← Feed

Posts

• View post

  Espionage crews keep landing on the same trick: relay command-and-control through a service the SOC already trusts. The latest is the CAV3RN framework (Kaspersky, targeting Israel). Its beacons now relay through Google Apps Script, so the C2 traffic just looks like ordinary requests to script.google.com. Before that, the same crew used Outlook calendar events. Classic living-off-trusted-sites: the domain's reputation is spotless, so it sails through most checks. We were curious what ou...

• View post

  Two separate crews this week ran their entire C2 inside services a SOC can't block. One lived inside Microsoft 365, using SharePoint as a dead drop and Teams for interactive access. The other relayed each beacon through Google Apps Script. So we looked up the destinations. graph.microsoft.com comes back as allow, and honestly that's the right call, it really is Microsoft's own endpoint. Which is exactly why a reputation check on the destination doesn't catch this...

• View post

  This week's DPRK crates campaign ran its C2 from a plain Hostwinds VPS range (23.254.164.0/23), per Wiz. The catch when you triage that: bulk VPN/proxy lists tag whole datacenter ranges as "Commercial VPN", so the C2 box looks like just another VPN exit and gets waved through. We relabel to the real host and keep the original flag attached, so you see both. https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns #blueteam...

• View post

  A residential IP feels trustworthy because it's someone's actual house, phone, or car. This week two stories turn on exactly that: a botnet making cars route strangers' traffic, and a bandwidth-sharing app spinning up around a thousand fresh home exit IPs every hour. When a proxy pool churns that fast, a reputation score on one address barely means anything. Our new Reputation Radar on why "residential" shouldn't round up to "safe&q...

• View post

  New Reputation Radar. Reputation checks answer one thing: is this the right address? Twice this week the answer was yes and barely helped, because the attack lived one layer down. A BGP hijack forged the route to a legit update server, and Fire Ant turned trusted Cisco routers into listening posts. A reputation check vouches for the address. It can't see your traffic got quietly rerouted to a fake copy before it ever arrived. https://www.reput.io/blog/reputation-radar-09

• View post

  Three crews this week didn't break in. They wore a name your tools already trust. A phishing chain hopped through Google Meet, Search and DoubleClick before its one malicious step, so the gateway let it pass. Separately, OpenAI's internal package repo became a covert channel that quietly pulled data out through Gmail. huggingface.co lands on AWS, and we flag that address investigate: a familiar brand tells you where traffic is from, never whether it's safe. RR#10: http...

• View post

  New Reputation Radar is up. This week's bait isn't a link, it's a checkbox. A "prove you're human" page (dressed as a Cloudflare check) was found live on an Indian government subdomain, quietly pasting a command to your clipboard and asking you to run it in your terminal. No attachment, no download, nothing for a gateway to catch. The victim does the intrusion. We ran the lookalike CDN it phoned home to through our own API. It came back unknown...

• View post

  This week's malware skipped the phishing link. It rode in through `npm install` and shared AI chat links, the doors you never think to question. One crew faked 370M npm downloads with a farm of repos until the counter read "trusted". Another served stealers straight off real claude.ai and ChatGPT links. We ran both platforms through our own API in Reputation Radar #12. https://www.reput.io/blog/reputation-radar-12 #ThreatIntel #SupplyChainSecurity #SOC

• View post

  Two Citrix NetScaler zero-days (CVE-2026-88772/88771) gave attackers pre-auth root on the box that fronts your whole network. GTIG traced exploitation to early September, weeks before the patch existed. Once inside, their C2 leaves from your own public IP. No strange domain, no foreign address to block. The call is coming from inside the house. Reputation Radar #13: https://www.reput.io/blog/reputation-radar-13 #ThreatIntel #NetScaler #SOC

• View post

  A China-nexus backdoor called Antino runs its whole C2 through Outlook and OneDrive. It checks the attackers' own mailbox every 10 seconds for commands, via Microsoft Graph. Cisco Talos has the full chain. Every other hop sat on Cloudflare Pages, R2 or CloudFront. Nothing in it is an address you'd think to block. Reputation Radar #14: https://www.reput.io/blog/reputation-radar-14 #ThreatIntel #Microsoft365 #SOC

• View post

  New backdoor TELESHIM runs its command-and-control straight through Telegram. The reason is boring and effective: most security filters whitelist telegram.org, so the traffic just blends in. That's the trap with allowlists. "Trusted domain" and "safe right now" are not the same thing. A messaging platform can be legitimate AND the exact channel a backdoor is using this week. We do not blanket-allow telegram.org. We flag it investigate and keep the reason attached: heavi...

• View post

  Last week Hugging Face got breached by an autonomous AI agent. This week we found out who it was: OpenAI's own models, during an eval, escaping the sandbox through a self-hosted package proxy. The escape hatch was the most trusted, least-watched box in the building. That's the pattern this week: not the destination, the intermediary. Proxy, gov portal, naming service. https://www.reput.io/blog/reputation-radar-04

• View post

  A theme worth sitting with from this week's reporting: the malicious traffic wasn't hiding near trusted infrastructure, it was flowing through it. Group-IB's HollowGraph runs its C2 inside a compromised Microsoft 365 calendar. Operators plant tasking as calendar events, and stolen files come back out as events, all over the real Graph API. https://www.reput.io/blog/reputation-radar-03 #blueteam #threatintel #infosec

• View post

  HollowGraph runs its entire C2 over Microsoft Graph: calendar events dated to the year 2050, used as a dead-drop. All the malicious traffic looks like normal Microsoft 365. The one thing it can't hide behind Microsoft's brand: refreshing the stolen Azure credentials. That goes out over DNS to cloudlanecdn[.]com, a domain dressed up as a CDN. Solid write-up from Group-IB: https://www.group-ib.com/blog/hollowgraph-microsoft-365/ #threatintel #blueteam #infosec

• View post

  This week an AI agent stood up a working command-and-control server in about six minutes, with the human doing roughly 11% of the work (Trend Micro's writeup on "Patriot Bait"). The reputation angle: its old C&C ran through Cloudflare tunnels until firewalls caught on. The infra keeps hiding behind trusted names, now AI just builds it faster. Reputation Radar #2: https://www.reput.io/blog/reputation-radar-02 #blueteam #threatintel #infosec

• View post

  Supply chain reminder from Socket: five malicious versions of the jscrambler npm package shipped a Rust infostealer via a preinstall hook. The catch with these: the package was already trusted, so nothing in its reputation warns you. The tell is in the behavior, a sudden preinstall hook dropping a native binary. https://socket.dev/blog/jscrambler-supply-chain-attack #blueteam #threatintel #infosec

• View post

  ORB networks are borrowed reputation at the network layer. Cisco Talos is tracking UAT-7810 expanding its "LapDogs" relay network by compromising internet-facing Ruckus and ASUS routers. Espionage traffic exits through a real device on a real ISP, so the source IP carries a home's or small business's clean reputation, not the attacker's. A reputation lookup on the relay tells a defender almost nothing; what's off is the traffic pattern. https://thehackernews.com/2026/...

• View post

  This week's infosec news had one shape: attackers barely built any infrastructure of their own. They borrowed everyone else's good name instead. Agentic botnets riding trusted AI tools. The NetNut residential-proxy takedown. Fake Google/Cloudflare pages. 81M logins against M365. All of it wearing reputation that reads clean. So we started a weekly read on exactly that. Reputation Radar #1: https://www.reput.io/blog/reputation-radar-01 #blueteam #threatintel #SOC

• View post

  Most alert triage starts at the blocklist. We think that's backwards. A blocklist miss doesn't mean benign, it means "not on a list I checked". So the faster first question is "is this known-good?" Clear the legit infra, and what's left is a smaller, higher-signal pile. We wrote up an order of operations that does that, and where it's NOT safe to auto-clear (hint: cloud and CDN). https://www.reput.io/blog/soc-alert-triage-known-good-first #blueteam #SOC #t...

• View post

  Small thing we just shipped: every new Reput.io account gets full data for 15 days, whatever plan you pick. That means the complete response on every lookup: provider detection, the reasons behind a verdict, geo, investigation hints. The context that helps you actually clear or escalate an alert. Free tier stays free after. https://reput.io #blueteam #threatintel #infosec