CVE-2026-61500: Rejetto HFS Authentication Bypass and Unauthenticated RCE Actively Exploited — Detection and Remediation Guide

---
title: Rejetto HFS Spawning Shell or Script Interpreter
description: Detects hfs.exe spawning command shells or script interpreters, a strong indicator of post-exploitation activity following CVE-2026-61500 unauthenticated RCE.
references:
  - https://securityaffairs.com/200444/ai/anthropic-mythos-found-a-bug-in-rejetto-hfs-attackers-are-now-exploiting-it.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
id: 8f2a1b3c-4d5e-6f70-8192-a3b4c5d6e7f8
status: experimental
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\hfs.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - HFS event scripts configured by administrators to run on upload/download events
level: critical
---
title: Rejetto HFS Spawning Download or LOLBin Utility
description: Detects hfs.exe spawning living-off-the-land binaries commonly used by attackers to fetch second-stage payloads after exploiting CVE-2026-61500.
references:
  - https://securityaffairs.com/200444/ai/anthropic-mythos-found-a-bug-in-rejetto-hfs-attackers-are-now-exploiting-it.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
id: 2c7e9d41-5a6b-47c8-9d0e-b1f2a3c4d5e6
status: experimental
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\hfs.exe'
  selection_child:
    Image|endswith:
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate HFS event scripting (rare; validate against configured event scripts)
level: high
---
title: Rejetto HFS Execution from Non-Standard or Temporary Path
description: Detects hfs.exe running from user-writable or temporary directories, indicating unauthorized or attacker-deployed instances of the file server.
references:
  - https://securityaffairs.com/200444/ai/anthropic-mythos-found-a-bug-in-rejetto-hfs-attackers-are-now-exploiting-it.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
id: 5d3b8f62-7e1a-49c5-b2d4-e6f7a8b9c0d1
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\hfs.exe'
  selection_paths:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Downloads\'
      - '\Desktop\'
  condition: selection and selection_paths
falsepositives:
  - Users legitimately running portable HFS from Downloads or Desktop (this itself is a policy violation worth surfacing)
level: medium

// Hunt 1: HFS spawning child processes (post-exploitation indicator for CVE-2026-61500)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "hfs.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
                      "mshta.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "rundll32.exe",
                      "regsvr32.exe", "msiexec.exe", "wmic.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc

// Hunt 2: Discover HFS instances receiving inbound connections (shadow IT / exposure discovery)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "hfs.exe"
| where ActionType == "InboundConnectionAccepted" or (ActionType == "ConnectionSuccess" and LocalPort in (80, 443, 8080, 8081, 8000))
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            RemoteIPs = make_set(RemoteIP), Ports = make_set(LocalPort)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by LastSeen desc

// Hunt 3: Syslog ingestion path for Linux-hosted HFS (Node.js) spawning shells
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has_any ("node", "hfs")
| where SyslogMessage has_any ("sh -c", "/bin/bash", "/bin/sh", "curl ", "wget ", "chmod +x")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Inventory HFS instances and identify suspicious child processes (CVE-2026-61500 hunt)
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       (SELECT Name FROM pslist(pid=Ppid)) AS ParentName,
       (SELECT Exe FROM pslist(pid=Ppid)) AS ParentExe
FROM pslist()
WHERE Name =~ '(?i)hfs\.exe'
   OR ParentExe =~ '(?i)hfs\.exe'

-- Additionally enumerate listening ports owned by hfs.exe to confirm exposure
SELECT Pid,
       Name,
       CommandLine,
       (SELECT Address, Port, Status FROM netstat(pid=Pid)) AS ListeningSockets
FROM pslist()
WHERE Name =~ '(?i)hfs\.exe'

# CVE-2026-61500 - Rejetto HFS Emergency Response Script
# Run elevated. Captures evidence, stops vulnerable instances, applies interim firewall block.

# --- Step 1: Discover and document running HFS instances ---
$hfsProcesses = Get-Process -Name "hfs" -ErrorAction SilentlyContinue
if ($hfsProcesses) {
    $evidencePath = "$env:ProgramData\HFS_IR_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
    New-Item -ItemType Directory -Path $evidencePath -Force | Out-Null
    $hfsProcesses | ForEach-Object {
        $_ | Select-Object Id, ProcessName, Path, StartTime |
            Export-Csv "$evidencePath\hfs_instances.csv" -NoTypeInformation -Append
        # Capture child processes for IR review BEFORE stopping
        Get-CimInstance Win32_Process -Filter "ParentProcessId=$($_.Id)" |
            Select-Object ProcessId, Name, CommandLine, CreationDate |
            Export-Csv "$evidencePath\hfs_child_processes.csv" -NoTypeInformation -Append
    }
    Write-Host "[+] Evidence captured to $evidencePath" -ForegroundColor Green

    # --- Step 2: Stop vulnerable HFS instances ---
    $hfsProcesses | Stop-Process -Force
    Write-Host "[+] Stopped $($hfsProcesses.Count) HFS instance(s)." -ForegroundColor Yellow
} else {
    Write-Host "[-] No running HFS instances found on this host." -ForegroundColor Cyan
}

# --- Step 3: Interim firewall block on common HFS ports (until patched version deployed) ---
$ruleName = "BLOCK-HFS-CVE-2026-61500"
if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -DisplayName $ruleName -Direction Inbound -Action Block `
        -Program "*\hfs.exe" -Protocol TCP -Profile Any | Out-Null
    Write-Host "[+] Firewall rule '$ruleName' applied: inbound traffic to hfs.exe blocked." -ForegroundColor Yellow
}

# --- Step 4: Check for persistence mechanisms referencing hfs.exe ---
$autoruns = Get-CimInstance Win32_StartupCommand | Where-Object { $_.Command -match 'hfs\.exe' }
$services = Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'hfs\.exe' }
$tasks    = Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'hfs\.exe' }
if ($autoruns -or $services -or $tasks) {
    Write-Host "[!] HFS persistence mechanisms found - investigate before re-enabling:" -ForegroundColor Red
    $autoruns | Format-Table Name, Command, Location
    $services | Format-Table Name, PathName, StartMode
    $tasks    | Format-Table TaskName, TaskPath
}

# --- Step 5: Verify patched version after upgrade ---
# After deploying the patched HFS release from https://github.com/rejetto/hfs/releases,
# confirm the version and remove the interim block:
#   Get-Item "C:\path\to\hfs.exe" | Select-Object -ExpandProperty VersionInfo
#   Remove-NetFirewallRule -DisplayName "BLOCK-HFS-CVE-2026-61500"