Solar 4RAYS

Smartphone Spyware: How Devices Collect and Exfiltrate Data Even Without Internet Access

Modern smartphones continue gathering sensor data including microphone, camera, gyroscope, and satellite navigation even when Wi-Fi and mobile data are disabled. Information is stored locally and transmitted only when connectivity is restored. The Find My Device feature from Google and Find My from Apple allow location reporting for hours after the device is powered off via a separate Bluetooth chip. In August 2026, ThreatFabric disclosed the Manic trojan that uses Wi-Fi Direct, Bluetooth RFCOMM, and BLE GATT to relay encrypted data through nearby infected devices when direct internet access is unavailable. The malware supports multi-hop routing of up to four intermediate devices. Everyday users face greater risk from over-privileged applications and pre-installed malware on gray-market devices than from sophisticated offline exfiltration techniques. A detailed checklist covers purchase hygiene, permission audits, and recovery steps after suspected compromise.

Solar SIEM 2026.2 Adds Full Solar JSOC Detection Library, TI Feeds Support, Enhanced AI Agent and Multi-Tenancy

GC Solar has released Solar SIEM 2026.2, which now includes the complete detection rule library developed by Solar JSOC over 14 years of monitoring approximately 300 customer infrastructures. The update eliminates the need for organizations to spend months building custom rule sets by providing ready-made detection scenarios that identify sophisticated attacks from the earliest implementation stages. In 2025, Solar JSOC recorded 1.16 million security events after false-positive filtering and confirmed more than 33,000 incidents, with malware accounting for 36 percent and unauthorized access attempts for 23 percent. The product also gained native support for TI Feeds, allowing automatic ingestion and correlation of indicators of compromise from Solar 4RAYS and customer-owned sources. The built-in AI agent has been significantly expanded so it can now independently query raw event data, perform deeper analysis, and recommend next steps, reducing manual workload for analysts. Multi-tenancy capabilities enable multiple organizations to share a single SIEM instance while keeping their event streams fully separated, targeting holdings, MSSP providers, and large enterprises with numerous divisions. More than 40 companies of various sizes participated in the pilot program.

Fake Telegram Proxy Repositories on GitHub Deliver Stealer Malware to Home Users Seeking to Bypass Restrictions

Cybersecurity researchers from Solar 4RAYS at GC Solar have uncovered a widespread campaign where attackers distribute fake Telegram proxy tools on GitHub and mirror sites. The scheme capitalizes on Russian users searching for ways to circumvent Telegram restrictions, with malicious repositories quickly replacing legitimate ones in search engine results. Victims download trojans such as Salat Stealer or Santa Stealer that are disguised as useful proxy software, complete with copied README files, layout, and even the original developer’s donation details. These stealers extract browser sessions, passwords, and specific file types, potentially leading to account takeovers and data theft. The attack benefits from high user trust in GitHub, although the platform’s hosting service cannot always review the constant stream of new uploads. Experts warn users to avoid automatic downloads and to watch for warning signs such as brand-new accounts, zero stars or forks, and requests to disable antivirus software before installation.