The Deep Purple Sec – December 2025

📝 Beyond the bomb: When adversaries bring their own virtual machine to ensure persistence

Red Canary’s analysis of «Beyond the Bomb: When Adversaries Bring Their Own Virtual Machine for Persistence» reveals a a novel, multi-stage attack chain where threat actors first flood victims with spam/email bombs to distract and overwhelm defences, then use social engineering to gain access to the environment under the pretence of providing technical support. Once inside, they deploy their own QEMU-based virtual machine (VM), hidden from traditional endpoint controls, in order to establish stealthy, long-term persistence. This VM acts as an isolated operational base, allowing attackers to bypass EDR/XDR monitoring, execute arbitrary commands, and retain access even if the host is remediated or credentials are rotated.

For blue teams, this tactic highlights the an urgent need for multi-layered defences: beyond robust email filtering and EDR, organisations must monitor for unauthorised VM creation (e.g., via process trees, hypervisor logs or network anomalies), restrict VM-related permissions, and train users to be wary of unsolicited «support» calls, especially following unusual activity such as spam bombing. The case also highlights how adversaries misuse of legitimate tools (QEMU, Hyper-V) and combine social engineering with technical evasion, making it a important reminder to audit of virtualisation platforms, enforce least-privilege access, and search for hidden VM artefacts (e.g., unexpected .vmx files, rogue network interfaces). This evolution in persistence tactics requires proactive threat hunting and defence-in-depth to detect and disrupt such covert operational environments.

📌 Source: https://redcanary.com/blog/threat-intelligence/email-bombing-virtual-machine

📝 Behind the Walls: Techniques and Tactics in Castle RAT Client Malware

Splunk’s analysis of CastleRAT malware reveals a a sophisticated, multi-stage Remote Access Trojan (RAT) that makes use of stealthy data exfiltration techniques, including clipboard hijacking (via SendInput() and Ctrl+V (simulation) to disguise malicious activity as normal user behaviour, and RC4-encrypted C2 traffic to evade detection. The malware uses living-off-the-land binaries (LOLBins) like rundll32 and ComputerDefaults.exe to bypass UAC, scheduled tasks for persistence, and system/device enumeration to target specific individuals. Notably, CastleRAT targets cryptocurrency wallets, login details and sensitive files, using dead-drop resolvers and IP geolocation APIs (e.g., ip-api.com) to dynamically adapt its C2 infrastructure.

For blue teams, this research is a a goldmine for detection engineering: Splunk provides actionable Splunk ESPL queries, MITRE ATT&CK mappings (T1059, T1055, T1082, T1083, T1562), and behavioural indicators, such as unusual outbound connections to unfamiliar domains, one-line PowerShell downloads, and processes launched with browser flags that mute the audio. Defenders are advised to monitor for RC4 traffic patterns, suspicious rundll32 executables and unexpected binaries in user folders (e.g., %APPDATA%), whilst making the most of Splunk’s Security Essentials to compare coverage against the Top 20 MITRE ATT&CK techniques. This approach enables proactive threat hunting and gap analysis to harden systems against CastleRAT’s evasive, multi-vector attack chains.

📌 Source: https://www.splunk.com/en_us/blog/security/castlerat-malware-detection-splunk-mitre-attck.html

📝 From cheats to exploits: Webrat spreading via GitHub

Kaspersky’s analysis of WebRAT reveals a targeted campaign where attackers distribute the malware via fake GitHub repositories, masquerading as proof-of-concept (PoC) exploits for high-profile CVEs (e.g., CVE-2025-59295, CVE-2025-10294). The attack chain begins with AI-generated, professional-looking repositories providing detailed descriptions of vulnerabilities, installation guides and advice on how to mitigate them, thereby luring victims (particularly inexperienced security researchers) into downloading a password-protected ZIP file. Inside, a multi-stage dropper (rasmanesc.exe) escalates privileges, disables Windows Defender, and retrieves the WebRAT payload from a hard-coded C2 URL. Once deployed, WebRAT acts as a full-featured backdoor and information stealer, capable of keylogging, screen recording, webcam and microphone surveillance, and stealing credentials from Discord, Telegram, Steam and cryptocurrency wallets.

For blue teams, this campaign highlights opportunities for the detection and mitigation of critical issues: monitor for suspicious GitHub downloads (particularly password-protected archives containing decoy files), audit outbound connections to unfamiliar domains, and block the execution of rasmanesc.exe or similar droppers. Kaspersky’s IOCs (e.g., HEUR:Trojan.PSW.Win64.Agent.gen) and behavioural red flags, such as privilege escalation via T1134.002, Defender tampering (T1562.001), and C2 traffic (T1071), provide actionable hunting rules. The case also highlights the the need for isolated analysis environments and rigorous vetting of open-source proofs of concept, as attackers are increasingly exploiting trust in public repositories and AI-generated documentation to avoid scrutiny.

📌 Source: https://securelist.com/webrat-distributed-via-github/118555

🛠️ Introducing Pathfinding.cloud

Datadog Security Labs’ pathfinding.cloud is a groundbreaking, open-source knowledge base those documents 65+ AWS IAM privilege escalation paths, including 27 previously undetected techniques (42%) overlooked by existing open-source tools. The project highlights critical gaps in IAM security by detailing how seemingly innocuous combinations of permissions, such as iam:PassRole + cloudformation:CreateStackSet + cloudformation:CreateStackInstances, can be chained together to escalate privileges, bypassing traditional detection and mitigation strategies. For blue teams, this resource is invaluable for securing AWS environments: it provides machine-readable YAML/JSON data for integration into security tools, visual attack path mappings, and actionable insights to address blind spots in IAM policies, CI/CD pipelines and cloud infrastructure.

The library empowers defenders to proactively audit IAM configurations, identify overly permissive roles, and prioritise remediation before attackers exploit these paths. By using pathfinding.cloud, security teams can bridge the detection gap, improve threat modelling, and assess the effectiveness of their existing security tools, all whilst benefiting from a community-driven, continuously updated a resource that evolves in line with emerging AWS attack techniques.

📌 Source: https://securitylabs.datadoghq.com/articles/introducing-pathfinding.cloud

📝 2025 CWE Top 25 Key Insights

The 2025 CWE Top 25 Most Dangerous Software Weaknesses report analyses 39,080 CVE records, highlighting the most serious and widespread vulnerabilities that organisations must prioritise for mitigation. Memory safety issues (buffer overflows, use-after-free) and authentication/authorisation flaws dominate the list, with CWE-862 (Missing Authorisation) and CWE-306 (Missing Authentication) rising sharply, whilst CWE-120, CWE-121 and CWE-122 (Classic, Stack and Heap-based Buffer Overflows) entered the Top 25 for the first time, reflecting a resurgence in memory corruption vulnerabilities. Notably, 42% of the Top 25 weaknesses are now mapped with greater precision, reducing reliance on abstract or deprecated CWEs, a sign of improved vulnerability reporting practices.

For blue teams, this report is a strategic guide to focus on security investments: it reveals that 79% mappings are actionable, «Allowed» CWEs, enabling targeted remediation within the SDLC and architectural planning. The data also highlights the the urgency of addressing improper access control (CWE-284, CWE-639) and resource exhaustion (CWE-770), which are increasingly being exploited in real-world attacks. By drawing on these insights, defenders can prioritise patching, strengthen authentication mechanisms, and enforce secure coding standards, ultimately reducing exposure to the most dangerous and exploitable vulnerabilities.

📌 Source: https://cwe.mitre.org/top25/archive/2025/2025_key_insights.html

📝 How I discovered a hidden microphone on a Chinese NanoKVM

The NanoKVM, A low-cost, open-source hardware KVM switch from Sipeed was found to contain multiple critical security flaws, most alarmingly a hidden, undocumented SMD microphone (2x1mm) capable of high-quality audio recording. The device, designed for remote server management via HDMI/USB, also came with default SSH credentials, hard-coded encryption keys for password protection, no CSRF protection, and pre-installed hacking tools (tcpdump, aircrack). Even more concerning is the NanoKVM communicates with Chinese servers for updates and closed-source components, lacks update integrity verification, and uses plaintext storage for identification keys. These vulnerabilities allow attackers to eavesdrop via the microphone, decrypt passwords, or use the device as a pivot point for lateral movement.

For blue teams, this case highlights the risks associated with supply-chain hardware and the the importance of physical and audio security audits, even for «open-source» devices. The article provides actionable mitigation measures: physically removing the microphone, flashing custom firmware (e.g., Debian/Ubuntu ports), and disabling default services. It also serves as a wake-up call to examine all remote management tools for hidden components, backdoors and insecure default settings, particularly those with overseas dependencies. The wider lesson? Trust but verify: even budget-friendly, open-source hardware can harbour critical, undocumented surveillance capabilities.

📌 Source: https://telefoncek.si/2025/02/2025-02-10-hidden-microphone-on-nanokvm