Pinned Tweet
114,000 OSS artifacts per day. Around 4,618 reach LLM triage. Roughly 100 reach an analyst.
In our latest blog post, @marius_benthin explains how we combine THOR Thunderstorm with LLM triage to monitor ten package registries and extension marketplaces without sending the l.
- THOR Thunderstorm ⚡️ scans the full feed using deterministic detection logic
- Only artifacts with THOR findings enter LLM triage 🤖
- The initial LLM stage costs an average of $2.88 per day
- Suspicious or inconclusive cases reach an analyst
- RuneAI is available on demand for deeper analysis of selected files
The article covers the architecture, operating numbers, limitations and a real malicious VS Code extension detected by the pipeline.
nextron-systems.com/2026/06/19/oss…
In our latest blog post, @marius_benthin explains how we combine THOR Thunderstorm with LLM triage to monitor ten package registries and extension marketplaces without sending the l.
- THOR Thunderstorm ⚡️ scans the full feed using deterministic detection logic
- Only artifacts with THOR findings enter LLM triage 🤖
- The initial LLM stage costs an average of $2.88 per day
- Suspicious or inconclusive cases reach an analyst
- RuneAI is available on demand for deeper analysis of selected files
The article covers the architecture, operating numbers, limitations and a real malicious VS Code extension detected by the pipeline.
nextron-systems.com/2026/06/19/oss…
2
10
28
10,943
#PHP2SHELL is already making its way into active Linux botnet arsenals.
Spotted a THOR-detected sample with PHP2SHELL-VULN-CVE-2026-109618 integrated alongside 8 existing CVE exploit references.
Botnets are adapting fast.
Patch ASAP and assess your systems for signs of e you're safe just because you've patched.
virustotal.com/gui/file/a75ff…
Spotted a THOR-detected sample with PHP2SHELL-VULN-CVE-2026-109618 integrated alongside 8 existing CVE exploit references.
Botnets are adapting fast.
Patch ASAP and assess your systems for signs of e you're safe just because you've patched.
virustotal.com/gui/file/a75ff…
1
20
39
6,147
Nextron Research ⚡️ retweeted
Our OSS artifact scanning picked this up too
The funny part, at least for us, is that this is a side project built around the scanner and detection rules we already ship for endpoints. Its initial LLM triage costs about $3 a day.
We download packages from public registries, eir files through THOR Thunderstorm. The generic detection rules flag suspicious code, obfuscation and recurring attacker tradecraft. Only artifacts with findings reach the LLM, which gets the matched strings and surrounding context to assess what’s going on.
Across roughly 114,000 artifacts a day, about 4% reach that initial LLM pass. The rest never generate a token bill.
In this case, an existing generic Python rule flagged the malicious sitecustomize.py. We already had the detection logic; we’re just applying it to packages downloaded from registries as well as files found on endpoints.
And that’s what amuses me about this. Supply-chain security attracts substantial funding, and specialist vendors are reporting this compromise. We picked it up by reusing years of endpoint detection engineering in an internal project, with an initial LLM triage bill averaging $2.88/day.
Pretty useful bycatch.
We described the pipeline here:
nextron-systems.com/2026/06/19/oss…
The funny part, at least for us, is that this is a side project built around the scanner and detection rules we already ship for endpoints. Its initial LLM triage costs about $3 a day.
We download packages from public registries, eir files through THOR Thunderstorm. The generic detection rules flag suspicious code, obfuscation and recurring attacker tradecraft. Only artifacts with findings reach the LLM, which gets the matched strings and surrounding context to assess what’s going on.
Across roughly 114,000 artifacts a day, about 4% reach that initial LLM pass. The rest never generate a token bill.
In this case, an existing generic Python rule flagged the malicious sitecustomize.py. We already had the detection logic; we’re just applying it to packages downloaded from registries as well as files found on endpoints.
And that’s what amuses me about this. Supply-chain security attracts substantial funding, and specialist vendors are reporting this compromise. We picked it up by reusing years of endpoint detection engineering in an internal project, with an initial LLM triage bill averaging $2.88/day.
Pretty useful bycatch.
We described the pipeline here:
nextron-systems.com/2026/06/19/oss…
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
5
12
39
6,206
We’ve been checking our PHP2SHELL detection coverage at Nextron and extending the rule set based on the published PoCs
After successful exploitation, we expect familiar activity: webshell drops, reverse shells, suspicious child processes, new user accounts… Our generic vered many of these patterns for years, so useful coverage was already in place before disclosure.
The blog documents that existing coverage and the additions, explains what the findings can actually tell you, and includes PHP hardening recommendations.
nextron-systems.com/2026/10/22/php…
After successful exploitation, we expect familiar activity: webshell drops, reverse shells, suspicious child processes, new user accounts… Our generic vered many of these patterns for years, so useful coverage was already in place before disclosure.
The blog documents that existing coverage and the additions, explains what the findings can actually tell you, and includes PHP hardening recommendations.
nextron-systems.com/2026/10/22/php…
0
15
31
8,536
#Kimsuky (APT-C-55) is delivering persistent backdoors through multilingual LNK phishing lures
After reading the 360 Threat Intelligence Center's report on APT-C-55's multi-path delivery campaign, we found a cluster of nine related malicious LNK files submitted between September detection ratios around 10-30 out of 60+ engines.
The LNK files execute a layered attack chain: base64-encoded batch scripts decoded via a renamed copy of certutil.exe, staging in C:\Users\Public, nircmd disguised as ntoskrnl.exe, and scheduled tasks running every 9 minutes for persistence. A parallel variant uses PowerShell with double hex-encoded payloads, and a third path poisons the open-source pybroker Python library as a supply chain attack.
Analysis & IOCs: github.com/NextronSystems…
After reading the 360 Threat Intelligence Center's report on APT-C-55's multi-path delivery campaign, we found a cluster of nine related malicious LNK files submitted between September detection ratios around 10-30 out of 60+ engines.
The LNK files execute a layered attack chain: base64-encoded batch scripts decoded via a renamed copy of certutil.exe, staging in C:\Users\Public, nircmd disguised as ntoskrnl.exe, and scheduled tasks running every 9 minutes for persistence. A parallel variant uses PowerShell with double hex-encoded payloads, and a third path poisons the open-source pybroker Python library as a supply chain attack.
Analysis & IOCs: github.com/NextronSystems…
0
11
46
3,908
A reminder of how cool THOR Thunderstorm and its collectors are ⚡
Some systems will never run a security agent: ESXi hosts, network appliances, routers, industrial and out-of-support systems. They are still part of your attack surface.
The trick: don't bring the scanner to the ine's files to the scanner.
- A collector (one Go binary, or one script in Bash, POSIX sh, Python, Perl, PowerShell or Batch) copies selected files to your own THOR Thunderstorm. The originals stay where they are.
- You decide what leaves: recent files, a size limit, selected types. Preview it with a dry run first.
- THOR does the heavy lifting on your server: YARA rules, your own signatures, IOCs, Sigma rules and forensic parsers.
- Findings land in a log, in syslog or in your SIEM. Run it every night with cron or Ansible and ship only what changed.
No agent. Often a shell and a network connection are enough.
93 seconds, no sound, video below
(The findings in the film are illustrative)
Collectors:
github.com/NextronSystems…
The written version: github.com/NextronSystems…
#DFIR #ThreatHunting #IncidentResponse #YARA #Sigma
Some systems will never run a security agent: ESXi hosts, network appliances, routers, industrial and out-of-support systems. They are still part of your attack surface.
The trick: don't bring the scanner to the ine's files to the scanner.
- A collector (one Go binary, or one script in Bash, POSIX sh, Python, Perl, PowerShell or Batch) copies selected files to your own THOR Thunderstorm. The originals stay where they are.
- You decide what leaves: recent files, a size limit, selected types. Preview it with a dry run first.
- THOR does the heavy lifting on your server: YARA rules, your own signatures, IOCs, Sigma rules and forensic parsers.
- Findings land in a log, in syslog or in your SIEM. Run it every night with cron or Ansible and ship only what changed.
No agent. Often a shell and a network connection are enough.
93 seconds, no sound, video below
(The findings in the film are illustrative)
Collectors:
github.com/NextronSystems…
The written version: github.com/NextronSystems…
#DFIR #ThreatHunting #IncidentResponse #YARA #Sigma
0
6
10
6,345
#APT28 is using weaponized Office documents to deliver the Covenant Grunt backdoor.
We detected a cluster of seven malicious .docm and .xls files between July 8 and July 14, with some having AV detection ratios as low as 5/62 at the time of first submission. Our THOR APT ught what traditional engines missed.
The documents use obfuscated VBA macros that assemble strings at runtime to evade static analysis, perform XOR-encoded host reconnaissance, and drop a 64-bit Covenant Grunt loader DLL disguised as a log file. The campaign uses Russian-language lures like "Прайс.xls" (Price List) and business-themed filenames like "accounts.xls", consistent with APT28 targeting patterns. Network analysis shows Dropbox being used as C2 infrastructure.
This activity aligns with Zscaler's reporting on Operation NeuSploit (CVE-2026-21509).
Analysis & IOCs: github.com/NextronSystems…
We detected a cluster of seven malicious .docm and .xls files between July 8 and July 14, with some having AV detection ratios as low as 5/62 at the time of first submission. Our THOR APT ught what traditional engines missed.
The documents use obfuscated VBA macros that assemble strings at runtime to evade static analysis, perform XOR-encoded host reconnaissance, and drop a 64-bit Covenant Grunt loader DLL disguised as a log file. The campaign uses Russian-language lures like "Прайс.xls" (Price List) and business-themed filenames like "accounts.xls", consistent with APT28 targeting patterns. Network analysis shows Dropbox being used as C2 infrastructure.
This activity aligns with Zscaler's reporting on Operation NeuSploit (CVE-2026-21509).
Analysis & IOCs: github.com/NextronSystems…
1
35
111
9,173
Our research team identified a second downloader variant linked to the WebSockets backdoor campaign recently analyzed by @dmpdump.
While the original downloader was written in native C++, this new variant uses C# (.NET 8).
Same seven payload files, same NVIDIA-themed disguise, plementation: no obfuscation, plaintext strings, and extensive retry logic designed to handle hours of unreliable connectivity.
An interesting detail: it ships as a 14 MB self-contained .NET single-file executable. Open it in IDA and you'll mainly see the native .NET runtime host rather than the actual downloader logic.
We've developed three new YARA detection rules covering both downloader variants and the WebSockets backdoor, and added them to our THOR scanners.
You can explore the rules' matches on VirusTotal through our Valhalla pages:
valhalla.nextron-systems.com/info/rule/MAL_…
valhalla.nextron-systems.com/info/rule/MAL_…
valhalla.nextron-systems.com/info/rule/MAL_…
Full technical analysis, decompiled source and IOCs:
github.com/NextronSystems…
While the original downloader was written in native C++, this new variant uses C# (.NET 8).
Same seven payload files, same NVIDIA-themed disguise, plementation: no obfuscation, plaintext strings, and extensive retry logic designed to handle hours of unreliable connectivity.
An interesting detail: it ships as a 14 MB self-contained .NET single-file executable. Open it in IDA and you'll mainly see the native .NET runtime host rather than the actual downloader logic.
We've developed three new YARA detection rules covering both downloader variants and the WebSockets backdoor, and added them to our THOR scanners.
You can explore the rules' matches on VirusTotal through our Valhalla pages:
valhalla.nextron-systems.com/info/rule/MAL_…
valhalla.nextron-systems.com/info/rule/MAL_…
valhalla.nextron-systems.com/info/rule/MAL_…
Full technical analysis, decompiled source and IOCs:
github.com/NextronSystems…
1
10
29
1,982
An Iranian threat actor is still running a GitHub-based loader with low detection rate on VirusTotal, six weeks after first submission.
We went hunting after reading Unit 42's Blinder Tunnel report and found a new variant with infrastructure changes not covered in prior Workers relay, a new GitHub account, and credential-rotation instructions hidden inside HTML comments on Microsoft/vscode issues, encrypted per-victim so only the targeted host can read them.
The loader was delivered via an Inno Setup installer themed as a Dubai Airport careers IT assessment, targeting Iraq.
Technical analysis + decompiled source + IOCs:
github.com/NextronSystems…
We went hunting after reading Unit 42's Blinder Tunnel report and found a new variant with infrastructure changes not covered in prior Workers relay, a new GitHub account, and credential-rotation instructions hidden inside HTML comments on Microsoft/vscode issues, encrypted per-victim so only the targeted host can read them.
The loader was delivered via an Inno Setup installer themed as a Dubai Airport careers IT assessment, targeting Iraq.
Technical analysis + decompiled source + IOCs:
github.com/NextronSystems…
2
27
126
9,971
Seven national blue teams used THOR APT Scanner at Locked Shields 2026, the world’s largest live-fire cyber defence exercise.
We didn’t ask for flowers. We asked how it held up, and what would make their life easier.
Their strongest ask: easier integration with LLM-assisted analysis. Which is exactly where THOR v11 will shine (stay tuned!).
Read the full feedback here:
nextron-systems.com/2026/09/30/tho…
#LockedShields @NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE)
We didn’t ask for flowers. We asked how it held up, and what would make their life easier.
Their strongest ask: easier integration with LLM-assisted analysis. Which is exactly where THOR v11 will shine (stay tuned!).
Read the full feedback here:
nextron-systems.com/2026/09/30/tho…
#LockedShields @NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE)
0
7
32
3,781
We’ve continued working on the recent Citrix #NetScaler exploitation around CVE-2026-88771 and CVE-2026-88772 and significantly expanded the THOR detection coverage.
We’re now at 21 new rules covering different parts of the exploitation and post-exploitation activity.
New E-2026-88771 exploitation and encoded variants
- NetScaler webshell droppers and encoded webshell payloads
- Perl bind shells and suspicious Perl execution
- hidden payload downloads
- suspicious chmod operations on /bin/sh
- EPA bypass and authentication policy manipulation
- creation of privileged users
- Platypus C2 agents and bootstrap scripts
- SLAPSHOT / WHIPSHOT related artifacts
- NetScaler persistence and C2-header based webshell indicators
- CVE-2026-88772 PoC artifacts
This comes on top of the generic THOR rules that already detected many of the recovered artifacts before we had campaign-specific signatures. As new samples, reports and information from partners and customers become available, we keep adding more precise coverage.
For scanning NetScaler appliances, there are two practical approaches: SSHFS + THOR for ad-hoc incident response and THOR Thunderstorm collectors for recurring compromise assessments. The infographic below shows the difference.
If you scanned your NetScaler systems a few days ago, update your signatures and scan again. The coverage today is considerably broader than it was immediately after disclosure.
nextron-systems.com/2026/10/06/upd…
We’re now at 21 new rules covering different parts of the exploitation and post-exploitation activity.
New E-2026-88771 exploitation and encoded variants
- NetScaler webshell droppers and encoded webshell payloads
- Perl bind shells and suspicious Perl execution
- hidden payload downloads
- suspicious chmod operations on /bin/sh
- EPA bypass and authentication policy manipulation
- creation of privileged users
- Platypus C2 agents and bootstrap scripts
- SLAPSHOT / WHIPSHOT related artifacts
- NetScaler persistence and C2-header based webshell indicators
- CVE-2026-88772 PoC artifacts
This comes on top of the generic THOR rules that already detected many of the recovered artifacts before we had campaign-specific signatures. As new samples, reports and information from partners and customers become available, we keep adding more precise coverage.
For scanning NetScaler appliances, there are two practical approaches: SSHFS + THOR for ad-hoc incident response and THOR Thunderstorm collectors for recurring compromise assessments. The infographic below shows the difference.
If you scanned your NetScaler systems a few days ago, update your signatures and scan again. The coverage today is considerably broader than it was immediately after disclosure.
nextron-systems.com/2026/10/06/upd…
0
6
8
2,005
Nextron Research ⚡️ retweeted
We examined artifacts left behind by attackers during the recent Citrix #NetScaler compromises. Many were already covered by existing generic THOR rules, including rules we've shipped for years.
One script matched SUSP_Linux_Downloader_Jul20_1. That rule dates back to 2020, more The script also matched SUSP_Bash_Jul26.
The recovered webshells matched these existing generic rules:
- SUSP_WEBSHELL_PHP_Encoded_Jun21_1
- SUSP_Eval_Base64_Indicators_Feb22_1
- EXT_WEBSHELL_PHP_Generic_Eval
- EXT_WEBSHELL_PHP_OBFUSC_3
- EXT_WEBSHELL_PHP_Generic
- EXT_WEBSHELL_PHP_Gzinflated
- EXT_WEBSHELL_PHP_Dynamic_Big
Some of those webshell rules are in THOR Lite, too (EXT_*)
This is POST-EXPLOITATION DETECTION. We didn't need to know which zero-day got the attacker in to recognize what they left behind.
A scan could have flagged these artifacts from day one, before the exploited vulnerabilities were public. The rules were already there.
Scan your edge devices regularly. Daily, where practical. Use THOR via SSHFS or scheduled file collection for THOR Thunderstorm.
Don't wait for the next advisory to start looking
Why THOR detects what others miss
nextron-systems.com/2025/06/18/the…
One script matched SUSP_Linux_Downloader_Jul20_1. That rule dates back to 2020, more The script also matched SUSP_Bash_Jul26.
The recovered webshells matched these existing generic rules:
- SUSP_WEBSHELL_PHP_Encoded_Jun21_1
- SUSP_Eval_Base64_Indicators_Feb22_1
- EXT_WEBSHELL_PHP_Generic_Eval
- EXT_WEBSHELL_PHP_OBFUSC_3
- EXT_WEBSHELL_PHP_Generic
- EXT_WEBSHELL_PHP_Gzinflated
- EXT_WEBSHELL_PHP_Dynamic_Big
Some of those webshell rules are in THOR Lite, too (EXT_*)
This is POST-EXPLOITATION DETECTION. We didn't need to know which zero-day got the attacker in to recognize what they left behind.
A scan could have flagged these artifacts from day one, before the exploited vulnerabilities were public. The rules were already there.
Scan your edge devices regularly. Daily, where practical. Use THOR via SSHFS or scheduled file collection for THOR Thunderstorm.
Don't wait for the next advisory to start looking
Why THOR detects what others miss
nextron-systems.com/2025/06/18/the…
For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems.
The new THOR Preview signature set currently includes:
POC_Sep26
Detects artifacts related to the public CVE-2026-88772 PoC
- LOG_SUSP_EXPL_CVE_2026_88771_Sep26
Detects potential CVE-2026-88771 exploitation traces in NetScaler logs
- WEBSHELL_CSS_PassThrough_Sep26
Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise
We also released a new IOC set:
- NetScaler ADC suspicious file artifacts
It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories.
The Preview signatures are already available with:
./thor-util update --sigdev
We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers.
Details:
nextron-systems.com/2026/09/29/new…
And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:
nextron-systems.com/2023/07/20/how…
6
51
194
18,264
Our THOR Thunderstorm-based artifact scanning pipeline detected a malicious, newly published npm package: dotenv-async v1.0.0.
Presented as an environment-configuration toolkit, it contains a Windows downloader that executes at import time and is concealed in JPEG metadata.
figuration packages are typically loaded during application startup, simply importing the package is enough to trigger the malicious chain.
The downloaded winhost.exe is an unsigned NSIS installer that deploys an obfuscated Electron infostealer. It targets browser passwords, cookies, and payment data, Discord and Telegram sessions, documents, and cryptocurrency wallets and seed phrases.
The malware establishes persistence as:
%LOCALAPPDATA%\Microsoft\Windows\0\svchost.exe
It also connects to a WebSocket gateway that provides an interactive CMD/PowerShell backdoor. Additional payloads are retrieved on demand:
/browser: encrypted shellcode injected into dllhost.exe to extract browser credentials and cookies (browser.h)
/update: a PowerShell loader that retrieves /jack, a native clipboard hijacker exporting StartClipjack, RunClipjackLoop, and StopClipjack.
Collected data is staged in %TEMP%, compressed, uploaded to a separate TryCloudflare endpoint, and then deleted.
We confirmed this multistage behavior in the analyzed artifacts. We are not attributing this activity to a specific actor, nor are we claiming that a legitimate maintainer was compromised.
Domains:
hardwood-studio-obviously-briefing[.]trycloudflare[.]com
manufacturers-arrested-acre-foods[.]trycloudflare[.]com
campus-petite-timothy-gulf[.]trycloudflare[.]com
SHA-256:
2a001e4ef9933701b3d93e1a7e1e7ef67d481fac5febc96f951beabe68022322 (winhost.exe)
196f6b820aaf094b8728a11699e4e91cea464623ab0c3acebdde3d1adab59fb6 (embedded Electron executable)
79121c5d9ddfafd532c30b9c20644b9a45fadadee9163eb2e5678e4efceb4312 (browser.h shellcode)
4a439412a37048f7c4e18c5a6b6763258e6358aa77693802dccc9d9d506ebc44 (ret.ps1 Clipjack PowerShell loader)
Presented as an environment-configuration toolkit, it contains a Windows downloader that executes at import time and is concealed in JPEG metadata.
figuration packages are typically loaded during application startup, simply importing the package is enough to trigger the malicious chain.
The downloaded winhost.exe is an unsigned NSIS installer that deploys an obfuscated Electron infostealer. It targets browser passwords, cookies, and payment data, Discord and Telegram sessions, documents, and cryptocurrency wallets and seed phrases.
The malware establishes persistence as:
%LOCALAPPDATA%\Microsoft\Windows\0\svchost.exe
It also connects to a WebSocket gateway that provides an interactive CMD/PowerShell backdoor. Additional payloads are retrieved on demand:
/browser: encrypted shellcode injected into dllhost.exe to extract browser credentials and cookies (browser.h)
/update: a PowerShell loader that retrieves /jack, a native clipboard hijacker exporting StartClipjack, RunClipjackLoop, and StopClipjack.
Collected data is staged in %TEMP%, compressed, uploaded to a separate TryCloudflare endpoint, and then deleted.
We confirmed this multistage behavior in the analyzed artifacts. We are not attributing this activity to a specific actor, nor are we claiming that a legitimate maintainer was compromised.
Domains:
hardwood-studio-obviously-briefing[.]trycloudflare[.]com
manufacturers-arrested-acre-foods[.]trycloudflare[.]com
campus-petite-timothy-gulf[.]trycloudflare[.]com
SHA-256:
2a001e4ef9933701b3d93e1a7e1e7ef67d481fac5febc96f951beabe68022322 (winhost.exe)
196f6b820aaf094b8728a11699e4e91cea464623ab0c3acebdde3d1adab59fb6 (embedded Electron executable)
79121c5d9ddfafd532c30b9c20644b9a45fadadee9163eb2e5678e4efceb4312 (browser.h shellcode)
4a439412a37048f7c4e18c5a6b6763258e6358aa77693802dccc9d9d506ebc44 (ret.ps1 Clipjack PowerShell loader)
2
5
11
1,001
Our THOR Thunderstorm-based artifact scanning pipeline detected a new malicious PyPI package called "beautifyText" with no detections on VT. It contains a cross-platform backdoor and claims to provide harmless text-formatting utilities for terminals, logs, and CLI output.
ng the package appears routine, but beautifyText/__init__.py silently loads _compat.py. That module launches a detached process and connects to an obfuscated command-and-control server. Moreover, it registers the host, reports system and user information, polls for tasks, executes arbitrary shell commands, reads files for exfiltration, and writes attacker-supplied files.
C2: bleodw[.]wisp[.]uno
PyPI: pypi.org/project/beauti…
virustotal.com/gui/file/1702f…
ng the package appears routine, but beautifyText/__init__.py silently loads _compat.py. That module launches a detached process and connects to an obfuscated command-and-control server. Moreover, it registers the host, reports system and user information, polls for tasks, executes arbitrary shell commands, reads files for exfiltration, and writes attacker-supplied files.
C2: bleodw[.]wisp[.]uno
PyPI: pypi.org/project/beauti…
virustotal.com/gui/file/1702f…
1
9
17
2,800
For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems.
The new THOR Preview signature set currently includes:
POC_Sep26
Detects artifacts related to the public CVE-2026-88772 PoC
- LOG_SUSP_EXPL_CVE_2026_88771_Sep26
Detects potential CVE-2026-88771 exploitation traces in NetScaler logs
- WEBSHELL_CSS_PassThrough_Sep26
Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise
We also released a new IOC set:
- NetScaler ADC suspicious file artifacts
It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories.
The Preview signatures are already available with:
./thor-util update --sigdev
We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers.
Details:
nextron-systems.com/2026/09/29/new…
And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:
nextron-systems.com/2023/07/20/how…
The new THOR Preview signature set currently includes:
POC_Sep26
Detects artifacts related to the public CVE-2026-88772 PoC
- LOG_SUSP_EXPL_CVE_2026_88771_Sep26
Detects potential CVE-2026-88771 exploitation traces in NetScaler logs
- WEBSHELL_CSS_PassThrough_Sep26
Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise
We also released a new IOC set:
- NetScaler ADC suspicious file artifacts
It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories.
The Preview signatures are already available with:
./thor-util update --sigdev
We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers.
Details:
nextron-systems.com/2026/09/29/new…
And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:
nextron-systems.com/2023/07/20/how…
3
22
65
21,715
More npm packages from this campaign, using the same install script:
express-javascript@5.2.1
exprdd@5.2.1
exptred@5.2.1
exptrdd@5.2.1
exprrdd@5.2.1
exptredd@5.2.1
xeprews@5.2.1
express-javascript@5.2.1
exprdd@5.2.1
exptred@5.2.1
exptrdd@5.2.1
exprrdd@5.2.1
exptredd@5.2.1
xeprews@5.2.1
Another new worm attempt - new NPM packages react-nodejs and express-javascript contain a postinstall script that sources simple payloads from codeberg that attempt to self-proliferate through NPM and AUR packages. Simple and unlikely to spread based on current foothold but another indication that some threat actors are still chasing Shai-Hulud's tail
codeberg.org/hellscripter/i…
1
6
8
1,734
We found a Ukraine-targeted campaign using two very different lures: an “air raid alert” document aimed broadly at Ukrainian users, and a military-specific unit property inventory.
Both lead to a Telegram-controlled VBScript RAT capable of credential theft, screenshots, command file collection.
The second lure pushes the campaign back to at least 26 August 2026. What stands out is the collection focus: CAD, BIM, GIS, LiDAR and weather-model data, combined with per-host tasking and date-based file harvesting.
Full technical analysis + IOCs:
github.com/NextronSystems…
Both lead to a Telegram-controlled VBScript RAT capable of credential theft, screenshots, command file collection.
The second lure pushes the campaign back to at least 26 August 2026. What stands out is the collection focus: CAD, BIM, GIS, LiDAR and weather-model data, combined with per-host tasking and date-based file harvesting.
Full technical analysis + IOCs:
github.com/NextronSystems…
0
10
25
2,225
🚨 Supply-chain alert affecting PyPI and npm packages from the MemOS project @MemOS_dev.
Detected by our THOR Thunderstorm-based artifact scanning pipeline:
- PyPI: memoryos@2.0.34
- npm: [at]memtensor/memos-cloud-openclaw-plugin@0.1.25
Both packages contain hidden, ious Golang binaries in .sckit directory that are launched silently during normal use.
MemoryOS triggers the binary when logging initializes. The OpenClaw plugin launches it at gateway startup and while processing user prompts. The binaries receive the host environment. The npm variant also receives prompt text.
Embedded configurations specify home inventory, local runtime state, and communication with hard-coded remote endpoints. This creates potential exposure of developer credentials, tokens, configuration, and agent data.
We will provide more information as our investigation progresses.
Technical details and IOCs:
gist.github.com/marius-benthin…
Detected by our THOR Thunderstorm-based artifact scanning pipeline:
- PyPI: memoryos@2.0.34
- npm: [at]memtensor/memos-cloud-openclaw-plugin@0.1.25
Both packages contain hidden, ious Golang binaries in .sckit directory that are launched silently during normal use.
MemoryOS triggers the binary when logging initializes. The OpenClaw plugin launches it at gateway startup and while processing user prompts. The binaries receive the host environment. The npm variant also receives prompt text.
Embedded configurations specify home inventory, local runtime state, and communication with hard-coded remote endpoints. This creates potential exposure of developer credentials, tokens, configuration, and agent data.
We will provide more information as our investigation progresses.
Technical details and IOCs:
gist.github.com/marius-benthin…
3
8
21
2,497
@MemOS_dev GitHub Security Advisory: github.com/MemTensor/MemO…
0
1
0
369
Our THOR Thunderstorm-based artifact scanning pipeline identified a coordinated npm campaign hiding malicious behavior inside packages presented as runtime, process, layout, and image utilities.
When imported, the packages launch a hidden Node.js process that retrieves and JSON storage "npoint". The payload collects system and network details, steals Chrome extension data, monitors the clipboard, and can activate a Windows keylogger.
IOCs:
api.npoint[.]io/24c25d5f5fcbb0992a4f
api.npoint[.]io/33e8d008c334b060adad
api.npoint[.]io/641d37178a880b1e8b8f
api.npoint[.]io/ddae72efbb6714fae922
api.npoint[.]io/37c0a0c68bf7a94ed731
103.170.217[.]184:8787
Packages:
process-mite@1.1.79
process-lhpm@1.1.79
process-tailwind@1.1.99
[at]biz44/process-runtime-utils@1.1.10
[at]vibecheck-polid/process-runtime-utils@1.1.12
@biz44/runtime-utils@1.1.11
swnwall@1.2.10
[at]railone/image-utils@1.1.10
When imported, the packages launch a hidden Node.js process that retrieves and JSON storage "npoint". The payload collects system and network details, steals Chrome extension data, monitors the clipboard, and can activate a Windows keylogger.
IOCs:
api.npoint[.]io/24c25d5f5fcbb0992a4f
api.npoint[.]io/33e8d008c334b060adad
api.npoint[.]io/641d37178a880b1e8b8f
api.npoint[.]io/ddae72efbb6714fae922
api.npoint[.]io/37c0a0c68bf7a94ed731
103.170.217[.]184:8787
Packages:
process-mite@1.1.79
process-lhpm@1.1.79
process-tailwind@1.1.99
[at]biz44/process-runtime-utils@1.1.10
[at]vibecheck-polid/process-runtime-utils@1.1.12
@biz44/runtime-utils@1.1.11
swnwall@1.2.10
[at]railone/image-utils@1.1.10
1
9
18
2,581