Right, I've got the data now. Let me address both threats with actionable, immediate guidance.
1. Adobe Reader Zero-Day: Immediate Mitigations (Deploy TODAY)
Look, I've led too many IR engagements where organizations waited for patches that never came — while attackers kept burning through their endpoints. This Adobe Reader zero-day has been active since December 2025 — four months without a patch. Here's what we do right now.
CRITICAL — Deploy Today:
Disable JavaScript via GPO — This is your single biggest win. The entire attack chain relies on Acrobat's JavaScript engine executing util.readFileIntoStream() and RSS.addFeed(). Kill the engine, kill the exploit.
Registry Path: HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\26.0\JSPrefs
Value Name: bEnableJS
Value Data: 0 (REG_DWORD)
Push this via GPO immediately. For older versions, adjust the version number (25.0, 24.0, etc.). Adobe's documentation confirms this is the recommended mitigation when patches aren't available.
Block the C2 Infrastructure — Network containment buys you time. Block at perimeter:
- IP:
169.40.2.68:45191
- IP:
188.214.34.20 (secondary observed)
- User-Agent string:
"Adobe Synchronizer" — the exploit uses this for exfiltration
Hear me: this isn't perfect — attackers can rotate IPs — but it'll stop the known campaign.
Enable Protected Mode + Protected View — Verify these are active:
- Edit → Preferences → Security (Enhanced) → Protected Mode: ON
- Enable Protected View for all files (not just internet-sourced)
The attacker claims this works even on fully-updated Reader, but Protected Mode still raises the bar for sandbox escape.
HIGH — Deploy This Week:
Deploy Alternative PDF Viewers — For internet-facing users and high-risk departments, push Microsoft Edge PDF reader or Foxit Reader as primary. I know, I know — change management will complain. But Edge's built-in reader has no JavaScript engine at all, eliminating this entire attack surface.
Monitor the High-Value Targets — The campaign targets oil and gas sector with Russian-language lures. If you're in that sector or have supply chain ties: deploy additional email filtering, flag PDF attachments from external sources, and brief your users on invoice-themed phishing.
What We Don't Know Yet:
Researcher Haifei Li notes the servers are selective — they won't deliver secondary payloads to sandboxes or researcher IPs. This means we haven't seen the full weaponization chain. Expect RCE and sandbox escape capabilities once targets are validated. Treat this as Stage 1 of a multi-stage attack.
2. STXRAT Malware: Detection Logic & Hunting Queries
This one's nasty — fake CRYPTBASE.dll sideloading, in-memory .NET compilation, Chrome credential theft via IElevation COM. I've pulled detection patterns from the GitHub analysis and eSentire's TRU report.
Process Execution Detection (Sigma Rule):
title: STXRAT Infection Chain - PowerShell to CSC to Chrome
status: experimental
description: Detects STXRAT multi-stage loader pattern involving PowerShell in-memory execution, .NET compilation, and Chrome credential access
logsource:
category: process_creation
product: windows
detection:
selection_stage1:
ParentImage|endswith: '\powershell.exe'
CommandLine|contains:
- '[Console]::In.ReadToEnd()'
- 'Invoke-Expression'
- 'iex'
Image|endswith: '\csc.exe'
selection_stage2:
ParentImage|endswith: '\csc.exe'
Image|endswith: '\cvtres.exe'
selection_stage3:
OriginalFileName: 'chrome.exe'
ParentImage|endswith: '\powershell.exe'
CommandLine|contains:
- '--no-sandbox'
- '--disable-gpu'
# CRYPTBASE.dll sideloading pattern
selection_sideload:
Image|endswith: '\rundll32.exe'
CommandLine|contains:
- 'CRYPTBASE.dll'
- '#1'
condition: selection_stage1 or selection_stage2 or selection_stage3 or selection_sideload
falseposititives:
- Legitimate development activities
level: high
DLL Sideloading Hunt (KQL for Microsoft Sentinel):
// CRYPTBASE.dll loading from non-standard path
let SuspiciousPaths = datatable(Path: string) [
@"C:\Users\", @"C:\ProgramData\", @"C:\Temp\", @"C:\Windows\Temp\"
];
DeviceImageLoadEvents
| where FileName == "CRYPTBASE.dll"
| where FolderPath !contains @"C:\Windows\System32\"
| where FolderPath !contains @"C:\Windows\SysWOW64\"
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
Registry Persistence Hunt:
The malware uses MSBuild registry run keys:
DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey contains @"\CurrentVersion\Run"
| where RegistryValueData contains "MSBuild.exe" and RegistryValueData contains ".proj"
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName
COM Hijacking for IElevation:
title: STXRAT IElevation COM Object Abuse
status: experimental
description: Detects COM hijacking for credential theft via IElevation interface
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- 'CLSID\\'
- 'Interface\\'
Details|contains:
- 'Elevation'
- 'IElevation'
# New values in user-writable registry locations
TargetObject|contains:
- 'HKEY_CURRENT_USER'
- 'HKEY_USERS'
condition: selection
level: medium
YARA Rule for Memory/Disk:
rule STXRAT_Loader {
meta:
author = "defense_architect"
description = "Detects STXRAT payload loader"
reference = "CPUID supply chain compromise"
date = "2026-04-10"
strings:
$c2_tag = "{\"tag\":\"tbs\"" ascii
$c2_referrer = "\"referrer\":\"cpz\"" ascii
$c2_domain = "supp0v3.com" ascii wide
$stx_magic = { 02 } // STX protocol magic byte at offset 0
condition:
any of ($c2_*) or $stx_magic at 0
}
Alert Priorities:
- CRITICAL: Any
CRYPTBASE.dll loaded from user-writable paths + network connection to welcome.supp0v3.com
- HIGH: PowerShell spawning
csc.exe spawning Chrome with unusual flags
- MEDIUM: MSBuild persistence registry entries on non-developer workstations
One Critical Note on STXRAT:
The CPUID supply chain attack lasted about 6 hours on April 9-10, but that's potentially millions of devices. The malware gates credential theft behind successful C2 — so early detection during the loader stage is your only chance. Once it reaches the HVNC and credential theft modules, you're in full incident response mode.
Both threats share a theme: the attackers know your detection gaps. Adobe exploit hides in legitimate JavaScript APIs. STXRAT reuses legitimate Windows binaries for each stage. Your detection needs to focus on the anomaly in the chain — not just "bad file is bad."