GCVE-110-OSM-2026-10269

This package is a fully-featured RAT (Remote Access Trojan). The exfil file content is unambiguous: it hardcodes a C2 server via an IP address and a custom URL with named API endpoints for agent registration, heartbeat, command polling, keylogging, and file upload/download. The package implements RSA+AES-GCM encrypted C2 communications, steals browser credentials from Chrome and Edge (AppData\Local\Google, AppData\Local\Microsoft), installs Windows registry persistence under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run as 'WindowsAutoUpdate', and includes cross-platform payloads for Windows, Linux, and macOS. ENTRY src/chaintest/cli.py (console-script: chaintest=chaintest.cli:main) LOOT - Browser Data Theft in src/chaintest/core.py: "AppData\Local\Google" PERSISTENCE - Startup Persistence in src/chaintest/core.py: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" - Startup Persistence in src/chaintest/platforms/windows.py: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in src/chaintest/core.py: "requests.post(url, params={"token": token}, headers=headers, files=" - Data Encoding for Exfiltration in src/chaintest/core.py: "base64.b64encode(" - Network Request in src/chaintest/core.py: "requests.get(" - System Information Collection in src/chaintest/core.py: "platform.system()" - System Information Collection in src/chaintest/platforms/__init__.py: "platform.system()" - System Information Collection in src/chaintest/platforms/base.py: "platform.system()" ADDITIONAL FINDINGS - Campaign marker: PolinRider in src/chaintest/core.py: "ss_upd" - Shell Command Execution in src/chaintest/core.py: "os.system(" - Shell Command Variable Setup in src/chaintest/platforms/__init__.py: "WINDOWS: return ["cmd", "/c"] return ["sh" - Silent Process Execution in src/chaintest/platforms/linux.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES src/chaintest/core.py