The Deep Purple Sec – October 2025

📝 APT28 Operation Phantom Net Voxel

Sekoia.io’s analysis of APT28’s Operation Phantom Net Voxel reveals a sophisticated, multi-stage infection chain targeting Ukrainian military personnel via weaponised Office documents delivered via Signal Desktop—exploiting its lack of Mark-of-the-Web (MOTW) security. The attack begins with VBA macros that drop a malicious DLL (prnfldr.dll) and a shellcode hidden using steganography within a PNG file (windows.png). The DLL uses COM hijacking for persistence and extracts the shellcode via LSB steganography, which then loads the The Covenant framework’s Grunt HTTP Stager via Koofr cloud storage, establishing a C2 channel.

The campaign makes use of Covenant’s C2Bridge to interact with Koofr’s API, using file uploads and downloads to execute commands and exfiltrate data, with hybrid encryption for secure communication. APT28 also deployed BeardShell, a C++ backdoor using icedrive for C2, executing PowerShell commands and exfiltrating system information every four hours. The malware uses XOR and ChaCha20-Poly1305 encryption, anti-analysis checks, and disguises itself as legitimate files (e.g., BMP, PNG) to evade detection.

This operation highlights APT28’s use of cloud storage abuse, advanced steganography, and ‘living-off-the-land’ techniques to target military logistics and personnel, in line with the GRU’s cyber espionage objectives.

📌 Source: https://blog.sekoia.io/apt28-operation-phantom-net-voxel

📝 Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office

Sam Curry and Shubs Shah uncovered a critical security flaw in ClubWPT Gold’s infrastructure, beginning with the discovery of an exposed staging environment (coin-admin.clubwpt.liuxinyi1.cn) via a hard-coded URL in the front-end JavaScript. The staging admin panel was affected by exposed .env and .git directories, leaked environment variables (including Alibaba Cloud credentials, albeit inactive) and the entire back-office source code. The team found hard-coded admin usernames in the .env file and successfully logged in using weak credentials (eg3478:123456), bypassing authentication.

The most serious vulnerability was an Unauthenticated 2FA bypass in the /admin/otp/bind endpoint, allowing attackers to overwrite any user’s 2FA secret by providing a uid and secret. This was exploited to gain access to the production admin panel, exposing sensitive customer PII (KYC data, transaction histories, IP addresses and geolocation). ClubWPT Gold addressed the issues promptly following responsible disclosure.

The attack chain highlights the risks of exposed development artefacts, weak credentials and faulty authentication mechanisms in critical systems.

📌 Source: https://samcurry.net/hacking-clubwpt-gold

📝 Mustang Panda Adopts a New DLL Side-Loading Method to Deploy Malware

Mustang Panda, a China-linked threat actor, recently deployed a refined DLL side-loading attack targeting the Tibetan community, using a malicious ZIP file disguised as a photo album relating to the Dalai Lama («Voice for the Voiceless Photos.exe»). The attack exploited a hidden DLL (libjyy.dll) with stealth attributes (arhs), making it invisible to standard file browsers. The decoy executable acted as a loader, using LoadLibraryW to trigger the malicious DLL, which masqueraded as legitimate «Wargaming.net Game Center» software.

The malware, dubbed Claimloader, employed XOR encryption (key: 0x19) to obfuscate API calls and strings, dynamically resolving Windows APIs to evade detection. It established dual persistence via a fake Adobe directory and registry key, and a scheduled task («Adobe Experience Manager») running every two minutes. When executed with the «Licensing» argument, it deployed Publoader shellcode via EnumFontsW API callback, using ROR13 API hashing and PEB walking to communicate with C2 servers and exfiltrate system data.

This campaign highlights Mustang Panda’s use of social engineering, advanced obfuscation, and redundant persistence to maintain access and circumvent security controls.

📌 Source: https://gbhackers.com/mustang-panda

📝 Crimson Collective hackers target AWS cloud instances to steal data

The Crimson Collective A threat group has been actively targeting AWS cloud environments, exploiting exposed credentials and IAM misconfigurations to steal data and extort victims. Using the open-source tool TruffleHog, they scan for and compromise long-term AWS access keys, then create new IAM users with AdministratorAccess privileges, granting full control over the environment. The attackers enumerate resources, modify RDS database passwords, create snapshots, and exfiltrate data via S3 buckets and EC2 instances, often launching new instances under permissive security groups to facilitate the transfer.

Following the data breach, the Crimson Collective sends blackmail notes via AWS Simple Email Service (SES) and external email addresses, demanding ransom payments. Rapid7 researchers noted that the group reused IP addresses across incidents, which helped with tracking efforts. AWS recommends using short-term, least-privilege credentials and restrictive IAM policies to mitigate such attacks, whilst tools such as S3crets Scanner can help detect exposed secrets.

This campaign highlights the risks of credential exposure, privilege escalation and cloud-native extortion tactics in modern cloud environments.

📌 Source: https://www.bleepingcomputer.com/news/security/crimson-collective-hackers-target-aws-cloud-instances-for-data-theft

🛠️ CISA Eviction Strategies Tool

CISA’s Eviction Strategies Tool provides cyber defenders with a structured framework for containing and removing adversaries during incident response, featuring Playbook-NG (a web app for next-generation operations) and COUN7ER, a database of atomic post-compromise countermeasures mapped to adversary TTPs. COUN7ER enables defenders to quickly identify and deploy tailored, actionable countermeasures against specific threat behaviours, significantly accelerating response planning and reducing attacker dwell time. By utilising COUN7ER’s curated countermeasures, which are aligned with the MITRE ATT&CK framework, blue teams can systematically address advanced threats, bridge knowledge gaps and ensure consistent, effective eviction strategies across diverse environments. The tool also supports customisation, export and integration with existing incident response workflows, enhancing collaboration and operational resilience for organisations in both the public and private sectors.

📌 Source: https://www.cisa.gov/resources-tools/resources/eviction-strategies-tool

📝 Velociraptor exploited in ransomware attacks

Cisco Talos confirmed that the Storm-2603 threat group exploited Velociraptor, an open-source DFIR tool, to maintain stealthy persistence and deploy Warlock, LockBit and Babuk ransomware in a recent campaign. The attackers installed an outdated, vulnerable version of Velociraptor (0.73.4.0, affected by CVE-2025-6264), which could allow arbitrary command execution and endpoint takeover. This vulnerability is particularly problematic for blue teams because Velociraptor is a a legitimate, trusted DFIR tool—its presence in an environment is often whitelisted or overlooked by security monitoring, making malicious activity harder to detect. The attackers used Velociraptor to maintain access even after hosts had been isolated, complicating incident response and allowing them to deploy fileless PowerShell encryptors and exfiltrate data undetected.

The campaign also involved disabling Microsoft Defender protections, modifying Group Policy Objects (GPOs), and using Smbexec for lateral movement, thereby further evading detection. For blue teams, this exploitation of a trusted DFIR tool creates a significant blind spot, as Velociraptor’s normal traffic and processes can mask malicious activity, delaying detection and response. This tactic forces defenders to scrutinise even legitimate tools and reassess their detection strategies for ‘living-off-the-land’ attacks.

📌 Source: https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks