Hello and welcome to the First Decipher podcast of 2026.
Hope you all had a nice holiday break as I did.
This is a solo podcast because as we mentioned late last year,
Lindsay is on maternity leave. Everything went well.
She's got a healthy baby girl at home, so she's doing great.
It's going to be a few weeks before she's back, obviously,
but there's still plenty for us to catch up on, plenty of stuff
going on in the security world. So you get me as a solo
podcaster, talking into a microphone for a few weeks.
Hopefully some special guests. A few things before we get to
this week's news, I wanted to mention all the ways you can get
in touch with us. You can follow us on Blue sky
Twitter at deciphersec. That's Decipher SEC.
That's also our YouTube channel. It's youtube.com or yeah,
youtube.com slash at decipher SEC.
And if you want to e-mail us, you can get in touch with me,
Dennis at Decipher dot SC Lindsay's is the same, just
Lindsay, Lindsey at Decipher dot SC.
Always happy to hear from our listeners.
If you have any podcast guests or topics you'd like us to
cover, please get in touch. Also, before we get to the news,
I wanted to mention a few things we have coming up on the podcast
feed. I have a podcast coming next
week that I recorded yesterday with my friends Jeremiah
Grossman and Robert Hansen, who many of you probably know is our
Snake 2 very, very smart and very experienced folks in the
cybersecurity industry. We talked about a whole bunch of
things, mostly about their new venture, which is called Root
Evidence. It's in the vulnerability
management space, but it's not exactly the vulnerability
management company that you might be thinking of.
It's a different approach and it's backed by some data, which
is a interesting idea in the security world.
It's not backed by vibes or best guesses.
So it's a really great conversation.
We talked for over an hour. We talked about a whole bunch of
things, some of the security industry history, why 0 days
matter sometimes and usually not all that much.
What organizations should be doing in terms of prioritizing
vulnerability patching, how they make those decisions, how to
justify those decisions with the board and the C-Suite and other
folks that are involved. So that should be up early next
week. That'll be on this feed as well
as the podcast or excuse me, the YouTube channel.
So look out for that. And we also will have some of
our hacker movie episodes coming soon as well.
We don't, I don't want to give away exactly which ones we're
doing in the next few weeks, but we have plenty of good ones
coming. So keep an eye out for those.
All right, on to the news. So there were a couple of
stories I wanted to highlight from this week.
The 1st is some research that our old friends and former
colleagues at Cisco Talos released this week on a new, I
guess newly disclosed Chinese APT that they identify as UAT
7290. All of these threat Intel teams
have their own naming conventions, as we've talked
about many times on this podcast.
And this is a group that Talos identifies as a Chinese Nexus
APT group that's been active since at least 2022.
Teller specifically was looking at some of their recent activity
into and some interesting targeting changes that the group
has made as well as some of the malware and implants that the
group uses. So UAT 7290 historically has
focused on attacking telecom providers mostly in South
Southeast Asia, but recently I guess modified or expanded their
targeting to also include some countries in southern
Southeastern Europe. So it's an it's always
interesting when APT teams decide to expand their
victimology. A lot of times, especially for
state backed actors, that is because they're getting
different tasking from their their bosses essentially,
whether that happens to be the intelligence agency that they
work for. Sometimes it's a military
branch, whatever it happens to be, a lot of times it's because
they essentially have different assignments.
So UAT 7290 has a dual role in this ecosystem and it serves as
both an initial access group, not an not an initial access
broker. They're not selling access to
victim organizations, but they're tasked with gaining
initial access to target organizations.
And they also perform cyber espionage activities, which is,
you know, a lot of times you see APT teams that specialize in one
thing or another. There might be groups that are
very good at initial access, you know, exploiting
vulnerabilities, finding other ways in, you know, targeting
help desks, whatever the case may be.
And then there are other groups that are then tasked with taking
over those those victims and gathering the the intelligence
that is the main goal of these operations.
This group happens to have dual tasking and looks like so it's
something to keep an eye on. And it, it, this group also
shares some common TTPS with some other Chinese Nexus AP TS,
including, you know, the exploitation of bugs in
networking edge devices, which is not a, a unique TTP.
Everybody does that because there's so many of them.
And it's a great way to get into an enterprise network.
They also use open source web shells for persistence.
Again, that's a common TTP. And they use compromised
infrastructure as part of their operations.
You see this sometimes with APT groups as well as some
cybercrime groups that will look around and find already
compromised boxes, routers, network edge devices that some
other actor has taken the time to compromise and then use them
for their own their own purposes.
It happens relatively frequently, but that's just one
of the things that Talos noticed about this group.
They also have some really interesting custom malware that
they use. They have a few different ones
that I would encourage everybody to go.
And we have a story up on this on Decipher.
You can also read Talos's research as well.
I'll link to that in the show notes.
But this group, UAT 7290, has several different pieces of
malware, both Linux and Windows based malware.
So they have a dropper that's called Rush Drop.
This is the Linux side of things.
Another piece of malware called drive switch which is then used
to execute the main implant which is called silent RAID.
So silent RAID is the persistence mechanism and it has
a whole bunch of, you know, the typical functionality that you
would expect in in a malware implant from an APT group.
So UAT 7290 looks like a relatively new player in the
Chinese APT world. There's that's a crowded
landscape. As everybody knows, there's an
unknowable but large number of APT groups that operate from
China and with Chinese, you know, authority and backing.
So this is just another one to to put on that that menu.
The second big story that I wanted to mention this week is
some research that our friends at Gray Noise released on
targeting activity that's still going after that React to shell
bug that was disclosed about a month ago.
Now. You know, this is a critical RCE
bug in the React server components library also affected
a bunch of downstream things. And it was kind of a one of
those fire drill bugs at the beginning of December when it
was initially disclosed, there was a lot of exploit activity
going on. Then there was public proof of
concepts that came out. A lot of the early exploit
activity, interesting enough was seen from red teams, which is
not atypical. You see that quite often with
something like this That's, that affects a large number of large
number of organizations and a whole bunch of apps.
So, you know, you have red teams immediately going to see what
they have in their environments, what they have in, you know,
external red teams looking at their their clients
environments, that sort of thing.
And that can spike the exploit activity volume that you see
immediately after a disclosure like this.
That's what happened. But now a month later, Grainoy
said that they're still seeing after a peak of about 430,000
attacks, attack sessions per day at the end of December, the
volume has come down a little bit, but it's still in the 300
to 400,000 range per day, which is a huge volume for something
like this. I mean, this is a, a big, you
know, vulnerability that got a ton of publicity.
It got a lot of attention from threat and tell teams, you know,
Sisa, all the usual suspects were urging everybody to up
upgrade and patch and all that kind of stuff.
But the fact that there's still that much exploit activity a
month out from the initial disclosure is an interesting
tidbit. And it's not just coming from,
you know, obviously with that volume of of activity, it's not
coming from one or two places. It's coming from all over the
place. A lot of it is coming from cloud
infrastructure, obviously AWS, places like that, but the
attackers them, so you know, whoever the attackers are.
But behind these, it's a wide range of of people as you might
expect, you know, cybercrime groups, APT groups, I'm sure
there's still some red teams in there, some offensive security
researchers, folks poking around to see, you know, what's still
vulnerable a month after after the fact.
So if you are listening to this and have not updated everything
that has this react to shell vulnerable, react to shell
library associated with it, you got to do that.
I mean it's it's been almost 5 weeks since the initial
disclosure. Obviously it's not always easy
to go and patch everything immediately, but this is one
that is obviously seeing a lot of attention from a variety of
attacker groups, you know, organized discipline groups as
well as opportunistic attackers that are just looking for a way
into any organization and then figuring it out from there.
But this is obviously something you want to pay attention to,
even though it's been, it's a month old, Please, you know, go
and patch it if you, if you haven't already.
Gray Noise said that they've seen a total of more than 8.1
million attack sessions in a month.
It's quite a large number. You can go and look at their
data. They have a good public data set
that they've shared and it shows you some of the ASNS that are
involved. So if you want to have a good
look at where the attack activity is coming from and what
kind of apps are being targeted, that's the place to go and look.
So those are the two things I wanted to really highlight for
this week. As I said at the beginning, keep
an eye out for my podcast with Jeremiah Grossman and Robert
Hansen that'll be coming early to mid next week.
That'll be both on this feed as well as the YouTube channel.
It'll be on the Decipher dot SC site as well, obviously.
And also keep an eye out for the hacker movie podcasts that are
coming. If folks have suggestions or
movies that they really want to see, see us do on the podcast,
please let us know. We have a pretty long list of
ones that we're going to get to in the in the coming weeks and
months. Some of which are, you know,
traditional hacker movies that you might expect.
Others are not quite, as you know, obvious choices.
But we're, we have a very loose definition of what a hacker
movie is. So if you want to throw a few at
us, please do. Again, my e-mail address Dennis
at decipher dot SC and I'd be happy to hear any of those
suggestions. So thanks everybody for
listening and have a great week.