operations Archives

Tech Optimizer

September 5, 2026

Silver Fox uses adware to distribute ValleyRAT backdoor

The cyber threat group Silver Fox is distributing the ValleyRAT backdoor disguised as a legitimate signed Chinese adware application, specifically bundled with the QN Wallpaper tool. This malware allows attackers to gain comprehensive control over infected machines, enabling them to collect sensitive information, capture screenshots, and deploy additional malicious modules. The attack utilizes DLL sideloading, where a modified version of QN Wallpaper loads a malicious DLL from the same directory, circumventing signature-based security measures. The installer disables Windows Defender, adds itself to autorun entries, and uses the "runas" command to elevate privileges if the user lacks administrator rights. ValleyRAT also marks its process as critical, potentially causing a blue screen of death if terminated. Kaspersky has identified Silver Fox as the likely perpetrator of this campaign, known for similar techniques.

AppWizard

September 5, 2026

NYC Council to grill Mamdani admin over use of influencers, encrypted messaging app

The City Council will examine Mayor Mamdani's administration's use of a secretive encrypted messaging channel for media relations, which connects nearly 200 social media influencers. This discussion is scheduled for a hearing on September 22. Queens Councilman Phil Wong plans to introduce legislation requiring influencers to label posts for city agency campaigns with a disclaimer stating “Paid for by NYC.” A report revealed that city officials communicated with influencers through a Signal app group titled “NYC Creators Announcements,” sharing updates and multimedia content. Some influencers received payment for their involvement, while others supported the mayor's agenda for personal growth. Concerns have been raised about the Signal chat potentially violating record-keeping regulations due to auto-deletion of messages. The identities of the influencers and details of their contracts remain undisclosed. Wong's proposed bill aims to reveal any undisclosed payments to influencers and raise questions about the integrity of the administration's use of external promoters. Critics argue that the administration's secrecy calls for greater transparency in public relations expenditures.

Tech Optimizer

September 4, 2026

Object Storage + WAL: Lakebase Postgres for the agentic era

Agents interacting with traditional OLTP databases face bottlenecks at the storage layer due to data movement required for operations like deploying instances and managing replicas. Object storage solutions, such as Amazon S3, provide a more efficient and cost-effective alternative. The text discusses two OLTP models: data-centric and transaction-centric. The transaction-centric model emphasizes the importance of transaction history, which Postgres retains through its write-ahead log (WAL). The WAL records every modification before it is committed, allowing for the reconstruction of the database state as of a specific point in time. Lakebase Postgres introduces a two-layer architecture separating compute and storage. The compute layer handles SQL operations, while the storage layer ensures data durability and historical integrity. The WAL is streamed to safekeepers for replication, and the pageserver transforms WAL into materialized pages stored in object storage. This architecture allows for efficient read and write operations without direct interaction with object storage during queries. Key features of Lakebase Postgres include branching, which allows agents to create pointers to specific LSNs without copying data; instant restore capabilities that enable point-in-time recovery; time travel queries for accessing historical data; and read replicas that do not require data duplication. The system also supports scaling down idle compute nodes and eliminates the need for separate copies of data for transactional and analytical processing by storing a single durable copy in object storage. Overall, Lakebase Postgres enhances agent interactions with the database by leveraging object storage as a foundational element.

Winsage

September 4, 2026

Microsoft warns fake CAPTCHA is tricking Windows users into running malware

Microsoft has identified a new malware campaign called TerminalFix that uses fake CAPTCHA prompts to trick Windows users into executing malicious commands. This campaign is a variation of ClickFix attacks and employs deceptive pages that impersonate reputable services like Cloudflare. Instead of traditional CAPTCHA challenges, users are instructed to open PowerShell or Command Prompt and paste in commands, allowing attackers to execute complex scripts more easily. TerminalFix initiates a multi-stage intrusion, granting attackers persistent proxy access to the infected machine, which can lead to further exploitation of the company's network. The campaign relies on social engineering tactics, requiring user compliance with counterfeit verification instructions. Microsoft has released mitigation guidance, recommending restrictions on PowerShell access, monitoring for DLL sideloading, blocking outdated Flash plugins, and enabling cloud-delivered protection in Microsoft Defender Antivirus. The campaign poses significant risks to enterprise networks, but individual users should also be cautious about executing commands requested by websites.

Winsage

September 2, 2026

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using counterfeit software-download websites to distribute malicious installers, primarily targeting users seeking popular software. This campaign has significantly affected China-based operations of multinational corporations and Chinese-speaking users. The malware, once executed, can establish persistence, undermine security measures, and communicate with attacker-controlled infrastructure. Victims span various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft associates this campaign with a Chinese threat cluster called Silver Fox, known for using spoofed vendor download pages to spread Gh0st RAT and ValleyRAT. The malicious websites are hosted on .com.cn and .hl.cn domains, featuring Chinese-language content. The downloaded files are dynamically generated, and upon execution, they deploy a wrapper installer that initiates the malware payload. The malware achieves persistence through scheduled tasks and interferes with Windows Update services. The campaign establishes command-and-control communication over non-standard ports, with two identified domains linked to the activity. Microsoft Defender has detected the threat and initiated containment procedures. Kaspersky reported a related malicious installer exploiting a legitimate adware application to execute a backdoor, which captures keystrokes and clipboard contents. ValleyRAT, a sophisticated implant, can collect system information, reboot the computer, capture screenshots, and transmit logs. The attackers are motivated by cyber espionage and financial gain, targeting organizations globally. A subgroup within GoldenEyeDog, known as CuboidalCanine, has also been linked to the use of ValleyRAT, particularly in the gambling industry. In June 2026, Chinese authorities addressed cybercrime cases involving a new variant of the Silver Fox trojan.

Tech Optimizer

September 2, 2026

Connecting My LangGraph AI Agent to Postgres

A stateful LangGraph agent was developed to streamline a 15-minute booking process, mimicking a customer service representative. It features a user-friendly Streamlit UI and a backend powered by a Postgres database. The agent can respond to customer queries, calculate service prices, manage acceptance or rejection of services, propose appointment time slots, and confirm booking details. The agent operates in two persistence modes: in-memory for quick testing and Postgres for durability. Testing can be conducted locally with Streamlit or using Docker to simulate a production environment. Docker allows the application to interact with a PostgreSQL server without local installation, enhancing reproducibility. The project includes a docker-compose.yml file to initiate a PostgreSQL container, and users can also utilize a cloud-based Postgres solution. The application behavior remains consistent regardless of the database setup. The complete source code is available on GitHub for testing and further enhancements.

AppWizard

September 2, 2026

Fully Playable Scream Game Found in Steam Leak [2026]

A horror game based on the Scream film franchise was discovered in the Steam data leak that occurred from August 29 to 31, 2026. The game, an unfinished multiplayer prototype created by Fatshark, was found by a Twitter user named Roly Poly Reaper, who managed to run it on their computer and enable online multiplayer. The prototype included several unfinished builds, with one featuring operational networking code that allowed players to take on the roles of survivors evading a player-controlled Ghostface. The project appears to have been a pitch build, never fully greenlit for production, and was stored in Valve’s old Steam2 backend for approximately 15 years before the leak. Roly Poly Reaper used the Goldberg Steam emulator and Radmin VPN to run the game, circumventing the need for a live connection to Valve’s servers. Fatshark, known for cooperative shooters, had reportedly built the Scream prototype around 2011, coinciding with the release of Scream 4. The prototype's existence predates the popularization of the asymmetric horror genre by several years. The Steam2 leak itself involved approximately 12 to 13 terabytes of data, including various internal builds and beta versions from Valve and third-party developers. Valve has not publicly commented on the leak.

Winsage

September 1, 2026

Windows 11 Updates Trigger False Antivirus Warnings & Cursor Glitches

Microsoft is addressing two notable issues in Windows 11. The first is a harmless glitch that falsely indicates "Microsoft Defender Antivirus is turned off," which does not impact the antivirus's functionality. Users are advised to wait for a Microsoft update to resolve this. The second issue involves mouse customization settings not saving correctly since the August 27th update, although it only affects cosmetic preferences and not critical settings like pointer speed. Additionally, Microsoft has identified a solution for a game-breaking bug related to the "inpoutx64" driver, which will now be automatically blocked when launching Arc Raiders, with plans to extend this block to Marvel Tokon: Fighting Souls. Developers at Embark Studios have also implemented fixes for affected games, except for Tokon, for which players should use Microsoft's official workaround until a permanent solution is available.

Tech Optimizer

September 1, 2026

Connecting My LangGraph AI Agent to Postgres

A stateful LangGraph agent was developed to streamline a 15-minute booking process, featuring a user-friendly Streamlit UI and a backend powered by a Postgres database. The agent responds to customer queries, calculates service pricing, manages service acceptance, suggests time slots, and confirms appointment details. It operates in two modes: in-memory for rapid testing and Postgres for persistent storage. Testing can be done locally using Docker, which simulates a Postgres environment, or with a hosted Postgres instance. The project includes a docker-compose.yml file to initiate a PostgreSQL 16 container, allowing the application to connect to the database. Data persistence is ensured through Docker volumes, and the application can be run with specific commands after setting up the environment variables. The system has been tested successfully, demonstrating its ability to manage bookings and maintain data integrity across sessions. Future enhancements are planned to improve the booking workflow and integrate additional communication channels.

Tech Optimizer

September 1, 2026

Autoscaling Lakebase Postgres

Choosing a database instance size without prior knowledge of the workload can lead to inefficiencies and excessive compute usage. Lakebase Postgres addresses this with an autoscaling feature that eliminates manual sizing, utilizing in-place VM resizing and a monitoring algorithm for CPU, memory, and working set size. Lakebase Postgres separates compute and storage layers, allowing independent resizing of compute nodes without affecting the database. The autoscaling algorithm relies on three signals: CPU load (cpuGoalCU), memory use (memGoalCU), and compute-cache working set size (lfcGoalCU). The CPU load is monitored every five seconds, aiming to maintain it at or below 90% capacity. Memory usage is tracked at two frequencies: overall memory every five seconds and Postgres-specific memory every 100 milliseconds, with a goal to keep usage below 75% of allocated RAM. The compute cache evaluates active data access efficiency, adjusting size based on workload. The working set is estimated using a modified HyperLogLog algorithm that records timestamps for page accesses, allowing for distinct page estimates over various time frames. The algorithm projects future working-set growth to allocate sufficient cache while capping it at 75% of RAM. Resizing the compute involves four components: the autoscaler-agent, vm-monitor, Kubernetes scheduler, and NeonVM. Scaling up occurs when any of the three goals indicate a need for more resources, while scaling down includes verification to ensure sufficient memory remains for operations. Timely adjustments in both directions are prioritized to minimize costs.