Article
Threat Actors Turn to Supply Chain Attacks to Push Malware
Arete Analysis
Cyber Threats
Arete has observed multiple campaigns of targeted supply chain attacks in which threat actors convince targets to download malware disguised as legitimate software. The tactics displayed are similar throughout the campaigns, regardless of who is launching the attack or what malware is to be downloaded.
Targeting Developers
Nx, an open-source platform designed to manage codebases, experienced a security incident beginning on August 26th that allowed threat actors to publish malicious versions of npm packages and other tools. When unsuspecting developers download and execute the malicious package, the malware can scan the file system, collect credentials, and then post the information to a GitHub repo under the user’s account. It is estimated that at least 1,000 GitHub tokens were leaked, with 90% remaining valid, in addition to legitimate cloud credentials and npm tokens. During these attacks, the malware was typically run on developers’ machines using the Nx Visual Studio Code extension.
Following the remediation of the first incident, there were second and third rounds of this activity by threat actors on the Nx platform, leading to the compromise of additional GitHub auth tokens, cloud-based credentials, and other stolen information that actors could use to launch ancillary attacks. To combat this activity, Nx is removing malicious npm packages as they are identified and working to fix the root cause of the incidents. Nx recommends that users who have encountered malicious repositories assume they have been compromised, stop using the malicious packages, and check for file names. zshrc and .bashrc for any evidence of unfamiliar instructions before removal of the files.
Targeting Crypto Users
Threat actors are distributing malware targeting crypto users through smart contracts on the Ethereum blockchain. A smart contract is a piece of code that sits on the blockchain and automatically executes once the predefined parameters are met and mined into the blockchain. Threat actors abused this native capability by disguising malware as legitimate npm packages to be downloaded by unsuspecting users and used as smart contracts. Once the package is used in a contract, the malicious script runs, executing a malicious command that contacts the threat actors’ command and control (C2) server and can then download additional malware.
What’s unique in this instance is the method of downloading the malware. Typically, malicious packages download second-stage malware by using a script already contained within the package. This gives security-minded users the chance to identify the package’s nefarious purposes by scanning for unusual URLs or commands. However, by using smart contracts to host the URLs where these malicious commands are located, threat actors can improve their odds of evading detection.
One Off or Here to Stay?
These are just two recent and novel examples of supply chain attacks utilizing illegitimate npm packages, and there are always new nefarious npm packages being uploaded to code repository sites like Nx and GitHub. Tricking users into downloading malicious code is a simple way to deploy second-stage malware to unknowing individuals, especially developers who may have admin access to organizations and sensitive tooling. This access allows threat actors to immediately begin ancillary actions without escalating privileges within the environment.
Conclusion and Remediations
Combating the use of malicious npm packages by threat actors can be difficult in organizational settings. Developers should carefully assess each library they implement before deploying it to their organization. As discussed in this article, scanning packages for threats can help identify malicious code, actor-owned C2s, or other suspicious activity, but it isn’t foolproof. Additionally, developers should view code repositories through the lens of monitoring for social engineering attacks. Threat actors can “prop up” their repositories with likes and comments from other fake accounts to bump them towards the top of the repository list. Finally, anytime suspicious activity is suspected from a downloaded npm package, security teams should delete the files and reset passwords.
Sources
Back to Blog Posts
Article
Top 9 Security Controls for SMBs
In today’s complex cyber threat landscape, small and medium-sized businesses (SMBs) should implement a layered, multi-pronged approach to security. Here are some proven, effective controls to consider:
1. Implement MFA for All Users
Multi-factor authentication (MFA) is an effective and accessible way to protect sensitive data, comply with regulatory standards, and prevent unauthorized access to critical systems. By ensuring that users not only use a password but also a secure token, an organization can significantly reduce phishing attempts, credential stuffing attacks, and ransomware incidents. MFA should be enabled for email, VPN, and critical system access.
2. Update Patch Management Programs
A modern patching program should include policies and mechanisms to manage software updates in a timely manner. Patching efforts should address not just operating system updates, but also commonly utilized software within the environment. An active patching plan aims to reduce the mean time to patch and provide metrics on existing patch efforts. In the event of a high-severity vulnerability, a mature patching program should also be able to identify the risks and exposure for a given set of systems based on the average time to patch. This helps stakeholders make informed decisions when a new exploit is released.
3. Leverage a Properly Managed Endpoint Detection and Response (EDR) Tool
With real-time threat detection and advanced visibility, endpoint detection and response (EDR) solutions can enhance an organization’s ability to detect and investigate potential malicious activity, including ransomware, lateral movement, fileless attacks, and more. Effective management of EDR should include proper configuration, regular agent updates, and established procedures for responding to alerts.
4. Enhance EDR with Frontline Incident Intelligence
While EDR solutions are an important component of a security program, threat actors are continually adapting their techniques to evade detection, and as a result, standard detection methods may not always identify emerging threats or novel attack behaviors. To strengthen protection, organizations can supplement EDR tools with custom detection rules informed by incident response data. These rules can help identify indicators of compromise observed during cyber incidents, providing an additional layer of visibility beyond traditional detections.
Arete Bloktd℠ illustrates this approach by transforming threat intelligence and malware analysis into curated detection rules for EDR tools. Applying frontline intelligence to security tools can result in earlier detection, less investigative burden, and a more confident response.
5. Create and Continuously Test an Incident Response (IR) Plan
An incident response plan can help an organization effectively identify, respond to, and recover from a cybersecurity incident while minimizing disruption and downtime. An IR plan defines clear roles, escalation paths, communication strategies, and decision frameworks for both internal and external teams. To be effective, these plans should be regularly tested with post-incident reviews or tabletop exercises involving key stakeholders.
6. Maintain Encrypted and Tested Data Backups
In the case of a cyberattack, backups can help organizations maintain business continuity, support ransom negotiations with threat actors, and contribute to a timely and successful recovery. Encrypting backups makes it more difficult for threat actors to access or alter them, and regular testing ensures they remain accessible during a security incident.
7. Conduct Employee Security Awareness Training
Human error is a leading cause of cybersecurity incidents, and an organization’s employees are its first line of defense against cyber threats. Security awareness training reinforces the importance of data confidentiality, supports regulatory compliance, and helps employees recognize and understand red flags such as suspicious emails, malicious links, and social engineering attempts.
8. Assess and Address Existing Risk and Vulnerabilities
To maintain a proactive approach to risk management and improve resilience, organizations should regularly assess existing vulnerabilities through expert-led Vulnerability Assessments, Penetration Testing, and Threat Hunting Assessments. These exercises can help identify security gaps, support regulatory compliance, and prevent potential incidents. During remediation, prioritize high-impact vulnerabilities and make a plan for periodic assessments.
9. Apply Least-Privilege Access Controls
Employees should have access only to the systems, applications, and data necessary to perform their jobs. By removing unnecessary administrative privileges and regularly reviewing user permissions, organizations can reduce the risk of unauthorized access and limit the damage caused by compromised accounts or insider threats.
Organizations should regularly review their cybersecurity programs, stay informed about emerging threats, and evaluate whether their security controls are adapting to the evolving threat landscape.
Article
Ransomware Trends & Data Insights: August 2026
Although INC Ransom was the most active ransomware threat group observed in August 2026, overall activity remained relatively distributed across the threat landscape, with approximately 30 unique ransomware and extortion groups, including both established and newly emerged actors, observed during the month. Alongside INC Ransom, Storm, DragonForce, Qilin, and The Gentlemen were among the top five most active threat groups, underscoring the continued diversity and competitiveness of the ransomware ecosystem.
Figure 1. Activity from the top 5 threat groups in August 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
August 2026 was a significant month for the emergence of new threat actors, with Arete identifying several previously untracked ransomware groups, including Storm, Dark Project, DireWolf, Morpheus, Orova, Spirals, Wallstreet Team, and Zawoo Team. This trend underscores the ongoing evolution of the threat landscape and the low barriers to entry for new cybercriminal operations.
Arete observed a continued use of AI-enabled capabilities across the ransomware ecosystem during August. Similar to Fulcrumsec and Setra, the newly emerged Zawoo Team appears to leverage AI-assisted analysis of stolen data, publishing highly structured and detailed victim assessments on its data leak site (DLS). Additionally, both the Aurora and Storm ransomware groups have been observed utilizing AI-driven or AI-assisted chat representatives during victim communications. These developments suggest that threat actors are increasingly incorporating AI to enhance data analysis, automate victim engagement, and improve the effectiveness and scalability of extortion operations.
In August, Arete also observed that despite sustained law enforcement disruption efforts, LockBit continues to demonstrate operational resilience, likely through the expansion of its affiliate ecosystem and the evolution of its tactics. Recent activity indicates an increased reliance on data theft and exfiltration-only operations, with observed victimology suggesting a notable focus on organizations within the financial sector.
Sources
Arete Internal
Report
Arete's H1 2026 Crimeware Report
Explore intelligence and operational data from the frontlines of ransomware and extortion response as we detail the most significant trends and developments in the cyber threat landscape in the first half (H1) of 2026.
Article
WinRAR Path-Traversal Vulnerability Exploited in Ransomware Attacks
CISA has warned that CVE-2025-8088, a path-traversal vulnerability in WinRAR, is being exploited in ransomware attacks. The vulnerability allows attackers to use specially crafted archive files to place malicious executables in locations such as the Windows Startup folder, enabling code execution when the system restarts. WinRAR addressed this vulnerability in version 7.13, but exploitation has continued due to challenges in updating the software. CISA's updated KEV entry now specifically identifies the vulnerability as being used in ransomware attacks.
What’s Notable and Unique
The vulnerability was initially exploited as a zero-day by the Russia-linked RomCom group, enabling malware execution at user logon and supporting credential theft, cyberespionage, and ransomware-related activities.
CVE-2025-8088 continues to be actively exploited by both government-backed and financially motivated threat actors. Observed campaigns have been attributed to Russian- and Chinese-linked groups targeting several organizations.
Phishing campaigns leveraging weaponized RAR attachments exploited CVE-2025-8088 to silently place malicious payloads in autorun locations using directory traversal and Alternate Data Streams (ADS).
The widespread exploitation of CVE-2025-8088 highlights strong demand for effective WinRAR exploits, with multiple underground vendors previously supplying exploit capabilities to a diverse range of threat actors. One such vendor, zeroplayer, advertised a WinRAR exploit in July 2025.
Analyst Comments
Organizations should immediately upgrade WinRAR to version 7.13 or later and conduct an enterprise-wide inventory to identify unmanaged installations. Given that WinRAR lacks automatic updates, Group Policy support, and integration with common enterprise patch management platforms, manual verification and remediation may be required to ensure all vulnerable instances are addressed. Security teams should also enhance defenses against archive-based phishing attacks by blocking or scrutinizing unsolicited compressed files, monitoring for suspicious file creation in Windows Startup directories, and detecting abuse of ADS. With CISA now linking CVE-2025-8088 to ransomware activity, organizations should treat remediation as a high priority and actively monitor for indicators of WinRAR-based exploitation across their environments.
Sources
CISA Adds Three Known Exploited Vulnerabilities to Catalog
WinRAR vulnerability being exploited in ransomware attacks, CISA warns