ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
Source: WeLiveSecurity (ESET) · 2026-10-22
Was investigating my gmail account (just for fun) and got to know about the concept of a GAIA ID. What can it exactly do? Google doesn’t give any answers.
Like, can it find my YouTube channel? Or is it limited to Google Maps review?
submitted by /u/TheMoon-Sparks
[link] [comments]
Source: Reddit r/OSINT · 2026-10-22
For SOCs and defenders:
Source: Cyble Research · 2026-10-22
Filtering those out is why the confirmed count is 35, not several thousand. Table 1 breaks the 35 down by type. The values stay withheld, and a few sites appear under more than one row.
| Exposure | Sites | What an attacker gains |
| OpenAI API key | 5 | Spend the owner’s balance, exhaust quota, run up the bill |
| Shared Slack webhook | 13 | Post arbitrary messages into the operator’s workspace |
| Stripe secret key | 6 | Full API access: charges, refunds, customer and payout data |
| Supabase service-role JWT | 4 | Full read/write to the backend database, bypassing access rules |
| AWS access key | 5 | Cloud account access, scope set by the paired secret |
| GitHub token / Google OAuth secret | 2 | Source-control or identity-provider access |
Table 1 – Confirmed private-credential exposures across 22,306 AI-built sites, by type.
Every credential in Table 1 is a working key to a live account. An attacker reads a public web page, copies a value, and calls an API. Here is what that buys them, key by key.
One exposure counts many times over. When the key sits on a cloned fleet, it is live on every domain in that fleet, so an attacker who finds it on one site has compromised all of them.
AI app-builders made it almost free to publish a website, and just as free to clone one, and most of what they produce is worth nothing to steal.
The exceptions are what we went looking for. A small, steady set of these sites hand over the key that runs them, and when an operator copies one site across a fleet, the leak rides along to every domain.
Against the millions of domains registered each month, the number is tiny, but every hit is a live account an attacker can reach and exploit just by opening the page.
If you build on these tools, read your own shipped code before you publish it. If you defend an organization, assume your keys may surface on sites you never built and look for them.
Cyble’s Threat Intelligence Platforms continuously monitor emerging threats, infrastructure, and activity across the dark web, deep web, and open sources. This proactive intelligence empowers organizations with early detection, impersonation, infrastructure mapping, and attribution insights. Altogether, these capabilities provide a critical head start in mitigating and responding to evolving cyber threats.
For developers and AI-builder users:
For SOCs and defenders:
Source: Cyble Research · 2026-10-22
Spinning up a website no longer takes a developer. A prompt to an AI app-builder returns a working, styled, deployable site in minutes, and when one template works, the same operator clones it across a dozen domains before launch. That is also how secrets end up in plain sight.
Over a month, Cyble Research and Intelligence Labs (CRIL) scanned more than 1.3 million newly registered domains, identified the ones built by AI app-builders, and read their public front-end code for exposed credentials. We built our own classifiers to spot AI-generated websites as they are registered, paired with a scanner that pulls exposed keys and credentials straight from their public code. On 35 of the 22,306 AI-built sites we identified, a genuinely private secret was sitting in the browser: live OpenAI keys, Stripe secret keys, backend database tokens, and, in several cases, a single credential cloned across a whole fleet of domains.
Thirty-five is a small number, since counting every key-shaped string on an AI-built site is easy and misleading, as most are meant to be in the browser; a single reCAPTCHA key appeared on thousands of sites. We kept only the credentials that are never supposed to leave a server. Those are the findings below.
This report walks through the two leak patterns we observed, what appears exposed, what an attacker can do with these keys, and how to shut down the exposure.
An AI-built site generates its content with a Large Language Model (LLM), and the key to that model often ships in the page the visitor downloads. That is the plainest pattern we found, and the most on-the-nose.
Five AI-built sites carried live OpenAI API keys in their client-side code, sixteen distinct keys across them, and four of the five are confirmed AI-generated. One AI-writing site stands out on its own: it shipped twelve different OpenAI keys, one per content category, as plain values in its bundle. Figure 1 shows a single entry, with the key masked.
A handful of sites, but each key is sensitive to exposure. An OpenAI secret key is a billing credential: anyone who reads the page can spend the owner’s balance, exhaust the rate limit, or run the bill up until someone notices and revokes it. Twelve keys in one bundle are twelve live credentials shipped at once, and five sites like this are five accounts an attacker can exploit.
An AI builder makes the hundredth site as cheap as the first, so an operator clones a working template across many domains, and whatever secret sat in the template now sits on every copy. We saw this in two shapes.
A Slack webhook shared across a 13-domain fleet. Thirteen near-identical domains, each a short word (ask, call, chat, get, hello, hey, hi, its, join, let, meet, my, see), glued to one brand, all served the same client bundle, and all embedded the same live Slack incoming-webhook URL. Figure 2 shows the URL in the shipped bundle, masked.
Anyone who can read the page can post messages to the operator’s Slack workspace via that webhook. That works for spam, for phishing aimed at the operator’s own staff, or for flooding a channel.
One Stripe secret key across four domains and two brands. A single Stripe secret key appeared on four domains under two separate brand names. The same sk_live_ value across all four points to one operator, or one shared Stripe account, behind every site. Figure 3 shows the assignment.
A Stripe secret key provides full API access to the account, including the ability to create charges, issue refunds, and read customer and payout records. That one key exposes the operator’s whole payment account on every domain in the fleet.
The 13-domain Slack fleet runs on Bubble, a no-code and AI app builder, as confirmed by Bubble’s x-bubble-perf response header and client markers. Bubble serves each app from a dynamic.js bundle, and any value a developer places in a client-accessible field ships inside that bundle in plain text. The Stripe cluster runs on a Next.js build instead, which shows that the pattern spans builders rather than tracing to a single platform.
Four AI-built sites exposed a Supabase service role JSON Web Token (JWT) on their front ends. A service-role token bypasses row-level security and grants full read and write to the project database. In terms of impact, it sits at the top of the set because it opens the entire backend rather than a single service.
Most of the remaining secret-looking strings on AI-built sites carry no/minimal exposure.
Filtering those out is why the confirmed count is 35, not several thousand. Table 1 breaks the 35 down by type. The values stay withheld, and a few sites appear under more than one row.
| Exposure | Sites | What an attacker gains |
| OpenAI API key | 5 | Spend the owner’s balance, exhaust quota, run up the bill |
| Shared Slack webhook | 13 | Post arbitrary messages into the operator’s workspace |
| Stripe secret key | 6 | Full API access: charges, refunds, customer and payout data |
| Supabase service-role JWT | 4 | Full read/write to the backend database, bypassing access rules |
| AWS access key | 5 | Cloud account access, scope set by the paired secret |
| GitHub token / Google OAuth secret | 2 | Source-control or identity-provider access |
Table 1 – Confirmed private-credential exposures across 22,306 AI-built sites, by type.
Every credential in Table 1 is a working key to a live account. An attacker reads a public web page, copies a value, and calls an API. Here is what that buys them, key by key.
One exposure counts many times over. When the key sits on a cloned fleet, it is live on every domain in that fleet, so an attacker who finds it on one site has compromised all of them.
AI app-builders made it almost free to publish a website, and just as free to clone one, and most of what they produce is worth nothing to steal.
The exceptions are what we went looking for. A small, steady set of these sites hand over the key that runs them, and when an operator copies one site across a fleet, the leak rides along to every domain.
Against the millions of domains registered each month, the number is tiny, but every hit is a live account an attacker can reach and exploit just by opening the page.
If you build on these tools, read your own shipped code before you publish it. If you defend an organization, assume your keys may surface on sites you never built and look for them.
Cyble’s Threat Intelligence Platforms continuously monitor emerging threats, infrastructure, and activity across the dark web, deep web, and open sources. This proactive intelligence empowers organizations with early detection, impersonation, infrastructure mapping, and attribution insights. Altogether, these capabilities provide a critical head start in mitigating and responding to evolving cyber threats.
For developers and AI-builder users:
For SOCs and defenders:
Source: Cyble Research · 2026-10-22
Spinning up a website no longer takes a developer. A prompt to an AI app-builder returns a working, styled, deployable site in minutes, and when one template works, the same operator clones it across a dozen domains before launch. That is also how secrets end up in plain sight.
Over a month, Cyble Research and Intelligence Labs (CRIL) scanned more than 1.3 million newly registered domains, identified the ones built by AI app-builders, and read their public front-end code for exposed credentials. We built our own classifiers to spot AI-generated websites as they are registered, paired with a scanner that pulls exposed keys and credentials straight from their public code. On 35 of the 22,306 AI-built sites we identified, a genuinely private secret was sitting in the browser: live OpenAI keys, Stripe secret keys, backend database tokens, and, in several cases, a single credential cloned across a whole fleet of domains.
Thirty-five is a small number, since counting every key-shaped string on an AI-built site is easy and misleading, as most are meant to be in the browser; a single reCAPTCHA key appeared on thousands of sites. We kept only the credentials that are never supposed to leave a server. Those are the findings below.
This report walks through the two leak patterns we observed, what appears exposed, what an attacker can do with these keys, and how to shut down the exposure.
An AI-built site generates its content with a Large Language Model (LLM), and the key to that model often ships in the page the visitor downloads. That is the plainest pattern we found, and the most on-the-nose.
Five AI-built sites carried live OpenAI API keys in their client-side code, sixteen distinct keys across them, and four of the five are confirmed AI-generated. One AI-writing site stands out on its own: it shipped twelve different OpenAI keys, one per content category, as plain values in its bundle. Figure 1 shows a single entry, with the key masked.
A handful of sites, but each key is sensitive to exposure. An OpenAI secret key is a billing credential: anyone who reads the page can spend the owner’s balance, exhaust the rate limit, or run the bill up until someone notices and revokes it. Twelve keys in one bundle are twelve live credentials shipped at once, and five sites like this are five accounts an attacker can exploit.
An AI builder makes the hundredth site as cheap as the first, so an operator clones a working template across many domains, and whatever secret sat in the template now sits on every copy. We saw this in two shapes.
A Slack webhook shared across a 13-domain fleet. Thirteen near-identical domains, each a short word (ask, call, chat, get, hello, hey, hi, its, join, let, meet, my, see), glued to one brand, all served the same client bundle, and all embedded the same live Slack incoming-webhook URL. Figure 2 shows the URL in the shipped bundle, masked.
Anyone who can read the page can post messages to the operator’s Slack workspace via that webhook. That works for spam, for phishing aimed at the operator’s own staff, or for flooding a channel.
One Stripe secret key across four domains and two brands. A single Stripe secret key appeared on four domains under two separate brand names. The same sk_live_ value across all four points to one operator, or one shared Stripe account, behind every site. Figure 3 shows the assignment.
A Stripe secret key provides full API access to the account, including the ability to create charges, issue refunds, and read customer and payout records. That one key exposes the operator’s whole payment account on every domain in the fleet.
The 13-domain Slack fleet runs on Bubble, a no-code and AI app builder, as confirmed by Bubble’s x-bubble-perf response header and client markers. Bubble serves each app from a dynamic.js bundle, and any value a developer places in a client-accessible field ships inside that bundle in plain text. The Stripe cluster runs on a Next.js build instead, which shows that the pattern spans builders rather than tracing to a single platform.
Four AI-built sites exposed a Supabase service role JSON Web Token (JWT) on their front ends. A service-role token bypasses row-level security and grants full read and write to the project database. In terms of impact, it sits at the top of the set because it opens the entire backend rather than a single service.
Most of the remaining secret-looking strings on AI-built sites carry no/minimal exposure.
Filtering those out is why the confirmed count is 35, not several thousand. Table 1 breaks the 35 down by type. The values stay withheld, and a few sites appear under more than one row.
| Exposure | Sites | What an attacker gains |
| OpenAI API key | 5 | Spend the owner’s balance, exhaust quota, run up the bill |
| Shared Slack webhook | 13 | Post arbitrary messages into the operator’s workspace |
| Stripe secret key | 6 | Full API access: charges, refunds, customer and payout data |
| Supabase service-role JWT | 4 | Full read/write to the backend database, bypassing access rules |
| AWS access key | 5 | Cloud account access, scope set by the paired secret |
| GitHub token / Google OAuth secret | 2 | Source-control or identity-provider access |
Table 1 – Confirmed private-credential exposures across 22,306 AI-built sites, by type.
Every credential in Table 1 is a working key to a live account. An attacker reads a public web page, copies a value, and calls an API. Here is what that buys them, key by key.
One exposure counts many times over. When the key sits on a cloned fleet, it is live on every domain in that fleet, so an attacker who finds it on one site has compromised all of them.
AI app-builders made it almost free to publish a website, and just as free to clone one, and most of what they produce is worth nothing to steal.
The exceptions are what we went looking for. A small, steady set of these sites hand over the key that runs them, and when an operator copies one site across a fleet, the leak rides along to every domain.
Against the millions of domains registered each month, the number is tiny, but every hit is a live account an attacker can reach and exploit just by opening the page.
If you build on these tools, read your own shipped code before you publish it. If you defend an organization, assume your keys may surface on sites you never built and look for them.
Cyble’s Threat Intelligence Platforms continuously monitor emerging threats, infrastructure, and activity across the dark web, deep web, and open sources. This proactive intelligence empowers organizations with early detection, impersonation, infrastructure mapping, and attribution insights. Altogether, these capabilities provide a critical head start in mitigating and responding to evolving cyber threats.
For developers and AI-builder users:
For SOCs and defenders:
Source: Cyble Research · 2026-10-22
Nearly all organizations now run production workloads in the cloud, but a new SANS survey found most have yet to achieve mature cloud security programs
Source: Infosecurity Magazine · 2026-10-22
When senior mining executive Stevi Thomas was convicted alongside an Indonesian governor for bribery in 2024, the ruling was seen as a rare case of accountability for corruption in the Southeast Asian nation.
The court case revealed how the politician had received some $60,000 in bribes for facilitating permits for Harita Group, a conglomerate that has sourced up to eight percent of the world’s nickel supply in recent years — and has also left a trail of environmental damage in its wake.
Now, leaked internal records obtained by OCCRP reveal a host of other payments that Harita executives earmarked for local politicians, individuals identified by the firm as community leaders, and the military between 2013 and 2023.
The planned or approved payments amounted to at least $389,000 and took the form of flights for politicians, “incentives” for the community leaders, and financial support for military projects.
Evidence of these outlays was found in leaked company emails, internal memos, and invoices.
Reporters were unable to independently verify if the money was ultimately disbursed in every instance, or establish the precise purpose of some of the approved payments.
But anti-corruption and mining experts said that some of the planned payments could violate Indonesian laws, including those regulating the giving of gifts to officials and a mining company’s use of corporate social responsibility funds.
Harita Group and the employees involved in approving the payments did not respond to requests to comment.
Though many of the individual outlays were not large in size, such as $80 earmarked for the head of the local port office, money of this magnitude can go far in Indonesia, where the average monthly salary is approximately $200.
The findings raise questions about whether the cash was used to reward individuals who acted in Harita’s commercial interests. In one case, Harita approved payments for a village chief who later, according to an internal company memo, monitored local residents who were protesting the miner’s operations.
The documents also provide a glimpse into the dealings between Harita executives and Indonesian officials, including how in one instance, the company drafted its own government permission decision and ultimately removed a legally-required clause.
“Harita or any private company has no legal authority to draft a government’s own policy or decision document, at any level of government,” Aryanto Nugroho, the national coordinator of the transparency organization Publish What You Pay Indonesia, told OCCRP.
“Drafting government decisions is a state function, not something delegated to the party the decision is meant to regulate.”
The Indonesian government did not respond to requests to comment.
In most cases, the payments were authorized by senior Harita executives such as Thomas, the company director who was imprisoned in 2024 for bribery, the leaked emails show. Thomas did not respond to requests to comment.
Harita is one of the largest nickel producers in Indonesia, and its mines feed the supply chains of some of the world’s biggest electric vehicle makers. But it has also come under scrutiny for its environmental record. In 2025, an investigation by OCCRP and partners found the company knew for a decade that its mining operations were regularly breaching legal limits on the release of a toxic chemical into surrounding waterways, and that the contamination had reached residents’ main source of drinking water.
Ferdian Yazid, a researcher at Transparency International Indonesia, said that the bribes that landed Harita executive Thomas and the governor in prison set “a bad precedent” in a country where anger over corruption erupted into nationwide protests late last year.
“Although Harita claims to adhere to anti-corruption and environmental principles, the reality is far from what it has stated.”
Yazid added that private companies such as Harita have disproportionate influence over regulatory frameworks at the expense of the public interest.
Given the severity of corruption in Indonesia’s nickel sector, he added, “corruption prevention must be strategic, targeting critical minerals.”
The small island of Obi, which forms part of the North Maluku province in eastern Indonesia, is covered in dense, mountainous forest. Harita opened a nickel mine there in 2010, and five years later, the company started building the first in a series of new smelters to process nickel ore into a material used in the production of stainless steel.
At the groundbreaking ceremony for Harita’s first smelter on Obi Island in June 2015, members of the Kasuba family, a powerful force in regional politics, watched on and gave the project their blessing.
But some residents of Kawasi — a village now encircled by Harita’s facility — were less cheerful about the expansion after already having seen the company’s mines strip away rainforest surrounding their homes.
Internal company emails show that Kawasi villagers met with company representatives and accused Harita of breaking the law by failing to hold a public consultation into the construction of the smelter. They also demanded that the company stop work and allow time for a new environmental impact assessment.
But Harita’s senior general manager dismissed their concerns, writing in an email to a colleague in July 2015 that he suspected “a third party is stirring up the public.”
It turns out Harita had already established financial ties with local residents they referred to as “influential” local officials and community members.
In 2013, an internal Harita spreadsheet titled “building relations” detailed planned payments totaling $2,300 for Kawasi’s elected leader, Arifin Saroa, and at least 11 other individuals. Around $400 of this total was earmarked specifically for Saroa, who could not be reached for comment.
Another July 2014 email chain marked as “confidential” details around $13,500 in “incentives” between March and July designated for dozens of individuals identified as community figures, including local imams and pastors listed as “partners” and “stakeholders.”
While the emails don’t state the exact reason for what were marked as monthly outlays, the correspondence shows Harita’s senior general manager evaluating payments based on the community figures’ level of influence.
In one message, he wrote that a certain reverend’s “role was quite significant” despite being from a different town, as he had managed to make a phone call that stopped a threat from protesters to halt production.
While it could not be confirmed if there was any connection to Harita’s planned payment, several years later Kawasi’s village head Saroa appeared to be providing the company with a valuable service. A 2020 internal security memo from Harita noted that he would be passing on any information about members of the community “suspected of being masterminds or participants” in a protest against the company.
This would allow the company to “give them special attention by rejecting them and their families” from employment opportunities, the document says.
According to the memo, Saroa had confirmed that “every [Harita] applicant from the village must go through the Kawasi Village Head for recommendation or otherwise be blacklisted,” and that a local widow was being monitored by the Kawasi village authorities.
Four Kawasi residents confirmed to OCCRP that those who wanted to work for Harita or sell supplies to the company had to go through Saroa for a recommendation.
They also alleged the company had offered financial incentives to those who complained about the damage caused by the mine, and who have also faced intimidation.
“Whenever people refuse to sell their land [to Harita], police personnel show up at odd hours to persuade and intimidate them,” said one resident, whose name OCCRP has chosen not to publish to protect him from potential reprisals. “Even the slightest protest here is immediately reported to the police or the military.”
Head of the village Saroa himself did sell land to the company among other substantial financial transactions with the Harita Group, the documents show.
He earned approximately $304,000 primarily between January 2020 and August 2022 in return for selling cropland close to Kawasi that he either owned or farmed, according to more than a dozen joint agreement letters seen in the leaked records by OCCRP. Harita planned to use the land to build a second smelter and other infrastructure, the documents say.
Separately, Harita had also contracted two companies it understood to be owned by Saroa to provide loading services at the island’s port, according to a contract and loading report.
In 2021, Harita’s stakeholder engagement plan identified the village leader as “critical” for the mine’s success — stating that he provided a high-level of support, and remained in regular contact with the company.
Harita did not respond to questions about where the funds for its various payments were drawn from.
However, in one case, reporters found that $1,400 earmarked for the military’s inauguration of a navy ship was categorized internally as CSR spending.
Under Indonesian law, mining companies are required to put CSR funds towards improving the quality of life of the community directly impacted by mining, as well as the broader society.
“Corporate social responsibility is supposed to be given to the community,” said Laode Muhammad Syarif, a former commissioner for Indonesia’s Corruption Eradication Commission.
“A volleyball court is built because there’s no place to play, or the mobile clinic is improved — that’s CSR. But if it’s given to the police and military, what’s the connection?”
The military did not respond to requests for comment.
In the summer of 2016, Harita’s senior director Lalu Mahfi had a problem. Harita was already a year into the building of its first smelter on Obi Island, but the company did not have a construction permit.
“Normally, a building should not be constructed without first obtaining an IMB [building permit], but through good relations with the local government, we have been able to continue the smelter construction,” Mahfi wrote in an email to colleagues that June. “In other places, such a project could be shut down or ordered to stop.”
In the same email Mahfi urged staff to make a hotel booking at a four-star hotel in Jakarta for Bahrain Kasuba, the nephew of Abdul Ghani Kasuba — the governor later jailed for accepting bribes from Harita in a separate instance — and several team members. At the time, Bahrain was serving as regent — a position equivalent to a district head — of South Halmahera, an area that includes Obi island.
Though there is no evidence Bahrain ultimately facilitated the construction permit for Harita, Mahfi explained in an email to colleagues that his “arrival in Jakarta is very important for the company in securing the building permit for the smelter.”
Mahfi did not respond to requests to comment and reporters sent questions for Bahrain through the regency government, which is currently headed by his cousin, but did not receive a response.
By that point Harita and Bahrain already had a working relationship. A year earlier, on the day he took office, the official signed a joint agreement with companies belonging to Harita Group to “smooth and accelerate” the company’s mining operations in “anticipation of social conflict” around the mining areas, the document says.
Although Bahrain canceled the June 2016 Jakarta plans, the company ultimately booked six flight tickets between North Maluku and Jakarta for the official and in one case his wife over the next five years, according to receipts, booking forms, and memos from Harita’s finance department. None of the documents provide a reason for why the company purchased these flights.
On November 15, 2016, Harita finally obtained the construction permit for the new smelter.
Yassar Aulia, researcher at Indonesia Corruption Watch, said the hotel booking and flight purchases raise questions over the propriety of Harita’s relationship with a public official, and whether there was any “kickback intent.”
The country’s Corruption Eradication Commission did not respond to queries about whether Bahrain reported the flight purchases.
Under Indonesian law, public officials have 30 working days to report any gift to the Commission, and must prove the gift was not a bribe in cases where the value is over $440. For lower value gifts, evidence of a bribe would need to be proven by a prosecutor, the law states. (The costs of the flights for Bahrain and his wife that are mentioned in the documents were typically around $140.)
In August 2017, Mahfi also sent the senior general manager a draft contract to hire Muhammad Kasuba — Abdul Ghani Kasuba’s brother and a former regent of South Halmahera — as an external relations consultant to, among other tasks, “foster relations with the Regional Government and community” for a minimum of $3,700 per month, a figure 20 times the average salary.
It is not known if Muhammad Kasuba ever signed the draft contract, but the former official has continued to publicly champion Harita as recently as last year. He did not respond to requests to comment.
Company emails indicate that Harita was given an unusual level of free rein by authorities.
In May 2016, Mahfi emailed Harita’s then-president director a draft government “decision” permitting the company to store hazardous waste.
Although the official government document was to be signed by Bahrain — the regional official who would later have flights booked by Harita — it was apparently put together by Mahfi himself.
“I compiled this draft from various sources,” Mahfi wrote in an email to colleagues.
The emails show Mahfi went on to further edit the decision, removing a clause which stated that the permit had been issued after a legally-required field verification.
Nugroho, the national coordinator of Publish What You Pay Indonesia, described this intervention as “a private party stepping into a function that belongs exclusively to the state.”
“That is precisely the mechanism governance experts describe as state capture.”
He also added that if the regency government issued the permit as written by Mahfi without the field verification clause, the permit could be revoked and the officials who signed off on it could be liable to either civil or criminal action.
In 2018, international consultancy firm Hatch delivered a technical review commissioned by Harita into the company’s smelter operations.
According to the review, which OCCRP found a copy of in the leaked Harita emails, the company used hazardous waste materials during the construction of the smelter without government permission.
Harita had also not completed a number of crucial environmental and social impact assessments, the report said.
However, Harita spent money painting a different picture to the public.
Between August 2022 and January 2023, Stevi Thomas signed off on spending a total of about $6,000 to place news stories about Harita in more than 40 Indonesian media outlets, internal memos show.
The stories described Harita’s contribution to the economy, the job market, and how the nickel industry was on track to meet net zero targets, among other topics.
On the ground, meanwhile, Kawasi villagers blame Harita’s operations for the degradation of their farmland through landfilling, flooding, and groundwater contamination. Most were eventually relocated to an “eco-village” built by the company.
Today, only a handful remain in the original Kawasi village, where homes and streets are subject to frequent blackouts, as well as severe flooding with contaminated water from the mine’s overflowing sediment pond.
Source: OCCRP · 2026-10-22
Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no BlackLotus samples were found in the wild, no one could at the time verify the claims made in the forum post.
BlackLotus advertisement
However, about half a year later, in March 2023, ESET confirmed that the BlackLotus advertisement was genuine. The researchers tracked down samples of this bootkit and confirmed that it can indeed bypass Secure Boot through a vulnerability called Baton Drop (CVE-2022-21894). As this vulnerability was still exploitable in 2023, Microsoft had to release multiple security updates to address it.
Since the release of these updates, the BlackLotus bootkit has gone quiet — no publicly known attacks have used it. Yet in early 2026, we discovered a malware sample similar to BlackLotus that was used in an APT campaign in Central Asia. In this report, we share our findings, including new payloads and possible attribution of this campaign.
In early 2026 we identified a complex APT attack targeting diplomatic agencies in Central Asian countries — namely Tajikistan, Uzbekistan, and Turkmenistan. This attack involved a UEFI bootkit that we dubbed BlackX. Having examined it, we found it to be similar to BlackLotus.
Attackers have been deploying BlackX after compromising the victim machine networks and obtaining administrator privileges. To install the bootkit, we observed them dropping the following files:
inst.exe, an installer executablePVMDIJGKAX2, an RC4-encrypted extensionless file containing files and strings required for the installationThe installer was launched with the command line C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1. The last argument here is the RC4 key used for decryption.
Curiously, the file inst.exe does not contain any malicious strings or embedded blobs. All the files needed to install the malicious payload are inside PVMDIJGKAX2, which makes it harder for incident responders to retrieve the bootkit components.
The installer package drops a set of files to both system and UEFI partitions, designed to exploit the Baton Drop vulnerability. We noted that the implementation of the exploit is remarkably similar to the one used in the BlackLotus malware. As with BlackLotus, the goal of the exploit is to install custom Machine Owner Keys (MOK), which allows loading arbitrary EFI files on the target machines to manipulate Secure Boot.
While the vulnerability exploitation chain was implemented very similarly to BlackLotus, we spotted differences between the exploits in BlackLotus and BlackX. That said, the source code of the BlackLotus bootkit has never been published online. This could mean that the attackers behind BlackX either reverse-engineered the BlackLotus bootkit or purchased its source code from cybercriminals. Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors.
The UEFI payload delivered during the Baton Drop exploitation has a classic bootkit goal — to inject a malicious driver into the Windows kernel. This driver differs from the one deployed by BlackLotus and is signed with a certificate belonging to an organization named 温江区明宇网络技术服务工作室 (English: Wenjiang District Mingyu Network Technology Service Studio). At the time of writing, this certificate (serial number: 0bcdf5e0da32d68900b8b7638459d072) has been revoked by its issuer.
The driver aims to tamper with security solutions installed on the machine. For example, it disables process, thread, and registry callbacks related to security solutions. It also tampers with ETW providers so that security solutions cannot access their output. Curiously, some of the tampering procedures are designed to run only if Kaspersky or Avast solutions are installed on the infected machine. However, during dynamic analysis of this driver, we found that these procedures are useless — they fail to interfere with Kaspersky products in any way.
The driver also protects the bootkit’s files from tampering. It intercepts kernel requests to open these files and returns a handle to calc.exe instead of a malicious file handle.
Apart from tampering with security solutions, the driver also deploys a user-mode payload. We observed two such payloads, used for cyberespionage, in the wild. One of them is a RAT that can load further-stage .NET payloads. This RAT uses cloud storage for C2 server communications — we observed its versions using Google Drive, OneDrive, and Yandex.Disk. Having connected to a cloud storage service, this RAT iterates over files available there and interprets them depending on the file suffix. Below is a list of supported suffixes:
| File suffix | Description | Type |
| 0X01 | A .NET file. The task is to parse it and run the method TEST.Class1.RunCMD(argument_array) from the module | Input |
| 0X02 | Result of the call TEST.Class1.RunCMD(argument_array) | Output |
| 0X03 | Task to upload a file to the drive | Input |
| 0X04 | Uploaded file | Output |
| 0X05 | Task to download a file to an infected machine | Input |
| 0X06 | File download status | Output |
| SSSR | Contains initial system info | Output |
We also observed another payload delivered through the bootkit, which we dubbed OxiDLLRunner. It is a malicious DLL obfuscated with OLLVM. It is loaded by the legitimate file googleupdate.exe (original filename: jcef_helper.exe, MD5: AF8A983B9ADA07EAE1259BF2953ABD40), which is also delivered by the bootkit. The DLL decrypts the contents of the file v8_context_snapshot.bin, which resides in the same folder, and then jumps to the beginning of the decrypted content. The decrypted data starts with shellcode followed by a PE file, which is a Rust payload designed to communicate with the www[.]archivetj[.]com C2 server. During communication, this payload is supposed to receive DLL files exporting a function named create_plugin, which are then executed in separate threads.
Based on the following facts, we have attributed this attack to the APT41 threat actor with medium confidence:
During our initial analysis of BlackX, we thought that attackers succeeded in deploying it due to the negligence of the target organizations. Baton Drop, the vulnerability used to deploy BlackX, was disclosed back in 2023 and was patched, so we first thought that the infected machines lacked the relevant updates. However, our investigation proved this wrong — the targeted machines were fully patched.
Instead, we found out that the problem was with the patch itself. As it turned out, the patch for the Baton Drop vulnerability is designed to revoke the “Windows Production PCA 2011” certificate used to sign vulnerable UEFI components. However, this revocation does not happen automatically upon patch installation — the user has to trigger it manually. This is done with the following steps:
This patch is designed to be applied manually — for instance, applying it automatically could break dual-boot systems relying on the “Windows Production PCA 2011” certificate to load. At the same time, this patch deployment practice creates a problem — as it is extremely unusual for a system administrator to take extra steps after installing an update. Usually, when applying patches, system administrators take no further action unless an installation failure occurs. These instructions for activating the patch are buried deep on the Microsoft website, and we assess that they are quite hard for an average IT administrator to notice.
Curiously, Microsoft’s plan for deploying the Baton Drop patches mentions an “Enforcement Phase” that involves revoking the “Windows Production PCA 2011” certificate automatically, without user interaction. At the time of publishing this post, this stage has not been implemented. On October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted.
It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch. As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit.
Patch management is important for every organization, as updates from vendors help protect software and hardware against known vulnerabilities. However, sometimes installed patches fail to protect against the flaws they address. The BlackLotus story we described is not the only such example — for instance, in 2025 Microsoft released an update against the ToolShell vulnerability that also had to be applied manually.
However, modern security solutions are designed to account for such cases when installed patches fail to protect against security flaws for one reason or another. For instance, the Exploit Prevention component available in Kaspersky products prevents exploits from running if the patch is not applied, or if it is a zero-day vulnerability with no available patch. It is thus crucial to equip all machines in an organization with security solutions and constantly monitor the alerts they raise.
Source: Securelist (Kaspersky GReAT) · 2026-10-22
The United Arab Emirates says it’s creating a foundation of security and safety as it transforms its public service footprint.
Source: Dark Reading · 2026-10-22
Collapsed international surrogacy agency World Center of Baby has been dealt a double blow in Florida, with a judge ruling against its U.S. corporate entity in a civil lawsuit – shortly after another case against the company was filed.
The developments come just over a month after OCCRP published a global investigation into the chaos World Center of Baby left in its wake after announcing it was filing for bankruptcy, including surrogates left unpaid and unsupported, and prospective parents abandoned.
In a decision made publicly available on Tuesday, Judge Thomas Ramsberger in Florida’s Sixth Circuit Court ruled in favor of a U.K.-based couple who brought a case against the agency’s U.S. corporate entity World Center Group Corp and two of its representatives. The complaint was on five counts, including breach of contract and fraud.
The lawsuit accused the company of “a calculated and coordinated scheme” to secure substantial payments for promised services despite its worsening financial and operational problems.
The judge noted that the decision was a default judgement as none of the three defendants — World Center Group Corp, its former listed president Yuri Star, and listed director Malvina Jonas — responded to summons sent to the addresses listed on the company’s corporate documents. The ruling followed an October 5 hearing that the defendants failed to attend.
World Center Group Corp, Star, and Jonas were ordered to recover funds for the couple amounting to $87,415 which they had paid for a World Center of Baby program that was meant to provide surrogate matching, medical coordination, and program management through the birth of two children. In the end, they received none of it.
The couple, who spoke with reporters, but asked not to be named, said: “Although we have a judgement, we are not yet clear on what our chances of recovery are.”
The case was tried in Pinellas County on Florida’s west coast, because that is where the most recent incorporation documents list an address for World Center Group Corp.
Just before the judgement, a second civil lawsuit was filed in Pinellas County against Yuri Star and World Center Group Corp. by another intended parent who alleges they paid the agency more than $40,000 for medical procedures that were due to take place in Mexico, but did not happen and were not refunded. The plaintiff had been urged to pay the money up front in exchange for a discount, the complaint alleges.
That lawsuit lays out four counts against World Center Group Corp, including fraud and breach of contract, citing OCCRP’s investigation as part of the submitted evidence.
The complaint also alleges that the plaintiff was unaware that the agency did not actually employ medical staff in Mexico and instead used third-party clinics. Former World Center of Baby employees later told the plaintiff that the agency had stopped paying its partner clinics and employees around the time that the plaintiff traveled to Mexico for a clinic visit.
OCCRP’s investigation into World Center of Baby found that the agency’s operations and ownership were difficult to pin down, including basic information such as who owns it, its corporate structure, and what led to its demise.
Star, the former listed president, told reporters during the investigation that he had been hired as a consultant to register the company and knew nothing about it or why it collapsed. He said he was not a shareholder, investor, or beneficiary, and was still owed money for his services.
Star did not respond to a request for comment on the judgement against him.
Reporters were unable to reach Jonas, the listed director. Five employees who spoke with reporters said they had never met or spoken with her and one of the employees claimed her signature was automated.
Ukrainian businessman Vladyslav Natochii, who is variously listed on previous versions of the agency’s website as its founder, owner, and managing director, but is not on the paperwork of the Florida-registered entity told reporters that World Center of Baby had “experienced a severe financial and operational crisis,” and denied wrongdoing.
Source: OCCRP · 2026-10-22
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the internet.
Source: WIRED Security · 2026-10-22
PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE
Source: Exploit-DB · 2026-10-22