Reput.io

Two separate crews this week ran their entire C2 inside services a SOC can't block. One lived inside Microsoft 365, using SharePoint as a dead drop and Teams for interactive access. The other relayed each beacon through Google Apps Script.

So we looked up the destinations. graph.microsoft.com comes back as allow, and honestly that's the right call, it really is Microsoft's own endpoint. Which is exactly why a reputation check on the destination doesn't catch this one. What gives it away is the behavior around the traffic: the odd Graph calls, the consent grants, the SharePoint access that doesn't fit a human.

This week's Reputation Radar, with the primary sources (Ontinue, Kaspersky Securelist):
https://www.reput.io/blog/reputation-radar-07

Espionage crews keep landing on the same trick: relay command-and-control through a service the SOC already trusts.

The latest is the CAV3RN framework (Kaspersky, targeting Israel). Its beacons now relay through Google Apps Script, so the C2 traffic just looks like ordinary requests to script.google.com. Before that, the same crew used Outlook calendar events. Classic living-off-trusted-sites: the domain's reputation is spotless, so it sails through most checks.

We were curious what our own API would say about it. It resolves to google.com and comes back as a popular Top-50K domain, the kind of "known good" that tempts you to move on. The verdict we return is still investigate, with a note that a popularity ranking says nothing about what's actually running there.

What gives CAV3RN away is the behavior around those requests, and the fact that the crew's real backend sits on plain rented VPN and proxy hosting.

Source: Kaspersky Securelist. https://securelist.com/project-cav3rn-continues/120991/

A China-nexus backdoor called Antino runs its whole C2 through Outlook and OneDrive. It checks the attackers' own mailbox every 10 seconds for commands, via Microsoft Graph. Cisco Talos has the full chain.

Every other hop sat on Cloudflare Pages, R2 or CloudFront. Nothing in it is an address you'd think to block.

Reputation Radar #14:
https://www.reput.io/blog/reputation-radar-14

#ThreatIntel #Microsoft365 #SOC

Two Citrix NetScaler zero-days (CVE-2026-88772/88771) gave attackers pre-auth root on the box that fronts your whole network. GTIG traced exploitation to early September, weeks before the patch existed.

Once inside, their C2 leaves from your own public IP. No strange domain, no foreign address to block. The call is coming from inside the house.

Reputation Radar #13:
https://www.reput.io/blog/reputation-radar-13

#ThreatIntel #NetScaler #SOC

This week's malware skipped the phishing link. It rode in through `npm install` and shared AI chat links, the doors you never think to question.

One crew faked 370M npm downloads with a farm of repos until the counter read "trusted". Another served stealers straight off real claude.ai and ChatGPT links.

We ran both platforms through our own API in Reputation Radar #12.

https://www.reput.io/blog/reputation-radar-12

#ThreatIntel #SupplyChainSecurity #SOC

New Reputation Radar is up.

This week's bait isn't a link, it's a checkbox. A "prove you're human" page (dressed as a Cloudflare check) was found live on an Indian government subdomain, quietly pasting a command to your clipboard and asking you to run it in your terminal. No attachment, no download, nothing for a gateway to catch. The victim does the intrusion.

We ran the lookalike CDN it phoned home to through our own API. It came back unknown, zero feed hits, and still: investigate. A blocklist-only defender waves that straight through.

https://reput.io/blog/reputation-radar-11

#ClickFix #ThreatIntel #InfoSec

Three crews this week didn't break in. They wore a name your tools already trust.

A phishing chain hopped through Google Meet, Search and DoubleClick before its one malicious step, so the gateway let it pass. Separately, OpenAI's internal package repo became a covert channel that quietly pulled data out through Gmail.

huggingface.co lands on AWS, and we flag that address investigate: a familiar brand tells you where traffic is from, never whether it's safe.

RR#10: https://www.reput.io/blog/reputation-radar-10

New Reputation Radar.

Reputation checks answer one thing: is this the right address? Twice this week the answer was yes and barely helped, because the attack lived one layer down.

A BGP hijack forged the route to a legit update server, and Fire Ant turned trusted Cisco routers into listening posts.

A reputation check vouches for the address. It can't see your traffic got quietly rerouted to a fake copy before it ever arrived.

https://www.reput.io/blog/reputation-radar-09

A residential IP feels trustworthy because it's someone's actual house, phone, or car. This week two stories turn on exactly that: a botnet making cars route strangers' traffic, and a bandwidth-sharing app spinning up around a thousand fresh home exit IPs every hour.

When a proxy pool churns that fast, a reputation score on one address barely means anything. Our new Reputation Radar on why "residential" shouldn't round up to "safe":

https://www.reput.io/blog/reputation-radar-08

This week's DPRK crates campaign ran its C2 from a plain Hostwinds VPS range (23.254.164.0/23), per Wiz.

The catch when you triage that: bulk VPN/proxy lists tag whole datacenter ranges as "Commercial VPN", so the C2 box looks like just another VPN exit and gets waved through.

We relabel to the real host and keep the original flag attached, so you see both.

https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns

#blueteam #threatintel #infosec