Threat Pulse: 70th Edition

Featured Incident

Stay of Edgecution

What we’re seeing 

• The Blackpoint SOC alerted to suspicious nltest.exe activity and Python-driven domain enumeration on a host, which was linked to a binary disguised as a Microsoft update.
• The binary unpacked a portable Python environment, force-closed Microsoft Edge, and planted a malicious browser extension that launched a Python backdoor through Chrome native messaging.
• The backdoor enumerated domain controllers, Domain Admins, and domain trusts indicating an attempt to set up lateral movement.

What the Blackpoint SOC did 

• The Blackpoint SOC isolated the impacted device immediately, cutting off access, and confirmed no signs of lateral movement.
• The Blackpoint APG conducted additional analysis of the incident and identified the activity as very likely Edgecution, a backdoor that abuses Chrome native messaging to run commands outside the browser; the activity has been previously attributed to a Payouts King Ransomware initial access broker.

Why this matters 

• By abusing Chrome native messaging, Edgecution can execute commands outside the browser, allowing attackers to conduct reconnaissance and potentially move laterally while blending in with legitimate browser component activity.
• The focus on domain controllers, privileged accounts, and trust relationships indicates potential preparation for lateral movement and potential deployment of malware payloads.

What Blackpoint is Doing

Blackpoint Cyber has detections in place for the behaviors observed in this attack chain. The Blackpoint SOC recognizes reconnaissance behaviors that often precede ransomware deployment as well as suspicious behaviors and activity that deviates from expected system operations. By understanding how this activity differs from attacker behavior, analysts can quickly identify emerging threats and take action without waiting for a confirmed malicious payload, limiting a threat actor’s opportunity to establish persistence or move laterally.

The SOC provides 24/7 monitoring and response, while APG tracks changes in adversary behavior, campaigns, and vulnerabilities to provide intelligence that supports detection, investigation, and response. Together, these capabilities help identify and respond to malicious activity before it can escalate into broader operational or business impact.

Recommendations

• Use the NativeMessagingBlocklist and NativeMessagingAllowlist browser policies to block unapproved native messaging hosts from launching.
• Block unsigned executables from running out of user-level paths like Downloads, AppData, and Temp using application control software, Blackpoint’s Managed Application Control (MAC), or AppLocker/WDAC.
• Enforce browser extension allowlisting for Edge and Chrome via Group Policy or Intune, blocking all extensions by default and disabling developer mode and sideloading.

BROC Weekly Snapshot

What changed. What didn’t. What matters.

Campaign Statuses

In Case You Missed It

On October 13, 2026, GitLab released patches for a critical vulnerability impacting GitLab Community Edition and Enterprise Edition. On October 29, 2026, the vulnerability was added to the CISA KEV Catalog.

GitLab | CVE-2026-97229 | CVSS 10 Critical | Integer Overflow or Wraparound Vulnerability

• Potential Actions: An unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation.
• Reported activity included a threat actor targeting an instance by sending crafted CI configurations, causing the GitLab worker processes to crash; several exploits failed at the next step.

Social Content

Threat Notices

• October 26, 2026: Node.js and .NET Brotli Decoder Library – LinkedIn | infosec.exchange