Ukraine wrecked Russia's best data centers and idled all three AI supercomputers. Then the internet decided that had also killed the bots. It hadn't and the way we know is
read post →f4n6.co.uk - October 2026 - TLP:CLEAR. All indicators are defanged. Hash: f745c2d897ad6f16cb5c0428ba74a7f041f7c3e94f52cc3727532577fe12507d 0:00 /2:34 1× TL;DR * A 9 MB, 64-bit Windows
A 12 MB batch file that unpacks a genuine, signed ScreenConnect client wired to an attacker's relay, disables every user-visible indicator, survives reboot and Safe Mode — and what it looks like on a real infected host.
The first detonation gave us nothing. No DNS, no sockets, no drops, no persistence 8.6 MB of Go binary that ran, yawned, and went back
A loader disguised as libcurl refuses to run on VMs and dies silently in sandboxes. We patched its six anti-VM checks out and captured its WebSocket C2 on port 406.
A 3.5 KB Windows loader with one import, a split-up C2 address, and a forty-byte handshake it repeats until somebody answers. We answered
A 15 KB DLL that silently rewrites cryptocurrency addresses on your clipboard. I pulled it apart statically, confirmed it in a sandbox, recovered all nine of
1. Executive summary The qilin ransomware group listed CREDIN, a Portuguese entity (www.credin.pt), on its leak site on 2026-10-19. The
1. Executive summary Two Windows flaws, CVE-2026-21510 (CVSS 8.8 HIGH, CWE-693) and CVE-2026-32202 (CVSS 4.3 MEDIUM, CWE-
1. Executive summary Rapid7 disclosed three vulnerabilities in Eptura Archibus Web Central, a facilities and real estate management platform that Eptura states was used
1. Executive summary Rank Math, the vendor of the Rank Math SEO plugin for WordPress, has disclosed that copies of its paid Rank Math
1. Executive summary Siemens has confirmed in-the-wild exploitation of CVE-2026-110936, a DLL search-path flaw in Siemens Software Center, after