GCVE-110-OSM-2026-14379

This package is a narrowly tailored, personal/organizational Zabbix–MikroTik monitoring and provisioning tool. Our analysis leads us to believe this is a genuine tool, and while this package has good documentation, it doesn't accurately describe what happens when you run it: it sends Zabbix user login data to a Russian .ru domain. As such, we are listing this as malicious with severity LOW. If the author were to list the domain and how it sends the Zabbix login data to that domain, we would probably view this a personal tool that had been improperly made public, and therefore not malicious. A malicious operator could misuse its legitimate administrative access, as with any SSH/Zabbix automation, but the package does not implement credential theft, covert control, persistence, payload delivery, or exfiltration. ENTRY src/mikrotik_doh_failover/zabbix_setup.py (console-script: doh-zabbix-setup=mikrotik_doh_failover.zabbix_setup:main) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in src/mikrotik_doh_failover/zabbix_setup.py: "urllib.request.Request(API, data=" - Data Encoding for Exfiltration in src/mikrotik_doh_failover/zabbix_setup.py: "json.dumps(payload).encode" - Network Request in src/mikrotik_doh_failover/zabbix_setup.py: "urllib.request.Request(" ADDITIONAL FINDINGS - Shell Command Execution in src/mikrotik_doh_failover/zabbix_collector.py: "subprocess.run(" - Brand New Package PAYLOAD FILES src/mikrotik_doh_failover/zabbix_setup.py