Metasploit

PATCHCORD: New Malware Cluster Targets Afghan Telecom and South Asian Critical Infrastructure | Community Portal | Gurucul

Researchers reported an active cyber espionage campaign linked with moderate confidence to APT36 (Transparent Tribe) that is targeting telecom, government, defense, energy, and other critical infrastructure organizations across South Asia, including lures tied to Afghan Telecom, government updates, and software installers. The operation uses a malware cluster that includes HACKERAI C2 Agent, PATCHCORD, and SHEETCORD, showing an evolution from earlier custom C/C++ tooling to newer Go-based implants. The malware uses legitimate cloud services as covert command-and-control channels, with HACKERAI abusing GitHub Gists and SHEETCORD using Google Sheets for command traffic and possible data exfiltration. Researchers said HACKERAI can gather system information, execute remote commands, and maintain persistence by modifying browser shortcuts while still opening the legitimate browser to avoid suspicion; published defensive leads include suspicious GitHub activity, altered browser shortcuts, malicious ZIP or installer files, and a set of reported IOCs including domains, an IP address, and multiple SHA-256 hashes.

HACKERAI Malware Turns GitHub Gists Into a Command-and-Control Channel

PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458 | Proofpoint US

Researchers and government agencies reported that the Russia-linked APT28 espionage cluster has continued and expanded Operation RoundPress, a campaign that compromises vulnerable webmail platforms when targets open specially crafted phishing emails. ESET said the operation began against Roundcube and later spread to Horde, MDaemon, and Zimbra, using cross-site scripting flaws to inject malicious JavaScript into active mail sessions and steal credentials, emails, contacts, and in some cases 2FA secrets and app passwords. Proofpoint said the activity persisted into 2026 with a new “half-click” zero-day in SOGo tracked as CVE-2026-8496, while also noting exploitation against Zimbra, MDaemon, Kerio, and Roundcube and a modified SpyPress chain that paired a Roundcube XSS vector with CVE-2025-49113 to pursue server-side code execution and longer-term access. The victim set has centered on government, military, diplomatic, and defense-related organizations, especially in Ukraine and Eastern Europe, but reporting also identified targets in France, Africa, Europe, and South America. ANSSI said French entities have faced repeated APT28 intrusions since 2021 using phishing, webmail brute force, edge-device compromise, and exploitation of flaws including CVE-2023-23397, with recurring Roundcube-focused operations and credential theft infrastructure. CERT-UA separately linked a phishing campaign against Ukrainian local government bodies to UAC-0001/APT28 with medium confidence, citing infrastructure overlap with an earlier Roundcube compromise involving CVE-2023-43770 that stole mailbox credentials and created malicious mail-forwarding rules. Across the reporting, the campaign is described as a strategic intelligence-collection effort tied to Russian state interests and the war in Ukraine.

ioc/Manjusaka at master · gendigitalinc/ioc · GitHub

Cisco Talos disclosed Manjusaka, an offensive framework used in the wild and marketed by its developers as an alternative to Cobalt Strike and Sliver. The toolkit includes a Go-based ELF command-and-control server with a Simplified Chinese interface and Rust-based implants for both Windows and Linux. Talos found a publicly accessible C2 binary on GitHub capable of generating customized payloads, and reported that the Windows implant supports broad remote-access and post-compromise functions including command execution, file management, screenshot capture, browser and Wi-Fi credential theft, Navicat credential theft, and host reconnaissance. Talos also tied the framework to a multi-stage intrusion campaign that used COVID-19-themed Microsoft Word lures referencing Golmud City in Qinghai Province. That infection chain ultimately deployed a Cobalt Strike beacon, while investigators also observed a Manjusaka implant communicating with the same infrastructure, including IP address 39.104.90.45, indicating operational overlap between the tools. Talos stopped short of firm attribution, but said available indicators suggest the framework developer is Chinese-speaking and may be based in Guangdong, China.

Targeted Attack Leverages India-China Border Dispute

Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy Cobalt Strike. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called IndigoDrop into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP Host headers such as update.windows.microsoft.com, and in some variants injected an RSA-encrypted payload into notepad.exe; researchers also identified infrastructure including 47.240.73.77, 114.67.110.37, and 360doc.com-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.

Operation RoundPress targeting high-value webmail servers

Manjusaka: A Chinese sibling of Sliver and Cobalt Strike