October 14, 2026
- Windows Fibers are being used to run arbitrary code inside an existing thread, with no new thread creation — a thread-creation-free execution primitive that sidesteps a common detection anchor. @ipurple ties the technique to Earth Ammit and Earth Kurma activity involving CoffeeLoader and ACR Stealer against government and technology targets in South Korea, Taiwan, the Philippines, Vietnam and Malaysia. · Offensive Tradecraft & Research
in Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN