Recon Main Blog

Iranian Government Affiliated Intrusions: Documented Tradecraft

luke@reconinfosec.com (Luke Rusten) — Tue, 03 Mar 2026 18:48:12 GMT

When geopolitical tensions rise, defenders tend to ask the same question: What does Iranian cyber activity actually look like on the wire?

ClawHype: Making Sense of Recent AI Cybersecurity News

Nicholas Lupien — Fri, 06 Feb 2026 00:09:37 GMT

Editor note: The sudden rise and crash of OpenClaw and Moltbook have been wild. The media will move on, but the story isn’t over for IT teams dealing with the risks posed by unauthorized AI. In this Q&A, Nick Lupien (Head of Recon Labs) will help make sense of the recent news and offer broader AI governance advice.

What would an IT manager need to know about the OpenClaw and Moltbook security issues? What makes these security issues different from others?

At this stage, it’s probably best to treat OpenClaw (formerly Moltbot, formerly Clawdbot) like malware. In order for OpenClaw to perform its stated function (a local personal assistant), it requires significant access to private data, arbitrary code execution privileges, and absolute autonomy without human approval. This combination is dangerous even without AI, but it’s particularly concerning when you consider that AI is vulnerable to prompt injection (other people trying to trick your agent into acting against your best interests) and misalignment (the model underneath providing inaccurate data and suggestions).

These are both “forever problems” with large language models, and they’re the reason we put “humans in the loop” for critical functions like sending emails or texts or executing code in privileged contexts. When you hand the keys over to an agent that will automatically act on your behalf, you’re taking immeasurable risk with not only your data, but that of everyone you interact with. It’s like turning on full car automation on untested infrastructure and then going to sleep. It raises serious concerns.

Moltbook is a public “Reddit-like” social media site that OpenClaw agents interact with autonomously. There have already been reports of massive data loss due to an improperly configured database. Though this and other vulnerabilities have been addressed, it’s the clearest example yet of the threats posed by OpenClaw, and it’s likely not the last.

Employees have always used unauthorized apps at work. How is that problem different now with AI tools?

Unauthorized/unvetted apps are still a big problem and contribute to significant losses for companies every year. The type of risk is the same: loss of confidentiality and integrity when the application misbehaves, whether through malicious activity or accidental misuse. The addition of AI significantly increases the magnitude of the threat: they are more likely to be exploited, and the effects of misuse are significantly more damaging to you, your organization, and everyone you interact with.

How do I decide whether to allow AI tools at our company? What safety measures must I put in place to protect our data and systems?

Stepping back, I wouldn’t conflate OpenClaw with most “AI tools.” There are many AI tools like Claude, Gemini, and ChatGPT that have mechanisms to control human-in-the-loop and that encourage good security practices. The best safety measures we’ve seen are proactive ones: provide people with vetted tools, and train them on best practices for interacting with confidential data. All of the large providers have a “no training on customer data” option for paid subscribers, and some have zero data retention policies available. Research and understand these features before deciding on a platform. Search for “Trust Center” with the products you’re considering to fully understand their compliance environments. For enterprise deployments, look for features like audit logs, admin controls, and SSO integration.

Deciding whether to allow AI tools at your company is a risk/benefit discussion. The risks of a trained workforce using vetted tools can be controlled but are never completely mitigated. Apps change quickly, and new features may introduce new risks that require significant, ongoing attention. If you decide to embrace AI, commit to one or two products at first, and create a plan to keep up with changes to those products. Even vetted tools require good policy around integrations and human approvals.

If employees are already using unauthorized AI tools, how do I find out and what should I do about it?

Prevention is really the first step. Decide on a path that satisfies employee and company needs, create a policy, communicate it, and enforce it.

Surveying / Enforcing: if you have a managed security provider or security operations center, have a conversation with them about detecting unauthorized software installations or visits to unauthorized sites. They will have a number of tools at their disposal to detect and surface unauthorized use.

What are the most important security rules IT leaders should follow when dealing with AI? What security basics stay the same even as technology changes?

Never grant an AI agent “modify” or “execute” permissions against a system that processes confidential data without a human approver.

The concept of “least privilege” underscores this entire conversation. Would you allow an intern to commit code to your production codebase without a senior engineer’s review and approval? Would you allow them to send emails to the CEOs of your customers without reviewing or approving them? Least privilege isn’t new, but people placing total trust in LLM agents is. Generally, you can’t have both.

Where can IT managers go to keep learning about AI security threats and how to handle them?

The Center for AI Safety (https://safe.ai/) is a non-profit dedicated to reducing societal-scale risk from AI. Their newsletter addresses current events pertaining to AI risk, including cyber risks.

Anthropic Academy has several great courses around AI fluency and technical expertise: https://anthropic.skilljar.com/

As always, monitor vendor security advisories and CVE databases for AI-related vulnerabilities.

What's one thing an IT manager can do this week to immediately improve AI security?

Create a policy that provides a governable path to individuals using AI safely and responsibly, and commit to supporting and enforcing it.

Planning for the Worst: Making IR, BC, and DR Plans Work

mthompson@reconinfosec.com (Macie Thompson) — Fri, 09 Jan 2026 17:32:15 GMT

Organizations know they should have plans for cyber incidents, but too often those plans are outdated, incomplete, or untested. Incident Response (IR), Business Continuity Plans (BCP), and Disaster Recovery (DR) plans are frequently treated as check-the-box documents instead of living, operational playbooks. The real cost of that mindset becomes painfully clear during a major cyber incident.

Case Study: From Running Blind to Active Defense

Recon Team — Thu, 04 Dec 2025 19:44:26 GMT

How a Mid-Size Energy Infrastructure Company Achieved 95%+ Security Score and Peace of Mind

A Pragmatic Approach to Vulnerability Management

Ben Webb — Mon, 10 Nov 2025 13:23:04 GMT

Every Pentest Makes us Better

acook@reconinfosec.com (Andrew Cook) — Wed, 08 Oct 2025 18:06:26 GMT

Penetration tests reveal the true strength of your organization’s security posture. Approached correctly, they also serve an important role in continuously improving your ability to find and stop real threats quickly. At Recon InfoSec, we view our customers’ penetration tests as invaluable opportunities to test and improve our detection capabilities against skilled attackers in a controlled environment.

Delivering AI Superpowers to Security Teams: Introducing Recon Labs

Nicholas Lupien — Mon, 22 Sep 2025 21:39:15 GMT

Recon InfoSec, a leader in managed security operations, is proud to announce the creation of Recon Labs, our internal R&D organization that delivers superpowers to your security teams.

Microsoft Teams Social Engineering: A Ransomware Attack Vector

acook@reconinfosec.com (Andrew Cook) — Thu, 18 Sep 2025 22:09:24 GMT

The Recon SOC is seeing an uptick in ransomware groups successfully gaining initial access to environment's by impersonating IT support staff and calling users directly over Microsoft Teams. This sophisticated social engineering attack leverages the trust users place in familiar communication platforms to bypass traditional security controls.

Mastering Threat Hunting Operations: A Deep Dive into Recon InfoSec’s Approach

Watson Brown — Tue, 12 Aug 2025 15:52:08 GMT

In today’s rapidly evolving cyber threat landscape, proactive defense is no longer optional—it’s essential. At Recon InfoSec, our Managed Security Operations (MSO) team makes threat hunting a cornerstone of continuous cybersecurity improvement. This blog post explores the comprehensive approach Recon takes to threat hunting operations, highlighting methodologies, tools, and best practices that empower security teams to detect and mitigate threats.

Prolific Phishing Campaign Leveraging Zoom's Infrastructure

mrobertson@reconinfosec.com (Michael Robertson) — Fri, 20 Jun 2025 23:18:57 GMT

The Recon SOC recently identified a significant uptick in phishing campaigns that exploit the legitimate infrastructure of Zoom Events.

These phishing attempts originate from noreply-zoomevents@zoom.us, bypassing numerous email security filters. These messages are cryptographically signed (SPF/DKIM/DMARC) and originate from Zoom Events, making it exceedingly difficult for users to identify them as phishing.

Headers from an example email we’ve observed show the following authentication information:

“Pass (protection.outlook.com: domain of bounce-sg.zoom.us designates 159.183.192.104 as permitted sender); helo=o26.sg.zoom.us; pr=C”

“spf=pass (sender IP is 159.183.192.104) smtp.mailfrom=bounce-sg.zoom.us; dkim=pass (signature was verified) header.d=zoom.us;dmarc=pass action=none header.from=zoom.us;compauth=pass reason=100”

We have observed both credential phishing and malicious desktop applications, urging users to “View file” and “Download Desktop App Now”. In all cases, there was an initial link to hxxps://docs.zoom.us/doc/. From there, users were either redirected to an AitM credential phishing site, or a malicious ScreenConnect[.]exe download.

This is not an entirely new technique for AitM phishing using hxxps://docs.zoom.us/doc/. However, unlike previously reported campaigns, this latest threat includes the abuse of Zoom Events.

Credential Phishing Using Zoom Events

The credential phishing emails utilize ChainLink Phishing, calling users to open a link to a document/file, leading to hxxps://docs.zoom.us/doc/, directing them to click to another link that displays a fake verification request (CAPTCHA), then to an AitM Microsoft login page where they are prompted to enter their credentials.

Example Malicious Email:

Sample hxxps[://]docs[.]zoom[.]us/doc/ page:

Fake verification page:

Phishing landing page:

Delivering Malicious Downloads Using Zoom Events

The malicious download phishing emails utilize ChainLink Phishing, calling users to open a link to a document/file, leading to hxxps://docs.zoom.us/doc/, then to a malicious download. It appears that the same email is sent to multiple users across different organizations, all with the same docs.zoom.us link.

At one point during our investigation, for a new email, we found that several users were accessing the shared Zoom doc at the same time.

Example Malicious Email:

hxxps://docs.zoom.us/doc/ page:

This sample is now even more concerning, as it’s downloading a malware payload - which we’ve identified as a renamed ScreenConnect binary.

App Protection Warning on Fake ScreenConnect Binary:

There are other recently uploaded examples with similar file names and similar docs.zoom.us links, most likely attributed to this same campaign, that we found on ANY.RUN.

Customers protected by Sublime and Recon's Advanced Email Protection (AEP) offering will find these messages automatically quarantined. Recon's engineers started crafting the necessary detection rules to identify these threats within hours of their initial discovery.

Sublime MQL Detection Logic:

We submitted a case to Zoom on Thursday evening, alerting them of the fraudulent activity sent from their platform, and offering samples. Our case was closed, saying that enforcing DMARC prevents this, despite our observation of DMARC passing. Friday afternoon, we opened another case and submitted samples. It appears that these attackers are leveraging compromised user accounts with access to “Zoom Events Email Builder”.

Key Indicators of this phishing campaign:

Deceptive Subject Lines & Content: These have been seen mimicking urgent financial, file sharing, or government notices.
Impersonation: This campaign impersonates legitimate organizations such as the Social Security Administration and investment firms.
Call to Action: Recipients are pressured to download desktop applications or click "View File" buttons within the email.
Misleading Branding: Emails feature Microsoft Office icons or Zoom Events footers with deceptive instructions to act on a "secure" document.
Malicious Links: Links typically redirect to credential harvesting sites or attempt to download malicious renamed ScreenConnect executables.

Protect your organization:

Users should be warned not to click on links or download files from unexpected "Zoom Events" emails.
If a message appears suspicious, verify its legitimacy with the sender through an independent channel rather than by directly replying.
Report any suspicious emails using your organization's established user-reported email systems.

IOCs:

AitM Phishing URLs:
hxxps[://]office[.]regencyoutdor[.]com/JUinaeSo
hxxps[://]od9[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]ffdsjf9[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]call[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]0ffgyedfrvl[.]qkipikpp[.]es/H7mozVCPB@35vHfGN
hxxps[://]foiufl[.]qkipikpp[.]es/H7mozVCPB@35vHfGN
hxxps[://]dnffeerof9[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]rrof9[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]scjool[.]qkipikpp[.]es/H7mozVCPB@35vHfGN
hxxps[://]trtiro[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]79ml2xl73[.]gwzimifoi[.]es/mxci!oD9ymNViz1JTv/
hxxps[://]looil[.]qkipikpp[.]es/H7mozVCPB@35vHfGN
hxxps[://]swiftde[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]truiro[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]sso[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]tuiriro[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]invest[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]pgjonesadr[.]com/js
hxxps[://]yuide[.]qkipikpp[.]es/PFsfkU!WQgMbZ/
hxxps[://]spsol[.]qkipikpp[.]es/H7mozVCPB@35vHfGN

Renamed Screenconnect Malicious payload URL:
hxxps[://]okekeimmigrationlawyer[.]com/js/
https://www.joesandbox.com/analysis/1719604