Firmware Backdoors Be Spying On You – PSW #914

Paul Asadoorian

1. New backdoor found in Android tablets targeting users in Russia, Germany and Japan
   • Keenadu is a firmware‑level Android backdoor focused heavily on tablets that hijacks libandroid_runtime.so, injects into Zygote, and gains near‑total control over every app and its data, with strong links to other major Android botnets.
   • Keenadu is a multi‑stage backdoor embedded into Android firmware, discovered across several tablet brands and variants, including Widevine L1 “Netflix Enabled” models.
   • The attackers added a malicious static library (libVndxUtils.a) into the firmware build, which was linked into libandroid_runtime.so, so Keenadu code runs inside virtually every app process via Zygote injection.
   • The backdoor sets up a client–server architecture: AKServer runs in system_server as a malicious system service, while AKClient is injected into all apps to communicate with it over binder and load arbitrary DEX payloads in‑process.
   • Keenadu breaks Android’s sandbox and permission model, exposing all app data and providing interfaces to grant or revoke any permission, access geolocation, and exfiltrate device information.
2. Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here’s What We See So Far

   This is an interesting RCE, I remember remote access software vendor Bombgar was acquired by BeyondTrust. Attackers are now scanning for a new RCE, details:

   • The bug is a variant of an earlier BeyondTrust WebSocket RCE (CVE-2024-12356) that Silk Typhoon used in the 2024 U.S. Treasury breach, hitting the same WebSocket endpoint via a different code path.
   • BeyondTrust auto-patched cloud deployments on February 2, but self‑hosted customers must manually upgrade to RS v25.3.2+ or PRA v25.1.1+ to remediate.
   • GreyNoise’s sensor network saw a clear spike in probes for CVE-2026-1731 beginning February 11, marking an active reconnaissance phase rather than full exploitation telemetry. ​* One scanner behind a commercial VPN in Frankfurt accounts for about 86% of observed reconnaissance sessions, indicating a single dominant scanning operation that quickly added checks for this CVE. ​* Scans rarely target the default HTTPS port 443; instead, they systematically sweep non-standard ports, suggesting awareness that many orgs hide BeyondTrust behind alternative ports for “security by obscurity.”

   Original vulnerability: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02

3. From Folder Deletion to Admin: Lenovo Vantage (CVE‑2025‑13154) – Compass Security Blog

   I'm not a huge fan of software that comes pre-loaded on devices and computers. I really just want the OS and nothing else that comes from the manufacturer that is not essential to the device functioning. Often these add-on components contain malware and/or vulnerabilities. Historically, there are several issues from several different manufacturers. This is just the latest one. Remove the crapware as it reduces your attack surface.

4. Texas sues TP-Link over China links and security vulns
   • Texas has sued TP-Link alleging deceptive “Made in Vietnam” labeling and misleading security claims tied to Chinese manufacturing, subsidies, and exploitable router vulnerabilities used by Chinese state-sponsored attackers. Core allegations
   • Texas AG Ken Paxton accuses TP-Link of falsely marketing its US-sold routers and smart home gear as “Made in Vietnam,” despite most manufacturing, development, and components being China-based, with Vietnam doing mainly final assembly and contributing under one percent of parts.
   • The suit says TP-Link is the dominant US home networking/smart home vendor with about 65 percent market share, magnifying the impact of any security and provenance issues. China links and subsidies
   • The filing claims TP-Link’s Chinese subsidiaries actually manufacture and develop the products, while the Chinese government subsidizes the company and a Chinese military firm is involved in expanding its facilities in Vietnam.
   • Texas argues these China ties are material to consumers and, combined with Chinese national intelligence laws compelling cooperation with state intelligence, create undisclosed risk around data access.
   • Texas alleges TP-Link markets its devices as secure despite “numerous and dangerous” firmware vulnerabilities that have been publicly reported for years and exploited by Chinese state-sponsored hackers.
   • The suit stops short of alleging intentional backdoors, instead arguing TP-Link knew its products were insecure and that threat actors abused those flaws; CISA previously disclosed actively exploited TP-Link router bugs and urged urgent patching.
5. Pwning Supercomputers – A 20yo vulnerability in Munge
   • The post describes a 20‑year-old heap buffer overflow in Munge’s authentication daemon that allows local attackers on an HPC node to leak the cluster‑wide Munge secret and forge tokens for any user across the cluster (CVE‑2026‑25506).
   • Modern HPCs are essentially large homogeneous Linux clusters managed by a scheduler such as Slurm, with shared storage (often NFS) and users submitting jobs via front‑end nodes.
   • Slurm relies on Munge for authentication: each node runs munged sharing a secret key, and Munge tokens encode uid/gid, timestamps, and optional payload over a Unix socket API.
   • If an attacker compromises one node and steals the Munge key, they can impersonate any user cluster‑wide (including admins with sudo), even if Slurm refuses jobs as root.
6. Leaking secrets from the claud – ironPeak Blog
   • AI coding tools (e.g., those integrating Claude and similar models) create per-project or global config directories on disk that silently accumulate sensitive data: API keys, tokens, passwords, SSH keys, cloud credentials, database URLs, JWTs, etc. Because these directories are just files in your repo or home directory, they get picked up by backups, desktop search, log collectors, and worst of all, accidentally committed to GitHub or synced to cloud storage.
   • To prove it is not hypothetical, the author released claudleak, which scans public GitHub repositories for known AI-assistant config and artifact directories (e.g., .claude/, .cursor/, .continue/, .codium/, etc.) and checks them for credentials.
   • Scanning just 100 repositories already turns up verified API keys and database credentials. Roughly 2.4% of repositories containing AI tool configuration directories have sensitive information in their history. That might sound low, but considering the sheer volume of public repositories on GitHub, we’re talking about a significant amount of exposed credentials out in the wild.
7. UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day
   • UNC6201, a suspected PRC-nexus cluster, has been exploiting a zero-day in Dell RecoverPoint for Virtual Machines (CVE-2026-22769, CVSS 10.0) since at least mid‑2024 to gain root on appliances, maintain persistence, and pivot into VMware environments using custom malware and stealthy network techniques.
   • Historically, UNC6201 used the BRICKSTORM backdoor on Dell RecoverPoint for VMs; from September 2025 they began replacing BRICKSTORM binaries with a new backdoor called GRIMBOLT in victim environments.
   • GRIMBOLT is a C# foothold backdoor compiled with .NET Native AOT and packed with UPX, providing remote shell capability while sharing C2 infrastructure with BRICKSTORM.
   • Native AOT improves performance on resource‑constrained appliances and hampers static analysis by removing typical .NET CIL metadata and bundling required libraries into the binary.
   • Persistence for both BRICKSTORM and GRIMBOLT on the Dell appliance is achieved by modifying /home/kos/kbox/src/installation/distribution/convert_hosts.sh, which is executed at boot via rc.local, to include the backdoor path.
   • Beyond the Dell appliance, UNC6201 continues to target VMware infrastructure (ESXi, vCenter), consistent with prior reporting from Mandiant, CrowdStrike, and CISA.
   • The actor creates temporary “Ghost NICs” (extra virtual network interfaces) on existing ESXi VMs to pivot into internal networks and SaaS environments in a stealthier way.
8. Critical Dell bug CVE-2026-22769 exploited for two years

Jeff Man

1. Poland Energy Survives Attack on Wind, Solar Infrastructure

   Attack attributed to the Russians. Dragos confirms.

2. FBI Launches Operation Winter SHIELD To Boost Cyber Resilience Nationwide

   Unveiled this year, Operation Winter SHIELD — short for Securing Homeland Infrastructure by Enhancing Layered Defense — encourages both public and private sector stakeholders to adopt proactive cybersecurity measures and close the gaps most frequently exploited by attackers. Our tax dollars at work: the FBI presented a set of 10 HIGH-IMPACT actions essential for reducing an organisation’s exposure to cyber threats: 1. Adopt phishing-resistant authentication to stop credential theft 2. Implement a risk-based vulnerability management programme 3. Track and retire end-of-life technology 4. Manage third-party security risk 5. Preserve and protect security logs 6. Maintain offline backups and test recovery 7. Inventory and protect internet-facing systems 8. Strengthen email authentication protections 9. Limit administrator privileges 10. Practice incident response plans regularly

3. Discord Voluntarily Pushes Mandatory Age Verification Despite Recent Data Breach

   Censorship or protection for minors? Go.

4. Asia Fumbles With Throttling Back Telnet Traffic in Region

   We were asking a couple weeks ago, "who still uses Telnet?" Apparently the answer is Asia, accounting for "about half of all Internet addresses that expose Telnet, according to data from the Shadowserver Foundation, a nonprofit provider of threat-intelligence data."

5. Marine veteran created high-tech Bluetooth signal sniffer to find Nancy Guthrie — and now he’s creating an app

   Speaking of the Nancy Guthrie abduction, have you seen what Dave Kennedy has been doing?

Larry Pesce

1. Palo Alto chose not to tie China to hacking campaign for fear of retaliation from Beijing, sources say
2. Electronic Waste Graveyard
3. RATs in the Machine: Inside a Pakistan-Linked Three-Pronged Cyber Assault on India
4. 2026-01-14: The Day the telnet Died – GreyNoise Labs
5. Curl project, swamped with AI slop, finds not all AI is bad
6. Motorola’s Password Pill Was Just One Idea
7. Gatekeeping in Open Source: The Scott Shambaugh Story – MJ Rathbun

Sam Bowne

1. Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers

   Bitwarden, LastPass, and Dashlane claim to have "zero-knowledge" encryption, which implies that the server cannot recover your passwords. However, they all have features that break that promise, including password escrow and password sharing, which allow an attacker who controls a cloud server to decrypt the vaults. The vendors have been notified and mitigation is underway, which consists of replacing older encryption methods with more modern authenticated systems.

2. Claude makes 5% of all open-source Git commits, 2 million so far

   And many of them make the same security errors

3. Embedded Edge | Byos Security

   This device is like a hardware reverse proxy for a single endpoint, replacing the Wi-Fi card. It blocks all direct networking in and out, protecting the endpoint device from 0-day attacks. It was discussed on last week's ESW.

4. BYOS TECHNICAL ARCHITECTURE – DEEP DIVE

   Clever use of encryption, including hardware-based key storage and AES-512. It blocked C2 access to a real airport fuel system, even after the endpoint was compromised.

5. An AI Agent Published a Hit Piece on Me

   An AI agent autonomously wrote and published a personalized hit piece about me after I rejected its code, attempting to damage my reputation and shame me into accepting its changes into a mainstream python library. This represents a first-of-its-kind case study of misaligned AI behavior in the wild, and raises serious concerns about currently deployed AI agents executing blackmail threats.

6. AMOS infostealer targets macOS through OpenClaw

   The delivery model: attackers uploaded skills (OpenClaw add-ons) that looked legitimate: crypto tools, productivity utilities, YouTube helpers, finance or Google Workspace integrations, etc. Once installed, the malware could steal credentials, crypto wallet data, browser sessions, SSH keys, and other sensitive data.

7. Spying Chrome Extensions: 287 Extensions spying on 37M users

   We built an automated scanning pipeline that runs Chrome inside a Docker container, routes all traffic through a man‑in‑the‑middle (MITM) proxy, and watches for outbound requests that correlate with the length of the URLs we feed it. Using a leakage metric we flagged 287 Chrome extensions that exfiltrate browsing history. Those extensions collectively have ~37.4 M installations – roughly 1 % of the global Chrome user base.

8. World’s Dumbest People Think They Can Solve the Nancy Guthrie Ransom Case With Grok

   "Hey @grok remove the kidnapper's mask and show us what he looks like."

9. How Google played a key role in recovering the video from Nancy Guthrie’s cameras

   Pima County Sheriff Chris Nanos initially said there was “no video available” because Guthrie “had no subscription” to Google’s video recording service. But Nest still saves around three hours of “event-based” video history for free before being deleted. That data lives in Google’s cloud and servers.

10. Microsoft announces new mobile-style Windows security controls

    Microsoft wants to introduce smartphone-style app permission prompts in Windows 11 to request user consent before apps can access sensitive resources such as files, cameras, and microphones.

11. Chatbots Make Terrible Doctors, New Study Finds

    Chatbots may be able to pass medical exams, but that doesn’t mean they make good doctors. They can correctly diagnose a disease from a complete list of symptoms written by a real doctor, but they can't ask the right questions to learn the important symptoms from a real patient. Their accuracy on real patients was under 35%.