GajShield Threat Intelligence

Severity: HIGH · Priority: P2 — authenticated Jinja2 sandbox escape in GitLab AI Gateway, investigate on hit

This rule detects attempted exploitation of CVE-2026-90970, a critical sandbox escape vulnerability in the GitLab AI Gateway component disclosed October 2, 2026. The gateway is the service that powers GitLab Duo's AI features and connects a self-hosted GitLab instance to language model providers. The flaw lives in the Jinja2 prompt template engine that the gateway uses to process AI flow configurations: a logged-in user with Duo Agent Platform access can craft a flow configuration that escapes the Jinja2 sandbox and executes arbitrary commands on the gateway host. 

A hit indicates an attempt to exploit this sandbox escape against an AI Gateway in your environment. Confirm whether the targeted host is a self-hosted AI Gateway installation (GitLab.com and GitLab Dedicated deployments are already patched by GitLab and do not require action). If it is a self-hosted gateway, treat the attempt as potentially successful if the gateway was running a vulnerable version — exploitation requires only a logged-in GitLab user with Duo Agent Platform access, which is a low-privilege starting point. Upgrade the gateway Docker image to version 19.2.4, 19.3.2, or 19.4.1 as the definitive fix. Review gateway process logs for unexpected subprocess or shell execution since the vulnerability window opened.

Severity: CRITICAL · Priority: P1 — actively exploited zero-day, CISA KEV, patch or disable IBE immediately

These rules detect exploitation attempts against CVE-2026-104286, a critical zero-day vulnerability in Fortinet FortiMail that is actively exploited in attacks. The flaw combines path traversal (CWE-22) with improper null-byte handling (CWE-158) in the FortiMail GUI, specifically the component that backs the Identity Based Encryption feature. An unauthenticated attacker may write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Fortinet published FG-IR-26-175 on October 1, 2026, reporting exploitation in the wild, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on the same date with a remediation deadline of October 4. 

Affected versions are FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, and FortiMail 7.2.0 through 7.2.9. The attack works by sending a crafted URL containing both a directory-traversal sequence (stepping outside the intended directory) and a null byte (which causes the underlying system to stop processing the string at that point, bypassing extension or path-restriction checks). Together, these allow the attacker to name and place a file anywhere on the appliance's filesystem. Arbitrary file write on a mail gateway can directly yield code execution: an attacker can write a web shell to a web-accessible path, overwrite a configuration file, or stage a file for execution by a scheduled task or startup process. 

A hit on the traversal rule indicates an active exploitation attempt against a FortiMail appliance in your environment. Act immediately: the interim workaround is to disable FortiMail IBE using config system encryption ibe / set status disable, and upgrade to the fixed releases 8.0.2, 7.6.7, or 7.4.9 once available. If disabling IBE disrupts a critical mail workflow, restrict management interface access to trusted IP addresses while you arrange the upgrade. Check the appliance filesystem for unexpected files in web-accessible directories and review Fortinet's compromise indicators published with FG-IR-26-175. The scanner IP rule provides a supplementary correlation signal; those addresses are point-in-time and will age as the attacker rotates infrastructure. 

Severity: HIGH · Priority: P2 — active macOS infostealer campaign, second wave with updated infrastructure

These rules extend coverage for the Macfinger ClickFix campaign. The campaign remains active: a new fake-verification domain (hollow-badger-moasfraum.life) was observed delivering the same infection chain, and a follow-up diary entry revised the payload identification.

The campaign targets macOS users by injecting scripts into compromised legitimate websites that display a fake bot-verification or CAPTCHA page in the visitor's browser. The page copies a malicious shell command to the clipboard and instructs the visitor to paste and run it in Terminal — the standard ClickFix technique. The shell script detects the victim's CPU architecture and downloads a matching Mach-O binary from the delivery server. The payload was initially described as a variant of Atomic macOS Stealer (AMOS),  the payload uses WebSocket-based C2 communication rather than AMOS's HTTP POST pattern, stores architecture-specific binaries separately rather than bundling a universal binary, and uses a different persistence mechanism — placing entries in /Library/LaunchAgents/ and files in /Library/Caches/. The specific malware family remains unconfirmed as of the September 25 diary; it is a macOS information stealer but not the AMOS variant.

The IP rule updates the earlier Macfinger IP coverage to add the delivery server address confirmed in the  infection traffic. A hit on any of these rules should be treated the same way as the earlier wave: isolate the Mac, treat any credentials and wallet data accessible from it as exposed, check /Library/LaunchAgents/ for unexpected persistence entries, and rebuild the machine. The WebSocket-based C2 means that network indicators are the primary detection for post-infection traffic, since the payload uses a different port and protocol pattern from the earlier AMOS-attributed rules in this set.

Severity: HIGH · Priority: P2 — active exploitation of an unauthenticated WordPress forum SQLi, investigate on hit

These rules detect exploitation attempts against CVE-2026-1581, an unauthenticated SQL injection vulnerability in the wpForo Forum plugin for WordPress, confirmed under active exploitation as of October 2026. The plugin affects WordPress installations running wpForo Forum version 2.4.14 or earlier. The flaw sits in a forum sort-order parameter (wpfob) that the plugin passes directly into an SQL ORDER BY clause after only basic text sanitisation, without parameterised query preparation. Because the parameter is read before authentication is checked, an unauthenticated visitor can inject arbitrary SQL expressions — in practice, time-delay functions that allow an attacker to determine the truth value of any database condition one bit at a time, and by extension to extract the entire contents of the WordPress database including usernames, password hashes, and session tokens. The primary rule watches for the injection in the GET query string, where the plugin reads it in all confirmed exploits; the second rule provides additional coverage for the POST body.

A hit indicates an active database extraction attempt against a WordPress site running wpForo Forum. Because time-based SQL injection attacks make many requests with deliberate delays, a hit is often followed by a burst of similar requests — check the server's access log for repeated requests to forum pages with wpfob= values containing parentheses, SQL keywords, or comment characters. Confirm whether the targeted site runs wpForo Forum ≤ 2.4.14; if so, update to 2.4.15 or later immediately as the definitive fix. If exploitation cannot be ruled out, treat the entire WordPress database as potentially read by the attacker: rotate the WordPress admin password, any service account credentials stored in the database, and any API keys configured in the site's settings. Also consider that successful database read can expose session tokens that may allow the attacker to log in as any user without needing to crack a password hash.

Severity: HIGH · Priority: P2 — ICICI Bank brand-impersonation phishing domain

This domain is assessed with high confidence as a phishing or brand-impersonation domain targeting ICICI Bank customers. The legitimate ICICI Bank operates exclusively from icicibank[.]com and icici[.]bank[.]in — the bank explicitly instructs its customers to verify that any webpage asking for banking credentials uses the www[.]icicibank[.]com address, and directs reports of any spoofed or unofficial ICICI Bank websites to antiphishing@icicibank.com. The domain icici[.]work uses the ICICI brand name exactly but pairs it with the .work top-level domain, which has no legitimate use in banking or financial services and which has an established association with low-cost, abuse-prone domain registration. There is no known product, service, or channel of ICICI Bank or any ICICI Group entity that uses the .work TLD.

Recommended action: block icici[.]work across web and DNS filtering and alert on any lookup or connection to it from your network. If a user has visited this domain and entered any credentials, banking PINs, OTPs, card numbers, or account details, treat those as compromised — have the user change their ICICI netbanking password and mPIN from a known-clean device immediately, contact ICICI Bank directly on 1800 200 3344 (24-hour toll-free) to flag a potential phishing exposure, and monitor the account for any unauthorised transactions. Users who received a link to this domain by SMS or email should report it to ICICI Bank at antiphishing@icicibank.com and to the Indian Cyber Crime portal at cybercrime.gov.in or by calling 1930.

For Indian organisations and those serving Indian banking customers, this domain falls into the category of ICICI Bank phishing that has been documented across multiple campaigns since at least 2020. CERT-In (cert-in.org.in) and the National Cyber Crime Reporting Portal (cybercrime.gov.in) are the appropriate authorities to report to for confirmed phishing targeting Indian banking customers.

Severity: CRITICAL · Priority: P1 — post-exploitation toolchain from an actively exploited Zimbra CISA KEV vulnerability, escalate immediately

These signatures detect all unique malware and hacktool components used into active exploitation of CVE-2026-73570, covering the complete attack toolchain from initial shell dropper through persistent remote-access agent.

The components form a sequential infection chain. de.sh (DeSh) is the initial shell dropper served from the attacker's dynamic-DNS C2, providing early-stage execution. agent2.sh (Agent2Sh) is a lightweight shell downloader that retrieves the installer stage. zimdown2 (Zimdown2) is a Go binary acting as an installer for the remote-access agent: it downloads the agent, verifies it by SHA-256 hash, selects writable installation paths, and reports installation status over a separate WebSocket channel. Zimclient2 is the final remote-access agent providing interactive shell access, bidirectional file operations, and SOCKS5 proxying over WebSocket, TLS, and raw TCP transports — six persistence mechanisms are associated with it including systemd services, OpenRC, cron, shell startup files, SSH authorized keys, and local account creation. build_amd64 (BuildAmd64) is a cryptominer staged under the disguise name .kworker_sys — this represents a second threat actor exploiting the same compromised server, resource-hijacking it alongside the espionage-focused operator. Looptik is correctly classified as a hacktool rather than a trojan: it is a publicly available GitHub LPE toolkit repurposed by the attacker for privilege escalation to root. ResolvedLoader is a loader disguised as systemd-resolved that installs /usr/sbin/_chronyd and decodes the in-memory stage 2. BaseChainStage2 is the decoded in-memory stage 2 executed via memfd_create — a process-file-descriptor technique that runs code in memory without writing a file to disk — whose commands are retrieved from a Base blockchain smart contract using the EtherHiding technique, providing a resilient C2 channel that cannot be blocked by domain or IP takedown.

If GajAV flags one of these files, the Zimbra server is actively compromised and likely at an advanced stage of the intrusion — these components represent post-exploitation activity following successful injection, not initial delivery. Escalate immediately. The attacker has already established multiple redundant persistence mechanisms, executed privilege escalation to root, and may have accessed Zimbra authentication secrets (zimbraPreAuthKey, zimbraAuthTokenKey) that allow forging session tokens for any account. Isolate the server from the rest of the network, including peer Zimbra cluster nodes, which the attacker moves to using Zimbra's own SSH identity. Rotate all Zimbra authentication secrets immediately. Inspect every Zimbra node in the cluster for unexpected JSP files, unexpected systemd units (particularly zimlog.service, chronyd-helper.service, syslog_init.service), sudoers entries, and cron jobs. Do not assume cleaning one node is sufficient — lateral movement across the cluster is a confirmed attack pattern. Apply the Zimbra 10.1.20 patch as the definitive fix for the initial access vector.

Severity: HIGH · Priority: P2 — dual-RMM persistent access via phishing, investigate on hit

These rules detect connections to domains used as relay or C2 hosts for ScreenConnect sessions established by a phishing campaign. The campaign, observed in July 2026, distributes a digitally signed MSP360 Remote Monitoring and Management installer version 2.5.0.67 under deceptive lure names — meeting invitations, PDF-themed files, software update prompts, and tax-document lures. When the victim executes the installer and approves a User Account Control elevation prompt, MSP360 establishes itself as a persistent Windows service and gives the attacker remote management access. The attacker then uses MSP360 to silently download and install ConnectWise ScreenConnect, creating a second independent remote-access channel — a dual-RMM setup that provides redundancy if either tool is removed or blocked. With both tools in place, the attackers collect credentials, gather system information, modify firewall settings and autorun entries, and stage additional executables, while blending their activity into the appearance of legitimate IT remote management.

A hit on these rules indicates a device on your network is establishing outbound ScreenConnect sessions to infrastructure linked to this campaign. Because both MSP360 and ScreenConnect are legitimate software that appears in many corporate environments, a hit should be correlated with evidence of unauthorised installation: check whether MSP360 RMM v2.5.0.67 was installed without a sanctioned IT request, look for the services RMM.Agent.exe and RMM.Agent.Launcher.exe, and verify whether ScreenConnect on the same device was deployed through your organisation's own ScreenConnect instance or an external one. Treat an unexplained installation of either tool combined with a hit on these rules as a probable intrusion: isolate the device, revoke any credentials stored on or reachable from it, and investigate what the attacker may have accessed through the remote sessions. Remove both unauthorised RMM tools, check firewall settings and autorun entries for modifications, and hunt for any additional executables staged by the attacker.

The most effective long-term control against this class of attack is an approved-RMM inventory policy: know which remote management tools are authorised in your environment and on which devices, and treat any other RMM installation as a security event. Endpoint detection rules for MSP360 and ScreenConnect installation events from unexpected parent processes or without a prior IT change ticket provide earlier detection than network indicators, which only fire after the tools are already connecting to the attacker's infrastructure.

Severity: CRITICAL · Priority: P1 — active exploitation of a CISA KEV Zimbra RCE, post-exploit activity detected, escalate immediately

These rules detect post-exploitation network activity following successful exploitation of CVE-2026-73570, a critical unauthenticated command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. The vulnerability was disclosed August 13, 2026, fixed in Zimbra 10.1.20 (released July 20), and added to the CISA Known Exploited Vulnerabilities catalogue August 21 with a three-day federal remediation deadline. Active exploitation is confirmed and ongoing. 

The attack reaches a Zimbra server through a specially crafted SMTP request containing shell metacharacters, which Zimbra processes through its SNMP notification component without sanitisation. This gives the attacker command execution as the zimbra service account. The attacker then installs multiple JSP webshells across the Jetty and mailboxd application paths for persistence, downloads dropper scripts from a dynamic-DNS C2 domain, establishes interactive reverse shells, and archives recent mailbox backups. Unusually for this class of attack, one observed campaign used AzCopy — Microsoft's own Azure Storage command-line tool — to stage exfiltrated mailbox content directly to an attacker-controlled Azure Blob Storage bucket. This campaign also employs EtherHiding, storing a command-agent address on the Base blockchain and querying it through a standard JSON-RPC call, giving the attacker a resilient C2 discovery mechanism resistant to domain takedowns.

A hit on any of these rules indicates a Zimbra server in your environment has already been compromised. Act immediately: the server's mailbox content may have been archived and exfiltrated. Isolate the server, review /var/log/zimbra.log for suspicious service restarts, look for unexpected files in /tmp/ and in Zimbra webapps directories, and check the Jetty and mailboxd web application paths for unexpected JSP files. Treat all email, calendar data, credentials, and authentication tokens stored on the server or accessible to the zimbra service account as exposed. For suspected compromise, collect request admin-tech output from the Zimbra server and contact Zimbra support. The definitive fix is upgrading to Zimbra 10.1.20 or later; note that this vulnerability only affects servers where the optional zimbra-snmp package is installed and SNMP notifications are enabled, so servers without that configuration are not vulnerable to the initial injection — but the post-exploit indicators in these rules apply regardless.

Severity: CRITICAL · Priority: P1 — actively exploited zero-day, no workarounds, patch immediately

These rules detect active exploitation of CVE-2026-76504, a critical authentication bypass in Cisco Catalyst SD-WAN Manager published and confirmed exploited on September 30, 2026. The flaw is rated CVSS 9.8 and was added to the CISA Known Exploited Vulnerabilities catalogue on September 25, 2026 — this is the fifth actively exploited Cisco SD-WAN zero-day of 2026. Cisco SD-WAN Manager controls the entire SD-WAN network fabric: an attacker with admin access to the Manager can reconfigure every connected branch, manipulate routing policy, intercept or redirect traffic, and reach any device the Manager governs. No credentials are required. Cisco states the product is affected regardless of its configuration and there are no workarounds.

The bypass exploits the Manager's mishandling of URI encoding in the login endpoint j_security_check. The authentication rule that guards this endpoint performs a literal string match and therefore does not trigger when the j character is expressed as its percent-encoded equivalent (%6a or %6A). An attacker sends the request with the encoded URI, the authentication check is skipped, and the request arrives at the protected API endpoint with administrative privileges. The first rule detects the specific confirmed exploit form precisely: a percent-encoded character immediately preceding _security_check in the raw URI. The second rule provides additional coverage for evasion variants where encoding appears at other positions in the request path.

A hit indicates an active exploitation attempt against a Cisco SD-WAN Manager in your environment. Act immediately: audit the logs Cisco names for URI-encoded j_security_check hits and viptela-reserved-system account activity from unknown IPs. If compromise cannot be ruled out, open a Severity 3 case with Cisco TAC with "CVE-2026-76504" in the title and run request admin-tech on the Manager beforehand so the output can be reviewed. Treat the compromise as affecting every network device the Manager governs: assume credentials, routing configuration, and traffic policies across the entire SD-WAN fabric may have been accessed or modified, and treat the fabric as potentially under attacker influence until the Manager is patched and audited. Previously patched Managers — including those updated for the May and June 2026 SD-WAN flaws — still require this new update. 

Severity: HIGH · Priority: P2 — China-nexus espionage implant, escalate on hit

These signatures detect ANTINO, a previously undocumented Rust-compiled Windows backdoor used by China-nexus threat actor UAT-11587. These samples cover the full breadth of ANTINO builds collected across the campaign's active period from September 2025 through July 2026, spanning 32-bit and 64-bit Windows builds in both executable and DLL forms, plus loader and staging components from multiple campaign waves. 

ANTINO is a comprehensive espionage implant supporting host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. Its defining technical characteristic is a command-and-control channel that operates exclusively through Microsoft 365 — using the Microsoft Graph API to interact with attacker-controlled Outlook and OneDrive objects rather than dedicated C2 servers. This design causes ANTINO's traffic to blend completely with legitimate Microsoft 365 usage and significantly complicates detection and blocking at the network layer; file-based detection from these signatures is therefore the primary catch.

If GajAV flags one of these files, treat it as confirmation of a targeted state-sponsored intrusion — UAT-11587 has been conducting intelligence-gathering operations against government institutions, defence establishments, legislatures, think tanks, and civil-society organisations, and the presence of ANTINO indicates the attacker has reached the final-stage implant deployment phase, meaning the compromise likely preceded file execution by days to weeks. Isolate the affected device immediately and initiate full incident response. Given ANTINO's Microsoft 365 C2 channel, immediately check Microsoft Entra ID service-principal sign-in logs for unexpected OAuth application registrations or Graph API delegated permission grants that ANTINO creates to authenticate to the victim tenant's OneDrive and Outlook.