Researchers in Japan have developed a compact smartphone-connected sensor that detects extremely low concentrations of toxic forever chemicals in water, potentially making contamination testing faster, cheaper, and more accessible.

Swedish-Estonian boatbuilder Cross Water wants to turn the military rigid inflatable boat into a plug-and-play platform, with drones, sensors and mission equipment that lock onto the deck in minutes and software that will eventually let the same hull run by remote control or on its own. The company, which also trades as XW Production, builds […]

Humans are exerting increasing influence over how water moves through lakes, rivers, soil, and the subsurface, and a new NASA study shows where those effects are greatest. Using more than two decades of satellite measurements of subtle changes in Earth’s gravity, the researchers sharpened the picture of how—and why—terrestrial water storage has changed.

This map encapsulates their findings, depicting changes in terrestrial water storage from April 2002 to November 2025. Beyond the influence of climate variability, the scientists identified 40 regions where the changes also aligned with human activities such as irrigation, reservoir impoundment, and land-use change. These activities were significantly related to terrestrial water storage trends on every nonpolar continent except Australia.

In some areas, the effects of human activities were especially strong. “In four continental regions, an anthropogenic variable showed a stronger relationship with the storage trends than any climate variable did,” said Mary Michael O’Neill, a hydrologist at NASA’s Goddard Space Flight Center and lead author of the study.

They include well-known spots such as California’s Central Valley and northern India, where farmers’ heavy reliance on groundwater has drawn down storage—in India’s case, faster than earlier estimates suggested. Elsewhere, some types of farming and water management appear to have done the opposite.

Gravity as a Water Gauge

The data behind the map come from the GRACE (Gravity Recovery and Climate Experiment) and GRACE-FO (GRACE Follow-On) missions, each of which consists of two satellites that fly in tandem. As the lead satellite passes over an area with greater mass, the slight change in gravity tugs at it, and instruments aboard the satellites measure the change in distance between them. Since water and ice are heavy and shift around regularly, scientists can use GRACE data to infer gains and losses.

The satellites’ data are typically processed into monthly maps that show broad patterns of water storage. But over more than 20 years, the satellites have passed over most of the planet many times. By combining all of those passes, the researchers could map long-term water trends with five to 10 times more spatial detail than previous analyses. The tradeoff was a loss of temporal detail. They then applied statistical techniques to weigh the importance of various anthropogenic and climatic factors in the storage trends and to pinpoint where human activities may have contributed.

The improved spatial resolution uncovered some human impacts that had not been previously detected, said Matthew Rodell, deputy director of Earth Sciences for Hydrosphere, Biosphere, and Geophysics at Goddard and one of the study’s authors. The analysis also showed that some known trends were stronger than previously realized.

Where the Water Went

Across several continents, groundwater-irrigated farmland was strongly associated with declines in terrestrial water storage. In North America, these declines appeared in California’s Central Valley, the southern High Plains of the U.S., and Chihuahua, Mexico, where long-term droughts have increased farmers’ reliance on groundwater. Groundwater pumping also drove declines in northern India, where the refined analysis showed a steeper downward trend than previously realized. Consistent with previous findings, retreating Himalayan glaciers accounted for only 15 percent of the decline there.

Other types of agriculture had a different relationship with water storage trends. In parts of sub-Saharan Africa, for example, some increases occurred where rainfed cropland has expanded. There, swaths of native savanna were replaced by millet cultivation throughout the study period, and water tables rose despite below-average precipitation. A similar pattern emerged in northern Brazil’s Maranhão state, where soybean fields have replaced forests and shrublands. The resulting water storage trend might be explained in part by the efficient water use of cereal and legume plants and by Indigenous practices that help direct water into shallow aquifers, the researchers said.

Water storage and diversion projects also came into focus on the new map. Hundreds of large reservoirs were filled during the study period, the authors note, but the coarse spatial resolution of gravity measurements previously made them difficult to track. In the new analysis, the Boguchany Reservoir on Russia’s Angara River, the second-largest reservoir filled in the 21st century, produced the strongest water storage trend in nonpolar northern Asia.

The map also resolves smaller reservoirs and other hydrologic engineering projects. The Karakum Desert in Turkmenistan registered water storage gains stemming from the long, largely unlined Karakum Canal running through it. The canal diverts river water to support desert agriculture, but enough seeps into the ground during its journey to alter the water picture in the desert. The map’s finer resolution allows for better monitoring of such hydrologic changes in remote areas where other measurement options may be limited.

Moving forward, O’Neill wants to capture how dams, diversions, irrigation, and other controls on Earth’s water affect storage downstream, and to disentangle the influence of local and non-local activities. “I’d also like to recover more of the temporal picture,” she said. One way to do that is by combining the higher-resolution data with standard monthly products or by applying the recent technique over shorter timeframes. “This could help track how localized trends evolve in response to specific events like droughts or policy changes.”

NASA Earth Observatory map by Michala Garrison, using data from O’Neill, M.M., et al. (2026). Astronaut photograph ISS065-E-111045 was acquired on June 13, 2021, with a Nikon D5 digital camera using a focal length of 1,150 millimeters. It is provided by the ISS Crew Earth Observations Facility and the Earth Science and Remote Sensing Unit at NASA Johnson Space Center. The image was taken by a member of the Expedition 65 crew. The image has been cropped and enhanced to improve contrast, and lens artifacts have been removed. The International Space Station Program supports the laboratory as part of the ISS National Lab to help astronauts take pictures of Earth that will be of the greatest value to scientists and the public, and to make those images freely available on the internet. Additional images taken by astronauts and cosmonauts can be viewed at the NASA/JSC Gateway to Astronaut Photography of Earth. Story by Lindsey Doermann.

References & Resources

• NASA Earth Observatory (2018, May 23) Twin Satellites Map 14 Years of Freshwater Changes. Accessed October 19, 2026.
• O’Neill, M.M., et al. (2026) Spatially refined satellite gravimetry captures human signatures in global terrestrial water storage trends. Proceedings of the National Academy of Sciences, 123 (38) e2600775123.

Refrigeration has been a challenge for humanity since the start. Ancient civilizations in dry climates like Persia and Egypt could use evaporative cooling on a large scale with specialized architecture, and with easy access to electricity modern civilization can cool down almost anything it wants. But whether in a refrigerator or heat pump, the electricity demands can get out of hand quickly, and heat-driven systems often require dangerous or hard-to-get chemicals. But [Greenhill Forge] has crafted a system that creates effective refrigeration with only fire and salt… and a bit of electricity.

Heat-driven systems are called absorption coolers. In this design, water is used as a refrigerant and forced to a very low pressure so that it can boil at a low temperature. When it boils it absorbs heat from the surrounding environment, and then that water vapor can be moved and condensed where it gives off that heat. The build has a few distinct loops to make all of this happen. The generator loop holds the heat source and a tank of water mixed with road salt. Boiled water travels up a tube to a condenser. A valve here is opened slightly to allow the water to drip into the absorber section, where it is under low pressure and boils rapidly. The vapor is carried away by the third system, which uses a shower of the salt solution to quickly suck up the vapor and move it away from the cooled area.

There is a small amount of electricity needed to run pumps and fans, but to keep this off-grid this requirement is easily met by a small solar panel or battery. The bulk of the energy is from the fire which boils the saltwater solution. [Greenhill Forge] added a number of temperature and pressure sensors to monitor and control the system as well, and in his firsts tests the refrigeration system was able to get to about 5° C with an ambient temperature around 16° C. That’s not quite the temperature needed for a refrigerator, but not bad for only salt and fire. [Greenhill Forge] has a number of other ingenious off-grid builds like this sawdust stove and a magnetic induction water heater.

For many longtime cotton farmers in the Texas High Plains, the 2026 drought sparked flashbacks to catastrophic harvests of the past. Miserably dry seasons forced farmers in America’s largest cotton-producing region to abandon massive portions of their dryland crop, including 72 percent in 2022 and 66 percent in 2011.

But in some ways, farmers felt the drought in 2026 entered new territory. “This is the first year that we’ve had cotton completely die,” said Lacy Cotter-Vardeman, a farmer based in Lubbock County whose family has worked the land there for several generations. “I was just talking to our insurance people, and they said they’d never seen this before,” she said, adding that roughly 90 percent of her dryland cotton was dead.

Satellite images highlight the scale of the problem in Lubbock and adjacent counties. Brown, parched crops and vacant plots dominated the landscape on September 9, 2026, when the OLI (Operational Land Imager) on Landsat 8 captured the image above (right). In contrast, much greener landscapes prevailed on September 22, 2025 (left), when the sensor captured an image of the same area during a more typical year with a relatively healthy harvest.

Subtler signs of the drought are also visible. With groundwater growing scarce in the High Plains aquifer, many farmers in the region have started irrigating just one-half or one-third of their center-pivot fields, explained Tillery Timmons-Sims, an agricultural conservationist who owns land in Brownfield, Texas, and used to grow cotton. In the imagery, these appear as green semicircles and quarter circles.

Note also the many shallow water features known as playa lakes—sometimes called mud holes, buffalo wallows, and lagoons—scattered throughout the image. Some, like Double Lakes and Mound Lake, are fairly large, but most of the more than 19,300 playa lakes in the Texas High Plains are quite small, less than 30 acres.

Many of these ephemeral lakes were dry in September 2026, unlike the previous year. Playa lakes are critical in this water-stressed region because the clay-lined features, if active, collect rainfall and provide pathways for water to seep underground and recharge the aquifer below, the region’s primary source of irrigation water. However, about 80 percent are modified by tilling or buried with sediment, and many no longer function that way.

Farmers in this region operate along the eastern margin of the aquifer, which has declined sharply in recent decades. According to U.S. Geological Survey data, the water table across much of Lubbock County has dropped by between 25 and 100 feet since 1950, around when people began drawing large volumes of water from the aquifer to irrigate. Losses have been even more extreme (150 feet or more) in counties to the north, including Parmer, Castro, Swisher, and Briscoe.

The aquifer’s long-term decline, combined with the 2026 drought, left many wells “pumping air” this summer for some of the farmers Timmons-Sims knows. “We simply don’t have groundwater to fall back on anymore,” she said. Many farmers she knows thought that water might run out during the next generation; instead, it’s “happening now,” she said. For Cotter-Vardeman, the problem couldn’t be more tangible. Many of her irrigation wells stopped working in August.

Rains in September and October, aided by a strong El Niño in the Pacific, are bringing needed moisture to the region, but they haven’t been enough, according to analysis from the U.S. Drought Monitor. “It will take about 7 inches of rain over a three-month period to ‘end’ the current drought,” said Jonathan Case, a meteorologist at NASA’s Marshall Space Flight Center and one of the Drought Monitor’s authors.

The deteriorating aquifer is one of the reasons Timmons-Sims stopped farming in 2007. She now spends most of her time searching for ways to keep farms in business, such as converting irrigated croplands to grasslands to earn water credits, developing alternative energy projects, adopting water-efficient techniques, and working with conservation organizations to plan for the long term.

Through that work, the Sandhills Area Research Association, a conservation organization she helps run, partnered with NASA Acres, a research consortium that connects farmers with NASA science to address agricultural challenges.

In August, a NASA Acres Space for Agriculture listening tour brought NASA officials to Cotter-Vardeman’s farm in Slaton, a vineyard in Meadow, and parched cotton fields in Kress (below). At each stop, the conversation returned to water: how to preserve the ailing aquifer, and how farmers could manage their land in ways that would help restore playa lakes and return billions of gallons of water to the aquifer. 

The playa lakes around Lubbock were among the first scientific topics researchers studied after Landsat 1 launched in 1972. One early analysis by a Texas Tech geoscientist highlighted the Double Lakes playa (shown above), estimating that monitoring lakes from space would cost just a fraction of what ground surveys would.

More recently, a team of Texas Tech University researchers used a deep learning framework to identify and track changes affecting thousands of playa lakes over three decades. Their results, published in September 2026, showed that since 1995, playa lakes declined significantly in 15 of the 45 counties analyzed, highlighting the water challenges facing farmers like Cotter-Vardeman, a member of the NASA Acres Farm Innovation Ambassador Team (FIAT).

In Texas, Timmons-Sims and FIAT are working to connect farmers and NASA scientists, making it easier for farmers to use NASA data to decide what and when to plant, how to use cover crops and irrigation, and how to manage sediment and playa lakes. “We’re simply running out of time and water,” Timmons-Sims said. “Farmers need information, innovation, optimization, and solutions—and they need it now.”

NASA Earth Observatory images by Lauren Dauphin, using Landsat data from the U.S. Geological Survey and the U.S. Drought Monitor at the University of Nebraska-Lincoln. Photos by Lacy Cotter-Vardeman and Adam Zwerner. Story by Adam Voiland.

References & Resources

• Better Cotton Initiative, Lacy Cotter-Vardeman and her girls. Accessed October 7, 2026.
• Dryside Dispatch (2026, September 10) Space4Ag with Tillery Sims. Accessed October 7, 2026.
• Economic Research Service (2025, January 8) Cotton and Wool – Cotton Sector at a Glance. Accessed October 7, 2026.
• National Integrated Drought Information System, Texas. Accessed October 7, 2026.
• NASA Acres (2026) On the Road with the NASA Space4Ag Tour: Listening to Agriculture Across Texas, Oklahoma, and Kansas. Accessed October 7, 2026.
• NASA, Earth Action. Accessed October 7, 2026.
• NASA, Drought. Accessed October 7, 2026.
• NASA DEVELOP (2025) Southern High Plains Texas Agriculture. Accessed October 7, 2026.
• NASA Technical Reports Server (1973) Dynamics of playa lakes in the Texas High Plains. Accessed October 7, 2026.
• NOAA, Current Drought Reduction. Accessed October 7, 2026.
• Playa Lakes Joint Venture Playas. Accessed October 7, 2026.
• Sandhills Area Research Association (2026, September 19) From Satellites to Soil: Bringing NASA Remote Sensing to West Texas Farms. Accessed October 7, 2026.
• Texas Counties Deliver, Texas Counties Interactive Map. Accessed October 7, 2026.
• Texas Water Development Board, Region O Planning Group. Accessed October 7, 2026.
• Texas Parks & Wildlife, Panhandle Playa Lakes. Accessed October 7, 2026.
• U.S. Drought Monitor (2026, September 29) National Drought Summary. Accessed October 7, 2026.

While tracking the activities of 4BID we uncovered a new string of campaigns that appear to be the work of several interconnected actors. While politically motivated groups generally limit their scope to specific nations – for 4BID and its peers, primarily Russian and occasionally Belarusian organizations – our latest findings reveal a shift. The actual geographic footprint of these attacks became broader than expected, striking companies across Kazakhstan, the UAE, Syria, and Egypt.

What triggered our investigation was spotting a cluster of indicators of compromise within a breached Russian organization’s infrastructure. We used these footprints to successfully track down other environments hit by the same threat actors and piece together the bigger picture.

This article dives into the software deployed throughout these hacktivist campaigns:

• New ransomware samples
• Scripts used at various stages of the attacks
• Commercially available IT remote monitoring and management (RMM) tools

These include both updated versions of known threat-actor tools and previously unseen software.

Overlapping activity streams

Within the initial organization’s infrastructure, we found numerous activity indicators linked to several interconnected hacktivist groups – which ultimately set the direction for our follow-up analysis. We can attribute the following findings to hacktivist activity with a medium level of confidence:

• Several samples of BlackReaperRAT, which we attribute to the 4BID group, were found alongside scripts designed to download Panorama9 RMM, AnyDesk, and Dev Tunnels.
• Besides the artifacts listed above, we discovered ClearWater ransomware in other compromised infrastructures. Interestingly, during this same window, public sources showed Hakerskii Kit claiming a successful attack on a Russian factory. Also detected in that facility’s infrastructure was ClearWater ransomware, with the attackers publicly thanking the С.A.S. group for their contribution.
• We uncovered several samples of Warp RAT within the hit infrastructures, which we link to the Goffee threat group. A detailed report on this specific activity will be published at a later date.

Technical details

Vulnerable web servers and fd.aspx

Analysis of the compromised environments revealed that the attackers gained initial access in most cases by exploiting the ProxyShell vulnerability in Microsoft Exchange, which allows for full server compromise.

Once inside, the attackers deployed the fd.aspx web shell – a modular ASP.NET file designed for remote control, file transfers, and system reconnaissance. Communication with the web shell relied on a basic security check: if the key parameter in an incoming request failed to match the AUTH_KEY constant, fd.aspx simply returned “Access Denied”.

If the verification was successful, the command contained in the request’s scriptText parameter was passed directly to PowerShell, and the output returned to the operator in the body of the HTTP response. In environments where PowerShell execution was restricted, the web shell swapped it out for cmd.exe. The CreateNoWindow: true and UseShellExecute: false flags were used to keep the command execution hidden from the user.

Beyond running commands, the web shell features bidirectional Base64-encoded file transfers. This allows any binary data – like executables, archives, or certificates – to be passed right inside the body of an HTTP request. The UploadFile function writes files to any directory the web server process can access, which makes it easy to drop additional shells or swap out legitimate files. The DownloadFile function exfiltrates any accessible file from the compromised system back to the attackers’ C2 server.

The web shell also includes a system reconnaissance feature that grabs the following data points:

• OSVersion: operating system version
• MachineName: hostname
• UserName: current username
• UserDomainName: domain name
• ProcessorCount: number of processors
• SystemDirectory: system directory path
• CurrentDirectory: current working directory
• Version: .NET Framework version

Additionally, the reconnaissance feature uses the DriveInfo.GetDrives() function to enumerate running processes and map out connected drives – along with the amount of free space available on each. This file system reconnaissance is topped off with LastWriteTime metadata for each object, which helps the operator quickly spot recently modified files and get their bearings within the storage layout.

Alongside the web shells, we encountered a variety of scripts and C2 frameworks across all compromised infrastructures, which we break down below.

Scripts deployed

Once the attackers gained control over a target system, they moved on to the next phase: loading their required toolkit via custom scripts. Variations of these scripts were consistently found alongside fd.aspx on compromised hosts. Most of them interact with legitimate tools, which makes them look almost identical to routine administrative scripts at first glance. The only real giveaway is the code comments, written in Ukrainian. One such script is responsible for deploying AnyDesk on the compromised host.

The build quality of these scripts is worth discussing separately. Several of them show telltale signs of AI generation; inside some compromised systems, we found multiple iterations of the exact same script, a few of which were completely broken. AI-generated code typically fails to work out of the box and requires manual tweaking to run properly.

First, the script checks for admin privileges, as it cannot proceed without them. If that check passes, it looks for an active anydesk.exe process. If the process is missing, the script fetches and installs the application directly from the official website. Once AnyDesk is successfully installed, the script configures an unattended access password and pulls the unique AnyDesk ID. All the collected details are compiled into a report and exfiltrated to the attackers’ server at 185.221.153[.]121. Because we spotted simultaneous activity from multiple groups – 4BID, Hakerskii Kit, and C.A.S. – on the analyzed hosts, this IP address could potentially belong to any one of them.

Besides AnyDesk, the threat actors leverage other legitimate tools. One example is Microsoft Dev Tunnels, a Microsoft service that exposes a local server to the internet. It’s brought into the system by a separate script that, much like the one for AnyDesk, checks if the utility is already present before downloading it from the official site. In certain instances, the utility was fetched directly from the attackers’ server instead:

Once installed, the application runs, and the resulting connection details are saved to a file named login.txt. The contents of this file consist of standard instructions for using a provided code to authenticate on a Microsoft page through a web browser.

To sign in, use a web browser to open https://login.microsoft.com/device and enter the code [CODE].

As a final step, the script opens up the required ports and creates the tunnel, giving the attackers a back door into the compromised host.

Another script we uncovered handles the installation of Panorama9, a legitimate remote monitoring and management utility. Immediately after downloading that application, the attackers configure it via the registry to hide both its system tray icon and its installation folder. To camouflage the Panorama9 services, the attackers rename them to Windows Update Helper and Windows Update Helper Cache and swap out their descriptions, making the utility look almost identical to standard system components. Once the utility finishes its job, the script clears its tracks.

The attackers used a dedicated script to establish persistence on the system. When executed, it used the net user command to spin up a local user account and then hid it via the registry. The script added this new user to every available local group; if the machine was domain-joined, it also attempted to inject the user into all Active Directory groups.

At the same time, the script tweaked RDP settings: it set the minimum encryption level through the registry, added a firewall rule to allow port 3389, and ran the relevant services.

After it wrapped up its main tasks, the script wiped the event logs, command history, temporary files, and finally itself. Once the attackers got what they wanted out of the infected host, they triggered another script that removed the previously created user account, cleaned out the registry keys generated during the earlier phases, and then deleted itself as well.

The scripts described here are just the most telling examples out of dozens of samples we found. An analysis of the attackers’ toolkit reveals a clear trend: they aren’t just fine-tuning the solutions they’ve used in the past (specifically, the AnyDesk deployment script), but are actively broadening their arsenal with new tools like Panorama9, Dev Tunnels, and others.

Publicly available utilities

As previously mentioned, the attackers leverage a broad spectrum of dual-use public software, such as all kinds of remote monitoring and management utilities. While they use the scripts discussed above to drop some of the utilities onto systems, we didn’t encounter scripts for others, so we can’t confirm whether any exist. We observed the following tools deployed across the campaigns in question:

• AnyDesk: a remote administration tool
• Advanced IP Scanner: a network scanning utility
• Dev Tunnels: a Microsoft service used for exposing a server to the internet
• Panorama9: an IT infrastructure management and monitoring service
• Nezha Monitoring: a server status monitoring utility
• Tactical RMM: a remote monitoring and management tool

C2 and communications

To gain a foothold in the victim’s infrastructure, the attackers relied on several post-exploitation frameworks. Some of these are publicly available utilities, while others are custom-built.

Among the publicly available tools in the group’s arsenal are:

• Sliver
• Havoc
• Apollo Mythic
• Adaptix

We also discovered a previously undocumented backdoor, dubbed BlackSalt, which contacts the C2 server to fetch commands and executes them via cmd.exe.

Sliver

On several hosts, following the initial Microsoft Exchange server compromise, files named upd.exe, winhost.exe, update1.exe, update.exe, and akolo.exe were dropped alongside the previously mentioned fd.aspx files and scripts. All of them were located in the C:\Windows\System32\inetsrv\ directory and were configured as SFX archives with nearly identical payloads, which ran an install.bat script upon extraction.

The script copies the malicious components into the Windows folder and installs servicechecker.bat as a system service. To do this, it leverages the legitimate Windows Service Wrapper (WinSW) utility included in the archive under the filename backupsrv.exe. The archive also contains the WinSW configuration file, backupsrv.xml, which specifies exactly which script should be registered as a service. Once installed, servicechecker.bat is configured to run automatically on system boot.

The servicechecker.bat script, in turn, runs backupagnt.exe, a loader for the main malicious component housed in WindowsInternal.UpdateComponent.dll. This file was built with the help of the Donut utility and is encrypted with a simple single-byte XOR key (0x0F). Its primary job is to inject the Sliver code straight into the device’s memory.

All Sliver instances uncovered during this investigation were configured to communicate with the C2 server at 185.221.153[.]121 over mTLS.

Havoc

Inside a similar SFX archive located in the user directory $user\desktop\ under the filename demon.x64.exe, we found another post-exploitation framework: Havoc. This instance was configured to communicate with the C2 server at 77.72.85[.]62.

Apollo

Mythic Apollo is a cross-platform post-exploitation agent used within the Mythic framework to manage compromised systems. It provides a persistent connection to the C2 server, executes operator commands, handles file uploads/downloads, runs arbitrary code, and supports expansion via plugins. We previously provided a detailed breakdown of the Mythic framework in our post, Hunting for Mythic in Network Traffic.

Here is an example of the Mythic Apollo configuration we encountered in these hacktivist attacks:

This specific sample of the .NET Mythic Apollo agent was compiled with an extensive suite of modules and supports multiple transport profiles that enable communication via HTTP, TCP, WebSocket, SMB, named pipes, and web shells. The C2 address 77.72.85[.]62 is hardcoded into its configuration.

Adaptix

AdaptixC2 is another post-exploitation framework in the attackers’ arsenal. This is a relatively new open-source project, which we broke down in our post, Adapt or pay:an analysis of the AdaptixC2 framework.

The agent samples discovered during our investigation into these hacktivist campaigns consist of a packed AdaptixC2 Beacon delivered via a custom x64 loader. Upon execution, the payload decrypts an embedded shellcode, allocates memory, and executes the malicious payload using the CreateThread WinAPI function. Packed inside the shellcode is the AdaptixC2 Beacon agent in DLL format, featuring a configuration encrypted using RC4.

According to the AdaptixC2 classification system, this agent falls under the BEACON_HTTP type. It is capable of executing commands, performing file operations, enumerating and killing processes, launching new programs, and exfiltrating data back to the C2. It also supports SOCKS port forwarding and BOF modules.

AdaptixC2 uses encryption to keep its configuration under wraps. The corresponding block contains the data size, the actual RC4-encrypted configuration, and a 16-byte key.

BlackSalt Backdoor

During the investigation, we also came across target infrastructures running vulnerable versions of Microsoft Exchange where – much like the Sliver cases – SFX archives named WindowsServiceHelper.exe were discovered in the C:\Windows\System32\inetsrv\ directory. Once extracted, the archive executed an install.bat file.

Similar to the other archives of this type, the script uses the WinSW utility to install the malicious components. In this specific case, however, the primary payload is a file named svc.exe, which turns out to be an obfuscated backdoor written in VBS. Much like the deployment scripts used for the remote management utilities, the code of this setup BAT script was clearly put together with AI tools and features comments in Ukrainian.

The backdoor is essentially a textbook reverse shell. Its capabilities boil down to fetching commands from the C2 server at 45.150.109[.]2, executing them via cmd.exe, and piping the output back to the C2.

EDR killers

In their attacks, the threat actors deploy what are known as EDR killers: malicious tools designed to disable security software on the system. In the vast majority of cases, these utilities rely on the BYOVD technique.

On the hosts compromised during these hacktivist operations, we discovered samples named kil.exe and Killer.exe. These are modified versions of the public, Rust-based BYOVD project EDRKiller. The attackers streamlined the utility to act strictly as a client for the driver and expanded the hardcoded list of security processes to terminate. The sample targets the vulnerable Warsaw_PM driver, though it lacks the functionality to load the driver itself – the attackers drop it onto the system separately.

The general workflow plays out as follows:

1. In user mode, the program finds the PID of the target process.
2. It opens a handle to \\.\Warsaw_PM.
3. It constructs a buffer containing the target process’s PID.
4. It calls DeviceIoControl.
5. The driver executes the calls:
   • ZwOpenProcess;
   • ZwTerminateProcess.

The EDR killer continuously enumerates processes, repeatedly sending the IOCTL and terminating the target processes every single time they pop up.

Both kil.exe and Killer.exe share the exact same list of processes targeted for termination:

MsMpEng.exe, SenseIR.exe, SenseNdr.exe, SenseCncProxy.exe, SenseSampleUploader.exe, NisSrv.exe, avp.exe, kavfs.exe, bdagent.exe, bdservicehost.exe, vsserv.exe, AvastSvc.exe, AvastUI.exe, aswidsagent.exe, avgsvc.exe, mfemms.exe, mfefire.exe, mfevtps.exe, dwengine.exe, dwservice.exe, elastic-agent.exe, elastic-endpoint.exe, Sysmon.exe, wazuh-agent.exe, ipban.exe

Another utility used to kill security software processes is ghostdriver.exe, an unmodified build of the open-source project GhostDriver. In this case, the attackers simply pulled a version straight from GitHub and didn’t modify any of its code.

The tool operates through the following stages:

1. Identify target processes
   The program takes a list of process names (such as msmpeng.exe) via command-line arguments. If no list is specified, it falls back to a default set.
2. Enumerate system processes
   To locate PIDs, the tool relies on standard Windows APIs:
   • CreateToolhelp32Snapshot
   • Process32First
   • Process32Next
3. Generate a list of processes to kill.
4. Load the vulnerable driver
   This is the core phase of the utility’s operation. During this step:
   • The sys driver is written to disk.
   • A SERVICE_KERNEL_DRIVER type service is created.
   • The driver is kicked off via the Service Control Manager (SCM).

GhostDriver.sys is hardcoded inside the GhostDriver executable and is a binary driver known as RentDrv2 (BadRentdrv2).

It contains the CVE-2023-44976 vulnerability, which allows it to:

• Accept user-mode commands via DeviceIoControl.
• Perform operations on processes from kernel mode.
• Bypass security mechanisms, including Protected Process.

Upon execution, GhostDriver drops RentDrv2 to disk, loads it into the Windows kernel, and connects to it via the virtual device \\.\rentdrv2. The utility then issues command 0x22E010 to the driver, passing along the target process ID, and the driver terminates that process directly from kernel mode.

GhostDriver runs in a continuous loop. Every ~700 ms, it rescans for the target processes and sends out termination commands.

After the driver starts up, the utility attempts to delete the ghostdriver.sys file. To do this, it opens a file handle, uses the SetFileInformationByHandle WinAPI function to rename it to something like :GhostDriver, reopens the handle, and marks the file for deletion via FileDispositionInfo. Before wrapping up, it also tries to stop and remove the driver service, and delete the C:\rentdrv.log file where the driver writes its logs.

Example of the adversary command execution launching GhostDriver:

Current versions of Kaspersky products are resilient to these types of attacks: the utilities described in this post cannot terminate their processes.

Connection to the ClearWater ransomware

Alongside the previously described Mythic Apollo samples (C2: 77.72.85.62), backupagnt.exe loaders, and Panorama9 deployment scripts, we discovered a new ransomware strain named ClearWater across several compromised infrastructures. Written in C++ and compiled with GCC (MinGW), the sample is a 64-bit Windows executable. It features zero obfuscation; in fact, the binary wasn’t stripped of its DWARF debug information. This makes analyzing the sample significantly easier and points to either sloppiness or a lack of technical expertise on the developers’ part.

When executed, ClearWater logs its progress in a separate console window.

File encryption

Like most ransomware strains, ClearWater is a Trojan designed to locate and encrypt the victim’s files. The Trojan executable contains a hardcoded RSA-2048 primary public key in PEM format.

For every file it processes, the ransomware generates a new 32-byte key and a 12-byte nonce – though only 8 of those 12 bytes are actually used – and encrypts the file’s contents via the ChaCha20 symmetric algorithm. The ChaCha key is then RSA-encrypted and appended to a specific data structure at the end of the file. To pull this off, the malware leverages cryptographic implementations from the open-source libsodium library.

struct
{
	uint8_t label[4];			//'M', 'Y', 'E', 'K' marker
	uint32_t rsa_encr_size;		//size of RSA-encrypted data
	uint8_t rsa_encr_data[256];	//RSA-encrypted ChaCha key
};

The Trojan processes all files except those with a .txt extension. This approach can easily break installed software, as it blindly encrypts both libraries and executables; however, it does explicitly skip the system directory during its search. Encrypted files are additionally appended with the .clear extension. The malware scans for targets on local drives as well as SMB network shares, which it maps out by using the net view command.

Additional functionality

Within every directory it processes, the Trojan drops the attackers’ demands into a file named CLEARWATER_README.txt.

Additionally, by modifying the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key, the malware sets up a persistence mechanism that automatically opens the ransom note with notepad.exe on startup.

ClearWater is distributed inside a self-extracting archive. The extraction script runs in silent mode (GUIMode=”2″), escalates privileges via a UAC prompt, drops the Trojan at C:\ProgramData\ClearWater_x64.exe, and kicks it off. Once the ransomware finishes running, the SFX archive cleans up after itself and wipes the original archive (SelfDelete=”1″).

Alongside this script and the Trojan executable, the archive includes a BMP image. The ransomware sets this image as both the desktop wallpaper (by tweaking the HKEY_USERS\<…>\Control Panel\Desktop\Wallpaper registry key and calling SystemParametersInfoA with the SPI_SETDESKWALLPAPER parameter) and the lock screen background (by modifying the LockScreenImagePath and LockScreenImageUrl values under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP).

To complicate system recovery after the attack, ClearWater performs several actions typical of ransomware:

• Deletes shadow copies using the following commands:
  
• Wipes the backup catalog and disables Windows Restore:
  
• Removes restore points:
  
• Disables the system startup recovery option:
  

ClearWater also features a kill_all_non_whitelisted_processes() function designed to terminate active tasks, though it doesn’t actually call it during execution. This function leverages PowerShell to look up and kill any process whose name isn’t included in a hardcoded allowlist within the Trojan’s body. It uses the following PowerShell code to do this:

Get-Process|Where-Object{$w -notcontains $_.Name.ToLower()}|Stop-Process -Force

The exclusion list contains various essential system processes and breaks down as follows:

system, idle, smss, csrss, wininit, services, lsass, winlogon, svchost, explorer, dwm, shellexperiencehost, runtimebroker, trustedinstaller, tiworker, textinputhost, taskhostw, mousocoreworker, fontdrvhost, audiodg, sihost, spoolsv, taskeng, taskhost, searchui, securityhealthservice, startmenuexperiencehost, searchindexer, backgroundtaskhost, sppsvc, wmiprvse, wudfhost, vboxservice, vboxtray, vmtoolsd, vmwaretray, vboxguest, vmsrvc, vgauthservice, vmacthlp, qemud, qemu-ga, msdtc, searchprotocolhost, wlanext, dllhost, conhost, comppkgsrv, msmpeng, mssecflt, systemsettings, securityhealthsystray, nvtray, nvvsvc, ravbg64, igfxtray, igfxem, igfxcuiservice, igfxhk, igfxext

Updated Blackout Locker

In a previously published report (link in Russian) on collaborations between several hacktivist groups, we highlighted a tool called Blackout Locker. In late January 2026, the 4BID group ran a series of attacks against organizations in Russia using an updated version of this malware. This section breaks down the new version of Blackout Locker and covers its key characteristics uncovered during our analysis.

Rust dropper

The attackers use a dropper written in Rust to distribute Blackout Locker. Depending on the specific sample, the dropper first carries out a series of staging actions. It then writes the payload executable to …\Users\[USERNAME]\AppData\Local\Microsoft\[REDACTED].dat and swaps its extension to EXE by calling the Windows command prompt:

After that, it launches the renamed executable.

Blackout Locker

The primary tool deployed in the attacks in question is an updated version of Blackout Locker.

Our analysis revealed that the key difference in this new version is the addition of a screen locker component, which it drops and executes in tandem with the ransomware’s main background payload.

During the initial phase, the screen locker file is created under the following paths:

To launch the screen locker, several tasks are created:

The screen locker is also written to the following registry keys:

After this, two LNK files, SystemHelper.lnk and WindowsHelper.lnk, are created via PowerShell for subsequent execution:

• The first file is placed in the %PROFILEPATH%\All users\Start menu\Programs\Startup directory:
  
• The second file is placed in the %USERPROFILE%\Start menu\Programs\Startup directory:
  

As a result, a shortcut is created in the startup folder pointing to WindowsSystemHelper.exe located on the desktop. This ensures the screen locker appears every time the user logs in. Even if the victim enters the correct password into the locker window, it will keep popping back up; while the window itself closes after password entry, the corresponding task is never actually deleted.

Screen locker

During execution, Blackout Locker generates a file named README.txt, which the screen locker later references to pull the text displayed to the user. Some Blackout Locker samples drop a ransom note written in English:

On the lock screen, it may look like this:

Other samples deploy a ransom note in Russian:

If the program fails to read README.txt, it falls back to a hardcoded ransom message. If this fallback message is in Russian but the victim’s operating system lacks support for Cyrillic encodings, the loader’s on-screen output renders as garbled text.

Attack geography

The majority of the compromised infrastructures belong to Russian and Belarusian organizations, which aligns with the stated agenda of these hacker groups. However, for the first time, we identified victims in other countries with no relation to this agenda: Kazakhstan, the UAE, Syria, and Egypt. Within the network of a Kazakh aviation company, we detected multiple post-exploitation frameworks pointing to C2 servers at 77.72.85[.]62 and 185.221.153[.]121, traces of the Panorama9 and Tactical RMM platforms, and backupagnt.exe loaders. A similar footprint was observed in the infrastructure of an Egyptian hospital, though the familiar toolkit was augmented by the fd.aspx web shell. The remaining international victims exhibited a nearly identical combination of artifacts, with only minor variations.

While the primary targeting vector previously centered on Russia and Belarus, the threat actors now appear to be pivoting their attention toward the wider CIS region and the Middle East. This strategic shift correlates with a statement from a member of the 4BID group, who claimed that attacking Russia is no longer profitable.

Takeaways

The hacktivist groups discussed in this report are steadily expanding the geographical footprint of their campaigns, pushing beyond Russia and the wider CIS region. Alongside this expansion, we observe the growing use of ransomware and other tooling consistent with financially motivated operations, which may further influence their choice of victims.

This shift underscores the critical need for continuous threat landscape monitoring. To stay ahead of threat actors, organizations must look beyond the immediate risks facing their perimeter and proactively track emerging threats, including the tactics of groups targeting specific industry verticals or geographic regions.

Detection by Kaspersky solutions

Kaspersky solutions reliably detect the malicious activity in question at every stage of the malware lifecycle. This section outlines potential detection scenarios.
Publicly available dual-use software leaves numerous artifacts on targeted hosts, which helps Kaspersky Endpoint Detection and Response Expert trace the activity of these utilities.

For instance, network connections established with Panorama9 servers both during the initial software launch and throughout the tool’s operation trigger the panorama9_dns_activity rule. The Hunt Hub section of our TI Portal features detection rules for other event types and specific operating systems, searchable with the keyword panorama9. Similar rules exist for the other utilities described in this post: Tactical RMM, Nezha, and Dev tunnels.

GhostDriver.exe relies on an embedded vulnerable driver, which it drops onto the target host. The creation of these drivers is detected by the vuln_driver_created_by_unsigned_process rule family.

Ransomware is inherently quite noisy and so can be detected at various execution phases. The execution graph within Kaspersky Cloud Sandbox on our Threat Intelligence Portal visualizes the entire ClearWater execution chain, capturing key behaviors such as modifying the desktop wallpaper and deleting shadow copies.

Additionally, the Threat Lookup and Research Graph sections of Kaspersky Threat Intelligence Portal allow you to visualize and analyze the connections between the malicious domains and files used by the adversaries.

Monitoring network traffic is another highly effective method for detecting the malicious activity described here. Kaspersky Anti Targeted Attack (KATA) with the NDR module detects the network communications of all malware samples in question utilized throughout this campaign.

For instance, upon detecting HTTP network activity characteristic of the BlackSalt backdoor, the system triggers an alert for the Backdoor.BlackSalt.HTTP.C&C rule triggering.

Examples of using the Kaspersky Anti Targeted Attack (KATA) platform with the NDR module to detect other agents described here – along with their detailed technical analysis – are available in our dedicated reports on Adaptix and Mythic detection.

Indicators of compromise

Web shells
26100db3f56880110a92a2b4742d6eaf	fd.aspx
cf682a6fee80a78be578b1edd82627fa	fd.aspx
2d5533fb65ebb50a5a5fd53e62d73b9a	fd.aspx
fe04d230db612ea24af3826fda667131	fd.aspx
Scripts
2db94ee3ec69988588702bd77999a5d4	any_local.ps1
f88d2b5c3b885ad5a9c1c44551bccc60	main.ps1
1e1edf879b2dc6c9892a22bfa5985db1	main.ps1
78250fa890220821e2b91e31b965de59	main.ps1
f2af797ac45b9f578c53cc49e5797397	auto_dev.ps1
0c32bfdf83ecebe3a1399d261dc8ff57	auto_dev_test.ps1
e14cc9a959bbe16c48b8dff063b311f3	auto_dev_test_multimple_task.ps1
36b3be503c6e34613ff50cb28e0f3ddb	auto_dev_test_multimple_task.ps1
c12ebe625737ed0908b045e811f14ecd	tun.ps1, auto_dev_test_multimple_task.ps1
1c0924f5711a24821921de5ad822213b	grant.ps1
d78adab5e16c26d4cd14fe38f77e29e6	pan.ps1, pam.ps1
6cf548445c39aff844be96d73c89e376	test.ps1
911a21aa999c324dc960d3498eec528e	radiant.ps1
68e310de44c3165ffffa25bc495d6fc5
4f41a22b3e7469fb6b45a42d71ec7087
80e5bde401d6b0ca96015ae9cfeb6535
1c82a94c362a9e98a66ae57d6ff37900
fa04aeedc0d2f5bb6ed357fdae1c1435
AdaptixC2
555a6722436d7cf7de396e0c57d32a27
b974141ff9ad1efb60dd9e16977266ca
7da855b2fd9b52f9088e64d656164637
d08056c2ac28933d6843658c2c8c574f
038cab0c60c53cf12f048272014024c0
c183033d86d2e052b8eb0deb2136ab29
bc0ebf67986eea803b4c9633ed3a4bb5
18618f4b468ba4e64c2e1072a6da2134
1742a9fa35e253614b76ac0f687ba02e
c7eb6da3aa216816079a1b785097552a
3ee38b944e5c83922f99641846f7db0c
d8ff7f417d56fa2a3baf3c8933013a25
1ff222457f5e0e32adfa8341f260dde7
ede8ce887dd9ab7add0f0fc872d51369
1344e6bc51cea35befb4adff7a25899b
2a09162d72aa416e18bab46070043a13
841b7d3863b49f62d4faa9949ff5df38
1bd1ca848b15530e39792b4fe6f31367
Mythic Apollo
b36968b98046d1b033d84f292e7ca1cb
663a479d6d24c767f1d3229a0a91554b
54a308f734095d54ae0e1c86c849a2d8
3137958eb830186826d486afd9222aee
1d09499cb2d7d70df903b60602a58887
d74262f968dc3f378c4021a89d16a292
3d9cbc944f9a9e127550ffb4e8394965
bcd3859f4ddd72c4690d76c3b4ef8955
3a9b0875fc692944c180b165a83a0d17
c558e6a9d0a697c757aa6d7782e269c9
61647db645f7cc221046999ef1dbe1d1
02493e1cb684be6a1a1fc6334a56c516
a3dba01c76571adc0797801ff30f2b90
3f4fbba101b209b00e70787fd5bab819
cd0c5b9e4e47df4231d02ed87ff49f26
b8a13e808b5b5f1836d3e559755139d0
60f8b115aec8a13b0069efc84fc645f5
da55b5612a80ef20ec75b68151e7ff4b
7d35b4961914ad83a57f8832d8e870d8
334abbdc99d359aab2ea371dd4eda5f2
389a1bbdbf5c91bd1c179227f5ae0923
87d48fbccb4aaee95222e215ecb7ebec
76c819185e3c8b8557a2c3986ab80a7c
6d19c8eea11d50c01d20f18382a964d1
Other C2 frameworks
8db0adf8fd6dc6195d7ae55e37e49f97
08f3a14a2337eb9936c38f5159be007c
717ab7624c192f6f8dd38994116c28dc
d1c51b92939aa168f0951a8368841373
5398b7eaa94f0ee570b1c5642b559047
d65a79ea9257637c77cab6e087468912
008cd423ca45134d3343f66cced1d104
9741672506f26813c71839aaa6aa3882
06bed0a0906e52c764b3b7016d6a4428
upd.exe (SFX archive)
08c069f133ac27cbc02a0ed79e4e87ba	upd.exe
a36082c998391a3ebaf05ba4f834172c	backupagnt.exe
9810ea6752112b3569ddc096e1a72e1d	sliver
update1.exe (SFX archive)
10824d14c814524155f2b529cf5fee43	update1.exe
a36082c998391a3ebaf05ba4f834172c	backupagnt.exe
9810ea6752112b3569ddc096e1a72e1d	sliver
akolo.exe (SFX archive)
242038139842ec79ec1044c64eb0804a	akolo.exe
53ba13cc6066adfd67f8098c0a5b8dde	backupagnt.exe
9810ea6752112b3569ddc096e1a72e1d	sliver
update.exe (SFX archive)
84bb66a982710c5536143a07d84e8749	update.exe
a36082c998391a3ebaf05ba4f834172c	backupagnt.exe
9810ea6752112b3569ddc096e1a72e1d	sliver
akolo.exe (SFX archive)
fa3c222f6b53d6a2e35a54600f6aa011	akolo.exe
0b1870d57221eec6f3bbef648e71a724	backupagnt.exe
5e81f72614db42615489266be11b1d09	sliver
akolo.exe (SFX archive)
4c8a0531653b5398a35c6b1b80ff1350	akolo.exe
83f66862c0cc40da20236fd6b47138fd	backupagnt.exe
5e81f72614db42615489266be11b1d09	sliver
[REDACTED].exe (SFX archive)
56be07e46fd452315008ed246ebbf52b	[REDACTED].exe
579e8bbd6a5bcca89b5acd6fb5db32db	backupagnt.exe
dd8fea244afc8223b961f1d9d6ac8c5d	Apollo
WindowsServiceHelper.exe (SFX archive)
09d0517a1f69feff8186655ae3b567e0	WindowsServiceHelper.exe
62123c39477389d500e74e82782adea5	BlackSalt Backdoor
winexe.exe (SFX archive)
6d365de5c5a13006b7cadd6bc6876e84	winexe.exe
2f40bcee90abed0898e92521da17e52d	BlackSalt Backdoor
WindowsServiceHelper.exe (SFX archive)
6dfef58ef68fb7965a23da8be3141af9	WindowsServiceHelper.exe
56d1de3159adbfda20aca593c99901f9	BlackSalt Backdoor
[REDACTED].exe (SFX archive)
96dbdc2651d829bf9ba35674dd4bfcae	[REDACTED].exe
129225b3e93c17f131bcc2a982ffb09a	BlackSalt Backdoor
test.exe (SFX archive)
9f37fff7e5d22f83fc1c0872ad5332f9	test.exe
cf54f6cbdb4dbf1ce6fc2e5be4ca3b20	BlackSalt Backdoor
1.exe (SFX archive)
e99efd77392e2b4fe4d9bf5728a12b98	1.exe
129225b3e93c17f131bcc2a982ffb09a	BlackSalt Backdoor
WindowsServiceHelper.exe (SFX archive)
f2dc794bf93887e281ad89209493065a	WindowsServiceHelper.exe
2f40bcee90abed0898e92521da17e52d	BlackSalt Backdoor
EDR killers
d13997b1716e4c82ab454285202eafdc	killer.exe, 2.exe
ecb57d8793514aa02314417265b1853f	kil.exe, 3.exe
3b974ff986445e5944c51179d19bd6be	GhostDriver.exe

Network indicators
212.46.12[.]182
185.221.153[.]121
77.72.85[.]62
45.150.109[.]2
130.49.155[.]112
45.112.194[.]82
138.226.236[.]52
85.137.253[.]186