# CTO at NCSC Weekly Summary (week ending July 19, 2026): Russian FSB Center 16 router exploitation, Turla, Daxin/Stupig, GoldenEyeDog DigiCert compromise, CVE-2026-40639

> A weekly roundup consolidating multi-nation APT activity: FSB Center 16 (Berserk Bear/Static Tundra) exploiting poorly configured network devices, Turla targeting French entities, the Daxin kernel rootkit resurfacing in Taiwan with the new Stupig backdoor, and GoldenEyeDog's CylindricalCanine subgroup compromising DigiCert to steal code-signing certificates. Also tracks CVE-2026-40639, a weak XOR BIOS password encoding flaw in Dell systems including the unpatched Wyse 5070.

- **Published:** 2026-11-03T10:59:49Z
- **Last reviewed:** 2026-11-03T10:59:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5143
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5143.png
- **ID:** TL-2026-5143
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** FSB Center 16 (Russia, China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)
- **CVEs:** CVE-2026-40639

## Description

This record aggregates the highest-signal items from the CTO at NCSC summary for the week ending July 19, 2026 and cross-checks them against primary sources.

Russia: On July 13, 2026 the UK NCSC and 18 agencies across 12 countries published a joint advisory warning that FSB Center 16 (also tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard and Static Tundra) continues to exploit poorly configured networking devices. Reported methods include scanning for default or weak SNMP credentials, abusing known Cisco vulnerabilities and the Cisco Smart Install (SMI) feature, and exploiting web management portal flaws. Targeted sectors are communications, defence, energy, financial services, government and healthcare; the advisory cites a December 2025 attack on Poland's energy grid that, had it succeeded, would have cut power to roughly 500,000 civilians. On the same date CERT-FR (CERTFR-2026-CTI-005) attributed the targeting and compromise of French ministries, diplomatic, defence, justice and technology entities to the Turla intrusion set operated by FSB's 16th Centre, active since at least 2004. Netherlands AIVD/MIVD separately reported that Russian state actors are systematically compromising internet-connected IP cameras for espionage in the Netherlands, EU and NATO states and Ukraine. The summary also references CERT-UA reporting on UAC-0145 (KALAMBUR, SUMBUR, TAMBUR, abuse of OpenSSH and TOR, theft of Signal/WhatsApp data, RSYNC exfiltration). The technical PDFs for the CSA, CERT-FR and AIVD reports were not retrievable in full, so no IOCs from them are recorded.

China-linked: Symantec reported Backdoor.Daxin, a Windows kernel-mode driver backdoor (srt64.sys, compile timestamp January 2013), running on a host at a Taiwan-based subsidiary of a multinational high-tech manufacturer, with telemetry beginning May 12, 2026. Daxin communicates by hijacking legitimate inbound TCP connections and supports multi-hop communication across chains of infected hosts. On the same host Symantec found a previously unknown backdoor, Backdoor.Stupig (compile timestamp February 2013), staged as a.dll and later renamed System32\kbdus1.dll to mimic kbdus.dll. Stupig registers as a keyboard-layout provider so that it loads into winlogon.exe, watches the logon screen for usernames beginning with 'stupig', and runs commands as SYSTEM on the secure desktop; it hooks SspiCli!LsaLogonUser and Advapi32!CredUnprotectA and references a companion payload msyun.dll that was not recovered. Symantec notes a possible link to the Daxin operation but no code-level connection is confirmed.

Expel attributed the April 2026 DigiCert incident to CylindricalCanine, a subgroup of GoldenEyeDog (APT-Q-27, Dragon Breath, Miutti Group) active since at least 2015. On April 2, 2026 the actors sent support staff a ZIP disguised as a customer screenshot via the support chat; it contained a .scr executable that used DLL side-loading, showed a decoy PDF with an HTTP 503 error, loaded an encrypted update.log payload and deployed Golden Gh0st RAT. Two analyst workstations were compromised and a customer-support portal account-proxying function was abused to steal certificates intended for DigiCert customers (initialization codes for EV code-signing certificates were sufficient when paired with approved orders). 60 certificates across four CAs were revoked and 27 were explicitly linked to the actor and used to sign Zhong Stealer malware.

Vulnerability: CVE-2026-40639 (published July 10, 2026; research by Craig S. Blackie of MDSec and Darren McDonald of AmberWolf) stems from Dell BIOS passwords being stored with a weak repeating-key XOR encoding in SPI flash, handled by the SystemPwSmm SMM driver. An attacker with physical access (SPI flash clip or controlled OS boot) can recover the password in milliseconds, especially for passwords of 12 characters or fewer. Affected models include Latitude E7250, Latitude 7490, XPS 15 9560 and the still-supported Wyse 5070, reported unpatched at publication. Dell rates it Medium, CVSS 5.7.

The summary additionally lists lower-detail items outside the core scope (BirdCall/Zangi masquerade, RokRAT 'Capsule Vault', APT-C-26 monitoring tooling, OkoBot, SharpViewStateKing, AiTM Device Code Flow phishing, OAuth client ID spoofing, forgotten UEFI shims, U-Boot FIT bypasses and a Zimbra 10.1.19 patch for malicious-email code execution without a CVE ID); these are referenced via the source article only.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.003 Phishing: Spearphishing via Service
- T1078.001 Valid Accounts: Default Accounts
- T1204.002 User Execution: Malicious File
- T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL
- T1574.001 DLL
- T1014 Rootkit
- T1036.008 Masquerading: Masquerade File Type
- T1553.002 Subvert Trust Controls: Code Signing
- T1685.005 Clear Windows Event Logs
- T1057 Process Discovery
- T1056.001 Input Capture: Keylogging
- T1113 Screen Capture
- T1205 Traffic Signaling
- T1090.003 Proxy: Multi-hop Proxy
- T1588.003 Obtain Capabilities: Code Signing Certificates

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CylindricalCanine .scr Side-Load Chain (update.log / Golden Gh0st RAT) - Exploitation** (`TL-2026-5143-SPL-001`)

TL-2026-5143. Detects the CylindricalCanine (GoldenEyeDog) lure used against DigiCert support staff: a ZIP delivered over support chat contains a .scr executable that runs from a user-writable path, side-loads an unsigned DLL and stages an encrypted update.log payload before deploying Golden Gh0st RAT. Fires when at least two of the three behaviours (user-path .scr execution, unsigned DLL load by the .scr process, update.log creation by the .scr process) occur on the same host/process.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.003, T1204.002, T1574.002, T1036.008
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h
```TL-2026-5143 CylindricalCanine: .scr from support-chat ZIP side-loads an unsigned DLL and stages update.log (Golden Gh0st RAT chain)```
((EventCode=1 Image="*.scr" (Image="*Downloads*" OR Image="*Temp1_*" OR Image="*AppData*Temp*" OR Image="*Desktop*"))
 OR (EventCode=7 Image="*.scr" ImageLoaded="*.dll" Signed="false")
 OR (EventCode=11 Image="*.scr" TargetFilename="*update.log"))
| eval signal=case(EventCode=1,"scr_exec_user_path",EventCode=7,"scr_unsigned_dll_sideload",EventCode=11,"update_log_staged")
| fillnull value="n/a" User ImageLoaded TargetFilename ParentImage
| stats dc(signal) as signal_count values(signal) as signals values(ImageLoaded) as dlls values(TargetFilename) as files values(ParentImage) as parents min(_time) as first_seen max(_time) as last_seen by host User Image
| where signal_count>=2
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let lookback = 24h;
let scr_exec = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName endswith ".scr"
| where FolderPath has_any ("Downloads", "Temp1_", "Temp", "Desktop")
| project DeviceId, DeviceName, AccountName, ProcessId, ScrFile=FileName, ScrPath=FolderPath, Parent=InitiatingProcessFileName, ExecTime=Timestamp;
DeviceImageLoadEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName endswith ".scr"
| where FileName endswith ".dll"
| where FolderPath !has "System32" and FolderPath !has "WinSxS"
| project DeviceId, ProcessId=InitiatingProcessId, LoadedDll=FileName, DllPath=FolderPath, DllSha256=SHA256, LoadTime=Timestamp
| join kind=inner scr_exec on DeviceId, ProcessId
| where LoadTime between (ExecTime .. (ExecTime + 10m))
| project ExecTime, DeviceName, AccountName, ScrFile, ScrPath, Parent, LoadedDll, DllPath, DllSha256
| order by ExecTime desc
```

### Sigma

```yaml
title: Screensaver Executable Launched From User-Writable Path (Gh0st Side-Load Chain)
id: 7c1d0e52-3b8a-4f6e-9a47-5d2e8b1c3f90
status: experimental
description: Detects .scr executables launched from download, archive-extraction, temp or desktop paths. This is the lure used by CylindricalCanine (TL-2026-5143) in the April 2026 DigiCert support-chat intrusion, where the .scr side-loads a DLL and reads update.log to deploy Golden Gh0st RAT.
references:
    - https://expel.com/blog/introducing-cylindricalcanine/
    - https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html
author: Threadlinqs Team
date: 2026-11-03
tags:
    - attack.initial_access
    - attack.t1566.003
    - attack.execution
    - attack.t1204.002
    - attack.persistence
    - attack.t1574.002
    - attack.defense_evasion
    - attack.t1036.008
    - attack.s0032
logsource:
    category: process_creation
    product: windows
detection:
    selection_scr:
        Image|endswith: '.scr'
    selection_path:
        Image|contains:
            - '\Downloads\'
            - '\Temp1_'
            - '\AppData\Local\Temp\'
            - '\Desktop\'
    filter_system:
        Image|startswith: 'C:\Windows\'
    condition: selection_scr and selection_path and not filter_system
falsepositives:
    - Legitimate third-party screensavers run from a user profile
    - Software packaging or testing workflows that execute .scr files from Temp
level: high
```

**Known false positives:**

- Legitimate third-party screensavers executed from a user profile or Downloads folder
- Software packaging/testing workflows that run .scr files from Temp

**Tuning notes:** Allowlist known corporate screensaver hashes and signed publishers. Raise priority when the parent is a chat, browser or archive tool (7zFM.exe, WinRAR.exe, explorer.exe) or when the host belongs to a support or help-desk team. The signal_count>=2 threshold can be lowered to 1 for support-desk assets.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- FSB Center 16 Network Device Targeting - Cisco Smart Install and SNMP From Untrusted Sources - Exploitation (locked: unlock with TL Creds)
- Backdoor.Daxin Kernel Driver [indicator] Dropped or Loaded - Post-Exploitation (locked: unlock with TL Creds)
- Executables Signed By CAs Revoked After DigiCert Breach Running From User-Writable Paths - Defense Evasion (locked: unlock with TL Creds)
- Screensaver (.scr) Dropped From Archive Into User-Writable Path - Support-Chat ZIP Lure (locked: unlock with TL Creds)
- Windows Event Log Clearing (wevtutil, Clear-EventLog, Event 1102/104) - Defense Evasion (locked: unlock with TL Creds)
- Backdoor.Stupig Trigger - Logon Attempt With 'stupig' Username Prefix - Command and Control (locked: unlock with TL Creds)
- Backdoor.Stupig Keyboard-Layout DLL Loaded Into winlogon.exe - Post-Exploitation (locked: unlock with TL Creds)
- Daxin-Style Inbound-to-Internal TCP Relay (Multi-Hop Proxy Heuristic) - C2 / Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- Domain: `api[.]stanfordstudies[.]com`
- File hash: `49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530`
- Domain: `extensions-hub[.]com`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CTO at NCSC Summary: week ending July 19th](https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-july-50a)
- [UK and allies urge critical sectors to improve defences against Russian intelligence targeting (NCSC)](https://www.ncsc.gov.uk/news/uk-and-allies-urge-critical-sectors-to-improve-defences-against-russian-intelligence-targeting)
- [Joint CSA: Improve Router Hygiene (FSB Center 16 exploitation of networking devices)](https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF)
- [CERTFR-2026-CTI-005: Targeting and compromise of French entities using the Turla intrusion set](https://cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-005/)
- [AIVD/MIVD advisory: Russian state actors are compromising IP cameras](https://english.aivd.nl/documents/2026/07/10/brochure-cybersecurity-advisory-russian-state-actors-are-compromising-ip-cameras)
- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor (Symantec)](https://www.security.com/threat-intelligence/daxin-returns-stupig)
- [Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident (Expel)](https://expel.com/blog/introducing-cylindricalcanine/)
- [Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639) (AmberWolf)](https://blog.amberwolf.com/blog/2026/july/dell-bios-passwords-weak-xor-encryption-allows-recovery-from-spi-flash-cve-2026-40639/)
- [NVD: CVE-2026-40639](https://nvd.nist.gov/vuln/detail/CVE-2026-40639)
- [UAC-0145 reporting (CERT-UA)](https://cert.gov.ua/article/6318437)
- [GoldenEyeDog subgroup linked to DigiCert breach (The Hacker News)](https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html)
- [Daxin resurfaces in Taiwan alongside Stupig (The Hacker News)](https://thehackernews.com/2026/07/daxin-resurfaces-in-taiwan-alongside.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5143