Malware Activity
Emerging GPU and Endpoint Attacks Defeat Trusted Security Controls
Researchers have identified two (2) sophisticated cyber threats that show how attackers can bypass protections traditionally considered reliable. The University of Toronto’s GPUThor attack can overcome NVIDIA ECC safeguards on several Ampere-based professional GPUs by producing unusually high numbers of memory bit flips. An attacker able to run an unprivileged CUDA workload could crash GPU operations, trigger repeated resets, corrupt page tables, access protected system memory, and potentially gain root privileges. This makes shared GPU infrastructure, AI platforms, and multi-tenant cloud environments especially vulnerable, even when ECC is enabled. Separately, a campaign targeting Cambodia uses convincing phishing documents to install Spark RAT through DLL sideloading, encrypted payloads hidden in PNG files, and analysis-evasion techniques. The attackers also exploit a vulnerable OPSWAT driver to elevate privileges and disable Microsoft Defender and other endpoint security products before establishing persistence and injecting malicious code into running processes. Although the activity resembles tactics associated with the Silver Fox group, researchers have not confirmed attribution, and there is currently no reported evidence that GPUThor is being actively exploited. Together, these threats reinforce the need for layered defenses, including IOMMU and DMA isolation, SYS-ECC, GPU telemetry monitoring, vulnerable-driver controls, phishing protection, and strict limits on untrusted workloads. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- BleepingComputer: New GPUThor Attack Defeats NVIDIA ECC Protection For Root Access article
- TheHackerNews: New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access article
- TheHackerNews: Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools article
Threat Actor Activity
US Disrupts QScan/QTRouter Proxy Network Targeting Critical Infrastructure
The US Department of Justice (DOJ) and FBI have disrupted QScan and QTRouter, two (2) hacking platforms run by (as stated in court documents unsealed in the Southern District of California) a China linked “quartermaster” group known as QTFY and employed by China-based Nanjing Xinjiuwei Network Technology Company. QTFY provided a reusable service for Chinese espionage operators, per the FBI Director, to scan, exploit, and route attacks against US critical infrastructure and sensitive networks, including NASA, the Federal Reserve, multiple federal departments, NIH, and the US Senate. QScan is a scanning and exploitation system that profiles high value targets and compromises vulnerable IoT devices. Those devices, plus commercial proxy nodes and leased VPSs, are then folded into QTRouter, a custom OpenWrt based obfuscation network that uses tools like Clash and Fast Labyrinth to relay traffic through rotating proxy chains and ORB style meshes, making attacks appear to come from legitimate consumer endpoints outside China. The seized domains (qtproxy[.]xyz, qt proxy[.]org, qt team[.]com) were hard coded into the tooling, halting operations. However, because the architecture relies on dynamically rotating commercial proxies, static IP blocking is insufficient. CTIX Analysts recommend defenders follow CISA/NCSC guidance and keep routers, firewalls, and IoT devices patched and tightly configured.
- Bleeping Computer: QScan and QTRouter Proxy Article
- The Hacker News: QScan and QTRouter Proxy Article
- Justice Department: State Sponsored Hacker Operation Seizure Press Release
Vulnerabilities
Critical Avada WordPress Vulnerability Chain Enables Zero-Click Remote Code Execution
A critical six-step vulnerability chain in the popular Avada WordPress theme and its required Fusion Builder plugin could allow unauthenticated attackers to execute arbitrary PHP code and fully compromise vulnerable websites. Collectively tracked as CVE-2026-18431 with a CVSS score of 9.8/10, the zero-click attack combines authorization, input-validation, trust-boundary, and file-handling weaknesses that must be exploited in a specific sequence to achieve remote code execution (RCE). Successful exploitation could enable attackers to deploy malware, access website databases, create rogue administrator accounts, redirect visitors to malicious sites, and perform other unauthorized actions. The vulnerability affects Avada versions through 7.16 and Fusion Builder versions through 3.16, and because Fusion Builder is a required component installed alongside Avada, Wordfence warned that virtually any site running an outdated Avada installation could be vulnerable. The risk is significant given Avada’s widespread adoption, with more than one million sales. Wordfence researchers discovered and reproduced the vulnerability chain on July 30, 2026, using their Argus agentic security framework, which also generated proof-of-concept exploit code in roughly two (2) hours. The flaws were disclosed to ThemeFusion on August 5, and the vendor subsequently released fixes in Avada 7.16.1 and Fusion Builder 3.16.1, making prompt updates critical for administrators running affected versions.
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
