ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More 威胁日报：Gogs 10.0 远程代码执行、n8n 工作流转RCE、1000万美元悬赏、GLM-5.3 AI漏洞等

TL;DR

• Check Point reverse-engineered Microsoft Defender's BTR.sys driver, demonstrating how legitimate signed kernel drivers can be repurposed as universal kernel operation engines to bypass endpoint security during the boot-time "golden window"
• The U.S. DOJ charged 17 members of Iran's Mabna Institute for a decade-long espionage campaign targeting 144 U.S. universities, stealing 31+ TB of academic IP, with a $10M State Department reward offered
• A new Grandoreiro malware campaign abuses the legitimate Duplicate Files Finder (DFF) application via DLL sideloading, featuring extensive anti-analysis capabilities including sandbox detection and VM artifact checks
• The article highlights a broader trend of "privatized state espionage" where commercially-run cyber crews conduct state-level operations at industrial scale, blurring lines between criminal and nation-state actors
• AI-assisted exploit research continues to lower the barrier to causing damage, alongside traditional attack vectors like weak header checks and exposed systems

Why It Matters

This bulletin illustrates how trusted, signed components—once considered safe by definition—are being systematically weaponized against the defenses they were designed to support, fundamentally challenging signature-based security models. The Mabna Institute case represents a paradigm shift in state-sponsored cyber operations, demonstrating how Iran's IRGC is outsourcing espionage to deniable commercial entities, a model that other nations may increasingly adopt. For AI practitioners and security professionals, the convergence of AI-assisted exploit development with traditional attack techniques signals a new era where the effort required to compromise systems continues to decline.

Technical Details

• BTR.sys Kernel Exploitation: Check Point reverse-engineered the Defender Boot-Time Removal driver to create BTR_CLI, a weaponization tool that mimics legitimate Windows Defender remediation footprints. The attack exploits the timing gap between system boot and user-mode initialization, eliminating the need for BYOVD (Bring Your Own Vulnerable Driver) techniques.
• Mabna Institute Campaign Architecture: Operating since ~2013, the campaign compromised 8,000+ professor accounts across 322+ institutions worldwide. Stolen data was monetized through Megapaper.ir and Gigapaper.ir, representing a commercialized espionage infrastructure with the IRGC as the anchor client.
• Grandoreiro DLL Sideloading: The malware abuses the legitimate Duplicate Files Finder (DFF) application, loading malicious DLLs through sideloading. Anti-analysis measures include sandbox detection, VM artifact checks, process blacklisting, and environment profiling—all executed before any C2 contact.
• Geographic Focus: Grandoreiro activity remains concentrated in Latin America (Mexico, Spain, Peru, Argentina), while the Mabna campaign had global reach with primary targeting of academic institutions.

Industry Insight

The BTR.sys exploitation demonstrates that trust-based security models relying on code signing are fundamentally insufficient; organizations should implement behavioral monitoring and runtime integrity checks that go beyond signature validation, particularly for kernel-mode components. The privatization of state espionage represented by Mabna Institute signals that universities and research institutions must treat academic IP as high-value targets requiring enterprise-grade security controls, not the thin identity management typical of open academic environments. The convergence of AI-assisted exploit research with traditional attack techniques means security teams should prioritize detecting anomalous behavior patterns and lateral movement rather than relying solely on known threat signatures.

TL;DR

• Check Point逆向工程微软Defender的BTR.sys驱动，证明可利用合法签名驱动在启动与用户模式初始化之间的“黄金窗口”绕过端点安全，无需依赖BYOVD方法。
• 美国司法部起诉伊朗Mabna研究所17名成员，指控其自2013年起针对全球100多所高校及企业实施大规模网络间谍活动，窃取超31TB数据，并悬赏1000万美元。
• Grandoreiro恶意软件利用合法应用程序Duplicate Files Finder（DFF）进行DLL旁加载攻击，主要针对拉丁美洲地区，具备沙箱检测、虚拟机识别等反分析功能。

为什么值得看

本文揭示了当前网络威胁中“合法组件滥用”和“国家行为体商业化”两大趋势，对AI从业者而言，展示了AI辅助漏洞研究如何降低攻击门槛，同时警示端点安全、供应链防护及学术机构数据保护需应对新型威胁。

技术解析

• BTR.sys驱动滥用：Check Point通过逆向工程发现，微软签名的Defender Boot-Time Removal驱动（BTR.sys）可在系统启动后、用户模式初始化前的短暂窗口内被武器化，工具（如BTR_CLI）模仿合法Defender进程行为，从而绕过基于签名的端点防护。
• Mabna研究所网络间谍活动：该组织自2013年起针对144所美国高校、178所外国高校及多家企业、政府机构，通过钓鱼攻击 compromising 约8000个教授账户，窃取超31TB学术数据，并通过Megapaper.ir和Gigapaper.ir网站出售。
• DLL旁加载攻击：Grandoreiro恶意软件利用合法应用程序DFF的DLL加载机制，将恶意DLL注入其中，实现代码执行；其样本包含反分析功能，如沙箱检测、虚拟机特征识别、进程黑名单和环境配置检查，以规避自动化分析。

行业启示

• 合法组件成为攻击载体：威胁行为者日益转向滥用受信任的签名驱动和应用程序，安全策略需从单纯依赖签名验证转向行为监控和异常检测，尤其关注启动阶段和供应链环节。
• 国家间谍活动商业化趋势：Mabna案例显示国家行为体通过私营承包商执行网络间谍活动，模糊了传统国家黑客与犯罪集团的界限，建议加强高校、研究机构及关键基础设施的身份管理和数据访问控制。
• AI辅助漏洞研究降低攻击门槛：原文提及AI-assisted exploit research，表明AI技术正加速漏洞发现和利用工具开发，安全社区需关注AI在攻防两端的演进，并探索AI驱动的安全检测和响应能力。