[arid-viper]

October 31, 2026

• Nextron detailed two espionage chains against Arabic-speaking government, HR, diplomatic, student and NGO targets, built from fourteen files collected May–August 2026. Chain one: a macro document with reversed strings fetches an HTA over WMI, which strips the Zone.Identifier from an Arabic questionnaire decoy and XOR-extracts a Go backdoor from a PNG (key byte read from the image), persisting as Run value HostHelpLoader and beaconing to mmarketplaces[.]com. Chain two delivers a C++ libcurl implant inside a 200 MiB VHDX so the payload never receives Mark-of-the-Web, persisting via a Startup .lnk — or a scheduled task when Kaspersky is present — and skipping persistence entirely when it finds no AV. One sample is ESET's Arid Gopher (Arid Viper/APT-C-23) with high confidence; the two campaigns match no published indicator, so attribution there is moderate (Nextron). · Threat Intelligence

in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits