Podcast Detail

SANS Stormcast Friday, August 28th, 2026: Broken Polymorphic Phishing; Router Implants; llms.txt exploits; Papercut 0-Day

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10072.mp3

previous
Podcast Logo
Broken Polymorphic Phishing; Router Implants; llms.txt exploits; Papercut 0-Day
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Friday, August 28, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu graduate certificate program in
 incident response. Well, in diaries today we have Jan
 talking about, well, the latest in phishing. In this
 particular case, the attacker was experimenting with
 polymorphic phishing pages. What this refers to is that
 each time you load the page, there is a different code
 being loaded. That, of course, makes identifying it as a
 phishing page more difficult. The code itself is heavily
 obfuscated JavaScript. Now, one thing that Jan sort of ran
 into when looking at the page was, well, of course, getting
 a different code means that now you're downloading the
 page multiple times to see how the code changes. But
 apparently not all versions of the page actually worked. What
 happened was that due to an error that Jan is explaining
 in the obfuscated JavaScript, the page actually doesn't load
 for some of the cases a couple percent of the time. It
 wouldn't display anything and basically would just stall.
 From a defensive point of view, this phishing page isn't
 really all that special. It does load the page with the
 user's email address as an argument. So it does try to
 adapt the page a little bit by adding, for example, the
 company's logo based on the domain name. Well, and Jacob
 Baines with Wollcheck published a blog post with
 details regarding two different backdoors that he
 found in Chinese-made routers. Now, these routers are made by
 ZBT. They're sold under various brand names here in
 the U.S. Apparently, Deep Orange and such is one of
 those brand names. But they're not really marketed in the U
 .S. They're really more targeting the Chinese domestic
 market with these routers. So the ones that show up in
 American websites and such are really, you know, more
 accidental resales and such that you may see there.
 They're also sold via Alibaba. And it's, of course, possible
 to buy these routers there directly if you are living
 outside of China as well. The problem here are two different
 implants that can be used to remote control the router
 without any authentication. One is passive. It listens for
 inbound UDP packets and then can send back details about
 the router, but can also do things like execute commands.
 The second one is more active. It connects outbound to the
 ZPT cloud infrastructure. So this is definitely something
 that was left by the manufacturer. This is not sort
 of some random malware that's not associated with the
 manufacturer. There are two domains that can be used. The
 one ac-link.com is still active. The second one was no
 longer in use. And Jacob managed to actually configure
 that domain, basically acquire it and configure it, and then
 see what connections are coming inbound. The number of
 devices here was fairly small, and I think surprisingly
 small. An active scan for the UDP backdoor listed about 200
 or so devices that responded, and the incoming traffic to
 the domain was about another sort of 300 devices. But the
 domain here is really just more the backup domain. So the
 primary domain is probably used by most devices that are
 configured with this particular backdoor. Now,
 given that these routers are targeting the domestic Chinese
 market, it's more likely that this is some kind of
 surveillance technology or so mandated or encouraged by the
 Chinese government, if this is at all government-linked. Some
 of the functionality could be a little bit explained as,
 well, badly done support features and such. But given
 that there is no authentication and such, well,
 it's badly done, even if it's done for surveillance
 purposes. And Elon Hertz, a security researcher, did a
 survey of LLMS.txt files that are posted around the
 Internet. This is a standard file that tells AI agents how
 to interact with your websites. For example,
 documentation regarding APIs or such that you may offer for
 them to consume. The problem is that, well, AI agents are
 trusting the instructions being posted in this file. And
 as an option, you may include, for example, instructions as
 to what software you need to install in order to access the
 particular API. What I found is that several large websites
 actually do have accidental malicious code included in
 these instructions. And, of course, an attacker could make
 these instructions do, well, whatever the attacker wants to
 do. Because agents implicitly trust whatever instructions
 they're finding in this file. This is a really interesting
 kind of exploit. Reminds me a little bit of ClickFix, but
 for bots, where you basically tell the bot, hey, if you want
 to get past this particular barrier, then just copy-paste
 this code and execute it. And PaperCut published a critical
 security advisory stating that they are aware of a currently
 exploited vulnerability and there is no patch available
 for it yet. The only recommendation they have to
 offer so far essentially to block access to your PaperCut
 instance, at least from the public internet or restricted
 to trusted IP addresses. Not ideal, of course. There is not
 a lot of detail about how severe this vulnerability is.
 They did publish some indicators of compromise and
 looks like there's an EXE that may be running. So I would
 assume that it's possible that this does include, indeed,
 remote code execution. At least that's sort of the
 hypothesis I would use in order to rank this particular
 vulnerability right now. Well, and this is it for today. So
 thanks for listening. Thanks for liking. Thanks for
 subscribing to this podcast. And as always, talk to you on
 Monday. Bye.