Fake Bitcoin-wallet installer delivering an unattended ScreenConnect (ConnectWise Control) backdoor, screened behind a genuine signed DocuSign installer.
| Classification | Dropper / initial-access implant — RMM abuse (T1219) |
| Severity | Critical — full unattended SYSTEM-level remote control, LSA-resident code |
| Analysis date | 2026-09-01 |
| Analysis type | Static only. Sample never executed (Windows batch, examined on macOS) |
Date: 2024-12-19
When MicroPython firmware fails during boot (e.g., due to import errors in frozen modules), the board may appear dead with no visible error output. Debug builds have REPL enabled, but if the main script crashes on import, you won't see the stacktrace unless you manually trigger the import.
You're reviewing a PR. You've read the description, checked out the branch, started going through the code. Then Slack explodes. Or you get pulled into an incident. Or it's 6pm and you'll "finish tomorrow."
Tomorrow: where were you? Did you run the tests? Did you check for security issues?
Mental checklists don't survive interruptions. You forget. You skip steps. You approve a PR that breaks production because you didn't actually run the tests locally.
What if your review workflow could survive crashes, enforce thoroughness, and prove you did the work?
Date: 2024-12-19
When MicroPython firmware fails during boot (e.g., due to import errors in frozen modules), the board may appear dead with no visible error output. Debug builds have REPL enabled, but if the main script crashes on import, you won't see the stacktrace unless you manually trigger the import.
| import {readdirSync} from 'fs' | |
| import path from 'path' | |
| export const logAPICall = async <T>( | |
| apiFunction: () => Promise<T>, | |
| functionName: string, | |
| ): Promise<T> => { | |
| try { | |
| const result = await apiFunction() | |
| logger.error( |
| #!/usr/bin/env python3 | |
| import asyncio | |
| import os | |
| import subprocess | |
| import sys | |
| import time | |
| import websockets | |
| from websockets import connect |
| #!/usr/bin/env python3 | |
| # Copyright (c) 2017-2021 The Bitcoin Core developers | |
| # Distributed under the MIT software license, see the accompanying | |
| # file COPYING or http://www.opensource.org/licenses/mit-license.php. | |
| """An example functional test | |
| getting node 1 to mine another block, send it to node 2, and check that node 2 received it. | |
| """ | |
| from collections import defaultdict |
| [ DEBUG] in rpc: call repeated 1 times | |
| [ DEBUG] in rpc: call(wallet/specter/ghostmachine )( 1ms) payload:[{'method': 'listtransactions', 'params': ['*', 1000, 0, True], 'jsonrpc': '2.0', 'id': 0}] | |
| [ DEBUG] in rpc: call(wallet/specter/ghostmachine )( 1ms) payload:[] | |
| [ DEBUG] in rpc: call repeated 1 times | |
| [ DEBUG] in rpc: call(wallet/specter/ghostmachine )( 2ms) payload:[{'method': 'listtransactions', 'params': ['*', 1000, 0, True], 'jsonrpc': '2.0', 'id': 0}] | |
| [ DEBUG] in rpc: call(wallet/specter/ghostmachine )( 1ms) payload:[] | |
| [ DEBUG] in rpc: call repeated 1 times | |
| [ DEBUG] in rpc: call(wallet/specter/ghostmachine )( 2ms) payload:[{'method': 'listtransactions', 'params': ['*', 1000, 0, True], 'jsonrpc': '2.0', 'id': 0}] | |
| [ DEBUG] in rpc: call(wallet/specter/ghostmachine )( 1ms) payload:[] |
