Infosec Threat Activity Remains Quiet This Week

Quick Takeaways

1. NIK C2 uses AI to analyze stolen data in real time, steal credentials and keystrokes, and deploy screen-locking ransomware.
2. Two critical PHP flaws are actively exploited, prompting CISA to add them to its KEV catalog.
3. Other active risks include Brotli flaws enabling code execution and stolen GitHub tokens exposing private repository secrets through Actions logs.

Threat, Techniques, and Targets

• Cisco Talos reports a new Go based Windows command and control framework called NIK C2. It can steal credentials, capture keystrokes, and deploy screen locking ransomware. It also uses an OpenAI model to analyze stolen data and may use a victim’s API keys to pay for requests.
• NIK C2 can process information during an active intrusion. It may also make attacker infrastructure harder to trace. The report does not identify specific NIK C2 targets.
• Meanwhile, CISA added two critical PHP vulnerabilities to its Known Exploited Vulnerabilities catalog. A flaw in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages and can enable code execution.
• Gheist uses stolen GitHub tokens to expose private repository secrets through Actions logs. Separately, GMO Internet investigates suspected unauthorized access to its Onamae cloud desktop service, which financial traders use. The report also notes increased ransomware activity and attacks that target endpoint detection and response systems and AI credentials.

Impact, Security Implications, and Remediation

• NIK C2 can turn a compromised host into an active tool for data theft and ransomware. Its rapid data analysis may reduce defenders’ time to detect activity. Use of a victim’s API keys may also complicate incident response.
• Therefore, monitor endpoints for unusual local proxy routing, unexpected PowerShell use, and unauthorized access to browser databases or cryptocurrency wallets. Update defenses with the ClamAV signature and indicators of compromise from the full Talos blog.
• Also, inventory systems, software versions, internet exposure, and device access rights. Apply available fixes and confirm that each fix reaches the intended system. If a system cannot receive an update, assign an owner and deadline, reduce its exposure, and monitor it until you can patch it.
• For PHP, Brotli, and affected packages, consult the relevant vendor or authority for specific patch guidance. For GitHub Actions exposure, deleting the branch or workflow run does not remove the exposed secrets, so review the affected logs and secrets and follow GitHub’s guidance.

Discover More Technology Insights

Explore the future of technology with our detailed insights on Artificial Intelligence.

Discover archived knowledge and digital history on the Internet Archive.

ThreatIntel-V1