Newsletter 2026-09-01

Another week, another round

Pointwild analyzed Plikanlocker, a locker malware with Telegram-based control and data exfiltration. Using Telegram as the command channel brings a cloud service into play that apparently doesn’t raise immediate alarms everywhere, and it saves the operator the need for dedicated C2 infrastructure.

• https://www.pointwild.com/threat-intelligence/plikanlocker-a-technical-teardown-of-file-locking-with-telegram-based-exfiltration/

Insinuator has a new tool for parsing TIA files. TIA Portal (Totally Integrated Automation Portal) is software for deploying updates to PLCs.

• https://insinuator.net/2026/08/tia-project-parser/

Quarkslab looked at measures to make reversing of legitimate software harder in the age of AI. The willingness of models to come up with “creative solutions” showed itself here as well.

• http://blog.quarkslab.com/defeating-ai-assisted-reverse-engineering-or-at-least-trying-to.html

Alejandro Parodi went hunting for RCE in the Pokémon Red and Blue Lua rewrite, getting well acquainted with the engine in the process. Since the rewrite includes online battle capabilities, a bypass of the online anti-cheat came along for the ride as well.

• https://hdbreaker.github.io/blog/pokemon-gen1recomp-hate-cheat/

There were two arrests around TeamPCP. With a bit of luck things might quiet down a little around Shai-Hulud and all the supply chain attacks.

• https://www.reversinglabs.com/blog/shai-hulud-worm-arrests-what-you-need-to-know

… Apparently not.

• https://research.jfrog.com/post/shai-hulud-trinitite/
• https://www.ox.security/blog/shai-hulud-trinitite-sponsored-by-preview-2-effects/

RCE in humanoid robots. Extensive writeup.

• https://boschko.ca/g1-ble-rce/

An interesting article on the Spacelab, a Mitra 125 MS based system from 1980 that was used on shuttle missions to collect data and run experiments.

• http://www.righto.com/2026/08/spacelab-core-memory.html

Sygnia published a comprehensive article on the approach of Chinese threat actor FireAnt.

• https://www.sygnia.co/blog/fire-ant-evolves-from-hypervisors-to-trusted-infrastructure/

Synacktiv has reworked their tooling to simulate legitimate AD-related traffic and modify it for further testing.

• https://synacktiv.com/en/publications/simulating-legitimate-active-directory-services-on-the-network-the-case-of-gpo

The Web Scraping Club looked at changes to Google’s search results. Google now serves redirects when it suspects scraping or similar activity.

• https://www.scraping.club/p/google-removed-the-urls-serp

Read you next week