JEDI-SEC | Security Research & Digital Defense

Day: October 8, 2026

  • Making sure the checks get printed

    Making sure the checks get printed

    Making sure the checks get printed

    Welcome to this week’s edition of the Threat Source newsletter. 

    My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies, and firewalls, then moving to risk management and compliance, disaster recovery, and investigations. I spent about 15 years as a consultant working across many well-known consultancy firms and eventually moved to Cisco where I spent time doing security operations center (SOC) design and assessments as well as segmentation before moving to the Talos IR team. I spent many years there, first as an Incident Commander and then a manager of our excellent team of global IR consultants and investigators. My current role is with the Talos Threat Intelligence and Interdiction team, where I’m focused on intelligence efficacy — how we can do better with the data we have, how we can get more data, and what our customers want from our intelligence products. 

    Since it’s Cybersecurity Awareness Month, I wanted to take a few minutes to collectively thank all of the defenders out there for the hard work you do each day. The work you do may not always be visible, but it matters.  

    I remember one job I had many years ago when I was in charge of security for a financial institution. I spent time learning each of the business processes that we had so I could understand each of the moving parts, what was essential, and what was on the horizon for change. I even spent a couple days meeting with the folks who handled printing. Yeah, printing — but not reports or internal documents. These were the people that created the checks that our institution used to pay other institutions, and more importantly (to me) our customers. 

    I recall there being many out-of-patch compliance boxes in this area of the company, so I, being the diligent Director, decided to find out why. It turns out the software being used to print these business essential checks would not run on the current operating systems, and the physical printer cards used to connect to these non-network printers also required older hardware ports. As one of the people I interviewed said, “We don’t want to be the reason someone’s grandma doesn’t get her check and can’t go to the grocery store.” 

    There were (at the time) no other alternatives that we could deploy, and the environment had zero tolerance for downtime. The solution I proposed was to isolate these devices into their own network, which blocked access to and from the internet for these devices, and also reduced the likelihood that these devices would be identified during an adversary’s internal reconnaissance or mapping. It didn’t patch the vulnerable devices, but it went a long way to reducing the likelihood of a bad thing happening to these devices due to their out-of-date OS and software. 

    This story is especially appropriate today, as we face ever-increasing numbers of vulnerabilities announced by software vendors, and can only expect this volume to continue to increase. Do what you can to make sure the checks still get printed, while managing your risks intentionally. 

    The one big thing  

    Cisco Talos is disclosing new findings from our CAIRN research that show malware authors are embedding natural-language instructions into their code to evade AI-assisted analysis. We classify this growing trend as “A3: AI-Analysis Evasion.” Over the past 18 months, we’ve tracked techniques ranging from simple comments telling an AI to ignore a file, to advanced “template spraying” designed to trick specific large language models (LLMs).  

    Why do I care? 

    Attackers expect AI to be in your analysis pipeline, and they’re developing cheap methods to manipulate those systems. While we found these prompt-injection techniques only steer the AI’s verdict in the attacker’s favor about 35 percent of the time, they are being adopted across all levels of malware sophistication. A3 families like MANTLEMAZE also pair these AI deceptions with serious underlying threats, such as abusing vulnerable drivers to disable EDR from kernel space. 

    So now what? 

    Because these evasion instructions must be written in plaintext, defenders have a highly stable detection surface to monitor. Security teams should flag imperative language addressed to analysis systems within binaries as a suspicious signal. Most importantly, anyone building or using AI-assisted pipelines must ensure that text extracted from a sample is strictly treated as evidence, never as a system directive. Read the full blog for more information on these techniques and a list of sample hashes. 

    Top security headlines of the week 

    Citrix NetScaler security snafus get even worse amid more zero-day reports 
    This latest vulnerability, tracked as CVE-2026-88779, is a memory overflow bug that leads to denial of service attacks. (The Register) 

    Hackers steal 8 million citizens’ records from Danish government database 
    The Danish government would not say who is behind the breach, which happened in September but was discovered on October 2. However, it said the unauthorized access was obtained by “abusing a Danish company’s lawful access to search for information in the CPR system.” (TechCrunch) 

    Google narrows open-source bug bounty amid wave of invalid automated reports 
    Google has temporarily closed its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions. According to Google, it has no impact on the program’s supply chain reports or on any pending reports. (SecurityWeek) 

    Warlock ransomware hits large Spanish, Portuguese orgs 
    In the last two months, researchers observed Warlock attacks against four victims: a water utility, a telecommunications provider, a regional government body, and a university. (Dark Reading) 

    U.S. Senate passes health care cybersecurity bill after 190 million impacted by Change Healthcare breach 
    The Health Care Cybersecurity and Resiliency Act of 2026 was passed by unanimous consent last week, potentially expanding federal cyber requirements for health care organizations. (The Record) 

    Can’t get enough Talos? 

    One breach, please, and make no mistakes 
    The cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure. How you prepare for agentic threats is what makes the difference during real incidents. 

    Talos Takes: Honey, I Trapped the Adversary 
    It’s time to start having fun and messing with your attackers. For Cybersecurity Awareness Month, Martin Lee joins Amy to discuss the fine art of making life on your network a complete nightmare for adversaries. 

    The Fine Art of Frustrating the Adversary 
    What really frustrates an adversary? Eight Cisco Talos researchers share practical ways to make their next move slower and riskier, from deception and behavioral detection to breaking attack dependencies. 

    Upcoming events where you can find Talos 

    Most prevalent malware files from Talos telemetry over the past week  

    SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
    MD5: 2915b3f8b703eb744fc54c81f4a9c67f 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
    Example Filename: sample.exe 
    Detection Name: W32.9F1F11A708-100.SBX.TG 

    SHA256: fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f 
    MD5: 207d9d891ac756b2bfad88aba5682c65 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f 
    Example Filename: sample.exe 
    Detection Name: W32.FED979F93B-95.SBX.TG 

    SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f 
    MD5: 38de5b216c33833af710e88f7f64fc98 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f 
    Example Filename: SECOH-QAD.exe 
    Detection Name: W32.9896A6FCB9-95.SBX.TG 

    SHA256: 73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f 
    MD5: 63f3351cfdf618bec6045f60203e7978 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f 
    Example Filename: f_003914.exe 
    Detection Name: W32.PUP:PulseBrowser.29kh.in12.Talos 

    SHA256: 58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 
    MD5: f1fe671bcefd4630e5ed8b87c9283534 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 
    Example Filename: KMSAuto Net.exe 
    Detection Name: W32.58D6FEC4BA-95.SBX.TG

    Source: Cisco Talos Intelligence · 2026-10-08

  • CastleStealer: An Emerging Infostealer Growing More Sophisticated

    Table Of Contents
    Table of Contents
    What We Know About CastleStealer
    What Data Does CastleStealer Target?
    Bypassing App-Bound Encryption
    From Infostealer to Remote Access
    How CastleStealer Exfiltrates Stolen Data
    Protect Against Emerging Infostealers Using Flashpoint

    More

    subscribe to our newsletter

    First discovered in April 2026, CastleStealer is a C#-based information-stealing malware that has continued to add new capabilities since its emergence. Newer samples analyzed by Flashpoint can bypass app-bound encryption in Chromium-based browsers, execute commands remotely, and exfiltrate stolen information in small encrypted transmissions rather than a single large archive.

    While Flashpoint has not yet identified a large influx of threat actors using CastleStealer, its continued development makes it an emerging threat worth watching. 

    What We Know About CastleStealer

    CastleStealer was first publicly identified in April 2026, when it was observed using ClickFix social engineering to deliver a Python script that executed a loader referred to as “CastleLoader.”

    By June, the malware had appeared in a different distribution campaign. Threat actors used malicious advertisements to direct victims to fake Node.js installation websites, where a batch script masquerading as an installer ultimately downloaded and executed a newer loader known as OXLOADER.

    Contents of downloaded batch script masquerading as a Node.js installer. (Source: Flashpoint)

    OXLOADER employs several techniques designed to make analysis and detection more difficult, including multiple rounds of self-decryption, obfuscated API resolution, sandbox checks, and in-memory execution. Flashpoint analysts assess that the loaders used to deliver CastleStealer appear to be developed in-house and demonstrate significant technical ability around anti-analysis and stealth. 

    But the delivery chain is only one part of CastleStealer’s evolution. Newer samples show that the infostealer itself has continued to expand what it can collect and what threat actors can do after a system is compromised.

    What Data Does CastleStealer Target?

    Once executed, CastleStealer first checks the system’s Multilingual User Interface (MUI) languages for Russian (ru-RU). It then connects to its command-and-control (C2) infrastructure and sends a handshake packet containing its build UUID and basic information about the infected host. After establishing the connection, it gathers additional information about the victim machine and sends it to the C2. 

    From there, CastleStealer begins searching for sensitive information across browsers, applications, and files on the victim’s system.

    For Chromium-based browsers, CastleStealer collects login data, cookies, browsing history, web data, and information stored by browser extensions. That includes extension IDs, IndexedDB data, and extension storage. 

    The malware also targets:

    • Firefox: Login data, cookies, browsing history, and form history.
    • Steam: Files including config.vdf, loginusers.vdf, and local.vdf, which can contain sensitive account information and settings.
    • Discord and Telegram: CastleStealer searches APPDATA for directories associated with both applications.
    • Files on the victim system: The malware broadly collects files while excluding several file types and files containing “backup.” It places particular emphasis on files containing “wallet” in their names.

    That browser targeting has also become more capable since CastleStealer was first discovered.

    Bypassing App-Bound Encryption

    One of the clearest examples of CastleStealer’s evolution is its ability to target data protected by newer browser security controls.

    Earlier analysis found that CastleStealer could not steal data from updated browsers using app-bound encryption. Newer samples analyzed by Flashpoint now use Chrome’s IElevator COM interface to bypass that protection, a technique also used by other modern infostealers.

    IElevator COM CLSIDs present for various Chromium-based browsers in newer CastleStealer samples. (Source: Flashpoint)

    The change closes a meaningful limitation present in earlier CastleStealer samples and expands the browser data available to the malware.

    From Infostealer to Remote Access

    Newer CastleStealer samples also give threat actors capabilities beyond stealing information from an infected machine.

    CastleStealer contains basic remote shell functionality that allows an operator to send a shell command to the victim system, provide a file for execution, or send the URL of another payload that CastleStealer will download and execute. 

    CastleStealer remote command capabilities. (Source: Flashpoint)

    That capability gives an attacker additional options after the initial compromise. Instead of ending the operation once targeted information has been collected, an operator can interact with the infected system and introduce additional payloads.

    How CastleStealer Exfiltrates Stolen Data

    CastleStealer also differs from many other infostealers in how it sends stolen information back to its operators.

    Rather than collecting stolen data into an archive and transmitting it to a C2 server or Telegram channel, CastleStealer sends smaller amounts of collected data over raw TCP. The transmissions are encrypted using AES.

    Flashpoint analysts assess that transmitting data this way may help CastleStealer avoid network detections associated with a single spike caused by a large data transfer. 

    The network packets follow a straightforward structure:

    {4-byte size} → {AES IV} → {Encrypted Data}

    AES-128 CBC decryption of a CastleStealer network packet. (Source: Flashpoint)

    Once CastleStealer completes its activity, it deletes itself using a common ping-delay self-deletion technique.

    Protect Against Emerging Infostealers Using Flashpoint

    CastleStealer’s development since its discovery illustrates how quickly an emerging infostealer can mature. Its operators have changed how the malware reaches victims, while the stealer itself has gained the ability to bypass browser protections, remotely execute commands and additional payloads, and exfiltrate stolen data in smaller encrypted transmissions.

    CastleStealer has not yet seen the widespread adoption associated with more established infostealer families. But its trajectory makes it one to watch as its developers continue to improve both its collection capabilities and what operators can do after compromising a victim.

    Flashpoint continuously monitors emerging malware, illicit communities, and threat actor infrastructure to identify these shifts as they happen. Request a demo to learn how Flashpoint’s primary source intelligence and analyst research help security teams identify emerging threats and respond before they become widespread.

    See Flashpoint in Action

    Get a Demo

    Contact Sales

    Source: Flashpoint · 2026-10-08

  • The Secrets of a US Spyware King

    Paragon Solutions vowed not to sell its mobile spyware to governments with poor human rights records and to cut off customers who misuse its products. However, in 2025 researchers at the Citizen Lab confirmed that the spyware had been used to target Italian activists and journalists. In an exclusive interview with WIRED, Paragon’s CEO Andrew Boyd revealed the limits of the company’s promise: that it has no way to know if customers misuse its software, and it doesn’t have a “kill switch” to disable customers when there is misuse.

    Speaking with WIRED, Citizen Lab’s senior researcher John Scott-Railton noted that Paragon has  “less oversight, less transparency, less contractual protection against abuses than NSO Group,” another spyware company that has faced criticism for its use against journalists, activists, and others. 

    “It’s exactly the opposite of the picture that Paragon has painted for itself for years,” says Scott-Railton, “And it signals to lawmakers and regulators that the spyware industry cannot be trusted to self-regulate.”

    Read the article in WIRED

    Source: Citizen Lab · 2026-10-08

  • Geothermal Energy: Bureau of Land Management Should Improve Permitting Process as Development Demand Grows on Federal Lands

    What GAO Found

    The Department of the Interior’s Bureau of Land Management (BLM) has processed an increasing volume of land nominations, leases, and permits for geothermal development on federal lands since 2019. Geothermal projects use heat from the earth’s interior to generate electricity. Parties interested in developing geothermal projects on federal lands nominate acres for BLM to review against land use plans. Such nominations increased from about 25,800 acres in 2020 to more than a million acres in 2025. BLM then offers qualifying lands for lease at auctions known as competitive lease sales, which have also increased since 2020. Once land is leased, developers submit plans to BLM for review and apply for permits at various stages of development. Drilling permits approved annually by BLM grew from seven in 2019 to 68 in 2024.

    Total Acreage Nominated for Geothermal Use and Offered for Lease, 2020–2025

    Geothermal developers and BLM officials identified various challenges facing the geothermal program, including:

    Inconsistent experience navigating the permitting process. Some developers reported instances of what they believe were inconsistent BLM determinations related to permits for exploration. BLM documentation notes that inconsistencies in terminology between developers and BLM officials may contribute to confusion or misunderstandings. However, handbooks that would resolve this confusion have been in draft since at least 2022 and are not publicly available. Without finalized geothermal resources handbooks, continued inconsistencies and misunderstandings could lead to longer development timelines and additional costs for developers.
    Limited visibility of permit data. Geothermal developers have limited visibility into the status of permits once these are submitted to BLM, which creates challenges for planning timelines and resource needs. BLM does not have comprehensive information on the status of geothermal permits, making it difficult for BLM to gain insights into permitting activity—for example, to determine if there is a growing backlog of permits across BLM field offices. By establishing a unified mechanism to track permitting activity, BLM could better track progress toward producing geothermal energy on federal land and generating revenue for federal, state, and county governments.

    Why GAO Did This Study

    Geothermal energy is a reliable and domestically-sourced option to help address growing demand for utility-scale power generation in the United States. Geothermal power plants on federal land have a combined 2,600 megawatts of capacity and, in 2022, generated enough electricity to power more than 1 million homes. Geothermal power plants on federal land represent about 65 percent of geothermal capacity in the United States.

    GAO was asked to review geothermal leasing and permitting on federal land. This report examines (1) the extent to which BLM processed land nominations, held lease sales, and approved permits for geothermal development and (2) challenges BLM faces in managing the geothermal leasing and permitting program.

    GAO analyzed BLM’s data on land nominations, lease sales, and permitting, and interviewed BLM officials in states with geothermal land nominations and leases. GAO also interviewed geothermal industry officials and administered a questionnaire to 22 geothermal developers.

    Source: GAO Reports & Testimonies · 2026-10-08

  • China-linked malicious actors called out by UK and international partners for targeting sensitive data globally

    Joint advisory with international partners highlights malicious targeting of organisations from a range of sectors across the globe.

    Source: NCSC UK · 2026-10-08

  • MATCHBOIL: New tricks, same old evil intentions

    ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026

    Source: WeLiveSecurity (ESET) · 2026-10-08

  • James v. Villanueva

    process itself was compromised by voter database hacking, violations of credentialing rules, quorum manipulation

    Original document

    Source: CourtListener — Breach & Hacking Opinions · 2026-10-08

  • Cyberangriff trifft Kreiskliniken Kassel

    Les Kreiskliniken Kassel ont été victimes d’une cyberattaque affectant les sites de Hofgeismar et Wolfhagen. L’incident a été détecté le 8 octobre 2026, et les plans d’urgence ont été activés. Bien que la prise en charge médicale et les opérations courantes restent pleinement assurées, les autorités examinent actuellement la possibilité d’une fuite de données personnelles. Le Vorfall a été signalé aux autorités allemandes compétentes (BSI, etc.).

    • Victim: Kreiskliniken Kassel
    • Country: DE
    • Domain: kreisklinikenkassel.de

    Source: ransomware.live — Cyberattacks in the News · 2026-10-08

  • Cyberangriff trifft Hochschulservicezentrum Baden-Württemberg in Reutlingen

    Le Hochschulservicezentrum Baden-Württemberg (HSZ-BW) de Reutlingen a été victime d’une cyberattaque. L’incident a été détecté par le département informatique le mercredi soir. Les autorités compétentes, incluant l’agence de cybersécurité BW et la police de Reutlingen, ont ouvert une enquête. Un groupe de crise est mobilisé pour gérer la situation.

    • Victim: Hochschulservicezentrum Baden-Württemberg
    • Country: DE
    • Domain: hsz-bw.de

    Source: ransomware.live — Cyberattacks in the News · 2026-10-08

  • Following cyber incident, some Easthampton students say hotspot access is limited

    L’école publique d’Easthampton a été touchée par un incident cybernétique qui a mis hors ligne son réseau informatique. Bien que des points d’accès (hotspots) aient été mis à disposition pour les élèves, des plaintes ont été soulevées concernant les restrictions d’accès à ces dispositifs. Le district travaille actuellement avec des experts en criminalistique numérique pour enquêter sur l’incident.

    • Victim: Easthampton Public Schools
    • Country: US
    • Domain: epsd.us

    Source: ransomware.live — Cyberattacks in the News · 2026-10-08