Three concurrent threat streams dominate the current OTX telemetry: (1) pre-patch leakage and immediate weaponization of two critical PHP multipart/form-data RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619; CVSS v4.0 9.2) with observed scanning roughly twenty minutes after patch release and historical overlap with Mirai/IoT botnet tradecraft and exposed open directories hosting PHP2Shell payloads; (2) a North Korea-linked intrusion set (Opal Sleet / Konni) running Operation Conflict Compass against Ukraine-focused government and NGO targets via spear-phishing ZIPs containing PDF-themed LNK lures that stage a PowerShell implant tracked as VelvetCake from GitHub-hosted payloads with scheduled-task persistence; and (3) RatHat, an Android RAT that operates beyond the application sandbox and is being exposed through Android Intrusion Logging and Delegated Scope telemetry on managed/BYOD fleets. The combined picture is an opportunistic-but-fast criminal scanning wave against PHP-heavy retail/finance/technology estates in the US, Germany, Singapore, and the UK, running in parallel with a targeted DPRK espionage/phishing operation and mobile RAT activity that evades classic app-only sandboxing. Security teams should treat PHP edge services, LNK-to-PowerShell chains, and Android network/security logs as priority detection surfaces this week.
Threat Summary
Across these pulses the common thread is initial access optimized for speed and low friction, followed by living-off-the-land execution and task-based persistence where endpoints are involved:
-
Web edge (PHP2Shell / CVE-2026-109618 & CVE-2026-109619): The bugs live in PHP core multipart/form-data parsing and are reachable via
session.upload_progresswithout authentication. That makes them ideal for mass scanning and automated exploitation against internet-facing PHP applications, including WooCommerce and Magento storefronts. The pulse notes scanning began ~20 minutes after patch release, which means exploit code and scanning lists were already staged. Historically, leaked PHP RCEs like this are rapidly folded into botnets (tags reference Mirai/IoT botnet) and into webshell dropper pipelines, frequently staged out of open directories that hostphp2shelltooling. Expect follow-on payloads: webshells, coinminers, Mirai/Gafgyt variants, and credential/config theft against e-commerce backends. -
Endpoint (Opal Sleet / Konni — Operation Conflict Compass): The actor uses spear-phishing emails with ZIP attachments containing LNK files masquerading as PDFs, themed around Russia-Ukraine peace plans and Ukrainian research. When a victim opens the shortcut, it reaches out to GitHub to retrieve additional stages and then executes a PowerShell-based malware family tracked as VelvetCake. Persistence is achieved through scheduled tasks, and the lure set is tightly aligned to Ukraine-focused government and NGO recipients. This is classic Konni/Opal Sleet tradecraft: geopolitical lures, shortcut files, trusted cloud hosting for staging, and script-based payloads to reduce static detection.
-
Mobile (RatHat Android RAT): RatHat is being surfaced via Android Intrusion Logs and Delegated Scope security/network log access rather than traditional sandbox-only inspection. The campaign emphasizes threats that operate beyond the standard app sandbox, abusing OS-level capabilities and blending into legitimate device management flows. The presence of a SHA256 sample and a hostname IOC indicates active infrastructure and at least one analyzed payload.
Collectively, defenders should assume: (a) any unpatched PHP service is already being scanned; (b) Ukraine-related NGOs and government entities are in an active DPRK phishing window; and (c) mobile fleets need OS-level telemetry, not just app reputation.
Threat Actor / Malware Profile
PHP2Shell RCE (CVE-2026-109618 / CVE-2026-109619) — Unknown Actors, Botnet-Adjacent
- Distribution method: Internet-wide scanning for PHP endpoints vulnerable to multipart/form-data corruption; exploitation via
session.upload_progresswithout authentication. Payloads and scanners have been observed in open directories on compromised or throwaway hosts. Tags reference Mirai/IoT botnet activity, suggesting automated conscription of vulnerable servers and adjacent IoT infrastructure. - Payload behavior: Post-exploitation typically drops a PHP webshell (the “PHP2Shell” pattern), executes arbitrary system commands under the web server user, and stages secondary payloads (botnet clients, miners, credential/config harvesters). On e-commerce stacks (WooCommerce/Magento), attackers prioritize database credentials, payment plugin configs, and admin panels.
- C2 communication: Varies by operator; Mirai-style traffic is characterized by rapid scanning on common service ports and hardcoded C2 IPs. The IPv4 IOCs in this pulse (89.32.41.16, 89.32.41.50, 41.223.30.7, 92.118.112.100, 104.219.251.31) should be treated as hostile scan/exploit or staging infrastructure.
- Persistence mechanism: Webshells on disk, rogue PHP files in webroot/upload directories, cron entries on Linux servers, and in some cases malicious extensions/plugins for the e-commerce platform.
- Anti-analysis techniques: Pre-patch leak minimized public signatures; use of open directories for staging rather than bespoke C2; rapid rotation of scanner IPs; exploitation that resembles legitimate multipart form uploads at the HTTP layer.
VelvetCake PowerShell Malware — Opal Sleet / Konni (Operation Conflict Compass)
- Distribution method: Spear-phishing emails carrying ZIP archives with LNK files disguised as PDFs. Lure themes are tightly targeted: Russia-Ukraine peace plans, Ukrainian research, and geopolitical topics, aimed at government and NGO recipients in or focused on Ukraine.
- Payload behavior: The LNK executes a command that retrieves additional stages from GitHub, then runs a PowerShell implant (VelvetCake). PowerShell enables in-memory execution, reconnaissance, and data theft with a small disk footprint.
- C2 communication: A hostname IOC
p1o2i3u4y5t6r7e8w9q0.medianewsonline.comis associated with the campaign. The use of legitimate services (GitHub) for staging helps blend traffic; subsequent C2 may ride HTTPS to attacker-controlled domains. - Persistence mechanism: Scheduled tasks are explicitly called out in the pulse. Expect tasks with innocuous names launching PowerShell or
rundll32/mshta-style chains at logon or on a timer. - Anti-analysis techniques: Script-based payloads, trusted hosting (GitHub) for staging, PDF-themed LNK lures to exploit user trust, and geopolitical pretexts to increase open rates in the target set.
RatHat Android RAT
- Distribution method: Not fully specified in the pulse; RatHat-style Android RATs typically spread via sideloaded APKs, malicious links, or abuse of enterprise/BYOD provisioning. The pulse emphasizes detection via Android Intrusion Logging and Delegated Scope on managed devices, indicating the malware operates with elevated or OS-level visibility rather than purely as a sandboxed app.
- Payload behavior: Remote access trojan capabilities: command execution, data collection, and control outside the normal app sandbox. Access to security and network logs suggests attempts to blend with legitimate security tooling or to tamper with telemetry.
- C2 communication: A hostname IOC
fegrs.adidasabc.comis associated with RatHat. Treat any DNS or TLS flows to this host as malicious. - Persistence mechanism: Likely abuse of device admin/accessibility services or enterprise provisioning to survive reboots and evade casual removal; on managed devices, watch for unexpected packages requesting Delegated Scope or intrusion-log access.
- Anti-analysis techniques: Operation beyond the app sandbox to frustrate app-only scanners; reliance on OS-level features; infrastructure that mimics legitimate brands at a glance (e.g., “adidasabc”).
IOC Analysis
The pulse set includes IPv4, hostname/domain, CVE, and FileHash-SHA256 indicators. Operationalize them as follows:
- IPv4 (PHP2Shell/botnet infrastructure): 89.32.41.16, 89.32.41.50, 41.223.30.7, 92.118.112.100, 104.219.251.31. Add to edge ACLs, WAF blocklists, and egress firewall deny rules. In Zeek/Suricata, alert on any connection to/from these IPs. On web servers, hunt access logs for requests immediately preceding/following connections to these IPs, especially multipart POSTs.
- Hostnames:
p1o2i3u4y5t6r7e8w9q0.medianewsonline.com(VelvetCake/Konni): sinkhole or block at DNS; hunt proxy/DNS logs for resolutions and TLS SNI matches. Given GitHub staging, also alert onpowershell.exemaking outbound connections togithub.com/raw.githubusercontent.comimmediately after an LNK execution.fegrs.adidasabc.com(RatHat): block at DNS and on mobile proxies; on Android fleets, query Intrusion Logging/network logs for this host and flag devices with connections.
- FileHash-SHA256:
bdfccc6ab3e592f6cfc47f6deb910950666fa47b5f87c6a08af7096d90e59d0f(RatHat). Add to EDR/mobile threat defense blocklists and sweep for file presence on devices and in email/web gateways. - CVEs: CVE-2026-109618, CVE-2026-109619 (PHP core), plus historical CVE-2025-55182 and CVE-2025-32975 referenced by the pulse. Prioritize emergency patching and virtual patching (WAF) for the 2026 PHP flaws; verify that older CVEs are not being chained in the same scans.
Tooling to decode/operationalize:
- Zeek/Suricata + Intel Frameworks: Load IPv4s and domains into threat intel feeds; alert on matches in
conn.log,dns.log, andhttp.log. - WAF/ModSecurity: Virtual-patch multipart/form-data parsing abuse and block POSTs that trigger PHP
session.upload_progressanomalies until PHP is patched. - Sigma/Sentinel/EDR: Detect LNK→PowerShell chains, scheduled-task persistence, and GitHub staging by PowerShell. On mobile, leverage Android Intrusion Logging and Delegated Scope security/network logs to surface RatHat behavior.
- YARA: Match the SHA256 and, if samples are available, build rules for VelvetCake PowerShell patterns and RatHat strings.
Detection Engineering
YAML
---
title: PHP2Shell RCE Exploitation via session.upload_progress Multipart Abuse
description: Detects web server process spawning shells or writing PHP files following multipart/form-data abuse consistent with CVE-2026-109618/109619 PHP2Shell exploitation and open-directory staging.
logsource:
category: process_creation
product: linux
service: null
definition: null
detection:
selection_parent_webserver:
ParentImage|endswith:
- '/php-fpm'
- '/php'
- '/apache2'
- '/httpd'
- '/nginx'
selection_child_shell:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/php'
- '/curl'
- '/wget'
- '/python'
- '/python3'
selection_suspicious_paths:
CommandLine|contains:
- 'session.upload_progress'
- 'multipart/form-data'
- '/tmp/'
- '/var/www/html/uploads/'
- 'eval('
- 'base64_decode'
- 'php2shell'
condition: selection_parent_webserver and selection_child_shell and selection_suspicious_paths
falsepositives:
- Legitimate admin scripts run under web server during maintenance
level: high
status: experimental
author: Security Arsenal
fields:
- Image
- ParentImage
- CommandLine
tags:
- attack.initial_access
- attack.t1190
- attack.t1059
- attack.t1505.003
references:
- https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
date: 2026/10/24
modified: 2026/10/24
id: 8f2a1c7e-2f3b-4c5d-9e6f-1a2b3c4d5e01
---
title: VelvetCake LNK to PowerShell GitHub Staging with Scheduled Task Persistence
description: Detects LNK-driven execution that spawns PowerShell reaching GitHub for staging and creating scheduled tasks, consistent with Opal Sleet/Konni Operation Conflict Compass delivering VelvetCake.
logsource:
category: process_creation
product: windows
service: null
definition: null
detection:
selection_lnk_parent:
ParentImage|endswith:
- '\explorer.exe'
- '\cmd.exe'
- '\rundll32.exe'
CommandLine|contains:
- '.lnk'
selection_powershell:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
selection_github_staging:
CommandLine|contains:
- 'github.com'
- 'raw.githubusercontent.com'
- 'Invoke-WebRequest'
- 'iwr'
- 'curl'
- 'DownloadString'
- 'IEX'
selection_schtasks:
CommandLine|contains:
- 'schtasks'
- '/create'
- 'Register-ScheduledTask'
condition: selection_powershell and (selection_lnk_parent or selection_github_staging) and selection_schtasks
falsepositives:
- Legitimate software deployment using GitHub and scheduled tasks by IT
level: high
status: experimental
author: Security Arsenal
fields:
- Image
- ParentImage
- CommandLine
- User
tags:
- attack.initial_access
- attack.t1566.001
- attack.t1204.002
- attack.t1059.001
- attack.t1053.005
references:
- https://cyberpress.org/konni-targets-ukraine-with-velvetcake/
date: 2026/10/24
modified: 2026/10/24
id: 9a3b4c5d-6e7f-8a9b-0c1d-2e3f4a5b6c02
---
title: RatHat Android RAT Network Beacon to Known C2 Domain
description: Detects Android or endpoint network connections to the RatHat C2 hostname fegrs.adidasabc.com or processes matching the RatHat sample hash, based on OTX intrusion logging telemetry.
logsource:
category: network_connection
product: android
service: null
definition: null
detection:
selection_domain:
DestinationHostname|contains:
- 'fegrs.adidasabc.com'
selection_hash:
Hashes|contains:
- 'SHA256=bdfccc6ab3e592f6cfc47f6deb910950666fa47b5f87c6a08af7096d90e59d0f'
condition: selection_domain or selection_hash
falsepositives:
- None expected for the C2 domain; validate hash against EDR context
level: critical
status: experimental
author: Security Arsenal
fields:
- DestinationHostname
- DestinationIp
- InitiatingProcessFileName
- Hashes
tags:
- attack.command_and_control
- attack.t1071.001
- attack.persistence
references:
- https://zimperium.com/blog/beyond-the-sandbox-leveraging-android-intrusion-logs-to-expose-advanced-threats
date: 2026/10/24
modified: 2026/10/24
id: 7b1c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d03
KQL — Microsoft Sentinel / Defender
// Microsoft Sentinel hunt: PHP2Shell scanning/exploitation, VelvetCake LNK->PowerShell GitHub staging + scheduled tasks, RatHat C2
let php_bad_ips = dynamic(["89.32.41.16","89.32.41.50","41.223.30.7","92.118.112.100","104.219.251.31"]);
let velvetcake_domain = "p1o2i3u4y5t6r7e8w9q0.medianewsonline.com";
let rathat_domain = "fegrs.adidasabc.com";
let rathat_sha256 = "bdfccc6ab3e592f6cfc47f6deb910950666fa47b5f87c6a08af7096d90e59d0f";
union isfuzzy=true
(
DeviceNetworkEvents
| where RemoteIP in (php_bad_ips)
or RemoteUrl has_any (velvetcake_domain, rathat_domain)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
),
(
DeviceProcessEvents
| where (FileName =~ "powershell.exe" or FileName =~ "pwsh.exe")
and (ProcessCommandLine has_any ("github.com","raw.githubusercontent.com","Invoke-WebRequest"," iwr ","DownloadString","IEX")
and ProcessCommandLine has_any ("schtasks","Register-ScheduledTask"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
),
(
DeviceProcessEvents
| where SHA256 == rathat_sha256
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, AccountName
)
| order by TimeGenerated desc
PowerShell
# Security Arsenal IOC Hunt - PHP2Shell, VelvetCake (Opal Sleet/Konni), RatHat artifacts
# Run on Windows endpoints/servers with appropriate privileges; export results for SIEM ingestion.
$ErrorActionPreference = 'SilentlyContinue'
$Results = New-Object System.Collections.Generic.List[Object]
# IOCs from OTX pulses
$PhpBadIPs = @('89.32.41.16','89.32.41.50','41.223.30.7','92.118.112.100','104.219.251.31')
$VelvetCakeC2 = 'p1o2i3u4y5t6r7e8w9q0.medianewsonline.com'
$RatHatC2 = 'fegrs.adidasabc.com'
$RatHatSha256 = 'bdfccc6ab3e592f6cfc47f6deb910950666fa47b5f87c6a08af7096d90e59d0f'
# 1) Network connections to hostile IPs / domains (VelvetCake, RatHat, PHP2Shell infra)
$conns = Get-NetTCPConnection | Where-Object { $PhpBadIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
$proc = Get-Process -Id $c.OwningProcess
$Results.Add([pscustomobject]@{
Type='NetworkConn'
Local=$c.LocalAddress; LocalPort=$c.LocalPort
Remote=$c.RemoteAddress; RemotePort=$c.RemotePort
State=$c.State; Process=$proc.ProcessName; Path=$proc.Path
})
}
# DNS cache hits for known C2 domains
$dns = Get-DnsClientCache | Where-Object { $_.Entry -match [regex]::Escape($VelvetCakeC2) -or $_.Entry -match [regex]::Escape($RatHatC2) }
foreach ($d in $dns) { $Results.Add([pscustomobject]@{Type='DNSCache'; Entry=$d.Entry; Data=$d.Data; Status=$d.Status}) }
# 2) VelvetCake persistence: suspicious Scheduled Tasks invoking PowerShell or referencing GitHub
$tasks = Get-ScheduledTask | ForEach-Object { $_; $_.Actions } | Where-Object { $_.Execute -match 'powershell|pwsh|wscript|mshta|rundll32' }
foreach ($t in (Get-ScheduledTask)) {
foreach ($a in $t.Actions) {
$cmd = "$($a.Execute) $($a.Arguments)"
if ($cmd -match 'powershell|pwsh' -and ($cmd -match 'github.com|raw.githubusercontent.com|IEX|DownloadString|Invoke-WebRequest')) {
$Results.Add([pscustomobject]@{Type='ScheduledTask'; TaskName=$t.TaskName; TaskPath=$t.TaskPath; Command=$cmd; State=$t.State})
}
}
}
# 3) PHP2Shell webshell indicators in common webroots (adjust paths for IIS/Apache/Nginx)
$webroots = @('C:\inetpub\wwwroot','C:\xampp\htdocs','C:\Apache24\htdocs','/var/www/html','/var/www')
foreach ($root in $webroots) {
if (Test-Path $root) {
Get-ChildItem -Path $root -Recurse -Include *.php -ErrorAction SilentlyContinue |
Where-Object { $_.Length -lt 20000 } |
ForEach-Object {
$content = Get-Content $_.FullName -Raw
if ($content -match 'eval\(|base64_decode|session.upload_progress|php2shell|multipart/form-data|assert\(') {
$hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
$Results.Add([pscustomobject]@{Type='WebshellSuspect'; Path=$_.FullName; SHA256=$hash; LastWrite=$_.LastWriteTime})
}
}
}
}
# 4) RatHat sample hash sweep across user-writable locations
$paths = @($env:TEMP, $env:APPDATA, $env:LOCALAPPDATA, "$env:USERPROFILE\Downloads")
foreach ($p in $paths) {
Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue |
ForEach-Object {
$h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
if ($h -eq $RatHatSha256) { $Results.Add([pscustomobject]@{Type='RatHatHashHit'; Path=$_.FullName; SHA256=$h}) }
}
}
$Results | Sort-Object Type | Format-Table -AutoSize
$Results | Export-Csv -NoTypeInformation -Path ".\otx_hunt_$(Get-Date -Format yyyyMMdd_HHmmss).csv"
Response Priorities
Immediate (0–24 hours):
- Block and alert on IOCs: Add the five IPv4s (89.32.41.16, 89.32.41.50, 41.223.30.7, 92.118.112.100, 104.219.251.31) to edge/firewall/WAF deny lists; sinkhole or block
p1o2i3u4y5t6r7e8w9q0.medianewsonline.comandfegrs.adidasabc.comat DNS/proxy; push the RatHat SHA256 to EDR/mobile defenses. - Emergency PHP mitigation: For CVE-2026-109618/109619, apply virtual patching at the WAF to inspect and rate-limit multipart/form-data POSTs and block anomalous
session.upload_progressrequests until PHP is patched. Inventory WooCommerce/Magento and other PHP apps exposed to the internet. - Hunt execution artifacts: Sweep webroots for suspicious PHP (webshells) and unexpected files in upload directories; search process logs for web servers spawning shells; on endpoints, hunt for LNK→PowerShell→GitHub→schtasks chains and any scheduled tasks invoking PowerShell with download cradles.
- Mobile containment: Flag devices that resolved or connected to
fegrs.adidasabc.com; review Android Intrusion Logging and Delegated Scope grants for unknown packages; isolate affected devices.
24 hours:
- Identity verification and credential resets: VelvetCake is a PowerShell implant likely performing reconnaissance and data theft; force credential resets for users on any endpoint with confirmed LNK/PowerShell/GitHub/scheduled-task hits, prioritizing mailboxes and VPN/SSO. For PHP2Shell-compromised e-commerce servers, rotate database, admin, and payment gateway credentials and invalidate active sessions.
- Email and phishing review: Search mail gateways for ZIP attachments containing LNK files with PDF icons and Ukraine/peace-plan themed subjects; purge and block sender infrastructure. Notify targeted users in government/NGO verticals.
- Web integrity checks: Diff webroots and plugin/extension directories against known-good baselines on retail/finance/technology PHP hosts; verify no new admin users or modified checkout/payment modules.
1 week:
- Architecture hardening — PHP edge: Enforce WAF rules for multipart parsing, isolate PHP-FPM with least privilege and
open_basedir, disable PHP execution in upload directories, add egress filtering for web servers, and segment e-commerce backends from the internet edge. Establish an emergency patch SLA for pre-patch leak scenarios. - Endpoint controls: Block or tightly control LNK files from email, enable PowerShell Script Block Logging/AMSI, restrict
powershell.exe/pwsh.exeegress to GitHub for standard users, and baseline/alert on scheduled task creation. - Mobile/BYOD: Require enrollment with Delegated Scope/Intrusion Logging enabled for security tooling, enforce app allowlists, and alert on network connections from unknown packages. Feed OTX IOCs into mobile threat defense and correlate with EDR.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.