Nextron threat research team. Signatures, rules, and analysis focused on eliminating blind spots.
Frankfurt, Germany
Joined October 2024
- Tweets385
- Following13
- Followers4.1K
- Likes243
Pinned Tweet
114,000 OSS artifacts per day. Around 4,618 reach LLM triage. Roughly 100 reach an analyst.
In our latest blog post, @marius_benthin explains how we combine THOR Thunderstorm with LLM triage to monitor ten package registries and extension marketplaces without sending the complete feed to a model.
- THOR Thunderstorm ⚡️ scans the full feed using deterministic detection logic
- Only artifacts with THOR findings enter LLM triage 🤖
- The initial LLM stage costs an average of $2.88 per day
- Suspicious or inconclusive cases reach an analyst
- RuneAI is available on demand for deeper analysis of selected files
The article covers the architecture, operating numbers, limitations and a real malicious VS Code extension detected by the pipeline.
nextron-systems.com/2026/06/…
CopperDragon, a China-nexus threat actor recently documented by Check Point Research (@_CPResearch_), develops the Sparrow Framework, a modular toolkit used by multiple espionage clusters.
The framework supports the full intrusion lifecycle across Windows and Linux, including initial access, payload loading, persistence, credential theft, remote access, and network tunneling.
Our YARA rules cover the following components:
• Initial Access: Spearphishing LNK files that abuse legitimate Windows binaries and malicious DLLs distributed through CAB archives.
• Loaders: SquadC and CopperLoader, including variants masquerading as legitimate OpenSSL, VLC, and WinFsp libraries.
• Backdoors: CopperDoor and CopperDNS, providing remote access and command-and-control capabilities over TLS and DNS.
• Credential Theft: CopperLsass on Windows and trojanized SSH binaries designed to capture credentials on Linux.
• Tunneling and Proxying: CopperProxy, alongside legitimate tools repurposed for malicious use, including FRP and a renamed SoftEther VPN Bridge.
Full analysis, YARA rules, and IOCs:
github.com/NextronSystems/io…
Our Thunderstorm-based artifact pipeline spotted "archetype-index-sdk@1.0.0", the latest npm package linked to a suspected DPRK cluster.
Importing the package automatically loads two obfuscated components disguised as "telemetry-info.mjs" and "dist/runtime-matrix.mjs".
The loader fingerprints the host and sends the collected data to the same C2 infrastructure observed previously: cdn[.]node-js[.]dev.
The server can respond with a Base64-encoded second stage, which is written as "helper.cjs" under the user's cache directory and launched as a detached Node.js process.
This iteration shows the campaign actively changing filenames and delivery mechanics while retaining its C2 infrastructure.
We did some additional pivoting and found packages from this cluster dating back to October 25, 2026. Most have already been removed from npm:
- birch-css-utils@1.1.0
- noelc-css-blender@2.1.9
- character-ai-sdk@1.0.0
- postcss-semantic-themes@1.0.1
- mocha-ui-themes@1.0.0 (still live)
They share obfuscated payloads and, in several cases, identical cross-platform VM-detection binaries.
We also observed credential harvesting, AWS/Bedrock and invoice reconnaissance, along with cron, SSH-key and curl PATH-shim capabilities. The 127.0.0.1:8873 endpoint may be a local relay or controller.
Your core Linux authentication could be compromised without a single alert. We've identified malicious PAM modules that are completely invisible on VirusTotal and bypass advanced LLM-based reverse engineering by altering just one line of source code.
Observed capabilities:
Universal bypass via the hardcoded password. .gnu.version_r, carefully chosen to avoid detection.
Targeted root access via password zZ,s=EB6f#91Lh@[ (observed in Yemen).
Achieved via minimal source code modification to pam_unix with a one-liner poisoning.
1/2
Nextron Research ⚡️ retweeted
Earlier this week, our friends at @nextronresearch documented an RRCfg delivery chain. We hunted for implants with similar code in our platform and uncovered additional samples and delivery chains dating back to September 2026, using different hosts, sideloaded DLLs and C2 infrastructure.
🔹 21 September 2026 — arphaCrashReport.exe / arphaDump64.dll.
Alibaba’s arphaCrashReport.exe, renamed 20260921163500-CC1DB4D9D1744A.exe, sideloads malicious arphaDump64.dll. Its bootstrap downloads Donut from hxxps://xiaxiazai.hkg.bcebos[.]com/kekehua/27.124.41.111.bin on Baidu Cloud BOS and executes it, loading RRCfg configured for 27.124.41[.]111:8083.
Report: reports.threatray.com/331547…
🔹23 September 2026 — ClosePre.exe / kcommon64.dll.
ClosePre.exe, renamed 2026095SDDE20.exe, sideloads malicious kcommon64.dll. Its bootstrap requests hxxps://gdnkdl[.]eu[.]cc/files/ahfayui.eu.cc.bin. No next-stage payload was received.
🔹22 October 2026 — BioEnrollmentHost.exe / wincorlib.dll.
Microsoft BioEnrollmentHost.exe, renamed 20261022128205.BC6FBTAC08T.exe, sideloads malicious wincorlib.dll. The DLL decrypts a bootstrap embedded in the host’s certificate table. It downloads Donut from hxxps://aawwf.hkg.bcebos[.]com/shiade/A03.bin, also on Baidu Cloud BOS, which loads RRCfg configured for 192.252.178[.]174:8083. The loader shares Nextron’s CAFEBABECAFEBABE marker, RC4 key AtkExEmbedKey2026, and SCURLTPL URL configuration.
Report: reports.threatray.com/83d1ff…
🔹25 October 2026 — ahfayui.eu.cc C2 variant.
An RRCfg implant uses ahfayui[.]eu[.]cc, which resolved to 61.18.208[.]171. The same hostname appears in the payload filenames requested by the ClosePre and Edge loaders.
Report: reports.threatray.com/4cd9fe…
🔹3 November 2026 — Edge notification_helper.exe / dbghelp.dll.
Microsoft Edge notification_helper.exe, renamed INV-No.20261102023748.exe, sideloads malicious dbghelp.dll. This loader also decrypts a certificate-embedded bootstrap, then requests hxxps://bmafhahl[.]eu[.]cc/files/ahfayui.eu.cc.bin. No next-stage payload was received.
🧬 Sample hashes, #IOCs and analysis reports: github.com/threatray/threat-…
Our generic YARA rules detected every stage of Gorbag's toolchain well before ESET’s analysis was published this week.
Here's the timeline:
July 2025: BeautyStealer detected.
September 2025: Prime ReverseShell detected.
February 2026: Weaponized LNKs detected just one day after their first submission.
These detections didn't just identify known malware. They also helped us uncover additional samples and expand the picture of Gorbag's activity beyond what was covered in the ESET report.
Gorbag has been targeting Ukrainian law enforcement, justice, defense, and local government institutions near the frontline since February 2025.
The activity involves BeautyStealer, a C++ browser stealer, and Prime ReverseShell, a PowerShell reverse shell packaged with PS2EXE. Initial access relies on spearphishing and weaponized RAR archives exploiting CVE-2025-8088.
Analysis and IOCs:
github.com/NextronSystems/io…
We identified a DLL sideloading chain that hides its first stage in the certificate table of a genuine, Microsoft-signed sllauncher.exe (Silverlight launcher). The signature appears intact, and a fake oledlg.dll pulls the payload out of the signed EXE.
The chain ends in a modular implant. On its own it only profiles the host, reports installed AV and operator-chosen running processes, and loads PE plugins on demand. Everything else is left to plugins the operator sends, likely to keep the implant small.
The lures are generic invoice and payment-themed documents aimed at Western businesses.
Full analysis + IOCs: github.com/NextronSystems/io…
We did some additional pivoting and found packages from this cluster dating back to October 25, 2026. Most have already been removed from npm:
- birch-css-utils@1.1.0
- noelc-css-blender@2.1.9
- character-ai-sdk@1.0.0
- postcss-semantic-themes@1.0.1
- mocha-ui-themes@1.0.0 (still live)
They share obfuscated payloads and, in several cases, identical cross-platform VM-detection binaries.
We also observed credential harvesting, AWS/Bedrock and invoice reconnaissance, along with cron, SSH-key and curl PATH-shim capabilities. The 127.0.0.1:8873 endpoint may be a local relay or controller.
Interesting malware payload in persona-ai-sdk@1.0.0. Customized js-obfuscator around a worm payload that contains crypto dead drops overlapping with the html-to-gutenberg addresses (PolinRider). There's also what seems to be some astroturfing mentions of the package name across x and youtube.
Only, the crypto dead drops seem to use a local IP address and don't actually download the next stage. Unsure whether this is DPRK testing in public or misguided adversary emulation but block cdn.node-js[.]dev either way
One Arid Gopher section in @ESET latest APT report led us to two more campaigns using the same playbook.
They target Arabic-speaking government employees, HR and diplomatic staff, students, activists and NGO workers across the Middle East, using polished Arabic survey and exam-paper lures. ESET ties one lure document to the Palestinian Authority's Ministry of Foreign Affairs and Expatriates.
Campaign 1: a macro document fetches an HTA through WMI, the HTA pulls a Go backdoor out of a PNG using a key byte read from the image, persistence is the Run value HostHelpLoader, C&C is mmarketplaces[.]com.
Campaign 2: a 4 MB libcurl implant inside VHDX, where the payload never receives Mark-of-the-Web, with a Startup link or a scheduled task chosen by an antivirus check.
We assess with high confidence that the sample is Arid Gopher, and therefore Arid Viper activity. The two campaigns share the victimology and naming habits.
Analysis & IOCs: github.com/NextronSystems/io…
Nextron Research ⚡️ retweeted
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this
We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates.
I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast.
I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood.
#ARTEX #Cairn
nextron-systems.com/2026/10/…
🤖 Made with AI
#PHP2SHELL is already making its way into active Linux botnet arsenals.
Spotted a THOR-detected sample with PHP2SHELL-VULN-CVE-2026-109618 integrated alongside 8 existing CVE exploit references.
Botnets are adapting fast.
Patch ASAP and assess your systems for signs of compromise. Don't assume you're safe just because you've patched.
virustotal.com/gui/file/a75f…
Nextron Research ⚡️ retweeted
Our OSS artifact scanning picked this up too
The funny part, at least for us, is that this is a side project built around the scanner and detection rules we already ship for endpoints. Its initial LLM triage costs about $3 a day.
We download packages from public registries, unpack them, and run their files through THOR Thunderstorm. The generic detection rules flag suspicious code, obfuscation and recurring attacker tradecraft. Only artifacts with findings reach the LLM, which gets the matched strings and surrounding context to assess what’s going on.
Across roughly 114,000 artifacts a day, about 4% reach that initial LLM pass. The rest never generate a token bill.
In this case, an existing generic Python rule flagged the malicious sitecustomize.py. We already had the detection logic; we’re just applying it to packages downloaded from registries as well as files found on endpoints.
And that’s what amuses me about this. Supply-chain security attracts substantial funding, and specialist vendors are reporting this compromise. We picked it up by reusing years of endpoint detection engineering in an internal project, with an initial LLM triage bill averaging $2.88/day.
Pretty useful bycatch.
We described the pipeline here:
nextron-systems.com/2026/06/…
We’ve been checking our PHP2SHELL detection coverage at Nextron and extending the rule set based on the published PoCs
After successful exploitation, we expect familiar activity: webshell drops, reverse shells, suspicious child processes, new user accounts… Our generic detection rules have covered many of these patterns for years, so useful coverage was already in place before disclosure.
The blog documents that existing coverage and the additions, explains what the findings can actually tell you, and includes PHP hardening recommendations.
nextron-systems.com/2026/10/…
🤖 Made with AI
#Kimsuky (APT-C-55) is delivering persistent backdoors through multilingual LNK phishing lures
After reading the 360 Threat Intelligence Center's report on APT-C-55's multi-path delivery campaign, we found a cluster of nine related malicious LNK files submitted between September and October 2026, with detection ratios around 10-30 out of 60+ engines.
The LNK files execute a layered attack chain: base64-encoded batch scripts decoded via a renamed copy of certutil.exe, staging in C:\Users\Public, nircmd disguised as ntoskrnl.exe, and scheduled tasks running every 9 minutes for persistence. A parallel variant uses PowerShell with double hex-encoded payloads, and a third path poisons the open-source pybroker Python library as a supply chain attack.
Analysis & IOCs: github.com/NextronSystems/io…
A reminder of how cool THOR Thunderstorm and its collectors are ⚡
Some systems will never run a security agent: ESXi hosts, network appliances, routers, industrial and out-of-support systems. They are still part of your attack surface.
The trick: don't bring the scanner to the machine. Bring the machine's files to the scanner.
- A collector (one Go binary, or one script in Bash, POSIX sh, Python, Perl, PowerShell or Batch) copies selected files to your own THOR Thunderstorm. The originals stay where they are.
- You decide what leaves: recent files, a size limit, selected types. Preview it with a dry run first.
- THOR does the heavy lifting on your server: YARA rules, your own signatures, IOCs, Sigma rules and forensic parsers.
- Findings land in a log, in syslog or in your SIEM. Run it every night with cron or Ansible and ship only what changed.
No agent. Often a shell and a network connection are enough.
93 seconds, no sound, video below
(The findings in the film are illustrative)
Collectors:
github.com/NextronSystems/th…
The written version: github.com/NextronSystems/th…
#DFIR #ThreatHunting #IncidentResponse #YARA #Sigma
#APT28 is using weaponized Office documents to deliver the Covenant Grunt backdoor.
We detected a cluster of seven malicious .docm and .xls files between July 8 and July 14, with some having AV detection ratios as low as 5/62 at the time of first submission. Our THOR APT Scanner's YARA rules caught what traditional engines missed.
The documents use obfuscated VBA macros that assemble strings at runtime to evade static analysis, perform XOR-encoded host reconnaissance, and drop a 64-bit Covenant Grunt loader DLL disguised as a log file. The campaign uses Russian-language lures like "Прайс.xls" (Price List) and business-themed filenames like "accounts.xls", consistent with APT28 targeting patterns. Network analysis shows Dropbox being used as C2 infrastructure.
This activity aligns with Zscaler's reporting on Operation NeuSploit (CVE-2026-21509).
Analysis & IOCs: github.com/NextronSystems/io…
Our research team identified a second downloader variant linked to the WebSockets backdoor campaign recently analyzed by @dmpdump.
While the original downloader was written in native C++, this new variant uses C# (.NET 8).
Same seven payload files, same NVIDIA-themed disguise, but a very different implementation: no obfuscation, plaintext strings, and extensive retry logic designed to handle hours of unreliable connectivity.
An interesting detail: it ships as a 14 MB self-contained .NET single-file executable. Open it in IDA and you'll mainly see the native .NET runtime host rather than the actual downloader logic.
We've developed three new YARA detection rules covering both downloader variants and the WebSockets backdoor, and added them to our THOR scanners.
You can explore the rules' matches on VirusTotal through our Valhalla pages:
valhalla.nextron-systems.com…
valhalla.nextron-systems.com…
valhalla.nextron-systems.com…
Full technical analysis, decompiled source and IOCs:
github.com/NextronSystems/io…
An Iranian threat actor is still running a GitHub-based loader with low detection rate on VirusTotal, six weeks after first submission.
We went hunting after reading Unit 42's Blinder Tunnel report and found a new variant with infrastructure changes not covered in prior reporting: a Cloudflare Workers relay, a new GitHub account, and credential-rotation instructions hidden inside HTML comments on Microsoft/vscode issues, encrypted per-victim so only the targeted host can read them.
The loader was delivered via an Inno Setup installer themed as a Dubai Airport careers IT assessment, targeting Iraq.
Technical analysis + decompiled source + IOCs:
github.com/NextronSystems/io…
