network traffic controls to capture users’ VDI login credentials and session information in transit, effectively sniffing authentication traffic for a victim network.
Steal Web Session Cookie T1539 Gunra actors captured legitimate VDI session data for a victim, which allowed them to steal and reuse session cookies to hijack active sessions and impersonate legitimate users on the internal victim network.
Credentials from Password Stores T1555 From a compromised virtual desktop, Gunra actors accessed the Hiware access control server for a victim and stole its symmetric encryption key.
OS Credential Dumping T1003 Gunra actors used a stolen symmetric encryption key from a Hiware system access control server to decrypt and dump stored enterprise server passwords.
Modify Authentication Process: Multi-Factor Authentication T1556.006 Gunra actors altered files in a victim’s VDI authentication server portal so that a specific attacker-chosen OTP always succeeded, creating a persistent backdoor that bypassed MFA.
Table 13. Discovery
Technique Title ID Use
File and Directory Discovery T1083 The Gunra ransomware binary contains custom instructions to enumerate the complete directory structure of victim machines to identify user-data files and directories for encryption.
System Network Connections Discovery T1049 Gunra actors enumerated active system network connections to map reachable internal infrastructure prior to ransomware deployment.
Table 14. Lateral Movement
Technique Title ID Use
Remote Services: Remote Desktop Protocol T1021.001 Gunra actors used stolen VDI session information to access a victim’s internal VDI environment, then moved laterally via RDP to access the victim’s VDI authentication web server, internal AD server, and IT staff virtual desktops.
Remote Services: SMB/Windows Admin Shares T1021.002 Gunra actors used SMB administrative shares with valid credentials to move laterally and deploy tools across compromised systems.
Use Alternate Authentication Material: Pass the Hash T1550.002 Gunra actors used pass-the-hash methods to move laterally to privileged systems.
Use Alternate Authentication Material: Pass the Ticket T1550.003 Gunra actors used pass-the-ticket methods to move laterally to privileged systems.
Table 15. Collection
Technique Title ID Use
Collection TA0009 Gunra actors were observed collecting business-critical documents, databases, PII, and internal email communications.
Archive Collected Data T1560 Gunra actors were observed utilizing tools such as 7-Zip, WinRAR, RClone, and others to copy and archive victim data for exfiltration.
Data from Cloud Storage T1530 Gunra actors launched a malicious application (main.exe) that specifically targeted Microsoft Cloud Services (OneDrive and SharePoint) for data exfiltration.
Data from Local System T1005

The Gunra ransomware binary recursed through the full directory structure of a compromised device to identify user-data files and directories for targeted exfiltration and subsequent encryption.

In one instance, Gunra actors were observed collecting system and network configuration network information by connecting to the VDI environments of IT personnel.
Email Collection T1114 Gunra actors collected internal email communications.
Table 16. Command and Control
Technique Title ID Use
Ingress Tool Transfer T1105 After obtaining admin access to a victim’s SSL-VPN appliance, Gunra actors downloaded an SSH tunneling tool from an external server to create and maintain persistent tunnel connections to compromised systems in the victim’s network.
Protocol Tunneling T1572 Gunra actors used an SSH tunneling tool to establish connections and maintain persistence between compromised systems.
Table 17. Exfiltration
Technique Title ID Use
Exfiltration Over Web Service T1567 Gunra actors were observed archiving victim data and exfiltrating it over the file-sharing service Mega.
Exfiltration Over Alternative Protocol T1048 Gunra actors used Filezilla software to exfiltrate data over FTP.
Table 18. Impact
Technique Title ID Use
Data Encrypted for Impact T1486

Gunra actors encrypt victim data using combined ChaCha20 + RSA-4096 algorithms to prevent victim access to critical business files. Gunra encryptors are available for Windows and Linux, increasing the potential attack surface within a victim network.

In one instance, Gunra actors encrypted key assets that included database servers and NAS systems.
Financial Theft T1657 Under the double-extortion model, Gunra actors demand ransom payment through a ransom note (R34DM3.txt) in cryptocurrency. The note instructs victims to make the payment to prevent public leaks of their sensitive business data and acquire decryption keys to unlock encrypted files on compromised systems.
Inhibit System Recovery T1490

To augment encryption of critical data on victim networks and prevent system recovery, Gunra actors disable backup features, such as volume shadow copies.

In one instance, Gunra actors prevented restoration from backups by deleting backup and archived data stored at the primary data center and disaster recovery center.

Incident Response

If a potential compromise is detected, but ransomware actors have not (yet) encrypted items, organizations should take the following actions:

  1. Determine which hosts were compromised and isolate them by quarantining or taking them offline.
    1. If the incident involves a Gunra Linux variant, preserve encrypted files, file timestamps, ransom notes, and relevant system logs.
      1. As of March 2026, researchers identified a weakness in the Gunra ransomware’s Linux Executable and Linkable Format (ELF) variants (appended with .GNRA); the encryption keys use a weak pseudorandom number generator (PRNG) seeded with the predictable system srand(time(NULL)).14 Defenders may leverage this to mathematically reconstruct the keys using file timestamps and recover files without paying the ransom.
  2. Initiate threat hunting activities to scope the intrusion. Collect and review relevant artifacts, logs, and other data to identify threat actor TTPs, compromised devices and accounts, a timeline of activity, etc. Responders should consider:
    1. Reviewing logs of network appliances (e.g., edge devices) to audit actions associated with privileged users to identify anomalous activity.
    2. Collecting copies of ransom notes to identify current threat actor communication platforms.
    3. Auditing the creation of new files (particularly archives) to determine possible pre- or post-exfiltration activity.
  3. Report the compromise to the FBI and other agencies as appropriate (see Reporting for contact information).
  4. Apply eviction countermeasures, including those listed below, to contain the incident and eradicate the threat actor from the network (Note: Start applying countermeasures after collecting enough threat hunting data to inform effective countermeasure selection; this will likely overlap with threat hunting activities).
    1. Identify and disable malicious, actor-controlled accounts.
    2. Identify and secure legitimate, privileged accounts.
    3. Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan—the tool comprises Playbook-NG (a web application) and COUN7ER (a database of post-compromise countermeasures mapped to adversary TTPs).
      1. Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool Fact Sheet.
  5. Harden the network to prevent additional malicious activity (see Mitigations for guidance).

If compromise is detected and items have been encrypted, see the “Ransomware and Data Extortion Response Checklist” in CISA’s joint #StopRansomware Guide.

Mitigations

The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of Gunra actor activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

  • Prioritize patching known exploited vulnerabilities [CPG 2.B] and the CVEs in this advisory in internet-facing systems—including VPN gateways and RDP-exposed infrastructure—and keep all OSs, software, and firmware up to date to support this.
  • Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drive, storage device, the cloud) [CPG 3.I, 3.O, 1.C].
  • Review domain controllers, servers, workstations, and active directories for new and/or unrecognized accounts [CPG 2.A, 2.E].
  • Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [CPG 3.G].
  • Segment networks [CPG 3.I] to prevent the spread of ransomware.
    • Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement.
  • Require MFA for all services to the extent possible, particularly for webmail, VPNs, and accounts that access critical systems [CPG 3.F].
  • Disable command-line and scripting activities and permissions. Privilege escalation and lateral movement often depend on software utilities running from the command line. If threat actors are not able to run these tools, they will have difficulty escalating privileges and/or moving laterally [CPG 3.G, 3.M].

Validate Security Controls

In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

To get started:

  1. Select an ATT&CK technique described in this advisory (see Table 6 to Table 18).
  2. Align your security technologies against the technique.
  3. Test your technologies against the technique.
  4. Analyze your detection and prevention technologies’ performance.
  5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
  6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Resources

Reporting

Your organization has no obligation to respond or provide information back to the FBI and other authoring agencies in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI and other authoring agencies, reporting must be consistent with applicable state and federal laws.

The FBI and other authoring agencies are interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, cryptocurrency wallet information, decryptor files, and/or a benign sample of an encrypted file.

Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.

The authoring agencies do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI’s Internet Crime Complaint Center (IC3) or a local FBI field office, to USSS via a local USSS Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (contact@cisa.dhs.gov), or by calling 1-844-Say-CISA (1-844-729-2472).

South Korean organizations: Report cybersecurity incidents to KNPA via the online cybercrime reporting system or by calling 112.

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA and co-sealers do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and co-sealers.

Version History

August 10, 2026: Initial version.

Notes

1 For information on historical Conti ransomware activity, see CISA and FBI’s Conti Ransomware advisory.

2 Breakglass Intelligence, “Gunra Ransomware’s Linux Variant Has a Fatal Flaw: time()-Seeded rand() Makes Encrypted Files Recoverable Without Paying,” Breakglass Intelligence, March 12, 2026, https://intel.breakglass.tech/post/gunra-ransomware-s-linux-variant-has-a-fatal-flaw-time-seeded-rand-makes-encrypted-files-recoverable-without-paying; Jeffrey Francis Bonaobra, Melvin Singwa, Emmanuel Panopio “Gunra Ransomware Group Unveils Efficient Linux Variant,” Trend Micro, July 29, 2025, https://www.trendmicro.com/en_us/research/25/g/gunra-ransomware-linux-variant.html; and CYFIRMA, “Gunra Ransomware – A Brief Analysis,” CYFIRMA, May 3, 2025, https://www.cyfirma.com/research/gunra-ransomware-a-brief-analysis/.

3 CloudSEK, “Inside Gunra RaaS: From Affiliate Recruitment on the Dark Web to Full Technical Dissection of their Locker,” CloudSEK, February 11, 2026, https://www.cloudsek.com/blog/inside-gunra-raas-from-affiliate-recruitment-on-the-dark-web-to-full-technical-dissection-of-their-locker.

4 CYFIRMA, “Gunra Ransomware – A Brief Analysis”; and Breakglass Intelligence, “Gunra Ransomware’s Linux Variant Has a Fatal Flaw.”

5 Bonaobra, “Gunra Ransomware Group Unveils Efficient Linux Variant”; and CloudSEK, “Inside Gunra RaaS.”

6 CloudSEK, “Inside Gunra RaaS.”

7 CYFIRMA, “Gunra Ransomware – A Brief Analysis.”

8 CloudSEK, “Inside Gunra RaaS.”

9 CloudSEK, “Inside Gunra RaaS.”

10 Bonaobra, “Gunra Ransomware Group Unveils Efficient Linux Variant.”

11 VirusTotal, “VirusTotal - File - 91f8fc7a3290611e28a35a403fd815554d9d856006cc2ee91ccdb64057ae53b0,” VirusTotal, https://www.virustotal.com/gui/file/91f8fc7a3290611e28a35a403fd815554d9d856006cc2ee91ccdb64057ae53b0/details.

12 CloudSEK, “Inside Gunra RaaS.”

13 CYFIRMA, “Gunra Ransomware – A Brief Analysis.”

14 Breakglass Intelligence, “Gunra Ransomware’s Linux Variant Has a Fatal Flaw.”

 

Received — 3 August 2026 ⏭

Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

✇CISA Alerts
By: CISA
21 July 2026 at 21:08

Executive summary 

A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see Cybersecurity industry tracking), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [1].

LAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques—including password spraying, phishing, and pass-the-cookie—allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) CVE-2025-66376, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy increasingly sophisticated technical capabilities.

Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim’s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the Persistence and credential access section.

This Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors’ continued success. The CSA is being released by the following authoring and co-sealing agencies:

  • United States National Security Agency (NSA)
  • United States Federal Bureau of Investigation (FBI)
  • Netherlands Defence Intelligence and Security Service (MIVD)
  • Netherlands General Intelligence and Security Service (AIVD)
  • United States Cybersecurity and Infrastructure Security Agency (CISA)
  • United States Defense Counterintelligence and Security Agency (DCSA)
  • United States Department of Defense Cyber Crime Center (DC3)
  • United States Department of the Treasury
  • United States Naval Criminal Investigative Service (NCIS)
  • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
  • Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)
  • New Zealand National Cyber Security Centre (NCSC-NZ)
  • United Kingdom National Cyber Security Centre (NCSC-UK)
  • Czech Republic National Cyber and Information Security Agency (NÚKIB)1
  • Danish Defence Intelligence Service (DDIS)2
  • Estonian Foreign Intelligence Service (EFIS)3
  • Finnish Defence Intelligence (FDI)4
  • Finnish Security and Intelligence Service (SUPO)5
  • French General Directorate for Internal Security (DGSI)6
  • French National Cybersecurity Agency (ANSSI)7
  • Italian External Intelligence and Security Agency (AISE)8
  • Italian Internal Intelligence and Security Agency (AISI)9
  • Security and Intelligence Service of the Republic of Moldova (SIS RM)10
  • Polish Foreign Intelligence Agency (AW)11
  • The Military Counterintelligence Service of Poland (SKW)12
  • Spain National Intelligence Centre (CNI)13
  • Sweden National Cyber Security Centre (NCSC-SE)14

The authoring agencies urge any organizations using ZCS to implement the recommendations listed within the Mitigations section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed Indicators of compromise (IOCs).  

As more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.

For a downloadable list of IOCs, see:

Cybersecurity industry tracking

The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:

  • LAUNDRY BEAR
  • Void Blizzard [2]
  • CL-STA-1114 [3]
  • TA488 (formerly UNK_PitStop) [4]

Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.

Background

Public advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [1] [2]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.  

The May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [T1114.002]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [T1078], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence & Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [T1557].  

Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [T1587.001] named “Улей” or “Ulej” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [T1114]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:

  • Last 90 days of emails,
  • Email address,
  • Password [T1589.001],
  • Global Address List (GAL) [T1087],
  • Two-factor authentication (2FA) tokens, and
  • Newly-created Application Passcode [T1098].

The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.

Targeting details

LAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:

  • the Defense Industrial Base (DIB),  
  • the federal and local government,
  • education,
  • energy,
  • law enforcement,  
  • media,  
  • non-governmental organizations, and
  • technology.

Technical details

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 19. This advisory also uses MITRE D3FENDTM version 1.4.015. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and D3FEND tactics, techniques, and countermeasures.

Ulej is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit CVE-2025-66376 [Common Weakness Enumeration (CWE) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [T1074.002] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.

Reconnaissance

LAUNDRY BEAR uses the Ulej capability to exploit the CVE-2025-66376 vulnerability in organizations using ZCS. This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [T1595] and fingerprinting datasets easily procured through various commercial vendors [T1596.005].  

After identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [T1589.002] from datasets offered by commercial vendors [T1597.002], open source intelligence [T1593], or previously exfiltrated data [T1597].  

Resource development

The actors procure VPSs from a variety of providers [T1583.003], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [T1583] when interacting with these servers, further demonstrating the group’s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for Ulej’s Flowerbed framework [T1608], which then receives and aggregates the data Ulej exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.

Flowerbed framework

Flowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:

  • Catcher,
  • Certbot,
  • Nginx, and
  • Gardener.

Catcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [T1048]. For additional information on Catcher, refer to the Exfiltration section of this advisory. Flowerbed’s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let’s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [T1048.002]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains “*.i.*” prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.

The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [T1588.007]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [T1588.002], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.

Initial access

To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [T1566]. Through exploitation of CVE-2025-66376, this JavaScript payload is immediately executed once the user views the malicious email [T1203], such as the one shown in Figure 1, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [T1199], as shown in the email metadata in Figure 2. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.

Figure 1: Example of malicious email
Figure 1: Example of malicious email

Figure 2: Headers from an example malicious email
Figure 2: Headers from an example malicious email

According to the National Vulnerability Database (NVD), CVE-2025-66376 was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet’s (CSS) @import directives within an email [5]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at that time [T1587.004].  

Utilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.

Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [T1027.017], as shown in Figure 3. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage CVE-2025-66376. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see Figure 3) [T1027.013]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [T1027.010], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [T1119]. The stages in order of appearance within the payload are as follows:

  1. sendStartPing,
  2. gather_email,
  3. gather_environment,
  4. gather_2fa_codes,
  5. gather_app_password,
  6. gather_device_status,
  7. gather_oauth_consumers,
  8. gather_autocomplete_password,
  9. enable_mail_protocols,
  10. gather_gal,
  11. sendArchives, and
  12. sendFinishPing. 

Figure 3: Malicious payload of example email
Figure 3: Malicious payload of example email

Use of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [T1587].

Persistence and credential access

To establish sustained persistence into the victim’s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the Exfiltration section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group’s ability to circumvent multi-factor authentication through session token replay [T1550.004], and the Zimbra campaign follows a similar trend.

The script used in this campaign tries to discover the victim’s email address during the gather_email stage [T1087]. The script searches for this email address in two ways. First, it examines the batchInfoResponse variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the Collection section of this advisory. If so, the script uses the “GetIdentitiesRequest” Simple Object Access Protocol (SOAP) command under the “ZimbraAccount” namespace to determine the victim’s email address [T1185] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim’s email, the script sends a JavaScript Object Notation (JSON) payload with a key of “email” and value of null over HTTPS and does not attempt DNS exfiltration.

During the gather_autocomplete_password stage, the script attempts to collect the victim’s saved password via the autocomplete feature of the victim’s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim’s view, as shown in Figure 4 and Figure 5. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in Figure 4. If there is no value in that input field, it checks the password input field shown in Figure 5. If neither input field contains a value, a JSON payload with a key of “autocomplete_password” and value of null is sent over HTTPS and DNS exfiltration is not attempted.

Figure 4: First illegitimate login HTML element
Figure 4: First illegitimate login HTML element

Figure 5: Second illegitimate login HTML element
Figure 5: Second illegitimate login HTML element

LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the enable_mail_protocols stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent. This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.

ZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the gather_app_password stage, the script makes a SOAP request using the “CreateAppSpecificPasswordRequest” command under the “ZimbraAccount” namespace to create a new Application Passcode [T1556.006]. The SOAP request uses “ZimbraWeb” as the name of the application.

Additionally, the script also attempts to collect 2FA tokens. During the gather_2fa_codes stage, the script makes a SOAP request using the “GetScratchCodesRequest” command under the “ZimbraAccount” namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.

Collection

As demonstrated in the Persistence and credential access section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim’s current CSRF token, which it attempts to access within the webpage’s local storage using localStorage.getItem("csrfToken"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the Persistence and credential access section, other SOAP commands executed to collect victim information are shown in Table 1.

Table 1: Additional SOAP commands used

SOAP Command 

Namespace 

Stage 

GetInfoRequest 

zimbraAccount 

gather_environment 

GetDeviceStatusRequest 

zimbraSync 

gather_device_status 

GetOAuthConsumersRequest 

zimbraAccount 

gather_oauth_consumers 

SearchGalRequest 

zimbraAccount 

gather_gal 

The script attempts to collect the victim’s GAL through brute force by searching for each two-character combination from a character set of “abcdefghijklmnopqrstuvwxyz1234567890.-_”. These queries are conducted using 20 batches of SOAP requests with 77 “SearchGalRequest” SOAP commands in each batch except for the last request containing only 58.

During the gather_environment stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user’s current URL to determine the client type being used, checking for certain indicators (shown in Table 2) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.

Table 2: ZCS webmail client types

Indicator 

Client Type 

Associated Value 

?client=advanced 

Advanced 

c 

/h/ 

Standard 

h 

/modern/ 

Modern 

m 

As part of collection, the script attempts to harvest any emails not marked as “junk” from the last 90 days from the victim’s account. Emails are collected daily by an HTTP GET request to the URL path, “/home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d AND (not in:junk)”. The {DAY_OFFSET} value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of zd_comp_YYYY-MM-DD, and value of true, is saved to the window.top.localStorage property. This variable is saved regardless of whether the email is successfully exfiltrated.  

According to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a {DAY_OFFSET} of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the Exfiltration section.

The script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the Exfiltration section below. For cases where the error occurs within a SOAP request, “:api” is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of gather_gal:{VAL}:api. The {VAL} placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use “gather_autocomplete_password:dom” for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day’s emails, the stage will include which day the error occurred on, using the previously defined placeholder {DAY_OFFSET}, with a format of sendArchive:day-{DAY_OFFSET}.

Exfiltration

At the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [T1048.003] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.

Prior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.  

DNS exfiltration

DNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, Ulej maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (“.”) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in Figure 6. Any traffic involving DNS exfiltration will have “d-“ prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.

Figure 6: Structure for information exfiltrated by DNS
Figure 6: Structure for information exfiltrated by DNS

When the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. Table 3 lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.  

Table 3: DNS exfiltration

Type of Information 

Exfiltration Stage 

Data Type 

Victim’s Email Address 

gather_email 

e 

Client Type 

gather_environment 

c 

Zimbra Version 

gather_environment  

v 

URL at Time of Exploitation 

gather_environment 

url 

2FA Scratch Codes 

gather_2fa_codes 

2fa 

Newly Created Application Password 

gather_app_password 

pa 

Harvested Autocomplete Password 

gather_autocomplete_password 

pw 

HTTPS exfiltration

Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let’s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim’s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in Table 4. Traffic associated with HTTPS exfiltration will use the URL scheme shown in Figure 7.  

Table 4: HTTPS exfiltration types

Content Type 

URL Path 

application/json 

/v/p 

application/octet-stream 

/v/d 

Figure 7: Structure for information exfiltrated by HTTPS
Figure 7: Structure for information exfiltrated by HTTPS

Some of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.  

Table 5 provides a summary of the JSON-based exfiltration.

Table 5: HTTPS JSON exfiltration  

Type of Information 

Exfiltration Stage 

JSON Key(s) 

Victim’s Email Address 

gather_email 

email 

Client Type, Version, and Current URL 

gather_environment 

client, version, full_url 

Newly Created Application Password 

gather_app_password 

app_password 

Harvested Autocomplete Password 

gather_autocomplete_password 

autocomplete_password 

The script transmits all HTTPS exfiltration not identified in Table 5 using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the “X-Filename” header. Traditionally, developers use headers prefixed with “X-” to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. Table 6 summarizes the data exfiltrated in this format.

 Table 6: HTTPS binary exfiltration

Type of Information 

Exfiltration Stage 

X-Filename Header 

SOAP request for GetInfoRequest 

gather_environment 

zimbra_batch_analytics.json 

SOAP request for GetScratchCodesRequest 

gather_2fa_codes 

zimbra_batch_analytics.json 

SOAP request for GetDeviceStatusRequest 

gather_device_status 

zimbra_batch_analytics.json 

SOAP request for GetOAuthConsumersRequest 

gather_oauth_consumers 

zimbra_batch_analytics.json 

Victim Organization’s Global Address List 

gather_gal 

telemetry_{1-20}.json 

Last 90 Days of Victim’s Emails 

sendArchives 

telemetryData_{0-89}.json 

The script sends all exfiltrated data identified in Table 6 to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [T1560]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in Table 6 using the application/octet-stream content typing rather than application/json.

At the beginning and end of the collection and exfiltration activity, during the sendStartPing and sendFinishPing stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in Figure 2, using a URL path of “/v/p” and with a “subtype” key that shows which type of action it logged (start, finish, or error).  

Catcher

Ulej exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the Resource development section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.

Catcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the Resource development section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let’s Encrypt and forwards all traffic with an SNI containing “*.i.*” to port 8000 within the Catcher container.

The DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let’s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.  

However, if a query includes a domain formatted as shown in Figure 6 and Figure 7, the service saves a log file in JSON format to disk containing the following details of the DNS query:

  • Time of query,
  • Source IP address for query,
  • Queried domain, and
  • Type of query.

The HTTP server typically responds with OK, except in cases where the path is “pixel.gif” when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in Figure 6 and Figure 7. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to “application/json”, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a “.bin” file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:

  • Time,
  • Source IP address,
  • Request method,
  • Host,
  • Path,
  • Query string,
  • Headers, and
  • Base64 payload.

These JSON event log files and binary output files are then initially saved to the directory /root/hits/tmp and later moved to the /root/hits/ready directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in Figure 8 also executes hourly to remove all files last modified at least two days ago from the /root/hits/ready directory.

Figure 8: Command used for automated directory cleanup
Figure 8: Command used for automated directory cleanup

Response strategies

Mitigations

In many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.

All organizations that use the ZCS webmail service should immediately prioritize ensuring that their ZCS is not running a vulnerable version. A patch for CVE-2025-66376 was released for both 10.1.13 and 10.0.18 versions of ZCS [D3-AH]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [d3f:Isolate].

System administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [D3-AH]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including CISA’s Known Exploited Vulnerabilities Catalog and NCSC-UK’s Responding to active exploitation of vulnerabilities guidance.

Organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [D3-CH]. However, Application Passcodes may still be necessary and should be monitored closely.  

Organizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [CPG 3.Q]. This will allow organizations to monitor for and identify suspicious network activity [CPG 4.B], such as:

  • Significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization [D3-NTA];
  • Frequent DNS queries for a suspicious domain with seemingly random subdomains [D3-DNSTA];
  • A sudden spike of connections to a server associated with a recently established domain [D3-NTCD]; and  
  • Connections to internal services, such as webmail, from VPN providers frequently leveraged by this group for nefarious activity, such as Mullvad VPN [D3-NTCD].

Additionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the Exfiltration section of this advisory.

Indicators of compromise (IOCs)

Flowerbed infrastructure

The following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS’s webmail service as of the publication of this advisory. (Disclaimer: Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) Table 7 provides details about the server infrastructure used to host Flowerbed, and Table 8 lists the corresponding SHA-1 hash values for the Let’s Encrypt certificates used by that infrastructure [D3-IAA].

Table 7: Flowerbed server infrastructure

Domain 

IP Address 

First Seen 

Last Seen 

zmailanalytics[.]com 

216.252.238[.]104 

8 July 2025 

15 October 2025 

zimbra-metadata[.]com 

216.252.238[.]18 

20 August 2025 

14 October 2025 

analyticemailmeter[.]com 

37.120.247[.]228 

24 September 2025 

18 March 2026 

emailanalytics.com[.]ua 

185.86.79[.]95 

24 September 2025 

18 March 2026 

mailnalysis[.]com 

104.248.134[.]194 

11 November 2025 

17 February 2026 

zimbrastat[.]com 

64.226.124[.]190 

18 December 2025 

18 March 2026 

zimbrasoft.com[.]ua 

193.238.152[.]66 

20 January 2026 

18 March 2026 

synacorzimbra[.]nl 

216.252.238[.]64 

3 February 2026 

30 March 2026 

istc-cloud[.]com 

194.156.103[.]193 

5 February 2026 

30 March 2026 

Table 8: Flowerbed X.509 certificate SHA-1 hashes  

Associated Domain 

X.509 SHA-1 Hash 

First Seen 

Last Seen 

zmailanalytics[.]com 

2e4f314bc9943cab5005d6fde0b271c74d47bc9d 

8 Jul 2025 

6 Aug 2025 

*.i.zmailanalytics[.]com 

50a87d926621dd06389ba50d86e0ff574ed713a8 

6 Aug 2025 

13 Oct 2025 

*.i.zimbra-metadata[.]com 

c5a72420e7bb308d078e62128430897f82194c95 

20 Aug 2025 

14 Oct 2025 

*.i.analyticemailmeter[.]com 

8959c4d29e29f02ea94ea8bb21c8df2594c5549d 

24 Sep 2025 

8 Nov 2025 

*.i.emailanalytics.com[.]ua 

62eb76432597694edb01c1fe57aab0cfe03a7178 

25 Sep 2025 

27 Sep 2025 

*.i.mailnalysis[.]com 

cddf5c3be1e07f28140aed165b929bf2d614922a 

12 Nov 2025 

17 Dec 2025 

*.i.zimbrastat[.]com 

18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8 

18 Dec 2025 

28 Dec 2025 

*.i.zimbrasoft.com[.]ua 

1b25041ececf2457eef0270fc1d785cec8ec9ded 

21 Jan 2026 

10 Feb 2026 

*.i.synacorzimbra[.]nl 

e4fe6466a4f9a4249fe330651e914e45bbdca44a 

5 Feb 2026 

22 Mar 2026 

*.i.istc-cloud[.]com 

b6b77c9a455225d525834a403ca9ef5481ed0447 

12 Feb 2026 

30 Mar 2026 

LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:

  • ivanka.zurabishvili@proton[.]me,
  • zmul1@buildandconsulting[.]com,
  • garrysmithme@pinmx[.]net, and
  • hostingclient@pinmx[.]net.

Phishing distribution

LAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR’s more recent efforts likely have shifted to distributing the payload through previous victims.  

The following email addresses have distributed payloads attributed to this campaign:

  • c.laurent.ejfa@proton[.]me,
  • j.moreau.epsc@proton[.]me,
  • liberty.insights@proton[.]me,
  • certain email addresses (presumably compromised) at the isofts.kiev[.]ua domain (i.e., ending with @isofts.kiev[.]ua), and
  • certain email addresses (presumably compromised) at the navs.edu[.]ua domain (i.e., ending with @navs.edu[.]ua).

Additionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:

  • 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf,
  • 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874,
  • b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d, and
  • 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760.

Post-compromise artifacts

Currently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.

This Ulej capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the /opt/zimbra/log/mailbox.log file [D3-PA]. A significant amount of SOAP request activity that aligns with what was described in the Persistence and credential access and Collection sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:

  • Many SearchGalRequest command requests from a single user over a short period of time;
  • Use of the CreateAppSpecificPasswordRequest command, especially in cases where it is creating an Application Passcode named “ZimbraWeb”; and
  • Use of the GetScratchCodesRequest command.

While LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [D3-PA]. Review of the items stored in that property for an organization’s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of zd_comp_YYYY-MM-DD, as explained in the Collection section of this advisory.

While Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name “ZimbraWeb” are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named “ZimbraWeb.”

In instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [D3-MA]. If an email that has a payload exploiting CVE-2025-66376 is discovered, steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.  

Remediation

In the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to CVE-2025-66376.

Organizations should use identifiers from the IOCs section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.

All users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [CPG 3.B] and creating unique credentials [CPG 3.C], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.

Works cited

[1] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf

[2] Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/

[3] Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. https://unit42.paloaltonetworks.com/russian-webmail-espionage/ 

[4] Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit

[5] Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/  

Footnotes

1 Národní úřad pro kybernetickou a informační bezpečnost
2 Forsvarets Efterretningstjeneste
3 Välisluureamet
4 Sotilastiedustelu
5  Suojelupoliisi
6 Direction générale de la sécurité intérieure
7 Agence nationale de la sécurité des systèmes d’information
8 Agenzia Informazioni e Sicurezza Esterna
9 Agenzia Informazioni e Sicurezza Interna
10 Serviciul de Informații și Securitate al Republicii Moldova
11 Agencja Wywiadu
12 Służba Kontrwywiadu Wojskowego
13 Centro Nacional de Inteligencia
14 Nationellt Cybersäkerhetscenter
15 MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.

Acknowledgements

The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.

Disclaimer of endorsement

The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

Organizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.

Purpose

This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Contact

United States organizations 

  • National Security Agency 
    Cybersecurity Report Feedback: CybersecurityReports@nsa.gov 
    Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov 
    Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov 
  • Cybersecurity and Infrastructure Security Agency 
    CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or by calling 1-844-Say-CISA (1-844-729-2472). 
  • Federal Bureau of Investigation 
    If you or someone you know has fallen victim to this campaign, file a complaint with IC3. 
  • Defense Counterintelligence and Security Agency  
    DCSA Counterintelligence, Cyber Mission Center, Cyber Threat Operations Branch: DCSA.CI.CyberOps@mail.mil 
    Cleared Contactors (CCs) should contact their DCSA Counterintelligence Special Agent to report information pertaining to suspicious contacts or physical/digital efforts to obtain illegal or unauthorized access to the CC’s cleared facility/information, as required by 32 CFR 117. 
    Media/Public Inquiries: dcsa.quantico.dcsa-hq.mbx.pa@mail.mil  
  • Department of Defense Cyber Crime Center  
    Defense Industrial Base Inquiries and Cybersecurity Services: DC3.DCISE@us.af.mil 
    Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at https://dibnet.dod.mil 
    Media Inquiries / Press Desk: DC3.Information@us.af.mil 
  • Naval Criminal Investigative Service 
    To report criminal activity impacting the United States Navy, go to www.ncis.navy.mil and click “Submit a Tip”

Dutch organizations 

Australian organizations 

  • Australian Signals Directorate 
    Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. 

Canadian organizations 

  • The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices.  
    Report an incident or suspicious activity to the Cyber Centre by email at contact@cyber.gc.ca, online via the reporting tool Report a cyber incident - Canadian Centre for Cyber Security or by phone at 1-833-CYBER-88 (1-833-292-3788). 

New Zealand organizations 

United Kingdom organizations 

Estonia organizations 

Finnish organizations 

French organizations 

  • French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18. 

Italian Organizations 

Moldovan organizations 

  • Security and Intelligence Service of the Republic of Moldova (SIS RM): cybersec@sis.md 

Polish organizations 

Appendix A: MITRE ATT&CK tactics and techniques

See Table 9 through Table 19 for all the threat actor tactics and techniques referenced in this advisory.

Table 9: Reconnaissance 

Technique Title 

ID 

Use 

Gather Victim Identity Information: Credentials 

The payload attempts to intercept a victim’s password from their password manager. 

Gather Victim Identity Information: Email Addresses 

The payload attempts to grab the victim’s email address from various data stores. 

Search Open Websites/Domains 

T1593 

This group likely leverages public information to support target development. 

Active Scanning 

T1595 

Port scanning can be used by this group to assist with determining exploitability of identified targets. 

Search Open Technical Databases: Scan Databases 

Various public datasets can provide information to support discovery of exploitable targets. 

Search Closed Sources 

T1597 

Previously exfiltrated data can be used to enhance target development efforts. 

Search Closed Sources: Purchase Technical Data 

Commercial datasets can also be used to support target development efforts. 
Table 10: Resource Development 

Technique Title 

ID 

Use 

Acquire Infrastructure 

T1583 

This group used Mullvad VPN to anonymize traffic sent to operational infrastructure. 

Acquire Infrastructure: Virtual Private Server 

This group procured VPS servers from a variety of vendors. 

Develop Capabilities 

T1587 

The Ulej capability was developed likely for use by this group to conduct spear phishing campaigns. 

Develop Capabilities: Malware 

Development of a novel payload that steals a victim’s emails and other sensitive account information. 

Develop Capabilities: Exploits 

Development of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript. 

Obtain Capabilities: Tool 

Open source tools, such as Evilginx2, have also been used by the group. 

Obtain Capabilities: Artificial Intelligence 

The group appears to have leveraged AI to support development efforts. 

Stage Capabilities 

T1608 

Flowerbed is deployed to a procured server in the cloud. 

Table 11: Initial Access 

Technique Title 

ID 

Use 

Valid Accounts 

T1078 

This actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing.  

Trusted Relationship 

T1199 

The group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target.  

Phishing 

T1566 

The actors used spear phishing to lure users into opening malicious email. 

Table 12: Execution 

Technique Title 

ID 

Use 

Exploitation for Client Execution 

T1203 

An XSS vulnerability was leveraged to execute the JavaScript payload. 

Table 13: Persistence 

Technique Title 

ID 

Use 

Account Manipulation 

T1098 

Enabling IMAP and Application Passcodes provides persistent access to the compromised account. 

Modify Authentication Process: Multi-Factor Authentication 

Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. 

Table 14: Privilege Escalation 

Technique Title 

ID 

Use 

Valid Accounts 

T1078 

This actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts.  

Table 15: Stealth 

Technique Title 

ID 

Use 

Obfuscated Files or Information: Command Obfuscation 

Obfuscated JavaScript payload sent to targets to exploit the XSS vulnerability. 

Obfuscated Files or Information: Encrypted/Encoded File 

The JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload. 

Obfuscated Files or Information: SVG Smuggling 

The payload was contained in an “onload” attribute within an SVG image included in the malicious email. 

Use Alternate Authentication Material: Web Session Cookie 

Previous campaigns using AiTM leveraged stealing and use of a victim’s session cookies to authenticate. 

Table 16: Credential Access 

Technique Title 

ID 

Use 

Modify Authentication Process: Multi-Factor Authentication 

Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. 

Adversary-in-the-Middle 

T1557 

Previous campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies. 

Table 17: Collection 

Technique Title 

ID 

Use 

Data Staged: Remote Data Staging 

Exfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions. 

Email Collection 

T1114 

This group has emphasized collection of emails. 

Email Collection: Remote Email Collection 

Emails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim’s device. 

Automated Collection 

T1119 

Upon execution, the JavaScript payload automatically collects all relevant information in stages. 

Browser Session Hijacking 

T1185 

The JavaScript payload leverages the user’s authenticated browser session to make API requests as the user. 

Archive Collected Data 

T1560 

Emails are exfiltrated with GZIP compression. 

Table 18: Discovery 

Technique Title 

ID 

Use 

Account Discovery 

T1087 

Stolen Global Access Lists provide the group with new users to target. 

Table 19: Exfiltration 

Technique Title 

ID 

Use 

Exfiltration Over Alternative Protocol 

T1048 

Victim information was exfiltrated over both HTTPS and DNS. 

Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol 

Some payloads, especially ones with large amounts of data, were exfiltrated over HTTPS. 

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol 

Some smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding. 

Appendix B: MITRE D3FEND countermeasures

See Table 20 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.

Table 20: MITRE D3FEND Countermeasures 

Countermeasure Title 

ID 

Description 

Application Hardening 

D3-AH 
  • Organizations should immediately prioritize patching CVE-2025-66376.  
  • Organizations should promptly apply software updates to all email systems. 

Isolate 

Organizations that cannot feasibly patch should use alternative mail clients. 

Credential Hardening 

D3-CH 

Organizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys. 

Network Traffic Analysis 

D3-NTA 

Organizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization. 

DNS Traffic Analysis 

Organizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains. 

Network Traffic Community Deviation 
  • Organizations should monitor for a sudden spike of connections to a server associated with a recently established domain. 
  • Organizations should monitor for connections to internal services, such as webmail, from VPN providers. 

Identifier Activity Analysis 

D3-IAA 

Organizations should search for the listed known IOCs. 

Process Analysis 

D3-PA 
  • Organizations should search ZCS log files for specific commands used by the malicious script. 
  • Organizations should search the localStorage property in web browsers for the ZCS webmail client for “ZimbraWeb” Application Passcodes. 
Message Analysis D3-MA Organizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims.

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

✇CISA Alerts
By: CISA
8 July 2026 at 20:43

Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors

Executive summary

Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure Public Service Announcement of the decade-plus FSB Center 16 cyber activity by providing additional tactics, techniques, and procedures (TTPs) to enable defenders to more fully understand and counter the threat. [1] 

This CSA is being released by the following authoring and co-sealing agencies: 

  • United States National Security Agency (NSA)
  • United States Cybersecurity and Infrastructure Security Agency (CISA)
  • United States Federal Bureau of Investigation (FBI)
  • United States Department of Defense Cyber Crime Center (DC3)
  • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
  • Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)
  • New Zealand National Cyber Security Centre (NCSC-NZ)
  • United Kingdom National Cyber Security Centre (NCSC-UK)
  • Czech Republic National Cyber and Information Security Agency (NÚKIB)1 
  • Danish Defence Intelligence Service (DDIS)2 
  • Estonian Foreign Intelligence Service (EFIS)3 
  • Estonian Information System Authority (RIA)4
  • Finnish Defence Intelligence (FDI)5
  • Finnish Security and Intelligence Service (SUPO)6
  • French National Cybersecurity Agency (ANSSI)7
  • Italian External Intelligence and Security Agency (AISE)8 
  • Italian Internal Intelligence and Security Agency (AISI)9
  • The Military Counterintelligence Service of Poland (SKW)10 
  • Sweden National Cyber Security Centre (NCSC-SE)11 

The authoring and co-sealing agencies strongly urge device owners and network defenders to take mitigation and remediation actions against Russian government-sponsored exploitation of vulnerable routers.

Adversary Techniques and corresponding Mitigation Actions as described in the Technical details and Mitigation actions sections.
Figure 1: FSB Center 16 activity and recommended mitigation actions

Download the PDF version of this report:

Cybersecurity industry tracking 

The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to this activity. Although not all encompassing, the following list contains the most notable threat group names commonly used within the cybersecurity community related to this activity: 

  • Berserk Bear 
  • Energetic Bear
  • Crouching Yeti 
  • Dragonfly
  • Ghost Blizzard
  • Static Tundra

Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this list may not provide a 1:1 correlation to the authoring agencies’ understanding for all activity related to these groupings.

Targeting details

Critical infrastructure sectors most at risk from the Russian Federal Security Service (FSB) Center 16 cyber actors’ targeting include:

  • Communications,
  • Defense Industrial Base,
  • Energy,
  • Financial Services,
  • Government Services and Facilities, especially organizations at the state and local level, and
  • Healthcare and Public Health.

Technical details

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise12 framework, version 19. See Appendix A for tables of the activity mapped to MITRE ATT&CK tactics and techniques. This advisory also uses MITRE DEFENDTM version 1.4.0.

The Russian FSB Center 16 cyber actors primarily use scanning to identify poorly configured networking devices, primarily routers, for exploitation. The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication [T1595.001, T1595.002]. These scans, run via proxies, consist of SNMP Set-Requests from a spoofed IP address [T1027] containing Object Identifiers (OIDs) that instruct the SNMP agent on poorly configured networking devices to [T1569, T1602.001, T1090]:

  • Copy its configuration to a file, often called “config.bkp” or “output.txt” [T1003, T1602.002].
  • Transfer the file, typically using Trivial File Transfer Protocol (TFTP), to an actor-controlled leased virtual private server (VPS) or compromised FTP server [T1583.003, T1090, T1071, T1048].

While SNMP scanning is the primary method the actors use to discover and exploit poorly configured networking devices, they occasionally exploit common vulnerabilities and exposures (CVEs) in Cisco devices, Cisco’s Smart Install (SMI) functionality, and web portals to manage network devices. The actors previously exploited at least the following CVEs [T1584.008, T1588.005, T1190, T1068]: 

Many of these TTPs overlap with activity by other malicious cyber actors, such as Salt Typhoon. Even though this CSA focuses on Russian FSB Center 16 cyber activity, the mitigations below should detect and counter these and similar TTPs used by other actors.

Mitigation actions

The authoring agencies highly recommend network defenders implement the following mitigations to harden networks against this exploitation:

  • Disable Cisco Smart Install on all devices [D3-ACH]. [2]
  • Use SNMPv3 with “authPriv” configured to the most modern encryption standard that is supported by the device instead of SNMPv1 or SNMPv2 [D3-ACH]. [3]
    • Disable SNMPv1 and SNMPv2. These are legacy protocols and should no longer be needed on current devices. If they are necessary, change all community strings from defaults and only allow read-only community strings rather than read-write access.
    • SNMPv3 adds strong authentication and data encryption that are unavailable in SNMPv1 and v2. SNMPv3 replaces clear text shared passwords, known as community strings, with more securely encoded parameters, and authenticates and encrypts data [D3-MAN, D3-MENCR].
  • Use strong, unique passwords for local accounts on network devices and configure credentials to be stored securely to prevent reuse of compromised passwords [D3-CH].
    • Cisco devices protect passwords in the configuration file using different hashing types. Use hashing type 8 for user credentials. Avoid using hashing type 0, 4, and 7 as they are insecure or store passwords in plaintext in the configuration file. [4]
    • Monitor for unusual credentials that do not conform to standard organizational naming conventions [D3-PM]. 
    •  Monitor for and alert on logins using local accounts. Local accounts should only be used in emergency situations when accounts supported by centralized authentication servers are unavailable. Centralized authentication to network devices should support multi-factor authentication where feasible. [3]
  • Monitor and restrict access to SNMP OIDs using a Management Information Base (MIB) allow list [D3-ACH]. [5] Reference the vendor-specific MIB for the network devices and monitor OIDs for indications of reconnaissance or misconfiguration in logs or intrusion detection systems (IDS). IDS rules should be written for inbound SNMP Set-Requests that contain OIDs targeting sensitive device data [D3-PM].
    • Example OIDs include:
      • 1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy)
      • 1.3.6.1.4.1.9.9.96.1.1.1.1.5 (Config Copy Server Address, value for this OID is where the configuration file is being sent to) 
  • Restrict management protocols [D3-NTF].
    • Use Access Control Lists (ACLs) to only allow management protocols, such as SNMP, from management devices, preferably on an out-of-band network. [3]
    • On edge firewalls and devices deny all external communications on the following ports unless mission critical, with strict monitoring if blocking is not feasible:
      • User Datagram Protocol (UDP) port 69 (TFTP) 
      • Transmission Control Protocol (TCP) port 4786 (SMI)
      • UDP ports 161 and 162 (SNMP)
      • TCP/UDP ports 10161 and 10162 (SNMPv3)
  • Update network device software and firmware images, especially to patch known vulnerabilities, and upgrade end-of-life devices to supported ones. 
    • Use an attack surface management service to identify and secure Internet-facing systems with weak configurations and known vulnerabilities [D3-NVA].
      • U.S.-based federal, state, local, tribal, and territorial governments and U.S. critical infrastructure organiztions should consider signing up for CISA’s no-cost Cyber Hygiene services.
      • U.S. Defense Industrial Base organizations should consider signing up for NSA’s DIB Cybersecurity Services.

Resources

United States:

Canada:

Works cited

[1] FBI. Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure. Alert Number: I-082025-PSA. 2025. https://www.ic3.gov/PSA/2025/PSA250820

[2] NSA. Cisco Smart Install Protocol Misuse. 2017. https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF

[3] NSA. Network Infrastructure Security Guide. 2023. https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF

[4] NSA. Cybersecurity Information Sheet Cisco Password Types: Best Practices. 2022. https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/0/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF

[5] NSA. Cybersecurity Information Sheet: Reducing the Risk of Simple Network Management Protocol (SNMP) Abuse. 2026. https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF

Footnotes

1  Národní úřad pro kybernetickou a informační bezpečnost

2  Forsvarets Efterretningstjeneste

3 Välisluureamet

4 Riigi Infosüsteem Amet

5 Sotilastiedustelu

6 Suojelupoliisi

7 Agence nationale de la sécurité des systèmes d’information

8 Agenzia Informazioni e Sicurezza Esterna

9 Agenzia Informazioni e Sicurezza Interna

10 Służba Kontrwywiadu Wojskowego

11 Nationellt Cybersäkerhetscenter

12 MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE DEFEND is a trademark of the MITRE Corporation.

13 CVE-2008-4128 only affects end-of-life Cisco devices.

Disclaimer of Endorsement

The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

Purpose

This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Contact

United States organizations

  • National Security Agency (NSA)
  • Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI)
    •  U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA via the agency’s Incident Reporting System, its 24/7 Operations Center (report@cisa.gov or 888-282-0870), or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment user for the activity; the name of the submitting company or organization; and a designated point of contact. 
  • United States Department of Defense Cyber Crime Center (DC3)  
    • Defense Industrial Base Inquiries and Cybersecurity Services: DC3.DCISE@us.af.mil 
    • Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at https://dibnet.dod.mil.
    •  Media Inquiries / Press Desk: DC3.Information@us.af.mil

Australian organizations

  • Australian Signals Directorate
    • Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.

Canadian organizations

  • The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices. 

New Zealand organizations

United Kingdom organizations

Estonia organizations

Finnish organizations

French organizations

  • French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18.

Italian Organizations

Appendix A: MITRE ATT&CK tactics and techniques

See Table 1 through Table 10 for all the threat actor tactics and techniques referenced in this advisory.

Table 1: Reconnaissance

Technique Title

ID

Use
Active Scanning: Scanning IP Blocks T1595.001 Scan range of IP addresses
Active Scanning: Vulnerability Scanning T1595.002 Scan victims for vulnerabilities that can be used during targeting
Table 2: Resource Development

Technique Title

ID

Use
Acquire Infrastructure: Virtual Private Servers  T1583.003  Leverage VPS as infrastructure 
Compromise Infrastructure: Network Devices  T1584.008  Compromise intermediate routers 
Obtain Capabilities: Exploits  T1588.005  Use publicly available code to exploit vulnerable devices 
Table 3: Initial Access

Technique Title

ID

Use
Exploit Public-Facing Application  T1190  Exploit publicly known CVEs 
Proxy T1090 Use a connection proxy to direct network traffic 
Table 4: Execution

Technique Title

ID

Use
System Services T1569 Executing commands via SNMP
Table 5: Privilege Escalation

Technique Title

ID

Use
Exploitation for Privilege Escalation T1068 Exploit publicly known CVEs for escalated privileges
Table 6: Stealth

Technique Title

ID

Use
Obfuscated Files or Information T1027 Obfuscate source IP addresses in system logs, as actions may be recorded as originating from local IP addresses
Table 7: Credential Access

Technique Title

ID

Use
OS Credential Dumping T1003 Collect router configuration with weak Cisco Type 7 passwords and Type 0
Table 8: Collection

Technique Title

ID

Use
Data from Configuration Repository: SNMP (MIB Dump)  T1602.001  Target MIB to collect network information via SNMP 
Data from Configuration Repository: Network Device Configuration Dump T1602.002 Acquire credentials by collecting network device configurations
Table 9: Command and Control

Technique Title

ID

Use
Proxy  T1090  Use VPS for C2 
Application Layer Protocol  T1071  Open and expose a variety of different services, including TFTP and FTP
Table 10: Exfiltration

Technique Title

ID

Use
Exfiltration Over Alternative Protocol T1048 Exfiltrating over a different protocol than that of the existing command and control channel. 

Appendix B: MITRE D3FEND countermeasures

See Table 11 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.

Table 11: MITRE D3FEND Countermeasures

Countermeasure Title

ID

Description
Application Configuration Hardening D3-ACH
  • Use SNMPv3 and disable SNMPv1 and SNMPv2. 
  • Use SNMP allowlisting to restrict access to OIDs and MIBs. 
  • Disable Cisco Smart Install.
Message Authentication D3-MAN
  • Use SNMPv3 with strong authentication.
Message Encryption D3-MENCR
  • Use SNMPv3 to encrypt payloads.
Credential Hardening D3-CH
  • Use strong, unique passwords and store them securely.
Platform Monitoring D3-PM
  • Monitor for unusual credentials. 
  • Monitor SNMP Set-Requests for OIDs targeting sensitive device data.
Network Traffic Filtering D3-NTF
  • Use ACLs to only allow management protocols from management devices. 
  • Block TFTP, SMI, and SNMP at edge firewalls.
Network Vulnerability Assessment D3-NVA
  • Use an attack surface management service.
Received — 10 July 2026 ⏭
Received — 18 June 2026 ⏭
Received — 8 June 2026 ⏭

Preparing for the World Stage

✇CISA Blog
By: CISA
27 May 2026 at 14:00
CISA is helping host cities strengthen readiness for FIFA World Cup 2026™ through full‑scale exercises, security assessments, and close coordination with local, state, and federal partners.
Received — 21 May 2026 ⏭
Received — 23 April 2026 ⏭

Defending Against China-Nexus Covert Networks of Compromised Devices

✇CISA Alerts
By: CISA
21 April 2026 at 17:12

Defending against china-nexus covert networks of compromised devices

executive summary

Defending against China-nexus covert networks of compromised devices 

Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it 

Summary

With support from the UK Cyber League, this advisory has been jointly released by the National Cyber Security Centre (NCSC-UK) and international partners: 

  • Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)
  • Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)
  • Germany Federal Office for the Protection of the Constitution -   Bundesamt für Verfassungsschutz (BfV)
  • Germany Federal Intelligence Service – Bundesnachrichtendienst (BND)
  • Germany Federal Office for Information Security - Bundesamt für Sicherheit in der Informationstechnik (BSI)
  • Japan National Cybersecurity Office (NCO) - 国家サイバー統括室
  • Netherlands General Intelligence and Security Service - Algemene Inlichtingen- en Veiligheidsdienst (AIVD)
  • Netherlands Defence Intelligence and Security Service - Militaire Inlichtingen- en Veiligheidsdienst (MIVD)
  • New Zealand National Cyber Security Centre (NCSC-NZ)
  • Spain National Cryptologic Centre – Centro Criptológico Nacional (CCN)
  • Sweden National Cyber Security Centre - Nationellt cybersäkerhetscenter (NCSC-SE)
  • United States Cybersecurity and Infrastructure Security Agency (CISA)
  • United States Department of Defense Cyber Crime Center (DC3)
  • United States Federal Bureau of Investigation (FBI)
  • United States National Security Agency (NSA) 

Its purpose is to provide network defenders with the tools needed to defend against China-nexus cyber actors and their tactic of using large scale networks of compromised devices (covert networks) to route their cyber activity. 

Introduction  

Over the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices. 

The NCSC believes that the majority of China-nexus threat actors are using these networks (hereafter “covert networks”), that multiple covert networks have been created and are being constantly updated, and that a single covert network could be being used by multiple actors. These networks are mainly made up of compromised Small Office Home Office (SOHO) routers, as well as Internet of Things (IoT) and smart devices. 

Anyone who is a target of China-nexus cyber actors may be impacted by the use of covert networks. They have been used by Chinese state-sponsored actors Volt Typhoon to pre-position offensive cyber capabilities on critical national infrastructure. The group Flax Typhoon used a different covert network of compromised infrastructure to conduct cyber espionage. 

The use of covert networks of compromised devices - also known as botnets - to facilitate malicious cyber activity is not new, but China-nexus cyber actors are now using them strategically, and at scale.  

This advisory describes the typical makeup of a covert network and what they are being used for. It also includes protective advice for organizations being targeted by cyber activity using a covert network as an access vector.

Covert Networks 

Covert networks are used to connect across the internet in a low-cost, low-risk, deniable way, disguising the origin and attribution of malicious activity. Actors have been observed using them for each phase of their Cyber Kill Chains, from performing scans as part of reconnaissance, to the delivery of malware, communicating with said malware, and exfiltrating stolen data from a victim. They can also be used for general deniable internet browsing, allowing threat actors to research exploitation techniques, new TTPs, and their victims without attribution. Some covert networks are also used by legitimate customers to browse the internet, making it challenging to attribute malicious activity. 

There is evidence that covert networks used by China-nexus actors are created and maintained by Chinese information security companies. A network known to network defenders as Raptor Train, which in 2024 infected more than 200,000 devices worldwide, was controlled and managed by the Chinese company, Integrity Technology Group. This company was also assessed by the FBI to be responsible for the computer intrusion activities attributed to China-based hackers known as Flax Typhoon. 

Botnet operations represent a significant threat to the UK by exploiting vulnerabilities in everyday internet-connected devices with the potential to carry out large-scale cyber attacks – NCSC Director of Operations, Paul Chichester 

Covert networks mostly consist of compromised SOHO routers, but they also pull in any vulnerable device they can exploit at scale. Raptor Train was made up of thousands of SOHO routers and IoT devices, such as web cameras and video recorders, as well as firewalls and Network Attached Storage (NAS) devices. The KV Botnet used by Volt Typhoon was mainly made up of vulnerable Cisco and NetGear routers. The edge devices were vulnerable because they were “end of life” – out of date and no longer receiving updates or security patches by their manufacturers. 

The cyber security industry has been aware of examples of these networks for some time and has publicly reported on the widespread scale of the threat and its implications. Mandiant Intelligence produced a public blog in May 2024 talking about covert networks in which they highlighted a key issue for defenders – indicator of compromise (IOC) Extinction. If a particular threat group could now come from one of many covert networks, each with potentially hundreds of thousands of endpoints, and each used by multiple threat actors, old network defense paradigms of static malicious IP block lists will be less effective. This is compounded by the dynamic nature of these networks where new nodes will be added as old devices are patched or removed from use. 

Typical Network Topology

The number of covert networks used by China-nexus cyber actors is large, with new networks regularly developed and deployed. The existing covert networks change too, either because of defensive or legal action, or simply as a result of software updates and new exploits being used to target different technologies for incorporation into the network. 

Because of this, a description of all known covert networks in detail, including how they are constructed and how they communicate, would immediately be out of date – and for most network defenders would not be practically useful. 

However, most covert networks of compromised devices use the same basic set up. Understanding this generalized structure can aid researchers and defenders by helping them to understand which part of a network they may have found, and how to defend against it. 

A diagram illustrating the basic setup of a covert network.
A diagram illustrating the basic setup of a covert network.

The diagram above illustrates the basic setup of a covert network, where typically an actor will connect to the network via an on-ramp or entry node. Their traffic will be forwarded through multiple compromised devices, used as traversal nodes, before exiting the network from an exit node, usually in the same geographic region as the target. 

Protective Advice 

Defending from attackers using covert networks is not straightforward, and defensive tactics will be different based on the levels of resource and the nature of the target organization. General advice for good cyber security practice should be followed, and some key messages can be found in the appendix of this advisory.  

The following advice is specifically tailored to steps which can be taken to combat the risk of attacks coming from large, dynamic networks of compromised devices. 

Further guidance for all organizations facing cyber security threats is available on the NCSC website. 

This guidance should be considered alongside all applicable laws and regulations of the UK and co-sealing countries relating to the security of networks and data. It will be each organization’s responsibility to ensure compliance with any such laws and regulations. Organizations should note that following the recommended actions set out below will not remove all risks.

All organizations

The NCSC recommends the following steps for all affected organizations to either take themselves, or ask their managed service and/or security providers to investigate for them: 

  • Map and understand network edge devices, developing a clear understanding of organizational assets and what should be connecting to them.
  • Baseline normal connections, especially to corporate virtual private networks (VPNs) or other similar services.
    • Would you expect connections from consumer broadband ranges?
  • Leverage available dynamic threat feeds which include covert network infrastructure.
  • Implement multifactor authentication for remote connections.

Smaller organizations should consider creating and actioning a free NCSC Cyber Action Toolkit. 

Larger or more at-risk organizations

Some more comprehensive measures may be appropriate if the risk to an organization is high enough, to be conducted either in-house or through a security provider:  

  • Apply IP address allow lists rather than deny lists for connections to corporate VPNs for remote workers.
  • Use geographic allow lists or profile incoming connections based on operating system, time zones, and/or organization specific system configuration settings.
  • Implement zero trust policies for connections.
  • Enforce machine certificates for Secure Sockets Layer (SSL) connections.
  • Reduce the internet-facing presence of the IT estate.
  • Investigate machine learning techniques to profile normal network edge activity to detect and block anomalies. 

The NCSC's Cyber Essentials can help protect organizations of all sizes. 

Largest or most at-risk organizations 

If Advanced Persistent Threat (APT) tracking is part of an organization’s in-house capability, or if it is part of the service provided by a security vendor, consider tracking China-nexus covert networks as APTs in their own right.

  • Active hunting – look for connections from IP addresses likely to be part of a covert network of compromised devices, for instance those hosting SOHO routers or IoT devices.
  • Track and map covert networks reported by industry or government by looking at banners and certificates.
  • Use threat reporting and threat feeds to create and implement dynamic blocklists and create alert rules to detect incoming threats.
  • Consider using NetFlow feeds to look upstream and map covert networks to find new nodes. 

The NCSC Cyber Assessment Framework provides guidance for organizations under the highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.  

MITRE ATT&CK® 

This advisory has been compiled with respect to the MITRE ATT&CK® framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. 

Tactic 

ID 

Technique 

Procedure 

Resource Development 

Compromise Infrastructure: Botnet 

Botnets are used as core components of covert networks 

Resource Development 

Compromise Infrastructure: Network Devices 

Devices are compromised and added to botnets 

Resource Development 

Acquire Infrastructure: Virtual Private Server 

Virtual private servers (VPS) are used in covert networks, typically as on-ramps 

Command and Control 

Proxy: Multi-hop Proxy 

Used by China-nexus cyber actors to route traffic 

 Appendix: Cyber Security Best Practices 

In addition to the protective advice outlined in this advisory, a number of cyber security best practices will also be useful in defending against the activity described in this advisory. 

Disclaimer  

This report draws on information derived from NCSC and industry sources. Any NCSC findings and recommendations made have not been provided with the intention of avoiding all risks and following the recommendations will not remove all such risk. Ownership of information risks remains with the relevant system owner at all times. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by co-sealers. UK readers should refer to the NCSC website for information about NCSC assured services. 

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation.  

Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk.  

All material is UK Crown Copyright © 

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

✇CISA Alerts
By: CISA
6 April 2026 at 13:03

Advisory at a Glance

Title Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
Original Publication April 7, 2026
Last Update  July 22, 2026
Executive Summary The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.
Last Update Description This update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs. It also expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practices for secure deployment.
Affected Products Potentially all internet exposed PLCs, including Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and other branded/manufactured PLCs.
Key Actions
  • Install PLCs consistent with manufacturers' guidelines and security best practices.
  • Remove PLCs from direct internet exposure via secure gateway and firewall; work with IT/OT team members and/or integrators to perform this action.
  • Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including 44818, 2222, 102, and 502, especially traffic originating from foreign hosting providers.
  • For Rockwell Automation devices, place the physical mode switch on the controller into run position. If you suspect your organization was targeted, including against other branded PLC devices, contact the authoring agencies and PLC manufacturer for guidance.
Indicators of Compromise

For a downloadable copy of July 22, 2026 IOCs, see:

For a downloadable copy of historical April 7, 2026 IOCs, see:
Intended Audience

Organizations: Critical Infrastructure

Sectors: Government Services and Facilities, Water and Wastewater Systems (WWS), and Energy 

Roles: Integrators, asset owners, defensive cybersecurity analysts, OT cybersecurity engineers, cybersecurity architects, secure systems developer

Introduction

Note: This advisory was originally published on April 7, 2026, to provide tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to ongoing cyber exploitation of internet-connected operational technology (OT) devices by Iranian-affiliated advanced persistent threat (APT) actors. The authoring agencies updated this advisory on July 22, 2026, to add new guidance on detecting malicious changes in reusable code modules leveraged within Rockwell Automation PLC programs. It also expands the manufacturer scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practice resources for secure deployment.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), United States Cyber Command – Cyber National Mission Force (CNMF), and Department of the Treasury (Treasury) (hereafter referred to as the “authoring agencies”) are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected OT devices—including PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs—across multiple U.S. critical infrastructure sectors. As a result of this activity, organizations from multiple U.S. critical infrastructure sectors experienced disruptions through malicious interactions with PLC project files1 and the manipulation of data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. In a few cases, this activity caused operational disruption and financial loss.

The authoring agencies assess a group of Iranian-affiliated APT actors is conducting this activity to cause disruptive effects within the United States. The group targeted devices spanning multiple U.S. critical infrastructure sectors, including Government Services and Facilities (to include local municipalities), Water and Wastewater Systems (WWS), and Energy Sectors. The authoring agencies previously reported on similar activity targeting PLCs by CyberAv3ngers (aka Shahid Kaveh Group)—a cyber threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).

Due to the widespread use of these PLCs, and the potential for additional targeting of other branded OT devices across critical infrastructure, the authoring agencies recommend U.S. organizations urgently review the TTPs and IOCs in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the Mitigations section of this advisory to reduce the risk of compromise.

If owners and operators discover an affected internet-accessible device in their environment, additional technical measures may be necessary to evaluate the risk of compromise. Please engage your cyber incident response plans and contact the authoring agencies and applicable vendors through existing support channels available to customers and integrators (see Contact Information) to receive support, mitigation, and investigation assistance.

For more information on Iranian malicious cyber activity, see CISA’s Iran Threat Overview and Advisories webpage and the FBI’s Iran Threat and Iran Cyber Threat Overview webpages.

Download the PDF version of this report:

(New, July 22, 2026) For a downloadable copy of July 22, 2026 IOCs, see:

For a downloadable copy of historical April 7, 2026 IOCs, see:

AA26-097A.stix_.xml (XML, 35.97 KB )
AA26-097A.stix_.json (JSON, 11.87 KB )

Background Information

Similar Historical Activity Targeting Programmable Logic Controllers

During a similar campaign beginning in November 2023, the IRGC CEC-affiliated cyber threat actors known as "CyberAv3ngers” targeted U.S.-based PLCs and HMIs, causing disruptive effects. Private industry and open sources also refer to this group as Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691, and the Shahid Kaveh Group. These attacks compromised at least 75 devices, targeting U.S.-based Unitronics PLC devices with an HMI used across multiple critical infrastructure sectors, including the WWS. APT actors developed and deployed custom ladder logic code to these devices, replacing the valid ladder logic with malicious code that continues to be observed to date.

For more information on this group’s activity, see the joint Cybersecurity Advisory IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities.

Ongoing Threat Actor Activity Against U.S.-Based Programmable Logic Controllers

The FBI observed Iranian-affiliated APT actors targeting internet-exposed PLCs with the intent to cause disruptions—including maliciously interacting with project files, and manipulating data displayed on HMI and SCADA displays—to U.S. critical infrastructure organizations. Iranian-affiliated APT targeting campaigns against U.S. critical infrastructure have recently escalated, likely in response to hostilities between Iran, and the United States and Israel.

(New, July 22, 2026) At one U.S. victim, the FBI observed the APT actors download a malicious project file to a targeted PLC using configuration software. Analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment.

Since at least March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT group disrupted the function of PLCs. Organizations across several U.S. critical infrastructure sectors (including Government Services and Facilities, WWS, and Energy Sectors) deployed these PLCs within a wide variety of industrial automation processes. Some of the victims experienced operational disruption and financial loss.

Technical Details

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 19. See the MITRE ATT&CK Tactics and Techniques section of this advisory for tables of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

Initial Access

(Updated, July 22, 2026) The authoring agencies observed Iranian-affiliated APT actors using several foreign-based IP addresses to access internet-facing PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs [T0883]. The actors used leased, third-party hosted infrastructure and manufacturers’ PLC programming software to connect to misconfigured victim PLCs. Inbound malicious traffic has been observed targeting PLC devices on the following ports: 44818, 2222, 102, and 502, as well as targeting modems on port 22. Targeted devices include:

  • Rockwell Automation: CompactLogix and Micro850 PLCs
  • Schneider Electric: BMX P34/Modicon M340 PLCs
  • Siemens: S7-1200 series PLCs

Command and Control

(Updated, July 22, 2026) The targeting of ports [T0885] associated with other OT vendors’ protocols suggests these actors are opportunistically targeting devices manufactured by companies other than Rockwell Automation/Allen-Bradley, including Schneider Electric and Siemens. In one reported instance, the actors utilized Dropbear Secure Shell (SSH) software on victim modems to enable them to gain remote access through port 22 [T1219].

Exfiltration

(New, July 22, 2026) The authoring agencies observed Iranian-affiliated APT actors using configuration software—such as Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal—on leased, third-party hosted infrastructure to exfiltrate device project files from PLC devices to threat-actor-controlled infrastructure [T1041].

Impact

(Updated, July 22, 2026) After the actors extracted device project files, the FBI and CISA identified the modification and deletion of project file logic, to include Add-On Instructions (AOIs) and data manipulation on HMI and SCADA displays [T1565]. Additionally, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.

Note: An AOI is analogous to a “Function Block” or “User Defined Function Block” used in other PLC vendor programs.

Indicators of Compromise

See Table 1 and Table 2 for recent IP addresses used by the Iranian-affiliated APT actors to communicate with PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens in the United States.

Disclaimer: The FBI observed the threat actors using the IP addresses listed below in the specified time frames. This data is being provided for customers to query against logs for indications of historical targeting by the Iranian-affiliated APT actors. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.

Table 1. Indicators of Compromise (New, July 22, 2026)
Indicator Beginning of Actor Association End of Actor Association
185.82.73[.]175 September 2025 February 2026
141.11.164[.]153 January 2026 June 2026
175.110.121[.]42 February 2026 March 2026
175.110.121[.]39 February 2026 March 2026
175.110.121[.]41 February 2026 March 2026
175.110.121[.]107 February 2026 February 2026
192.142.54[.]79 May 2026 June 2026
84.200.205[.]165 May 2026 June 2026
185.225.17[.]225 June 2026 July 2026
79.133.46[.]209 July 2026 July 2026
88.80.150[.]199 July 2026 July 2026
88.80.150[.]200 July 2026 July 2026
88.80.150[.]202 July 2026 July 2026
Table 2. Indicators of Compromise 
Indicator Beginning of Actor Association End of Actor Association
185.82.73[.]162 January 2025 March 2026
185.82.73[.]164 January 2025 March 2026
185.82.73[.]165 January 2025 March 2026
185.82.73[.]167 January 2025 March 2026
185.82.73[.]168 January 2025 March 2026
185.82.73[.]170 January 2025 March 2026
185.82.73[.]171 January 2025 March 2026
135.136.1[.]133 March 2026 March 2026

MITRE ATT&CK Tactics and Techniques

See Table 3 to Table 6 for all referenced threat actor tactics and techniques in this advisory. The authoring agencies recommend organizations review historical TTPs for similar Iranian-affiliated cyber actor activity in IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 3. Initial Access
Technique Title ID Use
Internet Accessible Device T0883 The actors accessed and interacted with publicly exposed, internet-accessible PLCs that lacked sufficient network and/or hardening security controls.

 

Table 4. Command and Control
Technique Title ID Use
Commonly Used Port T0885 The actors leveraged commonly used OT ports to communicate with PLCs.
Remote Access Tools  T1219 The actors deployed Dropbear SSH software on victim modems to enable them to gain remote access through port 22.
Table 5. Exfiltration (New, July 22, 2026)
Technique Title ID Use
Exfiltration Over C2 Channel T1041 The actors used remote, third-party hosted infrastructure as a C2 channel to transfer device project files out of victim environments.
Table 6. Impact
Technique Title ID Use
Data Manipulation T1565 The actors maliciously interacted with project files, including modifying and deleting project file logic, and altered data displayed on HMI and SCADA displays.

Mitigations

The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

Network Defenders

The cyber threat actors accessed PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other branded/manufactured PLCs to cause disruptions to victim systems. To safeguard against this threat and threats to other types of PLCs, the authoring agencies urge organizations to consider the following mitigations.

(Updated, July 22, 2026) In addition to contacting the authoring agencies, organizations and integrators operating PLCs from the manufacturers mentioned in this advisory should review the previously issued guidance to strengthen the security of their OT deployments:

  • Rockwell Automation: Contact the Rockwell Automation Product Security Incident Response Team (PSIRT) at PSIRT@rockwellautomation.com for questions regarding this guidance, or to report cyber incidents related to Rockwell Automation products.
    • Refer to Rockwell Automation Security Advisory SD1771 for recommended PLC hardening measures and configuration guidance.
  • Schneider Electric: Contact the Schneider Electric Corporate Product Cyber Emergency Response Team (CPCERT) at cpcert@se.com for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.
  • Siemens: Contact Siemens ProductCERT at productcert@siemens.com for questions regarding this guidance, or to report cyber incidents and vulnerabilities related to Siemens products.

Immediate steps to prevent the attack:

  • Disconnect the PLC from the public-facing internet [CPG 3.S]. Follow the joint guidance Secure connectivity principles for OT to safely allow remote access. Specifically, “remove inbound port exposure,” so the OT system is never directly exposed to the internet or external networks, and to ensure all access is mediated, monitored, and controlled. Do this through a secure gateway (jump host) that brokers the connection.
    • Ensure cellular modems, used for remote field connectivity and access, are secured with strong authentication and updated.
    • Enable logs for connected modems and regularly review for suspicious activity to detect intrusions and improve incident response speed.
    • (New, July 22, 2026) To mitigate unauthorized access to OT via cellular modems, organizations should consider implementing isolated architectures, such as private Access Point Name (APN), 5G Public Network Integrated Non-Public Network (PNI-NPN), cellular Software-Defined Wide Area Network (SD-WAN), Zero Trust Network Access (ZTNA), or a site-to-site virtual private network (VPN).
  • (New, July 22, 2026) Strictly control network access to PLC devices.
    • Configure firewall rules or access control list (ACL) security features on PLCs or programmable controllers to allow only authorized communications between expected control system devices. Block access from unauthorized or threat actor-controlled IP addresses, such as those associated with hosting providers.
  • For controllers with a physical mode switch, place the physical mode switch into run position to prevent remote modification. Devices should only be in the program or remote position when updating or downloading software online and immediately switched back to the run position when complete. (See Rockwell Automation’s2 System Security Design Guidelines for manufacturer’s instructions.)
    • (New, July 22, 2026) Prior to switching the device to run mode, review and validate project files, as changing modes will lock in the current project file downloaded to the device.
  • For devices that allow software key switching, enable programming protection in PLC configuration software (S7 TIA Portal) to limit who can modify PLCs remotely. (See Siemens’ Cybersecurity for Industry Operational Guidelines for the manufacturer’s instructions.)

Follow-up steps to strengthen security posture:

  • (New, July 22, 2026) Review project files running on PLCs for unauthorized changes. Use vendor-provided integrity checking tools and visually compare the running program to known good logic. Ensure reusable logic and input/output configurations are valid. For Rockwell Automation PLCs listed in the Customer Guidance to Disconnect Devices from the Internet, check the AOIs for any anomalous modifications.
    • If restoring from backups, verify the backup does not contain malicious logic before deployment.
    • Review logs and configurations on all connected devices, including modems, HMIs, and workstations, to assess potential lateral movement by threat actors. If it appears the actors connected to additional devices, reimage these devices to remove any potential malicious changes or access tools.
  • (New, July 22, 2026) Ensure device passwords are changed from their default and are configured to use complex, unique combinations of letters, numbers, and symbols that are not easily guessable. Implementing robust password practices remains a critical security measure that can help prevent unauthorized access and strengthen the overall security posture of OT devices.
  • (New, July 22, 2026) Take defensive measures to minimize the risk of exploitation. Conduct comprehensive impact analysis and risk assessments prior to deploying defensive measures.
  • Create and test strong backups of the logic and configurations of PLCs. Store backup files offline and secure the physical removal media to enable fast recovery.
  • Implement multifactor authentication (MFA) [CPG 3.F] for access to the OT network from an external network.
  • If remote access is required, implement a network proxy, gateway, firewall, and/or VPN in front of the PLC to control network access.
    • A VPN or gateway device can enable MFA for remote access even if the PLC does not support MFA. Implement security rules on these higher-level network security mechanisms to prevent the type of repeated and sustained login attempts seen during a brute force attack. When possible, implement a device control list for workstations sending messages or connecting to OT components.
    • Use the device control list to monitor for logon activity for unexpected or unusual access to devices from the internet.
  • Keep PLC devices updated with the latest software patches issued by the manufacturer. Use established downtime windows to install patches. Known Exploited Vulnerabilities may need to be prioritized outside a downtime window.
  • Configure external and internal firewalls to block traffic using common ports associated with network protocols that are unnecessary for the particular network segment.
  • Disable any unused authentication methods, logic, or features, such as default authentication keys and passwords, as well as unused or needed services such as Teletype Network (Telnet), File Transfer Protocol (FTP), Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), and web services.
  • Monitor asset management systems for device configuration changes, which can be used to understand expected parameter settings.
  • Monitor the content of network traffic for the following:
    • Unusual logins to internet-connected devices or unexpected protocols to/from the internet. 
    • Functions of industrial control systems management protocols that change an asset’s operating mode or modify programs.
  • (New, July 22, 2026) Ensure service providers are informed of active threats targeting internet-connected PLC devices. Owners and operators should communicate directly with service providers to address risks, especially when remote monitoring or maintenance is involved. Some service providers may rely on internet connectivity essential to monitor and maintain OT/ICS operations but may not be fully aware of active threats.

In addition, the authoring agencies recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, as well as reduce the impact and risk of compromise by cyber threat actors:

  • Reduce risk exposure. CISA offers a range of services at no cost, including scanning and testing, to help organizations reduce exposure to threats via mitigating attack vectors. CISA’s Cyber Hygiene Services can help provide additional review of organizations’ internet-accessible assets. 

Device Manufacturers

Note: The following guidance is general in nature and not specific to any OT vendor. Some of the features, settings, and practices may already be offered by certain vendors. The inclusion of this guidance should not be interpreted as an assertion that vendors referenced do not offer such security features. Also, this advisory is not highlighting a new vulnerability in the identified products, but instead discusses opportunistic targeting. Device manufacturers can make opportunistic attacks more difficult at scale by encouraging more secure behavior by default and in operations, as discussed below. 

Although critical infrastructure organizations using PLC devices can take steps to mitigate the risks, it is ultimately the responsibility of the device manufacturer to build products secured by design and default. The authoring agencies urge device manufacturers to take ownership of their customers’ security outcomes by following the principles in the joint guide Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products, primarily:

  • Change the manufacturers’ default settings to prevent exposing administrative interfaces to the internet.
  • Do not charge additional fees for basic security features needed to operate the product securely.
  • Support MFA, including via phishing-resistant methods.

By using secure by design tactics, software manufacturers can make product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.

For more information on common misconfigurations and guidance on reducing their prevalence, see joint advisory NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations. For more information on secure by design, see CISA’s Secure by Design webpage and joint guide.

Validate Security Controls

In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

To get started:

  1. Select an ATT&CK technique described in this advisory (see Table 3 to Table 6).
  2. Align your security technologies against the technique.
  3. Test your technologies against the technique.
  4. Analyze your detection and prevention technologies’ performance.
  5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
  6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the ATT&CK techniques identified in this advisory.

Resources

Contact Information

U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, the FBI, and/or NSA:

  • Contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). File a claim with FBI’s Internet Crime Complaint Center (IC3) or contact your local FBI field office. When available, please include the following information regarding the incident: 
    • Date, time, and location of the incident;
    • Type of activity;
    • Number of people affected;
    • Type of equipment used for the activity; and
    • Name of the submitting company or organization, and a designated point of contact.
  • For NSA cybersecurity guidance inquiries, contact CybersecurityReports@nsa.gov.
  • Entities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact EnergySRMA@hq.doe.gov.
  • Contact the Rockwell Automation PSIRT for questions regarding their guidance or for reporting cyber incidents related to Rockwell Automation products at PSIRT@rockwellautomation.com.
  • Contact the Schneider Electric CPCERT at cpcert@se.com for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.
  • Contact Siemens ProductCERT for up-to-date information about the security of Siemens products or to report cybersecurity vulnerabilities at productcert@siemens.com. For support with increasing the security of installed Siemens PLCs, contact Siemens Industrial Cybersecurity Services at services.automation@siemens.com. See Siemens ProductCERT and Siemens CERT for more information.

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA and the authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and the authoring agencies.

Version History

April 7, 2026: Initial version.

July 22, 2026: Update includes new guidance on detecting malicious activity, expanded scope of observed targeting, and best practices for secure PLCs deployment.

Notes

1Project file refers to the software file that contains ladder logic and configuration settings. On Rockwell Automation devices, it is referred to as an .ACD file.

2 See CompactLogix 5370 Controllers (Chapter 5: “Select the Operating Mode of the Controller”) for more information on functions available for the switch.

❌