I hate digging through PCAPs, especially in OT/ICS environments, so I built a small offline tool that turns passive traffic captures into a triage report.
New blog post: Turning OT PCAP Pain into a Triage Report
https://0ut3r.space/2026/05/08/ot-pcap-analysis/
Enjoy or not.
#OT #ICS #SCADA #PCAP #Wireshark #tshark #CyberSecurity #IndustrialSecurity #Python #OpenSource
ClickFix campaign uses fake macOS utilities lures to deliver infostealers
Threat actors are leveraging ClickFix-style social engineering tactics to distribute infostealers targeting macOS users through fake system utility lures. Attackers host malicious Terminal commands on blog sites and content platforms, disguised as troubleshooting advice for macOS issues. When executed, these commands download infostealers including Macsync, Shub Stealer, and AMOS, which exfiltrate browser credentials, cryptocurrency wallets, iCloud data, Keychain entries, and media files. The campaign has evolved to use Terminal-based script execution that bypasses Gatekeeper verification. Three distinct campaigns employ different tradecraft, with some replacing legitimate cryptocurrency wallet applications with trojanized versions and establishing persistence through LaunchAgents and LaunchDaemons that masquerade as legitimate services.
Pulse ID: 69fb97e43f09a3b9ae3a39b9
Pulse Link: https://otx.alienvault.com/pulse/69fb97e43f09a3b9ae3a39b9
Pulse Author: AlienVault
Created: 2026-05-06 19:35:00
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AMOS #Browser #Cloud #CyberSecurity #ICS #InfoSec #InfoStealer #Mac #MacOS #OTX #OpenThreatExchange #RAT #ScriptExecution #SocialEngineering #Trojan #bot #cryptocurrency #AlienVault
Malcolm v26.05.0 delivers a mix of feature improvements, performance improvements, bug fixes, dependency updates, and deployment refinements across Malcolm and Hedgehog for both Docker- and Kubernetes-based workflows.
If you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.
https://github.com/idaholab/Malcolm/compare/v26.04.1...v26.05.0
hoek ๐
OTX Bot
Seth Grover./netbox/custom-scripts and automatic script registration at startupnetbox/scripts to netbox/control-scriptsfile.strings extraction/indexing/search support across Strelka โ Logstash โ OpenSearch templates (wildcard field mapping type) โ Arkime/WISEZEEK_FILE_ANALYZER_TIMEOUT_SECnetdev users in ISO-installed environment can run nmcli and nmtui to configure network interfaces.malcolm_appliance_packager.sh script that creates a tarball of Malcolm images can now package for both Malcolm and Hedgehog profiles.0sensor on first login and disables direct root password login by default.github/workflows/raspi-build-push.ymlstop --wipekubernetes/01-volumes-nfs.yml.example for the filescan volume sectionopensearch is no longer part of the hedgehog Docker Compose profile, and some depends_on relationships were adjusted accordingly./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.ZEEK_FILE_ANALYZER_TIMEOUT_SEC (default 5) to zeek.env. This is the default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file.ZEEK_CLUSTER_BACKEND can be specified in zeek.env to specify the Zeek cluster backend (ZeroMQ vs Broker).Malcolm is a powerful, easily deployable network ๐ง traffic analysis tool suite for network security monitoring ๐ต๐ปโโ๏ธ.
Malcolm operates as a cluster of containers ๐ฆ, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker ๐, Podman ๐ฆญ, and Kubernetes โ. Check out the Quick Start guide for examples on how to get up and running.
Alternatively, dedicated official ISO installer images ๐ฟ for Malcolm and Hedgehog Linux ๐ฆ can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split ๐ช into 2GB chunks and can be reassembled with scripts provided for both Bash ๐ง (release_cleaver.sh) and PowerShell ๐ช (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.
As always, join us on the Malcolm discussions board ๐ฌ to engage with the community, or pop some corn ๐ฟ and watch a video ๐ผ.
#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL
ICSAP Analysis Report | ICSAP-AN-26-001
Reading Between the Advisories: Linux Kernel CVE-2026-31431 in the ICS Ecosystem
CVE-2026-31431 ("Copy Fail") was added to CISA's KEV Catalog on May 1. Theori's Xint Code research team disclosed it on April 29. It's a 9-year-old logic flaw in the Linux kernel's algif_aead module that lets any unprivileged local user escalate to root using a 732-byte Python script. The same exploit works on Ubuntu, Amazon Linux, RHEL, and SUSE without modification.
The mainstream security community has covered this well. What hasn't been written is the ICS angle.
We reviewed both the CISA ICS Advisory dataset (3,800 advisories since 2010) and the ICS[AP] Other CERT and Vendor ICS Advisories dataset (12,468 advisories) to see which industrial control system products have documented Linux exposure to this CVE.
Three observations:
Only 0.8% of CISA ICS advisories have ever explicitly mentioned Linux, the kernel, or embedded Linux components. Across 3,800 advisories, only two disclose a specific kernel version, and both are end-of-life branches.
Schneider Electric (234 CISA advisories, zero Linux mentions), Rockwell Automation (246, zero), Mitsubishi Electric (119, zero), Hitachi Energy (103, zero), and Moxa (53, zero) have published nothing about Linux in their CISA advisory text, despite shipping Linux-based product lines per their own technical documentation.
Container escape applies. CODESYS Control containers, Advantech IoTSuite Edge dockers, Bosch Rexroth ctrlX CORE container apps, and similar containerized industrial edge platforms are subject to the container-breakout behavior identified in Microsoft Defender's published analysis.
Asset owners cannot rely on advisory text to assess exposure. Direct vendor PSIRT engagement is the only defensible path. As of publication, no major ICS vendor has published a CVE-2026-31431-specific advisory.
ICSAP-AN-26-001 is the inaugural ICSAP Analysis Report. It covers the CVE technical mechanism with primary-source attribution to Theori, a Tier 1A list of 16 ICS product lines with documented Linux exposure, a Tier 2 list of 14 vendors whose Linux products do not surface in advisory text, and practitioner guidance for the next four to six weeks.
Read the full report at icsadvisoryproject.com or - download at https://drive.google.com/file/d/1v5RWBFT0cHFUDkUhM0enwh3t1PdOGVcv/view
#ICS #OTSecurity #CriticalInfrastructure #LinuxKernel #CopyFail #VulnerabilityManagement
It's so sad. With ๐ CalDAV we have a really nice open protocol for syncing events, todos and notes. The protocol, which is technically more of a file format (iCalendar) even supports quite complex reccurence rules and even things like recurring tasks.
Unfortunately, client (and server) applications usually only implement a subset of what's possible.
Know some good ones? Let me know!
My "Introduction to ICS Malware Analysis" workshop was accepted at the SANS ICS Security Summit.
You'll learn about ICS malware by analyzing samples modeled on FrostyGoop and CRASHOVERRIDE. No prior RE experience needed.
It's running twice: June 8 and June 10. Hope to see you there!
https://www.sans.org/cyber-security-training-events/ics-security-summit-2026#schedule
Inside Vect Ransomware-as-a-Service
Vect ransomware emerged in January 2026 as a new threat actor operating a Ransomware-as-a-Service program with strategic partnerships that significantly expand its reach. The group has partnered with TeamPCP, known for supply chain attacks compromising security tools like Trivy, KICS, and LiteLLM, and BreachForums, distributing affiliate keys to forum members. With 25 published victims primarily targeting the United States and Technology sector, Vect maintains an open affiliate program requiring only a $250 invite code. The operation offers multi-platform ransomware payloads for Windows, Linux, and ESXi with sophisticated lateral movement capabilities and tiered commission structures reaching 89% for top affiliates. Analysis reveals connections to the defunct Devman ransomware through shared code strings and ransom note similarities, suggesting possible rebranding or code reuse.
Pulse ID: 69f3e870bcc7ccaa076150b1
Pulse Link: https://otx.alienvault.com/pulse/69f3e870bcc7ccaa076150b1
Pulse Author: AlienVault
Created: 2026-04-30 23:40:32
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #ICS #InfoSec #Linux #OTX #OpenThreatExchange #RAT #RansomWare #RansomwareAsAService #SupplyChain #UnitedStates #Windows #bot #AlienVault
ClickFix Removes Your Background but Leaves the Malware
BackgroundFix masquerades as a free image-editing tool but functions as a ClickFix social engineering lure. The fake service prompts users to verify they are human, copying malicious commands to their clipboard that invoke finger.exe to retrieve additional payloads. This chain delivers CastleLoader, which subsequently drops NetSupport RAT and a custom .NET stealer dubbed CastleStealer. The loader uses reflective PE injection, API hashing, and ChaCha20-encrypted C2 communications. CastleStealer targets browser credentials, cryptocurrency wallet extensions, and Telegram sessions through DPAPI decryption and Restart Manager APIs. The campaign leverages BYOI tactics with embedded Python interpreters and multiple shellcode stages. A notable implementation flaw exists where launch method 4 references regsrv32.exe instead of the correct regsvr32.exe, causing silent failures.
Pulse ID: 69f36a0940fe2fa665ebe32e
Pulse Link: https://otx.alienvault.com/pulse/69f36a0940fe2fa665ebe32e
Pulse Author: AlienVault
Created: 2026-04-30 14:41:13
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Browser #ChaCha20 #Clipboard #CyberSecurity #ICS #InfoSec #Malware #NET #NetSupport #NetSupportRAT #OTX #OpenThreatExchange #Python #RAT #ShellCode #SocialEngineering #Telegram #bot #cryptocurrency #AlienVault
Phoenix Rising: Exposing the PhaaS Kit Behind Global Mass Phishing Campaigns
Since January 2025, researchers identified over 2,500 phishing domains targeting more than 70 organizations across financial services, telecommunications, and logistics sectors globally. Two dominant smishing campaigns were discovered: Reward Points phishing impersonating banks and telecom providers, and Failed Parcel Delivery phishing mimicking logistics companies. Despite different themes, both campaigns share infrastructure and utilize the Phoenix System administrative panel, a successor to the Mouse System. This Phishing-as-a-Service platform offers real-time victim monitoring, geofencing, IP-based filtering, and live-phishing interventions to bypass multi-factor authentication. The platform is distributed via Telegram channels for approximately $2,000 annually, providing threat actors with pre-built templates, traffic filtering mechanisms, and real-time victim management dashboards. Attackers potentially leverage fake Base Transceiver Stations to bypass carrier-level filtering and deliver messages app...
Pulse ID: 69f1fa3e73a0897558593b04
Pulse Link: https://otx.alienvault.com/pulse/69f1fa3e73a0897558593b04
Pulse Author: AlienVault
Created: 2026-04-29 12:31:58
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Bank #CyberSecurity #ICS #InfoSec #Mimic #OTX #OpenThreatExchange #Phishing #RAT #RCE #SMS #Smishing #Telecom #Telecommunication #Telegram #bot #AlienVault
#Forgejo 
releases are published according to a fixed release schedule with security announcements between major releases.
Already a year ago, I wrote a small #python script creating an #ics calendar file which can be read by almost any calendar software. Using a scheduled job (e.g., with #cron), I have the always updated calendar in my #Thunderbird.
In the meantime, I forgot about it, but now I want to share it with you (on #Codeberg, of course): https://codeberg.org/mahlzahn/forgejo-releases-ics
ICS Advisory Project
Fell
Jimmy Wylie
Robert Wolff