Notes from the Chief Security and Trust Officer: October 2026

The SOC, APG, and Product teams performed exceptionally well in October. The SOC isolated every host in multiple intrusions with no sign of lateral movement, preventing further impact to the networks. APG traced a new implant, gave advance notice on PHP2Shell, and identified the affected ConnectWise applications in customer tenants. Product expanded Microsoft Defender alert ingestion to seven more security products and added Google Workspace account controls to CompassOne. Thank you to all three teams.

ClickFix remained persistent in October. It started the intrusion APG traced to Variola and delivered a new build of ChainScript, and rogue RMM tools showed up again alongside it. What changed is how much APG found waiting behind the first payload.

PHP2Shell was an exercise in preparedness. Both flaws are unauthenticated remote code execution bugs rated 9.2 under CVSS v4.0. APG validated the severity and issued an advance notice a day before PHP shipped fixes, and the SOC kept watching managed environments continuously.

If you missed last month’s update, read Notes from the Chief Security and Trust Officer: September 2026.

Variola: The October Threat Worth Watching

I found APG’s Variola research especially interesting this month. It is a previously undocumented modular Windows implant APG traced from a ClickFix intrusion. It persists state locally, rotates between controllers, and loads modules on demand, including a browser component that hooks Chromium’s network service to reach authenticated sessions.

Read APG’s Variola research.

Blackpoint: Platform and Trust

The Microsoft Defender integration now ingests alerts from seven additional Microsoft security products, including Defender for Office 365, Defender for Cloud Apps, and App Governance.

Partners can also enable and disable Google Workspace accounts from the Asset Inventory dashboard in CompassOne. Partners get a self-service option alongside SOC containment, so disabling a compromised account no longer waits on a support ticket, and every action is logged in CompassOne.

On compliance, the DoD suspended CMMC Phase 2 on July 13, which removed the November 10 deadline for mandatory third-party Level 2 certification. Phase 1 self-assessments and existing NIST SP 800-171 obligations still apply.

If you support HIPAA, CMMC, or GDPR clients, Privacy Mode is worth a conversation. It’s a tenant-level setting that stops the SOC and APG from retrieving files from SNAP Agent endpoints, so a retrieved file can’t carry ePHI or CUI into our systems. If an analyst needs a file, a Blackpoint representative contacts the customer to coordinate it.

Read Blackpoint’s CMMC guide and Privacy Mode overview.

The SOC: Stopping It in Real Time

Three Lures, One Pattern

A Teams message that likely posed as IT support led to an executable that ran an AutoHotKey script, installed a browser extension consistent with public reporting on SNOWBELT, and deleted both files. The host then went looking for domain administrators and LDAP services.

Read the Threat Pulse for the week of 10/5.

A ClickFix command used msiexec to pull an MSI that turned out to be a new build of ChainScript. This build sets its command and control address directly, where the September samples resolved it through a Polygon smart contract, and it creates a scheduled task for persistence.

Read Threat Pulse 68 and APG’s ChainScript research.

A zip file posing as Google Meet installed ScreenConnect, and a second instance downloaded HideUL to hide the agent from the installed programs list and restart the service on its own.

Read Threat Pulse 69.

The SOC isolated every host and found no sign of lateral movement. Each attacker left something behind, and the ScreenConnect host had two remote tools on it.

ConnectWise Cloud Backup

ConnectWise disclosed an incident involving Cloud Backup, formerly SkyKick, on October 16, following reports of unauthorized access to customer Microsoft 365 environments through compromised application credentials.

APG identified the affected ConnectWise enterprise applications in customer tenants, disabled the application wherever it saw recent activity, and contacted those customers directly.

Later findings widened the scope to other ConnectWise Cloud Management integrations, with concerns about unauthorized changes to application credentials, permissions, and directory role assignments. APG worked with partners to investigate and contain the incident.

PHP2Shell Needs Attention

CVE-2026-109618 and CVE-2026-109619 are unauthenticated remote code execution flaws in PHP, each rated 9.2 under CVSS v4.0. APG issued an advance notice on October 20 and validated the flaws independently before PHP shipped fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Read the PHP2Shell blog.

Exploit code is public, and multiple researchers have reported attempted exploitation. Updating WordPress or Magento plugins doesn’t patch the PHP runtime. Restart php-fpm or Apache after upgrading so the patched build loads.

APG: The Research Behind the Reflex

Variola started with a ClickFix command that launched from Windows Terminal, spawned PowerShell, and downloaded a payload named sha from a GitHub repository. The payload unpacked two loader stages in memory before reaching the core.

Variola derives a stable host ID from the MachineGuid registry value and stores its configuration, a cached copy of its agent, and its last working controller in an encrypted local store, so every execution picks up where the last one ended. Each request to the controller uses an ephemeral key pair, and the implant rejects any response without a valid signature.

APG recovered tasking definitions for credential, cookie, wallet, and MFA theft, though not every collection component was in the build we examined. Variola hooks Chromium’s network service process so other components can reach authenticated sessions, which could carry an intrusion past the endpoint and into the applications the user was signed into.

The repository held several related builds with compile timestamps hours apart, and APG assesses with moderate confidence that Variola is under active development. APG published host artifacts for hunting, including the 4A-D3 storage directory, uid.dat, and two named mutexes.

That last point matters. ClickFix explains how the attacker got the first command to run. Variola shows what can be waiting several stages behind it.

What This Adds Up To

Variola shows what gets built behind the first payload, and the SOC incidents show attackers leaving a way back in. A few things are worth checking this week:

• ScreenConnect in Downloads or AppData is a potential indicator of compromise, and a second remote tool on the same host is worth looking for.
• Application control, no local admin for standard users, the Run dialog disabled where workflows allow, an allowlist for browser extensions, and restricted Teams chats from external tenants each cut off a step these attackers needed.
• ConnectWise enterprise applications in your Microsoft 365 tenants deserve a review of credentials, permissions, and role assignments.
• PHP needs patching on every host serving web requests, checked in php-fpm or the Apache module rather than the command line binary.

The common thread is trust. Attackers are still leaning on workflows and tools that look familiar enough to get past the first human decision: Teams, Google Meet, ScreenConnect, Windows Run, legitimate package installers, and authenticated browser sessions.

That means the job isn’t just to recognize a malicious file. It’s to understand what normal looks like well enough to catch trusted tools behaving in ways they shouldn’t.

See you next month.

Wil Santiago
Chief Security and Trust Officer
Blackpoint Cyber