Telekom Security Updates
Latest Update
Tracking Hermes: The Infrastructure of a New Stealer in Its First Weeks
The Hermes stealer went on sale on 21 August. The first backend servers appeared in the first week of September, and within the following three weeks, half of the servers in our later census had been set up. Public lists took longer to catch up: ThreatFox f...
Read the analysis
-
Honeypot Observations on PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell)
On 21 October 2026, the PHP project disclosed two critical vulnerabilities in PHP core, dubbed “php2shell”. We went through a week of our honeypot data to see who came knocking. The short answer: many checkers, some fuzzing, and a single...
Continue Reading -
HelixFix: ClickFix Through the Helix Ultimate Mega-Menu
A ClickFix alert in our SOC led to a campaign that injects Joomla sites through a Helix Ultimate mega-menu flaw. We tracked 89 domains and 2,580 compromised sites and found that the registration second, not the domain name, is what makes...
Continue Reading -
Beyond the Binary: Hunting VS Code Tunnel Abuse
Executive Summary IDE tunneling (T1219.001) gives an intruder an interactive command-and-control channel from a stock, Microsoft-signed Visual Studio Code binary, over a Microsoft-owned relay, authenticated to an attacker’s GitHub accou...
Continue Reading -
systemchk - DACH-Targeted VPN Credential Theft Toolkit
DescriptionThe analyzed archive contains a toolkit built to steal VPN credentials from enterprise endpoints. It covers twelve VPN products including Cisco AnyConnect, FortiClient, Palo Alto GlobalProtect, and Sophos. The attacker does no...
Continue Reading -
ABRTraryRoot: Local privilege escalation in Red Hat distributions
A chain of five bugs in ABRT allows any unprivileged local user to write attacker-controlled content into the root crontab, resulting in arbitrary command execution as root.We call the vulnerability chain “ABRTraryRoot” because it abuses...
Continue Reading -
From Infected Zyxel to Exposed C2: A Case Study in IoT Botnet Operations
This report documents the identification of previously concealed operational infrastructure, including an exposed operator working directory and command-and-control (C2) environment, following the investigation of low-volume authenticati...
Continue Reading -
SetRootLanguage: Local privilege escalation in Ubuntu via AccountsService
A two-bug chain in Ubuntu’s AccountsService language update path allows any local user to obtain local root access. We call the vulnerability chain “SetRootLanguage” because a single call to the SetLanguage D-Bus method is all it takes t...
Continue Reading