A Ruby on Rails exploit chain is live in the wild, a Chinese APT just expanded its infrastructure targeting to include Cisco IOS XR routers and TACACS+ authentication servers, and Anthropic is warning that commodity infostealers are hijacking Claude sessions for unauthorized compute consumption. Three different attack surfaces — application layer, network control plane, and AI SaaS — all active in the same week.

In the News

KindaRails2Shell: Rails Arbitrary File Read to RCE Under Active Exploitation

A critical Ruby on Rails vulnerability known as KindaRails2Shell is being actively exploited in the wild. The attack chain is elegant and dangerous: an arbitrary file read primitive allows attackers to extract application secrets — session signing keys, database credentials, API tokens — from the server filesystem. With those secrets in hand, the attacker crafts a serialized payload that achieves full remote code execution. Two requests. File read to RCE.

Rails is not a niche framework. It powers production applications at GitHub, Shopify, Airbnb, and thousands of enterprise SaaS platforms. The attack surface is enormous, and the exploit chain requires no authentication. Attackers are scanning for vulnerable Rails instances at scale, and exploitation timelines for web framework vulnerabilities have compressed from weeks to hours in recent years.

The immediate action is to patch. If patching requires a maintenance window, the compensating control is a web application firewall rule blocking the specific file-read request pattern — but this is a stopgap, not a fix. Any Rails application that was exposed before patching should be treated as potentially compromised: rotate all application secrets, session signing keys, and database credentials. Check deployment logs for unexpected code execution.

What defenders should do: Patch all Rails instances immediately. Rotate application secrets on any instance that was internet-facing before the patch. Deploy WAF rules as an interim control. Review web application security hardening practices for defense-in-depth.

Source: SecurityWeek

Fire Ant Expands to Cisco IOS XR Routers and TACACS+ Servers

China-nexus threat actor Fire Ant — previously known for targeting VMware infrastructure — has pivoted to Cisco IOS XR edge routers and TACACS+ authentication servers. The shift is significant. IOS XR runs on carrier-grade and enterprise edge routers. TACACS+ is the authentication, authorization, and accounting (AAA) protocol that controls who can log into network devices and what they can do. Compromising both gives Fire Ant persistent access to the network control plane and the ability to authenticate as legitimate network administrators.

Sygnia’s incident response findings confirm credential theft from TACACS+ servers and deliberate log blinding — attackers cleared authentication logs to prevent forensic reconstruction of their access timeline. This is a pattern consistent with advanced persistent threats operating on network infrastructure where dwell time measurement becomes impossible when the logs are gone.

The targeting of network infrastructure AAA systems is a tactical escalation. Most enterprise detection stacks focus on endpoint and cloud telemetry. Network device management planes — SSH sessions to routers, TACACS+ authentication flows, configuration changes — are often monitored loosely or not at all. Fire Ant is exploiting that blind spot. MITRE ATT&CK techniques in play include T1078 (Valid Accounts), T1070.001 (Indicator Removal: Clear Windows Event Logs — adapted to network device logs), and T1557 (Adversary-in-the-Middle) for credential interception.

What defenders should do: Enforce MFA on all network device administrative access. Segment the management plane onto a dedicated out-of-band network. Forward TACACS+ logs to a SIEM in real time so log destruction on the TACACS+ server itself does not eliminate the audit trail. Review IOS XR device configurations for unauthorized accounts or modified ACLs.

Source: The Hacker News

Infostealer Malware Hijacks Claude AI Sessions

Anthropic issued a warning that infostealer malware is targeting Claude session tokens on infected endpoints. The attack is not novel in mechanism — commodity infostealers like Raccoon, RedLine, and Lumma have been exfiltrating browser session cookies and API keys for years. What is new is the target: enterprise AI platforms with metered usage quotas.

Stolen Claude session tokens allow attackers to make API calls under the victim organization’s account. The immediate impact is financial — unauthorized compute consumption against enterprise usage limits. The deeper risk is data exposure. If the hijacked session retains context from prior conversations, the attacker may gain access to proprietary data, code, or strategic information that employees discussed with Claude.

This reinforces a fundamental lesson about session management and token lifecycle controls: any SaaS platform where a session token grants persistent access without re-authentication is vulnerable to session hijacking. Device-bound session credentials, short-lived tokens, and endpoint posture checks before session issuance are the relevant countermeasures.

What defenders should do: Deploy endpoint detection tuned for infostealer families. Enforce device-bound session credentials for AI SaaS platforms where available. Shorten session token lifetimes. Monitor Claude API usage for anomalous consumption patterns.

Source: BleepingComputer

Spring Ring: Teams + Vishing to Domain Controllers

Palo Alto Unit 42 documented a campaign called Spring Ring that uses Microsoft Teams as the initial contact vector, followed by voice phishing calls to trick employees into granting remote access. Once inside, operators move directly toward domain controllers for credential harvesting.

The campaign bypasses email security entirely — the social engineering happens on a trusted collaboration platform and over the phone. The domain controller targeting indicates the operators are after Tier 0 identity assets: KRBTGT hashes, domain admin credentials, and the ability to issue Golden Tickets. This is a well-documented privilege escalation path that remains effective because most organizations do not enforce phishing-resistant MFA on domain admin accounts.

What defenders should do: Restrict external Teams communication to approved domains via conditional access policies. Enforce FIDO2 or certificate-based MFA on all Tier 0 accounts. Monitor for anomalous remote access tool installations on endpoints following Teams calls.

Source: Unit 42

Defender Action Items

  • Rails: Patch all Ruby on Rails instances against KindaRails2Shell immediately. Rotate application secrets, session signing keys, and database credentials on any instance that was internet-facing before the patch was applied.
  • Network infrastructure: Audit TACACS+ server access controls and enforce MFA on all IOS XR administrative access. Forward AAA logs to a centralized SIEM to prevent log destruction from eliminating forensic evidence.
  • AI SaaS: Review session token lifetimes for Claude and similar AI platforms. Deploy endpoint detection rules for commodity infostealers (Raccoon, RedLine, Lumma). Enable device-bound session credentials where supported.
  • Collaboration platforms: Restrict external federation in Microsoft Teams. Train SOC analysts to correlate remote access tool installations with preceding Teams or voice calls.
  • PaperCut: Apply the second emergency patch for CVE-2026-82078 and CVE-2026-81578 immediately. Both are confirmed exploited in the wild. Restrict external access to PaperCut management consoles.

Detection Queries

Monitor for the arbitrary file read pattern associated with KindaRails2Shell — look for HTTP requests targeting known Rails secret file paths in web server access logs:

index=web sourcetype=access_combined
  (uri_path="*credentials.yml.enc*" OR uri_path="*master.key*" OR uri_path="*secret_key_base*" OR uri_path="*secrets.yml*")
  status=200
| stats count by src_ip, uri_path, status
| where count > 1
| sort -count

This query surfaces successful (HTTP 200) requests for Rails secret files. A single hit warrants investigation. Multiple hits from the same source IP confirm active exploitation. False positive rate is low — legitimate applications do not serve these files via HTTP.

For Fire Ant TACACS+ anomaly detection, monitor for authentication log gaps that may indicate log blinding:

index=network sourcetype=tacacs
| timechart span=1h count AS auth_events
| where auth_events < 1
| eval alert="TACACS authentication log gap detected — possible log blinding"

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) — Daily cybersecurity news, SE angles, and detection queries.