[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

official (Binarly research and IoCs, Nov 3)

Hunt: the JITTERLY/SIXZUT actor behind the Zyxel GS1900 exploit uses *.981666[.]xyz for C2 on odd ports and hides processes named 'configd'

  • C2 hostnames and ports: p1.981666[.]xyz:6443, p2.981666[.]xyz:8080, s2.981666[.]xyz:8082, s7.981666[.]xyz:443. Block and search DNS logs for the whole 981666[.]xyz domain.
  • IPs (Binarly): 104.223.65[.]148 (JITTERLY C2 on 8080; open directories on 80 and 18081, where gs1900_bundle.tar.gz was hosted), 104.225.153[.]141 (C2 on 5432, 6379 and 8082), 166.88.227[.]181 (C2 on 443), 203.88.123[.]148 (SoybeanAdmin admin panel and SSH).
  • Hashes (SHA-256): JITTERLY 82d072ab03d90c0131b06a576eadf2c986a51f0de986d50db4e49be01bf125cb, 663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c, 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6; embedded SIXZUT 295133156b6a7d95b9c92f832f49e35235f1fbd3906e75c9202ef4cd65d1018c, 64677002011bc2e4bc642a4154a20fdb95620ebd0144b98fc60f917901ec8b92, 728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146.
  • Host behavior: the SIXZUT sample hides processes named configd and its connections to s2.981666[.]xyz:8082, so check with tools that don't rely on the host's own process listing (e.g. compare /proc against ps, or look at connections from the network side).
  • Switch side: the exploit's built-in examples write to /tmp and start busybox telnetd -p 2323 -l /bin/sh; look for TCP 2323 or other new listeners on GS1900 management IPs and for HTTP requests to their CGI endpoints from non-admin hosts.

Also review Gitea servers reachable from the internet, since that was the original JITTERLY entry point Acronis reported.

Sources: Binarly: Zyxel GS1900 pre-auth RCE exploited in the wild as a zero-day (IoCs) · Binarly advisory BRLY-2026-057