The IT Nerd

The SOCRadar Threat Research Unit has unveiled a delivery technique that they haven’t seen documented before: threat actors are hiding staging commands inside FTP server banners, the greeting text a server sends when you connect to port 21.

Key details

• Threat actors are hiding malware staging commands inside FTP server banners – the greeting text a server returns on port 21. A shortcut file connects, reads the banner, executes what’s in it. Nothing malicious in the file itself.
• This is a dead drop resolver on a protocol nobody inspects for content. The technique has not been documented before.
• Live since early July 2026 and still operational.

Full research can be read here: https://socradar.io/blog/ftp-banners-new-dead-drop-resolver-rats/ 

Today, the SOCRadar research team published a new research report on the LiteLLM supply chain attack that exposed 2,500 companies. It includes full attack chain, TeamPCP profile, IOC table, five detection checks, rotation guidance andFAQ.  

What’s different from general coverage:

• They worked from the ranked company list. SOCRadar analyzed the 2,188 organization records at row level and the timeline changes.
• The 40-minute PyPI window was the end of a 5-day collection run, not the start. 95% of affected organizations were already exposed before March 24, and the earliest record lands 18 minutes after the poisoned Trivy build published on March 19.
  

SOCRadar Findings/Differentiators:

• Six CI/CD platforms, GitHub Actions and GitLab CI near-equal, self-hosted GitLab included
• Footprint skews European and Latin American, Germany then Brazil then France, 137 TLDs, eight .gov
• Credentials reach npm and Docker publishing tokens, Stripe, Twilio, SendGrid, not just AI keys
• Our Dark Web monitoring caught the loot brokered on Telegram at 150+ GB, tied to Vect ransomware

SOCRadar’s report is here: LiteLLM Supply Chain Attack: Inside the AI Breach That Exposed 2,500+ Companies 

SOCRadar, a global leader in extended threat intelligence and cybersecurity, today announced it has been ranked No. 542 on the 2026 Inc. 5000 list, the annual list of the fastest-growing private companies in America. The list is the most prestigious ranking of the nation’s most successful independent and entrepreneurial businesses, recognizing companies that have achieved remarkable growth while driving innovation, creating jobs, and shaping the future of the economy. Past honorees include companies such as Microsoft, Meta, Chobani, Oracle, and Patagonia. 

This year’s Inc. 5000 recognizes a new class of companies redefining what growth looks like. From AI and advanced manufacturing to healthcare, consumer products, and professional services, these businesses are expanding their impact, creating jobs and proving that entrepreneurial ambition continues to fuel the U.S. economy. Among the 5,000 companies on the list, the median three-year revenue growth rate was 130%, and those companies have collectively added more than 627,208 jobs to the U.S. economy over the past three years. 

For the full Inc. 5000 list, honoree company profiles, and a searchable database by industry and location, please visit: www.inc.com/inc5000. 

Inc. will celebrate the honorees at the 2026 Inc. 5000 Conference & Gala, taking place October 14–16 in Dallas, Texas and the top 500 will be listed in the Fall issue of Inc. Magazine. Tickets are on sale now.

Inc. 5000 List Methodology 

Companies on the 2026 Inc. 5000 are ranked according to percentage revenue growth from 2022 to 2025. To qualify, companies must have been founded and generating revenue by March 31, 2022. They must be U.S.-based, privately held, for-profit, and independent—not subsidiaries or divisions of other companies—as of December 31, 2025. (Since then, some on the list may have gone public or been acquired.) The minimum revenue required for 2022 is $100,000; the minimum for 2025 is $2 million. As always, Inc. reserves the right to decline applicants for subjective reasons. 

Following a post by skocherhan on X, the SOCRadar Threat Research Unit (STRU) analyzed Kynx, a Malware-as-a-Service (MaaS) stealer featuring a web panel deeply integrated with the malware’s execution flow. 

Kynx is sold on a tiered subscription model (Free, Plus, Pro, Ultra) through a Turkish gaming forum, and reaches well beyond typical credential theft into crypto wallets, gaming accounts, and AI developer tools like Claude Code, Cursor, GitHub Copilot, and ChatGPT.

What STRU Discovered:

• AI-assisted development: The developer openly credits Gemini for helping build the malware, including its App-Bound Encryption (ABE) bypass and anti-VM detection.
• A wide, deliberate target list: 65 cryptocurrency wallet extensions, 16 gaming platforms (Steam, Roblox, Minecraft, Battle.net), 8 AI/developer tools, 9 VPN providers, Discord tokens, and browser-saved credentials and card data.
• A convincing lure: Kynx masks itself behind a fake system update banner, likely distributed via cracked software or ClickFix-style pages, while it runs anti-sandbox checks before exfiltrating data.
• Live infrastructure: We traced its C2 to kynxdev[.]xyz, where it uses single-use tokens with a 5-minute validity window and permanent IP bans for invalid requests.

Why it matters: Kynx is a clean example of AI showing up on both sides of the malware economy at once — lowering the bar to build sophisticated stealers, and creating a new class of high-value target in the AI tools developers now trust with code and credentials. IOCs include the C2 domain, SHA256 hashes for the binary, and the staging directory pattern (WinSysHealth-{6 digits}) it drops in %TEMP%.

The full report can be found here. 

The SOCRadar Threat Research Unit (STRU) has identified and analyzed a multi-stage phishing campaign that exploits the high-intensity demand for Formula 1 Grand Prix tickets.

The attackers use highly convincing replicas of official ticketing platforms to deceive victims, tricking them into providing payment information and two-factor authentication (2FA) tokens. The operation allows attackers to engage in real-time, operator-controlled social engineering, adapting their tactics to bypass multi-factor authentication (MFA) measures.

What sets this attack apart is the backend: Human operators watch each victim’s session live and push a bank specific verification screen tailored to the card just entered, adapting on the fly to get past MFA.

What SOCRadar Uncovered:

• Full source code recovery: A hosting misconfiguration on one domain, f1-tickets-sg[.]com, let us pull the kit’s complete backend code rather than just the rendered pages – including the Python cloning script, which has Russian-language comments.
• A 134-page storefront: The mirror reproduces the legitimate site’s entire information architecture (news, event info, FAQs, even the real 15-page Terms & Conditions PDF) far beyond what a stripped-down lure would need.
• Bank specific fraud, chosen live: The kit reads the victim’s card BIN, identifies the issuing bank, and serves one of eight pre-branded challenge pages (Emirates NBD, RAKBank, HSBC, and five other mostly UAE institutions) while an operator on a live polling connection decides in real time whether to show an OTP prompt, a balance check, a push approval screen, or a generic fallback.
• A wider domain network: At least 11 lookalike domains impersonate the Singapore and Spanish Grand Prix under a predictable naming pattern, sharing one backend; several are already flagged as malicious.
  

Why it matters: It is a manned fraud operation. A person is actively steering each victim toward the exact verification screen their bank would show, which is exactly what static phishing detection misses. It’s also a preview of how ticket phishing for major sporting events keeps evolving around those brief, high urgency sales windows.
IOCs include the domain cluster, the live C2 host at 144.31.3[.]209, and behavioral fingerprints such as the session cookie and the URL flags used to switch challenge screens.

To view the full research, please see SOCRadar Formula 1 Phishing Campaign

At Black Hat 2026 today, SOCRadar, a global leader in extended threat intelligence and cybersecurity, announced the launch of SOCRadar Human Identity Exposure, a new Identity & Access layer for its Extended Threat Intelligence (XTI) platform.

SOCRadar Human Identity Exposure unifies fragmented identity exposure data, including breach repositories, stealer infections, attacker telemetry, PII, data leaks, and CTI signals into a single, decision-ready record. By providing investigative analysts with a unified operational surface, it accelerates identity risk prioritization and eliminates hours of manual data correlation. Because these records are built entirely from external, attacker-held data ingested directly by the platform, there is zero integration required from HR or IAM systems. 

By tapping into the full depth and breadth of the XTI platform, SOCRadar Human Identity Exposure gives analysts an instant, comprehensive snapshot of an individual’s identity risk. Complete with automated risk scoring, critical exposure insights, and actionable pivot points, this new identity and access layer operationalizes disparate data points for swift investigation and decision-making.

Identity is now the primary path into an enterprise network, not a secondary one. Verizon’s 2025 Data Breach Investigations Report found compromised credentials were the initial vector in 22% of confirmed breaches — the leading vector for the second straight year — and The SANS Institute reported that 90% of organizations experienced at least one identity-related incident in the past year. IBM prices the average compromised-credential breach at $4.67M, with a 246-day mean time to identify and contain.

Human Identity Exposure Card

SOCRadar Human Identity Exposure includes a Human Identity Exposure Card that offers a consolidated investigative profile of an individual’s identity, inferred directly from collected breach incident data, exposed PII records, and infostealer logs, including:

• Unified Risk Scoring: An in-platform scoring grade metric that quantifies identity risk analysis from across multiple datasets and criteria such as credential breaches and exposures, high sensitivity PII, critical data categories, PII leak records, and whether an individual’s identity shows up across various sources (e.g. leaks, breaches, infostealers).
• Unified Personal Data Records: This widget allows analysts to see an individual’s level of public exposure by aggregating a variety of unique personal data types from across multiple PII exposure records and making them available in one central location.
• Breach Timeline: Analysts can easily track every exposure signal, stealer hit, and external attacker telemetry record tied to an identity in a single timeline view. 
• People Graph: This interactive visual widget provides analysts with the ‘exposure surface’ tied to an individual’s email via a graph that displays the most critical points of exposure along various attack paths.
• Modeled Attack Scenarios: The platform automatically models potential attack scenarios (e.g. credential stuffing, stealer account takeover, sim swap, business email compromise, etc.) based on exposed data and attack telemetry with the specific attack path, confidence scoring for likelihood of attack, and defensive blocks for attack prevention.
• Identity Location Map: Analysts can see the estimated geo-location on a map derived from breach metadata.
• Linked Accounts: The platform surfaces all social media accounts tied to an individual’s identity record.

Additionally, analysts can leverage the platform’s Compromised Data Exposure Report, a one-click reporting feature that instantly generates identity leak incident reports for rapid sharing with stakeholders and more precise incident tracking. These reports illuminate exposed PII, password hashes, and login credentials, while providing automated risk scoring, assessments, and step-by-step remediation guidance.

Today, SOCRadar published new research WP Botnet Master: How a Security Researcher’s Paid Course Built a 2.1-Million-Credential WordPress Botnet.

On 13 July 2026, SOCRadar Researchers recovered the complete toolkit behind a distributed WordPress brute-force operation the operator called “WP Botnet Master.” We expected to be looking at the work of a single skilled attacker. What we found was a graduation project.

The server they pulled apart did not belong to a lone hacker. It belonged to a paying student of a structured, commercial “training” program run by a WordPress security researcher who sells cybercrime as a course – complete with a curriculum, a lab blueprint, a community, and an AI-assisted workflow that lets students build and run credential-harvesting botnets with almost no skill of their own.

One student, acting alone, harvested 2,118,764 WordPress administrator credentials from 606,591 domains across 100 countries. There are roughly 295 more people in the community that trained him. The botnet is a symptom. The academy is the disease.

Key Points:

• A threat actor operating as “KING” (@Real_King_Engine) sells a paid course, the ISAL Framework, that teaches students to stand up attack infrastructure, generate exploits with commercial AI assistants, deploy web shells, and run a credential-harvesting botnet at internet scale.
• KING is a WPScan-credited vulnerability researcher with three published advisories and a Wordfence Intelligence researcher account carrying an approved bounty payout. These are real, verifiable identities – used as legal cover (“educational and defensive research only”) and as a credibility funnel to convert hobbyists into paying students.
• The recovered botnet server does not belong to KING. It belongs to one of his students, a self-published developer who identifies publicly as Saeful Rochim (“dalung,” github.com/dalungid), tied to the recovered toolkit by a confirmed code-authorship fingerprint match.
• The course teaches push-button, AI-assisted exploitation. In a paying student’s own words: “The system did everything automatically – I only drank soda.” Both Anthropic Claude and Google Gemini appear in the toolchain.
• The output SOCRadar recovered: 272 million sites scanned, 2,118,764 administrator credentials harvested across 606,591 domains in 100 countries, and 137 active web shells across 24 countries.
• As of the time of writing, the master command-and-control server (217.216.72.31) remained online and continued ingesting fresh target lists.

This is scalable, repeatable, and deliberately deniable cybercrime. Each of the ~295 community members is a candidate to reproduce the full operation – and an English-language edition of the course is already in development.

To view the full report, please see WP Botnet Master: How a Security Researcher’s Paid Course Built a 2.1-Million-Credential WordPress Botnet 

SOCRadar has launched a free wp2shell checker to help organizations quickly determine whether their WordPress websites may be exposed to CVE-2026-63030, a critical remote code execution vulnerability affecting recent WordPress versions.

The tool allows users to enter a domain and assess potential exposure without manually reviewing WordPress versions or configurations—particularly useful for organizations managing large numbers of public-facing, subsidiary, staging or forgotten websites.

The checker is designed to help security teams:

• Quickly identify potentially exposed WordPress assets
• Verify whether automatic WordPress updates were successfully applied
• Prioritize vulnerable or overlooked sites for remediation
• Reduce the risk posed by unknown WordPress installations across the external attack surface

SOCRadar has also published a supporting technical analysis explaining how the wp2shell vulnerability chain can lead to unauthenticated remote code execution, which WordPress versions are affected and what defenders should look for in their logs.

You can access the checker and analysis here:
https://socradar.io/blog/wp2shell-wordpress-rce-cve-2026-63030/

The SOCRadar Threat Research Unit (STRU) published an in-depth analysis of the latest ClickFake interview campaign, a North Korean social engineering operation targeting cryptocurrency and Web3 professionals with fake job interviews. 

In this campaign, operators pose as recruiters to walk targets through a bogus skill assessment that ends in a copy-and-paste command, delivering the PylangGhost RAT on Windows and the GolangGhost RAT on macOS. 

Key points include: 

• Famous Chollima (aka Wagemole) is a North Korean-aligned threat actor that has been highly active through the Contagious Interview and the latest ClickFake Interview campaigns.
• For ClickFake Interview the actors are creating fraudulent companies or impersonating known ones in the crypto industry, and reach out to targets on social media (e.g., LinkedIn), inviting them to ClickFix empowered fake skill assessments.
• Their ClickFix panels incorporate gating, tailored questions based on advertised roles, psychological pressure to act fast, video recording, and social engineering that pushes targets to run malicious commands through fake camera errors.
• The final payloads target both Windows, by deploying PylangGhost RAT, and macOS, by deploying GolangGhost RAT alongside a credential-harvesting SwiftUI application.
• PylangGhost and GolangGhost consist of six interconnected modules: a main orchestrator, a configuration holder, an archive helper, a command launcher, a C2 component, and a stealer.
• Both payload chains download the runtimes needed to run in victim environments: Python’s interpreter for PylangGhost and Golang’s compiler for GolangGhost.
• In the latest variation of PylangGhost, the attackers also compiled their payloads as Python dynamic modules with Nuitka to further complicate detection and analysis.
• Famous Chollima actors register multiple domains for their fake skill assessments, predominantly on Hostinger and NameCheap registrars, emphasizing speed and scale, rather than operational security and infrastructure resilience.

For full details, this study can be read here: https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/

The SOCRadar threat research unit (STRU) has published an in-depth analysis of fraud campaigns associated with the 2026 FIFA World Cup. With the final coming up this Sunday, SOCRadar has tracked the fraud ecosystem between April and July, spanning the counterfeit merchandise stores, FIFA portal impersonation, and ticketing/betting infrastructure. 

Interestingly, rather than peaking during the tournament’s biggest matches such as earlier this week’s semi-finals, fraud activity peaked before kickoff, as operators activated infrastructure that had been prepared weeks in advance. 

Key findings of this research include: 

• The FIFA portal impersonation cluster, linked to the GHOST STADIUM phishing-kit lineage, now spans 850+ domains – nearly triple the 300+ publicly reported in May. STRU reconstructed the kit’s evolution through the developers’ own Chinese-language code comments, including a documented bug fix and an OPSEC migration between two generations – effectively the threat actor’s own development log.
• 79% of domains observed at the activity peak were registered within the previous 30 days. Operators quietly bought infrastructure in May and activated it at the tournament’s opening.
• The betting network hacked nothing. It legally purchased expired domains – a defunct US staffing agency, a French artisan site – for their retained SEO authority, a supply chain that is legal, frictionless, and largely beyond the reach of technical controls.
• Counterfeit storefronts burned through domains in under five days and used deliberately modest 22-30% discounts, calibrated to look like a plausible promotion rather than a scam.
• STRU also disproved three of its own most striking leads – a shared Telegram bot token, an identical registrant hash, a common template – all artifacts of shared infrastructure, not shared operators. A transparency point that sets the research apart from typical vendor reporting.
• Defender takeaway with legs beyond the World Cup: for event-driven fraud, the critical monitoring window is before the event begins – directly applicable to the 2028 Olympics and every future major event.

For full details on SOCRadar’s findings, the research can be read here: https://socradar.io/blog/fifa-world-cup-2026-fraud-campaigns/