Threat Brief — Saturday, February 15, 2026

Executive Summary

BeyondTrust CVE-2026-1731 hit CISA KEV and is actively exploited within 24 hours of PoC release—hunt for WebSocket/portal enumeration now. Microsoft disclosed a new ClickFix variant using nslookup for DNS-based payload staging that delivers ModeloRAT. Lazarus continues poisoning npm/PyPI with fake blockchain job offers.

1. BeyondTrust RS/PRA Pre-Auth RCE

🔴 Critical · Remote Code Execution · CVE-2026-1731 (CVSS 9.9) · PoC Available

Pre-authentication OS command injection in BeyondTrust Remote Support and Privileged Remote Access. Attackers abuse get_portal_info to extract x-ns-company value before establishing a WebSocket channel for RCE. WatchTowr and GreyNoise confirm in-the-wild exploitation less than 24 hours after PoC.

Sources: The Hacker News · GreyNoise

TTPs

Technique	Tactic	Observable
T1190	Initial Access	HTTP requests to `/api/client/portal_info` or similar BeyondTrust endpoints
T1059	Execution	OS command injection via crafted HTTP requests
T1071.001	C2	WebSocket connections post-exploitation

IOCs

86% of recon from single IP using commercial VPN (Frankfurt provider)
Scanning operations rapidly added CVE-2026-1731 checks to existing toolkit

Detection

Log Sources: Web server access logs, WAF, BeyondTrust application logs, network traffic

Logic:

# Hunt for portal enumeration
index=web sourcetype=access_* (uri_path="*portal_info*" OR uri_path="*get_portal*")
| stats count by src_ip, uri_path, status
| where count > 10

# WebSocket establishment post-portal query
index=network dest_port=443 (http.request.uri="*websocket*" OR tcp.flags.syn=1)
| transaction src_ip maxspan=60s
| search eventcount > 5

Existing Coverage:

None specific (gap) — generic web exploitation rules may trigger

Action

🔴 Patch immediately. If running BeyondTrust RS 21.3-25.3.1 or PRA 22.1-24.x, apply BT26-02 patches now. Hunt for portal enumeration attempts.

2. DNS-Based ClickFix Attack (ModeloRAT/Lumma Stealer)

🔴 Critical · Social Engineering + Malware Delivery · No CVE · Active Campaigns

Microsoft disclosed new ClickFix variant using nslookup against external DNS servers to retrieve payloads from TXT records. Bypasses web request monitoring by blending into DNS traffic. Delivers ModeloRAT (Python RAT) and Lumma Stealer via CastleLoader.

Sources: The Hacker News · Microsoft

TTPs

Technique	Tactic	Observable
T1204.002	Execution	User runs command via Windows Run dialog
T1059.001	Execution	`cmd.exe` → `nslookup` with hardcoded external DNS server
T1071.004	C2	DNS queries to attacker-controlled nameservers
T1059.006	Execution	Python-based ModeloRAT execution
T1547.001	Persistence	LNK file in Windows Startup folder

IOCs

azwsappdev[.]com — Payload hosting (ZIP archive)
Hardcoded external DNS servers (not system resolver)
VBScript launching ModeloRAT

Detection

Log Sources: Sysmon (ProcessCreate, NetworkConnect), DNS logs, PowerShell logs

Logic:

# Nslookup to non-standard DNS server
index=sysmon EventCode=1 Image="*nslookup.exe"
| regex CommandLine="nslookup.*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| where NOT match(CommandLine, "(8\.8\.8\.8|8\.8\.4\.4|1\.1\.1\.1)")

# CMD spawning nslookup then PowerShell
index=sysmon EventCode=1 
| transaction ParentProcessId maxspan=30s
| search Image="*cmd.exe*" Image="*nslookup.exe*" Image="*powershell.exe*"

Existing Coverage:

Nslookup PowerShell Download Cradle (Sigma) ✅
Nslookup PowerShell Download Cradle - ProcessCreation (Sigma) ✅
DNS Exfiltration Using Nslookup App (Splunk ESCU) ✅
Cisco Secure Firewall - Lumma Stealer Activity (Splunk ESCU) ✅

Action

🔴 Hunt for nslookup with external DNS. Microsoft detects as Trojan:Win32/ClickFix.R!ml. Look for LNK files in Startup folders pointing to VBScript.

3. Lazarus npm/PyPI Supply Chain Campaign

🔴 Critical · Supply Chain Compromise · No CVE · Active Since May 2025

North Korea-linked Lazarus Group poisoning npm/PyPI with 25+ malicious packages using fake blockchain recruitment (Veltrix Capital). Social engineering via LinkedIn/Facebook/Reddit job offers. Packages deploy token-authenticated RAT with file exfil capabilities.

Sources: The Hacker News · ReversingLabs

TTPs

Technique	Tactic	Observable
T1195.002	Initial Access	Malicious npm/PyPI packages as dependencies
T1566.003	Initial Access	Spearphishing via social platforms (LinkedIn, Reddit)
T1059.007	Execution	JavaScript malware disguised as *.pdf.js
T1041	Exfiltration	HTTP POST with token-based auth to C2

IOCs

Malicious npm packages: graphalgo, graphorithm, graphstruct, bigmathutils (10k+ downloads), terminal-kleur, graphflux, graphhub, graphrix

Malicious PyPI packages: graphalgo, graphex, graphlibx, bigpyx, bignum, bigmathutils

Indicators:

Fake company: Veltrix Capital
GitHub orgs with “blockchain” coding assessments
Token-based C2 authentication (Jade Sleet TTP)
MetaMask extension detection

Detection

Log Sources: Package manager logs, EDR, network traffic

Logic:

# npm/pip install of known malicious packages
index=endpoint (process="*npm*" OR process="*pip*") 
| regex CommandLine="(graphalgo|bigmathutils|graphflux|terminal-kleur|graphrix)"

# JavaScript with double extension
index=sysmon EventCode=11 TargetFilename="*.pdf.js"

# MetaMask enumeration
index=sysmon EventCode=1 CommandLine="*metamask*" CommandLine="*extension*"

Existing Coverage:

Outdated Dependency Alert Disabled (Sigma) — partial
None specific for these packages (gap)

Action

🔴 Audit dependencies. Run npm audit / pip-audit. Block or alert on packages listed above. Educate developers on fake recruiter campaigns.

4. CANFAIL Malware Targeting Ukraine

🟡 High · Espionage · No CVE · Russian-Linked APT

Google GTIG attributes CANFAIL malware to suspected Russian intelligence. Targeting Ukrainian defense, energy, government. Actor uses LLMs for reconnaissance and lure generation. Phishing impersonates Ukrainian energy orgs.

Sources: The Hacker News · Google Cloud Blog

TTPs

Technique	Tactic	Observable
T1566.002	Initial Access	Google Drive links in phishing emails
T1059.007	Execution	Obfuscated JavaScript (.pdf.js)
T1059.001	Execution	PowerShell dropper → memory-only execution
T1204.001	Execution	User executes RAR archive content
T1102	C2	WebSocket-based trojan communication

IOCs

RAR archives via Google Drive links
JavaScript files with double extension (*.pdf.js)
Fake Ukrainian energy company domains
LLM-generated phishing lures

Detection

Log Sources: Email gateway, Sysmon, PowerShell logs

Logic:

# RAR extraction followed by JS execution
index=sysmon EventCode=1 
| transaction ParentProcessId maxspan=60s
| search (Image="*WinRAR*" OR Image="*7z*") Image="*wscript*" 

# Memory-only PowerShell (no -File parameter)
index=sysmon EventCode=1 Image="*powershell.exe" 
| where NOT match(CommandLine, "-File")
| where match(CommandLine, "-e|EncodedCommand|FromBase64")

Existing Coverage:

Suspicious PowerShell Download (Sigma) ✅
Obfuscated PowerShell OneLiner Execution (Sigma) ✅

Action

🟡 Hunt if in-scope. Relevant for orgs supporting Ukraine or in defense/energy sectors. Look for Google Drive links in phishing leading to RAR→JS→PowerShell chains.

5. macOS MacSync Stealer via Claude/Google Ads

🟡 High · Info Stealer · No CVE · ClickFix Social Engineering

Campaign abuses Google Ads and Anthropic Claude artifacts to deliver MacSync stealer. 15,000+ users exposed. Uses ClickFix technique to trick users into running Terminal commands. Targets keychain, browser data, crypto wallets.

Sources: CyberPress · Moonlock Lab

TTPs

Technique	Tactic	Observable
T1583.008	Resource Dev	Malvertising via Google Ads
T1204.002	Execution	User pastes Base64 command into Terminal
T1059.002	Execution	`osascript` piped command execution
T1555	Cred Access	Keychain credential theft
T1041	Exfiltration	HTTP POST with chunked uploads

IOCs

a2abotnet[.]com/dynamic — C2 server
a2abotnet[.]com/gate — Data exfil endpoint
raxelpak[.]com — Payload hosting
apple-mac-disk-space.medium[.]com — Fake Apple article
/tmp/osalogging.zip — Staging file

Detection

Log Sources: macOS Unified Logs, EDR, network traffic

Logic:

# Curl piped to osascript
process where process.name == "osascript" and process.parent.name == "curl"

# Base64 decode in Terminal context
process where process.name == "base64" and process.args : "-d" 
  and process.parent.name in ("Terminal", "bash", "zsh")

# Network to known C2
dns.query.name : ("a2abotnet.com", "raxelpak.com")

Existing Coverage:

JXA In-memory Execution Via OSAScript (Sigma) ✅
Clipboard Data Collection Via OSAScript (Sigma) ✅
MacOS AMOS Stealer - VM Check Activity (Splunk ESCU) ✅

Action

🟡 Block IOCs at perimeter. Add a2abotnet[.]com and raxelpak[.]com to blocklists. Educate users about fake “DNS resolver” or “disk analyzer” prompts.

6. CISA KEV Additions (Feb 12-14)

🟡 High · Multiple Products · Active Exploitation

CISA added 4 vulnerabilities to KEV catalog. Notable: Notepad++ supply chain attributed to China-linked Lotus Blossom (Chrysalis backdoor).

CVE	Product	CVSS	Notes
CVE-2026-20700	Apple iOS/macOS	7.8	Memory corruption, targeted spyware delivery
CVE-2025-15556	Notepad++	7.7	Update hijack → Chrysalis backdoor (Lotus Blossom)
CVE-2025-40536	SolarWinds WHD	8.1	Auth bypass, used in lateral movement campaigns
CVE-2024-43468	Microsoft SCCM	9.8	SQL injection (patched Oct 2024, now actively exploited)

Sources: CISA KEV · SC Media

Detection

Log Sources: Endpoint telemetry, software inventory, web logs

Existing Coverage:

Notepad++ Updater DNS Query to Uncommon Domains (Sigma) ✅
Suspicious Child Process of GUP.Exe (Sigma) ✅
Windows Sqlservr Spawning Shell (Splunk ESCU) ✅

Action

🟡 Verify patch status. Federal agencies must remediate by March 5, 2026. Hunt for SolarWinds WHD exploitation if internet-exposed. Check Notepad++ update integrity.

Priority Actions

🔴 BeyondTrust CVE-2026-1731 — Patch RS/PRA immediately; hunt for get_portal_info probes
🔴 ClickFix DNS staging — Hunt for nslookup to external DNS servers followed by PowerShell
🔴 Lazarus npm/PyPI — Audit for malicious packages: graphalgo, bigmathutils, graphflux family
🟡 macOS MacSync — Block a2abotnet[.]com and raxelpak[.]com; educate users on Terminal paste attacks
🟡 CISA KEV — Verify SCCM, SolarWinds WHD, Notepad++ patch status; hunt for Chrysalis indicators