Threat Intelligence Researcher @esthreat 🚀🚀| Blue Teamer
Joined August 2014
- Tweets5.4K
- Following4K
- Followers2K
- Likes15.6K
Pinned Tweet
Today marks my first day to work as a SOC analyst. Perhaps one thing I have learned over the years is to be persistent, never stop grinding, and chasing down your dream. Here is my timeline for me to achieve my dream.
Bohan Zhang retweeted
The @FBI and @TheJusticeDept have announced the disruption of Virtualine, a so-called “bulletproof hosting” service designed to help cybercriminals evade detection and law enforcement action.
Before the FBI and its partners shut it down, the Virtualine[.]net domain was used to facilitate the distribution of child sexual abuse material (CSAM), international money laundering, and numerous other cybercrimes.
The case was investigated by @FBIWFO, with significant assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency, and private sector partners OverRIPE and Lumen. The Justice Department’s Office of International Affairs provided additional support.
justice.gov/usao-edva/pr/bul…
ALT FBI seizure notice for Virtualine.net with logos of international law enforcement and private sector partners involved in Operation Omega Line.
Bohan Zhang retweeted
Oh boy …
🔐 ⚠️ phpMyAdmin 5.2.3 - 2FA Bypass! 0day++! ⚠️ 🔐
🚨 WebAuthn signatures are parsed but never COSE-verified against credentialPublicKey 🚨 Arbitrary bytes pass the structural checks, so 2FA falls over after password auth 💀
Exploit:
> CWE-347/287 ⚠️ CVSS 8.1
> 🐙 github.com/abraxas/PMA-5.2.3…
🧩 Root cause: web-auth/webauthn-lib is only a dev/suggest dependency 📦 The distributed tarball is built with `composer install --no-dev`, so `WebAuthn::createServer` instantiates `CustomServer` instead of `WebauthnLibServer` 👀
🔍 How? 🤦♂️ `CustomServer::parseAndValidateAssertionResponse` enforces structural checks only: clientData type, session challenge, origin host, rpIdHash, user-present, allowed credential id 📋 `response.signature` is decoded and never verified ❌ `credentialPublicKey` is never read 🕳️
💥 Impact: a well-formed assertion carrying correct structural fields and an arbitrary signature yields a full authenticated session 🔓 Impact is unauthorized database access through the application, not host-level code execution 🗄️
Bohan Zhang retweeted
🚨 PHP2Shell exploited in real-world attacks.
An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment.
The intrusion extended into the internal network, where the attacker targeted Active Directory.
Suspected China nexus. Signs of AI-assisted tooling.
Read the full report: thehackernews.com/2026/10/ph…
Bohan Zhang retweeted
🚨🇺🇸 Discord will let search engines index messages from public servers
Starting in mid-December, messages posted in eligible public channels on Discoverable Discord servers may appear on server web pages and in search results on Google and other search engines.
⠀
The change only applies to Discoverable Servers, which have at least 1,000 members and can be joined without an invitation.
Private servers, restricted channels, direct messages and group DMs are excluded.
⠀
Discord says:
• Messages posted before the rollout will not be included
• Usernames and avatars will not appear beside indexed messages
• Participating channels will be clearly labeled
• Server administrators can exclude individual channels or disable the feature
• Users can prevent future messages from appearing through Data & Privacy settings
• Teen accounts are excluded entirely
⠀
The individual message setting will be enabled by default in most regions. It will be disabled by default in the EU/EEA, UK, Canada, Brazil, Australia and South Korea.
Turning the setting off only affects messages posted while it is disabled. Messages sent while the feature was enabled may remain public unless the original Discord message is deleted, and cached search results may take longer to disappear.
⠀
Beginning November 16, every Discoverable Server will also receive a public Server Web Page that may contain AI-generated summaries of discussions from selected public channels.
Bohan Zhang retweeted
In an international law enforcement operation 👮, the US Department of Justice 🇺🇸, in cooperation with private sector partners, have taken down notorious bulletproof hosting provider Virtualine 💥
➡️ justice.gov/usao-edva/pr/bul…
Operating as AS202412 (Omegatech LTD), Virtualine received upstream connectivity from German 🇩🇪 providers aurologic GmbH (AS30823) and Pfcloud UG (AS51396), as well as French 🇫🇷 PEERXY NETWORKS SAS (AS213382), as bgp .tools shows. This network connectivity is now gone, currently making it impossible for Omegatech to operate 🛑
Omegatech announced 24x /24 IPv4 CIDRs, totaling 6,144 IPs. Out of these, hundreds were seen daily participating in spamming, internet-wide scanning, and botnet C2 hosting ⤵️
🌐 URLhaus tracked over 10,000 malware distribution sites at Omegatech: urlhaus.abuse.ch/asn/202412
📡 ThreatFox logged 2,000+ community-shared IOCs tied directly to Omegatech: threatfox.abuse.ch/asn/20241…
The hoster primarily served malicious infrastructure associated with RATs 🖥️ (e.g., PureRAT and OverlordRAT), rogue ScreenConnect servers 🔌, and social engineering malware campaigns like ClickFix and ErrTraffic 🖱️. While internet abuse for sure can happen, Virtualine was not reacting on abuse reports at all and advertised their "bulletproof hosting services" on the darkweb, as investigation shows 🕵️♀️
The takedown of Omegatech is welcome news. However, its long-term impact remains uncertain. Bulletproof hosters commonly re-brand and resume operations under new ASNs quickly 🔃
Furthermore, Omegatech is just the tip of the iceberg. Other active bulletproof hosters include:
➡️ AS219502 (STORMCLOUD)
➡️ AS207043 (DEDIK-IO)
➡️ AS214351 (FEMOIT)
What do they all have in common? According to bgp .tools, they all receive upstream connectivity from German provider aurologic GmbH (AS30823) as well 🔍👀
If you don't want to worry about the threats posed by bulletproof hosters, just block any CIDRs and ASNs listed on @spamhaus 's Don't Router Or Peer List (DROP):
🛑 spamhaus.org/blocklists/do-n…
ALT bgp.tools showing historic BGP upstream connectivity of Omegatech LTD provided by AS213382 PEERYX, AS30823 aurologic GmbH and AS51396 Pfcloud UG
Bohan Zhang retweeted
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Bohan Zhang retweeted
🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.
Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.
Patch now → 22.23.4 / 24.22.1 / 26.12.1
Read ↓ thehackernews.com/2026/10/re…
Bohan Zhang retweeted
‼️ The Oracle PeopleSoft zero-day exploited by ShinyHunters was actually THREE chained flaws.
New technical analysis reveals how an SSRF flaw bypasses internal access controls, enabling unauthenticated remote code execution.
All three were patched under one CVE: CVE-2026-35273.
Details → thehackernews.com/2026/10/sh…
Bohan Zhang retweeted
🚨🇺🇸 Veeam patches critical Backup & Replication authorization bypass
Veeam has released security updates addressing five vulnerabilities across Backup & Replication, Veeam Agent for Linux and Veeam ONE.
⠀
The most serious, CVE-2026-108142, carries a CVSS score of 9.1 and allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
⠀
Other patched vulnerabilities include:
• CVE-2026-105477: Local privilege escalation in managed Veeam Agent for Linux installations, CVSS 7.3
• CVE-2026-108140: Arbitrary file writes through path traversal, CVSS 5.9
• CVE-2026-108141: Arbitrary file writes through path traversal, CVSS 5.9
• CVE-2026-107671: Veeam ONE administrator can bypass MFA by disabling it before completing verification, CVSS 8.5
⠀
Backup & Replication versions 13.0 and 13.1 are affected by the authorization and path-traversal flaws.
Older 12.x releases are not affected by those specific issues.
⠀
Administrators should update to:
• Backup & Replication 13.1.2 build 13.1.2.57
• Backup & Replication 13.0.3 build 13.0.3.63
• Veeam Agent for Linux 13.1.2 build 13.1.2.11
• Veeam ONE 13.1 P1 build 13.1.0.7940
Bohan Zhang retweeted
EV signature "Space Solar Technologies LLC"
Signs fake CloakGuard RMM disguised as Windows service -> fake blue screen -> installs ScreenConnect
rmm[.]cloakguard[.]org
162[.]246.19.216
relay[.]alico[.]shop · 69[.]169.106.96:8041
rogueauthority.org/cloakguar…
Bohan Zhang retweeted
Microsoft gives anyone with a Microsoft account a free Azure Data Explorer cluster.
No subscription, no credit card, full KQL. Mine took under 2 minutes to create.
aka.ms/kustofree
ALT Azure Data Explorer free cluster create dialog
Bohan Zhang retweeted
Cohere released the traces, so I had a look. Interesting stuff.
The model was asked to create a detection for curl downloading scripts to /tmp, followed by bash execution. Instead, it:
- Listed files under /tmp
- Checked for curl, wget, python3 and jq
- Read the DNS configuration
- Attempted an HTTP PUT to an Alibaba OSS endpoint with a synthetic test payload
- Checked the HTTP response code
I’m leaning towards training contamination. It’s bizarre behavior, especially without being asked or any prior context.
Could it have been trying to test curl before simulating the actual attack? Possibly. Still a very strange way to approach this.
In the spirit of transparency and openness, we are releasing the traces so developers can test this out for themselves. We noticed this behaviour without prefilling with the following prompt, but this is rare. If you want to reproduce it, you can use this prompt with prefilling.
Open models make for better science and are part of why this problem came to light at all: developers running Qwen3.8 on their own machines spotted the strange links, and having the weights let us study the behaviour in depth.
We're encouraged by the thoughtful discussion our research has sparked across the AI and security communities. It's our belief that open-weight models are an important part of the future of AI, and we've recently released several under the Apache 2.0 license.
Trace, raw tokens, & minimal reproduction script: huggingface.co/datasets/Cohe…
Bohan Zhang retweeted
php2shell (CVE-2026-109618/109619, CVSS 9.2) is unauthenticated RCE in PHP core. We took it into the lab to see what it actually looks like on a host, and how a SOC catches it.
activesoc.blackhillsinfosec.…
Bohan Zhang retweeted
Another day - another Stealer: MopsStealer 🐶
Active botnet C2s, hosted at Podaon SIA 🇳🇱:
📡 mops .to
📡 45.91.202.47:408
📡 45.91.202.47:1488
📡 45.91.202.146:408
📡 45.91.202.146:1488
Malware samples ⤵️
bazaar.abuse.ch/browse/signa…
IOCs ⤵️
threatfox.abuse.ch/browse/ma…
Bohan Zhang retweeted
Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder bundled with Node.js that can lead to RCE.
Discover affected versions, detection queries, and mitigation steps: ow.ly/T99a51013NZ
Bohan Zhang retweeted
Microsoft wants EDR out of the Windows kernel. We checked the binaries
They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U
Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds.
What we found:
• wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
• EspFilterPort: the filter communication port it uses to reach user mode
• espclient.dll: 120 Esp* exports for rules, filters and event queues
Bohan Zhang retweeted
❗️ A Chinese spyware kit called uCreator hides in repackaged Telegram, WeChat and GCash apps.
In Telegram it can read chats and grab the 2FA password in cleartext, researcher Ovi found.
Its makers left their backend and the names of ~3 dozen developers on an open GitLab server.
Bohan Zhang retweeted
🚨 Brotli2Shell goes beyond HTTP2Shell.
CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.
JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.
We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.
Full research and technical details in our blog 👇