Loading story…
Sophos X-Ops reported a limited series of attacks against Sophos Firewall devices in which attackers exploited CVE-2022-3236 and deployed a sophisticated mix of custom and commodity Linux malware. The intrusions included modifications to legitimate SFOS Java and Perl components, most notably a trojanized servlet-api-3.1.jar that captured administrator credentials, encrypted them, and accepted hidden commands through the JSESSIONID cookie field, creating a covert backdoor on compromised devices.
Investigators identified at least eight malicious file types, including a custom Metasploit JAR, multiple Linux backdoors, a Termite-labeled RAT, and Gh0st RAT variants that used crafted ICMP packets for traffic signaling. The malware enabled file manipulation, shell execution, persistence, encrypted command-and-control, SOCKS proxying, and stealthy communications, indicating a highly capable threat actor focused on maintaining control of firewall appliances while minimizing detection.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Sophos reported that the attackers modified legitimate SFOS Java and Perl components to create covert backdoors, including a trojanized servlet-api-3.1.jar that captured administrator credentials and accepted hidden commands via the JSESSIONID cookie field. The company also identified at least eight malicious file types, including custom backdoors, a Termite-labeled RAT, and Gh0st RAT variants using crafted ICMP packets for covert signaling.
Sophos X-Ops investigated a limited series of attacks against Sophos Firewall devices that began with exploitation of CVE-2022-3236. The intrusions led to deployment of a sophisticated mix of custom and commodity Linux malware on impacted devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors exploited internet-exposed Palo Alto Networks PAN-OS management interfaces by chaining **`CVE-2024-0012`** and **`CVE-2024-9474`**, a combination that enabled authentication bypass followed by privilege escalation to run arbitrary commands as **root** on affected firewall devices. Security reporting described a surge in exploitation after public disclosure, with campaigns targeting exposed firewalls and quickly moving from initial access to hands-on post-compromise activity. Investigators observed attackers validating exploitation with OAST domains, retrieving payloads with tools such as `curl` and `wget`, and establishing **Sliver** command-and-control. Follow-on activity included downloads of ELF, shell script, and PHP payloads, persistence through cron jobs and web shells, suspicious TLS traffic without SNI, use of uncommon ports, reconnaissance, lateral movement, and cryptomining tied to infrastructure including **herominers** and **xmrig**. One repeatedly downloaded payload, **`/palofd`** from **`38.180.147[.]18`** with SHA1 **`90f6890fa94b25fbf4d5c49f1ea354a023e06510`**, was linked by open-source reporting to **Spectre RAT**, indicating that compromised perimeter devices were being used for broader intrusion activity rather than simple opportunistic exploitation.
Jun 29, 2026
Sophos X-Ops reported that attackers used **covert communication channels** in a backdoor deployed against network-connected devices, allowing malicious traffic to blend into normal activity and making the intrusion harder to detect. The operation involved a backdoor designed to maintain access on compromised devices while concealing command-and-control exchanges from defenders monitoring conventional indicators. The finding highlights a stealth technique that can complicate incident response on edge infrastructure and other embedded systems, where visibility is often limited. By hiding communications inside seemingly legitimate traffic patterns, the attackers increased the likelihood of long-term persistence and reduced the chance that standard network monitoring would immediately identify the compromise.
Jul 12, 2026
Investigators at Sophos X-Ops uncovered a long-running intrusion at a telecommunications company involving a stealthy backdoor they named **NotSoTinyTurla**, citing code and tradecraft overlaps with malware previously associated with **Turla**. The malicious component was identified as `smpsvc.dll`, likely resident since at least June 2022, and configured to launch via the legitimate `smphost` service so it could run covertly inside `svchost.exe`. Sophos said the malware used an obfuscated loader, generated unique command-and-control URLs, and reached out to infrastructure disguised as a Chartbeat domain before injecting its final payload directly into memory while obscuring API calls. After establishing command and control, the intruders appeared to conduct a **DCSync** credential-theft operation and host discovery using **Impacket**, indicating an effort to expand access inside the victim environment. Investigators also found that the attackers created an `SRService` service to deploy **cloudflared** and maintain persistence through a Cloudflare Tunnel, a technique Sophos linked to prior Turla tradecraft. The findings add to the body of reporting on Turla’s multi-stage backdoor ecosystem, including earlier research into the group’s second-stage tooling such as **Carbon**, and suggest the actor continues to adapt established espionage methods for covert access and persistence.
Aug 15, 2026