DISCARDED: Tales From the Threat Research Trenches

Send us fan mail!
Hello to all our cybernauts!
This week Selena is joined by not one, not two, but three guests — Mark Kelly, Julia Paluch, and Dave Galazin — to unpack Proofpoint's latest research. Mark walks through how it started: on August 28, the China-aligned actor TA412 (aka Violet Typhoon), previously known mostly for device registration phishing, suddenly began delivering a Chrome exploit — kicking off a frantic cross-team investigation involving partners at Google and Microsoft. Within days, three more state-sponsored clusters adopted the same exploit chain, dubbed BlueMoon; by the time the blog published, that number had grown to seven distinct clusters, plus an eCrime actor and a brand-new espionage group picking it up since.
Julia breaks down the Chrome half of the chain — a type confusion bug in the V8 engine chained with a sandbox escape — and introduces the concept of the "patch gap": the roughly four-week window between when a fix is committed to the public Chromium codebase and when it's fully rolled out to stable Chrome releases. During that window, the regression test accompanying the fix effectively doubles as a roadmap for building an exploit, especially with an LLM doing the heavy lifting of interpreting it.
Dave then covers the Windows half: a kernel heap bug that lets an attacker escalate from Chrome's heavily sandboxed, untrusted-integrity renderer process straight to full privileges — without needing any file system access first. He and Mark also make the case that this particular Windows exploit had likely been sitting unused for over a year, based on consistent compilation timestamps across the payload's debug information.
Selena, Mark, Julia, and Dave also dig into:
Why the deployment looked rushed: exploit kits full of debug logging and comments, a downloader left behind indefinitely, and a Windows exploit that doesn't even check what OS the victim is running
Historical precedent for this kind of rapid multi-actor tool sharing among Chinese threat actors, including 2021's ProxyLogon and 2025's ToolShell activity
Evidence pointing toward AI-assisted exploit development — including leftover debugging comments and variable names lifted straight from the public regression test
Whether the open-source community's transparency (public commits, public regression tests) needs to change in light of this kind of patch-gap weaponization
Why Windows zero-days are much rarer to find "on the shelf" than browser bugs, and what that implies about how this one got used
Practical defensive takeaways: post-exploitation detection still matters most, since noisy, AI-assisted tradecraft is easier to catch than the initial exploit itself
Plus: a very enthusiastic Chrome-tab-hoarding discussion, Julia's advice to enable Chrome crash reporting, and a well-earned round of "you need a vacation, Mark."
Resources Mentioned:
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days


https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880

For more information about Proofpoint, check out our website.

Send us fan mail!
Hello to our Cyber Pals! 
This week, Selena hands the mic over to a recording of Proofpoint's Intercepted webinar — a monthly video series she co-hosts with Sarah Sabotka — for a deep dive into how cloud brute force attacks are quietly getting more sophisticated. Joining Sarah and webinar host Jason is Rachel Rabin, a threat researcher on Proofpoint's Cloud Threat Research Team, to unpack two spoofing techniques she's seen increasingly weaponized against Microsoft Entra ID environments.
Rachel opens with the state of brute forcing today: despite flashier techniques like device code phishing and MFA-resistant phishing kits, brute force remains the most common identity attack vector, with 99% of tenants experiencing some form of it in 2026 — even though success rates typically sit well under 1%. She walks through why first-party Microsoft apps like Azure CLI and Azure AD PowerShell remain the most heavily targeted (publicly known client IDs, gaps in MFA enforcement, and pre-consented scopes), and why the legacy ROPC authentication flow makes credential testing so convenient for attackers.
From there, Rachel breaks down two techniques that "level up" traditional brute forcing:
User agent spoofing, illustrated by a campaign (later tracked as UNK_CustomCloak) that hit Windows Live Custom Domains — a legacy, discontinued Microsoft app — impacting half a million users across 4,000 tenants using over 600,000 IP addresses and a staggering 7.4 million unique, machine-generated user agent strings.
OAuth client ID spoofing, a newer and stealthier technique where attackers submit a syntactically valid but fake client ID to infer whether a password is correct from Entra's error codes, without ever generating a successful sign-in event that would normally tip off defenders. Rachel compares two real-world campaigns (UNK_pyreq2323 and UNK_OutFlareAZ) that appear to have arrived at the technique independently.
Sarah, Jason, and the live chat also dig into:
Why over-engineering a spoofed user agent can make an attacker easier to spot, not harder
How conditional access policies scoped to the wrong signal (like operating system) can be silently bypassed by a spoofed user agent
Why a failed sign-in shouldn't be dismissed as a non-event. It can still mean a credential has been validated
Rachel's practical, "lowest hanging fruit" recommendations: MFA, blocking legacy authentication, layered conditional access, smart lockout policies, and the shift toward passkeys
Plus: a shoutout to next month's session on fraud and job scams ahead of Cybersecurity Awareness Month.
Resources Mentioned:
OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration — Proofpoint

Send us fan mail!
Hello to all our cyber stars!
Host Selena Larson is joined by co-host Sarah Sabotka, along with returning guest Greg Lesnewich, Principal Threat Research Engineer, and Staff Threat Researcher Mark Kelly, for a follow-up to last episode's half-click deep dive — this time tracking how the technique is spreading beyond TA458 and TA488 into a brand-new Chinese cluster.
Greg picks up where last week left off with TA488 (aka Void Blizzard, aka Laundry Bear): after going quiet in February following exposure, the group resurfaced on July 22 — one day before Proofpoint's joint advisory with the NSA — with a new half-click exploit against Microsoft Outlook Web Access. The payload, a previously unseen browser-resident implant called OWAReaper, is built for persistence: it survives credential rotation, browser restarts, and even a full device reimage, and it phones home via GitHub commit messages and image requests proxied through legitimate CDNs like Slack and WordPress.
Mark then brings a new actor into the half-click conversation: UNK_MassTraction, a suspected China-aligned cluster exploiting a cross-site scripting flaw in Roundcube to target physics and engineering departments at North American universities — chosen, it turns out, specifically because they were running vulnerable Roundcube instances. The infection chain drops either a webshell or VShell, a Linux backdoor of murky, possibly commercially-developed origin that keeps popping up across Chinese state-sponsored intrusions.
The conversation covers:
How OWAReaper's persistence differs from anything Greg's seen before — including "poisoning" a user's other emails to reinfect the browser on every new tab
Why Greg's assessment of TA488 shifted from "less capable than TA458" to "neck and neck" after seeing this campaign
How Mark and Greg discovered UNK_MassTraction independently, within hours of each other
Why UNK_MassTraction's targets were all running vulnerable Roundcube — evidence of deliberate reconnaissance, not spray-and-pray
IceCube, the Roundcube stealer with telltale signs of LLM-assisted development
Why mail servers are functionally edge devices, and what that means for defenders who can't run EDR on them
Whether AI is accelerating adversary tradecraft on both the Russian and Chinese sides
The ethics of publishing offensive research on a live, evolving technique
The funniest (and most unsettling) lure email of the year: "Hi fellow, I really liked your vibe..."
Plus: Gus the dog's podcast debut, security awareness training in a world where opening an email can be enough, and shoutouts to Tom Lancaster (Volexity) and Microsoft's patch team.
Resources Mentioned:
Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit
TA488 Targets Zimbra Mailservers with Half-Click Exploits
One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation
For more information about Proofpoint, check out our website.
Subscribe & Follow:
Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail!
Hello to all our cyber roosters!
Host Selena Larson is joined by co-host Sarah Sabatka and returning guest Greg Lesnewich, Principal Threat Researcher at Proofpoint, to unpack two new reports on Russian aligned espionage actors abusing “half-click” exploits, which are vulnerabilities that compromise a target the moment they open an email in a vulnerable webmail viewer, no link or attachment required.
Greg breaks down the two distinct actors covered in Proofpoint's research: TA458, a mature, well-resourced group active across multiple webmail platforms (Zimbra, MDaemon, Roundcube, SOGo, and Horde) primarily targeting Ukraine, Eastern Europe, and militaries/ministries of foreign affairs; and TA488 (aka Void Blizzard, aka Laundry Bear), a comparatively scrappier contractor operation that leaned on a single Zimbra zero-day dubbed “ZimReaper” to steal credentials, full mailboxes, and up to 90 days of email history from Ukrainian government and U.S. targets.
The conversation covers how the half-click technique works under the hood (stored cross-site scripting via mishandled JavaScript event handlers in webmail HTML), how it differs from traditional phishing, the evidence pointing to a possible link between TA458 and GRU Unit 20728, why TA488's contractor status may explain its skittishness (burning down infrastructure after being outed) versus TA458's higher risk tolerance (including repeatedly firing exploits at targets that weren't even running vulnerable software), and what defenders running Zimbra, Roundcube, or similar platforms can actually do about it.
Resources Mentioned:
https://www.proofpoint.com/us/blog/threat-insight/ta458-roundpress-exploits
https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits
For more information about Proofpoint, check out our website.
Subscribe & Follow:
Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail!
Hello to all our Cyber Pals!
Host Selena Larson is joined by Golo Mühr, Malware Reverse Engineer, X-Force Threat Intelligence and Kyle Cucci (Staff Threat Researcher, Proofpoint) to break down the joint research that helped power a major Operation Endgame disruption. 
Coordinated by Europol, the operation hit 66 domains and 296 servers tied to StealC and its close cousin Amadey, and led to the seizure of more than 25.6 million unique credentials stolen from over 385,000 compromised sites.

In this episode, Golo and Kyle take us inside the investigation:
How they built a custom StealC emulator to impersonate infected bots, talk to live C2 servers, and pull down real second-stage payloads
The tangled relationship between StealC and Amity, and how shared panels and configs let researchers cluster affiliates together
Why StealC sometimes delivers... more StealC (spoiler: probably not a masterplan)
A juicy case of "no honor among thieves" — evidence that one affiliate exploited a panel vulnerability to steal from other affiliates
The one confirmed instance of StealC delivering LockBit Black ransomware, caught in the wild via emulation
Why info stealers have become so attractive to threat actors compared to ransomware — lower risk, easier monetization, less law enforcement heat (until now)
What "success" actually looks like in a takedown, and why Kyle's proposed "pyramid of pain" for disruptions puts arrests at the top and infrastructure takedowns at the base
Plus: fake software downloads, sketchy YouTube game-crack links, public-private collaboration with law enforcement, and a well-earned shoutout to Proofpoint's Isaac for calling this threat over a decade ago.
Tune in for a deep dive into how threat intel teams track, emulate, and ultimately help dismantle one of the internet's most active credential-theft operations.

Resources Mentioned:

https://www.proofpoint.com/us/blog/threat-insight/stealc-you-later-proofpoint-and-ibm-x-force-support-operation-endgame

https://www.proofpoint.com/us/blog/threat-insight/threat-actors-deliver-malware-youtube-video-game-cracks

For more information about Proofpoint, check out our website.
 

Subscribe & Follow:
Stay ahead of emerging threats, and subscribe! Happy hunting!