From 409eddf28eee11ccf10df6a47e800ecc7f3116f8 Mon Sep 17 00:00:00 2001 From: Jonathan Peters <143413578+cod3nym@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:42:06 +0200 Subject: [PATCH 1/5] Create apt_virtualizor_compromise_aug26.yar --- yara/apt_virtualizor_compromise_aug26.yar | 41 +++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 yara/apt_virtualizor_compromise_aug26.yar diff --git a/yara/apt_virtualizor_compromise_aug26.yar b/yara/apt_virtualizor_compromise_aug26.yar new file mode 100644 index 00000000..fcc8e9ee --- /dev/null +++ b/yara/apt_virtualizor_compromise_aug26.yar @@ -0,0 +1,41 @@ +rule APT_Virtualizor_Compromise_ForensicArtifacts_Aug26 { + meta: + description = "Detects forensic artifacts found in a campaign against compromised hosting providers using Virtualizor software" + author = "Florian Roth" + date = "2026-08-31" + reference = "https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1" + score = 75 + hash = "b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7" + strings: + $x1 = "AAAAC3NzaC1lZDI1NTE5AAAAIP13pPAm5jmInLQYD3XNb3HwrW4cAKDcphoT4kSKrnte" + $x2 = "/tmp/.vz_svc_done" + $x3 = "/tmp/widdow.jar" + $x4 = "31.77.220.138:2025" // Java connection + + $sa1 = "proxyuser" + $sb1 = "193.32.127.248" + condition: + filesize < 5MB + and ( + 1 of ($x*) + or all of ($s*) + ) +} + +rule APT_Virtualizor_Compromise_Payload_Aug26 { + meta: + description = "Detects java based payload used in a campaign against compromised hosting providers using Virtualizor software" + author = "Jonathan Peters (cod3nym)" + date = "2026-08-31" + reference = "https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1" + hash = "b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7" + score = 80 + strings: + $s1 = "net/ikvm/clientvds/stresser/methods/impl/l4/minecraft/protocollib/" ascii + $s2 = "oshi/util/VirtualizationDetector" ascii + $s3 = "META-INF/proguard/base.proUT" ascii + condition: + uint16(0) == 0x4b50 + and filesize < 20MB + and all of them +} From 58502f19ef0dc01749312c7a6425ad3e24979ebf Mon Sep 17 00:00:00 2001 From: Jonathan Peters <143413578+cod3nym@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:43:40 +0200 Subject: [PATCH 2/5] add c2 icos for virtualizor compromise --- iocs/c2-iocs.txt | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/iocs/c2-iocs.txt b/iocs/c2-iocs.txt index d191c025..d289c2c2 100644 --- a/iocs/c2-iocs.txt +++ b/iocs/c2-iocs.txt @@ -1931,4 +1931,8 @@ ebix.portal-career.com ebix-exam.com ebix.recruitment-flow.com +# Virtualizer Compromise IOCs https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1 +cdn.nerat.cc;90 +connect.ne-rat.xyz;90 + # Last Line From 45d92e19b243c140d2a95dc2724346539f7e5225 Mon Sep 17 00:00:00 2001 From: Jonathan Peters <143413578+cod3nym@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:45:07 +0200 Subject: [PATCH 3/5] add filename iocs for virtualizor compromise --- iocs/filename-iocs.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/iocs/filename-iocs.txt b/iocs/filename-iocs.txt index 1048d16b..47c0cc99 100644 --- a/iocs/filename-iocs.txt +++ b/iocs/filename-iocs.txt @@ -4583,4 +4583,9 @@ C:\\ProgramData\\Microsoft\\mcrypto\.chiper;85 \\2FAGuard\\main\.dll;85 \\2FAGuard\\setup\.exe\.config;85 +# Virtualizor Compromise IOCs https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1 +/tmp/widdow\.jar;75 +/tmp/\.vz_svc_done;75 +/etc/systemd/system/java\-jre\-update\.service;75 + # End From 315caa47d4149af90f3a8893e35eeb8da06efabf Mon Sep 17 00:00:00 2001 From: Jonathan Peters <143413578+cod3nym@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:46:26 +0200 Subject: [PATCH 4/5] add hash iocs for virtualizor compromise --- iocs/hash-iocs.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/iocs/hash-iocs.txt b/iocs/hash-iocs.txt index 8071c8e1..98619a18 100644 --- a/iocs/hash-iocs.txt +++ b/iocs/hash-iocs.txt @@ -3376,3 +3376,5 @@ aea55e42c4436236278e5692d3dcbcbe5fe6ce0b;DAEMON Tools Lite supplychain compromis 2d4eb55b01f59c62c6de9aacba9b47267d398fe4;DAEMON Tools Lite supplychain compromise IOCs https://securelist.com/tr/daemon-tools-backdoor/119654/ 9dbfc23ebf36b3c0b56d2f93116abb32656c42e4;DAEMON Tools Lite supplychain compromise IOCs https://securelist.com/tr/daemon-tools-backdoor/119654/ 295ce86226b933e7262c2ce4b36bdd6c389aaaef;DAEMON Tools Lite supplychain compromise IOCs https://securelist.com/tr/daemon-tools-backdoor/119654/ + +b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7;Virtualizor Compromise IOCs https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1 From aa48c8ae4a4aeaeae537fb8682991709d1a28022 Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Mon, 31 Aug 2026 21:44:03 +0200 Subject: [PATCH 5/5] Update yara/apt_virtualizor_compromise_aug26.yar Co-authored-by: Mohamed Ashraf <47338567+X-Junior@users.noreply.github.com> --- yara/apt_virtualizor_compromise_aug26.yar | 1 - 1 file changed, 1 deletion(-) diff --git a/yara/apt_virtualizor_compromise_aug26.yar b/yara/apt_virtualizor_compromise_aug26.yar index fcc8e9ee..d4545091 100644 --- a/yara/apt_virtualizor_compromise_aug26.yar +++ b/yara/apt_virtualizor_compromise_aug26.yar @@ -5,7 +5,6 @@ rule APT_Virtualizor_Compromise_ForensicArtifacts_Aug26 { date = "2026-08-31" reference = "https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1" score = 75 - hash = "b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7" strings: $x1 = "AAAAC3NzaC1lZDI1NTE5AAAAIP13pPAm5jmInLQYD3XNb3HwrW4cAKDcphoT4kSKrnte" $x2 = "/tmp/.vz_svc_done"