A local privilege escalation technique hiding inside Windows RPC. Compromised routers quietly funneling Chinese espionage traffic through your network perimeter. A trojanized PDF reader dropping a post-exploitation beacon via GitHub. What connects these three stories isn’t the attacker or the malware — it’s the same uncomfortable truth: your firewall sees the connection, but it can’t always tell you what’s riding inside it. That’s where ipban-style edge controls and behavioral monitoring start pulling their real weight, filling the visibility gaps that traditional perimeter rules were never designed to close.

PhantomRPC: The Escalation Path Your EDR Probably Missed

Kaspersky’s researchers dropped a technically detailed post this week on a vulnerability they’re calling PhantomRPC. The short version: a flaw in Windows RPC architecture lets an attacker spin up a fake RPC server, intercept calls meant for a legitimate service, and escalate privileges — without needing admin rights to get there. It’s a local privilege escalation, so you need initial access first. But that’s a much lower bar than it sounds.

What makes this worth your time isn’t just the CVE. It’s the structural insight. RPC is load-bearing infrastructure in Windows environments — Active Directory, DCOM, WMI, remote management services all lean on it. When you introduce a spoofed RPC endpoint that Windows treats as legitimate, you’ve created a trust inversion inside your own OS. The attacker isn’t fighting your security controls. They’re using the operating system’s own service discovery against itself.

The practical attack chain looks like this: an attacker lands on a box through a phishing email, a trojanized installer, or a compromised credential — all of which were in the news this week in other contexts — and then uses PhantomRPC to move from user-level access to SYSTEM. From there, lateral movement is almost a formality. Defenders relying on “user couldn’t have done that, they don’t have rights” as a mental model just lost that assumption.

China’s Botnet Infrastructure and the Edge Device Problem

While PhantomRPC is a local technique, the NCSC advisory published this week focuses on the opposite end of the threat chain: how China-linked actors are getting into networks in the first place. The answer, increasingly, is through your edge devices — routers, VPN concentrators, and network appliances that sit between the internet and everything you care about.

The shift the NCSC is flagging is significant. Chinese state-linked groups have moved away from individually sourced VPS infrastructure — the kind that shows up on threat intel block lists within days — toward large-scale botnets built from compromised everyday devices. Think SOHO routers, old NAS units, end-of-life VPN boxes still sitting in server closets. These devices have legitimate IP addresses, often assigned to real businesses or residential ISPs, which means reputation-based IP banning and standard geo-filtering hit their limits fast.

The NCSC advisory is direct about what organizations should do: map and baseline traffic from edge devices, especially VPN and remote access connections. If you don’t have a traffic baseline, you can’t detect anomalies. And if your edge devices are themselves the compromised layer, your visibility problem runs deeper than your perimeter firewall can fix.

This is the real operational challenge. Brute-force protection and connection-rate limiting can help surface unusual access patterns. Automated threat protection tools that track behavioral indicators — not just known-bad IPs — are better positioned to catch this class of activity. But none of that matters if your edge device firmware hasn’t been updated since 2022 and a Chinese APT already owns the routing table.

Tropic Trooper’s Delivery Chain and Why GitHub Trust Is a Liability

Zscaler ThreatLabz’s report on Tropic Trooper this week showed a delivery mechanism that deserves a closer look beyond the headline malware. The campaign trojanized SumatraPDF — a legitimate, widely trusted open-source PDF reader — and used GitHub as part of its C2 and payload delivery infrastructure. The final payload is AdaptixC2 Beacon, a post-exploitation framework that then abuses VS Code tunnels for persistent remote access.

Pick that apart operationally and you’ll see why this is a problem for most enterprise network controls. GitHub is almost universally allowed outbound. VS Code tunnels run over Microsoft’s infrastructure. SumatraPDF is a known-good binary that most endpoint tools won’t flag. Each individual component passes a smell test. The combination is a complete, stealthy intrusion chain that a firewall tuned for known-bad indicators is going to miss entirely.

The lesson for incident response teams isn’t “block GitHub.” That’s not viable, and Tropic Trooper knows it. The lesson is that behavioral anomaly detection — which connections are unusual for this host, at this time, to this destination — has to be part of your detection stack. A developer workstation making authenticated GitHub API calls is expected. A finance department machine doing the same thing at 2 a.m. is not.

What You Can Actually Do Right Now: Operational Hardening Steps

These three stories don’t require a budget conversation to start addressing. Some of this is configuration work you can start this week.

• Audit RPC exposure: Inventory which services expose RPC endpoints and whether unnecessary RPC-based services can be disabled or restricted to loopback only. Check for unsigned or unexpected RPC server registrations as a detection hunt.
• Baseline your edge device traffic: If you don’t have a documented traffic baseline for VPN, firewall, and router interfaces, build one now. Deviations from baseline are your primary detection signal for compromised edge infrastructure.
• Enforce firmware update SLAs on network gear: Routers and VPN appliances are the botnet’s on-ramp. Treat firmware updates for network infrastructure with the same urgency as OS patches — because attackers already do.
• Flag unusual outbound connections to developer platforms: GitHub, GitLab, and VS Code tunnel infrastructure are legitimate services being abused for C2. Alert on unusual hosts initiating these connections, not just on destination reputation.
• Layer automated IP blocking with behavioral context: Static blocklists are inadequate against botnet-sourced traffic with clean IP reputation. IPBan Pro-style automated tools that incorporate behavioral signals — failed auth patterns, connection velocity, protocol anomalies — give you something to work with when reputation feeds fail.
• Apply this week’s CrowdStrike and Tenable patches immediately: A critical LogScale flaw and a high-severity Nessus vulnerability were patched this week. Your security tools themselves are attack surface — patch them first, not last.

None of this is exotic. It’s the kind of configuration hygiene that tends to get deferred because it isn’t glamorous. PhantomRPC, Chinese botnet infrastructure, and trojanized developer tools are sophisticated. The defenses that interrupt them often aren’t.

Frequently Asked Questions

What is PhantomRPC and does it require physical access?

PhantomRPC is a local privilege escalation technique exploiting a flaw in Windows RPC architecture that lets an attacker spoof an RPC server and hijack service calls to gain SYSTEM-level privileges. It does not require physical access — only user-level access on a Windows machine, which attackers typically obtain through phishing or credential theft.

Why is botnet-sourced traffic difficult to block with standard IP banning?

Botnet infrastructure built from compromised consumer routers uses IP addresses belonging to legitimate businesses and residential ISPs, so their reputation scores appear clean. Traditional ipban rules and blocklists that rely on known-bad IP reputation have very limited visibility into this traffic. Behavioral analysis and connection baselining are required to detect it reliably.

Is blocking GitHub and VS Code tunnels a realistic defense against Tropic Trooper?

For most enterprises, no — these are legitimate platforms that legitimate business tools depend on. The realistic defense is anomaly detection: alerting when unexpected hosts initiate connections to GitHub APIs or VS Code tunnel endpoints, especially outside normal business hours or from machines where that behavior is inconsistent with the user’s role.

Sources

• PhantomRPC: A new privilege escalation technique in Windows RPC — Kaspersky Securelist
• Compromised everyday devices power Chinese cyber espionage operations — Help Net Security
• Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2 — The Hacker News
• Vulnerabilities Patched in CrowdStrike, Tenable Products — SecurityWeek