CTO at NCSC Weekly Summary (week ending July 19, 2026): Russian FSB Center 16 router exploitation, Turla, Daxin/Stupig, GoldenEyeDog DigiCert compromise, CVE-2026-40639

Key facts

Detection coverage

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5143 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CylindricalCanine .scr Side-Load Chain (update.log / Golden Gh0st RAT) - Exploitation

TL-2026-5143. Detects the CylindricalCanine (GoldenEyeDog) lure used against DigiCert support staff: a ZIP delivered over support chat contains a .scr executable that runs from a user-writable path, side-loads an unsigned DLL and stages an encrypted update.log payload before deploying Golden Gh0st RAT. Fires when at least two of the three behaviours (user-path .scr execution, unsigned DLL load by the .scr process, update.log creation by the .scr process) occur on the same host/process.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.003, T1204.002, T1574.002, T1036.008
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h
```TL-2026-5143 CylindricalCanine: .scr from support-chat ZIP side-loads an unsigned DLL and stages update.log (Golden Gh0st RAT chain)```
((EventCode=1 Image="*.scr" (Image="*Downloads*" OR Image="*Temp1_*" OR Image="*AppData*Temp*" OR Image="*Desktop*"))
 OR (EventCode=7 Image="*.scr" ImageLoaded="*.dll" Signed="false")
 OR (EventCode=11 Image="*.scr" TargetFilename="*update.log"))
| eval signal=case(EventCode=1,"scr_exec_user_path",EventCode=7,"scr_unsigned_dll_sideload",EventCode=11,"update_log_staged")
| fillnull value="n/a" User ImageLoaded TargetFilename ParentImage
| stats dc(signal) as signal_count values(signal) as signals values(ImageLoaded) as dlls values(TargetFilename) as files values(ParentImage) as parents min(_time) as first_seen max(_time) as last_seen by host User Image
| where signal_count>=2
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let lookback = 24h;
let scr_exec = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName endswith ".scr"
| where FolderPath has_any ("Downloads", "Temp1_", "Temp", "Desktop")
| project DeviceId, DeviceName, AccountName, ProcessId, ScrFile=FileName, ScrPath=FolderPath, Parent=InitiatingProcessFileName, ExecTime=Timestamp;
DeviceImageLoadEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName endswith ".scr"
| where FileName endswith ".dll"
| where FolderPath !has "System32" and FolderPath !has "WinSxS"
| project DeviceId, ProcessId=InitiatingProcessId, LoadedDll=FileName, DllPath=FolderPath, DllSha256=SHA256, LoadTime=Timestamp
| join kind=inner scr_exec on DeviceId, ProcessId
| where LoadTime between (ExecTime .. (ExecTime + 10m))
| project ExecTime, DeviceName, AccountName, ScrFile, ScrPath, Parent, LoadedDll, DllPath, DllSha256
| order by ExecTime desc

Sigma

title: Screensaver Executable Launched From User-Writable Path (Gh0st Side-Load Chain)
id: 7c1d0e52-3b8a-4f6e-9a47-5d2e8b1c3f90
status: experimental
description: Detects .scr executables launched from download, archive-extraction, temp or desktop paths. This is the lure used by CylindricalCanine (TL-2026-5143) in the April 2026 DigiCert support-chat intrusion, where the .scr side-loads a DLL and reads update.log to deploy Golden Gh0st RAT.
references:
    - https://expel.com/blog/introducing-cylindricalcanine/
    - https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html
author: Threadlinqs Team
date: 2026-11-03
tags:
    - attack.initial_access
    - attack.t1566.003
    - attack.execution
    - attack.t1204.002
    - attack.persistence
    - attack.t1574.002
    - attack.defense_evasion
    - attack.t1036.008
    - attack.s0032
logsource:
    category: process_creation
    product: windows
detection:
    selection_scr:
        Image|endswith: '.scr'
    selection_path:
        Image|contains:
            - '\Downloads\'
            - '\Temp1_'
            - '\AppData\Local\Temp\'
            - '\Desktop\'
    filter_system:
        Image|startswith: 'C:\Windows\'
    condition: selection_scr and selection_path and not filter_system
falsepositives:
    - Legitimate third-party screensavers run from a user profile
    - Software packaging or testing workflows that execute .scr files from Temp
level: high

Known false positives:

• Legitimate third-party screensavers executed from a user profile or Downloads folder
• Software packaging/testing workflows that run .scr files from Temp

Tuning notes: Allowlist known corporate screensaver hashes and signed publishers. Raise priority when the parent is a chat, browser or archive tool (7zFM.exe, WinRAR.exe, explorer.exe) or when the host belongs to a support or help-desk team. The signal_count>=2 threshold can be lowered to 1 for support-desk assets.

• 🔒 FSB Center 16 Network Device Targeting - Cisco Smart Install and SNMP From Untrusted Sources - Exploitation · unlock with TL Creds
• 🔒 Backdoor.Daxin Kernel Driver [indicator] Dropped or Loaded - Post-Exploitation · unlock with TL Creds
• 🔒 Executables Signed By CAs Revoked After DigiCert Breach Running From User-Writable Paths - Defense Evasion · unlock with TL Creds
• 🔒 Screensaver (.scr) Dropped From Archive Into User-Writable Path - Support-Chat ZIP Lure · unlock with TL Creds
• 🔒 Windows Event Log Clearing (wevtutil, Clear-EventLog, Event 1102/104) - Defense Evasion · unlock with TL Creds
• 🔒 Backdoor.Stupig Trigger - Logon Attempt With 'stupig' Username Prefix - Command and Control · unlock with TL Creds
• 🔒 Backdoor.Stupig Keyboard-Layout DLL Loaded Into winlogon.exe - Post-Exploitation · unlock with TL Creds
• 🔒 Daxin-Style Inbound-to-Internal TCP Relay (Multi-Hop Proxy Heuristic) - C2 / Lateral Movement · unlock with TL Creds

Indicators of compromise

As of 2026-11-03, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5143.

Sample indicators (3 of 21)

• Domain: api[.]stanfordstudies[.]com
• File hash: 49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530
• Domain: extensions-hub[.]com

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

Technical analysis

Also tracks CVE-2026-40639, a weak XOR BIOS password encoding flaw in Dell systems including the unpatched Wyse 5070.

This record aggregates the highest-signal items from the CTO at NCSC summary for the week ending July 19, 2026 and cross-checks them against primary sources.

Russia: On July 13, 2026 the UK NCSC and 18 agencies across 12 countries published a joint advisory warning that FSB Center 16 (also tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard and Static Tundra) continues to exploit poorly configured networking devices. Reported methods include scanning for default or weak SNMP credentials, abusing known Cisco vulnerabilities and the Cisco Smart Install (SMI) feature, and exploiting web management portal flaws. Targeted sectors are communications, defence, energy, financial services, government and healthcare; the advisory cites a December 2025 attack on Poland's energy grid that, had it succeeded, would have cut power to roughly 500,000 civilians. On the same date CERT-FR (CERTFR-2026-CTI-005) attributed the targeting and compromise of French ministries, diplomatic, defence, justice and technology entities to the Turla intrusion set operated by FSB's 16th Centre, active since at least 2004. Netherlands AIVD/MIVD separately reported that Russian state actors are systematically compromising internet-connected IP cameras for espionage in the Netherlands, EU and NATO states and Ukraine. The summary also references CERT-UA reporting on UAC-0145 (KALAMBUR, SUMBUR, TAMBUR, abuse of OpenSSH and TOR, theft of Signal/WhatsApp data, RSYNC exfiltration). The technical PDFs for the CSA, CERT-FR and AIVD reports were not retrievable in full, so no IOCs from them are recorded.

China-linked: Symantec reported Backdoor.Daxin, a Windows kernel-mode driver backdoor (srt64.sys, compile timestamp January 2013), running on a host at a Taiwan-based subsidiary of a multinational high-tech manufacturer, with telemetry beginning May 12, 2026. Daxin communicates by hijacking legitimate inbound TCP connections and supports multi-hop communication across chains of infected hosts. On the same host Symantec found a previously unknown backdoor, Backdoor.Stupig (compile timestamp February 2013), staged as a.dll and later renamed System32\kbdus1.dll to mimic kbdus.dll. Stupig registers as a keyboard-layout provider so that it loads into winlogon.exe, watches the logon screen for usernames beginning with 'stupig', and runs commands as SYSTEM on the secure desktop; it hooks SspiCli!LsaLogonUser and Advapi32!CredUnprotectA and references a companion payload msyun.dll that was not recovered. Symantec notes a possible link to the Daxin operation but no code-level connection is confirmed.

Expel attributed the April 2026 DigiCert incident to CylindricalCanine, a subgroup of GoldenEyeDog (APT-Q-27, Dragon Breath, Miutti Group) active since at least 2015. On April 2, 2026 the actors sent support staff a ZIP disguised as a customer screenshot via the support chat; it contained a .scr executable that used DLL side-loading, showed a decoy PDF with an HTTP 503 error, loaded an encrypted update.log payload and deployed Golden Gh0st RAT. Two analyst workstations were compromised and a customer-support portal account-proxying function was abused to steal certificates intended for DigiCert customers (initialization codes for EV code-signing certificates were sufficient when paired with approved orders). 60 certificates across four CAs were revoked and 27 were explicitly linked to the actor and used to sign Zhong Stealer malware.

Vulnerability: CVE-2026-40639 (published July 10, 2026; research by Craig S. Blackie of MDSec and Darren McDonald of AmberWolf) stems from Dell BIOS passwords being stored with a weak repeating-key XOR encoding in SPI flash, handled by the SystemPwSmm SMM driver. An attacker with physical access (SPI flash clip or controlled OS boot) can recover the password in milliseconds, especially for passwords of 12 characters or fewer. Affected models include Latitude E7250, Latitude 7490, XPS 15 9560 and the still-supported Wyse 5070, reported unpatched at publication. Dell rates it Medium, CVSS 5.7.

The summary additionally lists lower-detail items outside the core scope (BirdCall/Zangi masquerade, RokRAT 'Capsule Vault', APT-C-26 monitoring tooling, OkoBot, SharpViewStateKing, AiTM Device Code Flow phishing, OAuth client ID spoofing, forgotten UEFI shims, U-Boot FIT bypasses and a Zimbra 10.1.19 patch for malicious-email code execution without a CVE ID); these are referenced via the source article only.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1014 Rootkit; T1036.008 Masquerading: Masquerade File Type

Collection

T1056.001 Input Capture: Keylogging; T1113 Screen Capture

Discovery

T1057 Process Discovery

Initial Access

T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application; T1566.003 Phishing: Spearphishing via Service

Command and Control

T1090.003 Proxy: Multi-hop Proxy; T1205 Traffic Signaling

Execution

T1204.002 User Execution: Malicious File

Persistence

T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing; T1685.005 Clear Windows Event Logs

stealth

T1574.001 DLL

Resource Development

T1588.003 Obtain Capabilities: Code Signing Certificates

Remediation

Patches

• No patch available for CVE-2026-40639 on Dell Wyse 5070 at time of publication; track the Dell advisory
• Apply Zimbra 10.1.19
• Apply Microsoft June 9, 2026 updates addressing forgotten UEFI shim Secure Boot bypasses

Immediate actions

• Upgrade network devices to SNMPv3 and disable legacy SNMP versions; replace default/weak credentials
• Disable Cisco Smart Install and restrict management protocol access with access controls
• Hunt for kbdus1.dll / a.dll in the Windows and System32 directories, srt64.sys in System32\drivers, and unexpected keyboard-layout provider registrations
• Review code-signing trust: revoke and block certificates issued by the revoked DigiCert, GoGetSSL and Verokey CAs listed in the Expel report

Workarounds

• For CVE-2026-40639: restrict physical access to affected Dell systems and treat BIOS passwords as recoverable; use longer passwords and tamper-evident controls

Longer-term hardening

• Follow the joint router-hygiene guidance: patch network devices, restrict management planes and monitor for configuration changes
• Isolate and inventory internet-connected IP cameras; restrict their egress
• Apply Cyber Essentials and the NCSC Cyber Assessment Framework

Affected and fixed versions

• Dell — Dell Wyse 5070, Latitude E7250, Latitude 7490, XPS 15 9560 (BIOS password storage)
  Vulnerable versions: Dell Wyse 5070 (unpatched); Latitude E7250; Latitude 7490; XPS 15 9560
• Cisco — Cisco network devices with Smart Install / SNMP exposure (targeted by FSB Center 16)
  Vulnerable versions: Devices with default/weak SNMP credentials or Smart Install enabled
• Microsoft — Windows (Daxin/Stupig host compromise; winlogon.exe keyboard-layout provider loading)
  Vulnerable versions: Hosts compromised in Taiwan manufacturer network
• DigiCert — DigiCert customer support portal / EV code-signing certificate issuance
  Vulnerable versions: April 2026 support portal account-proxying function
  Fixed in: Initialization codes masked from proxied portal users post-incident

Timeline

• 2013-01-01 Backdoor.Daxin sample (locked-ioc-7) carries a January 2013 compile timestamp; Stupig carries a February 2013 timestamp (Symantec)
• 2025-12-01 December 2025 attack on Poland's energy grid cited in the joint advisory on FSB Center 16 activity (exact day not stated)
• 2026-04-02 CylindricalCanine sends a ZIP with a .scr payload via DigiCert's support chat, compromising two support analyst workstations (Expel)
• 2026-05-12 Compromised Taiwan manufacturer host begins reporting telemetry to Symantec
• 2026-05-28 First detection of locked-ioc-9 (Backdoor.Stupig) on the host
• 2026-06-01 Renamed locked-ioc-5 detected in System32
• 2026-07-09 Joint CSA on improving router hygiene (FSB Center 16 exploitation) published on media.defense.gov
• 2026-07-10 CVE-2026-40639 (Dell BIOS weak XOR password encoding) published; Dell rates it Medium, CVSS 5.7; Wyse 5070 unpatched
• 2026-07-13 NCSC and 18 agencies from 12 countries publish the Russian router-exploitation advisory; CERT-FR publishes CERTFR-2026-CTI-005 attributing Turla activity against French entities to FSB's 16th Centre
• 2026-07-18 CTO at NCSC publishes the weekly summary for the week ending July 19, 2026

Sources cited

• UK and allies urge critical sectors to improve defences against Russian intelligence targeting (NCSC) NCSC (UK) · Advisory · 2026-07-13
• Joint CSA: Improve Router Hygiene (FSB Center 16 exploitation of networking devices) media.defense.gov · Advisory · 2026-07-09
• CERTFR-2026-CTI-005: Targeting and compromise of French entities using the Turla intrusion set cert.ssi.gouv.fr · Advisory · 2026-07-13
• AIVD/MIVD advisory: Russian state actors are compromising IP cameras english.aivd.nl · Advisory · 2026-07-10
• NVD: CVE-2026-40639 NVD (NIST) · Advisory · 2026-07-10
• UAC-0145 reporting (CERT-UA) CERT-UA · Advisory
• Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor (Symantec) security.com · Vendor report
• Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident (Expel) expel.com · Research
• Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639) (AmberWolf) blog.amberwolf.com · Research · 2026-07-10
• CTO at NCSC Summary: week ending July 19th ctoatncsc.substack.com · News · 2026-07-18
• GoldenEyeDog subgroup linked to DigiCert breach (The Hacker News) The Hacker News · News
• Daxin resurfaces in Taiwan alongside Stupig (The Hacker News) The Hacker News · News

Related threats

• Daxin Returns: China-linked Backdoor.Daxin kernel rootkit and new Backdoor.Stupig (keyboard-layout DLL in winlogon.exe) found in Taiwan

More from FSB Center 16

• CISA AA26-194A: Russian State-Sponsored (FSB Center 16) Exploitation of Misconfigured Cisco Routers via SNMP and Smart Install (CVE-2018-0171, CVE-2008-4128)
• US Treasury Sanctions 1VPNS VPN Service and Cryptor Seller for Enabling Ransomware Operations (linked to FSB Center 16 Router Exploitation via CVE-2018-0171/CVE-2008-4128)
• Static Tundra (Dragonfly/Energetic Bear) ICS Attacks on Polish Energy Infrastructure

Other reports on CVE-2026-40639

• Dell BIOS Flaw (CVE-2026-40639 / DSA-2026-197) Lets Attackers Recover Admin Passwords From SPI Flash

Previous and next in apt

• AI agent frameworks ARTEX (Vapor Panda, Storm-0940) and CyberStrikeAI scale China-linked intrusion campaigns Next report