This past week my parents visited and they brought their two dogs. I have one. The three of them are best friends. They pile onto the same couch like they have always lived in the same house.
Watch them for five minutes and you see the real motion. Who follows whom to the door. Who settles. Who keeps checking the window. They look like one pack. How they actually move is how you know.
Same job this week. Mail SNMP, a WebLogic front door, an implant that kills the endpoint agent, FTP banners used as dead drops. All of it looks like it belongs. The campaign is in the traffic after they settle in.
Big news on top of that. We have spent a lot of work this summer standing up a range we can actually attack. We re-enact the week's campaigns on our own network so we can see what the motion looks like. On that wire LogLM caught every instance of C2, lateral movement, and exfil we threw at it. The conn.log is in this post.
Branch61G Weekly. Here is what actually hit over the past seven days.
Zimbra SNMP RCE, 274 boxes, and a three day KEV clock
The most pressing mail story this week is Zimbra Collaboration. CVE-2026-73570, CVSS 8.9. Command injection in the SNMP monitoring component when notifications are enabled. Unauthenticated. Remote code execution as the Zimbra user. Synacor patched it in ZCS 10.1.20 on July 20. CERT Polska flagged in the wild use last Monday. CISA put it in KEV and gave federal agencies until August 24.
Shadowserver then counted the damage. 274 internet facing instances already showing exploitation artifacts on August 22. At least 8,200 still unpatched, including boxes where SNMP notifications are off, so not every one is exploitable. Zimbra sits in front of hundreds of government agencies and thousands of businesses.
CERT Polska told defenders what to hunt. Unexpected Zimbra restarts. New files under the jetty webapps and /tmp/ written by user zimbra. The first hit is a crafted SMTP request into SNMP notification processing. The rest is whatever that user can write on the box.
SNMP notifications are a feature. An EDR agent on a mailbox client never sees root on the collaboration appliance. A playbook waiting for a ransomware family name is late. The tell is a mail box that restarts, grows new jetty files, and then starts staging mail or holding C2.
And in a separate incident, the front door under fire was the HTTP proxy sitting on Oracle WebLogic.
Oracle WebLogic, CVSS 10.0, already on KEV
CISA added CVE-2026-21962 to KEV this week. Maximum severity. Unauthenticated attacker with HTTP access to Oracle HTTP Server or the WebLogic Server Proxy Plug-in. Improper access control. Unauthorized create, delete, or modify of critical data, plus a path to read everything those components can see. Oracle patched it in January. GreyNoise and CloudSEK have been watching exploitation since. Federal agencies now have until August 27 under BOD 26-04.
CloudSEK's honeypots also ate older WebLogic RCEs in the same traffic. The crowd that lives on this control plane keeps a short list of holes that still work.
An unauthenticated request to a proxy plug-in can look like the storefront doing its job. Signature packs have nothing for a January CVE that only landed in KEV this week. The miss is treating the first HTTP hit as business as usual while someone can already read or rewrite the data behind it.
Different attack, same week, and this time the costume was an endpoint agent that reported clean.
UAT-10147 uses agentic AI, then drops SPECTRE
Cisco Talos published a two part report on UAT-10147, a Chinese speaking cybercrime crew hitting Windows and Linux web servers across education, media, tech, and gaming. Most of the observed victims sit in Brazil, Bolivia, China, Canada, and Vietnam. An open directory at 139.180.197[.]150 held a target list of about 170,000 URLs, split into 17 files of 10,000. The actor uses known RCEs for first access, then Metasploit, ysoserial, PentestGPT, DeepAudit, and a stack of privilege escalation exploits to automate what comes next.
SEO fraud and data theft are the business. Persistence is BadIIS, Quasar RAT behind a scheduled task named Google Chrome Start, and a new cross platform implant Talos calls SPECTRE. SPECTRE is a C backdoor over HTTPS with 45 commands on Windows. File ops, keylogging, screenshots, process injection, Early Bird APC, and a BYOVD path through MSI RTCore64.sys and Dell DBUtil_2_3.sys that unlinks EDR callbacks so kernel callback agents stop seeing process creation for the rest of the session. The Linux build loads a kernel module named Specter. Talos assessed the comments as AI assisted.
Exfil is blended on purpose. Stolen host inventory goes to a Nacos instance the actor already owns, so the outbound looks like cloud configuration management. PentestGPT scans and fires public exploits. Python helpers launch SPECTRE through ViewState deserialization and ship IIS inventory to a webhook.
BYOVD and a kernel rootkit are built to make the agent go dark. A playbook that trusts process creation events on the host has nothing left. The tell is still on the wire. HTTPS C2 with a live operator rhythm, recon at 170,000 URL scale, and data leaving toward a cloud admin service that host never used that way.
Three costumes in and the fourth hides the next command in a protocol handshake.
E4del and PINHOLE turn FTP banners into dead drops
SOCRadar described a campaign that uses FTP banners as dead drop resolvers, the first time this trick has been seen in the wild. An FTP banner is the welcome string a server sends the moment you connect. E4del and PINHOLE fetch the next command from that string instead of from a web page.
Spanish voucher LNKs pull a banner from 157.254.194[.]31 on port 21, then a second banner from 167.148.41[.]164, then PowerShell, then E4del. E4del is a Node.js RAT packed inside a signed Electron app that looks like Discord. Encrypted C2, reverse shell, screenshots, live desktop, file theft. Beacon jitter is staged. Active in the first 20 seconds. Semi active from 20 to 40. Inactive after 40, checking in every 5 to 9 seconds.
PINHOLE is the more careful sibling. FTP banner at 209.99.185[.]38, then Pinterest and SurveyMonkey as resolvers, then Cloudflare Workers as the proxy. Halo's Gate to walk around userland hooks. Six unpack layers. Early Bird APC into a legitimate suspended process. Fourteen commands, file steal, process kill, PowerShell over anonymous pipes. An FTP stats panel on 69.48.228[.]126 port 5000 had only 11 execution events when SOCRadar looked, so this one is still early.
This is that range work. We re-enacted the dead drop pattern on our own network. Corporate pivot 10.0.30.80, already owned. HTTPS C2 to 203.0.113.100 on 443. Then SMB into the file server at 10.0.30.110, the box with the shares. Then a cloud upload to 203.0.113.20. Conn.log from that window is below. C2, lateral, and exfil are marked. LogLM caught all of it in this session. Every C2 instance, every lateral movement instance, every exfil instance.
An FTP banner looks like a server introducing itself. HTTPS to a paste or cloud host looks like a browser. Endpoint tools waiting for a RAT hash struggle when the first instruction arrives in a handshake, and when C2 later jitters like a chatty app. The leak is later. The early tell is a host that starts polling a destination it has no history with, at a cadence no user produces.
What this week means
Zimbra, WebLogic, SPECTRE, FTP dead drops. Four separate incidents. The same shape underneath. Attackers keep choosing the channel that already looks like it lives in the house. Mail monitoring, an app proxy, an endpoint agent, a banner. Trust is thickest there. Visibility is thinnest. After the first hit, the rest looks like SNMP, HTTP, a healthy process list, or an FTP hello.
Detections stay broken for attacks that do not match a named playbook. LogLM is a foundation model built as an encoder on network metadata. It learns normal deeply enough that a genuine deviation is legible on its own, with no prewritten signature for that CVE or family required first. The range is how we put a week's grammar on a wire we control, then put that same traffic in front of the model. In this session it caught every C2, lateral movement, and exfil instance on that wire.
Walk those four back through the wire. On Zimbra, the first SMTP into SNMP can be thin in netflow. Unexpected restarts, mailbox staging, and any C2 off that appliance sit outside a healthy collaboration baseline. On WebLogic, a completed campaign still needs recon, callbacks, or data leaving that proxy. On SPECTRE, HTTPS C2 and exfil into a Nacos cloud admin path are beacon and exfiltration even when BYOVD has silenced the host agent. On E4del and PINHOLE, the FTP banner is a short handshake. The jittered C2 that follows is the sustained grammar. On our range, that grammar showed up as HTTPS C2 from 10.0.30.80, SMB into the file server at 10.0.30.110, and a cloud upload to 203.0.113.20. LogLM caught every instance of those three stages in the window.
That is the generalizability. New costume, same grammar underneath it.
AI SOCs are only as good as the detections that feed them. When a zero day or a novel sequence slips past those detections, the rest of the stack has nothing left to reason over.
The pack looks settled. The traffic is how you know. Branch61G keeps watching the door.
Sources for this week include BleepingComputer coverage of the Zimbra CVE-2026-73570 mass compromise and CISA KEV order, The Hacker News on Oracle WebLogic CVE-2026-21962, Cisco Talos reporting on UAT-10147 and SPECTRE via The Hacker News, and SOCRadar via The Hacker News on E4del and PINHOLE FTP banner dead drops. Range flows are from a CyberRange re-enactment recorded 2026-08-25.
