Overview
In early October 2026, ThreatPurge threat intelligence sensors intercepted sustained exploitation activity against internet-facing security appliances. In-depth analysis confirmed a coordinated intrusion campaign tracked as 'Operation Velvet Chasm'.
Unlike commodity ransomware operations that rely heavily on mass phishing, the actors behind Velvet Chasm focus on edge network devices and unpatched gateway endpoints. Upon gaining initial foothold, the operators deploy a cross-compiled Rust binary optimized for speed and evasion.
Advisory Summary
Organizations operating internet-facing VPN or gateway controllers should immediately verify authentication logs for unauthorized administrative sessions and ensure all vendor-issued security patches are applied.
Initial Access & Lateral Movement
Initial ingress is achieved via automated exploitation of known vulnerability paths in legacy edge firmware. The threat actors execute lightweight reconnaissance commands before staging secondary payloads.
Once established within the perimeter, the attackers employ standard administrative utilities to harvest credentials from memory, systematically mapping internal domain controllers and file servers prior to the deployment phase.
Malware Architecture & Capabilities
The ransomware binary is written in Rust, providing native performance and cross-platform flexibility that complicates traditional signature-based detection mechanisms.
Prior to beginning the encryption routine, the malware terminates database management engines and virtualization services to clear active file locks. It then executes commands to remove volume shadow copies, preventing local data recovery via native system tools.
Recommended Mitigations
1. Audit perimeter appliances: Verify that administrative access to edge VPN gateways is restricted to internal jump boxes or protected by hardware security keys.
2. Implement network segmentation: Restrict communications between edge controllers and core business databases to minimize lateral movement scope.
3. Maintain immutable backups: Ensure critical backups are air-gapped or stored in write-once-read-many (WORM) configurations.
MITRE ATT&CK® Techniques
| Technique ID | Name |
|---|---|
| T1190 | Exploit Public-Facing Application |
| T1059 | Command and Scripting Interpreter |
| T1486 | Data Encrypted for Impact |
| T1567 | Exfiltration to Cloud Storage |
| T1490 | Inhibit System Recovery |