juniper

The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript. Russian cybersecurity company Kaspersky is tracking the malware strains under the names NodeRabbit and PollCat. The first sample of NodeRabbit was discovered on a system in Afghanistan, with subsequent sightings on two distinct machines located in Egypt and Ethiopia. "Its operators deliver [NodeRabbit] through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives," Kaspersky security researcher Omar Amin said. "Like NodeRabbit, PollCat is a cross-platform RAT, but it is written in obfuscated JavaScript also distributed through trojanized coding challenge archives." While Nimbus Manticore has historically employed malware written in C, C++, and Go, and relied on DLL search-order hijacking techniques to deploy them, the latest findings mark the threat actor's foray into cross-platform tools to accomplish its goals. The development also comes amid a rapid expansion of the hacking group's malware arsenal in recent months, including - A Windows backdoor called NightLedger Two custom WebSocket tunnelers, BridgeHead and ArcBridge A reverse SSH tunneling tool A backdoor that shares overlaps with TWOSTROKE The starting point of the suspicious activity observed in the Afghanistan-based system starts with a ZIP file ("Front-Technical-Challenge.zip") hosted on AWS that's assessed to have been delivered as part of a job opportunity for an engineering role. The threat actor is said to have masqueraded as a talent acquisition specialist at a major technology company to approach a software engineer and invited them to complete a technical assignment. It's worth noting that Nimbus Manticore is also tracked under the moniker Iranian Dream Job for its use of recruitment-themed lures to trick prospective targets into infecting their own computers, a tactic long adopted by the North Korea-linked Lazarus Group. The archive contains source code for a project management tool called Taskflow and instructs candidates to "find and fix all bugs in the frontend code" as part of an "engineering challenge" within three hours and without relying on artificial intelligence (AI)-assisted tools. The instructions specifically ask the candidates to refrain from modifying the server component of the application ("server.js"), claiming it's "bug-free and functions correctly." However, it's in this file that the malicious code is embedded. "The first line of server.js imported a trojanized npm package named colorized_terminal, version 2.1.0," Kaspersky said. "The attackers bundled the package directly in the challenge task archive's node_modules directory rather than publishing it to the npm registry. When imported, the package silently launched an implant from node_modules/.cache/.320697f1/index.js as a detached background process." The implant in question is NodeRabbit, which communicates with one of three Azure-hosted command-and-control (C2) addresses ("plugplay.azurewebsites[.]net," "rgbteller.azurewebsites[.]net," and "wslwebui.azurewebsites[.]net") through three distinct API endpoints - /api/rabbit/checkin, to register agent and host information /api/rabbit/task, to poll for commands /api/rabbit/result, to send task results The malware supports 11 commands that allows it to gather host details, list running processes, execute arbitrary shell commands, enumerate directories, read a file in chunks and return Base64-encoded data, decode Base64-encoded text and write it at a chosen file offset, delete a file or recursively delete a directory, create directories recursively, enumerate adapters, MAC addresses, IP addresses, and DNS settings, and alter beacon interval. Another notable capability of NodeRabbit is to write a Base64-encoded Node.js script to a randomly named ".tmp" file, execute it, and then delete it to cover up traces of malicious activity. Kaspersky said it identified two more variants of NodeRabbit that share the same code lineage, each recovered from Egypt and Ethiopia - A second variant that uses a different trojanized npm package named pretty-log (version 2.1.0) instead of colorized_terminal, while also partially implementing corporate proxy support and terminating if found to be running in an analysis environment A third variant that's also launched using the pretty-log npm package but uses a different set of API endpoints to accomplish the same tasks - - /sdk/v2/ready - /sdk/v2/config - /sdk/v2/events Persistence is achieved depending on the operating system: a Windows Run registry key on Windows, a cron entry for Linux, and a launch agent on macOS. The persistence mechanism mimics either a Microsoft Edge browser update (first variant) or Intel's Driver & Support Assistant (second variant). The third variant, on the other hand, does not impersonate any legitimate software, but also takes into account the Windows Subsystem for Linux (WSL) to create a daily 10 a.m. Windows task that launches a Visual Basic Script file through "wscript.exe" and "wsl.exe." In addition, it features 12 new commands to - Enumerate accessible Windows drive letters or WSL-mounted drives Execute a process Kill process by PID or image name Replace the active C2 server and attempt to keep the new configuration Return the current C2 server Harvest account addresses from Outlook OST and PST artifacts Attempt to install a fake VS Code extension named "GitHub Copilot Helper" and Windows Run value for added persistence Check selected VS Code, scheduled-task, and Run-key persistence indicators Remove the fake extension Search recent and common development locations for Git repositories Inject a launcher into a repository's Git hooks for added persistence Remove the marked Git-hook launcher Nimbus Manticore has also been observed using programming challenge lures ("RankChallenge-react-6uJSX3-main.zip") distributed via time-limited developer assessments to deliver PollCat. "Although the visible exercise is not a security CTF, the project uses CTF terminology in several places," Kaspersky said. "The root package is named ctf-server, the backend prints CTF server running, the frontend uses several ctf-* storage keys, and the tutorial refers to path/to/ctf." "These repeated labels, together with instructions that do not fully match the delivered application, are consistent with an AI-assisted or template-generated project. One possible explanation is that the attacker prompted an AI coding assistant to create a CTF-style React platform and later inserted the malicious components." A PDF tutorial present within the archive prompts the target to click "Continue" and enter an attacker-supplied six-digit one-time password (OTP) that's refreshed every 30 seconds, and complete the challenge within a one-hour session. The compressed timeline to activate the assessment is likely an attempt to create a false sense of urgency and make them run the project as soon as possible to increase the likelihood of an infection. Despite the one-hour session window, PollCat runs independently of the OTP authentication process, unaffected by the success or failure of the OTP validation step. A failed validation prevents the victim from accessing the protected challenge features, while a successful OTP validation issues a JWT and starts an additional PollCat instance. For persistence, the malware creates a daily scheduled task on Windows, Linux, or macOS, and then connects to a C2 server to send basic host information and await further instructions. It supports 22 commands and communicates via seven API endpoints - /beacon, to register the client and obtain a socketId /gate/hello, to send host, user, domain, operating system information, and its current privilege level /gate/fetch?token= , to poll for commands /gate/submit, to submit a Base64-encoded command-result structure /vault/ , to fetch a hosted file and write it to the victim machine /vault/push, to upload a local file or file chunk to the C2 /gate/track, to report chunk-upload progress The commands span the typical backdoor gamut, enabling the operator to perform file operations, execute shell commands, upload/download files, run JavaScript, load DLLs, create or extract a ZIP archive, and enumerate running processes, drives, volumes, or mount points. Three commands, namely WS_DOWNLOAD, REQUEST_ELEVATION, and PERSIST, are currently not implemented. PollCat also searches for folders matching 24 hard-coded strings corresponding to software and security vendors, including Google, Microsoft, Palo Alto Networks, Cisco, VMware, Fortinet, Citrix, Check Point, Juniper Networks, LogMeIn, Sophos, Symantec, Trend Micro, McAfee, Kaspersky Lab, ESET, Bitdefender, Avast, CrowdStrike, SentinelOne, Malwarebytes, Brave, Tencent, and Naver. When a matching folder is found, the malware inventories the folder's root contents but does not recursively scan the product's directory. The results are then transmitted in the form of JSON to the "/api/system-details/result" endpoint. The activity's links to Nimbus Manticore stem from the structural, command fetching, beacon timing, and command set similarities between PollCat and MiniFast (aka MiniUpdate or Retrograde), a backdoor previously attributed to the group, as well as the use of Azure Websites and Cloudflare‑backed domains for C2. "The shift to cross-platform scripting gives the operators a single codebase that runs on Windows, Linux, and macOS, with payloads that blend naturally into developer workstations," Kaspersky said. "The delivery mechanism, however, remains consistent with Mirage Kitten’s historical tradecraft: the use of recruiter personas on LinkedIn to target critical sectors across the Middle East and Africa for cyber espionage purposes."

While monitoring Mirage Kitten activity, we uncovered a previously undocumented malware family that we dubbed NodeRabbit. We identified the first sample on a system in Afghanistan. Further threat hunting revealed two additional, more advanced, variants: one on a system in Egypt and another on a system in Ethiopia. NodeRabbit is a cross-platform remote access trojan (RAT) built with Node.js. It targets Windows, Linux, and macOS. Its operators deliver it through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives. During the same investigation, we discovered another previously undocumented malware family that we dubbed PollCat. Like NodeRabbit, PollCat is a cross-platform RAT, but it is written in obfuscated JavaScript also distributed through trojanized coding challenge archives. Mirage Kitten has historically relied on native malware written in languages such as C, C++, and Go, often deploying it through DLL search-order hijacking. NodeRabbit and PollCat represent the first publicly documented use of Node.js- and JavaScript-based malware by this APT group. Kaspersky’s products detect this threat as Trojan.JS.MirageKitten.* Background During recent threat research, we detected suspicious activity on a system in Afghanistan. We traced it to an archive containing a software development project that the user may have received during a job application process. The archive purported to contain a coding challenge for candidates applying for an engineering role. The archive, Front-Technical-Challenge.zip (MD5: 1EA83E4E4592B01E4ACAB63EB867BEE5 ), was hosted in an Amazon S3 bucket at: https://oracle-challenge.s3[.]us-east-1.amazonaws[.]com/Front-Technical-Challenge.zip It contained TaskFlow, an app for software engineering assessment built with Express, React, and Vite. The accompanying README instructed the candidate to review the application and fix defects in its frontend. It also claimed that server.js was bug-free and should not be modified, conveniently directing attention away from the only application source file the attackers had altered. README file for a trojanized coding challenge app The README also imposed a three-hour time limit and prohibited the use of AI assistants. Notably, an AI code-review assistant tasked with auditing the project would likely have flagged the suspicious first-line import of an unknown npm package and warned the targeted developer that the project was trojanized. Rules and time limit included in the trojanized coding challenge app README file The first line of server.js imported a trojanized npm package named colorized_terminal , version 2.1.0 . The attackers bundled the package directly in the challenge task archive’s node_modules directory rather than publishing it to the npm registry. When imported, the package silently launched an implant from node_modules/.cache/.320697f1/index.js as a detached background process. Retrospective threat hunting across our telemetry revealed the broader scope of the campaign. We identified three NodeRabbit variants with a shared code lineage; each was recovered from a system in a different country. The operators delivered the variants through similarly themed coding challenges and used two trojanized packages, colorized_terminal and pretty-log , both pinned to version 2.1.0 . The campaign also delivered PollCat, a second RAT with a substantially different structure, through a separate coding challenge lure. We’ll analyze PollCat later in this research. Initial access The infection chain begins with fake recruiter accounts contacting prospective targets on a job search platform. According to a publicly cited source, a threat actor posing as a talent acquisition specialist at a major technology company contacted a software engineer and advertised a job opening, inviting the target to complete a technical assessment. The target received a link to a coding challenge hosted on Amazon S3 and was pressured to download and run the project immediately. This public post matches the delivery chain we reconstructed from our telemetry: recruiter outreach on a job search platform, a coding challenge presented as a technical assessment, and a trojanized project archive hosted on legitimate cloud infrastructure. NodeRabbit RAT: the first variant We discovered the first NodeRabbit variant on a system in Afghanistan. The malware was concealed within the TaskFlow assessment at node_modules/.cache/.320697f1/index.js and executed by the trojanized colorized_terminal package. Once running, NodeRabbit generates a unique agent identifier from available host information. It calculates the SHA-256 hash of the hostname, username, operating system version, architecture, and MAC address, then truncates the result to its first 32 hexadecimal characters. NodeRabbit binds a TCP listener to 127.0.0.1:48739. This listener acts as a single-instance mechanism. If the malware cannot bind to the port, it assumes that another instance is already running and terminates silently. NodeRabbit uses a persistence mechanism for each operating system: Operating system Persistence mechanism Windows Copies itself to %APPDATA%\Microsoft\EdgeUpdate\msedge_update.js; clones the local node.exe to nodew.exe in the same folder and patches its PE subsystem from Console to Windows GUI to suppress the console window; creates HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate registry key executing nodew.exe msedge_update.js Linux Copies itself to ~/.config/microsoft-edge-update/msedge_update.js and creates an @reboot cron entry that invokes the script using the current Node.js executable. macOS Copies itself to ~/.config/microsoft-edge-update , creates ~/Library/LaunchAgents/com.microsoft.edgeupdate.plist configuration file pointing at the copy’s location with RunAtLoad and KeepAlive parameters, and attempts to load it. The malware communicates with its command-and-control servers through three API endpoints, choosing from the following Azure-hosted C2 infrastructure addresses. On failure, it switches to the next C2 address: 1. https://plugplay.azurewebsites[.]net 2. https://Rgbteller.azurewebsites[.]net 3. https://Wslwebui.azurewebsites[.]net Method Endpoint Purpose POST /api/rabbit/checkin Register agent and host info POST /api/rabbit/task Poll for commands POST /api/rabbit/result Submit results NodeRabbit serializes each C2 request object as JSON and wraps it with AES-256-GCM. The AES key is the SHA-256 digest of an ASCII seed embedded into the agent. Every request uses a fresh 12-byte IV and a 16-byte authentication tag: The malware sends encrypted requests using the following structure: { "d": "base64(IV || ciphertext || authentication_tag)", "_r": "8 hexadecimal characters", "_t": "epoch timestamp" } C2 responses are structured the same way and may contain a command to execute. We observed the first NodeRabbit variant supporting 11 commands: Command Functionality sys:info Return hostname, domain user information, username, and process ID. proc:list List running processes. proc:start Execute an arbitrary shell command. fs:list List a directory. fs:read Read a file in chunks and return Base64 data. fs:write Decode Base64 and write it at a chosen file offset. fs:delete Delete a file or recursively delete a directory. fs:mkdir Create directories recursively. net:config Enumerate adapters, MAC addresses, IP addresses, and DNS settings. agent:sleep Change the beacon interval. script:exec Write a base64 Node.js script to a randomly named .tmp file, execute it and delete it. NodeRabbit RAT: the second variant Retrospective threat hunting following the discovery in Afghanistan led us to a second infection on a system in Egypt. This sample is a more advanced NodeRabbit variant, launched through the trojanized pretty-log package instead of colorized_terminal . Before running its core functionality, the malware checks whether the host resembles an analysis environment. It terminates if it detects limited system memory, a low CPU count, short system uptime, analyst-associated usernames or hostnames, or common analysis tools running on the system. Before terminating, the malware generates benign HEAD requests to www.google.com, www.microsoft.com , and www.cloudflare.com , then exits without ever contacting its C2 infrastructure. Most likely, it attempts to look less suspicious by showing some benign activity before exiting. Variant 2 implements partial corporate proxy support: it checks HTTP(S) proxy environment variables, Windows Internet Settings, including an explicit PAC URL, and WinHTTP configuration; tunnels its HTTPS C2 through HTTP CONNECT . It first tries to establish an unauthenticated connection. If it fails, it retries using URL-embedded basic credentials. Finally, it delegates Windows NTLM/Negotiate challenges to curl.exe --proxy-anyauth --proxy-user . It caches the proxy-discovery result, including when no proxy is found, for five minutes. If the polling loop detects a network-interface or IP-address change, it clears the cache and runs proxy discovery again on the next checkin. To make sure a single instance is running, Variant 2 uses a host-specific port derived from the agent identifier instead of the fixed TCP port used by the first variant. It interprets the first four hexadecimal characters of the identifier as an integer and applies the following calculation: 41984 + (value mod 5000) . The resulting listener port falls between 41984 and 46983 . Unlike the shared port used by Variant 1, this port varies depending on the infected host. For persistence, Variant 2 masquerades as Intel Driver & Support Assistant. The exact persistence mechanism, once again, depends on the operating system. Operating system Persistence mechanism Windows Copies itself to %LOCALAPPDATA%\Intel\DSA\idriver_support.js . It then copies the local node.exe binary to IntelDSA.exe and changes its PE subsystem from Console to Windows GUI, suppressing the console window. Finally, it creates a scheduled task named IntelDriverSupportUpdate , which runs daily at 10AM and executes IntelDSA.exe with the dropped script. Linux Copies itself to ~/.config/intel-dsa/idriver_support.js and creates an @reboot cron entry. macOS Copies itself to ~/Library/Application Support/Intel DSA/idriver_support.js and creates the LaunchAgent com.intel.dsa.helper with RunAtLoad and KeepAlive enabled. NodeRabbit RAT: the third variant Further threat hunting identified a third NodeRabbit variant on a system in Ethiopia. Like the second variant, it is launched through the trojanized pretty-log package. It retains much of the previous variant’s functionality but introduces significant changes to its command-and-control configuration, command set, and persistence mechanisms. The third variant communicates with its C2 infrastructure through a different set of API endpoints: Method Endpoint Purpose POST /sdk/v2/ready Register agent and host info POST /sdk/v2/config Poll for commands POST /sdk/v2/events Submit results We observed the malware using a C2 chain composed of Azure- and Cloudflare-hosted domains. 1. https://visitfinancedentists[.]com 2. https://kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net 3. https://healthcomfsdpower[.]com For persistence, Variant 3 implements the following mechanisms depending on the operating system in use: Operating system Persistence mechanism Windows Attempts to copy the payload to ProgramData or LocalAppData , create a build-specific daily 10AM task, and start the copied payload. To choose the exact directory, it tries to list C:\Windows\System32\config . If successful, it selects ProgramData with /ru SYSTEM /rl highest; in case of a failure, it selects LocalAppData without explicit /ru or /rl settings. macOS Copies the payload to ~/Library/Application Support, creates and loads a RunAtLoad/KeepAlive LaunchAgent and starts the copied payload. Linux Copies the payload to ~/.local/share , attempts to add an @reboot cron entry, and starts the copied payload. If crontab -l fails, persistence is skipped. WSL Uses the payload copied for persistence on the main Linux system, as described above. Writes launcher.vbs under the Windows user profile, and creates a daily 10AM Windows task that relaunches it through wscript.exe and wsl.exe . A new command, agent:servers , replaces the active in-memory C2 server list and can write the updated list to .sv.json . The third variant retains the original 11 commands and adds 12 new ones, bringing the total to 23. New commands Functionality fs:drives Enumerate accessible Windows drive letters or WSL-mounted drives proc:exec Execute a process proc:kill Kill process by PID or image name agent:servers Replace the active C2 and attempt to keep the new configuration agent:getchain Return the current C2 outlook:emails Harvest account addresses from Outlook OST and PST artifacts persist:check Check selected VS Code, scheduled-task, and Run-key persistence indicators persist:vscode Attempt to install a fake VS Code extension and Windows Run value persist:vscode:remove Remove the fake extension persist:projects:scan Search recent and common development locations for Git repositories persist:project:inject Inject a launcher into a repository’s Git hooks persist:project:remove Remove the marked Git-hook launcher Beyond the persistence mechanisms described above, Variant 3 introduces two additional persistence mechanisms that relaunch the malware through common developer workflows. 1. Malicious VS Code extension The persist:vscode command first copies the payload to its build-specific install path. If a compatible extension directory exists, it creates a fake extension displayed as GitHub Copilot Helper , with the description AI coding assistant helper service and the activation event on StartupFinished . The extension’s extension.js file attempts to start the installed payload as a detached Node.js process. To look less suspicious to the user, it uses a trusted publisher name borrowed from local extension metadata or a trustedPublishers value found in state.vscdb . However, no signature or trusted status is copied. Separately, the handler tries to disable Workspace Trust if the VS Code User directory exists. On Windows, it attempts to establish persistence using a current-user Run registry key value even if the extension directory is missing. 2. Git hook injection Git-hook persistence works in two steps. First, persist:projects:scan checks recent VS Code workspace paths directly. Under common locations such as ~/projects and ~/source , it checks only the first 60 immediate children, not the root itself, and returns no more than 20 repositories. For a selected repository, persist:project:inject appends a marked launcher to .git/hooks/post-merge and .git/hooks/post-checkout by default. The marker is # shepherd-persist; the line following the marker attempts to start the installed payload with Node in the background. A later Git operation must trigger one of those hooks, and the referenced Node executable and payload must still exist. PollCat RAT While tracking NodeRabbit infections, we discovered another malicious tool we dubbed PollCat, which is also distributed under the guise of a programming challenge. The sample we obtained resides inside RankChallenge-react , a React code-fixing challenge presented as a time-limited developer assessment. Running the project invokes npm i && node index.js , which starts the local application and attempts to open the challenge in the user’s browser. Although the visible exercise is not a security CTF, the project uses CTF terminology in several places. The root package is named ctf-server , the backend prints CTF server running , the frontend uses several ctf-* storage keys, and the tutorial refers to path/to/ctf . These repeated labels, together with instructions that do not fully match the delivered application, are consistent with an AI-assisted or template-generated project. One possible explanation is that the attacker prompted an AI coding assistant to create a CTF-style React platform and later inserted the malicious components. README instructions and challenge overview included in the trojanized React coding project The PDF tutorial contained in the same archive as the project tells the target to click Continue , enter a six-digit OTP code, and complete the challenge within a one-hour session. It states that codes are supplied by the recruiter, are single-use, and expire quickly; the visible login page also claims that codes rotate every 30 seconds. In the delivery scenario described by the investigation, the threat actor posing as a recruiter could provide the code directly to the targeted developer. This gives the operator control over access to the lure, while the expiring code and countdown create a sense of urgency, pressuring the target to run the project and complete the assessment quickly, potentially accelerating the infection process. One-hour session window enforced by the trojanized coding challenge The bundled .env file contains the JWT signing secret, OTP service URL, and OTP client ID. Configuration embedded in .env file of the trojanized coding project, including the OTP service URL and client identifier The application forwards submitted codes to an attacker-managed domain registered in late June-2026: https://lifespotify[.]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate . That said, PollCat starts independently of the OTP authentication process. During application startup, app.js loads requireAuth.js , which imports and immediately starts the malicious requireObjects.js component. PollCat can therefore begin C2 registration and command polling while the application is still loading, before the user enters an access code. A failed OTP validation prevents the user from accessing the protected challenge features, but PollCat continues running in the background. A successful OTP validation issues a JWT and creates another worker that starts an additional PollCat instance. The first authenticated request also triggers the persistence attempt. Persistence starts when the first request carrying a valid JWT reaches the protected middleware. PollCat then uses one of the following methods: Operation system Persistence mechanism Windows Writes package.json and requireObject.js to %APPDATA%\Microsoft\Network, runs npm install, and creates a daily task named NetSync_<username> and scheduled for 09AM that runs the worker with Node.js. Linux Writes the worker to ~/.node_packages, runs npm i, and appends both a daily 09AM cron line and an @reboot line. macOS Uses the same ~/.node_packages copy and cron path, then creates and loads ~/Library/LaunchAgents/com.harsh.requireobject.plist with RunAtLoad and a daily 09AM trigger. Once active, PollCat identifies the host as 129--<hostname> and iterates over the following C2s until registration succeeds: 1. https://sahi-finance[.]com 2. https://GamebarAppinformation[.]azurewebsites[.]net 3. https://GamebarApp[.]azurewebsites[.]net To register, it sends the following HTTP request to the C2: POST /beacon HTTP/1.1 Host: <c2-host> Content-Type: application/json {"clientId":"<client-id>","type":"poll","pcName":"<hostname>","userName":"<username>"} On successful registration, PollCat expects an unusual HTTP 400 response containing a socket identifier and optional timing values: HTTP/1.1 400 Content-Type: application/json {"socketId":"<socket-id>","pollInterval":<poll-interval-ms>,"jitterTime":<jitter-ms>} After registration, PollCat sends host information to /gate/hello , polls /gate/fetch for commands, and returns results through /gate/submit . All endpoints in use are presented in the table below. Method Endpoint Purpose POST /beacon Register the client and obtain a socketId and optional timing values. POST /gate/hello Submit host, user, domain, OS information, and its current privilege level. GET /gate/fetch?token=<socketId> Poll for commands. POST /gate/submit Submit a Base64-encoded command-result structure. GET /vault/<uuid> Retrieve a hosted file and write it to the victim machine. PUT /vault/push/ Upload a local file or file chunk to the C2. POST /gate/track Report chunk-upload progress. By default, PollCat RAT polls every two minutes with up to five seconds of jitter. Commands and results are stored as little-endian binary records and carried as Base64 text. PollCat RAT declares 22 commands, but three of them have no implementation: Command Functionality 0x02 (DIR) List a directory. 0x03 (MV) Move a file or directory. 0x04 (RUN) Execute a shell command. 0x05 (TASKLIST) List running processes. 0x06 (DEL) Delete a file or directory. 0x07 (UPLOAD) Download a file from the C2 to the victim’s machine. 0x08 (DOWNLOAD) Upload a local file to the C2. 0X09 (DRIVES) List drives, volumes, or mount points. 0X0A (TERMINATE) Terminate a process by PID. 0X0B (RUNDLL) Load a DLL and call an exported function on Windows. 0X0C (MKDIR) Create a directory. 0X0D (ZIP) Create or extract a ZIP archive. 0X0E (CHUNKED_DOWNLOAD) Upload a local file in chunks. 0X0F (RUN_HIDDEN) Start a hidden background process. 0X20 (EVAL_JS) Execute JavaScript supplied by the C2. 0X30 (SYSTEM_CHECK) Collect process and software inventory. 0XA1 (WS_DOWNLOAD) Defined but not implemented. 0xB0 (REQUEST_ELEVATION) Defined but not implemented. 0XB1 (PERSIST) Defined but not implemented. 0xF0 (SET_SLEEP_TIME) Change the polling interval. 0XF1 (SET_IDLE_TIME) Store an idle-time value. 0xF2 (SET_JITTER_TIME) Change polling jitter. The command names UPLOAD , DOWNLOAD , and CHUNKED_DOWNLOAD are written from the C2’s perspective. UPLOAD sends a C2-hosted file to the victim’s machine, while the two download commands transfer victim files back to the C2. EVAL_JS runs JavaScript supplied by the C2 and gives that code access to Node.js modules, files, processes, networking, and child-process functions. SYSTEM_CHECK collects the names of running processes and lists files and folders from: %SystemDrive%\Program Files %SystemDrive%\Program Files (x86) %LOCALAPPDATA% %LOCALAPPDATA%\Programs %APPDATA% %USERPROFILE% %APPDATA%\Microsoft\Outlook %LOCALAPPDATA%\Microsoft\Olk\Attachments %USERPROFILE%\Documents It also searches for folders matching 24 hardcoded strings corresponding to security software vendor names: ‘Google’, ‘Microsoft’, ‘Palo Alto Networks’, ‘Cisco’, ‘VMware’, ‘Fortinet’, ‘Citrix’, ‘CheckPoint’, ‘Juniper Networks’, ‘LogMeIn’, ‘Sophos’, ‘Symantec’, ‘Trend Micro’, ‘McAfee’, ‘Kaspersky Lab’, ‘ESET’, ‘Bitdefender’, ‘Avast Software’, ‘CrowdStrike’, ‘SentinelOne’, ‘Malwarebytes’, ‘BraveSoftware’, ‘Tencent’, and ‘Naver’. When PollCat finds a matching folder, it lists that folder’s root contents. It does not recursively scan the entire product directory. The detailed inventory, including process names, directory listings, and collected paths, is sent as JSON to POST /api/system-details/result . Infrastructure Mirage Kitten continues to rely on Azure Websites and Cloudflare-backed domains to hinder infrastructure discovery and tracking. More importantly, the use of Microsoft Azure subdomains for C2 helps the traffic blend into legitimate organizational network activity. In some cases that we encountered during our research, the actors even incorporated the targeted organization’s name into the Azure subdomain, making C2 communications appear more like normal business traffic originating from an employee machine during regular business days. Domain Registrar ASN Malware sample naturalapplication.azurewebsites[.]net retaildemo.azurewebsites[.]net tubitak.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 1 rgbteller.azurewebsites[.]net wslwebui.azurewebsites[.]net plugplay.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 2 crossdwm.azurewebsites[.]net wdisystem.azurewebsites[.]net wslmenus.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 3 dnshnsdev.azurewebsites[.]net hpjumpsrv.azurewebsites[.]net storview.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 4 healthcomfsdpower[.]com visitfinancedentists[.]com NameCheap, Inc. AS 13335 NodeRabbit RAT sample 5 kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net MarkMonitor Inc. AS 8075 greenyjsgfd.azurewebsites[.]net helptellerbls.azurewebsites[.]net timedrv.azurewebsites[.]net userwellgtfs.azurewebsites[.]net MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 6 hecowime-aqdphyd4bbdef6es.westeurope-01.azurewebsites[.]net msmanagementgrp[.]com msmanagementgrpmedia[.]com MarkMonitor Inc. AS 8075 NodeRabbit RAT sample 7 lifespotify[.]com Dynadot AS 8075 PollCat RAT gamebarapp.azurewebsites[.]net gamebarappinformation.azurewebsites[.]net MarkMonitor Inc. sahi-finance[.]com NameCheap, Inc. Based on our analysis of Mirage Kitten’s infrastructure, we identified certain patterns across several command-and-control channels, including msmanagementgrp[.]com and visitfinancedentists[.]com Further investigation based on these patterns led to the discovery of approximately 11 additional infrastructure assets attributed to the same group. Domain Creation date Registrar healthful-hub[.]com 2026-07-03 NameCheap, Inc. neumedicahealthcare[.]com 2026-07-03 NameCheap, Inc. optimumhealthcredit[.]com 2026-07-03 NameCheap, Inc. healthfullyrecipes[.]com 2026-06-30 NameCheap, Inc. refreshhealthandwellness[.]com 2026-06-09 NameCheap, Inc. healthvitalitycare[.]com 2026-05-18 NameCheap, Inc. aceofspadesmanagement[.]com 2026-05-18 NameCheap, Inc. glmediaagency[.]com 2026-05-18 NameCheap, Inc. digimediaskill[.]com 2026-05-18 NameCheap, Inc. healthyweightplan[.]com 2026-05-18 NameCheap, Inc. mens-health-online[.]com 2026-05-15 NameCheap, Inc. Victims Based on our telemetry, we identified victims in fintech, aviation and aerospace sectors across the Middle East and Africa – specifically, in Egypt, Ethiopia and Afghanistan. We also observed submissions of ZIP archives with trojanized projects containing NodeRabbit and PollCat to an online multi-scanner originating from several countries, including India, Türkiye, Israel, Iraq, Germany, and Ireland. Attribution We attribute this activity to Mirage Kitten with a high degree of confidence based on the following observations: Structural similarities with the Retrograde/ MiniFast native DLL backdoor (MD5: 810F8E3B88EB05F710C09552941D6F56 ) Initial C2 handshake and session establishment logic. Both PollCat and Retrograde/MiniFast follow a similar C2 handshake flow. Each builds a JSON request body containing host information and sends it via an HTTP POST request. Notably, both treat HTTP 400 as a successful handshake response rather than an error, parsing the response body to extract a socketId , which is then stored and used as the session token for subsequent C2 communication. Similar C2 handshake and socketId session establishment logic in MiniFast/Retrograde and PollCat Host registration. Both PollCat and Retrograde/MiniFast register the infected host with the C2 server by sending a structurally similar JSON request body containing the session token and host information. Malware Host registration request body C2 endpoint PollCat {“token”:”<socketId>”,”pcName”:”<host>”,”userName”:”<user>”,”domainName”:”<domain>”,”os”:”<os>”,”isElevated”:false} /gate/hello MiniFast/Retrograde {“token”:”<socketId>”,”pcName”:”<host>”,”userName”:”<user>”,”domainName”:”<USERDOMAIN>”,”isElevated”:<bool>} /agent/init Command fetching similarities. The similarities extend to command retrieval. Both PollCat and Retrograde/MiniFast periodically poll the C2 server using an HTTP GET request containing the previously assigned socketId as a token. Retrograde/MiniFast uses GET /agent/poll?token=<socketId> , while PollCat follows the same pattern with GET /gate/fetch?token=<socketId> , demonstrating a closely aligned C2 communication structure. Beacon timing similarities. PollCat and the Retrograde/MiniFast share identical beacon timing defaults: a polling interval of 120,000 ms ( 0x1D4C0 ), a jitter of 5,000 ms ( 0x1388 ), and a retry timeout of 60,000 ms ( 0xEA60 ). This further highlights the structural similarities between the two C2 communication implementations. Command set similarities. PollCat and Retrograde/MiniFast share several commands and command IDs. Notably, PollCat declares REQUEST_ELEVATION (0xB0) and PERSIST (0xB1) but does not implement them. In MiniFast, both are functional: 0xB0 performs UAC elevation, while 0xB1 creates the WindowsSecurityUpdate scheduled task for persistence. Command set similarities between MiniFast/Retrograde and PollCat, including shared command identifiers Proxy authentication similarities. NodeRabbit delegates corporate-proxy NTLM/Negotiate authentication to curl.exe --proxy-anyauth --proxy-user , using the victim’s logon session. Retrograde/MiniFast native DLL implements the same approach natively through WinHttpQueryAuthSchemes and WinHttpSetCredentials with NULL credentials. This shared proxy-aware C2 design suggests the same development approach across both malware families. Speaking of victimology, the attacks are consistent with Mirage Kitten’s known geographic targeting, with the group maintaining a strong focus on entities across Africa and the Middle East, this time with a particular focus on the aviation and FinTech sectors. As for the operational infrastructure, Mirage Kitten has historically hosted its initial ZIP lures on legitimate third-party services. Previously, it used onlyoffice.com for this purpose. In this activity, the group shifted to Amazon S3 buckets. Finally, the combination of Azure Websites and Cloudflare‑backed domains has been a hallmark of Mirage Kitten’s TTPs, which we have observed across NodeRabbit and PollCat. Conclusions Mirage Kitten’s latest activity marks a notable evolution in the group’s tooling: NodeRabbit and PollCat are the group’s first Node.js/JavaScript-based implants, departing from its usual native malware deployed through DLL search-order hijacking. The shift to cross-platform scripting gives the operators a single codebase that runs on Windows, Linux, and macOS, with payloads that blend naturally into developer workstations. The delivery mechanism, however, remains consistent with Mirage Kitten’s historical tradecraft: the use of recruiter personas on LinkedIn to target critical sectors across the Middle East and Africa for cyberespionage purposes. We continue to track the group’s activity and will report on new developments in future publications. Indicators of compromise Additional IoCs are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected] . File hashes CBAAF0900A13F28E380F49ADECEC932C   FrontEnd-Task.zip 1EA83E4E4592B01E4ACAB63EB867BEE5   Front-Technical-Challenge.zip 366515822D5AC1CC500711EF57A2E32E   Task-FullStack.zip CF449F1992C2819E62AC44A0B06AC2E7   fullstack-1536.zip E95A4366686E3F786EA3C056FAB5B0DA   webapp76592.zip DE5AF16A3757EF700B01DC34D67079AE   webapp76531.zip BE086789568441D0D7E4679AEE51F566   challenges-17831.zip E259C5EDF158AAC4CFE14F77DDD0B196   challenges-17832.zip 291AC3ABE73C5158E59A437B75D5F0AA   Project-1802.zip 0962F56D7EC69F4F2A0162DCBE22116B   Case-34234.zip 795E053A990A1569FFDCB57F48F6D085   RankChallenge-react-6uJSX3-main.zip Domains and IPs oracle-challenge.s3[.]us-east-1.amazonaws[.]com naturalapplication.azurewebsites[.]net retaildemo.azurewebsites[.]net tubitak.azurewebsites[.]net rgbteller.azurewebsites[.]net wslwebui.azurewebsites[.]net plugplay.azurewebsites[.]net crossdwm.azurewebsites[.]net wdisystem.azurewebsites[.]net wslmenus.azurewebsites[.]net dnshnsdev.azurewebsites[.]net hpjumpsrv.azurewebsites[.]net storview.azurewebsites[.]net healthcomfsdpower[.]com visitfinancedentists[.]com kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net greenyjsgfd.azurewebsites[.]net helptellerbls.azurewebsites[.]net timedrv.azurewebsites[.]net userwellgtfs.azurewebsites[.]net hecowime-aqdphyd4bbdef6es.westeurope-01.azurewebsites[.]net msmanagementgrp[.]com msmanagementgrpmedia[.]com lifespotify[.]com gamebarapp.azurewebsites[.]net gamebarappinformation.azurewebsites[.]net sahi-finance[.]com healthful-hub[.]com neumedicahealthcare[.]com optimumhealthcredit[.]com healthfullyrecipes[.]com Refreshhealthandwellness[.]com healthvitalitycare[.]com aceofspadesmanagement[.]com glmediaagency[.]com digimediaskill[.]com healthyweightplan[.]com mens-health-online[.]com

Eclypsium has launched InfraTrust, a new infrastructure cybersecurity knowledge base and monthly InfraTrust Pulse report designed to help organizations prioritize vulnerabilities affecting infrastructure, firmware, networking, and edge devices. The monthly report aggregates security advisories from major infrastructure vendors and highlights the vulnerabilities administrators should prioritize based on a flaw's exploitability, exposure, and real-world risk rather than severity scores alone. The inaugural July 2026 InfraTrust Pulse by Paul Asadoorian, Principal Security Researcher at Eclypsium, tracked 61 infrastructure advisories from 14 vendors, including six critical advisories and 26 remotely exploitable, unauthenticated vulnerabilities. The report also highlights several advisories containing actively exploited vulnerabilities or flaws tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog. Eclypsium also argues that organizations should prioritize vulnerabilities based on exploitability, reachability, and exposure rather than CVSS scores alone. The focus on infrastructure security comes as Russian and Chinese state-sponsored threat actors have increasingly targeted vulnerable network edge devices. In recent years, attackers have repeatedly exploited flaws in routers, VPNs, firewalls, and other internet-facing infrastructure to breach critical infrastructure and telecommunications providers, including in campaigns attributed to state-sponsored hacking groups such as Volt Typhoon and Salt Typhoon. What to patch first The report highlights several advisories that admins should prioritize because they affect internet-exposed infrastructure, are already exploited, or can be compromised remotely without authentication. Below are the infrastructure advisories Eclypsium says administrators should prioritize based on active exploitation, exposure, and the potential impact of a compromise. In SonicWall's case, attackers were exploiting the SMA1000 flaws, tracked as CVE-2026-15409 and CVE-2026-15410, to install custom malware weeks before SonicWall disclosed the flaws and before they were added to CISA's Known Exploited Vulnerabilities (KEV) catalog. The Fortinet FortiSandbox advisories (FG-IR-26-100 / FG-IR-26-141) include two older critical command injection vulnerabilities tracked as CVE-2026-39808 and CVE-2026-25089. While these vulnerabilities were disclosed in April 2026 and June 2026, they were later added to CISA's KEV catalog on July 16, after exploitation was detected. While these advisories were not published in the 30-day reporting period, Eclypsium highlighted them because organizations may not have patched them or known they were exposed to attacks. "These two Fortinet CVEs were in advisories released before our 30-day window opened. Still, we are including them because CISA added both to the Known Exploited Vulnerabilities catalog on July 16, 2026, with a federal remediation deadline of July 19 under BOD 26-04," explains Eclypsium. The Dell advisories (DSA-2026-240 and DSA-2026-317) address critical vulnerabilities in EMC Networking OS10 and SmartFabric Manager. Eclypsium notes that the OS10 advisory alone includes hundreds of upstream fixes, illustrating that network operating systems are full Linux distributions with large attack surfaces. The F5 BIG-IP advisory (K000153397) addresses critical unauthenticated vulnerabilities affecting internet-exposed application delivery controllers (ADCs) and load balancers. Eclypsium highlights these devices because they frequently sit at the edge of enterprise networks, making them attractive targets for attackers. The Juniper Networks advisory (JSA110083 and JSA110086) addresses remotely exploitable flaws in Junos OS that can crash affected routers and switches, potentially disrupting network availability. The NVIDIA advisory (NVIDIA Security Bulletin 5865) addresses vulnerabilities in BlueField DPUs and ConnectX SmartNICs used in AI and data-center infrastructure. Eclypsium also noted firmware and hardware vulnerabilities, warning that updates for these components commonly lag behind upstream security fixes because they depend on hardware vendors to integrate and distribute them. As an example, HP's Poly Video advisory shipped four months after an included Qualcomm GPU driver vulnerability (CVE-2026-21385) had already been exploited in attacks and added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Unlike many vulnerability roundups that count individual CVEs, InfraTrust tracks vendor advisories because a single infrastructure advisory can contain dozens or even hundreds of vulnerabilities. While the July report contains six critical advisories, it also identifies 26 vulnerabilities that can be exploited remotely without authentication, noting that an internet-reachable flaw with a lower CVSS score may present a greater risk to organizations than a higher-scoring vulnerability that requires an attacker to have local administrator access. July 2026 infrastructure reference Below is a complete list of the 61 infrastructure advisories tracked by Eclypsium in its inaugural July 2026 InfraTrust Pulse report. The table includes the affected vendor and product, advisory identifier, severity, whether the advisory contains an actively exploited vulnerability, and a brief explanation of why it matters. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Juniper heeft meerdere kwetsbaarheden verholpen in Junos OS en Junos OS Evolved, specifiek voor MX Series, PTX Series, QFX Series, EX Series, SRX Series en QFX10000 Series apparaten. De kwetsbaarheden betreffen verschillende componenten binnen Junos OS en Junos OS Evolved, waaronder de packet forwarding engine, routing protocol daemon, management daemon, SNMP daemon, http-gatekeeper, TCP proxy plugin, IKE daemon, fileio library, SIP plugin, URL filtering plugin en CLI. Exploitatie kan leiden tot geheugenbeschadiging, crashes van processen zoals mgd, rpd, flow processing daemon, l2ald, en FPC, wat resulteert in Denial-of-Service (DoS) condities. Sommige kwetsbaarheden kunnen door lokale gebruikers met beperkte rechten worden misbruikt om code uit te voeren of processen te laten crashen. Andere kwetsbaarheden kunnen door niet-geauthenticeerde aanvallers via netwerkverkeer worden misbruikt om processen te laten crashen, informatie te lekken, licentie-uitputting te veroorzaken of firewallregels te omzeilen. Specifieke hardwaremodellen en softwareversies zijn getroffen, zoals MX Series met SPC3, SRX Series, EX Series (EX2300, EX4000, EX4100, EX4400), QFX Series, PTX Series en QFX10000 Series. Sommige kwetsbaarheden vereisen handmatige herstart van systemen of processen om normale werking te herstellen. De problemen zijn aanwezig in versies voorafgaand aan de gepubliceerde patches en updates.

Juniper Networks: risolte vulnerabilità in Junos OS e Junos OS Evolved Alert AL07/260709/CSIRT-ITA Sintesi Juniper Networks ha rilasciato aggiornamenti per risolvere diverse vulnerabilità con gravità “alta”, nei sistemi operativi Junos OS e Junos OS Evolved. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di compromettere la disponibilità del servizio o di alterare configurazioni sui sistemi interessati. Tipologia Denial of Service Tampering Prodotti e/o versioni affette Junos OS Junos OS Evolved N.B. Per maggiori dettagli riguardanti le versioni dei software interessate dalle vulnerabilità, si rimanda ai bollettini di sicurezza del vendor disponibili nella sezione Riferimenti. Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “alta”: https://supportportal.juniper.net/s/global-search/%40uri#sortCriteria=date%20descending&f-sf_primarysourcename=Knowledge&f-sf_articletype=Security%20Advisories&numberOfResults=50 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-with-SPC3-SRX-Series-Processing-of-a-specifically-malformed-SIP-invite-causes-a-flowd-crash-CVE-2026-57026 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-with-SPC3-SRX-Series-A-specifically-malformed-TCP-packet-causes-a-flowd-crash-CVE-2026-57023 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specific-SNMPv3-request-results-in-memory-leak-and-eventual-snmpd-crash-CVE-2026-33799 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-SRX-Series-Flow-sessions-are-not-getting-cleared-leading-to-a-DoS-CVE-2026-57030 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-Evolved-PTX-Series-Receipt-of-repeated-ECMP-routing-updates-results-in-PFE-crash-CVE-2026-33794 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-with-SPC3-SRX-Series-Specific-packet-in-response-to-a-TCP-connection-establishment-by-the-affected-device-can-crash-the-PFE-CVE-2026-57022 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-Evolved-A-port-which-has-been-inadvertently-exposed-can-be-reached-by-an-attacker-CVE-2026-57028 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-EX-Series-Subscribing-to-an-unsupported-telemetry-sensor-path-causes-fxpc-process-crash-CVE-2026-57032 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-In-a-VC-scenario-a-high-rate-of-micro-BFD-session-flaps-will-cause-an-FPC-crash-CVE-2026-33800 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-Specific-traffic-causes-an-FPC-to-reset-CVE-2026-57019 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-EX4100-Series-EX4400-With-sFlow-configured-in-a-VC-scenario-multicast-traffic-leads-to-an-FPC-crash-CVE-2026-57027 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-QFX10000-Series-IPv6-multicast-traffic-received-on-non-IRB-interfaces-causes-a-multicast-flood-CVE-2026-57020 https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-a-specifically-malformed-BGP-route-update-is-received-RPD-crashes-CVE-2026-33801

Cisco has released fixes for a critical-severity command execution vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Tracked as CVE-2026-20181 (CVSS score of 9.1), the issue exists because user-supplied input is improperly validated, allowing an attacker to send a crafted HTTP request and obtain user-level access to the underlying operating system. The attacker could then elevate their privileges to root. “A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials,” Cisco explains. In single-node deployments, an attacker could exploit the flaw to cause a denial-of-service (DoS) condition, preventing endpoints that have not already authenticated from accessing the network until the node is restored. The bug was addressed with the release of ISE and ISE-PIC versions 3.3 Patch 11 and 3.4 Patch 6. A hotfix for ISE version 3.5 is also available and will be included in version 3.5 Patch 4 in August. The updates also address a high-severity information disclosure defect, tracked as CVE-2026-20190, which could allow unauthenticated attackers to access sensitive data, such as hashed credentials. On Wednesday, Cisco also released fixes for medium-severity vulnerabilities in the Webex App, the Umbrella Virtual Appliance, and the Crosswork Network Controller that could lead to malicious redirects, privilege escalation, and arbitrary command execution. The company says it is not aware of any of these security flaws being exploited in the wild. Additional information can be found on Cisco’s security advisories page. Related: Joomla, LiteSpeed Vulnerabilities Exploited in Attacks Related: Tech Coalition ‘Athena’ Targets OSS Vulnerabilities Ahead of Disclosure Related: Juniper Networks PTX Routers Affected by Critical Vulnerability Related: Imunify360 Vulnerability Could Expose Millions of Sites to Hacking

�����T���E�F�A�̋��Ђ��������A�P���ɋ@��݂����Ńl�b�g���[�N���g�[��������^�p�͌��E���}���Ă���B�Z�L�����e�B���������l�b�g���[�N�̊Ǘ����ׂ�}����ɂ͉���I�Ԃׂ����B �@�T�C�o�[���Ђ͍I�����Ƒ�K�͉����i��ł���B�x�@���T�C�o�[�x�@�ǂ́u�ߘa7�N�ɂ�����T�C�o�[��Ԃ��߂��鋺�Ђ̏���ɂ��āv�ɂ��ƁA�����T���E�F�A�i�g����v���^�}���E�F�A�j�̔�Q������226���ɏ��A�ˑR�Ƃ��č������𐄈ڂ���B�����ɑ��z1000���~�ȏ��v�����g�D�̊����͑S�̂�5�����Ă���A�����܂ł�1�J���ȏ��v�����g�D�������߂�ȂǁA�o�ϓI������Ɩ��ւ̉e���͐r�傾�B �@���E�^�Z�L�����e�B����[�����钆�A�e�����[�N��N���E�h���p���Z��������{�I�ȃl�b�g���[�N��Ղ��g���������邾���ł́A�ǂ̂悤�ȃ{�g���l�b�N�ɒ��ʂ���̂��B���{�q���[���b�g�E�p�b�J�[�h�̍╔�_�����iHPE Networking���Ɠ����{�� �Z�p�{�� �e�N�m���W�[�R���T���e�B���O�� �v���Z�[���X �R���T���^���g�j�ɁA�����IT�S���҂����ʂ���ۑ�̖{�������B �@���_�̕��U��]�ƈ��̑����ɔ����Z�L�����e�B�f�o�C�X�̑����Ɛڑ��p�^�[���̕��G���́AOS�X�V��p�b��K�p�Ƃ����������e�i���X���ׂ傳����B�]�ƈ�����ʐM�̈��萫�Ɖ��K�������҂�������A�Ǘ���Ƃɂ̓l�b�g���[�N��~���K�v�Ƃ����W�����}������B����ɁA���_�p�t�@�C�A�E�H�[���ƃ����[�g�A�N�Z�X�pVPN��ʌɓ������Ă������ʁA�Ǘ���ʂ�Z�L�����e�B�|���V�[���������Č����ቺ�������Ă���B�����āA�n�C�u���b�h���[�N��N���E�h���p�̊g��ɂ��A�]���̃Q�[�g�E�F�C�^VPN�̂܂܂ł͉^�p�p��������Ȃ����A���_��ڑ��v���̑���ɔ�Ⴕ�ĊǗ����S���}�����Ă���B���ꂪ�Z�L�����e�B�C���V�f���g��U������w�i�ɂȂ��Ă���B �@HPE�͂��������ۑ�ɁA�l�b�g���[�N�ƃZ�L�����e�B����̂Ƃ��đ�����u�C���e�O�����Z�L�����e�B�v�̐��i�Q��W�J����BSASE�iSecure Access Service Edge�j�AZTNA�i�[���g���X�g�l�b�g���[�N�A�N�Z�X�j�A�e���_�̃t�@�C�A�E�H�[���Q�����f�I�ɐ��䂷��A�[�L�e�N������B�u�Г��ɓƗ������F�؊�ՁiIDP�j��������Ă��Ȃ���Ƃł��X���[���X�^�[�g�ł����y��������A�^�p�Ǘ��̑��l���╉�S��}���āA��т����Z�L�����e�B�|���V�[��i�K�I�ɓK�p�\�ɂ��鋤�ʊ�ՂɂȂ邱�Ƃ�ڎw���Ă��܂��v�ƍ╔���͐�������B �@���_�p�t�@�C�A�E�H�[���ɂ́A�l�b�g���[�N�@��Ƃ��Ă̒ʐM���x�����łȂ��A�Z�L�����e�B��������s�ł���C���t���Ƃ��Ă̈��萫�����߂���B�uHPE Juniper SRX400�V���[�Y�v�́A������t�@�C�A�E�H�[�����͂��ߕ����̃Z�L�����e�B�@�\�������UTM�i�������ЊǗ��j���i���B�u���V���[�Y�́A�l�b�g���[�N�@��x���_�[�Ƃ��Ĕ|�����������[�e�B���O�Z�p�ƃX�C�b����O�Z�p�ɉ������x�ȃZ�L�����e�B�@�\�����ڂ��A�S�Ă�L����������Ԃł����Ă��A�ʐM�p�t�H�[�}���X���ێ����ĉ^�p���\�ł��v�ƍ╔���͐�������B �@���V���[�Y�́A�R���p�N�g���ƐÏl���A�����M�����������B�����d�͂Ȃ��獂�X���[�v�b�g������v�́A�ݒu�E��p�R�X�g��J�[�{���t�b�g�v�����g�̍팸�Ɋ�^����B4��܂ō\���ł��鎟����璷���@�\�u�}����m�[�hHA�v�́AIP�̓��B��������Ή��u�̕ʋ��_�Ԃł��\���\���BTPM 2.0��Z�L���A�u�[�g�ɂ��SRX���̂̈��S��������ɍ��߁AL2���C���[�̒ʐM���Í�������uMACsec�v�ɂ��X�C�b��@��ȂǂƂ�L2�ʐM�ɂ����Ă����R�����\���B��O�Ғ����@��CyberRatings�̕]���ł́A2025�N�G���^�[�v���C�Y�t�@�C�A�E�H�[������ɂ����āA���x�ȉ���^�}���E�F�A���܂ޕ����̍U���e�X�g���N���A���A�e�X�g�ɎQ������7�В�3�Ђɂ����^����ꂽ�������i�̔F����Ă���B �@���_�p�t�@�C�A�E�H�[���ɋ��߂���@�\�Ƃ��āA�╔���́u���[�J���u���[�N�A�E�g�v�u���Ђ̍������m�v�u�ϗʎq�v�Z�@�Í��iPQC�j�ւ̑Ή��v��3�_��������B �@���[�J���u���[�N�A�E�g�́A�����̃N���E�h�T�[�r�X�𗘗p�����ƂŁA���_�l�b�g���[�N�̑ш�s����ш捬�G��h����v�ȃA�v���[����B�]���A�v���L�V�T�[�o�����݂���l�b�g���[�N�ł̓N���C�A���g�[���̐ݒ�ύX���K�v�ɂȂ蓱��������Ƃ���Ă������ASRX��Secure Web Proxy�@�\�ɂ��A�N���C�A���g�[���̐ݒ��ς��邱�ƂȂ����[�J���u���[�N�A�E�g�������ł���悤�ɂȂ��Ă���B �@���Ђ̌��m�ł́AAI��SRX��ɑg�ݍ��ނ��ƂŁA�V�O�l����Ɉˑ��������m�̃}���E�F�A�������Ɍ��m����B�O���̃N���E�h���փf�[�^�𑗐M���ĉ�͂�҂]���̎�@�ł̓^�C�����O�̔������ۑ肾�������AJuniper SRX 400�V���[�Y��������uEclipse Engine�v�@�\�͖��m�̃}���E�F�A���SRX�̓����Ŋ���������B�܂��uEclipse Engine�v�̓I�t���C���ł��_�E�����[�h���\�Ȃ��߁A����ł������\�Ȏd�l�ɂȂ��Ă���B �@PQC�́A�ʎq�R���s���[�^�̔��W�ɂ���ď]���̈Í�������ǂ���郊�X�N�ɑR���邽�߂̎�����Í��Z�p���B�Í��Z�p�͒���I�ȍ��V���K�v�ł���A�č����W���Z�p�������iNIST�j���i�߂�W������A2035�N��ڕW�Ƃ����ڍs�̃��[�h�}�b�v�������O�ō��肳��Ă���B�����I�ȃC���t�����V���������A���������ŐV�̈Í��K�i�ւ̒ǐ����\�Ȑ��i�̑I��́A���_�l�b�g���[�N�̒�������^�p�ɂ����ďd�v�ȈӖ������B �@��Ƃ̍U���Ώۗ̈�i�A�^�b�N�T�[�t�F�X�j�Ɖ����Ă��郊���[�g�A�N�Z�X���̍��V���}�����B�����[�g�A�N�Z�XVPN�͊O������̐ڑ������C���^�[�l�b�g�Ɍ��J����A�[�L�e�N����̂��߁A���̐Ǝ�i�������Ⴍ�j�����U���̕W�I�ƂȂ�BHPE�͂��̉ۑ��ZTNA��K�p����B �@�uHPE Aruba Networking SSE�v�́A�Г��ɐݒu����u�R�l�N�^�v����A�C���^�[�l�b�g�ɂ���PoP�iPoint of Presence�j�Ɍ����ē�����O�ւ̃A�E�g�o�E���h�ʐM�݂̂ŃZ�b�V�������m������B�O������̃C���o�E���h�ڑ�����؎t���Ȃ����߁A�A�^�b�N�T�[�t�F�X��r���ł���B�Г����[�U�[���Г����\�[�X�փA�N�Z�X����ہA�ʐM���N���E�h�ɉI��i�������j�������ɒ��ڒʐM������uPrivate Edge�v�@�\�������̈���B�g���t�B�b�N��PoP���o�R���ĎГ��ɖ߂�w�A�s�����ۂ�h���ŁA�l�b�g���[�N���\�[�X�̘Q���}����B �@�����i��20���[�U�[���瓱���\�ŁA�����E������Ƃ̃X���[���X�^�[�g�ɂ��K���Ă���B�ŏ��\������i�K�I�Ɋg���ł��邽�߁A�]���̑�K�͑O���SSE�iSecurity Service Edge�j�Ɣ�r���ē����n�[�h�����Ⴂ�_���������B��ʂ�SSE�̓����͊O��IDP�̘A�g��O��Ƃ��邪�A�����i�́u����IDP�v�𓋍ڂ��邽�߁A�F�؊�Ղ��������ł��P�̂Ń��[�U�[�F�ƃA�N�Z�X������J�n�ł���BWeb�u���E�U�o�R�Őڑ�����G�[�W�F���g���X�̃C���^�t�F�[�X������A�Ɩ��ϑ����T�v���C���[�̃A�N�Z�X��i�Ƃ��Ă��L�p���B�u�ڑ����̒n���f�o�C�X��OS�o�[�W�����Ƃ������R���e�L�X�g�i�����j�����ʂ��āA�A�N�Z�X�̉ۂ����߂�|���V�[���ꊇ�K�p�ł��܂��v�ƍ╔���͐�������B �@�����̋@�\�́g�����̉ԁh�ł͂Ȃ��A���͂��̓͂��Ƃ���ɂ���B�Z�L�����e�B���i�̉^�p���ׂ͊�ƋK�͂��킸���ʂ̉ۑ肾�BHPE Juniper SRX400�V���[�Y��HPE Aruba Networking SSE�́AAI�l�C�e�B�u�ȊǗ���Ղł���uHPE Juniper Networking Mist�v��g�ݍ��킹�邱�ƂŁA�^�p�Ǘ����ȗ͉��ł���B �@�uHPE Juniper Networking Mist�̓l�b�g���[�N�̎����Ď������łȂ��A�G���h���[�U�[�̉��K�����ʓI�ɕ��͂��܂��B�g���u����������AI�A�V�X�^���g�Ƃ̃���b�g����̑Θb�Ō����Ɖ��������肵�āA��c���ł��܂��v�ƍ╔���͐�������B�e�R���|�[�l���g�ɑg�ݍ��܂ꂽAI�G���W���������Ŏx������d�g�݂́A���m���Ɉˑ������ɍ��x�ȉ^�p���\�ɂ��āA�Ǘ��H�����팸����B �@�u�l�b�g���[�N�ƃZ�L�����e�B����̂Ƃ��đ����āA�G�b�W����N���E�h�܂ʼn��f�Ǘ����鎋�_���A�����̃C���t���헪�ŏd�v�ł��BHPE�̐��i�Q�́A���Ђ̉ۑ��\�Z�ɍ��킹���i�K�I�ȃA�v���[�`�œ�����i�߂��܂��v�ƍ╔���͌��BHPE�̓C���e�O�����Z�L�����e�B���\�����鐻�i��ʂ��āA���[�U�[��Ƃ̃l�b�g���[�N��Ղ̈��S�������コ������g�݂��x������B ���{�A���P�[�g�͏I�����܂������@��Amazon�M�t�g�J�[�h��������I�A���P�[�g���{�� �{�L���Ɋ֘A���āu�l�b�g���[�N�^�Z�L�����e�B���i�̓����v�ɂ��ẴA���P�[�g�����{���Ă��܂��B���ꂽ���̒����璊�I��10���l�ɁAAmazon�M�t�g�J�[�h�iE���[���^�C�v�j3000�~�����v���[���g�������܂��B���I�҂ɂ́A�A�C�e�B���f�B�AID�ɂ��o�^�̃��[���A�h���X���ɃM�t�g�������肵�܂��B���I�Ҕ��\�̓M�t�g�̑��t�������Ă��A���Ƃ����Ă��������܂��B���Љ��L�A���P�[�g�t�H�[����育���������B ���O�C�� �܂��� ����o�^�i�����j���������ƃA���P�[�g�t�H�[�����\������܂��B�I�����W�F�́u�A���P�[�g�ɉ���v�{�^������A���P�[�g�����肢�������܂��B Copyright © ITmedia, Inc. All Rights Reserved. �FSB C&S������ЁA���{�q���[���b�g�E�p�b�J�[�h������� �A�C�e�B���f�B�A�c�Ɗ��^����F��IT �ҏW���^�f�ړ��e�L�������F2026�N6��29��

�����T���E�F�A��Q�͐[�������A������h�䂾���ł̓V�X�e��������Ȃ��B�ŊJ��́u�b�P�ʂ̕����v�ƃl�b�g���[�N�����A�������A�N����̔�Q���ŏ�������V���ȑ��w�h��̃A�v���[����B�m���ȕ����Ǝ��ƌp���𗼗��������@���A���Ƃƍl����B �@�����̊�Ƃ��Z�L�����e�B����������Ă���ɂ�������炸�A�Ȃ������T���E�F�A�i�g����v���^�}���E�F�A�j�U���ɂ���Q�͌��₽�Ȃ��̂��B�]���̓�����h�䂾���ł͖h����Ȃ�������ǂ��Ŕj���ׂ����BSB C&S�́g�Z�L�����e�B�\�����G�h�ł��鉓���@�����A�����ē��{�q���[���b�g�E�p�b�J�[�h�̚��������ƐX�c������A�X�g���[�W�A�o�b�N�A�b�v�A�l�b�g���[�N�Ƃ��������p�I�Ȋϓ_����c�_�����B�N����O��Ƃ����u���������v�����ɁA��Q���ŏ����ɗ}���Ď��ƌp���������߂�A�v���[���T��B ���ȉ��A�h�̗� �\�\�����̃T�C�o�[�U���̌X����A���[�U�[��Ƃ����ʂ��Ă���ۑ�ɂ��Đ��ƂƂ��Ăǂ̂悤�ɍl���܂����B �����@�����T���E�F�A�U�����������Ȃ��v���́A�U�����ɂƂ��ăR�X�g�p�t�H�[�}���X���ǂ����炾�ƍl�����܂��B��̌��́A�����ɍU���҂̎�Ԃ𑝂₵�ăR�X�p�����������邩�Ƃ������_�ł��B �X�c�@�T�C�o�[�ƍ߂͂��łɁu�r�W�l�X���v���Ă��܂��B�uRansomware as a Service�v�iRaaS�j�̕��y�Ŏ��s�̃n�[�h�����������āA�T�v���C��F�[����_���U���������Ă��܂��B�h�䑤�ɂ͌������������Ă��܂��B �@��̗v�Ƃ��ăo�b�N�A�b�v�͕s���ł��B��Q��O��Ƃ�����ŁA�m���Ƀf�[�^��ی삷��d�g�݂ƁA�l�b�g���[�N�̉�����g�ݍ��킹��A�����I�ȑ��߂��Ă��܂��B �����@�����̊�Ƃ��o�b�N�A�b�v�V�X�e�������Ă��܂����A�o�b�N�A�b�v���擾���������ň��S���Ă��܂��A�u����ɕ����ł��邩�v���\���Ɍ����Ă���Ƃ���͑����Ȃ���ۂł��B�L���̍ۂɐ����P�ʂ̃_�E���^�C���������邱�Ƃ́A���ƌp���ɂ����ďd��ȃ��X�N�ƌ����܂��B �\�\�����T���E�F�A��Q���ɁA�g������x���킸�Ɏ��Ƃ��p������ɂ́A�ǂ̂悤�ȕ����̐���z���ׂ��ł��傤���H �����@�g������x���킸�ɃV�X�e���𐳏퉻����ɂ́A�m���ȃo�b�N�A�b�v�ƁA����𐳂����߂�����̊m�ۂ��O��ł��B �X�c�@�o�b�N�A�b�v�f�[�^�̒I�������d�v�ł��B�u�ŗD��Ŏ��ׂ�IT���Y�͂ǂꂩ�v�����ɂ߂��ɑS�Ẵf�[�^��ی삷��̂͌����I�ł͂���܂���B���Y�̏d�v�x�����ėD�揇�ʂ�t���邱�Ƃ��A�����I�ȃf�[�^�ی�̑����ł��B �����@3�̃f�[�^�R�s�[���A2��ނ̈قȂ�X�g���[�W�}�̂ŁA1�J���͖{�ԋ��_�ƈقȂ鉓�u�n�ɕۊǂ���B���́u3-2-1���[���v���o�b�N�A�b�v�̊�{�ł��ˁB���݂͂���Ɂu�C�~���[�^�u���X�g���[�W�ɕۊǁB�܂��̓G�A�M���b�v�i�l�b�g���[�N����̕����I�Ȋu���j�����̃X�g���[�W�ɕۊǁv�Ɓu�������̃G���[�[�����m�ہv���������u3-2-1-1-0���[���v������Ă��܂��B��������͂ō\�z���ĉ^�p���镉�S���l����A���؍ς݂̐��i��T�[�r�X��L�����p����̂��������ł��傤�B �����@�p���I�f�[�^�ی�iCDP�j���i�́uHPE Zerto Software�v�́A5�10�b�̔��ɍׂ����P�ʂŕ����|�C���g��ێ����܂��B�ُ팟�m�̃^�C�~���O����������A�����O�␔���ԑO�Ƃ����P�ʂł͂Ȃ��A�u��Q�ɑ������b�O�v�̏�ԂɃs���|�C���g�ŕ����\�ł��B �@�f�[�^�ی�X�g���[�W�uHPE StoreOnce Systems�v�́A�C�~���[�^�u���o�b�N�A�b�v��WORM�iWrite Once Read Many�j�̋@�\������Ă��܂��B�����āA�Ǝ��v���g�R���uHPE StoreOnce Catalyst�v�ɂ���ăl�b�g���[�N����_���I�Ɋu�����ꂽ���i�_���G�A�M���b�v�j���\�z���āA�t�@�C���V�X�e���w�ւ̒��ڍU����������ăf�[�^�����܂��B �����@���̓x���_�[�t���b�g�ɐ��i���r���Ă��q���܂ɍœK�Ȑ��i���Ă��闧��ɂ���܂��B���̎��_���炠���Ďf���܂����A�u���b�O�ɖ߂��v�Ƃ����@�\����������A���А��i�ł������ł��܂���ˁH �����@�̗v�Ȃ̂̓f�[�^���X���ŏ�������g�^��CDP�h���A�[�L�e�N������x���Ŏ����������邩�ǂ����A���ƍl���Ă��܂��B��ʓI�ȃo�b�N�A�b�v���i�͐����Ԃ����́u�X�i�b�v�V���b�g�v���x�[�X�ɂ��邽�߁A�������͑����̃f�[�^���X�������܂��BHPE Zerto Software�̓u���b�N���x���Ńf�[�^���펞�������邽�߁A���b�P�ʂ̕����|�C���g�̍쐬�ƕb���P�ʂł̕������\�Ȃ̂ł��B �@������HPE StoreOnce Systems�ɂ́A�s�ϐ��i�C�~���[�^�u���j��WORM�@�\���������邱�ƂŁA�Г��̐l�Ԃɂ��s���ȃf�[�^�������������f�[�^��ی�ł���_�����݂ł��B�č������W���Z�p�������̃f�[�^�j���W���uSP 800-88 Rev.2�v�ɂ��������Ă��܂��B �X�c�@����̒S���҂�CISO�i�ō����Z�L�����e�B�ӔC�ҁj���L������F�߂Ă��A�o�c�w�̏��F�ő����݂���Ƃ����b�͂悭�����܂��B�Z�L�����e�B��ւ̓�������������ۂ́A�u���Ƃ�1����~�����ꍇ�̑��Q�z�v����̓I�Ɏ��Z���ׂ��ł��B���ݓI�ȃ��X�N�Ƒ���p���r���邱�ƂŁA�����̑Ó��������m�ɂȂ�܂��B �����@�C���V�f���g�������ɂ́A�V�X�e��������p�ɂƂǂ܂炸�A�ٌ�m��p�A�L��Ή���p�A���i�̏o�ג�~�ɔ����ɂւ̉e���ȂǁA�r��ȃR�X�g���������܂��B��Q���ǂ�قǂ̉e���͈͂ɋy�Ԃ̂��A�����Ɍ����Ăǂꂾ���̐l�������̂����v�Z����A�u�����𑁂߁A�������ŏ������邽�߂̔����v�ւ̓����͌����č����Ȃ��Ƃ������肢��������͂��ł��B �\�\�l�b�g���[�N�̈�ɂ�����AHPE�̃Z�L�����e�B�헪�ɂ��Ă��f���܂����B �X�c�@�]���̓��[�U�[��Ƃ̑g�D�\���Ƃ��āA�l�b�g���[�N�S���ƃZ�L�����e�B�S���̕�����������Ă��邱�Ƃ���ʓI�ł������A�ُ팟�m���̑Ή��Ɏ��Ԃ�v����ۑ肪����܂����B�������Ȃ���A�l�b�g���[�N�ƃZ�L�����e�B�̕������ꌳ�Ǘ������߂�P�[�X�͏��X�ɑ����Ă��܂��B���Ђ����N���Ă��铝���Ǘ���Ղɂ��A�v���ȃC���V�f���g�Ή����\�ɂȂ�܂��B �����@HPE��2023�N��Axis Security�����āA����N���E�h�Z�L�����e�B�̈�̐��i���C���A�b�v���[�������Ă��܂��ˁB�����Ɗ����̃l�b�g���[�N���i�Ƃ̘A�g�́A�ǂ̂悤�ɐi�����Ă��܂����B �X�c�@�Ǐ��I�ȃZ�L�����e�B�ł͂Ȃ��A�l�b�g���[�N�S�̂�ʂƑ������Z�L�����e�B��i�߂Ă��܂��BHPE���i���̘A�g�͂������̂��ƁA���А��i�Ƃ̘A�g���d�v�����Ă���A�Ⴆ�Α���SASE���i�Ƃ�VPN�̈Í����v���g�R���uIPsec�v�ŃZ�L���A�ɐڑ��\�ł��B �@�l�b�g���[�N�ƃZ�L�����e�B�̉^�p�Ǘ��c�[���ɂ́uHPE Juniper Networking Mist�v��uHPE Aruba Networking Central�v������AAI�@�\�̋����ɓw�߂Ă��܂��B���[�U�[�̊����d�����āA�Z�L�����e�B���x�����������S�ʼn��K�ȃl�b�g���[�N���̒�i�߂Ă��܂��B �����@�o�b�N�A�b�v�ƃZ�L�����e�B���i�̘A�g�ɂ��Ă͂������ł��傤���B �����@HPE Zerto Software�́ACrowdStrike�̓���EDR���i��AHPE Aruba Networking Central��IDS�^IPS�i�s���N�����m�^�h�~�j�����m�����u�s�R�ȋ����̃^�C���X�^���v�v��API�o�R�Ŏ�荞�߂܂��B����ɂ��A�U�����{�i�����钼�O�̃N���[���ȏ�Ԃ���肵�ăX���[�Y�ɕ����ł��܂��B���l�̋@�\�A�g��HPE Networking�u�����h���ŏ����g�傷��\��ł��B�b�P�ʂ̕����|�C���g������HPE Zerto Software�ƁA���x�Ȍ��m�A���[�g��g�ݍ��킹�邱�ƂŁA���m���Ȏ��ƌp���̐��Ɋ�^���܂��B �X�c�@�����ɂ����Ă�����d�v�Ȃ̂́A�f�[�^��߂����u�Ԃɓ����Ǝ�i�������Ⴍ�j����˂���Ȃ��悤�ɂ��邽�߂ɁA�U���������������邱�Ƃł��BJuniper SRX�V���[�Y�͖��m�Ȃ鋺�Ђɑ��ăC�����C���ō����ɖh��ł���AI/ML���f���𓋍ڂ��A�U����������A���q���܂̊��ɍ��킹���J�X�^���V�O�l������Ɏ����쐬����@�\������܂��B �����@�}���E�F�A���������f�[�^��A�Í������ꂽ�f�[�^���܂߂���ԂŃV�X�e�������Ă��܂����Ƃ������Ȃ�������܂���ˁBHPE Zerto Software�ɂ͕��������������z�}�V�������S�Ȋu�����ŗ����グ�A���g�����O�Ɋm�F�ł���@�\������܂��B�b�P�ʂŕ����|�C���g��I�ׂ鋭�݂����āA�m���ɃN���[���ȏ�Ԃ��ǂ������m�F���Ă��畜�����邱�Ƃ͏d�v�ł��B �\�\���Ԃł́u�Z�L�����e�B��Ƃ�����EDR�v�Ƃ�������������܂����A���Ƃ̎��_�ł͂������ł��傤���B �X�c�@�G���h�|�C���g�Z�L�����e�B�͂������d�v�ł����A�ߔN�͍U���҂�EDR���̂̃v���Z�X���������Č��m���������܂�����A�l�b�g���[�N�w�ł̌��m�E�Ւf�Ƃ̑g�ݍ��킹�͕s���ł��BJuniper SRX�V���[�Y�́A�]����IPS�A�A���`�E�C���X�AURL�t�B���^�����O�A�T���h�{�b�N�X�A���ЃC���e���W�F���X�ɉ����āAAI/ML���f���̎����㌟�m�G���W���̋@�\����g���āA���Ђ������ɓ��B����O�Ɏ����I�ɎՒf���܂��B �����@���͏��Z�L�����e�B�Ɋւ��鍑�ۋK�iISO27001�̓����č����Ƃ��Ă��������Ă��܂��B���̌o������\���グ��ƁA�Z�L�����e�B��̓c�[�������ďI���ł͂���܂���B���X�N�A�Z�X�����g��ʂ���IT���Y�ɗD�揇�ʂ�t���A�d�v�x�ɉ������K���ȗ\�Z��z������Ƃ����헪�I�Ȏ��_�����߂��܂��B �����@�Ǝ��ƑԂɂ���Ă��A���ׂ����Y�⋖�e�ł���_�E���^�C���͈قȂ�܂��B���ƌp�����ŗD��ɍl�����Ƃ��AHPE���i�Q�̑��w�I�ȑg�ݍ��킹�́A�����I�ŋ��͂ȑI�����ɂȂ�ł��傤�B������SB C&S�̓f�B�X�g���r���[�^�[�Ƃ��āA���q���܂��ƂɈقȂ�œK�������Ɍ����o���A�����x���������܂��B Copyright © ITmedia, Inc. All Rights Reserved. �FSB C&S������ЁA���{�q���[���b�g�E�p�b�J�[�h������� �A�C�e�B���f�B�A�c�Ɗ��^����F��IT �ҏW���^�f�ړ��e�L�������F2026�N6��22��

Ivanti, Fortinet, n8n, SAP, and VMware have released security fixes for various vulnerabilities that could be exploited by bad actors to bypass authentication and execute arbitrary code. Topping the list is a critical flaw impacting Ivanti Xtraction (CVE-2026-8043, CVSS score: 9.6) that could be exploited to achieve information disclosure or client-side attacks. "External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks," Ivanti said in an advisory. Fortinet published advisories for two critical shortcomings affecting FortiAuthenticator and FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS that could result in code execution - CVE-2026-44277 (CVSS score: 9.1) - An improper access control vulnerability in FortiAuthenticator that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. (Fixed in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3) CVE-2026-26083 (CVSS score: 9.1) - A missing authorization vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI that may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. (Fixed in FortiSandbox versions 4.4.9 and 5.0.2, FortiSandbox Cloud version 5.0.6, and FortiSandbox PaaS versions 4.4.9. and 5.0.2) SAP also shipped fixes for two critical vulnerabilities - CVE-2026-34260 (CVSS score: 9.6) - An SQL injection vulnerability in SAP S/4HANA CVE-2026-34263 (CVSS score: 9.6) - A missing authentication check in the SAP Commerce cloud configuration "The vulnerability is caused by an overly permissive security configuration with improper rule ordering, allowing an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution," Onapsis said about CVE-2026-34263. On the other hand, CVE-2026-34260 could be exploited by an attacker to inject malicious SQL statements and potentially impact the confidentiality and availability of the application. However, since the affected code only allows read access to data, the vulnerability does not compromise the integrity of the application. "It allows a low-privileged, authenticated attacker to inject malicious SQL code via user-controlled input, potentially exposing sensitive database information and crashing the application," Pathlock said. Patches have also been released by Broadcom for a high-severity flaw in VMware Fusion (CVE-2026-41702, CVSS score: 7.8) that could pave the way for local privilege escalation. The issue has been addressed in version 26H1. "VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary," Broadcom said. "A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed." Round off the list is a set of five critical vulnerabilities impacting n8n - CVE-2026-42231 (CVSS score: 9.4) - A vulnerability in the xml2js library used to parse XML request bodies in n8n's webhook handler that allows prototype pollution via a crafted XML payload, enabling an authenticated user with permission to create or modify workflows to achieve remote code execution on the n8n host. (Fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1) CVE-2026-42232 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node, leading to remote code execution when combined with other nodes exploiting the prototype pollution. (Fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1) CVE-2026-44791 (CVSS score: 9.4) - A bypass for CVE-2026-42232 that could result in remote code execution on the n8n host. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) CVE-2026-44789 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node, leading to remote code execution on the n8n host. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) CVE-2026-44790 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation, enabling an attacker to read arbitrary files from the n8n server and resulting in full compromise. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) Software Patches from Other Vendors Security updates have also been released by other vendors over the past several weeks to rectify various vulnerabilities, including - ABB Adobe Amazon Web Services AMD Apple ASUS Atlassian Axis Communications AVEVA Canon Cisco CODESYS ConnectWise Dell Devolutions Drupal F5 Fortra Foxit Software Fujitsu GitLab GnuTLS Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision Hitachi Energy Honeywell HP HP Enterprise (including Aruba Networking and Juniper Networks) Huawei IBM Intel Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Meta WhatsApp Microsoft Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA OPPO Palo Alto Networks Phoenix Contact Phoenix Technologies Progress Software QNAP Qualcomm React Ricoh Samsung Schneider Electric Siemens Sophos Spring Framework Supermicro Synology Tenable TP-Link WatchGuard Zoom, and Zyxel

Introduction The SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 is one of the most-observed Outlaw / Shellbot artifacts on the public internet. VirusTotal first ingested it on 5 July 2018 [2]. It is the SHA-256 of the authorized_keys file written by the campaign whose persistence comment string is mdrfckr, a campaign documented in handler diaries, vendor reports, and independent honeypot research for nearly seven years. This diary does not announce a new campaign. The file hash, the public key, the mdrfckr comment string, the chattr -ia .ssh defensive disarm, the chpasswd account hijack, and the /tmp/secure.sh competitor cleanup are all well-described in prior reporting [3][4][5][6][7]. What this diary does add is one new data point in an existing lineage: between 14 and 21 April 2026, my DShield sensor [8] observed the mdrfckr campaign using a third libssh client version that has not, to my knowledge, been published as part of this campaign’s hassh chronology. The botnet’s authorized_keys file is unchanged across four years. Its SSH client library is on its third documented major version. Detection rules pinned to the older hasshes will miss the current generation. The point of this diary is to put the prior reports side by side with my April 2026 observation, document the new hassh, and offer detection-engineering guidance for handlers maintaining mdrfckr-aware rules. What is already known I want to be careful to credit the prior work this diary builds on, because the new contribution is small relative to it. The mdrfckr persistence key was first associated with the Outlaw / Dota family by Trend Micro in 2018 [3], with subsequent updates in 2019 and follow-up reporting from Anomali, Yoroi [9], Juniper [10], CounterCraft [11], Cybereason, and Kaspersky. The recon command sequence and the competitor-cleanup playbook are described across that body of work. None of the file or behaviour signatures discussed in this diary are novel. In late 2022 and early 2023, the port22.dk blog [4][7] published a two-part deep dive on the campaign. Part one (data from October–November 2022) observed 12,913 unique IPs writing the mdrfckr key from a network of 10 honeypots. Crucially, the post introduced hassh-based clustering as a defender’s tool: 99.1% of the observed mdrfckr-key writes shared the hassh 51cba57125523ce4b9db67714a90bf6e, which corresponds to the SSH client banner SSH-2.0-libssh-0.6.0 / SSH-2.0-libssh-0.6.3. Part two (data from December 2022 onward) documented the campaign migrating to a second hassh f555226df1963d1d3c09daf865abdc9a, corresponding to SSH-2.0-libssh_0.9.5 / SSH-2.0-libssh_0.9.6, with ~30,000 unique IPs across the new fingerprint and a 94.5% confidence link. Part two also documented two new related command variants: chattr -ia .ssh; lockr -ia .ssh as a separate command, and lockr -ia .ssh run on its own, executed alongside the original key-write command. In May 2023, a SANS ISC diary by Jesse La Grew [5] presented two example sessions writing the same SHA-256, captured via a cowrie-log enrichment script. One session originated from a DigitalOcean datacentre IP; the other from a VPN-fronted Tencent IP. Both sessions executed the post-December-2022 split-command variant. In May / June 2023, Guy Bruneau’s monthly DShield diary [6] noted the same key-write playbook in honeypot data and attributed it explicitly to the Outlaw group via the original Trend Micro reporting. That is the public chronology this observation extends. What the April 2026 sensor saw Between 2026-04-14 01:23:41 UTC and 2026-04-21 02:22:56 UTC, my DShield sensor logged 24 unique source IPs writing the SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to /root/.ssh/authorized_keys (and to other compromised account paths). The cluster wrote 229 authorized_keys modifications across 1,230 SSH sessions and executed 4,133 post-authentication commands. The peak burst occurred on 19 April 2026: 20 of the 24 IPs first connected to the sensor between 06:05:19 UTC and 06:07:30 UTC, a 131-second window. The remaining four IPs appeared on neighbouring days but executed the same playbook with the same key. The defensive-disarm and key-write command observed across every successful session is the post-December-2022 split variant documented by port22 part two: The new data point is the SSH client. The new hassh: libssh 0.11.x Every one of the 24 IPs in the April 2026 cluster advertised the SSH client banner SSH-2.0-libssh_0.11.1 and produced the hassh fingerprint 03a80b21afa810682a776a7d42e5e6fb. This hassh does not match the hashes documented in port22 parts one and two, nor in the May 2023 ISC diary. A hassh is a hash of the SSH client’s advertised cipher, MAC, key-exchange, and compression algorithm lists [12]. Different libssh major versions ship with different default algorithm preferences, so each new libssh version a campaign adopts produces a new hassh. The 2026 hassh 03a80b21afa810682a776a7d42e5e6fb is the third documented entry in this campaign’s libssh version walk, separated from port22’s last published value by approximately three years and one major libssh version (0.9 → 0.10 → 0.11). I do not have a baseline of how prevalent this hassh is across the full DShield sensor population - that is the question I would most like other handlers and DShield operators to help answer. On my single sensor, this hassh accounted for 3,473 SSH log lines across the eight-day window, making it the most active SSH attacker-tooling fingerprint observed during the period. The 24-IP burst: small confirmation of an existing observation Twenty of the 24 cluster IPs first connected within a 131-second window. This is consistent with the coordination behaviour documented at much larger scale by port22, and does not represent a new claim. I mention it only for completeness, and because it has one practical implication for detection: per-source-IP rate limits (fail2ban, sshguard) will not trigger on this pattern because each IP performs only ~10 login attempts. Detection rules useful against this campaign should aggregate by target account rather than by source IP - ten distinct IPs attempting steam:Steam29! against the same host within five minutes is a stronger signature than any individual IP’s behaviour. The cluster IPs and the credential dictionary are listed in the indicators section. None of the credential pairs are new: steam:Steam29!, postgres:q1, dev:dev5, sammy:sammy26, root:AAAaaa111, root:root000@, sysadmin:test123, test1:passwd, tester:testerpass, sammy:12345. This is the existing Outlaw target list. Why this matters for defenders The detection-engineering implication of the libssh version walk is straightforward: hassh-based detection rules written in 2022 or 2023 against 51cba57125523ce4b9db67714a90bf6e or f555226df1963d1d3c09daf865abdc9a will silently miss the 2026 generation of the same campaign. The SHA-256 of the authorized_keys file remains the most reliable single indicator (it has not changed in four years), but operators relying on hassh enrichment as a leading indicator - for example, alerting on hassh values before a successful authentication occurs - should add 03a80b21afa810682a776a7d42e5e6fb to their watch lists. More broadly, the four-year libssh version walk suggests the campaign operator (or operators - the persistence model has always been consistent with shared infrastructure rather than self-propagation in the strict sense) keeps the targeting infrastructure stable while letting the underlying client library age forward. A defender writing a detection rule against this campaign should expect the hassh to change again on a roughly multi-year cadence as libssh ships new defaults, and should pin alerting to the SHA-256, the public key blob, the mdrfckr comment string, and the recon command sequence - none of which have changed since 2018 - rather than to any single hassh value. What I am not claiming The 24-IP April 2026 cluster is much smaller than the populations port22 worked with. I cannot meaningfully extend port22’s hassh-confidence statistics from one sensor’s eight-day window. The 99.1% / 94.5% figures published in 2022 and 2023 should not be extrapolated to the 2026 hassh from this data alone - that calculation requires a multi-sensor population study, which is exactly the kind of analysis ISC handlers and the DShield operator community are positioned to do better than any of my sensors. Indicators authorized_keys SHA-256 (unchanged since 2018):a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 Public key comment string: mdrfckr April 2026 hassh: 03a80b21afa810682a776a7d42e5e6fb April 2026 SSH client banner: SSH-2.0-libssh_0.11.1 Burst window: 19 April 2026, 06:05:19 → 06:07:30 UTC Credential dictionary: steam:Steam29! ,postgres:q1 ,dev:dev5 ,sammy:sammy26 ,root:AAAaaa111 ,root:root000@ ,sysadmin:test123 ,test1:passwd ,tester:testerpass ,sammy:12345 24 source IPs from the April 2026 cluster (Appendix A) Conclusion The mdrfckr campaign is older than many of the SSH honeypots currently watching it. Its authorized_keys file is approaching its eighth anniversary on VirusTotal and has not been rotated. Its target dictionary, recon sequence, and competitor-cleanup playbook have all remained stable across the four years that public researchers have been tracking the libssh version walk. What changes is the client. The April 2026 hassh 03a80b21afa810682a776a7d42e5e6fb joins 51cba57125523ce4b9db67714a90bf6e and f555226df1963d1d3c09daf865abdc9a as the third documented entry in this campaign’s lineage. Detection rules pinned to either earlier hassh will miss it. I would be very interested to hear from any other DShield operator or ISC handler who has independently observed the 0.11.x hassh writing the SHA-256 above - particularly with population data that would let the community update the hassh-to-mdrfckr confidence figures published by port22 in 2022 and 2023. Acknowledgments Drafting assistance from Claude (Anthropic) [13]. All log review, the hassh and SHA-256 verification, the credential and IP enumeration, and the comparison against prior reporting were done from the sensor’s own logs and the cited public sources. References [3] Trend Micro, https://www.trendmicro.com/en/research/20/b/outlaw-updates-kit-to-kill-older-miner-versions-targets-more-systems.html [4] port22.dk, “mdrfckrs – part one,” March 2023. https://blog.port22.dk/mdrfckrs-part-one/ [5] Jesse La Grew, “More Data Enrichment for Cowrie Logs,” SANS Internet Storm Center, 24 May 2023. https://isc.sans.edu/diary/29878 [6] Guy Bruneau, “DShield Honeypot Activity for May 2023,” SANS Internet Storm Center, 11 June 2023. https://isc.sans.edu/diary/29932 [7] port22.dk, “mdrfckrs – part two,” July 2023. https://blog.port22.dk/mdrfckrs-part-two/ [8] https://isc.sans.edu/honeypot.html [9] Yoroi, “Outlaw is Back: A New Crypto-Botnet Targets European Organizations.” https://yoroi.company/research/outlaw-is-back-a-new-crypto-botnet-targets-european-organizations/ [10] Juniper Threat Research, “Dota3: Is your Internet of Things device moonlighting?” https://blogs.juniper.net/en-us/threat-research/dota3-is-your-internet-of-things-device-moonlighting [11] CounterCraft, “Dota3 malware again and again.” https://www.countercraftsec.com/blog/dota3-malware-again-and-again/

OrBit (Re)turns: Tracking an open-source Linux rootkit across four years of forks and deployments May 14, 2026 Written by Nicole Fishbein In July 2022, we published the first analysis of OrBit, a then-undocumented Linux userland-rootkit that stood out for its comprehensive libc hooking, SSH backdoor access, and PAM-based credential harvesting. At the time, OrBit appeared as a single sample with a single operator fingerprint, and the codebase itself looked customized. It wasn't. As we will show below, OrBit is a repackaged and selectively weaponized build of Medusa, an open-source LD_PRELOAD rootkit published on GitHub in December 2022. The story of OrBit's four-year evolution is not one of novel development; it's the story of how a publicly available rootkit was forked, configured, and redeployed. Nearly four years later, OrBit is still in the wild, and it has not stood still. Hunting across VirusTotal, we pulled more than a dozen samples spanning 2022 through 2026 and walked each one through static and differential analysis. We discovered two parallel lineages: a full-featured "Lineage A" build that tracks closely with the 2022 original, and a lite "Lineage B" fork that drops entire capability domains (PAM, pcap, TCP-port hiding) in exchange for a smaller footprint. Along the way, the operators rotate XOR keys, shuffle install paths, swap backdoor credentials, add auditd-evasion hooks, and eventually bolt on a service-side PAM impersonation primitive. This blog picks up where the 2022 analysis left off. We focus on what changed, when, and why it matters for defenders. For each epoch, we enumerate the samples, call out the lineage, and break down the meaningful changes: credential changes, hook-set diffs, new evasion behavior, and operator tradecraft. Background: What is OrBit? For readers unfamiliar with the original analysis, OrBit is a Linux userland-rootkit deployed as a shared library (.so) that achieves persistence by patching the dynamic linker, specifically modifying ld.so to ensure the malicious library is loaded into every process on the system. It operates as a passive implant with no command-and-control communication; instead, the attacker connects in through an SSH backdoor. Once installed, OrBit hooks into PAM functions to harvest credentials from SSH and sudo authentication attempts, storing the captured passwords locally. Its evasion capabilities are comprehensive, hooking over forty libc functions to hide files, processes, and network connections from administrators and security tools alike. The malware stores its harvested credentials and configuration data in /lib/libntpVnQE6mk/, a directory that remains invisible to standard enumeration thanks to the rootkit's own hooks. July 2022 We will refer to this variant as Lineage A "Full" build of OrBit. OrBit variants through the years In our research, we collected samples from VirusTotal. Unlike PE files, ELF files don’t include a compilation timestamp, so we started by aggregating the samples by the date they were submitted to VirusTotal. To track the samples on the blog, we use the first 8 characters of each sample's SHA-256. At the bottom of the blog, you can find the full list of IOCs. December 2022 The first version shows a slight change: the username and password for the SSH connection, and the exported functions. Credential mechanism shift: 40b5127c resolved the backdoor username dynamically via the getpwuid hook; ec7462c3 dropped that hook entirely and hardcodes adm1n directly in the XOR-encrypted string table. The working folder was changed to libseconf. For the most part, the later variants will use this path. All other capabilities are identical: file I/O interception, stat hiding, PAM credential capture, TCP port hiding (alloc_tcp_ports/remove_port/tcp_port_hidden), load monitoring (.showload/.maxload), pcap sniffing, LD_PRELOAD management, log suppression, and process hiding. The transition from 2022 to 2023 is essentially a redeployment with new credentials and a more convincing install path, plus a minor simplification (dropping dynamic UID lookup in favor of a hardcoded username). The rootkit's hook surface stayed stable. Samples From 2023 The d419a9b1 sample stands out for the operator's choice of the install path (/lib/fuckwhitehatshome/) and the SSH username and password. No other known samples use these strings, suggesting a different operator or persona authored this particular build rather than it simply being a different deployment of the same toolkit. Functionally, it carries the full 2022-era hook set, with 65 exports. The 296d28eb sample is a full-featured build that uses the libseconf path and the same SSH credentials as ec7462c3. But this sample also has an evolutionary step: dropped TCP port hiding, added the exported xread function. This is not an LD_PRELOAD hook on a system library; it's a wrapper that calls syscall(SYS_read) directly, bypassing the rootkit's own hooked read(). The rootkit hooks the libc read() function; the hook filters out rootkit artifacts from files such as/proc/net/tcp and directory listings. Some C programs, such as Git, define their own internal xread() helper that wraps read() to handle partial reads and EINTR. Normally, these internal helpers call libc read(), which the rootkit intercepts and filters. By exporting its own xread, which directly calls syscall (SYS_read), the rootkit shadows these program-internal helpers with a version that bypasses its own read hook entirely. This is a compatibility fix: without it, any program that defines xread would receive the rootkit's filtered output through its core I/O path, potentially corrupting SSH protocol streams, breaking git operations, or causing other malfunctions that could expose the rootkit's presence. The hook ensures that programs continue to function normally while the rootkit's read interception remains active for standard libc callers. Both files, 3ba6c174 and 4203271c, represent the first appearance of Lineage B, a deliberately lite fork of the OrBit rootkit. Both are dynamically linked shared objects using the standard 0xA2 XOR key and installed in /lib/libseconf/, but they export only 54 functions, compared to the 67 in their closest Lineage A contemporaries (d419a9b1, ec7462c3). The 13 removed exports strip out three entire capability domains: network port-hiding (alloc_tcp_ports, remove_port, tcp_port_hidden, clean_ports), PAM credential interception (pam_authenticate, pam_acct_mgmt, pam_open_session, pam_get_password), and packet capture (pcap_loop, pcap_packet_callback). The string table reflects this (.logpam and .udp are absent), though .ports, .hosts, and sshpass2.txt are retained. This reduced feature set suggests they were purpose-built for different target environments where a smaller footprint or more limited functionality was either sufficient or preferred. The most notable change is the complete absence of a backdoor password. Every Lineage A sample embeds a password in its XOR-encrypted string block, but in both 3ba6c174 and 4203271c, the password field is missing. Each sample carries a distinct username (adm1n and b4ph0m3t0, respectively), and these are the only byte-level differences between the two binaries. This pattern of 54 exports, no password, no PAM/pcap hooks, held consistent across all subsequent Lineage B samples through 2024. Samples From 2024 2024 is the most diverse epoch in OrBit's timeline, with both lineages active simultaneously and an encryption key change in the Lineage A branch. eea274ed / a6138638: Lineage A, 0xAA key rotation These two samples belong to the same lineage: identical XOR key (0xAA is a break from the long-standing 0xA2), identical credentials (Y0u4reCu6e / 1qaz@WSX3edc123), and identical hook count (54). The only structural difference is the install path: /lib64/libseconf/ versus /lib/locate/. This is probably a deliberate path rotation to evade detections anchored on the previously documented /lib/libseconf/ directory. Credentials are stored inline in the XOR-encrypted block rather than written to sshpass.txt, representing a shift in the credential storage model. Both samples also have a reduced hook for the' execve' function: the execve hook handles persistence maintenance (apt/yum), output sanitization (dmesg), and ldd defeat. Compared to other samples in the lineage, it is a reduced feature set: no strace interception, no IP/iptables hooks, no command logging. Despite sharing the same hook count, the two samples do not share the same hook set. a6138638 swaps read/write for readdir_r/readdir64_r, indicating a targeted adjustment to the directory-hiding mechanism. A string-level diff reveals more changes: Credential harvesting is saved in remote.txt. This variant captures only SSH logins, not sudo sessions ([sudo] pass is missing). The result is 52 decoded XOR strings in eea274ed versus 47 in a6138638. Both samples retain .udp, .pts, and the credential pair, preserving the core backdoor functionality. The removals target logging and forensic-capture features, suggesting a6138638 was tailored for a deployment where a lighter footprint was preferred. a34299a1 / b1dd18a6 / 989f7eb4: Lineage B continuation These samples continue the 54-export lite build lineage that first appeared in 2023 with 3ba6c174/4203271c. The hook set is identical (49 hooks), the XOR key remains 0xA2, and the same capability domains are absent: no PAM credential interception, no pcap sniffing, no TCP port hiding. The password field is still missing from the binary. Each sample carries a distinct username (rebel, Gestuff, adm1n, respectively), consistent with the Lineage B pattern of per-deployment username rotation, with no corresponding password. 989f7eb4 is the payload extracted from the 48a68d05 dropper. It was not on VT; we uploaded it. Samples From 2025 The 2025 epoch marks two significant capability additions to Lineage A and confirms the rootkit's return to the 0xA2 encryption key after the 2024 0xAA experiment. Two distinct rootkit .so builds are present in 2025, both Lineage A: 8e83cbb2 represents the most capable build to date. Its 66-export set includes a significant new hook not seen in any prior variant: pam_sm_authenticate. This is the PAM service-side authentication function, meaning the rootkit now hooks both sides of the PAM stack. Where earlier variants could only passively capture credentials via client-side pam_authenticate, this build can also forge authentication outcomes, allowing the attacker to approve or deny login attempts at will. The export set also includes xread, first seen in 296d28eb (2023). 2b2eeb22 is a second Lineage A payload with 64 exports. XOR 0xA2 decode confirms credentials adm1n/asdfasdf, the same operator behind ec7462c3 (2022), 296d28eb (2023), and the 26082cd3 inner payload (2024), now spanning four years. 84828f31 is a truncated copy of 2b2eeb22 (same BuildID: cbc9724027399723a27daa4114ffcdf906cb802f, identical bytes up to 107KB, missing the trailing 102KB containing section headers and symbol tables), it is likely an incomplete extraction or download artifact. It is not a distinct sample. XOR 0xA2 string decode of both payloads confirms the full Lineage A string set is restored: sshpass.txt and sshpass2.txt both present, plus .logpam, .udp, .ports (×2), /proc/net/tcp. The string removals introduced by the 2024 0xAA cluster (a6138638's missing local.txt, sniff.txt, etc.) were not carried forward, and both builds return to the comprehensive logging and credential-capture model. Dropper Samples 090b15fd, 64a3ebd3, and b85ed157 are statically linked ELF executables that carry 8e83cbb2 as an embedded .so and share the same Build ID: da256c78910c552eb334814ada85c7655b717c4f. d3d204c1 is the same type of dropper carrying 2b2eeb22. All four share the same architecture first seen in f1612924 (from 2022). 73b95b7d: A New Dropper Architecture 73b95b7d is not just a dropper, it is an infector that carries the dropper as an embedded payload. This creates a two-stage delivery chain: infector → dropper → rootkit. The inner binary (090b15fd, embedded at file offset 0x20d7) is the dropper we previously saw. The infector's role is propagation and persistence; the dropper's role is to extract and install the rootkit .so via ld.so.preload. The infector scans the filesystem for ELF binaries and injects the second-stage payload into them. An infection marker bongripz4jezuz (stored in base64 encoding as: Ym9uZ3JpcHo0amV6dXoK) is checked before each infection attempt to avoid re-infecting the same target. The injected binaries include: /bin/ls All 64-bit ELF files in the current working directory that have read/write access. Additionally, /etc/cron.hourly/0 is created as a persistence mechanism (to download and execute a remote payload), though it is a shell script rather than an ELF injection target. This is the first OrBit component with any form of C2 communication. Every previous version was a purely passive implant, meaning the attacker connected via the SSH backdoor. This introduces an external command channel that can deliver updated payloads or instructions, adding a reinfection mechanism on top of ld.so.preload persistence. The earlier droppers stored all paths and commands as plaintext. 73b95b7d is the first dropper to implement string protection: a custom substitution cipher using two lookup tables at .data offsets for the cipher and plain, each with 88 entries, defining a character-by-character mapping. Notably, this is a different scheme from the XOR encryption used by the previous rootkit payloads. The structure of this dropper, which delivers the OrBit payload in the final stage, is identical to that described in this APNIC blog that analyzed a dropper that delivered RHOMBUS malware. Rhombus is a Linux-based botnet malware first reported in February 2020 by the MalwareMustDie research group, which analyzed and shared samples of it. It acts as an installer/dropper that persists on infected devices, drops a second-stage payload, and then uses the compromised system for DDoS activity. The target systems are VPS and IoT devices. (SHA256 of the dropper: b982276458a85cd3dd7c8aa6cb4bbb2d4885b385053f92395a99abbfb0e43784). Interestingly, the dropper 73b95b7d that delivers the OrBit payload in the final stage is identical to the one used in the Rhombus campaign 6 years ago. Coincidentally, both droppers use the same domain to download the payload as part of the cron-job-based persistence. The current resolution of the domain is to 109.95.212[.]253. The host has a unique BANNER_0_HASH-IP value, ba0c31785465186600a76b7af2a37aa6, that is shared with only one other IP, 109.95.211[.]141, as shown in the screenshot below from Validin. Based on the ASN resolution, both IP addresses are located in Russia. The fact that the OrBit dropper shares the same domain as malware from 6 years ago can also be interpreted as an attempt to mislead researchers; therefore, we are not taking this evidence into account for attribution at this moment. However, it is worth noting that this connection exists. Samples From February 2026 These two samples are confirmed to be identical in structure: the same 54-hook set, the same XOR key (0xA2), and the same working directory (/lib/libseconf/). The only difference is credentials: jokerteam/HACK89SERVER versus 57ill4Cu63/1qaz@WSX3edc098. XOR 0xA2 decode confirms the full Lineage A string set. No Lineage B samples have surfaced since 2024, suggesting the lite build may have been retired or consolidated back into the main branch. Connection to BLOCKADE SPIDER In CrowdStrike’s 2026 Global Threat Report, they mention that BLOCKADE SPIDER used the OrBit backdoor to maintain persistence and stealthy access to virtualization environments. BLOCKADE SPIDER is a CrowdStrike-tracked eCrime adversary that has been active at least since 2024. They are known for running Embargo ransomware campaigns using sophisticated, multi-domain attack techniques. Origin: OrBit is a fork of the Medusa open-source rootkit Mandiant's reporting on UNC3886 espionage operations identifies MEDUSA and its installer, SEAELF, as tools used by this state-sponsored actor against Juniper and VMware infrastructure. Essentially, OrBit is built from Medusa, an open-source LD_PRELOAD rootkit published on GitHub (github.com/ldpreload/Medusa) in December 2022. Mandiant's MEDUSA configuration table matches our 2024 Lineage A 0xAA-key cluster exactly across four independent fields: the XOR key 0xAA, the backdoor credentials Y0u4reCu6e and 1qaz@WSX3edc123, the install path /lib/locate/, and a modification to the rootkit that redirects strace output to /tmp/orbit.txt. That literal orbit filename, preserved as a plaintext artifact inside UNC3886's MEDUSA binary, is direct cross-attribution: Mandiant's "MEDUSA" sample set and our "OrBit" 2024 cluster are the same builds. We compiled Medusa from source and compared the resulting binaries byte-for-byte against our OrBit corpus. The match is unambiguous, and it rewrites the attribution and evolution story. Evidence of the fork The first is a function-set and export match. Compiling Medusa's src/rkld.c against the default Makefile recipe produces a shared object whose function set, hook list, and XOR-obfuscated string table are a direct superset match for OrBit Lineage A samples. The 2022 OrBit baseline (ec7462c3) shares all core exports with the Medusa build and reuses the identical XOR 0xA2 string obfuscation scheme driven by Medusa's build-time xor_dump() pipeline, with the XOR key itself hardcoded in config.c. The second is a source-filename fingerprint that is present in almost every sample we analyzed. Some of the samples ship with an unstripped ELF .symtab. The resulting filenames are preserved verbatim: rootkit samples carry rkld.c and, when Lineage A is linked in, rknet.c, while loader samples carry rkload.c. Those are the exact names of Medusa's source files, src/rkld.c, src/rknet.c, and src/rkload.c. The filenames themselves are not secret, since the Medusa repository is public, but their verbatim presence in the compiled binary is a strong attribution anchor: every unstripped sample directly identifies the upstream tree it was built from. Of the samples in our corpus, only three are fully stripped (the 2025 dropper 73b95b7d, and the rootkit binaries a6138638 and b9822764). Three representative samples are shown below: a full Lineage A rootkit (ec7462c3, 2022), a Lineage B lite rootkit (3ba6c174, 2023), and the SEAELF loader (26082cd3, 2024). 1: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c 9: 0000000000000000 0 FILE LOCAL DEFAULT ABS rkload.c 14: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c The Lineage A rootkit carries both rkld.c and rknet.c; the Lineage B rootkit, which omits the advanced hook set, carries only rkld.c; and the loader carries rkload.c. The same pattern holds across the wider corpus. Alongside the filename fingerprint, the loader's entry-point dispatch, its build_root() filesystem layout (.boot.sh, .logpam, sshpass.txt, sshpass2.txt, .ports), and its SELinux setxattr sequence all map one-to-one to the Medusa source. The third is an embedded inner ELF produced by xxd -i. Medusa's Makefile embeds build/rkld.so into the loader using the xxd -i build/rkld.so > build/rkld.h step, which is then included by the loader compiled at Makefile line 33. OrBit's loader binaries follow this pattern: a rkld.so blob embedded as a C byte array within the loader ELF, dropped to disk at runtime. The embedding technique, offset layout, and post-drop execution flow are identical. Per-Module Source Mapping Medusa's source tree maps cleanly onto the OrBit binary set we have tracked: The Medusa default Makefile compiles only src/rkld.c. Every Lineage A capability that appeared to "arrive" in OrBit between 2023 and 2025 was already present as source in Medusa's src/rknet.c on day one of the public release. The operators' work was to modify the Makefile to link rknet.c into their build, not to author those functions. Timeline Anomaly Our analysis shows that an initial OrBit sample (40b5127c) appeared in July 2022, predating the repository's publication by approximately 5 months. Based on this information, there are two options: either the Medusa author published a privately-circulated rootkit source that had already been deployed operationally, or the earliest OrBit sample was built from a pre-publication snapshot of the same tree. Either way, the 2022 OrBit sample and the December 2022 Medusa source tree are the same codebase. The question is only which commit was made public first. Implications The appearance of a single rootkit family across four years does not imply a single operator. OrBit and Medusa have been built and deployed by at least three unrelated actor clusters we can presently distinguish, including the state-sponsored espionage activity attributed to UNC3886, the eCrime ransomware operations run by BLOCKADE SPIDER, and the 2025 cron-dropper campaign previously linked to RHOMBUS infrastructure. Attribution at the family level is therefore not enough, and defenders tracking an OrBit infection should separate the questions of which codebase was used from which operator configured and deployed it. Tracking version-over-version changes in OrBit reads less like an active malware development project and more like a record of build-flag toggles, credential rotations, and install-path swaps against a stable upstream. The capability ceiling is set by the Medusa source tree as it existed in December 2022, and every apparent new feature we observed between 2023 and 2025 was already present in that tree, waiting for an operator to link it in. The xread read-hook bypass we first flagged as a 2023 compatibility shim is a function in src/rknet.c. The auditd evasion pair we called out as a 2024 addition, audit_log_acct_message and audit_log_user_message, sits in the same file. The PAM stack we noted as gradually expanding across versions, including pam_authenticate, pam_acct_mgmt, pam_open_session, and the 2025 service-side impersonation hook pam_sm_authenticate, is all present in the same rknet.c, as is the pcap_loop packet hook that appears in full Lineage A builds. None of these files is linked in by the default Makefile recipe, which compiles only src/rkld.c. Their arrival in individual OrBit samples corresponds to an operator modifying the build to include rknet.c, not to new code being written. Signatures based on invariants of the Medusa build pipeline will also flag builds from operators we have not yet seen. Three such invariants are worth calling out. The string table produced by Medusa's xor_dump() routine, which emits every protected string as a contiguous block of single-byte XOR-obfuscated byte arrays within the compiled binary. Operators change the key value (0xA2 in most builds, 0xAA in the 2024 UNC3886 cluster) and some paths, but the table's shape and the majority of its entries are fixed by the source. A YARA rule that decodes the table with a variable single-byte key and matches on a threshold count of known plaintext strings catches any build, regardless of which key was chosen. The filesystem skeleton that the loader's build_root() writes into its install directory. Operators vary only the parent directory (/lib/libseconf/, /lib/locate/, /lib/libntpVnQE6mk/), so host-based detection can alert on the co-occurrence of that filename set inside any directory, and binary-level signatures can match the embedded filename constants and the setxattr call pattern directly. The nested-ELF structure produced by the xxd - +i build/rkld.so > build/rkld.h step in the Makefile, which bakes a full secondary ELF into the loader's .rodata. Every Medusa loader therefore carries a second ELF magic inside its own image, followed by a length constant, and, if the binary is not stripped, two xxd-generated symbols (rkld_so and rkld_so_len ). The nested-ELF shape on its own is not specific enough to be a detection signature: plenty of legitimate software and unrelated malware use xxd -i or equivalent techniques to embed a payload, and any such binary will match a naive "second ELF at non-zero offset plus length constant" rule. The Medusa-specific part is the pairing of that structural pattern with (a) the symbol names rkld_so and rk +ld_so_len in the loader's symbol table when the binary is not stripped, and (b) the inner ELF itself, matching the rootkit fingerprint described earlier in this section, which gives both a family-level anchor and a structural one. Conclusion The analysis of OrBit variants from 2022 through early 2026 reveals a Linux rootkit whose code later surfaced in an open-source codebase named Medusa. This suggests that the backdoor was created before its public release and has since been selectively forked, configured, and redeployed by multiple operators over four years. We identified two parallel build paths: the comprehensive Lineage A ("Full" build), which links in Medusa's src/rknet.c advanced hook set, and the temporary Lineage B (lite build), which ships only the src/rkld.c core and was retired after 2024. Apparent "milestones" in Lineage A are the xread wrapper (2023), the audit_log_* auditd-evasion hooks (2024), and the 2025 addition of the pam_sm_authenticate hook, which corresponds one-to-one with functions already present in Medusa's published source. The operator work is in the build configuration and deployment, not the C code. Our analysis of the OrBit samples also discovered that at least 3 different operators are using the backdoor. A major operational shift occurred in 2025 with the introduction of a new two-stage infector architecture, marking one operator's transition from a purely passive SSH-backdoor implant to malware with its first direct C2 capability. This infector utilizes a cron job to fetch external payloads from the domain cf0[.]pw. The architecture of this new dropper is identical to one used in the 2020 RHOMBUS botnet campaign, suggesting shared tooling or operator overlap, a link further cemented by the C2 domain resolving to infrastructure located in Russia. In parallel, the same Medusa codebase was weaponized upstream by the state-sponsored espionage actor UNC3886 (tracked by Mandiant). The 2024 0xAA-key cluster we tracked as Lineage A corresponds exactly to UNC3886's MEDUSA configuration, including the backdoor credentials, the install path, and a strace artifact that retains the literal "orbit" string. The rootkit has also been adopted by the CrowdStrike-tracked eCrime adversary BLOCKADE SPIDER since at least 2024, who leverage OrBit for stealthy persistence against VMware vCenter infrastructure to facilitate the deployment of Embargo ransomware. The continued emergence of new Lineage A samples in 2026, accompanied by operator-specific credential rotation, confirms that a single public rootkit codebase is being cloned and configured by multiple unrelated actor groups. IOC Table Nicole Fishbein Nicole is a senior security researcher and malware analyst at Intezer. Prior to this, she was an embedded researcher in the IDF Intelligence Corps.

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment. Here are this week’s highlights: Tennessee hacker gets probation for Supreme Court breaches Nicholas Moore, 25, was sentenced to 12 months of probation after pleading guilty to a misdemeanor for using stolen credentials to break into the Supreme Court’s e-filing system on 25 separate days, plus systems at AmeriCorps and the Veterans Administration Health System. Rather than exploiting the access financially, he posted screenshots of the breached accounts apparently just to impress people online. UK military deployed to protect internet communications The UK has deployed military assets, including warships, support tankers, Merlin helicopters, and RAF P‑8 maritime patrol aircraft, to protect undersea communications cables from a perceived Russian naval threat. Tony O’Sullivan, CEO of RETN, comments, “Accidental damage is no longer the only threat, and operators and enterprises can no longer assume routes are safe and stable when assessing resilience. Rather, you have to engineer it into the network itself. Route diversity is a must to avoid creating single points of failure, as is ensuring visibility across international paths. Rather than trying to prevent disruption, we have to design networks to cope with it.” Lovable’s shifting story on exposed user data Vibe-coding startup Lovable — valued at $6.6 billion — fumbled its response to a BOLA vulnerability that allowed any free account holder to read other users’ source code, database credentials, and chat history. A researcher reported the flaw to HackerOne 48 days before going public, but the bug was closed without escalation because HackerOne assumed the exposure was intentional behavior. Lovable initially called it a design decision, then reversed course and admitted a February backend change had accidentally re-enabled access to public project chats — a setting they had previously patched out. US accused of exploting backdoor to disable Iranian infrastructure According to Iranian state media, during an attack on the city of Isfahan, networking equipment from Cisco, Juniper, Fortinet, and MikroTik failed simultaneously despite being disconnected from the global internet. Local experts suspect these outages were triggered by pre-installed firmware backdoors or supply chain compromises that allowed for remote deactivation via satellite or internal signals. Claude Mythos accessed by unauthorized testers Anthropic’s Claude Mythos was reportedly accessed by unauthorized users through a third-party vendor environment. Bloomberg News reports that someone discovered the interface, which allowed for the testing of Mythos’ advanced capabilities. The AI giant has since restricted access to the abused portal. Data breach at French state agency France Titres, the agency responsible for passports and driver’s licenses, confirmed a security breach on its ANTS portal that may have exposed the data of millions of users. A threat actor is currently attempting to sell a database on hacking forums containing roughly 19 million records, including names, birth dates, and unique account identifiers. Sean Plankey withdraws nomination for CISA director Sean Plankey has officially withdrawn his name for the role of Director at the Cybersecurity and Infrastructure Security Agency after a prolonged confirmation stalemate in the Senate. The withdrawal leaves the nation’s primary cyber defense agency without a permanent leader. This move forces the White House to restart the search for a candidate capable of navigating a deeply divided political landscape. Nick Andersen is currently Acting Director of CISA. UK’s NCSC debuts hardware guard to prevent data leakage via monitors The UK’s National Cyber Security Centre has developed a hardware security device designed to stop sensitive data from being exfiltrated through high-resolution display links. Named SilentGlass, the plug-and-play device “actively blocks anything unexpected or malicious between HDMI and Display Port connections and screens.” Recommended for high-threat environments, the device can now be acquired by anyone after being tested in government organizations. Global defense agencies issue alert on Chinese botnet infrastructure The FBI, CISA, and international partners have released a joint advisory regarding a massive network of compromised SOHO routers and IoT devices orchestrated by China-linked threat actors. The state-sponsored group Volt Typhoon has used the botnet to target critical infrastructure sectors. The agencies have issued recommendations for defending against such covert networks. Google expands enterprise security with browser and device controls Google has introduced new security capabilities within Chrome Enterprise and Android. Chrome Enterprise Premium now offers advanced data loss prevention and capabilities to address AI risks. Google is also expanding security for mobile, blocking sensitive data downloads on unmanaged devices. New controls in the Google Admin console allow for more granular policy enforcement across both browsers and devices to reduce the attack surface.

Juniper Networks: risolta vulnerabilità in Junos OS e Junos OS Evolved Alert AL05/260423/CSIRT-ITA Sintesi Juniper Networks ha rilasciato aggiornamenti per risolvere una vulnerabilità con gravità “alta”, nei sistemi operativi Junos OS e Junos OS Evolved. Tale vulnerabilità, potrebbe permettere ad un utente malintenzionato con privilegi elevati, di eseguire codice arbitrario eludendo le funzionalità di sicurezza sui sistemi interessati. Tipologia Arbitrary Code Execution Security Feature Bypass Prodotti e/o versioni affette Junos OS versioni precedenti alla 22.4R3-S8 23.2, versioni precedenti alla 23.2R2-S5 23.4, versioni precedenti alla 23.4R2-S7 24.2, versioni precedenti alla 24.2R2-S2 24.4, versioni precedenti alla 24.4R2 25.2, versioni precedenti alla 25.2R2 Junos OS Evolved versioni precedent alla 22.4R3-S8-EVO 23.2, versioni precedenti alla 23.2R2-S5-EVO 23.4, versioni precedenti alla 23.4R2-S7-EVO 24.2, versioni precedenti alla 24.2R2-S2-EVO 24.4, versioni precedenti alla 24.4R2-EVO 25.2, versioni precedenti alla 25.2R1-S1-EVO, 25.2R2-EVO Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettinio di sicurezza riportato nella sezione Riferimenti.

You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. Same mistakes. The supply chain is messy. Packages you did not check are stealing data, adding backdoors, and spreading. Attacking the systems behind apps is easier than breaking the apps themselves. The exploits are simple but still work, giving attackers easy access. AI tools are also part of the problem now. They trust bad input and take real actions, which makes the damage bigger. Then there are quieter issues. Apps take data they should not. Devices behave in strange ways. Attackers keep testing what they can get away with. No noise. Just ongoing damage. Here is the list for this week’s ThreatsDay Bulletin. State-backed crypto heistInter-blockchain communication protocol LayerZero has revealed that North Korean threat actors tracked TraderTraitor may have been behind the recent hack of decentralized finance (DeFi) project KelpDAO, resulting in the theft of $290 million. "The attack was specifically engineered to manipulate or poison downstream RPC infrastructure by compromising a quorum of the RPCs the LayerZero Labs DVN relied upon to verify transactions," LayerZero said. KelpDAO, in a post on X, said, "Two RPC nodes hosted by LayerZero were compromised. A simultaneous DDoS attack was launched against the third RPC node. This was an attack on LayerZero's infrastructure. Kelp's own systems were not involved in building or operating that infrastructure." Meanwhile, the Arbitrum Security Council has temporarily frozen the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. In an analysis published today, Chainalysis said: "Crucially, this was not a smart contract hack, but a sophisticated attack on off-chain infrastructure. The attackers compromised internal RPC nodes and DDoS’d external nodes to feed false data to a single-point-of-failure verification network (a 1-of-1 DVN setup). This tricked the Ethereum contract into releasing funds based on a phantom token 'burn' on the source chain." It's worth noting that TraderTraiter was attributed to the mega Bybit hack in early 2025 that led to the theft of $1.5 billion in digital assets. Recently, Lazarus Group was also linked to the $285 million theft from the Drift Protocol. Active RCE exploitsSeparately, VulnCheck has warned of attacks attempting to exploit two flaws in MajorDoMo, a smart home automation platform. While CVE-2026-27175 is a critical command injection vulnerability that started seeing exploitation on April 13, CVE-2026-27174 allows unauthenticated remote code execution via the PHP console in the admin panel and was first detected on April 18. "CVE-2026-27175 was exploited to drop a PHP webshell that delivers persistent backdoor access," VulnCheck said. "CVE-2026-27174 saw exploitation that ended in a Metasploit php/meterpreter/reverse_tcp staged payload." Other vulnerabilities that have witnessed exploitation efforts include CVE-2025-22952, an SSRF in Elestio Memos, and CVE-2024-57046, an authentication bypass in NETGEAR DGN2200 routers. Supply chain malware surgeA number of malicious packages have been discovered in the npm registry: ixpresso-core, forge-jsx, @genoma-ui/components, @needl-ai/common, rrweb-v1, cjs-biginteger, sjs-biginteger, bjs-biginteger, @fairwords/websocket, @fairwords/loopback-connector-es, @fairwords/encryption, js-logger-pack, and @kindo/selfbot. These packages come with features to steal sensitive data from compromised hosts, perform system reconnaissance, andimplant an SSH backdoor by injecting the attacker's public key into ~/.ssh/authorized_keys, deliver an information stealer, and spread the XWorm remote access trojan (RAT). The packages published under the "@fairwords" scope have also been found to self-propagate to all npm packages using the victim's token and attempt cross-ecosystem propagation to PyPI via .pth file injection. New versions of js-logger-pack have since been found to leverage the Hugging Face repository to poll for updates and use it as a data-theft destination. Also detected was the compromise of @velora-dex/sdk (version 9.4.1) to decode and execute a Base64 payload that fetches a shell script from a remote server that, in turn, downloads and persists a Go-based remote access trojan called minirat on macOS systems. Another legitimate package to be compromised was mgc (versions 1.2.1 through 1.2.4), which was injected with a dropper that detects the operating system and fetches a platform-specific RAT from a GitHub Gist to exfiltrate valuable data. AI prompt injection surgeForcepoint has detected 10 new indirect prompt injection (IPI) payloads targeting artificial intelligence (AI) agents with malicious instructions designed to achieve financial fraud, data destruction, API key theft, and AI denial-of-service attacks. "Regardless of the specific payload technique or attacker intent, every case follows the same fundamental sequence: the attacker poisons web content, hides the payload from human view, waits for an AI agent to ingest the page, exploits the LLM's inability to distinguish trusted instructions from attacker-controlled content, and triggers a real-world action with a covert exfiltration return channel back to the attacker," the company said. Covert browser data accessThe Claude desktop app has been found granting itself permission to access web browser data, even if some browsers haven't even been installed on a user's computer, web privacy expert Alexander Hanff said. The app has been spotted placing configuration files in preset locations for Chromium-based browsers like Brave, Google Chrome, Microsoft Edge, and Vivaldi. The Native Messaging manifest files pre-authorize Claude to interact with the browser even before the user installs it. The issue has been described as a case of dark pattern that violates privacy laws in the E.U. Hardware display protectionThe U.K. National Cyber Security Centre (NCSC) has unveiled a new technology called SilentGlass that's designed to protect video connections from cyber attacks. "SilentGlass, a plug-and-play device, actively blocks anything unexpected or malicious between HDMI and Display Port connections and screens," NCSC said. "Already successfully deployed on Government estates, SilentGlass is now available for anyone to buy and use. It has been approved for use in the most high-threat environments." Passkeys replace passwordsIn a related development, the NCSC also endorsed passkeys as the default authentication standard and the "first choice of login" for access to all digital services. "Passkeys are a newer method for logging into online accounts, which do much of the heavy lifting for users, only requiring user approval rather than needing to input a password," NCSC said. "This makes passkeys quicker and easier to use and harder for cyber attackers to compromise." It also said the majority of cyber harms to individuals begin with criminals stealing or compromising login details, which makes passkey adoption a "huge leap" in boosting resilience to phishing attacks. More than 50% of active Google services users in the U.K. are said to be already using passkeys. Backdoor sabotage claimsReports from Iranian media have claimed that hardware made by Cisco, Juniper, Fortinet, and MikroTik either rebooted or disconnected during recent attacks on Iran, despite the country being cut off from the global internet. "The most striking and suspicious aspect of this incident is its precise timing and the lack of access to the international internet at that moment," Iranian news website Entekhab said. "This disruption occurred at a time when international gateways were effectively blocked or inaccessible; therefore, attributing this chain collapse to 'a simple cyber attack from beyond the borders' is not only unconvincing but also reveals the traces of deep-seated sabotage embedded within the equipment." The report hypothesizes the presence of hidden firmware backdoors or rogue implants within compromised devices, creating a dormant botnet that's activated when a certain event occurs without the need for internet access. The other possibility is a supply chain compromise. "If the chips or installation files of Cisco and Juniper products are compromised before entering the country, even replacing the operating system will not solve the problem, because the root of the problem is embedded in the hardware and read-only memory (ROM)," the report said. These arguments have found purchase in China, whose state media agency Xinhua called U.S.-made equipment the "real trojan horse." The disclosure comes as DomainTools revealed that the various hacktivist personas adopted by Iran, such as Homeland Justice, Karma, and Handala, "constitute a coordinated, MOIS-aligned cyber influence ecosystem operating under multiple branded identities that serve distinct but complementary operational roles." Ransomware infighting escalatesThe Krybit ransomware group has hacked the website of rival ransom group 0APT after the latter threatened to dox Krybit's members. According to security firm Barricade, 0APT leaked the complete database of the Krybit ransomware operation, including victim records, plaintext credentials, Bitcoin wallets, encryption tokens, and a 56MB exfiltration file inventory. In return, Krybit has hit back by compromising 0APT's server within 48 hours, defacing their data leak site, and publishing source code, bash history, Nginx logs, and system files. To rub salt into the wound, the group listed 0APT as victim #1 on their own leak site. Stealth malware-as-a-serviceThere is a new cryptor-as-a-service platform called FUD Crypt (fudcrypt[.]net). "For $800 to $2,000 per month, subscribers upload an arbitrary Windows executable and receive a multi-stage deployment package that attempts automatic DLL sideloading, in-memory AMSI and ETW interference, silent UAC elevation via CMSTPLUA, and Windows Defender tamper via Group Policy on Enterprise builds," Ctrl-Alt-Intel said. Formbook phishing surgeTwo different phishing campaigns targeting Greek, Spanish, Slovenian, Bosnian, Latin, and Central American companies are using different techniques to deliver Formbook malware. "FormBook is a data-stealing malware that targets Windows systems, primarily distributed through phishing emails with malicious attachments," WatchGuard said. “It collects sensitive information like login credentials, browser data, and screenshots, using advanced evasion techniques to avoid detection.” Stealth .NET execution abuseA highly sophisticated, multi-stage post-exploitation framework has been observed targeting organizations in the Middle East and EMEA financial sectors. "The threat actor leverages a legitimate, digitally signed Intel utility (IAStorHelp.exe) by abusing the .NET AppDomainManager mechanism, effectively turning a trusted binary into a stealthy execution container," CYFIRMA said. "This approach allows malicious code to be executed within a trusted environment. It bypasses conventional security controls without modifying the original signed binary." Because AppDomainManager hijacking enables stealth execution within a trusted signed binary, it allows malicious code to run without modifying the original executable, effectively bypassing code-signing trust controls. The attack begins with a phishing email containing a ZIP archive, which contains an LNK file masquerading as a PDF document to execute "IAStorHelp.exe." It's currently not known who is behind the campaign, but the level of sophistication, modular design, and operational discipline suggest capabilities consistent with advanced threat actors. RAT plus adware bundleA new malware campaign is spreading both a remote access trojan and adware together, allowing attackers to establish persistent access and make financial profits. The attack has been found to leverage a loader to deliver Gh0st RAT trojan and CloverPlus adware, an unwanted software designed to install advertising components and change browser behavior, such as startup pages and pop-up ads, per Splunk. macOS stealth execution abuseIn a new analysis, Cisco Talos revealed that bad actors can bypass security controls in Apple macOS by repurposing native features like Remote Application Scripting (RAS) for remote execution and abusing Spotlight metadata (Finder comments) to stage payloads in a way that evades static file analysis. "Because Finder is scriptable over RAE, the comment of a file on a remote machine can be set via the “eppc://” protocol. By Base64 encoding a payload locally, a multi-line script can be stored within this single string field. The make new file command handles the creation of the target file, ensuring that no pre-existing file is required," Talos said. "The payload resides entirely within the Spotlight metadata, a location that remains largely unexamined by standard endpoint detection and response (EDR) solutions. This creates a stealthy staging area where malicious code can persist on the disk without triggering alerts associated with suspicious file contents." In addition, attackers can move toolkits and establish persistence using built-in protocols such as SMB, Netcat, Git, TFTP, and SNMP operating entirely outside the visibility of standard SSH-based telemetry. In some cases, adversaries can also bypass built-in restrictions by using Terminal as a proxy for execution, encoding payloads in Base64 and deploying them in stages. LLM agent testing frameworkA group of academics has released a hackable, modular, and configurable open-source framework called Terrarium for studying and evaluating decentralized LLM-based multi-agent systems (MAS). "As the capabilities of agents progress (e.g., tool calling) and their state space expands (e.g., the internet), multi-agent systems will naturally arise in unique and unexpected scenarios," the researchers said, adding it acts as "an isolated playground for studying agent behavior, vulnerabilities, and safety. It enables full customization of the communication protocol, communication proxy, environment, tool usage, and agents." AI data privacy purgeAccording to Reuters, AI company Clarifai said it has deleted 3 million profile photos taken from dating site OkCupid in 2014. It follows a settlement reached last month between the U.S. Federal Trade Commission (FTC) and Match Group, OkCupid's owner. Clarifai is said to have certified the data deletion to the FTC on April 7, 2026, and deleted any models that trained on the data. The company also emphasized that it hadn't shared the data with third parties. The FTC opened the investigation in 2019, after The New York Times reported that Clarifai had built a training database using OkCupid dating profile photos. The behavior was a direct violation of OkCupid's privacy policy, although Clarifai was not accused of wrongdoing. Zero-credential RCE chainVulnCheck said it's seeing active exploitation of the Apache ActiveMQ Jolokia remote code execution chain that strings together CVE-2026-34197 and CVE-2024-32114. "CVE-2024-32114 removes authentication from the Jolokia endpoint entirely on ActiveMQ versions 6.0.0 through 6.1.1," VulnCheck's Jacob Baines said. "Combined with CVE-2026-34197, that is zero-credential RCE." Stealth phishing lureThere has been a surge in phishing emails utilizing empty subject lines as a way to lure users to actually click and open the email without the usual warning cues. Known as silent subject or null subject phishing, the technique is designed to exploit blind spots in email defenses, as it allows such emails to bypass security filters that rely on analyzing the subject lines for specific keywords that may indicate potential phishing or scam. "Emails with empty subject lines evade user suspicion by exploiting human curiosity," CyberProof said. "The primary objective of a silent subject campaign is to gain initial access through social engineering, leading to credential compromise, unauthorized access, and potential lateral movement within targeted environments, especially focusing on high-value or VIP users." Industrial-scale SIM farmsA Belarus-based turnkey solution is assisting SIM farm operators in supporting cybercrime on an industrial scale. Infrawatch said that it identified 87 instances of ProxySmart control panels in 17 countries that are linked to at least 24 commercial proxy providers and 35 cellular providers. The footprint spans 94 phone farm locations, distributed across 19 U.S. states, as well as countries in Europe and South America. ProxySmart provides an end-to-end platform for operating and monetizing mobile proxy infrastructure, including farm management, device control, customer provisioning, retail proxy sales, and payment handling. It's accessible via a web-based control panel that's self-hosted by the farm operator. Devices in the farms are either physical Android phones or USB 4G/5G modems. The phones are enrolled via an unsigned Android APK package downloaded from the ProxySmart website, with SMS send and receive capability included. Modems are managed through ModemManager, an open-source USB dongle management tool. The ProxySmart service is written in Python and obfuscated using PyArmour. "ProxySmart is publicly associated with a Belarus-based vendor footprint and offers an end-to-end stack for operating and monetizing a physical farm, including device management, automated IP rotation, customer provisioning, plan enforcement, and anti-bot countermeasures," the company said. "Technical analysis indicates operator capabilities consistent with large-scale evasion enablement, including automated IP rotation, remote device control, and network fingerprint spoofing." SIM farms enable a range of cybercrime activity such as smishing, premium-rate number fraud, bot sign-ups, and one-time password interception. In response to the findings, ProxySmart disputed its characterization as a SIM farm, stating it's a "data-path proxy management platform" and that its mobile proxy infrastructure "underpins a wide range of legitimate commercial and research activity" including advertising verification, brand protection, price monitoring, and anti-fraud model training, among others. Telegram under CSAM probeOfcom, the U.K.'s independent communications regulator, has launched an investigation into Telegram under the country's Online Safety Act to examine whether the platform is being used to share child sexual abuse material (CSAM) and is doing enough to combat the threat. "We received evidence from the Canadian Centre for Child Protection regarding the alleged presence and sharing of child sexual abuse material on Telegram, and carried out our own assessment of the platform," Ofcom said. "In light of this, we have decided to open an investigation to examine whether Telegram has failed, or is failing, to comply with its duties in relation to illegal content." In a statement shared with The Record, Telegram said it "categorically denies Ofcom's accusations," adding it has "virtually eliminated the public spread of CSAM on its platform through world-class detection algorithms and cooperation with NGOs." Earlier this year, Ofcom also commenced a probe into X to determine whether the service is taking necessary steps to take down illegal content, including non-consensual intimate images and CSAM. EU cracks disinfo opsThe European Union imposed sanctions on two pro-Russian organizations accused of spreading disinformation and supporting the Kremlin's hybrid influence operations against Europe and Ukraine. The measures target Euromore and the Foundation for the Support and Protection of the Rights of Compatriots Living Abroad (Pravfond). The move is part of the E.U.'s broader effort to counter Russian information and influence operations targeting Europe since the start of Moscow's full-scale invasion of Ukraine in 2022. The E.U. has imposed sanctions on 69 individuals and 19 entities linked to Russian hybrid warfare. Bot farm dismantledUkrainian authorities have dismantled a bot farm that's alleged to have supplied thousands of fake social media accounts to Russian intelligence services for use in disinformation campaigns against Ukraine. The suspected organizer of the network has been detained in the northern city of Zhytomyr, and nearly 20,000 fraudulent online profiles that were used in information operations have been blocked. The suspect is believed to have sold more than 3,000 fake Telegram accounts each month to Russian clients. The accounts were created using Ukrainian mobile phone numbers and then advertised on online platforms used by pro-Russian actors. If convicted, the suspect faces up to six years in prison. Malicious extensions surgeMore than 130,000 users have downloaded and installed malicious Chrome and Edge extensions that, while offering the promised functionality, also implement covert tracking, remote configuration capabilities, and data collection mechanisms.The 12 extensions posed as tools to download TikTok videos and were available through the official Chrome and Edge stores. The activity has been codenamed StealTok. The extensions have been found to use remote configuration to bypass store review. "Beyond privacy concerns, the use of remote configuration endpoints introduces a significant security risk, enabling post-installation behavior changes that bypass marketplace review mechanisms," LayerX said. Joomla SEO spam backdoorIn a new campaign spotted by Sucuri, threat actors are planting a new PHP-based backdoor on Joomla sites to inject SEO spam. The injected script acts as a remote loader to send information about the infected website and awaits further instructions from an attacker-controlled server. "Attackers inject malicious code that silently serves spam content to visitors and search engines, all without the site owner knowing," Sucuri said. "The goal is simple: abuse the site's reputation to push traffic towards products the attacker wants to promote." Post-exfiltration data tradeA new service called Leak Bazaar has been promoted on the Russian-speaking TierOne forum that claims to process data stolen from extortion and ransomware attacks and turn it into "something more legible, more selective and precise, and making it marketable for the general population to ingest." It's advertised by a user named Snow, who joined the forum on March 3, 2026. "What Leak Bazaar is really offering is not a DLS or Data or Dedicated Leak Site in the conventional sense, but a post-exfiltration service layer," Flare said. "It is trying to reassure both suppliers and buyers that the platform can solve the most frustrating part of data theft, which is that a large percentage of exfiltrated material is too noisy, too unstructured, or too cumbersome to use without additional labor." RDP scanning concentrationGreyNoise has disclosed that a small cluster of 21 IP addresses is now responsible for generating nearly half of all the RDP scanning traffic on the public internet. The addresses are registered to ColocaTel (AS213438), a company based in the Seychelles. According to the threat intelligence firm, mass internet scanning activity is now preceding vendor vulnerability disclosures more frequently than before, with 49% of surges arriving within 10 days of disclosure and 78% within 21 days.In a related development, security researcher Morgan Robertson revealed that almost three-quarters of Perforce P4 source code management servers connected to the internet are misconfigured and leaking source code and sensitive files. "The default Perforce settings allow unauthenticated users to create accounts, list existing users, access passwordless accounts, and, until version 2025.1, allowed syncing repositories remotely; potentially exposing intellectual property across more than a dozen sectors, including gaming, healthcare, automotive, finance, and government," Robertson said. "Action is recommended for all Perforce administrators to ensure security hardening, including setting stronger authentication requirements, disabling automatic account creation, and raising security levels." Emerging threat groups surgeVarious new hacktivist, data extortion, and ransomware crews have been spottedin the wild. These include Harakat Ashab al-Yamin al-Islamia, World Leaks, Lamashtu, Payouts King, BravoX, Black Shrantac, NBLOCK, Ndm448, Chip, Ransoomed, and Zollo. None of this is new. That is the problem. Old paths still open, basic checks still skipped, and trust still given where it should not be. Attackers are not doing anything magical, they are just faster and less careful because they do not need to be. The fixes are known but ignored. Patch early, check what you install, limit access, and stop trusting inputs by default. Most of the damage comes from things that were easy to prevent. Same story next week.

HPE�̓G�b�W����N���E�h�܂ł�ی삷���I�ȃZ�L�����e�B��\�����B�V���iSRX400�̓�����AI�����@�\�̋����A�|�X�g�ʎq�Í��ւ̑Ή��ɂ���āA���U���ł̃��X�N�ጸ�ƃ��W���G���X�m�ۂ��x������B �@���{�q���[���b�g�E�p�b�J�[�h�i�ȉ��AHPE�j��2026�N4��15���AAI���p�̊g��ɔ������G�����镪�UIT���̉ۑ�ɑΉ����邽�߁A��I�ȃZ�L�����e�B�����Ɍ������V���Ȏ��g�݂\�����B�N���E�h����R�A�A�G�b�W�܂ł����f�����т����ی���������A��Ƃ�AI�����S�Ɋ��p�ł���悤��Ղ̐�����_���B �@���\�ł͐V���i�uHPE Juniper Networking SRX400 Series Firewalls�v�̃����[�X�ɉ����A�n�C�u���b�h���b�V���^�̃Z�L�����e�B�A�[�L�e�N����̋@�\�����A���W���G���X���d�������e��@�\�̊g���������ꂽ�BAI�������i�ޒ��ŁA�^�p�͈͂̊g���T�C�o�[���X�N�̑���ɑΉ����A�S�̂�ʂ��������Ɖ����̋������d�v�ۑ�ƂȂ��Ă���B �@����SASE����уl�b�g���[�L���O�Z�L�����e�B�S���V�j�A�o�C�X�v���W�f���g���[�l�����}�l�W���[�̃f�r�b�h�E�q���[�Y���́AAI�̊��p���i�ރV�X�e�����ł́A�]���̂悤�ɃZ�L�����e�B����t���Ŏ��������@�ł͕s�\���ł���A�l�b�g���[�N�ƃZ�L�����e�B�̓������s�����v�Ǝw�E�����B���̏�ŁA�|���V�[�̕W�����ƑS�̓K�p���x�����A���\��^�p�����ێ����M�����̍���AI�������\�ɂ���Ɛ��������B �@���\���ꂽSRX400�V���[�Y�́A���K�͋��_��ݒu����̂�����ɂ��L�����A�O���[�h�̕ی�@�\�����_���������B�R���p�N�g�Ȑv�Ȃ��獂���������\�Ɖ^�p����������A���u���_���܂߂��S�̂̃Z�L�����e�B�������ψꉻ����B������ϐ���f�o�C�X�̊��S���m�ۂ���������Ă���A���U���ɂ������_��}���������S���B �@�n�C�u���b�h���b�V���t�@�C�A�E�H�[���̋����ɂ����ẮAAI���p���ɂ����铝���@�\���g�[���ꂽ�BPonemon Institute�̒����ɂ��ƁA�����ΏۂƂȂ�����Ƃ̉ߔ�����AI�����p���Ă������ŁA���̗��ŁA�@�����̕s�K�ȋ��L��s���A�N�Z�X�Ƃ��������X�N���ۑ�ƂȂ��Ă���B����ɑΉ����邽�߂ɁAAI�A�v���P�[�V�����̗��p�̉�����A�N�Z�X����A�����F�T�[�r�X�̎Ւf�@�\���lj����ꂽ�B �@�v�����v�g�P�ʂł̌����@�\�ɂ��A�O���T�[�r�X�ւ̏�o��}�~����d�g�݂��������ꂽ�B���[�U�[��[�N���[�h�P�ʂł̃|���V�[�K�p���\�ɂ���ID�x�[�X�̕ی����������A�����≼�z�A�R���e�i�����܂ޓ����I�ȊǗ�����������B�^�p�ʂł͎������@�\�����b�gbot�ɂ��x������������A���G�ȍ�Ƃ̊ȑf�����}����B �@���Б�ɂ����ẮAHPE Threat Labs�̎��g�݂��������ꂽ�B���g�D�̓l�b�g���[�N�e�����g���[�Ɛ��m�������p���A���A���^�C���̋��Е��͔\�͂����߂Ă���B���J���ꂽ���|�[�g�ł́A2025�N�Ɋϑ����ꂽ1186���̍U���L�����y�[���͂��A�U�������x���E�g�D�����Ă�����Ԃ𖾂炩�ɂ����B���m�̐Ǝ�i�������Ⴍ�j���̈��p���Ղ̍ė��p�ɂ��A�����I�ɑ�K�͍U��������Ă���_���w�E����Ă���B �@���̕��͂ł́A�h��̋����ɂ͒P�Ȃ�c�[���lj��ł͂Ȃ��A�S�̂̉����ƘA�g�A�Ή��͂̋������K�v���ƌ��_�t���Ă���B�[���g���X�g�̓K�p��AI�ɂ�錟�m�A�T�v���C��F�[���⎩������܂ޑ�̊g�����d�v�Ƃ����B �@���i�ʂɂ����ẮA�X�g���[�W��T�[�o���܂ރ|�[�g�t�H���I�S�̂ł̃Z�L�����e�B�@�\�̊g�����i�߂��Ă���B�uHPE Zerto Software�v�ł̓T�C�o�[���J�o���[�@�\����������A�����Ώۂ̊g�[��AI�֘A���[�N���[�h�ւ̑Ή����i�BStoreOnce�Ƃ̘A�g�ɂ��A�s�σf�[�^����̐v���ȕ������\�ƂȂ�B �@�܂��uHPE Morpheus Software�v�ɂ͋@���R���s���[�e�B���O�@�\���lj�����A�������̃f�[�^���Í������ꂽ�܂����ł���B�n�[�h�E�F�A�x�[�X�̐M�����s���ƌ��Ǘ���g�ݍ��킹�邱�ƂŁA�K���v���ւ̑Ή��ƃf�[�^�ی�𗼗�����B �@�����̋��ЂƂ��đz�肳���ʎq�R���s���[�e�B���O�ɂ��Ή�����B�uJunos OS Evolved�v�i�ȉ��AJunos�j�ɂ̓|�X�g�ʎq�Í��iPQC�j����������A�����Junos�S�̂֊g�������\�肾�B�֘A����T�[�o���i�ɂ��K�p���i�݁A�Í���Ղ̋������}����B �@�����̃\�����[�V�����́A�\�u����IT��G�A�M���b�v�����܂ޑ��l�ȉ^�p��ԂɑΉ����A�����ƃR���v���C�A���X���m�ۂ���v�ƂȂ��Ă���B�����ɂ��ẮASRX400�V���[�Y����ъ֘A�@�\��2026�N��2�l�����AZerto Software�̐V�o�[�W���������N4���A�@���R���s���[�e�B���O�@�\����3�l�����APQC�Ή��͓��N�Ăɂ��ꂼ��J�n�����\�肾�B Copyright © ITmedia, Inc. All Rights Reserved.

A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases. Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business Warehouse (CVE-2026-27681, CVSS score: 9.9) that could result in the execution of arbitrary database commands. "The vulnerable ABAP program allows a low-privileged user to upload a file with arbitrary SQL statements that will then be executed," Onapsis said in an advisory. In a potential attack scenario, a bad actor could abuse the affected upload-related functionality to run malicious SQL against BW/BPC data stores, extract sensitive data, and delete or corrupt database content. "Manipulated planning figures, broken reports, or deleted consolidation data can undermine close processes, executive reporting, and operational planning," Pathlock said. "In the wrong hands, this issue also creates a credible path to both stealthy data theft and overt business disruption." Another security vulnerability that deserves a mention is a critical-severity remote code execution in Adobe Acrobat Reader (CVE-2026-34621, CVSS score: 8.6) that has come under active exploitation in the wild. That said, there are many unknowns at this stage. It is not clear how many people have been affected by the hacking campaign. Nor is there any information about who is behind the activity, who is being targeted, and what their motives could be. Also patched by Adobe are five critical flaws in ColdFusion versions 2025 and 2023 that, if successfully exploited, could lead to arbitrary code execution, application denial-of-service, arbitrary file system read, and security feature bypass. The vulnerabilities are listed below - CVE-2026-34619 (CVSS score: 7.7) - A path traversal vulnerability leading to security feature bypass CVE-2026-27304 (CVSS score: 9.3) - An improper input validation vulnerability leading to arbitrary code execution CVE-2026-27305 (CVSS score: 8.6) - A path traversal vulnerability leading to arbitrary file system read CVE-2026-27282 (CVSS score: 7.5) - An improper input validation vulnerability leading to security feature bypass CVE-2026-27306 (CVSS score: 8.4) - An improper input validation vulnerability leading to arbitrary code execution Fixes have also been released for two critical FortiSandbox vulnerabilities that could result in authentication bypass and code execution - CVE-2026-39813 (CVSS score: 9.1) - A path traversal vulnerability in FortiSandbox JRPC API that could allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests. (Fixed in versions 4.4.9 and 5.0.6) CVE-2026-39808 (CVSS score: 9.1) - An operating system command injection vulnerability in FortiSandbox that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. (Fixed in version 4.4.9) The development comes as Microsoft addressed a staggering 169 security defects, including a spoofing vulnerability impacting Microsoft SharePoint Server (CVE-2026-32201, CVSS score: 6.5) that could allow an attacker to view sensitive information. The company said it's being actively exploited, although there are no insights into the in-the-wild exploitation associated with the bug. "SharePoint services, especially those used as internal document stores, can be a treasure trove for threat actors looking to steal data, especially data that may be leveraged to force ransom payments using double extortion techniques by threatening to release the stolen data if payment is not made," Kev Breen, senior director of threat research at Immersive, said. "A secondary concern is that threat actors with access to SharePoint services could deploy weaponised documents or replace legitimate documents with infected versions that would allow them to spread to other hosts or victims moving laterally across the organization." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD Apple ASUS AVEVA Broadcom (including VMware) Canon Cisco Citrix CODESYS D-Link Dassault Systèmes Dell Devolutions dormakaba Drupal Elastic F5 Fortinet Foxit Software FUJIFILM Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Grafana Hitachi Energy HP HP Enterprise (including Aruba Networking and Juniper Networks) Huawei IBM Ivanti Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NETGEAR Node.js NVIDIA ownCloud Palo Alto Networks Phoenix Contact Progress Software QNAP Qualcomm Rockwell Automation Ruckus Wireless Samsung Schneider Electric Siemens SonicWall Splunk Spring Framework Supermicro Synology TP-Link WatchGuard, and Xiaomi

Ivanti on Tuesday updated Neurons for ITSM to resolve two medium-severity vulnerabilities affecting both on-premises and cloud deployments. The first bug, tracked as CVE-2026-4913 (CVSS score of 5.7), is described as the improper protection of an alternate path. According to Ivanti, it could allow “a remote authenticated attacker to retain access when their account has been disabled”. The second flaw, CVE-2026-4914 (CVSS score of 5.4), is described as a stored cross-site scripting (XSS) issue that can be abused remotely to obtain limited information from other user sessions. Successful exploitation of the weakness requires authentication and user interaction, Ivanti notes in its advisory. Both vulnerabilities were resolved in Ivanti Neurons for ITSM version 2025.4. Users are advised to update their deployments as soon as possible. “No action is required for customers using the cloud solution as the fix was applied to all cloud environments on 12 December 2025,” Ivanti says. The company says it is not aware of either of these vulnerabilities being exploited in the wild. No other Ivanti products are affected. On Tuesday, Ivanti also updated its advisory on CVE-2025-26465 and CVE-2025-26466, two OpenSSH flaws disclosed in February 2026. Ivanti EPMM, Sentry and Connector are not affected by the two bugs, but an updated OpenSSH version will be included in future releases, the company says. Related: Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities Related: SAP Patches Critical ABAP Vulnerability Related: Fortinet, Ivanti, Intel Patch High-Severity Vulnerabilities Related: Juniper Networks Patches Dozens of Junos OS Vulnerabilities

Monday is back, and the weekend’s backlog of chaos is officially hitting the fan. We are tracking a critical zero-day that has been quietly living in your PDFs for months, plus some aggressive state-sponsored meddling in infrastructure that is finally coming to light. It is one of those mornings where the gap between a quiet shift and a full-blown incident response is basically non-existent. The variety this week is particularly nasty. We have AI models being turned into autonomous exploit engines, North Korean groups playing the long game with social engineering, and fileless malware hitting enterprise workflows. There is also a major botnet takedown and new research proving that even fiber optic cables can be used to eavesdrop on your private conversations. Skim this before your next meeting. Let’s get into it. ⚡ Threat of the Week Adobe Acrobat Reader 0-Day Under Attack — Adobe released emergency updates to fix a critical security flaw in Acrobat Reader that has come under active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2026-34621, carries a CVSS score of 8.6 out of 10.0. Successful exploitation of the flaw could allow an attacker to run malicious code on affected installations. It has been described as a case of prototype pollution that could result in arbitrary code execution. The development comes days after security researcher and EXPMON founder Haifei Li disclosed details of zero-day exploitation of the flaw to run malicious JavaScript code when opening specially crafted PDF documents through Adobe Reader. There is evidence suggesting that the vulnerability may have been under exploitation since December 2025. Your VPN is Helping Attackers Move as Fast as AI The Zscaler ThreatLabz 2026 VPN Risk Report reveals a dangerous disconnect: while attackers use AI to move at machine speed, legacy VPNs are leaving defenders blind and exposed. When you can’t see what’s happening, response time collapses and the odds of containment drop with it. Get the Report ➝ 🔔 Top News U.S. Warns of Hacking Campaign by Iran-Affiliated Cyber Actors — U.S. agencies warned of a hacking campaign undertaken by Iranian threat actors hitting industrial control systems across the U.S. that has had disruptive and costly effects. The attacks, ongoing since last month, targeted programmable logic controllers (PLCs) in the energy sector, water and wastewater utilities, and government facilities that are left exposed to the public internet with the apparent intention of sabotaging their systems. "In a few cases, this activity has resulted in operational disruption and financial loss," the agencies said. The activity has not been attributed to any particular group. The attacks are part of a wider pattern of escalating Iran-linked operations as the war led by the U.S. and Israel against Iran entered its sixth week. The U.S. and Iran have since agreed to a two-week ceasefire. Anthropic's Mythos Model is a 0-Day and Exploit Generation Engine — A closed consortium including tech giants and top security vendors is getting early access to a general-purpose frontier model that Anthropic says can autonomously discover software vulnerabilities at scale. Because there are concerns that frontier AI capabilities could be abused to launch sophisticated attacks, the idea is to use Mythos to improve the security of some of the most widely used software before bad actors get their hands on it. To that end, Project Glasswing aims to apply these capabilities in a controlled, defensive setting, enabling participating companies to test and improve the security of their own products. In early testing, Anthropic claims the model identified thousands of high-severity vulnerabilities across operating systems, web browsers, and other widely used software, not to mention devising exploits for N-day flaws, in some cases, under a day, significantly compressing the timeline typically required to build working exploits. "New AI models, especially those from Anthropic, have triggered a new set of actions for how we build and secure our products," Cisco, which is one of the launch partners, said. "While the capabilities now available to defenders are remarkable, they soon will also become available to adversaries, defining the critical inflection point we face today. Defensively, AI allows us to scan and secure vast codebases at a scale previously unimaginable. However, it also lowers the threshold for attackers, empowering less-skilled actors to launch complex, high-impact campaigns. Ultimately, AI is accelerating the pace of innovation for both defenders and adversaries alike. The question is simply who gets ahead of it and how fast." Law Enforcement Operation Fells APT28 Router Botnet — APT28 has been silently exploiting known vulnerabilities in small and home office (SOHO) routers since at least May 2025, and changing their DNS server settings to redirect victims to websites it controls for credential theft. The attack chain begins with Forest Blizzard gaining unauthorized access to poorly secured SOHO routers and silently modifying their default network settings so that DNS lookups for select websites are altered to direct users to their bogus counterparts. Specifically, the actor replaces the router's legitimate DNS resolver configuration with actor-controlled DNS servers. Since endpoint devices, such as laptops, phones, and workstations, automatically inherit network configuration from routers via the Dynamic Host Configuration Protocol (DHCP), every device connecting through a compromised router unknowingly begins forwarding its DNS requests to Russian intelligence-controlled infrastructure. For a select subset of high-priority targets, Forest Blizzard escalated beyond passive DNS collection to active Adversary-in-the-Middle (AiTM) attacks against Transport Layer Security (TLS) connections. The compromised router redirects the victim's DNS query to the actor-controlled resolver. The malicious resolver returns a spoofed IP address, directing the victim's device to actor-controlled infrastructure instead of the legitimate service. Forest Blizzard then intercepts the underlying plaintext traffic – potentially including emails, credentials, and sensitive cloud-hosted content. The activity has gradually declined over the past few weeks. The operations are "likely opportunistic in nature, with the actor casting a wide net to reach many potential victims, before narrowing in on targets of intelligence interest as the attack develops," per the U.K. government. "The GRU provides fraudulent DNS answers for specific domains and services – including Microsoft Outlook Web Access — enabling adversary-in-the-middle (AitM) attacks against encrypted traffic if users navigate through a certificate error warning. These AitM attacks would allow the actors to see the traffic unencrypted." The operation fits into a series of disruptions aimed at Russian government hackers dating back to 2018, including VPNFilter, Cyclops Blink, and MooBot. Drift Protocol Links Hack to North Korea — Drift Protocol has revealed that a North Korean state-linked group spent six months posing as a trading firm to steal $285 million in digital assets. The attack has been described as a meticulously planned intelligence operation that began in fall 2025, when a group of individuals approached Drift staff at a major cryptocurrency conference, presenting themselves as a quantitative trading firm seeking to integrate with the protocol. Over the next couple of months, the group built trust through in-person meetings, Telegram coordination, onboarding an Ecosystem Vault on Drift, and made a $1 million deposit of their own capital. But once the exploit hit, the trading group vanished, with the chats and malware "completely scrubbed" to cover up the tracks. The Drift Protocol hack follows a pattern that is becoming increasingly frequent as this incident marks the 18th North Korea-linked act Elliptic has tracked in 2026. Bitter-Linked Hack-for-Hire Campaign Targets Journalists Across MENA — An apparent hack-for-hire campaign likely orchestrated by a threat actor with suspected ties to the Indian government targeted journalists, activists, and government officials across the Middle East and North Africa (MENA). The targets included prominent Egyptian journalists and government critics, Mostafa Al-A'sar and Ahmed Eltantawy, along with an anonymous Lebanese journalist. The spear-phishing attacks aimed to compromise their Apple and Google accounts by sending specially crafted links designed to capture their credentials. The attack has been found to share infrastructure overlaps with an Android spyware campaign that leveraged deceptive websites impersonating Signal, ToTok, and Botim to deploy ProSpy and ToSpy to unspecified targets in the U.A.E. While Bitter has not been attributed to espionage campaigns targeting civil society members in the past, the campaign once again demonstrates a growing trend of government agencies outsourcing their hacking operations to private hack-for-hire firms, which develop spyware and exploits for use by law enforcement and intelligence agencies to covertly access data on people's phones. 🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-34621 (Adobe Acrobat Reader), CVE-2026-39987 (Marimo), CVE-2026-34040 (Docker Engine), CVE-2025-59528 (Flowise), CVE-2026-34976 (dgraph), CVE-2026-0049, CVE-2025-48651 (Android), CVE-2026-0740 (Ninja Forms – File Upload plugin), CVE-2025-58136 (Apache Traffic Server), CVE-2026-4350 (Perfmatters plugin), CVE-2026-32922, CVE-2026-33579, GHSA-9p3r-hh9g-5cmg, GHSA-g5cg-8x5w-7jpm, GHSA-8rh7-6779-cjqq, GHSA-hc5h-pmr3-3497, GHSA-j7p2-qcwm-94v4, GHSA-fqw4-mph7-2vr8, GHSA-9hjh-fr4f-gxc4, GHSA-hf68-49fm-59cq (OpenClaw), CVE-2026-29059, CVE-2026-23696, CVE-2026-22683 (Windmill), CVE-2026-34197 (Apache ActiveMQ), CVE-2026-4342 (Kubernetes), CVE-2026-34078 (Flatpak), CVE-2026-31790 (OpenSSL), CVE-2026-0775 (npm cli), CVE-2026-0776 (Discord Client), CVE-2026-0234 (Palo Alto Networks), CVE-2026-4112 (SonicWall), CVE-2026-5437 through CVE-2026-5445 (Orthanc DICOM Server), CVE-2026-30815, CVE-2026-30818 (TP-Link), CVE-2026-33784 (Juniper Networks Support Insights Virtual Lightweight Collector), CVE-2026-23869 (React Server Components), CVE-2026-5707, CVE-2026-5708, CVE-2026-5709 (AWS Research and Engineering Studio), CVE-2026-5173, CVE-2026-1092, CVE-2025-12664 (GitLab), CVE-2026-5860, CVE-2026-5858, CVE-2026-5859, from CVE-2026-5860 through CVE-2026-5873 (Google Chrome), CVE-2023-46233, CVE-2026-1188, CVE-2026-1342, CVE-2026-1346 (IBM Verify Identity Access and IBM Security Verify Access), CVE-2026-5194 (WolfSSL), and CVE-2026-20929 (Windows HTTP.sys). 🎥 Cybersecurity Webinars The Blueprint for AI Agent Governance: Identity, Visibility, and Control → As autonomous AI agents move from experimental "slideware" to production middleware, they’ve created a massive new attack surface: non-human identities. Join this webinar to cut through the vendor noise and get a practical blueprint for the three pillars of agent security—identity, visibility, and control. Learn how to establish hardware-backed agent identities and implement forensic AI proxies to govern your machine workforce before the "ghosts" in your system become liabilities. State of AI Security 2026: From Experimental Apps to Autonomous Agents → AI is evolving from static tools to autonomous agents, outstripping traditional security faster than ever. With 87% of leaders citing AI as their top emerging risk, the "wait and see" approach is officially over. Join us to dissect the 2026 State of AI Security and gain a battle-tested roadmap for securing model runtimes, preventing agentic data leaks, and governing your machine workforce in production. Validate 56% Faster: How AI Agents are Automating the Pentest Loop → Vulnerability backlogs are endless, but true exploitability is rare. Agentic Exposure Validation uses autonomous AI to safely test your defenses in real-time, proving which risks are real and which are just noise. Join us to learn how to automate your validation loop, prioritize the 1% of flaws that actually matter, and shrink your attack surface at machine speed. 📰 Around the Cyber World Fake Claude Website Drops PlugX — A fake website impersonating Anthropic's Claude to push a trojanized installer that deploys known malware referred to asPlugXusing a technique called DLL side-loading. The domain mimics Claude's official site, and visitors who download the ZIP archive receive a copy of Claude that installs and runs as expected," Malwarebytes said. "But in the background, it deploys a PlugX malware chain that gives attackers remote access to the system." While PlugX is known to be widely shared among Chinese hacking groups and delivered via DLL side-loading, its source code has circulated in underground forums, indicating that other threat actors could also be weaponizing the malware in their own attacks. Seized VerifTools Servers Expose 915,655 Fake IDs — In August 2025, a joint law enforcement operation between the Netherlands and the U.S. led to the takedown of a fake ID marketplace called VerifTools. Last week, Dutch police arrested eight suspects in a nationwide operation targeting users of the illicit platform as part of an identity fraud investigation. The male suspects, aged between 20 and 34, have been accused of identity fraud, forgery, and cybercrime-related offenses. In addition, nine suspects have been ordered to report to the police station. This includes seven men aged 18 to 35, and two girls aged 15 and 16. Further investigation into VerifTools has revealed that there were 636,847 registered users from February 2021 to August 2025, with 915,655 fake documents generated between May 2023 and August 2025. Investigators also found 236,002 document images linked to the U.S. that were purchased for about $1.47 million between July 2024 and August 2025. U.K. Government Threatens Tech Execs with Jail Time — The U.K. government said it submitted amendments to the Crime and Policing Bill that, besides criminalizing pornography depicting illegal sexual conduct between family members and adults roleplaying as children and prohibiting people from possessing or publishing such content, also aims to fine or imprison senior executives of companies who fail to remove people's intimate images that have been shared without consent. Optical Fibers for Acoustic Eavesdropping — New research from the Hong Kong Polytechnic University and Chinese University of Hong Kong has uncovered a critical side channel within telecommunication optical fiber that enables acoustic eavesdropping. "By exploiting the sensitivity of optical fibers to acoustic vibrations, attackers can remotely monitor sound-induced deformations in the fiber structure and further recover information from the original sound waves," a group of academics said in an accompanying paper. "This issue becomes particularly concerning with the proliferation of Fiber-to-the-Home (FTTH) installations in modern buildings. Attackers with access to one end of an optical fiber can use commercially available Distributed Acoustic Sensing (DAS) systems to tap into the private environment surrounding the other end." Storm-2755 Conducts Payroll Pirate Attacks — Microsoft said it observed an emerging, financially motivated threat actor dubbed Storm-2755 carrying out payroll pirate attacks targeting Canadian users by abusing legitimate enterprise workflows. "In this campaign, Storm-2755 compromised user accounts to gain unauthorized access to employee profiles and divert salary payments to attacker-controlled accounts, resulting in direct financial loss for affected individuals and organizations," the company said. The tech giant also pointed out that the campaign is distinct from prior activity owing to differences in delivery and targeting.Particularly, this involves the exclusive targeting of Canadian users and the use of malvertising and search engine optimization (SEO) poisoning industry agnostic search terms like "Office 365" to lure victims to Microsoft 365 credential harvesting pages. Also notable is the use of adversary‑in‑the‑middle (AiTM) techniques to hijack authenticated sessions, allowing the threat actor to bypass multi-factor authentication (MFA) and blend into legitimate user activity. MITRE Releases F3 Framework to Fight Cyber Fraud — MITRE has released the Fight Fraud Framework (F3), which it described as a "first-of-its-kind effort to define and standardize the tactics and techniques used in cyber-enabled financial fraud." The tactics cover the entire attack lifecycle: Reconnaissance, Resource Development, Initial Access, Defense Evasion, Positioning, Execution, and Monetization. By codifying the tradecraft used to conduct fraud, the idea is to help financial institutions better understand, detect, and prevent fraud through a shared framework of adversary behaviors, it added. "Fraud actors often blend traditional cyber techniques with domain-specific fraud tactics, making a unified cyber-fraud framework essential," MITRE said. "F3 helps defenders connect technical signals to real-world fraud events, enabling a shift from reactive response to proactive defense." RegPhantom, a Stealthy Windows Kernel Rootkit — A new Windows kernel rootkit dubbed RegPhantom can give attackers code execution in kernel mode from an unprivileged user mode context without leaving any major visual evidence behind. "The malware abuses the Windows registry as a covert trigger mechanism: a usermode process can send an encrypted command through a registry write, which the driver intercepts and turns into arbitrary kernel-mode code execution," Nextron Systems said. "What makes this threat notable is the combination of stealth, privilege, and trust abuse. The driver runs as a signed kernel component, allowing it to operate at the highest privilege level on Windows systems. It does not rely on normal driver loading behavior for its payloads and instead reflectively maps code into kernel memory, making the loaded module invisible to standard tools that enumerate drivers. It also blocks the triggering registry write, wipes executed payload memory, and stores hook pointers in encoded form, which significantly reduces forensic visibility." The first sample of RegPhantom in the wild was detected on June 18, 2025. APT28's NTLMv2 Hash Relay Attacks Detailed — In more APT28 (aka Pawn Storm) news, the threat actor has been attributed to NTLMv2 hash relay attacks through different methods against a wide range of global targets across Europe, North America, South America, Asia, Africa, and the Middle East between April 2022 and November 2023. The threat actor is known to break into mail servers and the corporate virtual private network (VPN) services of organizations around the world through brute-force credential attacks since 2019. "Pawn Storm has also been using EdgeOS routers to send spear-phishing emails, perform callbacks of CVE-2023-23397 exploits in Outlook, and proxy credential theft on credential phishing websites," Trend Micro said. Successful exploitation of CVE-2023-23397 allows an attacker to obtain a victim's Net-NTLMv2 hash and use it for authentication against other systems that support NTLM authentication. The vulnerability, per Microsoft, has been exploited as a zero-day since April 2022. Select campaigns observed in October 2022 involved the use of phishing emails to drop a stealer that scanned the system periodically for files matching certain extensions and exfiltrated them to the free file-sharing service, free.keep.sh. New RATs Galore — Trojanized FileZilla installers are being used to initiate an attack chain that leads to the deployment of STX RAT, a remote access trojan (RAT) with infostealer capabilities. Researchers have also discovered an active threat called DesckVB RAT, a JavaScript-based trojan that deploys a PowerShell payload, which subsequently loads a .NET-based loader directly into memory. "Once executed, the RAT establishes communication with a command-and-control (C2) server, enabling attackers to remotely control the compromised system, exfiltrate sensitive data, and carry out various malicious activities while maintaining a low detection footprint," Point Wild said. Some of the other newly discovered RATs include CrystalX or WebCrystal RAT (a new malware-as-a-service (MaaS) and a rebrand of WebRAT promoted on Telegram and YouTube with remote access, data theft, keylogging, spyware, and clipper capabilities), RetroRAT (a malware distributed via PowerShell and .NET loaders as part of a campaign named Operation DualScript for system monitoring, financial activity tracking, clipboard hijacking to route cryptocurrency transactions, and remote command execution), ResokerRAT (a malware that uses Telegram for C2 and receive commands on the victim machine), and CrySome (a C# RAT that offers full-spectrum remote operations on compromised systems, along with deeply integrated persistence, AV killer, and anti-removal architecture that leverages recovery partition abuse and offline registry modification). Phishing Campaign Delivers Remcos RAT in Fileless Manner — Phishing emails are being used to deliver Remcos RAT in what has been described as a fileless attack. "The attack chain is initiated through a phishing email containing a ZIP attachment disguised as a legitimate business document," Point Wild said. "Upon execution, an obfuscated JavaScript dropper establishes the initial foothold and retrieves a remote PowerShell script, which acts as a reflective loader. This loader employs multiple layers of obfuscation, including Base64 encoding, raw binary manipulation, and rotational XOR encryption, to reconstruct and execute a .NET payload entirely in memory." An important aspect of the campaign is the use of trusted system binaries to proxy malicious execution under the guise of legitimate processes. The final RAT payload is retrieved dynamically from a remote C2 server, allowing the threat actor to switch payloads at any time. Tycoon 2FA Switches Infrastructure and Uses ProxyLine — The operators of the Tycoon 2FA phishing kit have been observed increasingly relying on ProxyLine, a commercial datacenter proxy service, to evade IP and geo‑based detection controls following its return after the coordinated global takedown of its infrastructure last month. Following the takedown, threat actors have pivoted to new infrastructure providers like HOST TELECOM LTD, Clouvider, GREEN FLOID LLC, and Shock Hosting LLC. One provider that has witnessed continued use pre- and post-takedown is M247 Europe SRL. In addition, Gmail-targeted Tycoon 2FA campaigns have implemented WebSocket-based communication for real-time credential harvesting and reduced detection footprint compared to traditional HTTP POST requests. TeleGuard's Security Failings Exposed — TeleGuard, an app that's advertised as an "encrypted messenger [that] offers uncompromising data protection" and has been downloaded more than a million times, has been found to suffer from poor encryption that allows an attacker to trivially access a user’s private key and decrypt their messages. "TeleGuard also uploads users' private keys to a company server, meaning TeleGuard itself could decrypt its users' messages, and the key can also at least partially be derived from simply intercepting a user's traffic," security researchers told 404 Media. Google Brings E2EE to Gmail for Android and iOS — Google officially expanded support for end-to-end encryption (E2EE) to Android and iOS devices for Gmail client-side encryption (CSE) users. "Users with a Gmail E2EE license can send an encrypted message to any recipient, regardless of what email address the recipient has," Google said. The feature is currently limited to only Enterprise Plus customers with the Assured Controls or Assured Controls Plus add-on. Bad Actors Abuse GitHub and GitLab — Threat actors are turning to trusted services like GitHub and GitLab for spreading malware and stealing login credentials from unsuspecting users. About 53% of all campaigns abusing the GitHub domains have been found to deliver malware (e.g., XWorm, Venom RAT), whereas 64% of campaigns abusing GitLab domains deliver malware (e.g., DCRat). Select campaigns have also adopted a dual threat attack chain, leveraging GitHub or GitLab to trick users into downloading Muck Stealer, after which a credential phishing page automatically opens. "These Git repository websites are necessary and can'tbe blocked because of their use by enterprise software and normal business operations," Cofense said. "By uploading malware or credential phishing pages to repositories hosted on these domains, threat actors can generate phishing links that won'tbe blocked by many email-based security defenses like secure email gateways (SEG). GitHub and GitLab mark the latest trend in abuse of legitimate cloud collaboration platforms." FBI Extracts Signal Messages from iOS Notification History Database — The U.S. Federal Bureau of Investigation (FBI) managed to forensically extract copies of incoming Signal messages from a defendant's iPhone, even after the app was deleted, by taking advantage of the fact that copies of the content were saved in the device's push notification database, 404 Media reported. The development reveals how physical access to a device can enable specialized software to run on it to yield sensitive data derived even from secure messaging apps in unexpected places. The problem is not limited to the Signal app, but one that stems from a more fundamental design decision regarding how Apple stores notifications. Signal already has a setting that blocks message content from displaying in push notifications. Users who are concerned about their privacy are advised to consider turning the option on. Multiple Flaws in IBM WebSphere Liberty — Multiple security flaws have been disclosed in IBM WebSphere Liberty, a modular, cloud-friendly Java application server, that could be exploited to seize control of affected systems. The vulnerabilities offer multiple pathways for attackers to move from network-level exposure or limited access to full server compromise, according to Oligo Security. The most severe is CVE-2026-1561 (CVSS score: 5.4), which enables pre-authenticated remote code execution in SSO-enabled deployments due to unsafe deserialization in SAML Web SSO. "IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF)," IBM said. "This may allow [a] remote attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks." 🔧 Cybersecurity Tools Betterleaks → It is the next-generation successor to Gitleaks, built to find exposed credentials with greater speed and accuracy. It eliminates the noise of false positives by moving beyond basic pattern matching to high-fidelity detection. Designed for modern CI/CD pipelines, it helps developers identify and fix leaked API keys and sensitive data before they become security liabilities. Supply Chain Monitor → This tool provides end-to-end visibility into your software supply chain by monitoring CI/CD pipelines for suspicious activity. It tracks build integrity, detects unauthorized changes, and surfaces vulnerabilities in real-time. By integrating directly with your existing workflows, it helps ensure that the code you ship hasn't been tampered with between the commit and production. Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law. Conclusion That’s the wrap for this Monday. While the headlines usually focus on the high-level nation-state drama, remember that most of these attacks still rely on someone, somewhere, clicking a "trusted" link or ignoring a basic patch. Whether it’s an AI-driven exploit engine or a fake trading firm, the goal is always to find the path of least resistance into your environment. Stay sharp, keep your edge devices updated, and don’t let the noise of the news cycle distract you from the basics of your own defense.

Adobe on Saturday released emergency patches for a critical Acrobat and Reader zero-day that has been exploited in the wild for several months. The vulnerability has been assigned the CVE identifier CVE-2026-34621 and a CVSS score of 9.6. According to the software giant, the flaw stems from improperly controlled modifications to prototype attributes and can be exploited to execute arbitrary code. Acrobat and Reader for Windows and macOS are affected. Patches are included in version 26.001.21411 of Acrobat DC and Acrobat Reader DC, and versions 24.001.30362 and 24.001.30360 of Acrobat 2024. Adobe’s advisory confirms that CVE-2026-34621 has been exploited in the wild. The company has credited Haifei Li for reporting the vulnerability. Li is a reputable researcher who has worked at Fortinet, McAfee, Microsoft, and Check Point. He is the founder of Expmon, a sandbox system designed to detect file-based exploits. Li came across the zero-day while analyzing a sophisticated PDF exploit uploaded to Expmon. The exploit he identified was designed to harvest information, but the researcher warned in his initial disclosure that subsequent stages in the exploit chain may include remote code execution and a sandbox escape. Adobe has confirmed that exploitation of CVE-2026-34621 can lead to code execution, rather than just information disclosure. Based on the analysis of an exploit sample uploaded to VirusTotal, researchers determined that exploitation of CVE-2026-34621 started as early as November 2025. Li indicated that an APT is likely behind the attacks, and a threat intelligence analyst who uses the online moniker Gi7w0rm noted that the malicious PDFs used Russian-language lures and referenced current events in Russia’s oil and gas sector. More information on who is behind the attacks will likely surface in the coming days as more members of the cybersecurity community analyze the exploits. Li has made technical details available, and others have released indicators of compromise (IoCs) to help defenders detect potential exploitation of CVE-2026-34621. UPDATE 04.13.2026: Adobe has updated the CVSS score for CVE-2026-34621 to 8.6, reducing the severity from ‘critical’ to ‘high’ due to the requirement to open a file locally to trigger the exploit. However, Li warned, “Please note that this does not reduce the urgency of the issue and users should continue to apply the patch as soon as possible in order to prevent potential attacks.” Related: Juniper Networks Patches Dozens of Junos OS Vulnerabilities Related: Orthanc DICOM Vulnerabilities Lead to Crashes, RCE Related: Critical Marimo Flaw Exploited Hours After Public Disclosure

Juniper Networks this week released patches for nearly three dozen vulnerabilities, including Junos OS and Junos OS Evolved bugs that could lead to privilege escalation, denial-of-service (DoS), and command execution. The most severe of the flaws is CVE-2026-33784 (CVSS score of 9.8), a default password in the Support Insights (JSI) Virtual Lightweight Collector (vLWC) that could be exploited remotely to take over a vulnerable device. “vLWC software images ship with an initial password for a high-privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible,” Juniper Networks explains. Juniper Networks also resolved a weak password issue in CTP OS that could allow remote, unauthenticated attackers to potentially take full control of the device. Tracked as CVE-2026-33771, the security defect exists because settings related to password complexity requirements are not saved, leading to the use of weak passwords that could be guessed and exploited. A high-severity SSH host key validation vulnerability in Juniper Networks Apstra could be abused in machine-in-the-middle (MITM) attacks to capture user credentials. Multiple high-severity flaws in Junos OS could allow attackers to cause DoS conditions via crafted packets, directly access FPCs installed on devices, gain root privileges and take over devices, and execute commands to compromise managed devices. The remaining security defects addressed this week are medium-severity flaws that could allow attackers to cause DoS conditions, execute commands with elevated privileges, gain root privileges, impact the integrity of downstream networks, read sensitive information, bypass the configured firewall filter, or inject arbitrary shell commands as root. Juniper Networks says it is not aware of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s support portal. Related: Orthanc DICOM Vulnerabilities Lead to Crashes, RCE Related: Chrome 147 Patches 60 Vulnerabilities, Including Two Critical Flaws Worth $86,000 Related: Palo Alto Networks, SonicWall Patch High-Severity Vulnerabilities Related: Cisco Patches Critical and High-Severity Vulnerabilities

Juniper heeft een kwetsbaarheid verholpen in Junos OS Evolved draaiend op PTX Series apparaten. Een kwaadwillende kan deze kwetsbaarheid misbruiken om zijn rechten te verhogen. De kwetsbaarheid zit in de Flexible PIC Concentrators (FPC’s) van Juniper Networks Junos OS Evolved op PTX-systemen. De kwetsbaarheid kan leiden tot volledige compromittering van de Flexible PIC Concentrator component. De oorzaak ligt in onvoldoende access controls binnen de Junos OS Evolved omgeving op PTX Series hardware.

Aggiornamenti per prodotti Juniper Networks Alert AL03/260410/CSIRT-ITA Sintesi Juniper Networks rilascia aggiornamenti di sicurezza per sanare alcune vulnerabilità, di cui una con gravità “critica” e otto con gravità “alta”, in diversi prodotti. Le vulnerabilità, qualora sfruttate, potrebbero consentire ad un attaccante di eseguire codice arbitrario, l'ottenimento di privilegi più elevati e la compromissione della disponibilità del servizio sui sistemi interessati. Tipologia Arbitrary Code Execution Privilege Escalation Denial of Service Prodotti e/o versioni affette Junos OS MX Series 24.4, versioni precedenti la 24.4R2-S3 25.2, versioni precedenti la 25.2R2 Junos OS tutte le versioni precedenti la 23.2R2-S7 24.2, versioni precedenti la 24.2R1-S2, 24.2R2 24.4, versioni precedenti la 24.4R1-S2, 24.4R2 25.2, versioni precedenti la 25.2R2 Junos OS Evolved: tutte le versioni precedenti la 22.4R3-S7-EVO 23.2, versioni precedenti la 23.2R2-S4-EVO 23.4, versioni precedenti la 23.4R2-S6-EVO 24.2, versioni precedenti la 24.2R2-EVO 24.4, versioni precedenti la 24.4R1-S1-EVO, 24.4R2-EVO 25.2-EVO, versioni precedenti la 25.2R2-EVO Junos OS SRX Series tutte le versioni precedenti la 21.2R3-S10 21.3, tutte le versioni 21.4, versioni precedenti la 21.4R3-S12 22.1, tutte le versioni 22.2, versioni precedenti la 22.2R3-S8 22.4, tutte le versioni 23.2, versioni precedenti 23.2R2-S6 23.4, versioni precedenti 23.4R2-S7 24.2, versioni precedenti 24.2R2-S3 24.4, versioni precedenti 24.4R2-S3 25.2, versioni precedenti 25.2R1-S2, 25.2R2 Junos OS Evolved PTX Series Tutte le versioni precedenti la 21.2R3-S8-EVO 21.4-EVO, versioni precedenti la 21.4R3-S7-EVO 22.2-EVO, versioni precedenti la 22.2R3-S4-EVO 22.3-EVO, versioni precedenti la 22.3R3-S3-EVO 22.4-EVO, versioni precedenti la 22.4R3-S2-EVO 23.2-EVO, versioni precedenti la 23.2R2-EVO JSI vLWC Tutte le versioni precedenti la 3.0.94 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti. https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-MX-Series-Missing-Authorization-for-specific-request-CLI-commands-in-a-JDM-CSDS-scenario-CVE-2026-33785 https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-an-unsigned-Python-op-script-configuration-is-present-a-local-low-privileged-user-can-compromise-the-system-CVE-2026-33793 https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-SRX-Series-In-a-NAT64-configuration-receipt-of-a-specific-malformed-ICMPv6-packet-will-cause-the-srxpfe-process-to-crash-and-restart-CVE-2026-33790 https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-An-attacker-sending-a-specific-genuine-BGP-packet-causes-a-BGP-reset-CVE-2026-33797 https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-Evolved-Local-authenticated-attackers-can-gain-access-to-FPCs-CVE-2026-33788 https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-A-low-privileged-user-can-escalate-their-privileges-so-that-they-can-login-as-root-CVE-2026-21916 https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-vLWC-Default-password-is-not-required-to-be-changed-which-allows-unauthorized-high-privileged-access-CVE-2026-33784 https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-SRX-Series-MX-Series-When-a-specifically-malformed-first-ISAKMP-packet-is-received-kmd-iked-crashes-CVE-2026-33778 https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-CTP-OS-Configuring-password-requirements-does-not-work-which-permits-the-use-of-weak-passwords-CVE-2026-33771

A long-term and ongoing campaign attributed to a China-nexus threat actor has embedded itself in telecom networks to conduct espionage against government networks. The strategic positioning activity, which involves implanting and maintaining stealthy access mechanisms within critical environments, has been attributed to Red Menshen, a threat cluster that's also tracked as Earth Bluecrow, DecisiveArchitect, and Red Dev 18. The group has a track record of striking telecom providers across the Middle East and Asia since at least 2021. Rapid7 described the covert access mechanisms as "some of the stealthiest digital sleeper cells" ever encountered in telecommunications networks. The campaign is characterized by the use of kernel-level implants, passive backdoors, credential-harvesting utilities, and cross-platform command frameworks, giving the threat actor the ability to persistently inhabit networks of interest. One of the most recognized tools in its malware arsenal is a Linux backdoor called BPFDoor. "Unlike conventional malware, BPFdoor does not expose listening ports or maintain visible command-and-control channels," Rapid7 Labs said in a report shared with The Hacker News. "Instead, it abuses Berkeley Packet Filter (BPF) functionality to inspect network traffic directly inside the kernel, activating only when it receives a specifically crafted trigger packet." "There is no persistent listener or obvious beaconing. The result is a hidden trapdoor embedded within the operating system itself." The attack chains begin with the threat actor targeting internet-facing infrastructure and exposed edge services, such as VPN appliances, firewalls, and web-facing platforms associated with Ivanti, Cisco, Juniper Networks, Fortinet, VMware, Palo Alto Networks, and Apache Struts, to obtain initial access. Upon gaining a successful foothold, Linux-compatible beacon frameworks such as CrossC2 are deployed to facilitate post-exploitation activities. Also dropped are Sliver, TinyShell (a Unix backdoor), keyloggers, and brute-force utilities to facilitate credential harvesting and lateral movement. Central to Red Menshen's operations, however, is BPFDoor. It features two distinct components: One is a passive backdoor deployed on the compromised Linux system to inspect incoming traffic for a predefined "magic" packet by installing a BPF filter and spawning a remote shell upon receiving such a packet. The other integral part of the framework is a controller that's administered by the attacker and is responsible for sending the specially formatted packets. "The controller is also designed to operate within the victim’s environment itself," Rapid7 explained. "In this mode, it can masquerade as legitimate system processes and trigger additional implants across internal hosts by sending activation packets or by opening a local listener to receive shell connections, effectively enabling controlled lateral movement between compromised systems." What's more, certain BPFDoor artifacts have been found to support the Stream Control Transmission Protocol (SCTP), potentially enabling the adversary to monitor telecom-native protocols and gain visibility into subscriber behavior and location, and even track individuals of interest. These aspects demonstrate that the functionality of BPFdoor goes beyond a stealthy Linux backdoor. "BPFdoor functions as an access layer embedded within the telecom backbone, providing long-term, low-noise visibility into critical network operations," the security vendor added. It doesn't end there. A previously undocumented variant of BPFdoor incorporates architectural changes to make it more evasive and stay undetected for prolonged periods in modern enterprise and telecom environments. These include concealing the trigger packet within seemingly legitimate HTTPS traffic and introducing a novel parsing mechanism that ensures the string "9999" appears at a fixed byte offset within the request. This camouflage, in turn, allows the magic packet to stay hidden inside HTTPS traffic and avoid causing shifts to the position of data inside the request, and allows the implant to always check for the marker at a specific byte offset and, if it's present, interpret it as the activation command. The newly discovered sample also debuts a "lightweight communication mechanism" that uses the Internet Control Message Protocol (ICMP) for interacting between two infected hosts. "These findings reflect a broader evolution in adversary tradecraft," Rapid7 said. "Attackers are embedding implants deeper into the computing stack — targeting operating system kernels and infrastructure platforms rather than relying solely on user-space malware." "Telecom environments — combining bare-metal systems, virtualization layers, high-performance appliances, and containerized 4G/5G core components — provide ideal terrain for low-noise, long-term persistence. By blending into legitimate hardware services and container runtimes, implants can evade traditional endpoint monitoring and remain undetected for extended periods." Update In a follow-up analysis, Rapid7 said it discovered seven new BPFDoor variants: 'F,' 'G,' 'H,' 'I,' 'J,' 'K,' and 'L,' alongside two primary versions – httpShell and icmpShell – that tunnel the magic packet via HTTP and ICMP tunnels, respectively. "The newly identified features in BPFDoor samples highlight how TAs are tailoring and reusing BPFDoor’s code to the target environment," the cybersecurity company said. "Variant H (active beacon) stands out as it tries to blend in with the network traffic, contacting fake NTP update servers."

Researchers release tool to detect stealthy BPFDoor implants in critical infrastructure networks Telecommunications providers around the world have been dealing with the burrowing efforts of the China-linked APTs for many years now. To help them identify hard-to-detect implants used by the China-based group dubbed Red Menshen, Rapid7 researchers have released a scanning script. BPFdoor US, Canadian, European and Asian telcos have been repeatedly hit by the infamous Salt Typhoon group in the past few years. Red Menshen has been previously observed using the BPFDoor implant/backdoor when targeting telecommunications providers across Asia and the Middle East, as well as organizations in the finance and retail sectors. Initial access is usually gained by exploiting known vulnerabilities in edge networking devices and VPN products or by leveraging compromised accounts. But, once inside, Red Menshen attackers are retaining long-term access by placing hard-to-detect kernel-level implants like BPFdoor and passive backdoors like TinyShell. “What makes BPFdoor particularly unique is its ability to operate at the kernel level without exposing a traditional network footprint,” Christiaan Beek, VP of Cyber Intelligence at Rapid7, told Help Net Security. This unconventional Linux malware abuses Berkeley Packet Filter (BPF) functionality to inspect network traffic directly inside the kernel, and passively listens for specially crafted network packets (aka “magic packets”) that will activate it. BPFDoor activation relying on magic packets (Source: Rapid7) Rapid7 researchers fittingly describe this type of implant as “sleeper cells” – waiting to spring into action when called, but otherwise laying dormant and blending into the environment. When triggered, BPFdoor spawns a bind shell or reverse shell. The researchers have analyzed a number of BPFdoor samples and have discovered that older and newer variants: Use code to masquerade as legitimate system services that run bare-metal infrastructure commonly deployed in telecom environments Spoof core containerization components Are capable of monitoring telecom-native protocols such as the Stream Control Transmission Protocol Don’t just rely on magic packets to spring into action, but can also be triggered with packets embedded within seemingly legitimate (encrypted) HTTPS traffic Use older or non-standard encryption routines to confuse inspection systems Use specially crafted Internet Control Message Protocol (ICMP) payloads to signal back to the operator, but also to pass execution instructions from one compromised host to another These techniques target different security boundaries, “from TLS inspection at the edge to IDS detection in transit and endpoint monitoring on the host, illustrating a deliberate effort to operate across the full defensive stack,” the researchers pointed out. A BPFDoor detection script BPFdoor isn’t the only “magic packet” malware out there: there’s the SEASPY backdoor targeting Barracuda Networks’ Email Security Gateway appliances, and the J-magic backdoor that’s been loaded by attackers into enterprise-grade Juniper router. Symbiote, a Linux userland-level rootkit/backdoor, is also capable of kernel packet filtering and hiding malicious network traffic from packet capture tools. In complex and noisy telecom environments, implants like BPFdoor are difficult to catch as – according to Rapid7 – many organizations lack visibility into kernel-level operations, raw packet filtering behavior, and anomalous high-port network activity on Linux systems. “Unlike most backdoors, [BPFdoor] doesn’t rely on open ports or persistent connections. You’re essentially trying to identify malicious behavior hidden inside otherwise normal network traffic. It’s like looking for a needle that looks and smells like hay, while the haystack itself keeps changing,” Beek added. Company researchers have therefore created a scanning script designed to detect known/analyzed BPFDoor variants across Linux environments, and are offering it to defenders. “The script is highly effective at identifying known patterns and behaviours we’ve validated in real samples,” Beek told us. That said, it can miss highly stealthy or evolving variants and may flag unusual but legitimate activity, so it should be used as part of a broader detection strategy. Unfortunately, the point of this type of threat is that organizations can’t be 100% certain that they’ve removed them all. “These threats shift the conversation from ‘Did we remove it?’ to ‘Do we have enough visibility to trust the system again?’,” he added. As their research is ongoing, Rapid7 may or may not create a detection tool for similar threats like Symbiote. “Rather than chasing individual malware families, we’re focusing on detecting the underlying techniques such as kernel-level stealth and covert network behaviour across multiple threats,” Beek concluded. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

SAP has released security updates to address two critical security flaws that could be exploited to achieve arbitrary code execution on affected systems. The vulnerabilities in question listed below - CVE-2019-17571 (CVSS score: 9.8) - A code injection vulnerability in SAP Quotation Management Insurance application (FS-QUO) CVE-2026-27685 (CVSS score: 9.1) - An insecure deserialization vulnerability in SAP NetWeaver Enterprise Portal Administration "The application uses an outdated artifact of Apache Log4j 1.2.17 that is vulnerable to CVE-2019-17571," SAP security company Onapsis said. "It allows an unprivileged attacker to execute arbitrary code remotely on the server, causing high impact on confidentiality, integrity, and availability of the application." CVE-2026-27685, on the other hand, stems from missing or insufficient validation during the deserialization of uploaded content, which could allow an attacker to upload untrusted or malicious content. "Only the fact that an attacker requires high privileges for a successful exploit prevents the vulnerability from being tagged with a CVSS score of 10," Onapsis added. The disclosure comes as Microsoft shipped patches for 84 vulnerabilities across products, including dozens of privilege escalation and remote code execution flaws. On Tuesday, Adobe also announced patches for 80 vulnerabilities, four of which are critical flaws impacting Adobe Commerce and Magento Open Source that could result in privilege escalation and security feature bypass. Separately, it fixed five critical vulnerabilities in Adobe Illustrator that could pave the way for arbitrary code execution. Elsewhere, Hewlett Packard Enterprise put out fixes for five shortcomings in Aruba Networking AOS-CX. The most severe of the flaws is CVE-2026-23813 (CVSS score: 9.8), an authentication bypass affecting the management interface. "A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls," HPE said. "In some cases, this could enable resetting the admin password." "Exploitation of this Aruba vulnerability potentially gives attackers full control of AOS-CX network devices and the ability to compromise an entire system undetected," Ross Filipek, CISO at Corsica Technologies, said in a statement. "A successful compromise could lead to the disruption of network communications or the erosion of the integrity of key business services. This flaw is a reminder that vulnerabilities in network devices are becoming more common in today's hyper-connected world. When attackers gain privileged access to these devices, it puts organizations at significant risk." Software Patches from Other Vendors Security updates have also been released by other vendors over the past few weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD Arm Atlassian Bosch Broadcom (including VMware) Canon Cisco Commvault Dassault Systèmes Dell Devolutions Drupal Elastic F5 Fortinet Fortra Foxit Software GitLab Google Android and Pixel Google Chrome Google Cloud Google Pixel Watch Google Wear OS Grafana Hitachi Energy Honeywell HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Intel Ivanti Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric Moxa Mozilla Firefox, Firefox ESR, and Thunderbird n8n NVIDIA Palo Alto Networks QNAP Qualcomm Ricoh Samsung Schneider Electric ServiceNow Siemens SolarWinds Splunk Synology TP-Link Trend Micro WatchGuard Western Digital Zoom, and Zyxel

Google says 90 zero-days exploited in 2025 as commercial vendor activity grows Commercial surveillance vendors are increasingly leading the charge in exploiting zero-day vulnerabilities according to a new report. Google Threat Intelligence Group said it tracked 90 zero-day vulnerabilities that were exploited by a variety of actors last year, surpassing the 78 that were used by threat actors in 2024. The company defines zero-days as vulnerabilities that were maliciously exploited in the wild before a patch could be released publicly. Of the 90 zero-days tracked last year, GTIG was able to directly attribute exploitation for 42 of them — finding that 18 were either definitively or likely used by commercial surveillance vendors. Fifteen were deployed or likely deployed by state-sponsored espionage groups based in China, Russia, the UAE and other countries. The two groups focused their efforts on different technologies, with state-sponsored groups prioritizing edge devices and security appliances like routers or firewalls that enable access to an organization’s network. Commercial surveillance vendors primarily targeted mobile devices and browsers — aiming to sell tools that allow for the breach of personal technology. Mobile device zero-days have fluctuated wildly over the last three years, dropping from 17 to 9 between 2023 and 2024, and then rebounding to 15 in 2025. Microsoft technology had the largest number of zero-days followed by Google and Apple, according to the report. Nation-state targeting Throughout 2025, government agencies across the U.S. and Europe raised alarms about zero-day vulnerabilities in security tools from companies like Ivanti, Cisco, Fortinet and others. The GTIG report focuses on zero-days developed by espionage groups based in the People’s Republic of China, noting that in comparison to other state-backed actors, Chinese groups “remained the most prolific users of zero-day vulnerabilities in 2025.” The groups “continued to focus heavily on security appliances and edge devices to maintain persistent access to strategic targets.” Edge devices have been repeatedly targeted by state-backed groups because many routers, switches and security appliances sit on the perimeter of an organization's infrastructure and typically lack endpoint detection and response security coverage — serving as a blind spot for defenders. One month ago, U.S. officials ordered all federal civilian agencies to remove edge devices that no longer receive vendor updates to firmware or other security patches. GTIG noted its previous reporting on a campaign involving the Brickstorm malware that was attributed to Chinese state-backed groups. The researchers warned that the campaign marked a “new paradigm for zero-day exploitation where data theft has the potential to enable long-term zero-day development.” “Instead of just exfiltrating sensitive client data, the threat actors targeted intellectual property from the victim companies, potentially including source code and proprietary development documents,” the researchers said. “This IP could be used to discover new vulnerabilities in the vendor's software, not only posing a threat to the victims themselves but also to victims’ downstream customers.” Key examples of Chinese exploitation included Juniper Networks’ CVE-2025-21590 and Ivanti’s CVE-2025-0282. The report adds that there have been shifts in Chinese behavior regarding zero-days. Chinese groups typically provided zero-days to a small group of well-resourced threat actors but now “an increasing number of activity clusters are exploiting vulnerabilities closer to public disclosure, indicating that PRC-nexus espionage operators have potentially reduced the time to both develop exploits and distribute them among otherwise separate groups.” Commercial vendors and criminals Mobile operating system exploitation saw increases in the number of zero-days last year in part because commercial surveillance vendors created exploit chains involving three or more vulnerabilities. Google has long warned of the increasing role commercial surveillance vendors are playing in the zero-day industry, highlighting the work of companies like Intellexa in providing “extremely capable spyware to high paying customers” that “erode civil liberties and human rights.” “This is reflected not only in the gradual proliferation of exploit code targeting specific vulnerabilities, but also by the shrinking gap between the public disclosure of n-day vulnerabilities and their widespread exploitation by multiple groups,” they wrote. Boris Cipot, senior security engineer at security firm Black Duck, said that the exploits and capabilities outlined in the report are becoming more widely accessible and less confined to traditional intelligence services. When asked who the end user is for zero-days developed by commercial vendors, Clement Lecigne, security engineer at GTIG, said most of the companies they track “primarily sell to nation-states.” GTIG also tracked nine zero-days developed and exploited by financially-motivated hackers, including a headline-grabbing bug impacting Oracle E-Business Suite that was developed by a hacker claiming affiliation with the Clop extortion cybercriminal group. The group sent extortion emails to hundreds of organizations after exploiting CVE-2025-61882 and CVE-2025-61884 in August 2025. The researchers also found overlaps between state-sponsored groups and financially-motivated actors, noting that it saw hackers connected to Russia-based group Evil Corp using CVE-2025-8088 to distribute malware. The same bug was also used in attacks by the RomCom group — which has conducted both financially-motivated attacks and espionage operations. GTIG senior vulnerability intelligence analyst Casey Charrier said the new landscape “is largely defined by expanded access to zero-day capabilities, interwoven with the drastic movement we’ve seen over multiple years towards exploitation of more diversified vendors and products, a shift from which threat actors are certainly seeing success.” “The struggle to protect highly privileged edge devices remains a critical gap; security flaws in these high-value assets continue to serve as leverage for wide-scale exploitation,” Charrier said. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

This week is not about one big event. It shows where things are moving. Network systems, cloud setups, AI tools, and common apps are all being pushed in different ways. Small gaps in access control, exposed keys, and normal features are being used as entry points. The pattern becomes clear only when you see everything together. Faster scans, smarter misuse of trusted services, and steady targeting of high-value sectors. Each story adds context. Reading them all gives a fuller picture of how today’s threat landscape is evolving. ⚡ Threat of the Week Cisco SD-WAN Zero-Day Exploited — A newly disclosed maximum-severity security flaw in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Catalyst SD-WAN Manager (formerly vManage) has come under active exploitation in the wild as part of malicious activity that dates back to 2023. The vulnerability, tracked as CVE-2026-20127 (CVSS score: 10.0), allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges on an affected system by sending a crafted request. Cisco credited the Australian Signals Directorate's Australian Cyber Security Centre (ASD-ACSC) for reporting the vulnerability. The networking equipment major is tracking the exploitation and subsequent post-compromise activity under the moniker UAT-8616, describing the cluster as a "highly sophisticated cyber threat actor." Control Your AI Agents Before They Control You Airia is the governance and orchestration layer for enterprise AI. Monitor drift, enforce policy, optimize inference cost, and generate audit-ready evidence—so your AI scales securely, compliantly, and profitably. Request a Demo ➝ 🔔 Top News Anthropic Accuses 3 Chinese Firms of Distillation Attacks — Anthropic accused three Chinese AI firms of engaging in concerted "industrial-scale" distillation attack campaigns aimed at extracting information from its model, making it the latest American tech firm to level such claims after OpenAI issued similar complaints. DeepSeek, Moonshot AI, and MiniMax are said to have flooded Claude with large volumes of specially-crafted prompts to elicit responses to train their own proprietary models. Last month, OpenAI submitted an open letter to U.S. legislators, claiming to have observed activity "indicative of ongoing attempts by DeepSeek to distill frontier models of OpenAI and other U.S. frontier labs, including through new, obfuscated methods." The disclosure renewed a debate over training data sources and distillation techniques, with some criticizing the company for training its own systems using copyrighted material without permission. "Anthropic is guilty of stealing training data at a massive scale and has had to pay multibillion-dollar settlements for their theft," xAI CEO Elon Musk said. Google Disrupts UNC2814 GRIDTIDE Campaign — Google disclosed that it worked with industry partners to disrupt the infrastructure of a suspected China-nexus cyber espionage group tracked as UNC2814 that breached at least 53 organizations across 42 countries. The tech giant described UNC2814 as a prolific, elusive actor that has a history of targeting international governments and global telecommunications organizations across Africa, Asia, and the Americas. Central to the hacking group's operations is a novel backdoor dubbed GRIDTIDE that abuses Google Sheets API as a communication channel to disguise C2 traffic and facilitate the transfer of raw data and shell commands. Chinese cyber espionage groups have consistently prioritized the telecommunication sector as a target precisely because of the access their networks provide to sensitive data and lawful intercept infrastructure. Thousands of Public Google Cloud API Keys Exposed with Gemini Access — New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data. The problem occurs when users enable the Gemini API on a Google Cloud project (i.e., Generative Language API), causing the existing API keys in that project, including those accessible via the website JavaScript code, to gain surreptitious access to Gemini endpoints without any warning or notice. With a valid key, an attacker can access uploaded files, cached data, and even rack up LLM usage charges, Truffle Security said. The issue has since been plugged by Google. UAT-10027 Targets U.S. Education and Healthcare Sectors — A previously undocumented threat activity cluster known as UAT-10027 has been attributed to an ongoing malicious campaign targeting education and healthcare sectors in the U.S. since at least December 2025. The end goal of the attacks is to deliver a never-before-seen backdoor codenamed Dohdoor. "Dohdoor utilizes the DNS-over-HTTPS (DoH) technique for command-and-control (C2) communications and has the ability to download and execute other payload binaries reflectively," Cisco Talos said. Analysis of the campaign has revealed no evidence of data exfiltration to date. Although no final payloads have been observed other than what appears to be the Cobalt Strike Beacon to backdoor into the victim's environment, it's believed that UAT-10027's actions are likely driven by financial gain based on the victimology pattern. Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration — Security vulnerabilities in Anthropic Claude Code could have allowed attackers to remotely execute code on users' machines and steal API keys by injecting malicious configurations into repositories, and then waiting for an unsuspecting developer to clone and open an untrustworthy project. The vulnerabilities were addressed between September 2025 and January 2026. "The ability to execute arbitrary commands through repository-controlled configuration files created severe supply chain risks, where a single malicious commit could compromise any developer working with the affected repository," Check Point said. "The integration of AI into development workflows brings tremendous productivity benefits, but also introduces new attack surfaces that weren't present in traditional tools." ️🔥 Trending CVEs New vulnerabilities surface daily, and attackers move fast. Reviewing and patching early keeps your systems resilient. Here are this week’s most critical flaws to check first — CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, CVE-2025-40541 (SolarWinds Serv-U), CVE-2026-20127, CVE-2026-20122, CVE-2026-20126, CVE-2026-20128 (Cisco Catalyst SD-WAN), CVE-2026-25755 (jsPDF), CVE-2025-12543 (HPE Telco Service Activator), CVE-2026-22719, CVE-2026-22720, CVE-2026-22721 (Broadcom VMware Aria Operations), CVE-2026-3061, CVE-2026-3062, CVE-2026-3063 (Google Chrome), CVE-2025-10010 (CryptoPro Secure Disk for BitLocker), CVE-2025-13942, CVE-2025-13943, CVE-2026-1459 (Zyxel), CVE-2025-71210, CVE-2025-71211 (Trend Micro Apex One), CVE-2026-0542 (ServiceNow AI Platform), CVE-2026-24061 (telnetd), CVE-2026-21902 (Juniper Networks Junos OS), CVE-2025-29631, CVE-2025-1242 (Gardyn Home Kit), CVE-2025-15576 (FreeBSD), CVE-2026-26365 (Akamai), CVE-2026-27739 (Angular), and SVE-2025-50109 (Samsung Tizen OS). 🎥 Cybersecurity Webinars Automating Real-World Security Testing to Prove What Actually Works → This webinar explains why one-time security assessments are no longer enough and shows how organizations can automate continuous, real-world testing of their defenses to uncover gaps and measure how well controls hold up against actual attack techniques. When AI Agents Become Your New Attack Surface → This webinar explains that as AI tools turn into autonomous agents that can browse, call APIs, and access internal systems, the security risk expands beyond the model to the entire environment they operate in, requiring stricter access controls, monitoring, and system-level safeguards rather than model testing alone. Quantum Is Coming: Preparing for the End of Today’s Encryption → This webinar explains how future quantum computers could break today’s encryption, why “harvest now, decrypt later” attacks are a real risk, and what practical steps organizations can take now to begin shifting to post-quantum cryptography. 📰 Around the Cyber World UNC6384 Drops New PlugX Variant — IIJ-SECT and LAB52 have detailed new activity from the Chinese cyber espionage group UNC6384. The attacks follow a known modus operandi of using STATICPLUGIN, a digitally signed downloader, to deliver updated versions of PlugX using DLL side-loading. The malicious payloads are distributed via phishing emails with meeting invitation lures or through fake software updates. OpenAI Takes Action Against ChatGPT Accounts Used for Harmful Purposes — OpenAI said it took down ChatGPT accounts used for influence operations, phishing, and malware development. This included a possible Chinese intelligence operation in which an individual associated with Chinese law enforcement used the AI tool for covert influence operations against domestic and foreign adversaries. The company also acted against clusters conducting reconnaissance about U.S. persons and federal building locations, online romance scams, and Russian influence operations across Africa by generating social media posts and long-form commentary articles. "Unusually, this scam network combined manual ChatGPT prompting and an automated AI chatbot to try to entrap its targets," OpenAI said about the scam operation running out of Cambodia. Some of these scams targeted Indonesian loveseekers. Other scams used ChatGPT to create content that purported to come from fictitious law firms, as well as impersonate real attorneys and U.S. law enforcement as part of a recovery scam targeting fraud victims. AI-Induced Lateral Movement — New research from Orca Security has highlighted how AI can become a "third dimension" in the world of lateral movement, after network and identity, allowing attackers to expand their reach. "By injecting prompt injections in overlooked fields that are fetched by AI agents, hackers can trick LLMs, abuse Agentic tools, and carry out significant security incidents," Orca said. "LLMs don’t truly understand the difference between data and instructions, and when tool output is fed back into the model, it can be interpreted as something to act on. Which opens a window to AI-induced Lateral Movement (AILM) activities." Russia Launches Probe into Telegram CEO — Russian authorities launched a criminal investigation of Telegram founder and CEO Pavel Durov. He is allegedly charged with promoting and facilitating terrorist activity on the messaging platform by failing to respond to law enforcement takedown requests. Russian officials have accused Durov of choosing a "path of violence and permissiveness" by not cooperating with its law enforcement agencies, according to the Rossiyskaya Gazeta. The move comes after Russia began restricting access to Telegram in the country in favor of MAX. Last month, Durov called it an "attempt to force its citizens to switch to a state-controlled app built for surveillance and political censorship." Hacked Prayer App Sends Surrender Messages — According to reports from The Wall Street Journal and WIRED, unidentified hackers seized control of an Iranian prayer app during a joint U.S.-Israeli attack to send messages urging the Iranian military to lay down their weapons and promising amnesty if they surrendered. The messages were sent in the form of push notifications to the BadeSaba Calendar app. It's currently not clear who is behind the hack. The app has been downloaded more than 5 million times from the Google Play Store. Following the U.S.-Israel war on Iran, the government shut down all internet access in the country. Smart TVs Turned Into AI Content Scrapers — Several smart TV app makers are deploying a new SDK named Bright SDK that lets users see fewer ads but also stealthily turns their TV into a node in a global proxy network that crawls and scrapes the web. Bright Data, the company behind the SDK, claims to operate more than 150 million residential proxy IP addresses spanning 195 countries. Multiple Stealer Malware Families Detected — Multiple information stealer families have been detected in the wild. This includes Arkanix, CharlieKirk GRABBER, ComSuon, DarkCloud, MawaStealer, and MioLab (NovaStealer). Kaspersky's analysis of Arkanix has revealed that it was likely developed as an LLM-assisted experiment, shrinking development time and costs. While Arkanix was promoted on underground forums in October 2025, the malware-as-a-service (MaaS) appears to have been taken down towards the end of 2025. The findings demonstrate continued demand for off-the-key stealer malware, creating an ecosystem that enables other threat actors to purchase stealer logs for obtaining initial access to targets. "Raw Infostealer logs are meticulously filtered by corporate domain, packaged, and sold to initial access brokers and attackers specifically looking for frictionless entry points into high-value corporate networks," Hudson Rock said. The development has been complemented by underground networks turning into cybercrime marketplaces, complete with reputation systems, escrow, and specialist vendors, Varonis added. "One operator runs infostealers across thousands of machines. Another extracts and sorts the credentials. A third sells curated access," security researcher Daniel Kelley said. "A fourth deploys the ransomware. Each person focuses on what they do best, and the ecosystem has become ruthlessly efficient." Chilean National Extradited to U.S. to Face Financial Fraud Crimes — Alex Rodrigo Valenzuela Monje (aka VAL4K), a 24-year-old Chilean national, has been extradited to the U.S. over his alleged role in running a cybercrime operation that involved the trafficking of payment card data. The defendant is accused of trafficking stolen credit card numbers and information for over 26,500 credit cards. "From at least May 2021 to August 2023, Valenzuela Monje operated an illegal online card shop, selling dumps of unauthorized access devices through Telegram channels," the U.S. Justice Department said. "He allegedly operated the channels known as MacacoCC Collective and Novato Carding, offering payment card data for virtually all U.S. payment cards." New FUNNULL Infrastructure Discovered — QiAnXin has flagged new infrastructure associated with FUNNULL, a Philippines-based content delivery network (CDN) sanctioned last year by the U.S. Treasury for facilitating cyber scam operations. "Previously, their main method was to poison existing public CDN services; now they have evolved to independently develop complete server-side attack suites (RingH23), actively infiltrating CDN nodes, demonstrating a significant improvement in control and technical sophistication," QiAnXin XLab said. Two independent supply chain infection channels have been identified: the compromise of maccms.la to distribute a malicious PHP backdoor through its update channel, and the compromise of the GoEdge CDN management node to implant an infection module, and deploy the proprietary RingH23 attack suite to all edge nodes via SSH remote commands. The campaign has compromised 10,748 unique IP addresses, predominantly video streaming sites. Spike in Scans for SonicWall Devices — GreyNoise said it detected a spike in scans for SonicWall devices originating from the infrastructure of a known proxy provider. The activity started on February 22, 2026, and scanned for exposed SonicWall SSL VPNs. A total of 84,142 scanning sessions targeting SonicWall SonicOS infrastructure were observed between February 22 and February 25, 2026. The scanning came from 4,305 unique IP addresses across 20 autonomous systems. "Ninety-two percent of sessions probed a single API endpoint to determine whether SSL VPN is enabled — the prerequisite check before credential attacks," GreyNoise said. "A commercial proxy service delivered 32% of campaign volume through 4,102 rotating exit IPs in two surgical bursts totaling 16 hours." Google Removes 115 Android Apps Tied to Ad Fraud — A new ad fraud operation dubbed Genisys involved hijacking Android devices to run malicious activity in the background. The activity leveraged a set of 115 apps that stealthily opened websites inside hidden browser windows to generate ad display revenue for their creators. More than 500 domains were generated using AI tools to serve the ads. "They appear as generic blogs, news-style sites, and informational properties produced at scale, built not to attract real audiences but to receive and monetize fraudulent traffic," Integral Ads said. The apps have since been removed by Google. The findings build on another mobile ad fraud scheme called Arcade in which mobile apps generated hidden in-app browser activity to load websites in the background and convert mobile-origin activity into web traffic. Zerobot Exploits Flaws in n8n and Tenda Routers — A Mirai-based IoT botnet named Zerobot has been observed exploiting vulnerabilities in the n8n AI automation platform (CVE-2025-68613) and Tenda routers (CVE-2025-7544) to expand its reach. The activity was first detected in January 2026. "Targeting of the n8n vulnerability is particularly interesting: Botnets typically exploit Internet of Things (IoT) devices, such as security cameras, DVRs, and routers, but n8n falls into an entirely different category," Akamai said. "Although this isn’t entirely new behavior for botnets, this sort of targeting presents a greater danger to organizations by exposing more critical infrastructure to compromise as the n8n exploit could enable lateral movement for a threat actor." Various ClickFix Campaigns Spotted — Threat hunters disclosed multiple ClickFix campaigns, including one leading to a hands-on-keyboard attack that deployed the Termite ransomware. The attack has been attributed to a group known as Velvet Tempest (DEV-0504). Another ClickFix campaign, codenamed OCRFix, used websites impersonating the Tesseract OCR tool as a launchpad for delivering malware that uses EtherHiding to retrieve the C2 server, send system information, and await further instructions. A third campaign has been found employing fake GitHub repositories impersonating software companies and leveraging ClickFix to social-engineer victims into installing infostealers, such as SHub Stealer v2.0. GTFire Phishing Scheme Detailed — A phishing campaign dubbed GTFire is abusing Google Firebase to host phishing pages and Google Translate to disguise the malicious URLs and bypass email and web security filters. "By chaining these services together, the attackers create phishing links that appear benign, leverage Google’s reputation, and dynamically redirect victims to brand‑impersonating login pages," Group-IB said. "Once credentials are submitted and harvested, victims are often redirected back to the legitimate website of the targeted organization, reducing suspicion and delaying incident response." The campaign is estimated to have harvested thousands of stolen credentials associated with more than a thousand organizations, spanning over a hundred countries and hundreds of industries. The threat actor behind the operation has been active since at least January 1, 2022. Mexico, the U.S., Spain, India, and Argentina are among the prominent targets. C77L Ransomware Targets Russia — A ransomware operation called C77L has been tied to at least 40 attacks on Russian and Belarusian enterprises since March 2025. The group is assessed to be operating out of Iran. Initial access to target networks is accomplished via weak passwords for publicly available RDP and VPN endpoints. "The targets of attacks are Windows systems due to their overwhelming predominance in the IT infrastructures of medium and small businesses," F6 said. RESURGE Malware Can Be Dormant on Infected Ivanti Devices — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its original alert for RESURGE, a piece of malware deployed as part of exploitation activity targeting a now-patched security flaw in Ivanti Connect Secure (ICS) appliances. The agency said "RESURGE has sophisticated network-level evasion and authentication techniques, leveraging advanced cryptographic methods and forged TLS certificates to facilitate covert communications," adding "RESURGE can remain latent on systems until a remote actor attempts to connect to the compromised device." 30 Members of The Com Arrested — A coordinated law enforcement operation led by Europol detained 30 individuals connected to an underground online community known as The Com. The operation, launched in January 2025, has been codenamed Project Compass. An additional 179 members were also identified as part of the investigation. The Com is the name assigned to a loose-knit cybercrime collective that has been linked to online doxxing, harassment, threats of violence, extortion, sexual exploitation, phishing, SIM swapping, ransomware, and other digital crimes. Europol described The Com as a decentralized extremist network. U.K. Government Cuts Cyber Attack Fix Times by 84% — The U.K. government has claimed it has reduced its backlog of critical vulnerabilities by 75% and reduced cyber attack fix times by 87%. Serious security weaknesses in public sector websites are fixed six times faster, cutting the average time from nearly two months to just over a week, the U.K. government said in an update published on 26 February. Poland Dismantles Organized Crime Group — Poland's Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group that used phishing to take control of Facebook accounts and extract BLIK payment codes from victims. Eleven members of an organized criminal group operating in Poland and Germany between May 2022 and May 2024 were identified. Six suspects have been placed in pretrial detention as part of the investigation, and over 100,000 credentials were seized. The group used "phishing techniques to obtain login details for Facebook accounts, and then gained access to them and used instant messaging to extort BLIK codes from other users of the portal," CBZC said. Hacker Exploits Clade to Target Mexican Government Sites — An unknown hacker exploited Anthropic's Claude chatbot to carry out attacks against Mexican government agencies, according to a report by Gambit Security. "Within a month of the initial compromise, ten government bodies and one financial institution were affected, approximately 195 million identities exposed, and roughly 150GB of data exfiltrated: tax records, civil registry files, voter data," the company said. "The attacker even built an automated system that forges official government tax certificates using live data. It was orchestrated by an individual actor directing AI to operate as a nation-state-level team of operators and analysts." The operation ran on more than 1,000 prompts and regularly passed information to OpenAI's GPT-4.1 for analysis. The breach began in late December 2025 and continued for about a month. Anthropic has since disrupted the activity and banned all of the accounts involved. The attacks haven't been attributed to a specific group. 🔧 Cybersecurity Tools Titus → It is an open-source tool from Praetorian that scans code, files, repositories, and traffic to find leaked credentials like API keys and tokens. It uses hundreds of pattern rules and can check whether a detected secret is actually active. You can run it as a command-line tool, use it inside other tools as a Go library, or use it as extensions in Burp Suite or a browser to uncover credential leaks in different workflows. Sirius → It is an open-source vulnerability scanning platform on GitHub that automates network and system security checks to find weaknesses and risks in infrastructure. It combines community-driven security data with automated tests, runs within containers, and gives operators a unified view of vulnerabilities to prioritize remediation. Disclaimer: These tools are provided for research and educational use only. They are not security-audited and may cause harm if misused. Review the code, test in controlled environments, and comply with all applicable laws and policies. Conclusion Viewed one by one, these incidents seem contained. Seen together, they show how risk now flows across connected systems that organizations rely on daily. Infrastructure, AI platforms, cloud services, and third-party tools are deeply intertwined, and strain in one area often exposes another. The takeaway is clarity, not alarm. Adversaries are improving efficiency, scaling access, and operating inside normal processes. Reading through each report helps map that shift and understand how the broader environment is changing.

Juniper Networks this week released an out-of-band update for its Junos OS Evolved network operating system to patch a critical vulnerability. The vulnerability, tracked as CVE-2026-21902, affects Junos OS Evolved on PTX series high-performance routers. The issue impacts the On-Box Anomaly detection framework and it can be exploited by an unauthenticated attacker with network access to execute arbitrary code with root privileges. “The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port,” Juniper said in its advisory. The company added, “With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device. Please note that this service is enabled by default as no specific configuration is required.” The security hole has been patched with the release of versions 25.4R1-S1-EVO and 25.4R2-EVO. Junos OS Evolved versions prior to 25.4R1-EVO and Junos OS are not affected. “If an attacker gains control of a PTX, the impact is bigger than a single device compromise because it can become a traffic vantage point and a control point at the same time,” explained Piyush Sharma, co-founder and CEO of Tuskira. “This opens the door to the stealthy interception of data flows, controller redirected traffic, or easy pivots into adjacent networks.” Juniper Networks said CVE-2026-21902 was discovered internally and there is no evidence of in-the-wild exploitation. However, it’s not uncommon for threat actors to exploit vulnerabilities in Juniper products in their attacks. CISA’s KEV catalog currently includes eight flaws whose exploitation was observed in recent years. “Juniper vulnerabilities have attracted a lot of attention from hackers over the years, due largely in part to the premium positioning they provide if long-term footholds are established,” Sharma said. Related: Juniper Networks Patches Critical Junos Space Vulnerabilities Related: Mandiant Uncovers Custom Backdoors on End-of-Life Juniper Routers Related: Juniper Networks Patches Dozens of Junos Vulnerabilities Related: Juniper Networks Fixes High-Severity Vulnerabilities in Junos OS

Juniper heeft een kwetsbaarheid verholpen in Junos OS Evolved (Specifiek voor PTX Series apparaten). De kwetsbaarheid bevindt zich in het On-Box Anomaly detection framework van Junos OS Evolved dat draait op PTX Series apparaten. De oorzaak is een onjuiste toewijzing van rechten die ongeauthenticeerde externe aanvallers in staat stelt om code met rootprivileges uit te voeren. Deze kwetsbaarheid kan op afstand via het netwerk worden misbruikt zonder authenticatie, wat aanvallers volledige controle over het apparaat geeft. Het On-Box Anomaly Detection-framework mag uitsluitend door interne processen via de interne routinginstantie worden benaderd en niet via een extern blootgestelde poort. Om het risico op misbruik te verkleinen heeft Juniper een oplossing beschikbaar gesteld. Toegang dient te worden beperkt tot alleen vertrouwde netwerken en hosts met behulp van toegangslijsten of firewallfilters, waarbij uitsluitend de expliciet vereiste verbindingen worden toegestaan en alle overige verbindingen worden geblokkeerd. Als alternatief kan deze service volledig worden uitgeschakeld met het commando: request pfe anomalies disable.

A critical vulnerability in the Junos OS Evolved network operating system running on PTX Series routers from Juniper Networks could allow an unauthenticated attacker to execute code remotely with root privileges. PTX Series routers are high-performance core and peering routers built for high throughput, low latency, and scale. They are commonly used by internet service providers, telecommunication services, and cloud network applications. The security issue is identified as CVE-2026-21902 and is caused by incorrect permission assignment in the ‘On-Box Anomaly Detection’ framework, which should be exposed to internal processes only over the internal routing interface. However, the glitch allows accessing the framework over an externally exposed port, Juniper Networks explains in a security advisory. Because the service runs as root and is enabled by default, successful exploitation would allow an attacker who is already on the network to take full control of the device without authentication. The issue affects Junos OS Evolved versions before 25.4R1-S1-EVO and 25.4R2-EVO, on PTX Series routers. Older versions may also be impacted, but the vendor does not assess releases that have reached the end-of-engineering or end-of-life (EoL) phase. Versions before 25.4R1-EVO, and standard (non-Evolved) Junos OS versions are not impacted by CVE-2026-21902. Juniper Networks has delivered fixes in versions 25.4R1-S1-EVO, 25.4R2-EVO, and 26.2R1-EVO of the product. Juniper's Security Incident Response Team (SIRT) states that it was not aware of malicious exploitation of the vulnerability at the time of publishing the security bulletin. If immediate patching is not possible, the vendor's recommendation is to restrict access to the vulnerable endpoints to trusted networks only using firewall filters or Access Control Lists (ACLs). Alternatively, administrators may disable the vulnerable service entirely using: 'request pfe anomalies disable' Juniper Networks products are typically an attractive target for advanced hackers as the network equipment is used by service providers requiring high bandwidth, such as cloud data centers and large enterprises. In March 2025, it was revealed that Chinese cyber-espionage actors were deploying custom backdoors on EoL Junos OS MX routers to drop a set of ‘TinyShell’ backdoor variants. In January 2025, a malware campaign dubbed ‘J-magic’ targeted Juniper VPN gateways used in the semiconductor, energy, manufacturing, and IT sectors, deploying network-sniffing malware that activated upon receiving a “magic packet.” In December 2024, Juniper Networks Smart routers became targets of Mirai botnet campaigns, getting enlisted in distributed denial of service (DDoS) swarms. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Aggiornamenti di sicurezza per prodotti Juniper Networks Alert AL01/260226/CSIRT-ITA Sintesi Juniper Networks rilascia aggiornamenti di sicurezza per sanare una vulnerabilità con gravità “critica”, che interessa Juniper Junos OS Evolved su dispositivi della serie PTX. La vulnerabilità, qualora sfruttata, permetterebbe ad un attaccante remoto non autenticato di eseguire codice arbitrario con i massimi privilegi di sistema. Tipologia Remote Code Execution Authentication Bypass Descrizione e potenziali impatti Nel dettaglio, tale vulnerabilità, di tipo Incorrect Permission Assignment for Critical Resource, deriva da un’errata assegnazione di permessi ad una componente interna denominata On-Box Anomaly detection framework. A causa di tale configurazione impropria, il servizio risulta raggiungibile tramite una porta esposta sulla rete. Questa condizione può consentire ad un attaccante di invocare il servizio vulnerabile e manipolarne il comportamento, fino ad ottenere l’esecuzione di codice con i privilegi di root. Prodotti e/o versioni affette Junos OS Evolved su dispositivi della serie PTX 25.4Rx-EVO, precedenti alla 25.4R1-S1-EVO e alla 25.4R2-EVO Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti. Inoltre, considerata la presenza di vulnerabilità sfruttabili da remoto, si rimarca la necessità di verificare attentamente la propria postura di sicurezza, utilizzando firewall o ACL per restringere l’accesso solo a IP interni o VPN.

Aggiornamenti di sicurezza per prodotti Juniper Networks Alert AL02/260213/CSIRT-ITA Sintesi Juniper Networks rilascia aggiornamenti di sicurezza per sanare diverse vulnerabilità, di cui una con gravità “critica”, che interessano Juniper Secure Analytics (JSA), sistema SIEM (Security Information and Event Management) che raccoglie, correla e analizza in tempo quasi reale grandi volumi di dati provenienti da dispositivi di rete, endpoint e applicazioni. Tipologia Arbitrary Code Execution Authentication Bypass Denial of Service Information Disclosure Privilege Escalation Security Feature Bypass Security Restrictions Bypass Tampering Prodotti e/o versioni affette Juniper Secure Analytics 7.5.x, versioni precedenti alla 7.5.0 UP14 IF01 N.B. Si evidenzia che le vulnerabilità riguardano componenti di terze parti in uso nei prodotti indicati. Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti. Inoltre, considerata la presenza di vulnerabilità sfruttabili da remoto, si rimarca la necessità di verificare attentamente la propria postura di sicurezza, con particolare attenzione ai seguenti aspetti: evitare l’esposizione di interfacce di amministrazione su internet; utilizzare firewall o ACL per restringere l’accesso solo a IP interni o VPN; valutare il collocamento di JSA in una VLAN dedicata.

It's Patch Tuesday, which means a number of software vendors have released patches for various security vulnerabilities impacting their products and services. Microsoft issued fixes for 59 flaws, including six actively exploited zero-days in various Windows components that could be abused to bypass security features, escalate privileges, and trigger a denial-of-service (DoS) condition. Elsewhere, Adobe released updates for Audition, After Effects, InDesign Desktop, Substance 3D, Bridge, Lightroom Classic, and DNG SDK. The company said it's not aware of in-the-wild exploitation of any of the shortcomings. SAP shipped fixes for two critical-severity vulnerabilities, including a code injection bug in SAP CRM and SAP S/4HANA (CVE-2026-0488, CVSS score: 9.9) that an authenticated attacker could use to run an arbitrary SQL statement and lead to a full database compromise. The second critical vulnerability is a case of a missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (CVE-2026-0509, CVSS score: 9.6) that could permit an authenticated, low-privileged user to perform certain background Remote Function Calls without the required S_RFC authorization. "To patch the vulnerability, customers must implement a kernel update and set a profile parameter," Onapsis said. "Adjustments in user roles and UCON settings might be required to not interrupt business processes." Rounding off the list, Intel and Google said they teamed up to examine the security of Intel Trust Domain Extensions (TDX) 1.5, uncovering five vulnerabilities in the module (CVE-2025-32007, CVE-2025-27940, CVE-2025-30513, CVE-2025-27572, and CVE-2025-32467), and nearly three dozen weaknesses, bugs, and improvement suggestions. "Intel TDX 1.5 introduces new features and functionality that bring confidential computing significantly closer to feature parity with traditional virtualization solutions," Google said. "At the same time, these features have increased the complexity of a highly privileged software component in the TCB [Trusted Computing Base]." Software Patches from Other Vendors Security updates have also been released by other vendors in recent weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD AMI Apple ASUS AutomationDirect AVEVA Broadcom (including VMware) Canon Check Point Cisco Citrix Commvault ConnectWise D-Link Dassault Systèmes Dell Devolutions dormakaba Drupal F5 Fortinet Foxit Software FUJIFILM Fujitsu Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision Hitachi Energy HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Intel Ivanti Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric MongoDB Moxa Mozilla Firefox and Thunderbird n8n NVIDIA Phoenix Contact QNAP Qualcomm Ricoh Rockwell Automation Samsung Schneider Electric ServiceNow Siemens SolarWinds Splunk Spring Framework Supermicro Synology TP-Link WatchGuard Zoho ManageEngine Zoom, and Zyxel

All four major telecommunications providers in Singapore were targeted last year by a Chinese APT, according to Singapore’s cybersecurity agency CSA and its development agency IMDA. The attack, initially disclosed in July, was attributed to UNC3886, a cyberespionage group active since at least 2021, which is known for targeting vulnerabilities in Ivanti, Juniper, and VMware products. “UNC3886 launched a deliberate, targeted, and well-planned campaign against Singapore’s telecommunications sector. All four of Singapore’s major telecommunications operators – M1, SIMBA Telecom, Singtel and StarHub – have been the target of attacks,” CSA says. As part of the campaign, the agency notes, the APT deployed advanced tools, including a zero-day exploit in a firewall, to access a telco’s network and obtain a small amount of technical data. UNC3886 was also seen deploying rootkits to evade detection and maintain persistent access to the compromised environments. CSA says UNC3886 gained limited access to some parts of the victim companies’ networks and systems, but could not disrupt services. “There is no evidence to-date that sensitive or personal data such as customer records were accessed or exfiltrated. There is also no evidence that the threat actor managed to disrupt telecommunications services such as internet availability,” CSA says. The cybersecurity agency says it has been working with the targeted organizations to investigate the intrusions, close the threat actor’s access, implement remediation measures, and expand monitoring capabilities across the impacted networks. “While our collective efforts have contributed to containing the attacks so far, we must be prepared that there may be future attempts to gain access into our telco infrastructure. Telcos are strategic targets for threat actors, including state-sponsored ones,” CSA notes. The agency says it will introduce initiatives to improve Singapore’s cyber capabilities and ensure better and faster response to similar attacks. Related: Notepad++ Supply Chain Hack Conducted by China via Hosting Provider Related: China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear

Singapore says China-linked hackers targeted telecom providers in major spying campaign Singapore authorities said Monday that a sophisticated China-linked cyber espionage group carried out a targeted campaign against all four of the country’s major telecommunications operators. In a statement, the Cyber Security Agency of Singapore (CSA) said the threat actor known as UNC3886 was behind what it described as a “deliberate, targeted, and well-planned” operation against M1, SIMBA Telecom, Singtel and StarHub. The group used advanced tools to infiltrate telecom networks and maintain long-term covert access, the agency said. Singapore first disclosed the attacks on critical infrastructure in July but did not provide details at the time, saying it would assess whether further disclosure was in the national interest. Following the initial findings, Singapore launched an operation called Cyber Guardian, which officials described as the country’s largest cyber incident response effort to date. The operation lasted more than 11 months and involved more than 100 cyber defenders from multiple government agencies. Officials said the attackers gained unauthorized access to parts of telecom networks and, in one case, reached limited portions of critical systems. They said there were no service disruptions and no evidence customer data was accessed. “There is no evidence to date that sensitive or personal data, such as customer records, was accessed or exfiltrated,” CSA said, adding there was also no indication telecommunications services were disrupted. Authorities did not provide a detailed technical account of the attacks but said that in at least one case, the group exploited a previously unknown software vulnerability to gain access to internal systems. In another incident, the hackers used “advanced tools” to maintain persistent access and evade detection. Singapore warned that telecommunications infrastructure remains a high-value target for advanced threat actors, including state-backed groups, because of its importance to national security and economic stability. “We must be prepared for future attempts to gain access to our telco infrastructure,” CSA said. The Chinese embassy in Singapore did not publicly respond to the latest disclosure. Beijing has repeatedly denied conducting cyber espionage operations abroad. Security researchers have described China-linked UNC3886 as a “highly disciplined and stealthy” state-linked threat actor. Google has warned that the group targets strategic organizations globally and has linked it to campaigns deploying custom backdoors on network infrastructure, including Juniper routers. The group has also been associated with compromises involving Fortinet and VMware systems targeting defense, government, technology, and telecommunications organizations. Singapore has previously faced intrusions that investigators, cited by Bloomberg, said were tied to Chinese advanced persistent threat groups. In 2024, Bloomberg said the China-linked Volt Typhoon group was believed to have breached Singtel, the country’s largest mobile carrier. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Social media sites received nearly £3.8bn ($5.2bn) in revenue from malicious ads in Europe in 2025, off the back of almost one trillion impressions, according to Juniper Research. The analyst used publicly available data to study ads on Facebook, Instagram, TikTok, Snapchat, X (formerly Twitter) and LinkedIn, across 11 European markets including the UK. It defined a scam ad as a “deceptive paid post that misleads users into giving money, personal information, or account access by falsely advertising products, services, or investment opportunities.” The Revolut‑sponsored report found that European users saw 993 billion social media ad impressions last year, generating £38bn ($52bn) in revenue. About 10% of those impressions were linked to scams. Juniper Research predicted that total impressions would surge to 1.4 trillion by 2030, pushing overall ad revenue up by 120% to £84bn ($114bn). That could mean social platforms benefitting from scams to the tune of around £8.4bn unless more protections are built in. The report warned that consumers typically lower their guard on social sites, as they believe content to be pre-vetted. “Scam ads erode trust among social media users through advertising fake products with attractive deals or investment opportunities,” the report noted. “When users are successfully deceived, they not only lose money, but also risk exposing sensitive financial and personal information to scammers.” Although the big social media sites already do some scanning for malicious ads, they should do more in terms of detection, enforcement and user education, or else risk a dangerous erosion of credibility and user trust, the report warned. Banks Urge Social Media to Step Up Banks and payment providers have long argued that social media sites should accept more responsibility for the surge in global fraud over recent years. They argue that the majority of fraud – like authorized push payment fraud – occurs outside of banking apps and sites, meaning that financial institutions alone should not be footing the bill for reimbursement of victims. Social sites claim they already invest heavily in anti-fraud measures, and that more real-time data sharing from banks would help. In 2023, Facebook, Instagram, TikTok, Snapchat, X, LinkedIn and others signed up to a “world-first” Online Fraud Charter with the UK government, in which they committed to blocking and removing fraudulent content from their platforms – including scam ads. However, the Juniper report urged more action from social media platforms, including: Greater transparency about their fraud fighting efforts Investment in manual checks for advertisers, alongside automated identification Greater agility to evolve tactics as scams change over time Promote the above to build trust with users

Da 1,2 miliardi di dollari nel 2026 a 13,3 miliardi di dollari nel 2035 (+1000%), tanto vale la crescita del mercato della crittografia post-quantistica. Il mercato della crittografia post-quantistica è in rapida espansione, con numeri incredibili entro i prossimi dieci anni. Secondo un recente studio di Juniper Research, il suo valore dovrebbe infatti passare da 1,2 miliardi di dollari nel 2026 a 13,3 miliardi di dollari nel 2035 (+1000%). Il tutto, con un tasso di crescita annuo composto (CAGR) del 30%. Queste cifre rappresentano al meglio la “trasformazione strutturale in corso, spinta dall’avanzata del quantum computing e dalla crescente consapevolezza dei suoi impatti sulla cybersicurezza“. Che cos’è la crittografia post-quantistica La crittografia post-quantistica comprende algoritmi progettati “per resistere sia agli attacchi dei computer classici sia a quelli quantistici“. Non si tratta di crittografia “quantistica” in senso stretto, ma di soluzioni matematiche che possono essere implementate sugli attuali sistemi IT. Soluzioni, che non risultano vulnerabili agli algoritmi quantistici noti, come quello di Shor. Il riferimento è al cosiddetto “Q-Day”. Si tratta di quel momento – sebbene non ci sia ancora una data precisa – in cui la potenza dei computer quantistici renderà vulnerabili le tecniche crittografiche. Tecniche crittografiche che oggi sono alla base di comunicazioni, transazioni finanziarie, identità digitali e infrastrutture critiche. Il passaggio alla crittografia post-quantistica, però, non è un semplice aggiornamento software. Implica infatti “una revisione profonda di sistemi, protocolli, infrastrutture, dipendenze da fornitori terzi e modelli di governance“. Recentemente, il Gruppo di esperti cyber del G7 ha approfondito il tema, inquadrandolo nei termini di una “transizione e non di una sostituzione immediata“. I pilastri del mercato Il report di Juniper Research offre una visione di lungo periodo, basandola su oltre 54.000 datapoint di 61 Paesi. Da qui, l’analisi della crescita del mercato della crittografia post-quantistica come il risultato di due fattori principali. Il primo è la rapida evoluzione di standard e regolamenti, pensati proprio per preparare sistemi e infrastrutture all’era post-quantistica. In questo contesto, “un ruolo centrale è svolto dagli algoritmi standardizzati dal NIST (National Institute of Standards and Technology)“. Algoritmi, che in molti Paesi sono già diventati l’opzione di riferimento per la sicurezza “quantum-resistant”. Il secondo è la mole degli investimenti in crescita proprio nello sviluppo degli algoritmi. Stanno così accelerando la loro “maturità“, attraverso test rigorosi e applicazioni in scenari reali L’importanza della collaborazione Verso il futuro prossimo, insieme al tema economico, il report ha ribadito la massima centralità della collaborazione globale tra organizzazioni e Paesi. Un aspetto cruciale, senza il quale non sarà possibile adottare efficacemente la crittografia post-quantistica. La crittografia, infatti, è per sua natura un dominio che richiede interoperabilità. Sistemi, reti e infrastrutture devono funzionare senza frizioni anche oltre i confini nazionali. Molti Stati hanno già accettato gli algoritmi del NIST come standard de facto – anche in contesti dove la comprensione del panorama quantistico è ancora limitata – un segnale di per sé ritenuto “positivo“.

Juniper heeft kwetsbaarheden verholpen in Junos OS (Specifiek voor SRX en MX Series apparaten). De kwetsbaarheden in Junos OS omvatten verschillende problemen, waaronder clickjacking, Denial-of-Service (DoS) door malformed packets, en kwetsbaarheden die kunnen worden misbruikt door ongeauthenticeerde aanvallers. Deze kwetsbaarheden kunnen leiden tot serviceonderbrekingen, netwerkinstabiliteit en ongeautoriseerde acties door gebruikers. De technische details van deze kwetsbaarheden vereisen aandacht van beveiligingsbeheerders om de impact op hun netwerkinfrastructuur te beoordelen.

Aggiornamenti di sicurezza per prodotti Juniper Networks Alert AL01/260115/CSIRT-ITA Sintesi Juniper Networks rilascia aggiornamenti di sicurezza per sanare diverse vulnerabilità, di cui 9 con gravità “alta”, nei propri prodotti. Tipologia Arbitrary Code Execution Denial of Service Prodotti e/o versioni affette Junos OS: tutte le versioni precedenti alla 22.4R3-S8 23.2.x, versioni precedenti alla 23.2R2-S5 23.4.x, versioni precedenti alla 23.4R2-S6 24.2.x, versioni precedenti alla 24.2R2-S3 24.4.x, versioni precedenti alla 24.4R2-S1 25.2.x, versioni precedenti alle 25.2R1-S2, 25.2R2 Junos OS Evolved: tutte le versioni precedenti alla 22.4R3-S8-EVO 23.2.x, versioni precedenti alla 23.2R2-S5-EVO 23.4.x, versioni precedenti 23.4R2-S6-EVO, 24.2.x, versioni precedenti alla 24.2R2-S3-EVO, 24.4.x, versioni precedenti alla 24.4R2-S1-EVO, 25.2.x, versioni precedenti alle 25.2R1-S2-EVO, 25.2R2-EVO N.B. Si evidenzia che i prodotti elencati risultano vulnerabili solo alle condizioni descritte nei relativi bollettini di sicurezza. Azioni di mitigazione In linea con le dichiarazioni del vendor, si consiglia di aggiornare i singoli prodotti seguendo le indicazioni riportate nei bollettini di sicurezza, disponibili ai link presenti nella sezione Riferimenti. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “alta”: https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-SRX-Series-With-GRE-performance-acceleration-enabled-receipt-of-a-specific-ICMP-packet-causes-the-PFE-to-crash-CVE-2026-21906 https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-SRX-Series-Specifically-malformed-SSL-packet-causes-FPC-crash-CVE-2026-21917 https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-SRX-Series-If-a-specific-request-is-processed-by-the-DNS-subsystem-flowd-will-crash-CVE-2026-21920 https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-SRX-Series-A-specifically-malformed-GTP-message-will-cause-an-FPC-crash-CVE-2026-21914 https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-SRX-Series-MX-Series-with-MX-SPC3-or-MS-MPC-Receipt-of-multiple-specific-SIP-messages-results-in-flow-management-process-crash-CVE-2026-21905 https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-SRX-and-MX-Series-When-TCP-packets-occur-in-a-specific-sequence-flowd-crashes-CVE-2026-21918 https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-EX4000-A-high-volume-of-traffic-destinated-to-the-device-leads-to-a-crash-and-restart-CVE-2026-21913 https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Use-after-free-vulnerability-In-802-1X-authentication-daemon-can-cause-crash-of-the-dot1xd-process-CVE-2026-21908 https://supportportal.juniper.net/s/article/2026-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-BGP-update-with-a-set-of-specific-attributes-causes-rpd-crash-CVE-2025-60003

Microsoft on Tuesday rolled out its first security update for 2026, addressing 114 security flaws, including one vulnerability that it said has been actively exploited in the wild. Of the 114 flaws, eight are rated Critical, and 106 are rated Important in severity. As many as 58 vulnerabilities have been classified as privilege escalation, followed by 22 information disclosure, 21 remote code execution, and five spoofing flaws. According to data collected by Fortra, the update marks the third-largest January Patch Tuesday after January 2025 and January 2022. These patches are in addition to two security flaws that Microsoft has addressed in its Edge browser since the release of the December 2025 Patch Tuesday update, including a spoofing flaw in its Android app (CVE-2025-65046, 3.1) and a case of insufficient policy enforcement in Chromium's WebView tag (CVE-2026-0628, CVSS score: 8.8). The vulnerability that has come under in-the-wild exploitation is CVE-2026-20805 (CVSS score: 5.5), an information disclosure flaw impacting Desktop Window Manager. The Microsoft Threat Intelligence Center (MTIC) and Microsoft Security Response Center (MSRC) have been credited with identifying and reporting the flaw. "Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager (DWM) allows an authorized attacker to disclose information locally," Microsoft said in an advisory. "The type of information that could be disclosed if an attacker successfully exploited this vulnerability is a section address from a remote ALPC port, which is user-mode memory." There are currently no details on how the vulnerability is being exploited, the scale of such efforts, and who may be behind the activity. "DWM is responsible for drawing everything on the display of a Windows system, which means it offers an enticing combination of privileged access and universal availability, since just about any process might need to display something," Adam Barnett, lead software engineer at Rapid7, said in a statement. "In this case, exploitation leads to improper disclosure of an ALPC port section address, which is a section of user-mode memory where Windows components coordinate various actions between themselves." Microsoft previously addressed an actively exploited zero-day flaw in DWM in May 2024 (CVE-2024-30051, CVSS score: 7.8), which was described as a privilege escalation flaw that was abused by multiple threat actors, in connection with the distribution of QakBot and other malware families. Satnam Narang, senior staff research engineer at Tenable, called DWM a "frequent flyer" on Patch Tuesday, with 20 CVEs patched in the library since 2022. Jack Bicer, director of vulnerability research at Action1, said the vulnerability can be exploited by a locally authenticated attacker to disclose information, defeat address space layout randomization (ASLR), and other defenses. "Vulnerabilities of this nature are commonly used to undermine Address Space Layout Randomization (ASLR), a core operating system security control designed to protect against buffer overflows and other memory-manipulation exploits," Kev Breen, senior director of cyber threat research at Immersive, told The Hacker News. "By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack." The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, mandating Federal Civilian Executive Branch (FCEB) agencies to apply the latest fixes by February 3, 2026. Another vulnerability of note concerns a security feature bypass impacting Secure Boot Certificate Expiration (CVE-2026-21265, CVSS score: 6.4) that could allow an attacker to undermine a crucial security mechanism that ensures that firmware modules come from a trusted source and prevent malware from being run during the boot process. In November 2025, Microsoft announced that it will be expiring three Windows Secure Boot certificates issued in 2011, effective June 2026, urging customers to update to their 2023 counterparts - Microsoft Corporation KEK CA 2011 (June 2026) - Microsoft Corporation KEK 2K CA 2023 (for signing updates to DB and DBX) Microsoft Windows Production PCA 2011 (October 2026) - Windows UEFI CA 2023 (for signing the Windows boot loader) Microsoft UEFI CA 2011 (June 2026) - Microsoft UEFI CA 2023 (for signing third-party boot loaders) and Microsoft Option ROM UEFI CA 2023 (for signing third-party option ROMs) "Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time," Microsoft said. "To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance." The Windows maker also pointed out that the latest update removes Agere Soft Modem drivers "agrsm64.sys" and "agrsm.sys" that were shipped natively with the operating system. The third-party drivers are susceptible to a two-year-old local privilege escalation flaw (CVE-2023-31096, CVSS score: 7.8) that could allow an attacker to gain SYSTEM permissions. In October 2025, Microsoft took steps to remove another Agere Modem driver called "ltmdm64.sys" following in-the-wild exploitation of a privilege escalation vulnerability (CVE-2025-24990, CVSS score: 7.8) that could permit an attacker to gain administrative privileges. Also high on the priority list should be CVE-2026-20876 (CVSS score: 6.7), a critical-rated privilege escalation flaw in Windows Virtualization-Based Security (VBS) Enclave, enabling an attacker to obtain Virtual Trust Level 2 (VTL2) privileges, and leverage it to subvert security controls, establish deep persistence, and evade detection. "It breaks the security boundary designed to protect Windows itself, allowing attackers to climb into one of the most trusted execution layers of the system," Mike Walters, president and co-founder of Action1, said. "Although exploitation requires high privileges, the impact is severe because it compromises virtualization-based security itself. Attackers who already have a foothold could use this flaw to defeat advanced defenses, making prompt patching essential to maintain trust in Windows security boundaries." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors since the start of the month to rectify several vulnerabilities, including — ABB Adobe Amazon Web Services AMD Arm ASUS Broadcom (including VMware) Cisco ConnectWise Dassault Systèmes D-Link Dell Devolutions Drupal Elastic F5 Fortinet Fortra Foxit Software FUJIFILM Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Imagination Technologies Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox and Firefox ESR n8n NETGEAR Node.js NVIDIA ownCloud QNAP Qualcomm Ricoh Samsung SAP Schneider Electric ServiceNow Siemens SolarWinds SonicWall Sophos Spring Framework Synology TP-Link Trend Micro, and Veeam