Tag
fast16 Cyber Sabotage Framework
3 rules 4 TTPs 4 IOCsThe fast16 framework is a cyber sabotage tool dating back to 2005 that selectively targets high-precision calculation software, patching code in memory to tamper with results, using a Lua virtual machine and propagating across an entire facility to produce inaccurate calculations, with svcmgmt.exe as a carrier and fast16.sys modifying executable code.
Libinput Code Injection Vulnerability via Malicious Lua Bytecode (CVE-2026-35093)
3 rules 6 TTPs 1 CVEA local attacker can exploit CVE-2026-35093 in libinput by placing a specially crafted Lua bytecode file in configuration directories, allowing arbitrary code execution with the privileges of the application using libinput.
Contour HTTPProxy Lua Code Injection via Cookie Path Rewrite
2 rules 3 TTPsContour's Cookie Rewriting feature is vulnerable to Lua code injection; an attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in the `spec.routes[].cookieRewritePolicies[].pathRewrite.value` or `spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value` fields, resulting in arbitrary code execution in the Envoy proxy.