Founder of Lupovis
Glasgow, Scotland
Joined December 2009
- Tweets10.7K
- Following4.4K
- Followers1.8K
- Likes13.7K
We've all heard this week about the PHP vulnerability that has impacted many websites around the world.
@LupovisDefence has seen initial recon for this vulnerability as early as the 19th of October. 1 full day before the vulnerability announcement.
#php2shell #threatintel
Xavier Bellekens retweeted
Searching for the Nuclear Control Room
What an exposed Windows intrusion workbench reveals about SCADA, PLC and critical-infrastructure discovery.
huntback.io/blog/searching-f…
#threatintel #SCADA #iot #CyberSecurity
Xavier Bellekens retweeted
WEB_RAT is still alive.
A 990-byte "config.json" on 176.12.71[.]122 turned out to be a SalatStealer panel bootstrap. Live TLS certs tie it to the stealer's rotating C2: wruser[.]org, salator[.]es, websalat[.]top. 🧵⬇️
#ThreatIntel #SalatStealer #Infostealer
Xavier Bellekens retweeted
A week after Censys mapped the DarkSword/Coruna iOS-exploit delivery infrastructure, we went back to one of the staging hosts (47.102.192[.]23). Still open, and it had grown.
The interesting part wasn’t the Coruna staging Censys already documented, it’s what sat next to it: a full enterprise post-compromise kit. SQL Server and MySQL looting, Jenkins and GitLab credential theft, SSH pivoting, lateral movement. Plus two dozen ELF/PE malware binaries, webshells, and a 187KB AI-pentest prompt corpus.
Loads of files across 4 open ports. And the Coruna delivery config? Byte-identical hash, reappeared on fresh IPs the week after Censys published.
Full breakdown + IOCs 👇
huntback.io/blog/darksword-c…
#ThreatIntel #CTI #DarkSword #Coruna #DFIR
Xavier Bellekens retweeted
Someone left the botnet’s backstage door open. 👀
We recovered 39 files from 129.159.135.190: C2 source, multi-architecture bots, DDoS tools and Roblox scripts.
The best part? Bot registrations in the logs match the recovered C2 code.
Even the operators need an opsec team.
huntback.io/ip/129.159.135.1…
#ThreatIntel #Botnet #DDoS
Xavier Bellekens retweeted
Following the @GoogleCloudSec and @censysio reports on the DarkSword/Coruna iOS exploit chain, we checked huntback, and we’d independently harvested the operator’s open directory at 47[.]102.192.23 (Alibaba Cloud, China) a while back 🧵 #darksword #coruna #ios
The best thing around vibe coding?
I have a 2018 75' LG OLED TV ... love the thing, but streaming from a computer to it is a pain.
Got myself a developper's account, made an app, now stremio streams on it directly.
15 minutes tops.
Xavier Bellekens retweeted
Our sensors gears are turning .... AGAIN!
We have issued immediate guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway: bit.ly/4rWRBz4
We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible.
Xavier Bellekens retweeted
The AI supply chain is already under fire.
CVE-2026-46339 (CVSS 10, critical) is an unauthenticated RCE in 9Router, an AI router / token-saver, via its MCP bridge. Unprotected /api/mcp/* lets an attacker register plugins and execute commands with no auth.
On our deception network: 362 hits from 312 distinct IPs since Sept 22, with a tight operator cluster on 69.5.169[.]x (DE).
As teams bolt MCP into production, the agent layer is now an attack surface. Running 9Router < 0.4.37? Patch now.
#ThreatIntel #MCP #AI #RCE
Xavier Bellekens retweeted
🚨 One more interesting techniques we've captured in the CVE-2026-88771 exploitation wave doesn't put the payload in the login field at all.
Two independent actors are using HTTP access logs as a staging area. We're calling it log-reflection. Here's how it works.
The attacker sends a GET request to the NetScaler with a full shell script embedded in the User-Agent header, tagged with a random identifier.
That request gets written into the HTTP access log like any other.
The payload is now sitting in /var/log/httpaccess*, looking like a normal log entry.
#citrix #netscaler #threatintel #CVE202688771
Xavier Bellekens retweeted
Found an entire botnet operation sitting in an open directory:
Cross-compiled bot binaries for every architecture, mips · mpsl · arm5/6/7 · x86 · ppc · m68k · sh4 (build name "UnHAnaAW"), the loader script, the CNC panel (dashboard.html + a .bak_cnc backup), and the bot's SQL db.
Open ports include 6666/6667: it's IRC-controlled. Old-school, still running.
Seen on the huntback honey network
Check app.huntback.io for the loot
#ThreatIntel #Botnet #Mirai #IoT
Xavier Bellekens retweeted
🚨 158.94.211[.]205 appears in public second-wave NetScaler IOC reporting.
Our sensors have been watching this IP since Sep 29, and the full timeline tells a more complete story than just "known attacker."
This is what methodical capability development looks like from the inside.
Sep 29: First contact. Broad NetScaler fingerprinting with a custom User-Agent "CVE-2026-88771-scanner/1.0 (defensive)".
Sweeps approximately 23 NetScaler-specific paths per sensor. No exploitation attempted. Pure reconnaissance.
Oct 1: Pivots to targeted POST /cgi/samlauth. Ten requests across multiple sensors between 08:15 and 14:45 UTC. The User-Agent changes mid-session from python-requests/2.34.2 to Chrome/148.0.0.0, suggesting active tool iteration during the campaign.
This SAML probing occurs approximately 35 hours before the first public report of CVE-2026-88779 exploitation.
#citrix #netscaler #threatintel
Xavier Bellekens retweeted
CVE-2026-88779 (NetScaler SAML) is on CISA KEV, due 7 Oct.
Checker v1.13: did the injection attempts run? Download host, source IP, payload in shell logs. + SAML probes, Sliver files, 105 IPs.
Thx @LupovisDefence, Huntback.io, PitScaler, @GothamTG
github.com/ThomasPoppelgaard…
Xavier Bellekens retweeted
🚨 This one is worth stepping back on, because the story that's emerged around WHIPSHOT scanning is one of the more interesting things we've seen in this campaign.
Not because of what it exploits, but because of what it reveals about the ecosystem forming around compromised NetScaler infrastructure.
After Mandiant published their analysis of CVE-2026-88772 and the WHIPSHOT/SLAPSHOT post-exploitation toolkit, you would expect scanning for those implants to follow.
And it did. But some of it started before that publication, and the tooling has evolved significantly since.
#citrix #netscaler #threatintel
Après un week-end consacré à #Citrix, ce lundi matin place à l’attaque contre l’#IFAPME avec RTLBelgium
On parle de risque, de sécurité préemptive, de contrôles et du délai entre publication d’une CVE et exploitation.
Avec une question : combien de Belges ont déjà vu leurs données fuiter ?
While the entire weekend was on CITRIX, Monday Morning is on the #IFAPME attack
The team is following an old (17 of sept) thread 🧵 #citrix #netscaler
🚨 One weird historical NetScaler hit we’re keeping an eye on:
On 17 Sep, a single IP hit one of our NetScaler sensors with GET /saml/login?SAMLRequest=... using UA probe/1.
The request URL/base64/DEFLATE decodes from ~2.8 KB to exactly 63,488 bytes (0xF800 / 62 KiB), but the output is not XML. It’s ~59.9 KB of G, ~2.5 KB of high-entropy binary, then 1 KB of g.
We searched across production for the IP, /24, UA and payload family: zero matches.
That does not prove CVE-2026-88779, but now that 88779 is confirmed as a remotely reachable SAML memory-overflow issue, a one-off pre-disclosure probe apparently targeting the pre-XML decompression/memory path is hard to ignore.
No known public scanner or PoC matches it so far.
#citrix #netscaler #threatintel #poc