project
Executable packer whose headers were customized to obfuscate the deployed miner binary.
No evidence-backed relationships are recorded.
The patch for the last Gogs RCE validated the path parameter and never looked at where a committed symlink pointed. Wiz counted more than 700 already-compromised instances before v0.13.4 shipped.
Reality
FlexenseActivator.exe stays quiet until something answers its connectivity check. Simulating the network, rather than isolating the host harder, is what made the payload observable.
Reality
Datadog ran a post-June N4D sample and watched the agent enumerate a target's MCP tools and invoke command execution. No CVE was needed; the capability was already published.
Reality
An operator found a hidden dropper reinstalling itself every 20 minutes on his Synology NAS only because he asked why an unexplained scheduled task existed. The vendor scan reported nothing.
Reality
Wiz says attackers are using the WebDriver API's documented remote-command features to plant a modified XMRig on internet-facing Selenium Grid nodes. Authentication is off by default.
Reality