Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process. The new revocations bring the total number of affected intermediate CA certificates to 16, including eight previously compromised certificates whose private keys were so weak that anyone could recover them almost instantly. In a new incident report published Tuesday, eMudhra said that both sets of certificates were affected by a custom Python script used to transfer private keys between hardware security modules (HSMs) in April 2025. HSMs are devices designed to securely generate and store cryptographic keys, preventing sensitive private keys from being exposed outside the hardware.
Notion, the digital workspace platform, disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts in a small number of workspaces. The disclosure comes shortly after Fireworks AI confirmed that an attacker accessed its development environment via a third-party cloud provider on October 23 and compromised resource metadata, billing information, model weights, and datasets for some customers. Fireworks AI experienced another breach in early October, when hackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts. Notion learned about the exposed chat transcripts after receiving an alert from Fireworks on November 2 about an exposed dataset that contained only synthetic test data.
Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS environments. The infrastructure hosting AntiFox was used for various malicious activities, including vulnerability exploitation, webshell deployment, credential validation, configuration discovery, and AWS secret harvesting. Initially created as a fork of ARTEX 0.1.1, AntiFox has a Chinese-language interface and lets users deploy AI agents and automate common penetration-testing tasks, such as mapping exposed services and probing target endpoints for vulnerabilities. Security researchers at Arctic Wolf observed malicious AntiFox-linked infrastructure hosted on Alibaba Cloud using valid AWS identities, including IAM users and, in some cases, assumed EC2 roles, to make authenticated requests to Amazon Web Services APIs.
Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules. Flare reveals how these techniques are spreading through underground forums, where threat actors are sharing rootkit source code, tutorials, and exploits targeting Linux systems.
We uncover Falcon C2, a browser-based threat framework targeting governments via malicious scripts, extensions, and the Antino implant. The post The XG Files: Falcon C2 Flying Under The (Browser) Radar appeared first on Unit 42.
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. This follows N-able's decision to take all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions until it could patch them against potential attacks targeting the zero-day flaws in the wild. "N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher," N-able told BleepingComputer on Monday. "As a precautionary measure, we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice."
Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. The company explained, when it acknowledged this known issue days after the September 2026 Patch Tuesday, that USB Audio Class 1.0 devices failed to start or produce audio on some systems after installing recent updates. Some affected users reported seeing no audio output, unresponsive volume controls and sound settings, and "This device cannot start (Code 10)." errors in Device Manager, while others said the impacted USB audio speakers fail only when using multichannel audio features, including 3D audio or 8-channel modes. These audio issues affect both server (Windows Server 2012 and later) and client (Windows 10 and Windows 11) systems.
Hackers advertise a $1,000-a-month tool claiming persistent Gmail access after password resets, but its effectiveness remains unverified. A developer of hacking tools is selling a $1,000 per month feature that allegedly gives criminals continuous access to Gmail inboxes. The cybersecurity firm Hudson Rock reports that the tool can keep reading a victim’s mailbox after a password change, after the browser closes and after sessions are revoked. “Remus Stealer is advertising a way for criminals to open a compromised Gmail inbox directly from a stolen-device record.” reads the report published by cybersecurity firm Hudson Rock. “Its latest pitch goes further: the operator claims access continues even after the victim changes their password or revokes sessions.” The tool belongs to Remus Stealer, an infostealer, meaning malware that steals data from infected computers. Remus supposedly gives its operators a searchable inbox right inside a stolen-device dashboard. Hudson Rock says it spoke with the developer and with a customer who used it, and the customer supplied screenshots of messages, timestamps and a control for sharing a mailbox with other operators. If the claims are true, the risk goes beyond a single Gmail inbox. Attackers could read password reset links and verification codes, allowing them to access other accounts linked to that email address. This makes Gmail a valuable target because many online services use it to recover accounts. “In the supplied version 1.3.9 announcement, Remus promotes email-code interception without collecting browser cookie files, claims that password changes and session revocation do not stop it, and advertises shareable mailbox links. The feature is listed as Enterprise-only; the main sales thread advertises that tier at $1,000 per month.” continues the report. “The sharing claim concerns giving other operators access to an already acquired mailbox through the service. The material does not show a victim being infected by opening one of those links.” It is still unclear how the tool works. Hudson Rock says Remus does not steal browser cookies, while its developer claims that changing the Gmail password does not stop access. The developer has not shared technical details. He only said that the malware interacts with browser memory, but this does not explain how it can maintain access after a password change or when active sessions are revoked. Hudson Rock believes Remus may obtain or create an authorization token while the victim is logged into Gmail through a browser. A remote component could then use this authorization to access emails even after the malware has stopped running, as long as Google continues to accept it. Tom’s Guide also reports that the tool can bypass Google’s anti-fraud checks and says it has contacted Google for comment. However, other reports highlight some important uncertainties. CyberInsider says Hudson Rock has not confirmed that the tool can maintain access after a password change, nor has it established that the feature exploits a Gmail vulnerability. Hudson Rock has not conducted a controlled test to show that Remus can still access newly received emails after the victim changes their password and revokes existing sessions and third-party access. According to Cybernews, the developer describes the feature as a Gmail “zero-day”. However, this claim has not been independently reproduced. The business side is more concrete. CyberInsider says the mailbox feature sits in an Enterprise tier at $1,000 per month, with shareable mailbox links so criminals can hand an inbox they’ve already compromised to others. The actor behind Remus Stealer offers the MaaS with three subscription tiers: Basic at $250, Pro at $500 and Enterprise at $1,000. This kind of claim has a history. In late 2023, a developer called PRISMA surfaced an exploit that regenerated persistent Google cookies by manipulating a token and account ID pair, and Lumma then used it so access continued after a password reset. It’s a precedent and not proof, since Remus’ mechanism is unknown, and Hudson Rock still treats a Google password change as an essential recovery step, while saying victims should also look for other ways an attacker could keep access. The tool is marketed to “enterprise” customers, so most users are unlikely to be targeted. It will probably be used mainly against organizations and high-profile individuals. Hudson Rock recommends that victims first disconnect and clean the infected computer before accessing their trusted accounts again. They should then change compromised passwords using a clean device and review their signed-in devices to remove suspicious sessions and third-party access. Hudson Rock also advises users to check Gmail settings for unauthorized changes and secure any other accounts that use the compromised mailbox for password resets or verification codes. Other basic precautions remain important: watch out for phishing emails with urgent messages, spelling mistakes or suspicious sender addresses, and keep antivirus software up to date. Tom’s Guide expects Google to introduce additional Gmail protections if the tool proves as effective as its developer claims. For now, this is a vendor’s marketing claim supported by customer screenshots and Hudson Rock’s investigation, not a confirmed Gmail vulnerability. One important detail offers some reassurance: attackers must first infect the victim’s computer and compromise their mailbox before they can use the tool. “Remus is marketing an integrated mailbox-reading capability, and a customer has endorsed its claimed persistence. The most plausible broad model is reuse of access obtained or established during endpoint compromise.” concludes the report. “The evidence does not identify the mechanism or show fresh mail remaining accessible after comprehensive recovery.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Gmail)
The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. Cisco BroadWorks is a cloud unified communications (UC) software platform and the underlying engine allowing telecom carriers and managed service providers (MSPs) to provide branded cloud PBX, voice, and collaboration services to business customers. Tracked as CVE-2026-20320, the security flaw stems from an improper restriction of XML External Entity (XXE) reference weakness in the Open Client Interface (OCI) XML Parser that can allow unauthenticated, remote attackers to read sensitive configuration information from vulnerable systems by sending maliciously crafted XML messages. "This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service," Cisco explained when it patched the bug in August.
In recent years, cyberthreats have increasingly taken a hybrid approach, combining time-tested techniques for advancing through infrastructure, modern methods of evading network filters, and automation powered by large language models. This is also the approach of Citrus Ransomware, a previously undocumented group whose toolset includes VLESS tunnels (used to disguise traffic as regular HTTPS) and a ransomware Trojan from the Sn00py family. The attackers also integrate LLMs (large language models) into the process of infrastructure compromise. In this article, we review the tactics and techniques the group used in recent incidents. Initial Access: attacks through contractors The attackers gain initial access to victims’ infrastructure through compromised contractors. They use credentials stolen from these contractors’ employees to connect to corporate VPNs or directly to internet-facing terminal servers over RDP. Execution: commands, LLMs, and Impacket The attackers run commands on compromised systems through the standard Windows command interpreter and PowerShell. As the attack progresses, they create and run PowerShell scripts, batch files, and commands generated by LLMs. One example of the latter is the commands below, which disable the account of one of the administrators. Comment translation # Disable account # Verify result Both commands come with comments, something attackers rarely bother with, so the comments very likely point to LLM use. And the models did more than generate commands. The attackers also produced full scripts, complete with the comments typical of LLM output. Comment translation # Creating background tasks for each computer with a thread limit # Concurrent task limit control # Quick ping The fragment above comes from a script Citrus used to enumerate active user sessions on domain systems. Besides LLMs, the attackers use atexec, a classic tool from the Impacket collection, to create scheduled tasks that run commands on hosts: Task name Launched executable file sIErKswD C:\Windows\System32\..\System32\cmd.exe PpMBCCSR C:\Windows\system32\cmd.exe QwZtLmNp C:\Windows\..\Windows\System32\cmd.exe We did not see the exact commands behind these tasks, but Group Policy was refreshed after they ran, so they most likely executed gpupdate /force. When the group compromises 1C:Enterprise servers, it uses external data processors (1C-Shell) to run commands. Persistence: scheduled tasks Citrus uses scheduled tasks to launch its malicious tools automatically. The attackers create the tasks manually through PowerShell: On systems that are not regularly rebooted, such as terminal servers, they sometimes run their tools without establishing persistence at all. Privilege Escalation: vulnerabilities and configuration flaws In every case we know of, the contractor domain account used for initial access had very limited privileges, so the attackers tried to escalate them. To do this, they attempted to exploit the authentication bypass vulnerability CVE-2026-54121 (Certighost); these attempts created machine accounts with telltale names in Active Directory, such as: GHOSTAUFTAFGS GHOSTCZYQVAZS GHOSTIVPRLDZA GHOST{8 random letters} These names are generated by scripts making use of an exploit published on GitHub. The exploit works like this: on behalf of the newly created account, it requests a certificate based on the Machine template from the system holding the AD CS role. The Attributes, Subject, and SubjectAlternativeName fields contain parameters like these: <Data Name='Attributes'>CertificateTemplate:Machine\nSAN:dns=dc01.victim.domain\ncdc:91.210.109[.]118\nrmd:dc01.victim.domain </Data> <Data Name='Subject'>CN=GHOSTABUIEFAD.victim.domain</Data> <Data Name='SubjectAlternativeName'>DNS name =dc01.victim.domain\r\n</Data>The cdc attribute specifies the IP address or name of the system that the certification authority must contact to verify the data. The attackers specify the address of a system they control (in this case, 91.210.109[.]118) and send forged data from it. If exploitation succeeds, the certification authority issues a certificate with the specified parameters, based on the specified template. Once the certificate is issued, the domain controller name in its SubjectAlternativeName field lets the attackers authenticate as the domain controller account. In one case, the attackers also uploaded an executable for persistence, on behalf of which PowerShell scripts were launched with nonstandard HostName (Имя узла) field value. Field name translation Severity HostName HostVersion HostId HostApplication EngineVersion RunspaceId PipelineId CommandName CommandType ScriptName Although the file was later deleted, indirect evidence hints at its purpose. For example, the MSFConsole value may indicate that the file is a component of the Metasploit framework. The PowerShell scripts run through this file included an exploit for the CVE-2020-1337 vulnerability; the same exploit is available in the Metasploit GitHub repository. Beyond classic vulnerabilities in Microsoft products, the attackers also took an interest in 1C:Enterprise servers with insecure configurations (article in Russian). On top of the configuration flaws, 1C:Enterprise systems are frequently accessed by support staff and administrators who hold elevated privileges in Active Directory. Together, these factors make it easy for attackers to escalate privileges and start moving laterally. Stealth: covering tracks and masquerading To hinder incident response, the attackers delete their tools and output files and clear the command history. While the tools are still in use in the victim’s infrastructure, the attackers typically give them and their auxiliary objects legitimate-looking names: KasperskyGPO_Deploy_64.exe and KasperskyGPO_Deploy_64_FIXED.exe are self-extracting archives. They contain the Deploy-KasperskyGPO.ps1 script, a directory with a malicious Group Policy Object, and one of two archives, KasperskyAgent.exe or agent.exe. KasperskyAgentInstaller.exe, KasperskyAgent.exe, and agent.exe are self-extracting archives containing the ransomware Trojan executable and auxiliary files. Kaspersky GPO is the name of the Group Policy Object that distributes the ransomware Trojan in the victim’s infrastructure. KasperskyAgentInstallTask and Sysvc are names used for the scheduled task that runs the self-extracting ransomware archive files. Deploy-KasperskyGPO.ps1 is the PowerShell script that creates the malicious Kaspersky GPO. Kaspersky_GPO_Deployment.log is the log of the Deploy-KasperskyGPO.ps1 script. Note that using the Kaspersky name in malicious file names doesn’t help the attackers avoid detection. Kaspersky solutions successfully detect and block these malicious files. Defense Impairment: weak access policies for security tools play into attackers’ hands To stay under the radar longer, the attackers clear event logs on some systems using the built-in wevtutil utility. In addition, once they have sufficient privileges, they disable antivirus protection on hosts, which lets them run tools such as mimikatz. The attackers also go after the centralized management consoles for security solutions, which they then use to disable protection en masse. At the Impact stage, the attackers also use a Group Policy Object that modifies Windows Defender settings in the registry to switch it off. As a result, the antivirus did not respond when the ransomware was launched. Finally, if they have sufficient privileges, the attackers manually add their malicious tools to the antivirus exclusion list. Credential Access: mimikatz, a keylogger, and extraction of credentials from files To capture keystrokes on a compromised system, the attackers use a modified version of the peeping-tom keylogger, whose source code is available on GitHub. The keylogger executable and its log file are located at the following paths: C:\ProgramData\Oracle\Java\jhost.exe C:\Users\<username>\AppData\Roaming\Microsoft\CLR\ErrorLog.txt In the sample we found, stolen data was sent to 91.210.109[.]118. Persistence for the keylogger is provided by the scheduled task described above in the Persistence section. To dump credentials from memory, the attackers use mimikatz. Files related to mimikatz are located at the following paths: C:\ProgramData\x64\mimidrv.sys C:\ProgramData\x64\mimikatz.exe C:\ProgramData\x64\mimilib.dll C:\ProgramData\x64\mimispool.dll To hunt for credentials and other secrets (SSH keys, access tokens, and the like) in files on accessible network shares, the group uses Snaffler. To simplify running the tool, the attackers drop a configuration file on the system: Besides data from network shares, the attackers were interested in data stored in password managers (for example, KeePass) on administrator workstations. Discovery: the standard toolkit Local discovery After gaining control of a compromised system, the attackers ran a basic set of commands to identify the current user, running processes, network interface settings, the system’s external IP address, and so on: whoami tasklist quser ipconfig curl 2ip[.]io Remote discovery In the early stages, the attackers used the fscan scanner to gather information on the internal infrastructure. They were particularly interested in the following ports: 135 (RPC) 139 (NetBIOS-SSN) 1433 (Microsoft SQL) 8006 (Proxmox VE) Once they had the access they needed and had moved laterally, the attackers ran ADRecon on domain controllers and SharpHound on one of the workstations. The attackers also used PowerShell to run LDAP queries against the controllers of adjacent domains, pulling lists of domain systems, users, and groups. Russian text translation The user has no additional groups in memberOf (primary only) User not found As an alternative to PowerShell, the attackers used the net.exe utility to get information about domain users and privileged groups: net users /domain net group "Domain Admins" /domain net group "Администраторы домена" /domain Lateral Movement: SSH, RDP, and WinRM For lateral movement, the group relies on standard remote administration protocols: SSH, WinRM, and RDP. The attackers connect to systems either through previously deployed tunnels or directly from the compromised host. Command and Control: delivering tools to the system To deliver its tools to target hosts, the group uses built-in OS utilities. Specifically, the incidents involved: certutil: The Windows BITS background service (invoked in two ways): cURL: PowerShell: Creating tunnels with Xray The certutil and BITS commands shown above are what the attackers used to download Xray onto victim systems. They then used Xray to set up reverse VLESS tunnels to the command-and-control server. The configuration file, stored alongside the Xray executable, was usually named config.json. In some cases, the attackers deleted it right after starting the tunnel to hide the Xray configuration from defenders. Judging by the configuration files recovered during the analysis, the attackers used port 443 on the VLESS server to blend in with legitimate HTTPS traffic. The configuration files also contain blocks that set up the REALITY protocol, which is intended to disguise the attackers’ traffic as requests to the legitimate site mirror.yandex.ru: The traffic was also disguised as requests to another legitimate site, yastatic.net: Installing AnyDesk The PowerShell command above AnyDesk, which the attackers used to remotely control compromised hosts. After the download, the attackers installed the software with the --silent flag to avoid alerting the user, set a connection password, and used PowerShell to pull the infected machine’s ID (which AnyDesk uses for remote connections on the client side) from the configuration file: Collection & Exfiltration: data from messaging apps Right before encrypting the data, the attackers connected to one of the domain controllers and ran the PowerShell script steal_tgs.ps1, which created the tdatas directory. According to the NTFS USN journal, while the script ran, 7-Zip created archives in this directory with telltale names hinting at their contents: <system_name>_<date>_<username>_tdata.zipThe directory name tdatas and the substring tdata may refer to the C:\Users\<username>\AppData\Roaming\Telegram Desktop\tdata directory. The Telegram messaging app uses this directory to store authorization keys, session data, app settings, and other session information. So the attackers were harvesting messaging app data from remote systems they could reach, packing it with 7-Zip and uploading it to an external web service through Google Chrome. Impact: Sn00py ransomware Trojan The Citrus group uses ransomware from the Sn00py family to encrypt data. It’s written in Go and uses the RSA-2048 and ChaCha20 algorithms to encrypt user files (but not system files) on Windows systems. Encrypted files receive the .citrus extension. For now, decryption is impossible without the attackers’ private key. When launched, the ransomware opens a console on the victim’s device, where it outputs the commands it runs. It also attempts to modify the boot configuration data (BCD) by invoking a nonexistent executable, bcedit (likely a typo for bcdedit): The ransomware’s console output contains the string: We`re going to do something special today :). Made with RaaS platform Sn00py.The string likely means the ransomware is distributed under the ransomware-as-a-service model, where attackers don’t write the malware themselves but subscribe to a ready-made offering. The ransomware configuration contains the Citrus group’s public key in the pubkey parameter: -----BEGIN PUBLIC KEY----- A7+eV3M+EDIh5kId+vf46QkKpAOKxUxv97PDFj66ox+uE0GV9UQhrSmBAoGAcyNI +z7noIwrFYnHi6wtj8gLEOT0hE/cNDp0VLoUnAzi551kZA7J3Q575jwqrJcDrZSO JLkZX7pxLLSd9iQdxMxDrLYZGRtiht8ToD5OGZri36oPvnW56ijJZ/NMzlFtVr7V iSZJr5Qkz2cxShcSuhDLLXmzleclBd7HQtWTuZUCgYEAqN8WFAZxkV2e1p4v3U98 VOu4XxEfqAc2Gs2Ccs/kkWoX/1fxvuSRcF6/hMdfVwUP0z+/fnhbFMNfysBeWo1W ZfmpBF/HbnRSg2ZDLWIwXEXEsNNSRmlvwyHWSEZgyG1xjgjSZKWuxo92WVmPxb5i S6NLrZkHPHwqaBy8CnD6ft8= -----END PUBLIC KEY-----The host_blacklist parameter also lists the system names that are exempt from encryption: [ "DC01", "DC02", "DC03", "DC04" ]This list includes the domain controllers used to distribute the policy that launches the ransomware. This way, the attackers ensure the policy keeps propagating uninterrupted. As it runs, the Trojan drops CITRUS_README.txt files containing the ransom note: -[ All your data were encrypted ] | |-If you try to decrypt them yourself, you will lose your data. To decrypt all systems, you need to contact us for guidance and a data recovery tool in the future. If you ignore our offer and the conversation does not take place, we will take extreme measures against your company and your employees, as a result of which you will lose access to all resources of your network and lose your reputation. | |-To contact us - register your mail here: https://account.proton.me/mail/signup?plan=free and write to us by email: [REDACTED] |-Further negotiations regarding this situation will be conducted there. Also we have Telegram: [REDACTED] | |-Be sure to use a VPN, and do not attempt to write from other email addresses, as there is a high chance that the messages will not be delivered to either party. | |-You have 72 hours to contact us to establish negotiations and interaction, starting from the date of creation of this file. |-If you do not contact us within 3 days, we will consider this a refusal to cooperate. This will entail immediate measures, such as: Dumps of your services, personal data of employees, accounting, contracts and source code. | |-Warning: \\_ Do not delete, modify, or attempt to recover files by any means other than using our key and decryptor. This will damage your data, and we cannot guarantee its recovery. \\_ Do not try to make this public, as you will only harm yourself and your reputation.As mentioned above, the group uses malicious Group Policy Objects to launch the ransomware across victim systems en masse. The GPOs are created by self-extracting archives, of which we have seen two versions. Each archive contains: A self-extracting archive with the ransomware Trojan and auxiliary files. A directory containing the Group Policy Object. The policy drops the ransomware archive on the target system, creates a scheduled task that runs the archive with the parameters /quiet /norestart, enables the WinRM service, and disables the Volume Shadow Copy service and Windows Defender antivirus protection. It also sets a desktop wallpaper displaying the ransom note. A PowerShell script that copies the ransomware archive to the \\<current_domain_name>\SYSVOL directory on the domain controller and links the malicious GPO to the domain using the Import-GPO and New-GPLink One version of the PowerShell script contained comments suggesting that it was likely edited with an LLM: Links to Toy Ghouls While analyzing Citrus activity, we noticed several similarities to Toy Ghouls. Although their infrastructures don’t directly overlap, the two groups share TTPs: they encrypt their victims’ systems, use a similar set of tools (1C-Shell for remote command execution on 1C:Enterprise servers, mimikatz, PsExec, and ADRecon), and store these tools in the same directories. What’s more, both groups are Russian-speaking and attack Russian companies only. In several incidents, we saw the same infrastructure compromised simultaneously by both Toy Ghouls and Citrus. Conclusion What makes Citrus interesting is its unconventional approach to network tunneling and its use of AI to generate auxiliary tools. Even so, the attackers largely rely on well-known tools and techniques, which makes early detection somewhat easier. Kaspersky solutions detect all the activity described in this article. That said, the Citrus attacks are another reminder that contractor access to an organization’s infrastructure must be tightly controlled and restricted. After all, compromising contractor accounts is exactly how the attackers get into their victims’ networks. We’ll continue to track the group’s activity and report new techniques as we discover them. Indicators of compromise File hashes Xray d631627131b90d576d77f4bf530e1abe mst.exe, sabycenter.exe, webex.exe, rpchost.exe Meterpreter stager 7107fb029e7c63523e3aca5fc8e56b38 2341.exe Keylogger e251df2d0b7c3682965efb4d2009a2f4 jhost.exe Sn00py 17b29b6c9de80402a45e321bbe1168fa build_64.exe 9eee984b187423c46c10a63d080da15d build_64.exe fscan cf903e4a1629aa0582fd0363b5786676 fscan.exe File paths C:\ProgramData\ADRecon-Report-* C:\ProgramData\SharpHound.exe C:\ProgramData\Snaffler.exe C:\ProgramData\WebEx\config.json C:\ProgramData\WebEx\host_to_ip.ps1 C:\ProgramData\WebEx\ping_oldwin.bat C:\ProgramData\WebEx\web.txt C:\ProgramData\WebEx\webex.exe C:\ProgramData\ad_ru.ps1 C:\ProgramData\computers.txt C:\ProgramData\config.json C:\ProgramData\default.toml C:\ProgramData\fscan.exe C:\ProgramData\llc\*_BloodHound.zip C:\ProgramData\mst.exe C:\ProgramData\oracle\java\jhost.exe C:\ProgramData\pve.exe C:\ProgramData\rules C:\ProgramData\sabycenter.exe C:\ProgramData\steal_tgs.ps1 C:\ProgramData\tdatas C:\ProgramData\x64\mimikatz.exe C:\ProgramData\xray.exe C:\ProgramData\rpchost.exe C:\ProgramData\3777.exe C:\ProgramData\2341.exe C:\ProgramData\ChromeSetup.exe C:\ProgramData\Kaspersky\KasperskyAgent.exe C:\ProgramData\Kaspersky\KasperskyAgentInstaller.exe C:\ProgramData\1.txt C:\ProgramData\7z2603-x64.exe C:\ProgramData\Kaspersky\task.log C:\ProgramData\enum.ps1 C:\ProgramData\kp.ps1 C:\ProgramData\ping.ps1 C:\ProgramData\result.txt C:\ProgramData\user_activity_report.txt C:\Users\*\AppData\Local\Temp\7ZipSfx.000\Deploy-KasperskyGPO.ps1 C:\Users\*\AppData\Local\Temp\Kaspersky_GPO_Deployment.log C:\Users\*\AppData\Local\Temp\7ZipSfx.000\KasperskyAgent.exe C:\Users\*\Desktop\KasperskyGPO_Deploy_64.exe C:\Users\*\Desktop\KasperskyGPO_Deploy_64_FIXED.exe C:\Windows\SYSVOL\domain\KasperskyAgent.exe C:\Windows\SYSVOL\domain\build_64.exe C:\Windows\SYSVOL\domain\icon.ico C:\Windows\SYSVOL\domain\wallpaper.bmp C:\Windows\Temp\agent.exe C:\Windows\build_64.exe C:\Windows\icon.ico C:\Windows\wallpaper.bmp C:\Users\*\AppData\Roaming\Microsoft\CLR\ErrorLog.txt C:\Users\*\Desktop\webex.zip Scheduled task names Java rpchost agent KasperskyAgentInstallTask Sysvc IP addresses 91.210.109[.]118 91.210.108[.]180
Confirm this action.
Leaving now will discard your changes.