Last Updated On
Developer Browsers Betray AI Clusters as AmnesiaStealer Seizes Live Sessions
CISA has placed a critical Ray AI compute framework flaw under an aggressive three day federal remediation clock after confirming active exploitation that converts ordinary developer browsers into unauthenticated remote code execution vectors against local and adjacent clusters. The same news cycle reveals a global vCenter campaign that already compromised hundreds of systems across dozens of countries dropping durable persistence mechanisms and occasional encryption while a Windows Task Host elevation receives a formal ransomware use flag even without Microsoft public confirmation.
Emergency patches for GitLab GraphQL integrity failures and a widely installed WordPress form plugin arrive with no confirmed in wild exploitation yet still demand immediate attention given their unauthenticated nature. Simultaneously a sophisticated multi stage macOS infostealer named AmnesiaStealer spreads through fake GitHub ClickFix lures enabling real time browser session hijacking that bypasses multi factor authentication and empties Keychain and cryptocurrency stores.
Developer workstations control planes and AI pipelines now form the primary attack surface. Organizations must inventory every Ray instance isolate any previously exposed vCenter hunt for residual persistence and revoke sessions on macOS endpoints showing terminal pipe or remote debugging activity before the next escalation wave arrives.
9.8
CVSS Score
15
IOC Count
12
Source Count
78
Confidence Score
CVE-2025-62593, CVE-2025-60710, CVE-2026-19478, CVE-2026-19650, CVE-2026-15748, CVE-2026-15826, CVE-2026-59310, CVE-2026-59309, CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, CVE-2025-10123, CVE-2025-55583, CVE-2021-36260, CVE-2022-26134, CVE-2022-29464, CVE-2022-30525, CVE-2023-1389, CVE-2024-4577, CVE-2024-10914, CVE-2025-1974
Under Attribution
Technology, Software, Cybersecurity, Higher Education, Research, Telecommunications, Network Services, Federal Civilian Executive Branch, AI ML development environments, Financial Services, Cryptocurrency and Digital Assets, Government and Public Sector
Germany, United States, Turkey, Iran, France, Global, North America, EMEA
Chapter 01 - Executive Overview
CISA confirmed active exploitation of a critical Ray AI compute flaw and gave U.S. federal agencies until 20 August 2026 to patch or stop using it. The same window also brought a CISA ransomware use flag on a Windows privilege escalation bug, a GitLab GraphQL emergency patch, a WordPress form plugin remote code path, continued reporting on a global vCenter intrusion set, and the emergence of AmnesiaStealer a multi stage macOS infostealer performing live browser session hijacking. The common theme is exposed control plane and developer infrastructure not a single named actor.
Ray KEV Critical AI compute and developer workstations: CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities catalog on 17 August 2026. Ray versions before 2.52.0 can be reached through Firefox or Safari via DNS rebinding after a developer visits a malicious site or ad. That path can run attacker code on the machine hosting Ray and per maintainers on network adjacent Ray instances inside a private network. CISA lists ransomware use as unknown. Decision now inventory every Ray install including laptops and notebooks and force 2.52.0 or isolate until upgraded. Consulted sources confirm the browser driven path yields full arbitrary code execution enabling exfiltration of models training data and cloud credentials.
vCenter Syslog RCE Critical Virtualization and hosting: Consulted research assessed a campaign against CVE-2026-59310 that reached 361 victim IP addresses in 47 countries with the largest counts in Germany 55 the United States 41 Turkey 38 Iran 26 and France 25. Named sectors are technology software cybersecurity higher education research telecommunications and network services. Broadcom rates the flaw 9.8 and lists no workaround. One analyzed host later showed Babuk derived .babyk encryption on ESXi files. China nexus attribution remains a moderate confidence assessment only. Decision now treat internet facing or unpatched vCenter as a compromise hunt not a patch ticket.
Windows Task Host ransomware flag High Windows 11 Server 2025 estates: Consulted reporting stated that CISA updated KEV to mark CVE-2025-60710 as used by ransomware gangs. The bug is a local link following elevation to SYSTEM on Windows 11 and Windows Server 2025 patched by Microsoft in November 2025 and added to KEV on 13 April 2026. CISA published no attack details. Microsoft had not confirmed in the wild use. Decision now verify November 2025 patches and hunt local privilege escalation on unpatched Task Host hosts.
GitLab GraphQL directive Critical Self managed source control: GitLab released 19.2.4 19.1.6 19.0.8 and 18.11.11 on 17 August 2026 for CVE-2026-19478 CVSS 9.4 unauthenticated modification or deletion of public projects and user data via a GraphQL directive. A second issue CVE-2026-19650 CVSS 7.1 allows unauthenticated mutations over GET in GraphQL multiplex handling. GitLab.com and Dedicated are already patched. No in wild exploitation is confirmed. Decision now upgrade every self managed instance in the affected ranges.
Forminator upload RCE Critical WordPress publishing: Consulted analysis disclosed CVE-2026-15748 CVSS 9.8 unauthenticated arbitrary file upload in Forminator versions up to 1.56.1 when a form has both File Upload and Select fields. Fix is 1.56.2 released 31 July 2026. Exploitation in the wild is not confirmed in sources. Decision now patch or disable the File Upload plus Select combination.
AmnesiaStealer macOS Malware High Financial Services Crypto and Technology: A multi stage infostealer named AmnesiaStealer targets macOS workstations using fake GitHub ClickFix social engineering lures to deploy a Rust based payload capable of live interactive browser session hijacking via Chrome DevTools Protocol. Unlike passive stealers it enables real time MFA bypass and session takeover. High risk of SaaS compromise developer repository takeover and theft of cryptocurrency wallets Keychain secrets and messaging tokens. Decision now deploy endpoint rules blocking unauthorized terminal pipe executions and enforce hardware backed FIDO2 tokens.
Todays Intelligence Quality: Strongest evidence is CISA KEV plus NVD and vendor advisories for Ray GitLab vCenter and Forminator corroborated by multiple outlets plus Tier one endpoint telemetry for AmnesiaStealer. Weakest points include no Microsoft confirmation of CVE-2025-60710 no high confidence China nexus attribution no CISA exploit narrative for Ray and limited published file hashes. Overall confidence 78.
Chapter 02 - Threat & Exposure Analysis
Todays landscape is confirmed exploitation of developer and virtualization control planes plus high severity patches with limited confirmed in wild use and a sophisticated macOS session hijacking campaign.
CVE-2025-62593 Browser driven code injection against unauthenticated Ray APIs: Ray /api/jobs and /api/job_agent/jobs/ endpoints have long had no real authentication. The remaining guard was a User Agent prefix of Mozilla which the Fetch specification allows a page to change. Combined with DNS rebinding Firefox or Safari can become a confused deputy and submit jobs to a local or adjacent Ray process. Fixed in 2.52.0. GitHub CNA CVSS 4.0 is 9.4. CWE 94 and CWE 352. CISA added the CVE to KEV on 17 August 2026 with FCEB due date 20 August 2026 under BOD 26 04 for exposed systems. CISA did not publish how current attacks work. Bitsight previously recorded RondoDox attempting this CVE on 24 November 2025 two days before the CVE date but implemented it with a Mozilla User Agent that the advisory says returns HTTP 405 so that historic botnet use may have been ineffective. Oligo older ShadowRay 2.0 GPU cryptomining campaign is a separate Ray problem not this CVE. Actor Under Attribution. Attack progression involves short DNS TTL rebinding when a developer navigates to a malicious page enabling unauthorized POST requests that spawn arbitrary Python tasks and shell processes.
CVE-2026-59310 and CVE-2026-59309 vCenter syslog traversal and directory service bypass: Broadcom rates CVE-2026-59310 as directory traversal in the vCenter Syslog server allowing a network attacker to execute arbitrary code. CVSS 3.1 9.8. No workaround. Fixed builds include 9.1.0.0300 9.0.2.0100 8.0 U3k 8.0 U2f and Telco guidance. CVE-2026-59309 is a VMware Directory Service authentication bypass also 9.8. Consulted research states exploitation of 59310 began five calendar days after the 29 July disclosure with first victim connections 3 August and 343 of 361 IPs by 5 August. On one appliance 59309 activity from 1 August created vcenter_admin from 146.59.252.178 with User Agent GoodMoodle VCFleet/1.0. That account was not used in the later 59310 chain. Post exploit activity includes cron drop of zz poc59310 syslog.log curl or wget to external hosts for linuxFile WebSocket C2 esxi.sh reverse_ssh cron names impersonating VMware services JSP web shell SSO LDAP admin adds passwordless sudo for perfcharts vmdir credential theft ESXi local accounts and on one host .babyk encryption. Moderate confidence China language artifacts appear in research but remain unconfirmed as high confidence attribution. Actor Under Attribution.
CVE-2025-60710 Local Task Host link following to SYSTEM now KEV tagged for ransomware: NVD describes improper link resolution in Host Process for Windows Tasks allowing an authorized local attacker to elevate privileges. CWE 59. Affects Windows 11 and Windows Server 2025. Patched November 2025. KEV date added 13 April 2026 due 27 April 2026. Consulted reporting states CISA later marked known ransomware campaign use. CISA shared no victimology actor or technical campaign data. Microsoft had not updated its advisory to confirm in the wild use. Actor Under Attribution.
CVE-2026-19478 and CVE-2026-19650 Unauthenticated GitLab GraphQL integrity failure: Unauthenticated remote modify or delete of public projects and user data via a GraphQL directive CWE 94 CVSS 3.1 9.4. Companion CSRF in GraphQL multiplex GET handling CVSS 7.1. Affected CE EE from 18.2 before 18.11.11 19.0 before 19.0.8 19.1 before 19.1.6 19.2 before 19.2.4. GitLab will open the issues 90 days after patch. Exploitation not confirmed in sources. Actor Under Attribution.
CVE-2026-15748 Unauthenticated Forminator file upload: handle_file_upload exact key dangerous extension blocklist bypassed by pipe alternative MIME keys. Public handler trusts attacker controlled upload field config via a forged Select value. CWE 434. Prerequisite form with File Upload and Select. Default .htaccess may block PHP execution custom upload roots created on a frontend request can miss that guard. Versions up to 1.56.1 fixed 1.56.2. Same analysis covers User Profile Builder CVE-2026-15826 CVSS 9.8 when Automatically Log In is enabled. In wild use not confirmed. Actor Under Attribution.
Evooo1Bot Mirai derived edge botnet: Active since July 2026. Loader wget.sh from 91.92.40.118 architecture specific binary encrypted C2 on 443 SOCKS5 proxying SSH brute force credential sniffer DDoS. No named actor.
AmnesiaStealer Live Chrome DevTools Protocol Hijacking via ClickFix: Victims navigating to lookalike repositories are prompted to fix a download issue by copying and executing a base64 encoded shell script in macOS Terminal. The loader fetches a Mach O payload that harvests macOS Keychain data Apple Notes and Telegram then deploys a secondary streaming module. Relies on social engineering to bypass gatekeeper followed by dynamic execution leveraging Chrome DevTools Protocol remote debugging port to interface directly with active Chromium processes. Campaign uses fake GitHub download interfaces staged ZIP archives and encrypted C2 to Russian language Amnesia Panel backends. Sector exposure Cryptocurrency Software Engineering Decentralized Finance. Geographic exposure North America Europe East Asia. Actor Under Attribution financially motivated cybercrime ecosystem.
Cross Incident Pattern Analysis: Ray vCenter GitLab Forminator and AmnesiaStealer are all unauthenticated or weakly authenticated remote integrity failures or client side trust abuses on internet reachable or developer adjacent services. CISA three day Ray deadline and Broadcom no workaround language both treat control plane exposure as the binding constraint. Both Ray and AmnesiaStealer highlight convergent strategy of bypassing fortified enterprise perimeter firewalls by exploiting client side trust relationships on engineer workstations.
Chapter 03 - Operational Response
Treat Ray KEV and any unpatched or previously exposed vCenter as same day work. GitLab and Forminator are emergency patch cycles. Windows Task Host is a ransomware priority patch and hunt. AmnesiaStealer requires immediate endpoint isolation and session revocation.
Ray KEV Immediate Response and Containment: Containment Priorities:
Do this NOW find Ray versions before 2.52.0 on workstations CI images notebooks and clusters stop internet reachable dashboards.
Upgrade all head and worker nodes to 2.52.0 in one change window. Mixed versions leave the oldest node as the real patch level.
If a dashboard was ever reachable from an untrusted network or a developer browser rotate cloud IAM Kubernetes tokens and object storage keys on that host. Security Hardening Actions: python c import ray print ray.version and pin ray greater than or equal to 2.52.0 in requirements pyproject images. Place clusters behind an authenticated proxy or VPN do not rely on User Agent checks. Restrict Firefox Safari use on boxes that still run old Ray until patched. Internal Security Coordination: Notify platform ML ops and developer experience owners the same day. Escalate if Ray is internet exposed or holds training data model artifacts cloud credentials. FCEB BOD 26 04 due 20 August 2026 for exposed systems treat 20 August as the operational clock. Do this within 24 hours rebuild any image that still resolves Ray before 2.52.0. Isolate internet facing or dual homed developer workstations running unpatched Ray daemons. Enforce local loopback binding restrictions and restrict access to ports 8265 and 10001 via host firewalls. Review active Ray job submission queues. Implement strict DNS inspection on internal enterprise recursive resolvers to detect and block DNS rebinding attempts against private and loopback IP spaces.
vCenter Syslog RCE Isolation and Patch Prioritization: Containment Priorities:
Do this NOW remove vCenter from the internet restrict management to a jump network. Broadcom no workaround except patch.
If patched on or after 3 August 2026 assume possible prior access and hunt persistence. Patching does not drop reverse_ssh.
Block outbound from VCSA ESXi to the listed IPs and intel.se9ly9upbhay.shop. Security Hardening Actions: Move to 9.1.0.0300 9.0.2.0100 8.0 U3k 8.0 U2f or the Telco build. Review cron systemd tmp sudoers.d vSphere SSO and ESXi local accounts. Preserve logs before reboot encryption may destroy ESXi telemetry. Internal Security Coordination: Virtualization identity and IR together. Escalate on new local admins reverse shells or .babyk files. Legal comms only if encryption or data impact is confirmed on your estate. Do this within 24 hours forensic review of every vCenter that was reachable when the campaign peaked 3 to 5 August.
Windows Task Host Patch Verification and Ransomware Hygiene:
Do this NOW confirm the November 2025 Microsoft patch for CVE-2025-60710 on Windows 11 and Server 2025.
Hunt leftover local admin SYSTEM abuse on still unpatched hosts.
Do this within 24 hours treat unpatched Task Host as ransomware staging risk per CISA KEV ransomware flag even though CISA published no campaign detail.
GitLab GraphQL Emergency Upgrade:
Do this NOW upgrade self managed CE EE to 18.11.11 19.0.8 19.1.6 19.2.4.
Audit public projects for unexpected deletion or modification since 17 August.
Do this within 24 hours review GraphQL access logs for unauthenticated directive mutation abuse. GitLab.com Dedicated no action.
Forminator Plugin Containment:
Do this NOW update to 1.56.2 or higher or remove File Upload plus Select from live forms.
Hunt web roots for unexpected PHP under upload directories especially custom storage roots.
Do this within 24 hours if User Profile Builder is installed with Automatically Log In upgrade to 3.16.5 or higher for CVE-2026-15826.
AmnesiaStealer Immediate Response and Containment: Containment Priorities:
Disconnect compromised macOS endpoints from corporate Wi Fi and VPN networks immediately.
Force an enterprise wide session revocation and password reset across all cloud identity providers for affected users from an out of band clean device.
Terminate running background Chrome DevTools debugging instances and quarantine tmp random staging paths. Security Hardening Actions: Block known staging domain github.aoitour.com at Secure Web Gateway and DNS resolvers. Deploy MDM profile restrictions disallowing non admin execution of terminal pipe commands curl pipe sh or base64 decode pipe bash. Internal Security Coordination: Notify Desktop Engineering IAM administrators and the CSIRT on call team. Escalation trigger Active extraction of session cookies or access to corporate GitHub cloud production environments.
Defender Priority Order Today:
Ray KEV CISA confirmed exploitation three day federal clock.
vCenter 59310 confirmed mass exploitation persistence survives patch.
AmnesiaStealer interactive browser hijacking on developer endpoints.
Windows Task Host CISA ransomware use flag local SYSTEM.
GitLab 19478 unauthenticated integrity break no ITW yet.
Forminator 15748 unauthenticated RCE path large install base ITW unconfirmed.
Evooo1Bot patch ancient edge CVEs.
Incident Timeline
Ray KEV Timeline: 24 November 2025 Bitsight first observed RondoDox attempting CVE-2025-62593. 26 November 2025 NVD published CVE-2025-62593 Ray 2.52.0 is the fix. Date unconfirmed cited as March 2026 Bitsight public RondoDox write up later referenced by CISA ADP on the NVD record. 17 August 2026 CISA added CVE-2025-62593 to KEV announcements posted same day. NVD last modified 17 August 2026. 17 August 2026 CISA SSVC exploitation value changed from proof of concept to active per secondary reporting. 18 August 2026 Multiple outlets reported the KEV add and the 20 August FCEB deadline. 20 August 2026 CISA stated due date for exposed federal systems. 18 August 2026 Status exploitation confirmed by KEV ransomware use unknown no official exploit narrative.
vCenter Syslog RCE Timeline: 29 July 2026 Broadcom published VMSA 2026 0006 covering CVE-2026-59309 CVE-2026-59310 and others. 1 August 2026 Activity consistent with CVE-2026-59309 on one appliance. 3 August 2026 Broadcom issued VMSA 2026 0006.1 with express patches. First 59310 victim connections campaign chain begins on the analyzed host. 4 August 2026 Campaign ramp 151 new victim IPs reported in secondary coverage. 5 August 2026 343 of 361 victim IPs observed. 7 August 2026 Cumulative 361 IPs 47 countries in tracking. 14 August 2026 GitHub repo pikpak0066 tmpclean created later tied to reverse_ssh. 17 August 2026 Campaign analysis published including Babuk derived .babyk on one ESXi host. 18 August 2026 Status exploitation ongoing in reporting CISA KEV listing for 59310 not confirmed in sources.
Windows Task Host Timeline: 11 November 2025 NVD published CVE-2025-60710 Microsoft patched in November 2025. 13 April 2026 CISA added CVE-2025-60710 to KEV FCEB due 27 April 2026. Date unconfirmed reporting indicates CISA updated KEV again to flag ransomware use. Article itself dated 18 August 2026. 18 August 2026 Reporting covers the ransomware flag Microsoft comment unavailable no attack detail from CISA.
GitLab GraphQL Timeline: 17 August 2026 GitLab released 19.2.4 19.1.6 19.0.8 18.11.11 NVD published CVE-2026-19478 and CVE-2026-19650. 18 August 2026 Status no confirmed exploitation no public PoC not in KEV.
Forminator Timeline: 14 July 2026 Wordfence received the Forminator submission. 16 July 2026 User Profile Builder 3.16.5 patched CVE-2026-15826. 31 July 2026 Forminator 1.56.2 patched CVE-2026-15748. 17 August 2026 Disclosure published. 18 August 2026 NVD published CVE-2026-15748. 18 August 2026 Status no confirmed in wild exploitation in sources.
Evooo1Bot Timeline: July 2026 First activity noted. 17 August 2026 Write up published.
AmnesiaStealer macOS Campaign Timeline: 13 August 2026 Technical discovery of AmnesiaStealer multi stage Rust infostealer leveraging ClickFix lures published. 14 August 2026 Identification of C2 infrastructure running Amnesia Panel and browser remote control module via Chrome DevTools Protocol. 16 August 2026 Threat campaigns observed actively targeting macOS developers via typo squatted and counterfeit GitHub domains. 18 August 2026 Campaign active detections distributed across open source security intelligence feeds.
Chapter 04 - Detection Intelligence
CVE-2025-62593 User Agent bypass plus DNS rebinding to Ray Jobs API: Attack vector network user interaction required visit site or malvertising in Firefox or Safari. Mechanism defense is User Agent starts with Mozilla Fetch can set that header. DNS rebinding then lets the page call unauthenticated /api/jobs and /api/job_agent/jobs/ and inject jobs CWE 94 CWE 352. Observed behavior CISA confirmed exploitation but published no current kill chain. Bitsight RondoDox sample used User Agent Mozilla 5.0 rondo2012 atomicmail.io which the advisory says should 405. Affected Ray before 2.52.0. Patch 2.52.0 commit 70e7c72780bdec075dba6cad1afe0832772bfe09 GHSA q279 jhrf cc6v. Credits Avi Lumelsky Oligo Jonathan Leitschuh. CVSS 4.0 9.4 from GitHub CNA. NVD has no independent score. Spawns arbitrary Python tasks and shell processes with the privileges of the Ray runtime user.
CVE-2026-59310 Syslog path traversal to root cron execution: Attack vector network no auth no workaround. Mechanism directory traversal in vCenter Syslog server CWE 22 writes outside the intended tree. Malformed cron zz poc59310 syslog.log under etc cron.d using a syslog like name at least one file executed and dropped linuxFile. Observed behavior root via crond curl wget staging WebSocket backdoor with XOR obfuscated C2 over ws systemd cron persistence reverse_ssh VMware named cron jobs adding SSH keys JSP shell vmware perf update.jsp and adminuser in SSO Administrators etc sudoers.d vmware perf for passwordless root as perfcharts vmdir credential query via registry path or GetMachineName GetMachinePassword GetDomainName ESXi local accounts optional .babyk locker. Follow on GitHub pikpak0066 tmpclean deletes tmp entries older than 24 hours hourly and shipped reverse_ssh in release tmpclean v3.0.0. Affected products builds see Broadcom matrix VCF vSphere Foundation 9.1 9.0 vCenter 8.0 VCF 5.x Telco. CVE-2026-59309 on the same host was a separate auth bypass track not chained in the 59310 narrative.
CVE-2025-60710 Task Host link following: Attack vector local authorized user. Mechanism CWE 59 link following in Host Process for Windows Tasks to SYSTEM. Observed ransomware tradecraft insufficient source data. CVSS numeric not confirmed in sources.
CVE-2026-19478 GraphQL directive code injection: Attack vector network unauthenticated no user interaction. Mechanism CWE 94 via GraphQL directive can modify delete public projects and user data. Full issue text embargoed 90 days. Companion CVE-2026-19650 GraphQL multiplex handler accepts mutations over GET CWE 352. Exploitation not confirmed in sources.
CVE-2026-15748 Forged Select field to executable upload: Attack vector network unauthenticated needs File Upload plus Select on one form. Mechanism blocklist exact key match bypassed by pipe alternative MIME keys handler trusts attacker supplied upload field config. Custom storage root may be created without .htaccess because the helper is not loaded on that frontend request. Patch 1.56.2.
AmnesiaStealer Multi Stage Rust Payload and Browser Hijacking: Attack vector Local User Execution Terminal ClickFix lure. Exploitation mechanism Deceptive web prompt instructs user to execute a base64 encoded command in Terminal. The command executes a shell script downloading a password protected ZIP archive containing a Mach O binary. Observed behavior The Rust binary decrypts its config using key 4mn3s1a_2o26!xK queries Keychain via AppleScript security tools harvests data from 16 Chromium browsers Apple Notes and Telegram stages it in tmp and archives it with ditto to send to /send/ on the C2. Upon receiving a remote_stream command it spawns a headless Chromium instance with remote debugging port to exfiltrate cookies using Network.getAllCookies and interactively control active sessions. Vulnerability details Abuse of Chrome DevTools Protocol and legacy TCC bypass behaviors. CVE technical context insufficient source data Malware campaign utilizing social engineering rather than a specific CVE. Patch status Exploits patched OS behaviors active detection required.
Inferred ATT and CK behavioral basis only T1190 exposed vCenter GitLab Forminator Ray APIs T1059.004 QUIRSO bin sh and bash T1053.003 cron T1543.002 systemd T1505.003 JSP shell T1136 T1078.001 local SSO accounts T1098.004 authorized_keys T1552 vmdir machine password T1105 curl wget T1071.001 WebSocket 443 C2 T1572 WebSocket T1090 Evooo1Bot SOCKS5 T1486 .babyk on one host T1070 tmpclean bash history wipe T1185 browser session hijacking T1555.001 Keychain T1539 session cookies.
Inferred D3FEND analyst control mapping D3 PM patch to fixed builds D3 ITF block inbound to vCenter Ray GraphQL from untrusted nets D3 OTF deny VCSA egress D3 UA D3 AL account and cron review D3 FCR upload execution barriers.
vCenter campaign Indicators and Infrastructure: Indicators of Compromise: Type IP Address Value 146.59.252.178 Context Account creation source for vcenter_admin 59309 track Verdict Pending Type IP Address Value 5.34.177.38 Context Backdoor fetch port 9861 Verdict Pending Type IP Address Value 185.144.28.120 Context esxi.sh reverse_ssh port 3232 Verdict Pending Type IP Address Value 192.255.141.13 Context Cron staging port 8080 Verdict Pending Type IP Address Value 5.34.176.100 Context Tooling port 5244 AList directory listing of reverse_ssh Verdict Pending Type Domain Value intel.se9ly9upbhay.shop Context linuxFile WebSocket C2 host Verdict Pending Type URL Value ws://intel.se9ly9upbhay.shop:8080/ws Context linuxFile C2 path Verdict Pending Type URL Value https://github.com/pikpak0066/tmpclean Context Actor linked tmp cleaner that ships reverse_ssh Verdict Pending
Infrastructure Patterns: Payloads from actor controlled or third party hosting one host exposed reverse_ssh via AList. Outbound connect back reverse_ssh WebSocket bypasses inbound only firewall policy. No mainland China victims in the tracked set. IP count does not equal org count because of shared cloud hosting. ASN registrar reuse insufficient source data.
Named artifacts not hashes not confirmed as cryptographic IOCs linuxFile systemlog linux_x86 zz poc59310 syslog.log esxi.sh reverse_ssh vmware vpxd stats vmware perf collect vmware perf sync vmware perf update.jsp tmp .vmware perf upd.sh etc sudoers.d vmware perf accounts vcenter_admin vcadmin adminuser User Agent GoodMoodle VCFleet/1.0 extension .babyk.
Evooo1Bot Indicators and Infrastructure: Type IP Address Value 91.92.40.118 Context Loader host for wget.sh Verdict Pending Type URL Value http://91[.]92[.]40[.]118/wget[.]sh Context Architecture loader then history wipe Verdict Pending Fortinet hashes insufficient source data original appendix not retrieved.
AmnesiaStealer Indicators and Infrastructure: Type Domain Value github.aoitour.com Context AmnesiaStealer ClickFix distribution host Verdict Malicious Type File Path Value tmp 25 random chars Context AmnesiaStealer staging directory Verdict Suspicious Type Config Key Value 4mn3s1a_2o26!xK Context AmnesiaStealer XOR configuration decryption key Verdict Malicious Type CVE ID Value CVE-2025-62593 Context Ray Framework DNS Rebinding RCE Identifier Verdict Vulnerability
Infrastructure Patterns: Counterfeit domain naming imitating legitimate developer platforms hosted on bulletproof infrastructure. C2 backend architecture utilizes Amnesia Panel listening on standard HTTPS ports handling /send/ exfiltration endpoints.
Ray Windows Task Host GitLab Forminator: No IP domain URL or hash indicators published in window. Do not import Bitsight 2025 early 2026 RondoDox infrastructure table as current Ray KEV IOCs that dataset ends 16 February 2026 and Bitsight itself says the Ray exploit implementation was broken.
Actor Normalization Evidence: No source showed overlap among Ray vCenter Task Host GitLab Forminator Evooo1Bot and AmnesiaStealer infrastructure.
Browser to Jobs API Detection Opportunity Ray KEV: Detection Engineering Opportunities: Job create requests to /api/jobs or /api/job_agent/jobs/ whose User Agent is attacker controlled or whose source is a browser origin unexpected resolver. New Python child processes spawned by a Ray dashboard process after an outbound browse session. Immediate detection action alert on internet to Ray dashboard access and on Ray before 2.52.0 in package inventory. Hunt this week workstations that ran Ray while the user used Firefox Safari then spawned unusual job processes.
YARA is a poor fit for this web API bug hunt package versions not binaries. Detection Context Quality need package inventory proxy DNS logs rebinding and Ray dashboard logs. Gap CISA published no exploit telemetry.
Syslog to cron root Detection Opportunity vCenter: Immediate detection action alert on new files under etc cron.d matching poc 59310 vmware vpxd stats vmware perf outbound from VCSA to the five IPs and intel.se9ly9upbhay.shop. Hunt this week SSO ESXi accounts adminuser vcadmin vcenter_admin perfcharts sudoers JSP shells .babyk.
Consulted research published a reverse_ssh YARA rule the rule body is insufficient source data here retrieve it before production use.
Local SYSTEM via Task Host Detection Opportunity CVE-2025-60710: Immediate detection action missing patch compliance for November 2025 Task Host fix. Hunt this week non admin users spawning taskhostw.exe host process activity that results in SYSTEM token then ransomware staging. CISA gave no event IDs.
GraphQL directive GET mutation Detection Opportunity GitLab: Immediate detection action WAF app log for unauthenticated GraphQL POSTs with unusual directive usage and GraphQL GET multiplex that include mutations. Hunt this week public project delete update with user_id null.
Forged upload field Detection Opportunity Forminator: Immediate detection action alert on Forminator submissions that include both upload and select then write .php under wp content uploads. Hunt this week custom upload roots missing .htaccess.
Edge loader Detection Opportunity Evooo1Bot: Immediate detection action block 91.92.40.118 and alert on wget.sh retrieval plus bash history truncation.
String evooo1 is from secondary coverage not a retrieved sample. Validate before blocking on name alone.
T1190 T1204 Detection Opportunity Ray and AmnesiaStealer: Detect Ray worker child processes spawning unexpected command shells or outbound connections to unusual external IPs. Detect macOS Terminal spawning base64 decode utilities piped into shell execution engines. Detect Chromium browsers launched with the command line flag remote debugging port. Detection Context Quality Data source requirements macOS Endpoint Telemetry Unified Audit Logs Endpoint Security Framework Linux Auditd eBPF process telemetry Web Proxy DNS query logs. Known detection gaps Direct loopback web traffic 127.0.0.1 to 127.0.0.1 is frequently omitted from host network telemetry. Threat Hunting Hypotheses Threat actors are actively establishing interactive CDP browser sessions to bypass session cookie expiration on developer endpoints. Evidence target Search process execution logs for Google Chrome or Chromium processes executed with remote debugging port or headless flags originating from non developer automation parent processes.
Action item Deploy the macOS Terminal base64 pipe detection rule across all endpoints within 24 hours run a retrospective threat hunt across 14 day DNS logs for rebinding query anomalies this week.
No confirmed MITRE mapping in sources no article in this window published official ATT and CK IDs.
Analyst inferred mappings behavioral basis do not treat as source mapped:
T1190 Exploit Public Facing Application Initial Access: Incidents Ray Jobs API vCenter Syslog GitLab GraphQL Forminator upload Evooo1Bot CVE list AmnesiaStealer social engineering path. Basis unauthenticated or weakly authenticated network reachability or client side trust abuse described by CISA NVD Broadcom GitLab Wordfence Fortinet and endpoint research.
T1053.003 Cron Persistence Execution: Incident vCenter. Basis crond execution of planted syslog named files and VMware named jobs.
T1505.003 Web Shell Persistence: Incident vCenter. Basis vmware perf update.jsp.
T1098.004 SSH Authorized Keys Persistence: Incident vCenter. Basis cron adding attacker SSH public key.
T1071.001 T1572 Web Protocols Protocol Tunneling C2: Incident vCenter linuxFile ws C2 Evooo1Bot port 443 AmnesiaStealer HTTPS /send/.
T1486 Data Encrypted for Impact: Incident vCenter one host .babyk. Research is unsure this was the objective.
T1068 Exploitation for Privilege Escalation: Incident Windows Task Host CVE-2025-60710. Basis NVD local elevation description.
T1185 Browser Session Hijacking Collection: Incident AmnesiaStealer. Basis operator invokes Chrome DevTools Protocol on active victim browsers to manipulate live sessions and steal valid authentication cookies.
T1555.001 Credentials from Password Stores Keychain Credential Access: Incident AmnesiaStealer. Basis Rust stealer executes system calls and native tools to query and dump stored secrets from the macOS Keychain.
T1204.002 User Execution Malicious File: Incident AmnesiaStealer ClickFix lure.
T1562.001 Impair Defenses Disable or Modify Tools: Incident AmnesiaStealer and Ray related defense bypass behaviors.
Chapter 05 - Governance, Risk & Compliance
Ray KEV Regulatory and Business Risk Exposure: Regulatory Exposure: U.S. FCEB Binding Operational Directive path BOD 22 01 catalog reporting cites BOD 26 04. Due 20 August 2026 for exposed systems. Private sector no legal CISA clock but KEV is the prioritization input CISA tells everyone to use. If a Ray host holds personal data model weights or credentials treat confirmed compromise as a potential GDPR DPDP NIS2 notification event. No source confirmed a specific Ray breach of personal data in this window. Applicable frameworks NIST SP 800 218 SSDF CISA BOD 26 04 ISO IEC 27001. Notification obligations For U.S. Federal agencies KEV inclusion imposes a binding remediation deadline. Commercial enterprises holding sensitive IP face reporting triggers under SEC Cyber Disclosure Rules if exploitation leads to material exfiltration of proprietary model algorithms. Evidence preservation requirements Retain container logs worker node disk snapshots and DNS resolution caches for forensic chain of custody. Business Risk Impact: Operational hijack of GPU CPU clusters and developer laptops. Prior Ray campaigns ShadowRay not this CVE stole credentials source and models. Reputational unauthenticated job APIs on AI infrastructure. Financial insufficient source data for loss figures. Operational risk Threat actors can terminate model training workloads corrupt AI weights or hijack GPU compute clusters. Reputational risk Compromise of proprietary LLMs or training datasets undermining intellectual property standing. Financial risk Unauthorized compute resource consumption and direct cloud infrastructure theft. Threat Actor Attribution No confirmed attribution. RondoDox is historic possibly failed exploit use not a current named operator for this KEV add. CISO decision escalate. CISA confirmed exploitation plus a three day federal deadline. Mandate comprehensive inventory and immediate patching of all AI ML developer workstations and cluster endpoints within 24 hours.
vCenter Syslog RCE Regulatory and Business Risk Exposure: Regulatory Exposure: vCenter is a virtualization control plane. Confirmed encryption on even one ESXi host can trip incident classification and evidence preservation duties. Research warns the locker may exist to burn logs. NIS2 essential entity rules apply where virtualization underpins regulated services. Sectors named include telecom and higher education. CISA KEV status for 59310 not confirmed in sources. Business Risk Impact: Operational one appliance to ESXi estate. 361 IPs 47 countries is an exposure metric not an org count. Reputational China nexus claims are moderate confidence and relayed do not brief boards as confirmed PRC APT. Financial insufficient source data. CISO decision escalate for any vCenter that was network exposed after 29 July 2026.
Windows Task Host Regulatory and Business Risk Exposure: CISA now associates CVE-2025-60710 with ransomware. That raises backup segregation and board ransomware reporting posture even without a named gang. Microsoft non confirmation is a gap not a reason to wait. CISO decision escalate unpatched Windows 11 Server 2025 otherwise monitor.
GitLab GraphQL Regulatory and Business Risk Exposure: Integrity loss on public projects and user data can be a source code and personal data event. GitLab.com Dedicated already patched self managed owners own residual risk. No ITW yet. CISO decision escalate self managed upgrades today defer external notification unless audit shows tampering.
Forminator Regulatory and Business Risk Exposure: Unauthenticated PHP upload is a website takeover and subsequent data exfil path. Large install base. ITW unconfirmed. CISO decision escalate internet facing WordPress with Forminator up to 1.56.1 otherwise monitor after 1.56.2.
AmnesiaStealer Regulatory and Business Risk Exposure: Applicable frameworks GDPR EU AI Act DORA SEC Cybersecurity Rules. Notification obligations Mandatory 72 hour breach reporting under GDPR DORA if live browser session hijacking enables unauthorized exfiltration of customer PII or financial accounts. Evidence preservation requirements Preserve endpoint volatile memory browser cache profiles and local tmp staging files before reimaging. Business Risk Impact: Operational risk Complete compromise of identity credentials enabling lateral movement into production SaaS platforms. Reputational risk Public exposure of leaked proprietary source code repositories or customer data. Financial risk Direct draining of cryptocurrency wallets and high IR engagement costs. Threat Actor Attribution Attributed to financially motivated Russian speaking cybercrime ecosystem utilizing Amnesia Panel in consulted sources. CISO Decision Escalate Enforce device bound phishing resistant credentials across all SaaS portals and quarantine flagged endpoints immediately.
Board Level Risk Summary Today: The U.S. government confirmed that a widely used AI computing tool is being broken into and gave federal teams three days to fix it. A separate already patched VMware management product is being used in a global break in that can take over virtual servers. Two other critical patches GitLab WordPress forms are not yet confirmed as attacked. A sophisticated macOS stealer is hijacking live developer browser sessions to bypass MFA. Patch the confirmed ones first hunt the VMware systems that were reachable in early August and isolate any macOS endpoints showing ClickFix or remote debugging activity. Todays primary organizational exposure centers on the compromise of engineering and AI workstations serving as backdoors into core enterprise infrastructure. Attackers are bypassing perimeter security by weaponizing standard developer browsers to seize live application sessions and execute unauthorized compute jobs.
Chapter 06 - Adversary Emulation
No source mapped ATT and CK IDs exist. Scenarios below are defensive validations of behaviors documented in sources. Do not exploit production vCenter Ray GitLab or WordPress.
Ray KEV Validation and Purple Team Scenarios: Detection Validation Scenarios: Scenario from a lab browser attempt a DNS rebind to a lab Ray before 2.52.0 Jobs API using a modified User Agent. Do not run attacker payloads. Expected detection web alert on /api/jobs plus EDR child process from Ray. Failure signal Ray accepts the job and nothing fires. Scenario Simulate a local loopback HTTP request against a test Ray dashboard endpoint simulating mismatched Host headers to verify whether network inspection tools flag internal cross zone requests. Expected detection Network sensor triggers an alert on private destination IP pairing with public domain Host header. Failure signal Request succeeds with 200 OK and no SIEM alert is generated. Purple Team Exercise Suggestions: Inventory drill can you list every Ray version in 4 hours. Control test User Agent filtering versus authenticated proxy. Maintainers already said User Agent is insufficient.
vCenter Validation and Purple Team Scenarios: Detection Validation Scenarios: Scenario in a lab VCSA drop a benign file named zz poc59310 syslog.log under etc cron.d and a test cron using vmware perf sync prefix do not execute reverse_ssh against live C2. Expected detection FIM cron SIEM rule. Failure signal crond executes it with no alert. ATT and CK Aligned Security Testing inferred IDs: T1053.003 T1505.003 T1098.004 authorized keys JSP in web roots sudoers.d vmware perf. Focus detect outbound from VCSA not inbound exploit development. Broadcom published no exploit code do not write one.
Windows Task Host GitLab Forminator: Task Host patch compliance validation only. No public exploit steps in sources. GitLab send a benign unauthenticated GraphQL introspection mutation attempt against a staging instance expect WAF log alert. Forminator staging form with Upload plus Select upload a non executable canary and confirm 1.56.2 rejects dangerous types.
AmnesiaStealer Validation and Purple Team Scenarios: Detection Validation Scenarios: Scenario In a sandboxed macOS virtual machine execute a benign script echoing test strings using base64 decoding piped into bin zsh. Expected detection EDR triggers a high severity alert for suspicious command line execution originating from Terminal. Failure signal Script executes without EDR event generation. Purple Team Exercise Suggestions: Exercise Simulate the launch of Chromium using remote debugging port 9222 from a non standard parent script and test if EDR or behavioral monitoring detects the invocation. Defensive hypothesis EDR agent detects and blocks unauthorized remote debugging connections to running enterprise browser processes. ATT and CK Aligned Security Testing: Technique T1185 Browser Session Hijacking. Test approach Execute safe inspection of browser debugging endpoints using isolated test browser profiles. Focus Defensive verification of EDR alerting telemetry only.
Overall Score | 78 | Reflects CISA KEV plus NVD and vendor advisories for Ray GitLab vCenter and Forminator corroborated by multiple outlets plus detailed endpoint reverse engineering for AmnesiaStealer
Strong Evidence | High | Authoritative government confirmation of Ray exploitation and federal deadline plus vendor primary patch notes
Offsetting Gaps | Moderate | No Microsoft confirmation of CVE-2025-60710 ransomware flag moderate confidence only China nexus claims no CISA Ray exploit narrative limited file hashes silence from several major research groups in window
AmnesiaStealer Contribution | Elevated | Endpoint telemetry and reverse engineering raise confidence for that campaign but overall score remains conservative due to breadth of incidents