Kairos Botnet, Trojanized Claude Code Extension, Zimbra CVE-2026-73570 Exploitation, MadApe Phishing Kit, and PHP2Shell Extortion: OTX Threat Intelligence Briefing — Enterprise Detection Pack | Security Arsenal

This OTX intelligence briefing synthesizes five concurrent threat campaigns representing a spectrum of initial access vectors, persistence mechanisms, and monetization strategies observed in late October 2026. While these campaigns appear operationally distinct, they share a common thread: the exploitation of implicit trust in legitimate services, development tooling, and internet-facing infrastructure to establish footholds within enterprise environments.

The Kairos botnet represents an evolution in DDoS-for-hire infrastructure, leveraging Go's cross-platform capabilities to compromise Linux systems via Telnet with default credentials, transforming them into high-throughput attack nodes. The trojanized Claude Code extension (v2.1.313) demonstrates a sophisticated supply chain attack against developer workstations, planting persistent SSH backdoors and reverse tunnels masquerading as telemetry services. CVE-2026-73570 reveals active exploitation of Zimbra Collaboration Suite's SNMP notification path, enabling unauthenticated command injection and deployment of multiple webshell families including China Chopper, GodzillaWebShell, and Looptik. The MadApe phishing kit abuses Microsoft's legitimate Device Code authentication flow, bypassing traditional credential harvesting to gain OAuth token access to Microsoft 365 accounts. Finally, the PHP2Shell campaign attributed to operator kkkkevin777 demonstrates a post-compromise extortion operation targeting Japanese real estate and finance sectors through shared hosting credential reuse and webshell deployment.

These campaigns collectively indicate a threat landscape where attackers are increasingly: (1) targeting developer toolchains and IDE extensions as high-value access points, (2) exploiting legitimate cloud authentication flows to bypass MFA, (3) weaponizing n-day vulnerabilities in internet-facing collaboration platforms within hours of patch release, and (4) leveraging compromised shared hosting infrastructure for lateral movement across related business entities.

Threat Actor / Malware Profile

Kairos DDoS Botnet

Distribution Method: Kairos propagates via Telnet (TCP/23) exploitation, specifically targeting Linux systems with default root credentials and empty passwords. The botnet does not employ sophisticated exploitation; instead, it relies on the prevalence of misconfigured IoT devices, embedded systems, and legacy infrastructure exposed to the internet.

Payload Behavior: Written in Go, Kairos is designed for cross-architecture compatibility (x86, ARM, MIPS). Upon execution, the bot establishes hundreds to thousands of concurrent TCP connections to operator-specified targets, maintaining them with minimal keepalive bytes transmitted every few seconds. This "low-and-slow" connection exhaustion technique is designed to evade traditional volumetric DDoS detection by mimicking legitimate persistent connections while exhausting target service thread pools and connection tables.

C2 Communication: The malware communicates with C2 infrastructure to receive target specifications and attack parameters. Specific protocol details remain under analysis, but the use of Go suggests potential use of HTTP/HTTPS or custom binary protocols over TCP.

Persistence Mechanism: Persistence is achieved through standard Linux service installation or cron job creation, though specific mechanisms vary by infected system architecture.

Trojanized Claude Code Extension (Supply Chain Compromise)

Distribution Method: The legitimate Claude Code extension for Visual Studio Code (Cursor Marketplace) was compromised at version 2.1.313. A malicious 66-line loader was prepended to the legitimate extension.js file, ensuring execution upon IDE activation.

Payload Behavior: The malicious loader performs the following actions:

Adds an attacker-controlled SSH public key labeled svc-telemetry to the victim's ~/.ssh/authorized_keys file
Attempts to enable local SSH services (sshd) if not already running
Establishes a reverse SSH tunnel to attacker-controlled infrastructure, effectively bypassing firewall restrictions

Persistence Mechanism: The SSH key addition provides persistent remote access even if the malicious extension is later removed or updated. The reverse tunnel ensures outbound connectivity from the victim machine to the attacker, circumventing inbound firewall rules.

Anti-Analysis: The loader's brevity (66 lines) and placement within legitimate code make static detection challenging. The use of standard SSH protocols for C2 blends with legitimate administrative traffic.

CVE-2026-73570 Zimbra Exploitation

Vulnerability: Unauthenticated OS command injection in Zimbra Collaboration Suite's SNMP notification path. The vulnerability exists in the handling of SNMP trap messages, allowing attackers to inject arbitrary commands without authentication.

Exploitation Window: Active exploitation occurred between patch availability (July 20, 2026) and public disclosure (August 13, 2026), indicating weaponization by sophisticated actors with access to patch-diffing capabilities or insider knowledge.

Post-Exploitation: Attackers deployed multiple webshell families:

China Chopper (S0020): A lightweight, single-line webshell providing remote code execution
GodzillaWebShell: A more feature-rich webshell with encryption and plugin support
Looptik: A JSP-based webshell with file management and command execution capabilities
NeedyMantis: Additional webshell variant for redundancy

Infrastructure: Observed C2/hosting infrastructure includes psk1zim.abrdns.com and tls.psk1zim.abrdns.com.

MadApe Microsoft Device Code Phishing Kit

Attack Vector: MadApe abuses the Microsoft Device Code authentication flow (RFC 8628), designed for devices with limited input capabilities. The kit presents victims with business-themed PDF lures and fake document-sharing pages, prompting them to enter a device code on Microsoft's legitimate login page.

Technique: Unlike traditional phishing that harvests credentials directly, MadApe tricks users into authenticating to the attacker's application registration. The victim enters a code provided by the attacker, granting the attacker's application OAuth tokens with the victim's privileges. This bypasses MFA in some configurations, as the victim is technically completing a legitimate authentication flow.

Targeting: Campaigns observed targeting Israel with business-themed lures, suggesting corporate espionage or financial fraud objectives.

PHP2Shell Extortion Campaign (kkkkevin777)

Operator Profile: kkkkevin777 operates an extortion campaign targeting Japanese real estate and finance sectors.

Attack Chain:

Initial access via exploitation of PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) in web applications
Deployment of webshells on compromised staging servers (observed at 96.126.130.81)
Credential harvesting from compromised systems
Lateral movement via credential reuse across shared hosting environments
Data exfiltration (16,061 customer records observed)
Extortion demands

Infrastructure: The operator utilized exposed staging servers as operational hubs, demonstrating poor operational security that enabled researcher attribution.

IOC Analysis

The indicators provided span multiple types, each requiring specific operationalization strategies:

File Hashes (MD5, SHA1, SHA256):

Kairos: 16 indicators including ELF binaries for multiple architectures
Claude Code Extension: 3 SHA256 hashes of malicious extension.js files
Zimbra Webshells: 5 SHA256 hashes of JSP and PHP webshell variants
Operationalization: Import into EDR/XDR platforms, SIEM correlation rules, and threat intelligence platforms (TIP). Use hash-based blocking for immediate protection. For retroactive hunting, search for these hashes in forensic images and proxy logs.

Network Indicators (IPv4, Hostnames, Domains):

IPv4: 96.126.130.81 (kkkkevin777 staging server)
Hostnames: psk1zim.abrdns.com, tls.psk1zim.abrdns.com (Zimbra C2)
Domains: sucdens.com, cepoffices.com, zakosta.info, nsboards.com, adastraerrans.com, travestiilan.com, nysndigital.com, powerlivings.com (MadApe phishing infrastructure)
Operationalization: Add to firewall blocklists, DNS sinkholes, and proxy filters. Monitor DNS query logs for resolution attempts. For the MadApe domains, implement web filtering rules to block access and alert on connection attempts.

CVEs:

CVE-2026-73570 (Zimbra command injection)
CVE-2026-109618, CVE-2026-109619 (PHP2Shell)
Operationalization: Prioritize patching and vulnerability scanning. Use CVEs in vulnerability management workflows and SIEM correlation rules.

Tooling:

YARA: For hash-based detection in memory and disk
Suricata/Snort: For network-based detection of C2 traffic
Sigma: For SIEM correlation rules (provided below)
Velociraptor/OSQuery: For endpoint hunting of SSH key modifications and suspicious processes
Shodan/Censys: For identifying exposed Zimbra instances and Telnet services

Detection Engineering

Sigma Rules

YAML

---
title: Kairos Botnet Telnet Exploitation Attempt
id: 9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b
status: experimental
description: Detects Telnet authentication attempts with default or empty credentials, indicative of Kairos botnet propagation
author: Security Arsenal Threat Intelligence
date: 2026/10/31
logsource:
    category: authentication
    service: telnet
detection:
    selection:
        user|contains:
            - 'root'
        password:
            - ''
            - 'admin'
            - 'password'
            - '12345'
            - 'default'
    condition: selection
falsepositives:
    - Legitimate administrative access with default credentials (should be remediated)
level: high
tags:
    - attack.initial_access
    - attack.t1078
---
title: Suspicious SSH Authorized Keys Modification
description: Detects modification of SSH authorized_keys files, potentially indicating the trojanized Claude Code extension backdoor
id: 8f7e6d5c-4b3a-4f2e-1d0c-9b8a7f6e5d4c
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/31
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|contains:
            - '/.ssh/authorized_keys'
            - '/.ssh/authorized_keys2'
    condition: selection
falsepositives:
    - Legitimate administrative SSH key management
    - Configuration management tools (Ansible, Puppet)
level: medium
tags:
    - attack.persistence
    - attack.t1098.004
---
title: Zimbra SNMP Command Injection Exploitation
description: Detects potential exploitation of CVE-2026-73570 in Zimbra Collaboration Suite
id: 7e6d5c4b-3a2f-4e1d-0c9b-8a7f6e5d4c3b
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/31
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|contains:
            - 'snmpd'
            - 'snmptrapd'
        Image|contains:
            - '/bin/sh'
            - '/bin/bash'
            - '/usr/bin/wget'
            - '/usr/bin/curl'
            - '/usr/bin/perl'
            - '/usr/bin/python'
    condition: selection
falsepositives:
    - Legitimate SNMP monitoring scripts (rare)
level: critical
tags:
    - attack.execution
    - attack.t1059
    - cve.2026-73570

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for SSH authorized_keys modifications and suspicious network connections
let suspicious_extensions = dynamic(["18756b75afedee74bbf49832a1b1dada4961672c41d595be5c1bbe75709de927", "7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278", "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15"]);
let madape_domains = dynamic(["sucdens.com", "cepoffices.com", "zakosta.info", "nsboards.com", "adastraerrans.com", "travestiilan.com", "nysndigital.com", "powerlivings.com"]);
let zimbra_c2 = dynamic(["psk1zim.abrdns.com", "tls.psk1zim.abrdns.com"]);
let kkkkevin777_ip = "96.126.130.81";

union isfuzzy=true
    (DeviceFileEvents
    | where FolderPath has_any (".ssh/authorized_keys", ".ssh/authorized_keys2")
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend IndicatorType = "SSH_Key_Modification"),
    (DeviceNetworkEvents
    | where RemoteUrl has_any (madape_domains) or RemoteIP == kkkkevin777_ip or RemoteUrl has_any (zimbra_c2)
    | project Timestamp, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend IndicatorType = "Network_Connection"),
    (DeviceProcessEvents
    | where SHA256 has_any (suspicious_extensions)
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine
    | extend IndicatorType = "Malicious_File_Execution")
| order by Timestamp desc

PowerShell Hunt Script

PowerShell

# Security Arsenal - OTX Threat Hunt Script
# Searches for indicators from Kairos, Claude Code Extension, Zimbra, MadApe, and PHP2Shell campaigns

$ErrorActionPreference = "SilentlyContinue"
$ReportPath = ".\ThreatHunt_Report_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"

function Write-Report {
    param([string]$Message, [string]$Level = "INFO")
    $Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $LogEntry = "[$Timestamp] [$Level] $Message"
    Add-Content -Path $ReportPath -Value $LogEntry
    Write-Host $LogEntry
}

Write-Report "Starting OTX Threat Hunt..." "INFO"

# 1. Check for malicious Claude Code extension hashes
Write-Report "Checking for trojanized Claude Code extension files..." "INFO"
$MaliciousHashes = @(
    "18756b75afedee74bbf49832a1b1dada4961672c41d595be5c1bbe75709de927",
    "7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278",
    "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15"
)

$VSCodePaths = @(
    "$env:USERPROFILE\.vscode\extensions",
    "$env:USERPROFILE\.cursor\extensions",
    "$env:APPDATA\Code\User\globalStorage",
    "$env:APPDATA\Cursor\User\globalStorage"
)

foreach ($Path in $VSCodePaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Filter "extension.js" | ForEach-Object {
            $FileHash = Get-FileHash -Path $_.FullName -Algorithm SHA256
            if ($MaliciousHashes -contains $FileHash.Hash) {
                Write-Report "CRITICAL: Malicious extension found: $($_.FullName) (SHA256: $($FileHash.Hash))" "CRITICAL"
            }
        }
    }
}

# 2. Check SSH authorized_keys for suspicious keys
Write-Report "Checking SSH authorized_keys for unauthorized modifications..." "INFO"
$SSHPaths = @(
    "$env:USERPROFILE\.ssh\authorized_keys",
    "$env:USERPROFILE\.ssh\authorized_keys2",
    "C:\ProgramData\ssh\authorized_keys",
    "C:\ProgramData\ssh\authorized_keys2"
)

foreach ($SSHPath in $SSHPaths) {
    if (Test-Path $SSHPath) {
        $Content = Get-Content $SSHPath -Raw
        if ($Content -match "svc-telemetry") {
            Write-Report "CRITICAL: Suspicious SSH key 'svc-telemetry' found in $SSHPath" "CRITICAL"
        }
        # Check for recently modified keys (last 7 days)
        $FileInfo = Get-Item $SSHPath
        if ($FileInfo.LastWriteTime -gt (Get-Date).AddDays(-7)) {
            Write-Report "WARNING: SSH authorized_keys recently modified: $SSHPath (LastWrite: $($FileInfo.LastWriteTime))" "WARNING"
        }
    }
}

# 3. Check network connections to known malicious IPs/domains
Write-Report "Checking active network connections..." "INFO"
$MaliciousIPs = @("96.126.130.81")
$SuspiciousPorts = @(22, 23, 2323) # SSH, Telnet

Get-NetTCPConnection | Where-Object { $_.State -eq "Established" } | ForEach-Object {
    $RemoteIP = $_.RemoteAddress
    $RemotePort = $_.RemotePort
    
    if ($MaliciousIPs -contains $RemoteIP) {
        Write-Report "CRITICAL: Connection to known malicious IP $RemoteIP`:$RemotePort" "CRITICAL"
    }
    
    if ($SuspiciousPorts -contains $RemotePort) {
        $Process = Get-Process -Id $_.OwningProcess
        Write-Report "INFO: Connection on suspicious port $RemotePort to $RemoteIP (Process: $($Process.Name))" "INFO"
    }
}

# 4. Check for Zimbra SNMP exploitation artifacts
Write-Report "Checking for Zimbra exploitation artifacts..." "INFO"
$ZimbraPaths = @(
    "C:\zimbra",
    "C:\opt\zimbra",
    "$env:ProgramFiles\Zimbra"
)

foreach ($ZPath in $ZimbraPaths) {
    if (Test-Path $ZPath) {
        # Look for JSP webshells
        Get-ChildItem -Path $ZPath -Recurse -Include "*.jsp", "*.jspx" | ForEach-Object {
            $Content = Get-Content $_.FullName -Raw
            if ($Content -match "(China Chopper|Godzilla|Looptik|NeedyMantis|Runtime\.getRuntime|ProcessBuilder)") {
                Write-Report "CRITICAL: Potential webshell detected: $($_.FullName)" "CRITICAL"
            }
        }
    }
}

# 5. Check for Telnet server activity (Kairos propagation)
Write-Report "Checking for Telnet server activity..." "INFO"
$TelnetService = Get-Service -Name "TlntSvr" -ErrorAction SilentlyContinue
if ($TelnetService -and $TelnetService.Status -eq "Running") {
    Write-Report "WARNING: Telnet service is running. This is a security risk and may indicate Kairos botnet activity." "WARNING"
}

# Check for recent Telnet connections in event logs
$TelnetEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue | 
    Where-Object { $_.Message -match "Telnet" -or $_.Message -match "23" }
if ($TelnetEvents) {
    Write-Report "WARNING: Found $($TelnetEvents.Count) Telnet-related failed logon attempts in the last 7 days" "WARNING"
}

# 6. Check for MadApe phishing kit artifacts (OAuth consent grants)
Write-Report "Checking for suspicious OAuth application consents..." "INFO"
$OAuthPath = "HKCU:\Software\Microsoft\Office\16.0\Common\Identity\Identities"
if (Test-Path $OAuthPath) {
    Get-ChildItem $OAuthPath | ForEach-Object {
        Write-Report "INFO: Found Office identity: $($_.Name)" "INFO"
    }
}

# 7. Check for PHP2Shell indicators
Write-Report "Checking for PHP2Shell artifacts..." "INFO"
$WebPaths = @(
    "C:\inetpub\wwwroot",
    "C:\xampp\htdocs",
    "C:\wamp\www"
)

foreach ($WebPath in $WebPaths) {
    if (Test-Path $WebPath) {
        Get-ChildItem -Path $WebPath -Recurse -Include "*.php" | ForEach-Object {
            $Content = Get-Content $_.FullName -Raw
            if ($Content -match "(eval\(|assert\(|base64_decode\(|shell_exec\(|passthru\(|system\()") {
                Write-Report "WARNING: Suspicious PHP file detected: $($_.FullName)" "WARNING"
            }
        }
    }
}

Write-Report "Threat hunt completed. Review $ReportPath for details." "INFO"

Response Priorities

Immediate (0-4 hours)

Block Known IOCs:
- Add all file hashes to EDR/XDR blocklists
- Block domains sucdens.com, cepoffices.com, zakosta.info, nsboards.com, adastraerrans.com, travestiilan.com, nysndigital.com, powerlivings.com at DNS and web proxy levels
- Block IP 96.126.130.81 and hostnames psk1zim.abrdns.com, tls.psk1zim.abrdns.com at network perimeter
- Isolate any systems showing connections to these indicators
Disable Telnet:
- Audit and disable Telnet services on all Linux systems (port 23)
- Change default credentials on all IoT and embedded devices
- Implement network segmentation to restrict Telnet access
Audit SSH Keys:
- Immediately audit all ~/.ssh/authorized_keys files for unauthorized additions
- Look for keys labeled svc-telemetry or unknown keys added in the past 72 hours
- Revoke and investigate any suspicious keys
Zimbra Patching:
- Verify Zimbra Collaboration Suite is patched against CVE-2026-73570
- If unpatched, isolate Zimbra servers from the internet immediately

24 Hours

Identity Verification:
- Force password resets for all users who may have interacted with MadApe phishing pages
- Review OAuth consent grants in Azure AD/Entra ID for suspicious application permissions
- Revoke suspicious OAuth tokens and refresh tokens
- Enable MFA enforcement if not already active
Extension Audit:
- Inventory all VS Code/Cursor extensions across developer workstations
- Remove or update Claude Code extension to version 2.1.314 or later
- Scan for the malicious SHA256 hashes across all endpoints
Credential Reuse Assessment:
- Audit for credential reuse across shared hosting environments (relevant to PHP2Shell campaign)
- Reset credentials for any accounts found on compromised staging servers

1 Week

Architecture Hardening:
- Implement network segmentation to prevent lateral movement from compromised IoT devices
- Deploy application whitelisting on developer workstations to prevent unauthorized extension installation
- Implement SSH certificate authentication instead of key-based authentication where possible
- Enable SSH logging and monitoring for all key modifications
Detection Rule Deployment:
- Deploy provided Sigma rules to SIEM
- Configure KQL queries as scheduled analytics rules in Microsoft Sentinel
- Integrate PowerShell hunt script into automated response playbooks
Supply Chain Security:
- Implement extension allowlisting for VS Code/Cursor in enterprise environments
- Require code signing verification for all IDE extensions
- Establish a process for vetting and approving development tools
Threat Intelligence Integration:
- Subscribe to OTX pulses for continuous IOC updates
- Implement automated IOC ingestion into security tools
- Establish TLP:WHITE information sharing with industry peers

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Kairos Botnet, Trojanized Claude Code Extension, Zimbra CVE-2026-73570 Exploitation, MadApe Phishing Kit, and PHP2Shell Extortion: OTX Threat Intelligence Briefing — Enterprise Detection Pack