-
A phishing campaign impersonating DocuSign is being used to trick victims into installing malicious remote management software for persistent access.
-
The Australian government has warned organizations of ongoing attacks exploiting vulnerabilities in widely deployed content management systems.
-
Progress has advised ShareFile Storage Zone customers to shut down internet-facing servers due to the risk of active exploitation.
-
Multiple AsyncAPI packages have been compromised in a supply chain attack to distribute malicious code to developers.
-
Nightmare Eclipse has released a proof-of-concept exploit for the LegacyHive zero-day vulnerability, increasing the risk of exploitation.
-
SonicWall has warned that two zero-day vulnerabilities affecting SMA 1000 appliances are being actively exploited in the wild.
1. DocuSign Phishing Campaign Leads to Malicious RMM Deployment
Summary
A phishing campaign leverages DocuSign lures to automatically download payloads, track user interactions, and install legitimate RMM tools for persistent access.
Category: Phishing
Industry: Multiple
Sources
-
https://www.stormshield.com/news/cti-phishing-campaign-rmm-installation/
-
Internal OSec research
Analyst comments
A phishing campaign is mimicking DocuSign pages to compromise users and install RMM software on their workstations. The campaigns use scripted triggers to download legitimate RMM tools such as Atera, SimpleHelp, and ScreenConnect, which are repurposed for persistent remote access. Initial contact typically occurs through compromised websites or phishing lures that deliver files with names such as “financial_info”. Although the original source notes this as a single campaign, our analysis indicates that these are likely two campaigns based on major code differences and tactics employed after initial compromise. Given their scale and scope, both campaigns likely rely on Phishing-as-a-Service (PhaaS) kits supported by other criminal ecosystems, including ransomware operators.
The original article details two variants of the phishing activity. Variant A uses the /ftx endpoint, while Variant B uses variations of /docusign/<mac or windows>/utility.php and /docusign/<mac or windows>/utility.php/download/index.php. Additional Variant B activity used “n-docusign” as opposed to “docusign”. On analyzing the two differing variants, we conclude that it is highly likely these are two separate campaigns or phishing kits sharing the same DocuSign lure.
However, significant differences in the code indicate that the attacks are likely operated by two separate threat actors. All observed landing pages used the title. Variant A sends data to a Telegram bot accounts that differ between pages through requests to api.telegram[.]org/bot-<token>. It also uses *.r2.dev domains for downloading a malicious .msi file within the attack chain. Variant B instead redirects the users from utility.php after three seconds to index.php, which downloads the ScreenConnect installer ScreenConnect.ClientSeup.exe. Variant A likely uses both compromised and newly registered domains, based on the wide range of hosting providers associated with its landing pages. Variant B was primarily observed across Cloudflare ASN13335, AS40092 - ONIAAS - HostPapa, AS40676 - AS40676 - Psychz Networks and Interserver ASN19318, which hosted the most recent sample dated July 8.
Given the volume of landing pages found in the wild, both campaigns are likely associated with PhaaS platforms. Both Campaigns remain active, with new samples for each variant uploaded to urlscan[.].io as of July 15th. Observed file types include .dmg (macOS), .msi (Windows Installer), .exe, and .iso images . The following network endpoints were used by both and can be used to support detection efforts:
Variant A Endpoint
/ftx/<6-character alphanumeric string>-<10-character numeric string>-<12-character alphanumeric string>/?redir=<url-encoded base64 string>example:
https://yonataxi[.]at/ftx/aru07x-1784131650-64e1be2f7ebd/?redir=C%2FbLfuWeDlFBZAQRKARBApGXUDzX6KocqQ3QxVvCUGVmoR6PC4IF7KsVLWvQgno2
*.r2.dev - Domains used for serving malicous files.
Variant B Endpoint
*docusign/<mac or windows>/utility.php
*docusign/<mac or windows>/utility.php/download/index.phpexample:
mediengebuehr[.]info/user/acess/verify/n-docusign/Windows/utility.php
mediengebuehr[.]info/user/acess/verify/n-docusign/Windows/utility.php/download/index.phpActionable guidance
Both variants use very specific endpoints, with no observed deviation across available samples. For variant A, requests to the /ftx endpoint combined with connections to api.telegram[.]org and domains ending in *.r2.dev provide a strong indication of campaign activity. Organizations should also restrict users from executing or installing unauthorized binaries on employee workstations. For Variant B, blocking the known URL paths used by the threat actor can further reduce the risk of compromise. User awareness training should be conducted to help users identify potential look-a-like sites, avoid links or files from unknown senders, and verify that software is downloaded from official sources.
2. Australia Alerts Organizations to Ongoing CMS Exploitation Attacks
Summary
The Australian Signals Directorate has issued an alert regarding a widespread exploitation campaign that targets known vulnerabilities in CMS software like WordPress and Joomla to deploy webshells. While WP-SHELLSTORM is not mentioned, the activity is likely related to the campaign recently disclosed by other researchers.
Category: Known Exploited Vulnerabilities
Industry: Technology, Retail, Consumer Services, Multiple (primarily for homepages of companies in a variety of sectors)
Sources
-
https://socradar.io/blog/wp-shellstorm-expose-1-4m-wordpress-sites/
-
Internal OSec Research
Analyst comments
Australia’s Signals Directorate has issued an alert regarding a global exploitation campaign targeting known vulnerabilities in content management systems (CMS) like WordPress and Joomla. Attackers are deploying webshells through known vulnerabilities to gain persistent remote access, primarily affecting small and medium-sized Australian businesses. The exploited software includes 17 CVEs across various CMS plugins and platforms. These vulnerabilities allow actions such as unauthenticated file upload, remote code execution, server side request forgery, or deserialization. Webshells can enable attackers to deface websites, capture credentials, upload malware, or use web servers for broader network compromises.
This campaign is likely related to the recently disclosed WP-SHELLSTORM activity, given the overlap of plugins and vulnerabilities. Information obtained through an operational security failure exposed significant details about a large cybercrime operation believed to be run by individuals likely based in China. The threat actors primarily compromised WordPress sites by exploiting outdated plugins used by victims. The following list of known vulnerabilities was compiled from the Australian alert, researcher disclosure, and our own analysis. We also compared the original file listing found on the threat actor’s server, although the full files were not available for review. Many, if not all, of the vulnerabilities listed below have publicly available PoC code that can be used for exploitation:
# Vulnerable plugins and CMS items targeted accrding to AUS Advisory and SOCRadar article.
Simple File List (WordPress) CVE-2025-34085/CVE-2020-36847/CVE-2026-3844
WavePlayer (WordPress) CVE-2025-12057
BerqWP (WordPress) CVE-2025-7443
WPBookit (WordPress) CVE-2025-7852
Ninja Forms (WordPress) CVE-2026-0740
ThemeREX Addons (WordPress) CVE-2026-1969
Breeze Cache (WordPress) CVE-2026-3844
pay-uz CVE-2026-31843
ACF Extended (WordPress) CVE-2025-13486
Sneeit Framework CVE-2025-6389
WPvivid Backup (WordPress) CVE-2026-1357
Gravity Forms (WordPress) CVE-2025-12352
GutenKit/Hunk Companion (WordPress) Likely CVE-2024-9234
Craft CMS CVE-2025-32432
MaxSite CMS CVE-2026-3395
MetInfo CMS CVE-2026-29014
Joomla JCE CVE-2026-48907
Custom CSS JS PHP CVE-2026-6433
Although the threat actor initially used a United States based IP address, the address has since been reassigned and now geolocates to China. Most other observed infrastructure was associated with South Korea and Taiwan, including command and control systems hosted through Alibaba Cloud to reduce reliance on niche VPS providers and help evade detection.
IOCs
137.175.93[.]126 China AS54600 PEG TECH INC Shui Weizhen - Formerly US based/ DNS status “re-assigned” - Operator’s address of server left open.
43.108.17[.]80 South Korea AS45102 Alibaba (US) Technology Co., Ltd. Alibaba.com LLC - C2 Activities
113.196.56[.]150 Taiwan AS9919 New Century InfoComm Tech Co., Ltd. NCICNET 113.196.56.150.ll.static.sparqnet.net -
113.196.59[.]51 Taiwan AS9919 New Century InfoComm Tech Co., Ltd. NCICNET113.196.59.51.ll.static.sparqnet.net
84F7E396A48913851A10CC78C5CC22A25634564ABD0694465236D2F365E2BDEE - Webshell down.php
# Based on the naming convention of the files and payloads found in the analyzed directory structure, we were able to find similar samples that match the naming convention and are associated with the Godzilla webshell:
dd67d50872a7970e109646938951826d4e60d6b14d7873b5b1862b66ce32ce03The above samples all followed a common naming convention of the following:
payload_<pub or nopub>_<8 character alphanumeric string>.bin (e.g. payload_nopub_2ce4697b.bin).
# Additional payload filenames on server, these will likely change for future intrusions and is provided for threat hunt detection of past intrusions.
payload_nopub_e404a4fe.bin
payload_nopub_f339f4d6.bin
payload_pub_2b2b21be.bin
payload_pub_2ce4697b.bin
payload_pub_315acfe5.bin
payload_pub_452751bf.bin
payload_pub_4a677eb0.bin
payload_pub_4e413d00.bin
Actionable guidance
Based on the attacks and data collected, patching and discontinuing the use of outdated plugins and CMS versions should be prioritized to prevent attacks from this threat actor. If compromise is suspected, organizations should look for increased traffic to Alibaba Cloud environments and look for the presence of known payload files for past intrusions. The full directory listing is available and can be shared on request.
3. Progress ShareFile Storage Zone Customers Told to Shutdown internet-facing Servers
Summary
Progress Software advised ShareFile customers to immediately shut down internet-facing Storage Zone Controller (SZC) servers and temporarily disable cloud access while they investigate an active security threat.
Category: Supply Chain Risk
Industry: Technology, Financial and Fintech, Multiple
Sources
-
https://www.reddit.com/r/sysadmin/comments/1usohco/psa_shutdown_your_sharefile_storage_zone/
-
Internal OSec Research
Analyst comments
Progress Software alerted ShareFile customers to immediately shut down their internet-facing SZC servers due to a credible security threat. The directive came after Progress worked with internal and external experts, as these controllers manage file transfers between cloud platforms and company-managed storage infrastructure, making them prime targets for attackers. Although details of the threat have not been fully disclosed, the situation resembles a 2023 vulnerability that was exploited in Storage Zones Controller environments.,. Only hybrid deployment models using Storage Zone Controllers are affected, while cloud-only accounts remain unaffected.
Official details of the 0-day vulnerability have not been released, although Progress has stated that a disclosure is expected within two weeks. Several participants in the related social media discussion claimed that the vulnerability is associated with the remote code execution chain disclosed in April and is due to incomplete patching. One participant also reported that an affiliated organization was compromised through the April RCE chain. However, an update to the advisory contradicts these statements, and describes the issue as a path traversal vulnerability requiring administrator privileges in order to exploit.
Based on Progress Software’s statements, related discussions and media coverage, the issue is more likely linked to incomplete remediation of the RCE chain disclosed in April, which also affects the ShareFile Zone Controller. This assessment is supported by Progress Software’s aggressive response, the temporary disabling of ShareFile accounts, multiple reports citing Progress technical support, and mentions of recent compromise using April’s CVEs. Shutting down ShareFile instances would appear excessive for a path traversal vulnerability that requires administrator privileges. New patches are currently being rolled out, with the following fixed versions:
v5.12.5
v6.0.2
Path traversal attacks will typically use sequences such as../../../, which may be visible in logs from affected ShareFile hosts. However, if this is related to the previous April CVEs, exploitation may look like the following:
# Primary used endpoints for exploitation of CVE-2026-2699 and CVE-2026-2701
GET request to /ConfigService/Admin.aspx
GET request to /ConfigService/api/StorageZoneConfig?h=<hmac based on new passphrase>
# Exploitation flow of how vulnerabilities are chained and exploited
1. Initial GET to /ConfigService/Admin.aspx
2. Modify ZoneController URL with POST to /ConfigService/Admin.aspx
3. ShareFile connects to malicious zone and verifies passphrase
4. Join zone and use /ConfigService/api/StorageZoneConfig?h=<hmac leak of tempdata2>
5. Decrypt tempdata2 hmac of zone secret and calculate
6. Upload webshell with .zip file
7. Access webshell via <Network-Storage-Location>/files/ul-<query-string-uploadid>/1/
Actionable guidance
Organizations using ShareFile should apply the new vendor patch and conduct audits to identify potential compromise. Log reviews should search for traversal strings such as ../../../, rogue users or administrator sign-ons from unfamiliar locations, and activity associated with CVE-2026-2699 and CVE-2026-2701. Additional indicators may include multiple requests to the previously mentioned endpoints, files originating from unexpected locations, unknown zones or configurations, requests to /ConfigService, and use of upload.aspx when other indicators are seen.
4. AsyncAPI Packages hit by Supply CHain Attacks
Summary
A sophisticated supply chain attack compromised AsyncAPI npm packages with more than 2 million weekly downloads, delivering complex malware capable of stealing sensitive information and cryptocurrency while enabling remote access. The malware also used resilient communication methods like IPFS and BitTorrent to evade detection and maintain control.
Category: Supply Chain Risk
Industry: Multiple (Likely targeting high-profile repositories and maintainers)
Sources
Analyst comments
The AsyncAPI npm organization was compromised, with malware injected into four packages: @asyncapi/generator 3.3.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator-helpers 1.1.1, and @asyncapi/specs 6.11.2 and 6.11.2-alpha.1. These packages collectively receive more than 2 million weekly downloads. The malware combines information theft, cryptocurrency theft, and remote access capabilities. It uses IPFS for storage and a fallback C2 server, while also communicating through BitTorrent bootstrap nodes to maintain resilience against network blocking. The malware can also self-propagate by attempting to publish itself in developer-maintained packages if it finds valid authentication tokens for npm, PyPI, or Cargo.
We analyzed the code samples used in the attack but found no other affected repositories containing signatures similar to those in our possession. The initial compromise vector was through malicious GitHub actions making commits to the repository and inserting the stage one obfuscated code into a file within the repository. The threat actor primarily used variations of the same obfuscated payload. However, in one instance, partially de-obfuscated code was used without the Base64 array obfuscation normally applied to the payload returned on execution. This may have been done to allow the code to blend in easier with the normal AsyncAPI code. The attack also included references to the Miasma supply chain worm. Some researchers believe a different threat actor included these references to make activity appear connected to the previously known supply chain worm sample. We cannot verify this assessment, and it conflicts with reporting from two other sources. Therefore, this claim should be considered unconfirmed until additional evidence becomes available.
Actionable guidance
Package maintainers should regularly audit commits and codebases for signs of potential compromise. Supply chain threat actors commonly use obfuscated code, making instances of “const _0x” or “var _0x” followed by alphanumeric strings a strong indicator, particularly when similar variable structures do not appear elsewhere in the codebase. Repository activity should also be reviewed to confirm that only authorized maintainers are making commits.
If compromise is suspected, organizations should monitor for suspicious connections to torrent or Ethereum related endpoints, repeated WebSocket requests to Nostr domains, communication with known malicious services, and unexpected JavaScript files such as sync.js. Secrets and authentication keys should be rotated if compromised packages were used or potential exposure is identified.
5. LegacyHive Windows 0-day PoC Disclosed by Nightmare Eclipse
Summary
A prolific researcher known as Nightmare Eclipse disclosed a new zero-day vulnerability called LegacyHive, which allows for local privilege escalation in Windows by exploiting weaknesses in the User Profile Service. Exploitation requires additional user credentials and does not provide full system compromise.
Category: Zero-day
Industry: Multiple
Sources
Analyst comments
A researcher known as Nightmare Eclipse disclosed a new zero-day vulnerability called “LegacyHive,” which exploits a weakness in the Windows User Profile Service (profsvc), allowing attackers with local access to gain privileged read-write access to user hives. This exploit, while sophisticated and potentially useful for attackers already inside a network, does not provide full system compromise on its own.
The current PoC has been provided in a state that requires initial user access and knowing the credentials of a second user. However, the researcher has stated on their repository that the vulnerability can be used without this restriction but would need various changes of the code base in order to fully weaponize. Several researchers on social media have confirmed they were able to test the new PoC. Their findings indicate that it allows a non-privileged user to modify classes within the registry hive of an admin user. As described by researchers, this can be used to associate specific file types to open with programs located on the Windows file system. So in an attack scenario, this can be used to associate some file type with something like rundll.exe for code execution as the administrator user. This has multiple uses including privilege escalation, overwriting objects that start at start-up for persistence, and similar behavior. If threat actors can weaponize this within their attack chains, it could be extremely beneficial for persistence, privilege escalation and security evasion. Given the benefits, threat actors will likely attempt to weaponize this in the coming weeks.
Actionable guidance
No patch is currently available. Organizations should maintain regular patching schedules and monitor for the release of an official fix. Detection logic exists for this PoC until a patch can be made available. Exploitation loads offreg.dll, so detecting use of this uncommon DLL outside normal Microsoft Defender activity may indicate compromise. Modified registry values underSoftware\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders that contain \.\globalroot or \BaseNamedObjects may also indicate exploitation and provide an additional detection opportunity.
6. SonicWall warns of active exploitation of two SMA 1000 0-Days
Summary
SonicWall has alerted users to active exploitation of two critical zero-day vulnerabilities in SMA 1000 appliances, including one that enables authenticated attackers to execute arbitrary commands.
Category: Known Exploited Vulnerabilities
Industry: Technology, Public Sector and Government Administration, Financial and Fintech, Multiple (with other sectors mentioned likely a priority, especially for state actors who have already adopted these vulnerabilities)
Sources
Analyst comments
SonicWall has identified two critical vulnerabilities in their SMA 1000 appliances: CVE-2026-15409, a Server-side Request Forgery (SSRF) with a CVSS score of 10.0, and CVE-2026-15410, a post-authentication code injection flaw with a CVSS score of 7.2. The SSRF vulnerability allows remote unauthenticated attackers to make unintended requests, while the code injection flaw permits remote authenticated users to execute arbitrary OS commands under certain conditions. These vulnerabilities are being actively exploited and affect specific software versions. SonicWall has released hotfixes in versions 12.4.3-03453 and higher, and 12.5.0-02835 and higher. Customers are advised to upgrade immediately and review their system logs for any signs of compromise or suspicious activity.
Proof of concept code and technical research are publicly available for both vulnerabilities, making them easy to weaponize in active attacks. Multiple threat actors are therefore likely exploiting these vulnerabilities as part of their attack chains. The advisory provides guidance on potential indicators of compromise and identifies the following endpoints as being abused:
Requests to /__api__/login or /__api__/logout with http 200 status
Requests to /wsproxy with host parameters likely including encoded or unencoded OS commands
If routes to /__api__/login or /__api__/logout and seen within /var/lib/unit.conf.json
Analysis of the PoC code and related research identified additional activity that may support detection logic and help identify previous intrusions. The following indicators are associated with exploitation of these vulnerabilities. The vulnerabilities are chained together for maximum effect, with CVE-2026-15409 enabling initial code execution and creating files required for privilege escalation. CVE-2026-15410 then exploits path traversal within the rollback functionality to execute the created code and elevate privileges.
Affected products include the following:# Affected products
SMA1000 Models – 6210, 7210, 8200v
# Fixed versions
12.4.3-03453 (platform-hotfix) and higher versions.
12.5.0-02835 (platform-hotfix) and higher versions.
Actionable guidance
A hotfix is available that addresses these vulnerabilities. If compromise is suspected, the organization should audit logs for the identified artifacts and for connections from unknown network sources to the targeted endpoints. Requests to rollbackConfirm.action containing path traversal notation such as ../../../ are a high indicator of compromise involving this exploit chain.