Back to Intelligence

FortiBleed, TAG-195 MaaS, & TA458 RoundPress: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
July 23, 2026
5 min read

Threat Summary

Recent OTX pulses reveal a converging threat landscape involving large-scale credential harvesting, advanced malware-as-a-service (MaaS) updates, and state-sponsored espionage leveraging zero-day vulnerabilities.

  • FortiBleed (Unknown Actor): A massive campaign targeting internet-facing FortiGate SSL VPNs. The "CyberStrike Harvester" operation utilizes CVE-2026-35616 and CVE-2026-0257 to harvest configurations, followed by credential stuffing and offline cracking using EKZ Infostealer.
  • TAG-195 (Venom Spider): Financially motivated actor upgrading their MaaS ecosystem. New families include TinyEgg (initial access), ChonkyChicken (credential theft), and TerraStealerV2. Notable for the use of WebSocket C2 (RevC2) to evade network detection.
  • TA458 (Russia-aligned/GRU): Continues Operation RoundPress, exploiting half-click XSS zero-days (CVE-2026-8496, CVE-2025-27915) in webmail platforms (SOGo, Zimbra) to deploy SpyPress and steal sensitive data from government and defense sectors in Eastern Europe.

Collectively, these campaigns indicate a shift toward automated post-exploitation frameworks and the abuse of trusted perimeter devices and communication platforms.

Threat Actor / Malware Profile

TAG-195 (Golden Chickens)

  • Malware: TinyEgg, ChonkyChicken, ChromEggscalator, TerraStealerV2, TerraLogger, RevC2.
  • Distribution: Phishing kits, malvertising, and "ClickFix" style social engineering.
  • Payload Behavior: Modular architecture. TinyEgg establishes initial access, loading plugins for browser credential theft (ChonkyChicken) or data exfiltration.
  • C2 Communication: Uses RevC2, a WebSocket-based protocol designed to blend in with legitimate web traffic, bypassing traditional firewall port inspection.
  • Anti-Analysis: Obfuscated Javascript, custom encryption for C2 payloads.

TA458 (Operation RoundPress)

  • Malware: SpyPress.
  • Distribution: Spear-phishing emails containing links exploiting XSS flaws in webmail interfaces.
  • Payload Behavior: "Half-click" exploits trigger upon email preview, executing scripts that hijack sessions or deploy malware without further user interaction.
  • Targeting: Strategic espionage against Albania, Greece, Moldova, Ukraine, and Defense sectors.

FortiBleed Actors

  • Malware: CyberStrike Harvester v1.5, EKZ Infostealer.
  • Tools: Hashcat (offline cracking).
  • Behavior: Automated pipeline harvesting SSL VPN configs, extracting credentials, and validating them via password spraying.

IOC Analysis

The provided IOCs offer immediate detection opportunities:

  1. File Hashes: SHA256 and MD5 hashes are provided for the CyberStrike Harvester, TinyEgg, and ChonkyChicken binaries. These should be blocked in EDR solutions and used to scan historical logs.
  2. Domains: Indicators like xtrafftrck.net, screenly.cam, and upgybj.store serve as C2 infrastructure or delivery sites. These should be added to DNS blocklists (RPZ) and perimeter firewall deny-lists.
  3. CVEs: Specific 2025/2026 CVEs (e.g., CVE-2026-8496, CVE-2026-35616) highlight vulnerable software requiring immediate patch validation.
  4. Operationalization: SOC teams should ingest these hashes into SIEM correlation rules for "Process Creation" events. Domains should be hunted in DeviceNetworkEvents and DnsEvents.

Detection Engineering

Sigma Rules

YAML
title: FortiBleed CyberStrike Harvester Execution
id: 8a7f9c2d-1e3b-4f5a-9b6c-3d2e1f0a9b8c
description: Detects execution of known CyberStrike Harvester and EKZ Infostealer file hashes associated with the FortiBleed campaign.
status: experimental
date: 2026/07/24
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6423847f5b9d3843847f5b9d
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\csrv.exe'
            - '\ekz.exe'
    selection_hashes:
        Hashes|contains:
            - '7f74bb6ba185978134c318bc5f91d23c'
            - '2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: critical
tags:
    - attack.credential_access
    - attack.t1003
---
title: TAG-195 C2 Infrastructure Connection
id: 9b8e0d3c-2f4a-5e6b-0c7d-4e3f2b1a0c9d
description: Detects network connections to known TAG-195 MaaS C2 domains (TinyEgg, ChonkyChicken) and WebSocket anomalies.
status: experimental
date: 2026/07/24
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6423847f5b9d3843847f5b9e
logsource:
    product: zeek
    category: http
detection:
    selection_domains:
        host|endswith:
            - 'xtrafftrck.net'
            - 'screenly.cam'
            - 'ahdaratlegalservices.com'
    selection_websocket:
        method: 'GET'
        upgrade|contains: 'websocket'
    condition: 1 of selection*
falsepositives:
    - Legitimate websocket traffic to unrelated domains
level: high
tags:
    - attack.c2
    - attack.t1071
---
title: TA458 Webmail Exploit Indicator
id: 0c9f1e4d-3g5b-6f7c-1d8e-5f4g3c2b1d0e
description: Detects outbound connections to domains associated with TA458 Operation RoundPress webmail exploits.
status: experimental
date: 2026/07/24
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6423847f5b9d3843847f5b9f
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|endswith:
            - 'upgybj.store'
            - 'xsza.net'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve-2026-8496

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender
// Hunt for TAG-195 and TA458 C2 Domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("xtrafftrck.net", "screenly.cam", "ahdaratlegalservices.com", "upgybj.store", "xsza.net")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ActionType
| extend IOCs = "TAG-195/TA458 Domain"
;

// Hunt for FortiBleed Malware Hashes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98",
    "38353f95fff270f4e3a9d7add8c64666020dd668ce66e15969a736ec48cadc59",
    "4253dd1a4c0867b0be7732f75b2f630cebfb7fed94270e15fb3b12ae40546d01",
    "6c23b7723a9f69ea48f02c8fe13fd60ecbfc2fb28e32e481c46ec968a66c66cd",
    "b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45",
    "625e4c166c7a1d5a1becf56b27d4f76a2f95935cbd8d556c30a493263d10dbf8"
)
| project Timestamp, DeviceName, AccountName,FolderPath, SHA256, ProcessCommandLine

PowerShell Hunt Script

PowerShell
# IOC Hunter for FortiBleed, TAG-195, and TA458
# Requires Admin Privileges for process/memory scanning

$MaliciousHashes = @(
    "2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98",
    "38353f95fff270f4e3a9d7add8c64666020dd668ce66e15969a736ec48cadc59",
    "4253dd1a4c0867b0be7732f75b2f630cebfb7fed94270e15fb3b12ae40546d01",
    "6c23b7723a9f69ea48f02c8fe13fd60ecbfc2fb28e32e481c46ec968a66c66cd",
    "b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45",
    "625e4c166c7a1d5a1becf56b27d4f76a2f95935cbd8d556c30a493263d10dbf8"
)

$MaliciousDomains = @(
    "xtrafftrck.net",
    "screenly.cam",
    "ahdaratlegalservices.com",
    "upgybj.store",
    "xsza.net"
)

Write-Host "[+] Scanning running processes for known malicious hashes..."
Get-Process | ForEach-Object {
    $proc = $_
    try {
        $path = $proc.Path
        if ($path -and (Test-Path $path)) {
            $hash = (Get-FileHash -Path $path -Algorithm SHA256).Hash.ToLower()
            if ($MaliciousHashes -contains $hash) {
                Write-Host "[!] MALICIOUS PROCESS DETECTED: $($proc.ProcessName) (PID: $($proc.Id)) - Path: $path" -ForegroundColor Red
            }
        }
    } catch {}
}

Write-Host "[+] Checking DNS Cache for C2 domains..."
$DnsCache = Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry.Split(".")[-2, -1] -join "." -or $_.Entry -in $MaliciousDomains }
if ($DnsCache) {
    Write-Host "[!] Suspicious DNS Entries found:" -ForegroundColor Yellow
    $DnsCache | Format-Table Name, Type, Data
} else {
    Write-Host "[-] No suspicious DNS cache entries found."
}

Write-Host "[+] Hunt Complete."

Response Priorities

  • Immediate: Block all listed domains (TAG-195, TA458) at the perimeter proxy and firewall. Initiate a hunt for the file hashes provided in the "FortiBleed" and "TAG-195" pulses.
  • 24h: If credential-stealing malware (EKZ, ChonkyChicken) is suspected, force a password reset for privileged accounts and verify MFA enrollment. Audit FortiGate SSL VPN logs for signs of "CyberStrike Harvester" exploitation or configuration harvesting.
  • 1 Week: Patch FortiOS against CVE-2026-35616 and CVE-2026-0257. Upgrade webmail platforms (SOGo, Zimbra) to mitigate TA458 half-click exploits. Review WebSocket outbound traffic policies to detect RevC2 beaconing.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-aptfortibleedtag-195ta458webmail-exploitsmaas

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action