roundcube

Risolte vulnerabilità in prodotti Roundcube Webmail Alert AL05/260818/CSIRT-ITA Sintesi Rilasciati aggiornamenti di sicurezza per risolvere tre vulnerabilità con gravità “alta” in Roundcube Webmail, noto gestore di posta elettronica open source. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato remoto di eseguire codice arbitrario, elevare i propri privilegi e/o accedere a informazioni sensibili sui sistemi interessati. Tipologia Remote Code Execution Privilege Escalation Information Disclosure Prodotti e/o versioni affette Roundcube Webmail tutte le versioni precedenti alla 1.6.18 1.7.x, versioni precedenti alla 1.7.3 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili come indicato nel bollettino di sicurezza riportato nella sezione Riferimenti.

SYSTEMS What Nvidia's first Groq 3 LPU benchmarks tell us about its $20B gambleGemma 4 31B performance tests offer a best-case scenario for next-gen dataflow accelerators ON-PREM US datacenters tripled their water footprint in 10 years... and those are figures from the start of the AI boom. It can only be worse now. Silo-ed reporting isn't helping ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career Emperor Penguin Linus Torvalds banishes a bug – with a botThe lad himself finds and fixes a tricky one… or does he? FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan

A China-linked threat cluster has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware. The campaign has been observed since May and focuses on physics and engineering departments, administrators and professors, as well as organizations involved in astrophysics, particle physics, or national security-related research. Researchers at cybersecurity company Proofpoint are tracking the activity under the name ‘UNK_MassTraction’ and believe to be associated with a new threat cluster. The attack begins with a malicious email sent from compromised accounts or spoofed domains, using a generic lure. Opening the email in a vulnerable Roundcube webmail client triggers exploitation of a cross-site scripting flaw tracked as CVE-2024-42009, which executes JavaScript code inside the victim’s browser, loading a payload called IceCube. According to the researchers, IceCube "is a fully-featured Roundcube stealer" that can harvest usernames, passwords, cookies, two-factor authentication (2FA) data, and browser information. Proofpoint says that the malware uses "helpers" to exploit a Roundcube deserialization flaw tracked as CVE-2025-49113 and attempts to install SquareShell, a PHP webshell that includes remote code execution capabilities. If successful, the attacker gains remote code execution on the mail server; otherwise, the malware downloads a shell script that loads another payload, VShell, directly in memory. VShell is a commodity Go-based backdoor that supports interactive shell access and port forwarding, which is commonly used by Chinese threat actors. Based on several observations, Proofpoint assesses that UNK_MassTraction is likely a China-aligned espionage actor. First, the infrastructure used in the attacks overlaps with a covert VPS network previously associated with multiple China-linked actors. Another clue is the presence of Chinese-language artifacts in earlier phishing emails. Finally, the tactic of targeting internet-facing mail servers as a foothold for accessing internal networks is a hallmark of Chinese attacks. Taking everything into account, Proofpoint emphasizes that attribution in this case is just an assessment and definitely not a high-confidence one. An interesting finding regarding the specific targeting of this campaign is that UNK_MassTraction appears to have selected servers previously deemed vulnerable to CVE-2024-42009 and CVE-2025-49113, so some reconnaissance was performed prior to the attacks. Administrators of Roundcube systems are advised to apply the latest security updates that address the two flaws and treat mail servers with the same diligence they show for VPNs and other remote access nodes. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Risolte vulnerabilità in prodotti Roundcube Webmail Alert AL07/260707/CSIRT-ITA Sintesi Rilasciati aggiornamenti di sicurezza per risolvere diverse vulnerabilità, di cui due con gravità “critica”, che interessano Roundcube Webmail. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di eludere le funzionalità di sicurezza sui sistemi interessati. Tipologia Security Restrictions Bypass Prodotti e/o versioni affette Roundcube Webmail 1.7.x, versioni precedenti alla 1.7.2 1.6.x LTS, versioni precedenti alla 1.6.17 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili come indicato nel bollettino di sicurezza riportato nella sezione Riferimenti.

A suspected China-aligned threat cluster has been exploiting vulnerable Roundcube mail servers at universities in the US and Canada to steal credentials and establish network access. New research from Proofpoint, published on June 7, tracked the activity under the name UNK_MassTraction and found that attackers were targeting physics and engineering departments at academic institutions with potential links to national security. Proofpoint assessed that the attackers likely selected these organizations after identifying vulnerable Roundcube instances. The campaign used multiple known Roundcube vulnerabilities to compromise mail servers, using stolen credentials and server access as a pathway into victim networks rather than focusing solely on email data theft. The activity follows previous campaigns in which China-aligned operators exploited internet-facing infrastructure to gain access to targeted organizations, including attacks involving vulnerable edge devices and public-facing applications. Roundcube Servers Used as Network Entry Points Proofpoint found that UNK_MassTraction used phishing emails containing malicious content designed to exploit CVE-2024-42009, a cross-site scripting (XSS) vulnerability in Roundcube. When executed in a vulnerable webmail client, the exploit allowed JavaScript to run in the victim's browser. The JavaScript payload, tracked by Proofpoint as IceCube, was used to steal usernames, passwords, cookies and authentication data. The malware also gathered information about victims’ environment and used the stolen session data to continue the compromise. The firm observed the attackers using a range of techniques during the infection chain, including: Credential theft through malicious JavaScript payloads Server-side exploitation of vulnerable Roundcube components Deployment of webshells for remote access Memory-based execution of the VShell backdoor Attackers Deploy VShell For Follow-On Access After gaining access to Roundcube servers, UNK_MassTraction exploited CVE-2025-49113, a deserialization vulnerability, to deploy a webshell or install the VShell backdoor in memory. Proofpoint said VShell, a publicly available Go-based remote access tool, has previously been used by China-aligned operators across Windows, Linux and macOS environments. The malware provides interactive shell access and port-forwarding capabilities that can help attackers move deeper into compromised networks. The firm assessed that UNK_MassTraction was likely conducting espionage-focused operations based on its targeting, infrastructure links and the presence of Chinese language artifacts in some phishing emails. "The campaign is a reminder that email delivery can facilitate compromise of mail servers, and that Chinese operators will continue to treat them like any other edge device," Proofpoint warned. "Defenders should prioritize defending the mail servers of their networks as thoroughly as they do their VPN concentrators and other remote access nodes on their networks."

A suspected China-aligned threat activity cluster has been observed exploiting Roundcube webmail software belonging to physics and engineering departments of U.S. and Canadian universities as part of a new campaign. The activity involves the exploitation of now-patched, critical security flaws in the open-source email solution, such as CVE-2024-42009 (CVSS score: 9.3), to siphon credentials, followed by either the deployment of a web shell for persistent access or a known post-exploitation tool called VShell. The emerging threat cluster is being tracked by Proofpoint under the moniker UNK_MassTraction. It was first detected in May 2026, specifically focusing on administrators and professors in departments with either national security ties or entities studying astrophysics and particle physics. "The emails targeting university departments used both compromised senders, as well as abused domains vulnerable to spoofing due to lax DMARC policy to send the emails," the enterprise security company wrote in a technical report shared with The Hacker News, adding the use of generic lures indicates a "larger targeting swath" beyond its visibility. While the nature of the cross-site scripting (XSS) exploit is such that it only requires the recipient to open the email in the Roundcube client in order to obtain access to the mail server, it's assessed that the targeted departments were singled out because they were all running versions of Roundcube susceptible to N-day security flaws. This indicates that the threat actor likely carried out preparatory reconnaissance into these targets to gather information about their environments prior to sending phishing emails that trigger an exploit for CVE-2024-42009 and execute arbitrary JavaScript code in the context of the victim's web browser. "The actor is likely abusing Roundcube servers as a pivot point to enter target networks, and the operators have deliberately crafted their infection chain to avoid detection," Proofpoint researchers Greg Lesnewich and Mark Kelly said. The payload delivered following the exploitation of the XSS flaw, codenamed IceCube, is designed to siphon credential information stored in the browser along with two-factor authentication (2FA) and cookies. It also carries out reconnaissance of its own to collect information about the browser language, screen size, and form field values. screen size, and form field values. The harvested information is sent to an external system by means of an HTTP POST request. In the next step, IceCube leverages the session's CSRF token to weaponize a second post-authenticated remote code execution flaw in Roundcube - CVE-2025-49113 (CVSS score: 9.9) - with the goal of obtaining a foothold in the mail server and dropping VShell or a web shell dubbed SquareShell in memory. The web shell, deployed by means of a PHP gadget shell command, is remotely reachable at the endpoint "plugins/newmail_notifier/mail_preview.php" and enables arbitrary code execution. However, if the web shell installation fails for some reason, the attack chain falls back to an alternate mechanism in which a shell script is executed via the Roundcube vulnerability to ultimately deliver VShell. The secondary method is said to have been introduced in June 2026, when previously the attack chain would simply exit upon failing to deploy SquareShell. The shell script acts as a conduit for an ELF loader referred to as SNOWLIGHT and has been put to use in other intrusions orchestrated by Chinese adversaries. The use of both SNOWLIGHT and VShell has been linked to a China-linked cluster tracked as UNC5174 in the past. Lesnewich, principal threat researcher at Proofpoint, told The Hacker News that there is currently no data that links UNK_MassTraction to UNC5174 or other known adversaries, adding the toolkit has been put to use by multiple Chinese threat actors. This suggests that the shell script is possibly shared by multiple China-nexus clusters in a private capacity, similar to ShadowPad and other tools. The script's main responsibility is to fetch a version of SNOWLIGHT that's compatible with the host's system architecture and then execute it. "IceCube also sets up what it calls 'deferred triggers' to ensure continuance of the infection chain," Proofpoint said. "The deferred triggers monitor if the user closes the page or changes tabs, checks if the mouse leaves the browser window, and hijacks the logout button." "If any of those actions are taken, IceCube hooks those events, and re-attempts exploitation of CVE-2025-49113, and beacons to the C&C [command-and-control] that the user left the Roundcube session." Upon completing these actions or running into a timeout, the JavaScript malware destroys user and malware-initiated sessions on the server, causing the user to log out and erase forensic evidence associated with the compromise from the Roundcube server. Written in Go, VShell is a remote administration tool that provides post-compromise capabilities similar to Cobalt Strike. It has been utilized by various China-aligned adversaries in recent years. The development marks the first time a Chinese hacking group has been tied to the exploitation of Roundcube flaws, which have been traditionally abused by state-sponsored threat actors from Russia. "While the targeting of this campaign is captivating to the imagination, it is unlikely that UNK_MassTraction will be solving deep theoretical physics questions or the Fermi Paradox in the near future," Proofpoint researchers concluded. "UNK_MassTraction displayed a mature toolkit and unique usage of n-day vulnerabilities. The campaign is a reminder that email delivery can facilitate compromise of the mail server, and that Chinese operators will continue to treat them like any other edge device, so defenders should prioritize defending the mail servers of their networks as thoroughly as they do their VPN concentrators and other remote access nodes on their networks." (The story was updated after publication to include a response from Proofpoint.)

Details It was discovered that Roundcube Webmail was prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. An attacker could use this issue to execute arbitrary web script in the context of an affected user's session. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Vulnerabilità in Roundcube Webmail Alert AL03/260526/CSIRT-ITA Sintesi Aggiornamenti di sicurezza sanano 8 vulnerabilità, di cui 4 con gravità “alta” in Roundcube Webmail, noto gestore di posta elettronica open source. Tipologia Remote Code Execution Privilege Escalation Security Restrictions Bypass Prodotti e versioni affette Roundcube Webmail 1.7.x, versioni precedenti alla 1.7.1 1.6.x, versioni precedenti alla 1.6.16 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili come indicato nel bollettino di sicurezza riportato nella sezione Riferimenti. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “alta”:

Details It was discovered that Roundcube Webmail mishandled Punycode xn-- domain names. An attacker could possibly use this issue to cause a homograph attack. (CVE-2019-15237) It was discovered that Roundcube Webmail did not properly sanitize certain attributes when handling CSS within HTML messages and certain SVG attributes. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2024-38356, CVE-2024-38357) It was discovered that Roundcube Webmail did not properly sanitize certain HTML attributes when rendering e-mail messages. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2024-42008) It was discovered that Roundcube Webmail did not properly filter certain CSS token sequences within rendered e-mail messages. An... It was discovered that Roundcube Webmail mishandled Punycode xn-- domain names. An attacker could possibly use this issue to cause a homograph attack. (CVE-2019-15237) It was discovered that Roundcube Webmail did not properly sanitize certain attributes when handling CSS within HTML messages and certain SVG attributes. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2024-38356, CVE-2024-38357) It was discovered that Roundcube Webmail did not properly sanitize certain HTML attributes when rendering e-mail messages. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2024-42008) It was discovered that Roundcube Webmail did not properly filter certain CSS token sequences within rendered e-mail messages. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-42010) It was discovered that Roundcube Webmail did not properly treat an SVG tag as an image source within its HTML sanitizer. An attacker could possibly use this issue to bypass remote image blocking to track email open actions or potentially bypass access control. (CVE-2026-25916) It was discovered that Roundcube Webmail did not properly handle comments within Cascading Style Sheets (CSS). An attacker could possibly use this issue to perform a CSS injection attack. (CVE-2026-26079) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Ukraine confirms suspected APT28 campaign targeting prosecutors, anti-corruption agencies A Ukrainian cyber official has confirmed that several local government agencies were targeted in a long-running cyber-espionage campaign attributed to a Russian state-linked hacker group. Taras Dzyuba, head of the information communications department at Ukraine’s State Service of Special Communications and Information Protection (SSSCIP), told Recorded Future News that authorities are aware of the attacks, which Western researchers say compromised email accounts belonging to Ukrainian prosecutors and investigators. Earlier this week, Reuters reported that hackers linked to Russia had broken into more than 170 email accounts belonging to prosecutors and investigators across Ukraine in recent months. According to Dzyuba, the activity described by the Reuters report appears to be part of a broader campaign that Ukrainian authorities have been tracking since 2023. Ukraine’s computer emergency response team (CERT-UA) has identified three waves of attacks that likely form part of the same campaign. The intrusions exploited vulnerabilities in the open-source Roundcube webmail platform that allow attackers to execute malicious code when a victim simply opens an email in their inbox — without needing to click on links or download attachments. Dzyuba said some information allegedly stolen during these attacks from several Ukrainian state agencies was published online earlier in March, but he added that the leaked material was unlikely to contain confidential data. He said Russia could use these cyber incidents as a basis for disinformation campaigns aimed at discrediting Ukrainian institutions. Researchers at Ctrl-Alt-Intel, who were cited in the Reuters report, attributed the campaign to the hacking group APT28 — also known as Fancy Bear, BlueDelta or Forest Blizzard — which Western governments and cybersecurity firms widely believe is linked to Russia’s military intelligence agency, the GRU. Dzyuba confirmed that all indications point to this group. CERT-UA has previously reported several APT28 attacks exploiting Roundcube vulnerabilities. According to a Ctrl-Alt-Intel report, most victims of the latest campaign were in Ukraine, although some compromised accounts were linked to neighboring NATO countries and the Balkans, including Romania, Bulgaria, Greece and Serbia. Among the Ukrainian institutions reportedly affected were the Specialized Anti-Corruption Prosecutor’s Office (SAP) and the Asset Recovery and Management Agency (ARMA), which oversees assets seized from criminals and Russian collaborators. ARMA’s acting head, Yaroslava Maksymenko, confirmed on Thursday that the agency’s employees had been targeted by a Russian cyberattack but said the hackers failed to access its internal systems. “The review established that no access to internal information systems was obtained, and no data leak from databases or state information resources occurred,” Maksymenko said in a statement to the Interfax-Ukraine news agency. SAP said earlier this week that it had launched a review following reports that Russian hackers had breached dozens of email accounts belonging to Ukrainian law enforcement officials, including those at the agency. So far, investigators have found no evidence that data was stolen from SAP systems, though the review is ongoing. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Details It was discovered that Roundcube Webmail did not properly sanitize certain HTML elements within the e-mail body. An attacker could possibly use this issue to cause a cross-site scripting attack. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-4068, CVE-2016-4069) It was discovered that Roundcube Webmail did not properly handle certain configuration parameters. An attacker could possibly use this issue to execute arbitrary code. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-9920) It was discovered that Roundcube Webmail did not properly sanitize CSS styles within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2017-6820) It was discovered that... It was discovered that Roundcube Webmail did not properly sanitize certain HTML elements within the e-mail body. An attacker could possibly use this issue to cause a cross-site scripting attack. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-4068, CVE-2016-4069) It was discovered that Roundcube Webmail did not properly handle certain configuration parameters. An attacker could possibly use this issue to execute arbitrary code. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-9920) It was discovered that Roundcube Webmail did not properly sanitize CSS styles within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2017-6820) It was discovered that Roundcube Webmail did not properly restrict exec call in certain drivers of the password plugin. An authenticated user could possibly use this issue to perform arbitrary password resets. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2017-8114) It was discovered that Roundcube Webmail did not properly set file permissions within the Enigma plugin. An attacker could possibly use this issue to exfiltrate GPG private keys via network connectivity. (CVE-2018-1000071) It was discovered that Roundcube Webmail did not properly handle GnuPG MDC integrity-protection warnings. An attacker could possibly use this issue to obtain sensitive information from encrypted communications. (CVE-2018-19205) It was discovered that Roundcube Webmail did not properly sanitize

Another week, another reminder that the internet is still a mess. Systems people thought were secure are being broken in simple ways, showing many still ignore basic advisories. This edition covers a mix of issues: supply chain attacks hitting CI/CD setups, long-abused IoT devices being shut down, and exploits moving quickly from disclosure to real attacks. There are also new malware tricks showing attackers are becoming more patient and creative. It’s a mix of old problems that never go away and new methods that are harder to detect. There are quiet state-backed activities, exposed data from open directories, growing mobile threats, and a steady stream of zero-days and rushed patches. Grab a coffee, and at least skim the CVE list. Some of these are the kind you don’t want to discover after the damage is done. ⚡ Threat of the Week Trivy Vulnerability Scanner Breached in for Supply Chain Attack — Attackers have backdoored the widely used open-source Trivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions used by thousands of CI/CD workflows. The breach has triggered a cascade of additional supply-chain compromises stemming from impacted projects and organizations not rotating their secrets, resulting in the distribution of a self-propagating worm referred to as CanisterWorm. Trivy, developed by Aqua Security, is one of the most widely used open-source vulnerability scanners, with over 32,000 GitHub stars and more than 100 million Docker Hub downloads. The Trivy compromise is the latest in a growing pattern of attacks targeting GitHub Actions and developers in general. GitHub changed the default behavior of pull_request_target workflows in December 2025 to reduce the risk of exploitation. BAS vs Automated Pentesting: What Each Actually Covers (and Doesn't) Most teams pick one without knowing what the other misses. This guide breaks down both by use case across blue, red, and purple teams so you can see where each fits and where the gaps are. Download Now ➝ 🔔 Top News DoJ Takes Down DDoS Botnets — A cluster of IoT botnets behind some of the largest DDoS attacks ever recorded -- AISURU, Kimwolf, JackSkid, and Mossad -- were wiped as part of a broad law enforcement operation. The botnets largely spread across routers, IP cameras, and digital video recorders that are often shipped with weak credentials and rarely patched. Authorities removed the command-and-control servers used to commandeer the infected nodes. Together, operators of the four botnets had amassed more than 3 million devices, which they then sold access to other criminal hackers, who then used them to target victims with DDoS attacks to knock websites and internet services offline or mask other illicit activity. Some of these DDoS attacks were aimed at U.S. Department of Defense systems and other high-value targets. No arrests were announced, but two suspects associated with AISURU/Kimwolf are said to be based in Canada and Germany. All four botnets disrupted by the operation are variants of Mirai, which had its source code leaked in 2016 and has served as the starting point for other botnets. The U.S. Justice Department said some victims of the DDoS attacks lost hundreds of thousands of dollars through remediation expenses or ransom demands from hackers who would only stop overloading websites for a price. Google Debuts New Advanced Flow for Sideloading on Android — Google's advanced flow for Android changes how apps from unverified developers are installed, adding friction to combat scams and malware. The feature is aimed at experienced users and allows sideloading through a one-time setup. The advanced flow adds a 24-hour delay and verification steps intended to disrupt coercive pressure and give users time to make decisions. It’s designed to address scenarios where attackers pressure individuals to install unsafe software and play on the urgency of the operation to push them to bypass security warnings and disable protections before they can pause or seek help. Critical Langflow Flaw Comes Under Attack — A critical security flaw impacting Langflow has come under active exploitation within 20 hours of public disclosure, highlighting the speed at which threat actors weaponize newly published vulnerabilities. The security defect, tracked as CVE-2026-33017 (CVSS score: 9.3), is a case of missing authentication combined with code injection that could result in remote code execution. Cloud security firm Sysdig said that the attacks weaponize the vulnerability to steal sensitive data from compromised systems. "The real-world proof is definitive: threat actors exploited it in the wild within 20 hours of the advisory going public, with no public PoC code available," Aviral Srivastava, who discovered the vulnerability, told The Hacker News. "They built working exploits just from reading the advisory description. That's the hallmark of trivial exploitation when multiple independent attackers can weaponize a vulnerability from a description alone, within hours." Interlock Ransomware Exploited Cisco FMC Flaw as 0-Day — An Interlock ransomware campaign exploited a critical security flaw in Cisco Secure Firewall Management Center (FMC) Software as a zero-day well over a month before it was publicly disclosed. The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary Java code as root on an affected device. "This wasn't just another vulnerability exploit; Interlock had a zero-day in their hands, giving them a week's head start to compromise organizations before defenders even knew to look," Amazon, which spotted the activity, said. Yet Another iOS Exploit Kit Comes to Light — A new watering hole attack against iPhone users has been found to deliver a previously undocumented iOS exploit kit codenamed DarkSword. While some of the attacks targeted users in Ukraine, the kit has also been put to use by two other clusters that singled out Saudi Arabian users in November 2025, as well as users in Turkey and Malaysia. It's worth noting that these exploits would not be effective on devices where Lockdown Mode is active or on the iPhone 17 with Memory Integrity Enforcement (MIE) enabled. The kit used a total of six exploits in iOS to deliver various malware families designed for surveillance and intelligence gathering. Apple has since addressed all of them. "Completely written in JavaScript, DarkSword comprises six vulnerabilities across two exploit chains that were patched in stages ending with iOS 26.3," iVerify said. "Starting in WebKit and moving down to the kernel, it achieves full iPhone compromise with elegant techniques never publicly seen before." The discovery of DarkSword makes it the second mass attack targeting iOS devices. What's more, the Russian threat actor that deployed DarkSword demonstrated poor operational security. They left the full JavaScript code unobfuscated, unprotected, and easily accessible. The findings also point to a secondary market where such exploits are being acquired by threat actors of varied motivations to actively infect unpatched iOS users on a large scale. Perseus Banking Malware Targets Android — A newly discovered Android malware is masking itself within television streaming apps in order to steal users' passwords and banking data and spy on their personal notes, researchers have found. The malware, dubbed Perseus by researchers at ThreatFabric, is being actively distributed in the wild and primarily targets users in Turkey and Italy. To infect devices, attackers disguise the malware inside apps that appear to offer IPTV services — platforms that stream television content over the internet. These apps are also widely used to stream pirated content and are often downloaded outside official marketplaces like Google Play, making users more accustomed to installing them manually and less likely to view the process as suspicious. Once installed, Perseus can monitor nearly everything a user does in real time. It uses overlay attacks — placing fake login screens over legitimate apps — and keylogging capabilities to capture credentials as they are entered. The malware's most unusual feature is its focus on personal note-taking applications. "Notes often contain sensitive information such as passwords, recovery phrases, financial details, or private thoughts, making them a valuable target for attackers," ThreatFabric said. ️🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-21992 (Oracle), CVE-2026-33017 (Langflow), CVE-2026-32746 (GNU InetUtils telnetd), CVE-2026-32297, CVE-2026-32298 (Angeet ES3 KVM), CVE-2026-3888 (Ubuntu), CVE-2026-20643 (Apple WebKit), CVE-2026-4276 (LibreChat RAG API), CVE-2026-24291 aka RegPwn (Microsoft Windows), CVE-2026-21643 (Fortinet FortiClient), CVE-2026-3864 (Kubernetes), CVE-2026-32635 (Angular), CVE-2026-25769 (Wazuh), CVE-2026-3564 (ConnectWise ScreenConnect), CVE-2026-22557, CVE-2026-22558 (Ubiquiti), CVE-2025-14986 (Temporal), CVE-2026-31381, CVE-2026-31382 (Gainsight Assist), CVE-2026-26189 (Trivy), CVE-2026-4439, CVE-2026-4440, CVE-2026-4441 (Google Chrome), CVE-2026-33001, CVE-2026-33002 (Jenkins), CVE-2026-21570 (Atlassian Bamboo Center), and CVE-2026-21884 (Atlassian Crowd Data Center). 🎥 Cybersecurity Webinars Learn How to Automate Exposure Management with OpenCTI & OpenAEV → Discover how to automate continuous, threat-informed testing using open-source tools like OpenCTI and OpenAEV to validate your security controls against real attacker behavior without increasing your budget. See a live demo on how to verify your security works, identify real gaps, and integrate it into your SOC workflow at no extra cost. Identity Maturity Cracking in 2026: See the New Data + How to Catch Up Fast → Identity programs are under massive pressure in 2026 - disconnected apps, AI agents, and credential sprawl are creating real risks and audit challenges. Join this webinar for new Ponemon Institute 2026 research from over 600 leaders, showing the scale of the problem and practical steps to close gaps, reduce friction, and catch up quickly. 📰 Around the Cyber World WhatsApp Tests Usernames Instead of Phone Numbers — WhatsApp is planning to introduce usernames and unique IDs instead of phone numbers, allowing users to send messages and make voice or video calls without sharing numbers. The optional privacy feature is expected to roll out globally by June 2026, with users and businesses able to reserve unique handles. "We're excited to bring usernames to WhatsApp in the future to help people connect with new friends, groups, and businesses without having to share their phone numbers," the company said in a statement shared with The Economic Times. The feature has been under test since early January 2026. Signal introduced a similar feature in early 2024. FBI Details SE Asia Scam Centers — The U.S. Federal Bureau of Investigation (FBI) detailed its work with Thai authorities to shut down scam centers proliferating in Southeast Asia. The schemes, which primarily target retirees, small-business owners, and people seeking companionship, have been described as a blend of cyber fraud, money laundering, and human trafficking, causing billions of dollars in annual losses. These scam centers operate in a manner that's similar to how legitimate corporations do. "Recruiters advertise high-paying jobs abroad. Workers are flown to foreign countries only to discover that the positions do not exist," the FBI said. "Passports are confiscated. Armed guards patrol the grounds. Under threat of violence, workers are forced to pose as potential romantic partners or savvy investment advisers, cultivating trust with victims over weeks or months." Recent crackdowns in countries like Cambodia have freed thousands of workers from scam compounds, but the FBI warned that these breakthroughs can be temporary, as criminal networks always tend to relocate, rebrand, or shift tactics in response to law enforcement actions. APT28 Exposed Server Leaks SquirrelMail XSS Payload — A second exposed open directory discovered on a server ("203.161.50[.]145") associated with APT28 (aka Fancy Bear) has offered insights into the threat actor's espionage campaigns targeting government and military organizations across Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia. According to Ctrl-Alt-Intel, the directory contained command-and-control (C2) source code, scripts to steal emails, credentials, address books, and 2FA tokens from Roundcube mailboxes, telemetry logs, and exfiltrated data. The stolen data consists of 2,870 emails from government and military mailboxes, 244 sets of stolen credentials, 143 Sieve forwarding rules (to silently forward every incoming email to an attacker-controlled mailbox), and 11,527 contact email addresses. One of the newly identified tools is an XSS payload targeting the SquirrelMail webmail software, highlighting the threat actor's continued focus on leveraging XSS flaws to steal data from email inboxes. It's worth noting that the server was attributed to APT28 by the Computer Emergency Response Team of Ukraine (CERT-UA) as far back as September 2024. "Fancy Bear developed a modular, multi-platform exploitation toolkit where a victim simply opening a malicious email – with no further clicks – could result in their credentials stolen, their 2FA bypassed, emails within their mailbox exfiltrated, and a silent forwarding rule established that persists indefinitely," Ctrl-Alt-Intel said. Analysis of a Beast Ransomware Server — An analysis of an open directory on a server ("5.78.84[.]144") associated with Beast, a ransomware-as-a-service (RaaS) that's suspected to be the successor to Monster ransomware, has uncovered the various tools used by the threat actors and the different stages of their attack lifecycle. These included Advanced IP Scanner and Advanced Port Scanner to map internal networks and find open remote desktop protocol (RDP) or server message block (SMB) ports. Also identified were programs to locate sensitive files for exfiltration and flag which servers hold the most data, as well as Mimikatz, LaZagne, and Automim (for credential harvesting), AnyDesk (for persistence), PsExec (for lateral movement), and MEGASync (for data exfiltration). Beast ransomware operations paused in November 2025 and resumed in January 2026. GrapheneOS Opposes the Unified Attestation Initiative — GrapheneOS has come out strongly against Unified Attestation, stating it "serves no truly useful purpose beyond giving itself an unfair advantage while pretending it has something to do with security." The Unified Attestation initiative is an open-source, decentralized alternative to the Google Play Integrity API to provide device and app integrity checks for custom ROMs without requiring Google Play Services. "We strongly oppose the Unified Attestation initiative and call for app developers supporting privacy, security, and freedom on mobile to avoid it," GraphenseOS said. "Companies selling phones should not be deciding which operating systems people are allowed to use for apps." VoidStealer Uses Chrome Debugger to Steal Secrets — An information stealer known as VoidStealer has observed using a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the "v20_master_key" directly from browser memory and use it to decrypt sensitive data stored in the browser. VoidStealer is a malware-as-a-service (MaaS) infostealer that began being marketed on several dark web forums in mid-December 2025. The ABE bypass technique was introduced in version 2.0 of the stealer announced on March 13, 2026. "The bypass requires neither privilege escalation nor code injection, making it a stealthier approach compared to alternative ABE bypass methods," Gen Digital said. VoidStealer is assessed to have adopted the technique from the open-source ElevationKatz project. FBI Says it is Buying Americans' location Data — FBI director Kash Patel admitted that the agency is buying location data that can be used to track people's movements without a warrant. "We do purchase commercially available information that’s consistent with the Constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us," Patel said at a hearing before the Senate Intelligence Committee. Iranian Botnet Exposed via Open Directory — An Open Directory on "185.221.239[.]162:8080" has been found to contain several payloads, including a Python-based botnet script, a compiled DDoS binary, multiple C-language denial-of-service files, and IP addresses associated with SSH credentials. "A Python script called ohhhh.py reads credentials in a host:port|username|password format and opens 500 concurrent SSH sessions, compiling and launching the bot client on each host automatically," Hunt.io said. "The exposed .bash_history captured three distinct phases of work: standing up the tunnel network, building and testing DDoS tooling against live targets, and iterative botnet development across multiple script versions." The activity has not been linked to any state-directed campaign. OpenClaw Developers Targeted in Phishing Attack — OpenClaw's combination of flexibility, local control, and a fast-growing ecosystem has made it popular among developers in a very short time. While that unprecedented adoption speed has exposed organizations to new security risks of its own (i.e., vulnerabilities and the presence of malicious skills on ClawHub and SkillsMP), threat actors are also capitalizing on the brand name and reputation to set up fake GitHub accounts for a phishing campaign that lures unsuspecting developers with promises of free $CLAW tokens and trick them into connect their cryptocurrency wallet. "The threat actor creates fake GitHub accounts, opens issue threads in attacker-controlled repositories, and tags dozens of GitHub developers," OX Security researchers Moshe Siman Tov Bustan and Nir Zadok said. "The posts claim that recipients have won $5,000 worth of CLAW tokens and can collect them by visiting a linked site and connecting their crypto wallet." The linked site ("token-claw[.]xyz") is a near-identical clone of openclaw.ai rigged with a wallet-draining "Connect your wallet" button designed to conduct cryptocurrency theft. New Campaign Targets Energy Operations Personnel in Pakistan — A targeted campaign against operations personnel at energy firms linked to projects in Pakistan has leveraged phishing emails mimicking invitations to the upcoming Pakistan Energy Exhibition & Conference (PEEC). The messages, sent from compromised accounts from a Pakistani university and a government organization, aim to deceive victims into opening PDF attachments with a fake Adobe Acrobat Reader update prompt. Clicking the update leads to the download of a ClickOnce application resource that drops the Havoc Demon C2 framework. "The redirect chain was also wrapped in geofencing and browser fingerprinting, limiting access to intended targets," Proofpoint said. "That likely reduced the exposure to automated analysis while keeping the delivery path tightly scoped." The activity has been codenamed UNK_VaporVibes. It's assessed to share overlaps with activity publicly associated with SloppyLemming. Over 373K Dark Web Sites Down — International law enforcement agencies announced the takedown of one of the largest known networks of fraudulent platforms on the dark web, uncovering hundreds of thousands of fake websites used to scam users seeking child sexual abuse content. A 10-day international operation led by German authorities and supported by Europol shut down more than 373,000 dark web domains run by a 35-year-old man based in China, who had been operating a sprawling network of fraudulent platforms since at least 2021. While the sites advertised child abuse material and cybercrime-as-a-service offerings, nothing was actually delivered after victims made a payment in Bitcoin. The fraudulent scheme netted the operator an estimated €345,000 from around 10,000 people. Authorities from 23 countries participated in the operation, and have since identified 440 customers whose purchases are now under active investigation. Malicious npm Packages Steal Secrets — Two malicious npm packages, sbx-mask and touch-adv, have been found to steal secrets from victims' computers. While one invokes the malicious code via the postinstall script, the other executes it when application code is invoked by the developer after importing it. "The evidence strongly suggests account takeover of a legitimate publisher, rather than intentional malicious activity," Sonatype said. "Hijacked publisher accounts are particularly concerning as, over time, maintainers build trust with the users of their components. Attackers aim to take advantage of that trust in order to steal valuable, or profitable, information." China to Have Its Own Post-Quantum Cryptography in 3 Years — China is reportedly planning to develop its own national post-quantum cryptography standards within the next three years, according to a report from Reuters. The U.S. finalized its first set of post-quantum cryptography standards in 2024 and is aiming to achieve full industry migration by 2035. What's Next for Tycoon2FA? — A recent law enforcement operation dismantled the infrastructure associated with the Tycoon2FA phishing-as-a-service (PhaaS) platform. However, a new analysis from Bridewell has revealed that some of the 2FA phishing CAPTCHA pages are still live. The lingering activity, the cybersecurity company noted, stems from the fact that these pages operate on a massive network of compromised third-party sites, legitimate SaaS platforms, and thousands of disposable domains. "Operators and affiliates are highly agile and will attempt to rebuild, migrate to new infrastructure, or pivot to competing PhaaS platforms," it added. "The live CAPTCHA pages we are seeing may belong to surviving criminal affiliates attempting to keep their individual campaigns breathing on secondary proxy networks." 🔧 Cybersecurity Tools MESH → It is an open-source tool from BARGHEST that enables remote mobile forensics and network monitoring over an encrypted, peer-to-peer mesh network resistant to censorship. It connects Android/iOS devices behind firewalls or CGNAT using a modified Tailscale-like protocol (no central servers needed), supports ADB wireless debugging, libimobiledevice, PCAP capture, and Suricata IDS—allowing secure, direct access for live logical acquisitions in restricted or hostile environments. enject → It is a lightweight Rust tool that protects .env secrets from AI assistants like Copilot or Claude. It replaces real values in your .env file with placeholders (e.g., en://api_key). Secrets stay encrypted in a per-project store (AES-256-GCM, master password protected). When you run enject run -- , it decrypts them only in memory at runtime, then wipes them—never leaving plaintext on disk. Open-source, macOS/Linux, perfect for safe local development. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion And that’s the week. The real pattern isn’t any one story; it’s the gap. The gap between a flaw and detection. Between a patch and a deployment. Between knowing and doing. Most of this week’s damage happened in that gap, and it’s not new. Before you move on: update your mobile devices, review anything touching your CI/CD pipeline, and don’t store crypto wallet recovery phrases in notes apps.

Details USN-8097-1 fixed a vulnerability in roundcube. The update caused a regression affecting the HTML sanitizer, preventing Roundcube from rendering any email message body. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Roundcube Webmail did not properly sanitize the animate tag within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack. USN-8097-1 fixed a vulnerability in roundcube. The update caused a regression affecting the HTML sanitizer, preventing Roundcube from rendering any email message body. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Roundcube Webmail did not properly sanitize the animate tag within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Details It was discovered that Roundcube Webmail did not properly sanitize the animate tag within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy. Fresh messes, old problems getting sharper, and research that stops feeling theoretical real fast. A few bits hit a little too close to real life, too. There’s a good mix here: weird abuse of trusted stuff, quiet infrastructure ugliness, sketchy chatter, and the usual reminder that attackers will use anything that works. Scroll on. You’ll see what I mean. ⚡ Threat of the Week Google Patches 2 Actively Exploited Chrome 0-Days — Google released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the wild. The vulnerabilities related to an out-of-bounds write vulnerability in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine (CVE-2026-3910) that could result in out-of-bounds memory access or code execution, respectively. Google did not share additional details about the flaws, but acknowledged that there exist exploits for both of them. The issues were addressed in Chrome versions 146.0.7680.75/76 for Windows and Apple macOS, and 146.0.7680.75 for Linux. Detection Starts the Clock. Response Decisions Shape the Outcome When incidents escalate, early decisions determine containment and impact. Join this SANS IR Command Roundtable to learn how experienced teams avoid investigation drift, improve coordination, and execute faster response across cloud, enterprise, and operational environments. Watch the Webcast ➝ 🔔 Top News Meta to Discontinue Instagram E2EE in May 2026 — Meta announced plans to discontinue support for end-to-end encryption (E2EE) for chats on Instagram after May 8, 2026. In a statement shared with The Hacker News, a Meta spokesperson said, "Very few people were opting in to end-to-end encrypted messaging in DMs, so we're removing this option from Instagram in the coming months. Anyone who wants to keep messaging with end-to-end encryption can easily do that on WhatsApp." Authorities Disrupt SocksEscort Service — A court-authorized international law enforcement operation dismantled a criminal proxy service named SocksEscort that enslaved thousands of residential routers worldwide into a botnet for committing large-scale fraud. "The malware allowed SocksEscort to direct internet traffic through the infected routers. SocksEscort sold this access to its customers," the U.S. Justice Department said. The main thing to note here is that SocksEscort was powered by AVrecon, a malware written in C to explicitly target MIPS and ARM architectures via known security flaws in edge network devices. The malware also featured a novel persistence mechanism that involved flashing custom firmware, which intentionally disables future updates, permanently transforming SOHO routers into SocksEscort proxy nodes to blindside corporate monitoring. UNC6426 Exploits nx npm Supply Chain Attack to Gain AWS Admin Access in 72 Hours — A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package in August 2025 to completely breach a victim's AWS environment within 72 hours. UNC6426 used the access to abuse the GitHub-to-AWS OpenID Connect (OIDC) trust and create a new administrator role in the cloud environment, Google said. Subsequently, this role was abused to exfiltrate files from the client's Amazon Web Services (AWS) Simple Storage Service (S3) buckets and perform data destruction in their production cloud environments. KadNap Enslaves Network Devices to Fuel Illegal Proxy — A takedown-resistant botnet comprising more than 14,000 routers and other network devices has been conscripted into a proxy network that anonymously ferries traffic used for cybercrime. The botnet, named KadNap, exploits known vulnerabilities in Asus routers (among others), leveraging the initial access to drop shell scripts that reach out to a peer-to-peer network based on Kademlia for decentralized control. Infected devices are being used to fuel a proxy service named Doppelganger that, for a fee, tunnels customers' internet traffic through residential IP addresses, offering a way for attackers to blend in and make it harder to differentiate malicious traffic from legitimate activity. APT28 Strikes with Sophisticated Toolkit — The Russian threat actor known as APT28 has been observed using a bespoke toolkit in recent cyber espionage campaigns targeting Ukrainian cyber assets. The primary components of the toolkit are two implants, one of which employs techniques from a malware framework the threat actor used in 2010s, while the other is a heavily modified version of the COVENANT framework for long-term spying. COVENANT is used in concert with BEARDSHELL to facilitate data exfiltration, lateral movement, and execution of PowerShell commands. Also alongside these tools is a malware named SLIMAGENT that shares overlaps with XAgent. ️🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-3909, CVE-2026-3910, CVE-2026-3913 (Google Chrome), CVE-2026-21666, CVE-2026-21667, CVE-2026-21668, CVE-2026-21672, CVE-2026-21708, CVE-2026-21669, CVE-2026-21671 (Veeam Backup & Replication), CVE-2026-27577, CVE-2026-27493, CVE-2026-27495, CVE-2026-27497 (n8n), CVE-2026-26127, CVE-2026-21262 (Microsoft Windows), CVE-2019-17571, CVE-2026-27685 (SAP), CVE-2026-3102 (ExifTool for macOS), CVE-2026-27944 (Nginx UI), CVE-2025-67826 (K7 Ultimate Security), CVE-2026-26224, CVE-2026-26225 (Intego X9), CVE-2026-29000 (pac4j-jwt), CVE-2026-23813 (HPE Aruba Networking AOS-CX), CVE-2025-12818 (PostgreSQL), CVE-2026-2413 (Ally WordPress plugin), CVE-2026-0953 (Tutor LMS Pro WordPress plugin), CVE-2026-25921 (Gogs), CVE-2026-2833, CVE-2026-2835, CVE-2026-2836 (Cloudflare Pingora), CVE-2026-24308 (Apache ZooKeeper), CVE-2026-3059, CVE-2026-3060, CVE-2026-3989 (SGLang), CVE-2026-0231 (Palo Alto Networks Cortex XDR Broker VM), CVE-2026-20040, CVE-2026-20046 (Cisco IOS XR Software), CVE-2025-65587 (graphql-upload-minimal), CVE-2026-3497 (OpenSSH), CVE-2026-26123 (Microsoft Authenticator for Android and iOS), and CVE-2025-61915 (CUPS). 🎥 Cybersecurity Webinars Stop Guessing: Automate Your Defense Against Real-World Attacks → Learn how to move beyond basic security checklists by using automation to test your defenses against real-world attacks. Experts will show you why traditional testing often fails and how to use continuous, data-driven tools to find and fix gaps in your protection. You will learn how to prove your security actually works without increasing your manual workload. Fix Your Identity Security: Closing the Gaps Before Hackers Find Them → This webinar covers a new study about why many companies are struggling to keep their user accounts and digital identities safe. Experts share findings from the Ponemon Institute on the biggest security gaps, such as disconnected apps and the new risks created by AI. You will learn simple, practical steps to fix these problems and get better control over who has access to your company's data. The Ghost in the Machine: Securing the Secret Identities of Your AI Agents → As artificial intelligence (AI) begins to act on its own, businesses face a new challenge: how to give these "AI agents" the right digital IDs. This webinar explains why current security for humans doesn't work for autonomous bots and how to build a better system to track what they do. You will learn simple, real-world steps to give AI agents secure identities and clear rules, ensuring they don't accidentally expose your private company data. 📰 Around the Cyber World Fake Google Security Check Drops Browser RAT — A web page mimicking a Google Account security page has been spotted delivering a fully featured browser-based surveillance toolkit that takes the form of a Progressive Web App (PWA). "Disguised as a routine security checkup, it walks victims through a four-step flow that grants the attacker push notification access, the device's contact list, real-time GPS location, and clipboard contents—all without installing a traditional app," Malwarebytes said. "For victims who follow every prompt, the site also delivers an Android companion package introducing a native implant that includes a custom keyboard (enabling keystroke capture), accessibility-based screen reading capabilities, and permissions consistent with call log access and microphone recording." Forbidden Hyena Delivers BlackReaperRAT — A hacktivist group known as Forbidden Hyena (aka 4B1D) has distributed RAR archives in December 2025 and January 2026 in attacks targeting Russia that led to the deployment of a previously undocumented remote access trojan called BlackReaperRAT and an updated version of the Blackout Locker ransomware, referred to as Milkyway by the threat actors. BlackReaperRAT is capable of running commands via "cmd.exe," uploading/downloading files, spawning an HTTP shell to receive commands, and spreading the malware to connected removable media. "It carries out destructive attacks against organizations across various sectors located within the Russian Federation," BI.ZONE said. "The group publishes information regarding successful attacks on its Telegram channel. It collaborates with the groups Cobalt Werewolf and Hoody Hyena." Chinese Hackers Target the Persian Gulf region with PlugX — A China-nexus threat actor, likely suspected to be Mustang Panda, has targeted countries in the Persian Gulf region. The activity took place within the first 24 hours of the ongoing conflict in the Middle East late last month. The campaign used a multi-stage attack chain that ultimately deployed a PlugX backdoor variant. "The shellcode and PlugX backdoor used obfuscation techniques such as control flow flattening (CFF) and mixed boolean arithmetic (MBA) to hinder reverse engineering," Zscaler said. "The PlugX variant in this campaign supports HTTPS for command-and-control (C2) communication and DNS-over-HTTPS (DOH) for domain resolution." Phishing Campaign Uses SEO Poisoning to Steal Data — A phishing campaign has employed SEO poisoning to direct search engine results to fake traffic ticket portals that impersonate the Government of Canada and specific provincial agencies. "The campaign lures victims to a fake 'Traffic Ticket Search Portal' under the pretense of paying outstanding traffic violations," Palo Alto Networks Unit 42 said. "Submitted data includes license plates, address, date of birth, phone/email, and credit card numbers." The phishing pages utilize a "waiting room" tactic where the victim's browser polls the server every two seconds and triggers redirects based on specific status codes. Roundcube Exploitation Toolkit Discovered — Hunt.io said it discovered a Roundcube exploitation toolkit on an internet-exposed directory on 203.161.50[.]145. It's worth noting that Russian threat actors like APT28, Winter Vivern, and TAG-70 have repeatedly targeted Roundcube vulnerabilities to breach Ukrainian organizations. "The directory included development and production XSS payloads, a Flask-based command-and-control server, CSS-injection tooling, operator bash history, and a Go-based implant deployed on a compromised Ukrainian web application," the company said, attributing it with medium to high confidence to APT28, citing overlaps with Operation RoundPress. The toolkit, dubbed Roundish, supports credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and two-factor authentication (2FA) secret extraction, mirroring a feature present in MDAEMON. One of the primary targets of the attack is mail.dmsu.gov[.]ua, a Roundcube webmail instance associated with Ukraine's State Migration Service (DMSU). Besides the possibility of a shared development lineage, Roundish introduces four new components not previously documented in APT28 webmail activity, including a CSS-based side-channel module, browser credential stealer, and a Go-based backdoor that provides persistence via cron, systemd, and SELinux. The CSS injection component is designed to progressively extract characters from Roundcube's document object model (DOM) without injecting any JavaScript into the victim's page. The technique is likely used for targeting Cross-Site Request Forgery (CSRF) tokens or email UIDs. Central to the Roundish toolkit is an XSS payload that's engineered to steal the victim's email address, harvest account credentials, redirect all incoming emails to a Proton Mail address, export mailbox data from the victim's Inbox and Sent folders, and gather the victim's complete address book. "The combination of hidden autofill credential harvesting, server-side mail forwarding persistence, bulk mailbox exfiltration, and browser credential theft reflects a modular approach designed for sustained access," Hunt.io said. "From a defensive perspective, password resets alone are not sufficient in cases like this. Mail forwarding rules, Sieve filters, and multi-factor authentication secrets must be audited and reset." Phishing Campaign Targeting AWS Console Credentials — An active adversary-in-the-middle (AiTM) phishing campaign is using fake security alert emails to steal AWS Console credentials, per Datadog. "The phishing kit proxies authentication to the legitimate AWS sign-in endpoint in real time, validating credentials before redirecting victims and likely capturing one-time password (OTP) codes," the company said. "This campaign does not exploit AWS vulnerabilities or abuse AWS infrastructure." Post-compromise console access has been observed within 20 minutes of credential submission. These efforts originated from Mullvad VPN infrastructure. Malicious npm Packages Deliver Cipher stealer — Two new malicious npm packages, bluelite-bot-manager and test-logsmodule-v-zisko, were found to deliver via Dropbox a Windows executable designed to siphon sensitive data, including Discord totems, credentials from Chrome, Edge, Opera, Brave, and Yandex browsers, and seed files from cryptocurrency wallet apps like Exodus. from compromised hosts using a stealer named Cipher stealer. "The stealer also uses an embedded Python script and a secondary payload downloaded from GitHub," JFrog said. GIBCRYPTO Ransomware Detailed — A new ransomware called GIBCRYPTO comes with the ability to capture keystrokes and corrupt the Master Boot Record (MBR) so that any attempt to restart the system will cause the system to run into an error. The ransomware uses the Salsa20 algorithm for encryption. It's suspected to be part of Snake Keylogger, indicating the malware authors' attempts to diversify beyond information theft. The development comes as Sygnia highlighted SafePay's OneDrive-based data exfiltration technique during a ransomware attack after breaching a victim by leveraging a FortiGate firewall flaw and a misconfigured administrative account. "SafePay gained initial access by exploiting a firewall misconfiguration, which enabled them to obtain local administrative credentials," the company said. "They rapidly escalated discovery and enumeration activities to identify high-value targets for lateral movement, demonstrating a structured and methodical approach to mapping the environment. Within a matter of hours, SafePay escalated to domain administrator access." The attack culminated in the deployment of ransomware, encrypting more than 60 servers. Fraudulent Account Registration Activity Originating from Vietnam — A sprawling cybercrime ecosystem based in Vietnam has been linked to a cluster of fraudulent account registration activity on platforms like LinkedIn, Instagram, Facebook, and TikTok. In these attacks, attributed to O-UNC-036, the threat actors rely on disposable email addresses in order to execute SMS pumping attacks, also called International Revenue Sharing Fraud (IRSF). "In this scheme, malicious actors automate the creation of puppet accounts in a targeted service provider," Okta said. "Fraudsters use these account registrations to trigger SMS messages to premium rate phone numbers and profit from charges incurred. This activity can prove costly for service providers who use SMS to verify registration information in customer accounts or to send multi-factor authentication (MFA) security codes." O-UNC-036 has also been linked to a cybercrime-as–a-service (CaaS) ecosystem that provides paid infrastructure and services to facilitate online fraud. The web-based storefronts are hosted in Vietnam and specialize in the sales of web-based accounts. Hijacked AppsFlyer SDK Distributes Crypto Clipper — The AppsFlyer Web SDK was briefly hijacked to serve malicious code to steal cryptocurrency in a supply chain attack. The clipper malware payload came with capabilities to intercept cryptocurrency wallet addresses entered on websites and replace them with attacker-controlled addresses to divert funds to the threat actor. "The AppsFlyer Web SDK was observed serving obfuscated malicious JavaScript instead of the legitimate SDK from websdk.appsflyer[.]com," Profero said. "The malicious payload appears to have been designed for stealth and compatibility, preserving legitimate SDK functionality while adding hidden browser hooks and wallet-hijacking logic." The incident has since been resolved by AppsFlyer. Operation CamelClone Targets Government and Defense Entities — A new cyber espionage campaign dubbed Operation CamelClone has targeted governments and defense entities in Algeria, Mongolia, Ukraine, and Kuwait using malicious ZIP archives that contain a Windows shortcut (LNK) file, which, when executed, delivers a JavaScript loader named HOPPINGANT. The loader then delivers additional payloads for establishing C2 and exfiltrating data to the MEGA cloud storage service. "One interesting aspect of this campaign is that the threat actor does not rely on traditional command-and-control infrastructure," Seqrite Labs said. "Instead, the payloads are hosted on a public file-sharing service, filebulldogs[.]com, while stolen data is uploaded to MEGA storage using the legitimate tool Rclone." The activity has not been attributed to any known threat group. How Threat Actors Exfiltrate Credentials Using Telegram Bots — Threat actors are abusing the Telegram Bot API to exfiltrate data via text messages or arbitrary file uploads, highlighting how legitimate services can be weaponized to evade detection. Agent Tesla Keylogger is by far the most prominent example of a malware family that uses Telegram for C2. "In general, Telegram C2s appear to be most popular among information stealers, possibly due to Telegram's technically legitimate nature and because information stealers typically only need to exfiltrate data passively rather than provide complex communications beyond simple message or file transfers," Cofense said. Microsoft Launches Copilot Health — Microsoft has become the latest company after OpenAI and Anthropic to launch a dedicated "secure space" called Copilot Health that integrates medical records, biometric data from wearables, and lab test results to give personalized advice in the U.S. "Copilot Health brings together your health records, wearable data, and health history into one place, then applies intelligence to turn them into a coherent story," the company said. Like OpenAI and Anthropic, Microsoft emphasized that Copilot Health isn't meant to replace professional medical care. Rogue AI Agents Can Work Together to Engage in Offensive Behaviors — According to a new report from artificial intelligence (AI) security company Irregular, agents can work together to hack into systems, escalate privileges, disable endpoint protection, and steal sensitive data while evading pattern-matching defenses. What's notable is that the experiment did not rely on adversarial prompting or deliberately unsafe system design. "In one case, an agent convinced another agent to carry out an offensive action, a form of inter-agent collusion that emerged with no external manipulation," Irregular said. "This scenario demonstrates two compounding risks: inter-agent persuasion can erode safety boundaries, and agents can independently develop techniques to circumvent security controls. When an agent is given access to tools or data, particularly but not exclusively shell or code access, the threat model should assume that the agent will use them, and that it will do so in unexpected and possibly malicious ways." 🔧 Cybersecurity Tools Dev Machine Guard → It is a free, open-source tool that scans your computer to show you exactly what developer tools and scripts are running. It creates a simple list of your AI coding assistants, code editor extensions, and software packages to help you find anything suspicious or outdated. It is a single script that works in seconds to give you better visibility into the security of your local coding environment. Trajan → It is an automated security tool designed to find hidden vulnerabilities in "service meshes," which are the systems that manage how different parts of a large software application talk to each other. Because these systems are complex, it is easy for engineers to make small mistakes in the settings that allow hackers to bypass security or steal data. Trajan works by scanning these configurations to spot those specific errors and helping developers fix them before they can be exploited. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion There’s a lot packed in here, and not in a neat way. Some of it is the usual recycled chaos, some of it feels a little more deliberate, and some of it has that nasty “this is going to show up everywhere by next week” energy. Anyway — enough throat-clearing. Here’s the stuff worth your attention.

For the latest discoveries in cyber research for the week of 2nd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Wynn Resorts, a United States-based casino and hotel operator, has confirmed that employee data was accessed following an extortion threat linked to ShinyHunters. The company said operations were not disrupted. Reports indicate the stolen dataset includes HR-related information, including contact details and employment records for current and former staff. UFP Technologies, a United States-based medical device manufacturing giant, has disclosed a cyberattack that compromised parts of its IT environment and resulted in data exfiltration. The company reported disruptions to shipping and labeling workflows. According to the company, some of its data was wiped in the attack. Transport Workers Union of America Local 100, which represents New York City transit workers, was targeted by the Qilin ransomware group and listed on its leak site. According to reports, personal data of the union’s 67,000 members is now at risk of fraud and identity misuse. Check Point Harmony Endpoint and Threat Emulation provide protection against this threat (Ransomware.Wins.Qilin.ta.* Ransomware.Wins.Qilin.) European home improvement marketplace ManoMano has reported a data breach tied to a third-party customer support portal. The exposed records include customer names, email addresses, phone numbers, and support ticket details. ManoMano said passwords and payment data were not affected, and notifications are being sent to impacted users. AI THREATS Check Point Research has discovered critical vulnerabilities in Anthropic’s Claude Code that allow attackers to achieve remote code execution and steal API credentials through malicious project configurations. Stolen keys can provide access to shared Workspaces for file access and tampering. Anthropic patched the issues, including CVE-2025-59536. Anthropic warns of coordinated “distillation” activity attributed to China-based AI firms, including DeepSeek, MiniMax, and Moonshot. Anthropic said fraudulent accounts generated millions of Claude exchanges aimed at extracting reasoning, coding, and agent workflows. The activity was described as an effort to train competing models. OpenAI has released a report listing malicious attempts to misuse its models. Among the threats listed in the report is an influence operation attempt linked to Chinese law enforcement, which targeted Japan’s prime minister. VULNERABILITIES AND PATCHES Two Roundcube Webmail flaws have been listed as exploited in the wild, including CVE-2025-49113, a high-severity post-auth remote code execution bug. The second issue, CVE-2025-68461, is an unauthenticated cross-site scripting flaw. The bugs affect widely used Roundcube deployments, including cPanel environments globally. Check Point IPS provides protection against this threat (Roundcube Webmail Remote Code Execution (CVE-2025-49113)) Researchers have unveiled a pre-auth remote code execution chain in SolarWinds Web Help Desk. The chain combines authentication bypass flaws CVE-2025-40552 and CVE-2025-40554 with deserialization RCE CVE-2025-40553. A successful attack can allow takeover of exposed help desk servers without credentials. The flaws affect widely deployed on-premises instances. Check Point IPS provides protection against these threats (SolarWinds Web Help Desk Authentication Bypass (CVE-2025-40536, CVE-2025-40554, CVE-2025-40552), SolarWinds Web Help Desk Insecure Deserialization (CVE-2024-28986, CVE-2024-28988, CVE-2025-40553, CVE-2025-26399)) Researchers alerted organizations about CVE-2026-20127, a critical authentication bypass in Cisco Catalyst SD-WAN Controller (CVSS 10) exploited in the wild for at least three years. Attackers can log in with high privileges, add rogue peers, and downgrade controllers to exploit CVE-2022-20775 for root access. CISA issued an emergency directive mandating fast patching. THREAT INTELLIGENCE REPORTS Check Point Research summarizes five key Iranian threat actor clusters relevant to the current conflict in the Middle East. It outlines the main TTPs these groups have recently used against targets in the Middle East and the United States and shares six defensive measures IT teams should take to help prevent attacks during the ongoing conflict. Check Point Research has published its Untold Stories of 2025, a compilation covering multiple notable campaigns that occurred during 2025. These include exploitation of Microsoft SharePoint (“ToolShell”), and adversary-in-the-middle phishing used to bypass MFA, as well as state-linked operations attributed to groups such as Camaro Dragon and COLDRIVER. The report also highlights evolving command-and-control techniques observed across Europe and Central Asia. Lazarus-linked operators were observed using Medusa ransomware in recent intrusions, including activity against a Middle Eastern entity and attempted access at a US healthcare organization. Medusa is described as a ransomware-as-a-service operation with leak-site activity. Check Point Harmony Endpoint and Threat Emulation provide protection against this threat. Researchers have uncovered GrayCharlie activity targeting WordPress sites by injecting external JavaScript that profiles visitors and delivers malware through fake updates or ClickFix-style prompts. Reporting links infections to NetSupport tooling, followed by Stealc and SectopRAT.

SolarWinds on Tuesday announced patches for four critical-severity vulnerabilities in its enterprise file transfer solution, Serv-U. All four security defects, tracked as CVE-2025-40538 to CVE-2025-40541, have a CVSS score of 9.1, could result in remote code execution, and impact Serv-U version 15.5. CVE-2025-40538, SolarWinds explains, is a broken access control issue that could allow threat actors to create a system admin user and execute arbitrary code with the elevated privileges of domain admin or group admin. CVE-2025-40539 and CVE-2025-40540 are type confusion flaws that allow attackers to execute code with elevated privileges, the company notes, without providing additional details. CVE-2025-40541 is described as an insecure direct object reference (IDOR) bug leading to the execution of native code in the context of a privileged account. The successful exploitation of all four vulnerabilities, SolarWinds explains, requires that an attacker have administrative privileges on the vulnerable Serv-U instance. “On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default,” the company says. All four CVEs were resolved with the release of SolarWinds Serv-U version 15.5.4. Additional information can be found on SolarWinds’ security advisories page. SolarWinds makes no mention of any of these flaws being exploited in the wild, but users are advised to update their instances as soon as possible. Threat actors are known to target SolarWinds bugs in attacks, including issues affecting the Serv-U file transfer appliances. In late January, SolarWinds rolled out fixes for Web Help Desk (WHD) security defects that had been potentially exploited as zero-days in attacks observed in December 2025. In mid-February, the US cybersecurity agency CISA added one of the issues to its Known Exploited Vulnerabilities (KEV) list. Related: VMware Aria Operations Vulnerability Could Allow Remote Code Execution Related: Recent RoundCube Webmail Vulnerability Exploited in Attacks Related: Critical Grandstream Phone Vulnerability Exposes Calls to Interception

Rilevate attività malevole al fine di ottenere privilegi elevati e persistenza sui sistemi Bollettino BL01/260224/CSIRT-ITA Sintesi Questo CSIRT ha recentemente osservato attività malevole volte a sfruttare vulnerabilità note presenti in prodotti Roundcube non adeguatamente aggiornati. Tali attività, perpetrate ai danni di organizzazioni localizzate sul territorio nazionale, hanno come obiettivo l’ottenimento di persistenza, di privilegi elevati e la possibilità di effettuare azioni di ricognizione sulle infrastrutture interessate. Descrizione e potenziali impatti Questo CSIRT ha recentemente osservato attività malevole volte a sfruttare vulnerabilità note presenti in prodotti Roundcube non adeguatamente aggiornati. Tali attività, perpetrate ai danni di organizzazioni localizzate sul territorio nazionale, hanno come obiettivo l’ottenimento di persistenza, di privilegi elevati e la possibilità di effettuare azioni di ricognizione sulle infrastrutture interessate. Le evidenze raccolte indicano che l’accesso iniziale sia stato verosimilmente ottenuto mediante lo sfruttamento di vulnerabilità note presenti su server Roundcube esposti sulla rete Internet. La fase di post-exploitation si è articolata in tre passaggi: Persistenza e Accesso Remoto: installazione di webshell, nello specifico reGeorg, per creare tunnel SOCKS e mantenere il controllo costante sul server compromesso. Ricognizione Interna: utilizzo del tool fscan per la scansione della rete interna, identificazione di altri asset e mappatura delle porte aperte, propedeutica ad eventuali movimenti laterali. Privilege Escalation: impiego dell'exploit GodPotato (sfruttando il protocollo DCOM/RPCHTTP) per forzare l'acquisizione di privilegi di sistema (NT AUTHORITY\SYSTEM) partendo da account con privilegi limitati. Dettagli inerenti alle vulnerabilità note Le evidenze raccolte indicano che l'attacco ha presumibilmente interessato una o più delle vulnerabilità note presenti nelle istanze Roundcube Webmail esposte e non adeguatamente aggiornate (versioni ≤ 1.6.8): CVE-2025-49113 (Deserialization of Untrusted Data): di tipo “Remote Code Execution” post-autenticazione è dovuta da una non opportuna deserializzazione di oggetti PHP. Nel dettaglio, la falla risiede nella totale assenza di validazione del parametro _from nel file program/actions/settings/upload.php. CVE-2025-68460 (Improper Encoding or Escaping of Output): vulnerabilità di tipo “Information Disclosure”, causata da un errore logico presente nell’HTML Style Sanitizer di Roundcube Webmail. Tale problematica consentirebbe, a un utente autenticato, l’accesso a dati non autorizzati a causa di controlli di validazione e autorizzazione non sufficienti nelle richieste applicative. CVE-2025-68461 (Improper Neutralization of Input During Web Page Generation): vulnerabilità di tipo “Stored Cross-Site Scripting” deriva dall’erronea sanitizzazione del tag nei file SVG. Nel dettaglio un utente malintenzionato potrebbe iniettare codice JavaScript nel contesto della sessione Roundcube della vittima, inducendo quest’ultima a visualizzare l'immagine malevola opportunamente predisposta. Dettaglio sugli strumenti utilizzati dagli attaccanti reGeorg reGeorg è una webshell avanzata progettata per trasformare un server compromesso in un pivot proxy, consentendo agli attaccanti di instradare traffico TCP attraverso di esso. Viene utilizzata per ottenere accesso persistente ed eseguire tunneling verso sistemi interni non esposti e risulta utile per aggirare le restrizioni di rete e facilitare eventuali movimenti laterali. fscan fscan è un tool di network scanning multiprotocollo ampiamente utilizzato nelle operazioni di post-exploitation, progettato per effettuare scansioni complete delle reti interne in modo automatico. Tra le principali peculiarità si evidenziano le capacità di: enumerare rapidamente host interni, identificare porte aperte, servizi attivi e misconfigurazioni, rilevare vulnerabilità sfruttabili, individuare credenziali deboli o servizi esposti. Oltre ad essere uno strumento particolarmente efficace nelle fasi di ricognizione interna, viene tipicamente utilizzato in maniera impropria per accelerare la mappatura dell’infrastruttura compromessa. GodPotato GodPotato è un exploit che sfrutta vulnerabilità nei meccanismi di autorizzazione/impersonificazione dei servizi Windows, permettendo a un utente con privilegi limitati di ottenere privilegi NT AUTHORITY\SYSTEM. Viene comunemente impiegato per: eseguire privilege escalation su host Windows; ottenere privilegi di amministratore locale; preparare l’ambiente a payload più avanzati; installare nuovi servizi o script con privilegi elevati. Criticità e superficie di esposizione Il caso trattato sottolinea, ancora una volta, quanto sia rischioso esporre servizi applicativi su Internet senza garantire un’adeguata protezione tramite misure di sicurezza e aggiornamenti costanti. Sistemi accessibili pubblicamente, ove non correttamente configurati o mantenuti, costituiscono infatti un vettore privilegiato per gli attaccanti, che possono sfruttare vulnerabilità note, configurazioni errate o di default per ottenere un punto di accesso nella rete dell’organizzazione. Questi scenari sono stati ampiamente trattati nell’ambito del bollettino BL01/250626/CSIRT-ITA, che rimarca come la presenza di tali scenari incrementino la superficie di esposizione e il rischio di compromissione. L'analisi del contesto italiano (Figura 1) evidenzia una presenza non trascurabile di istanze Roundcube Webmail accessibili da rete pubblica. Tale scenario delinea una superficie di esposizione che, nell'attuale ecosistema digitale, suggerisce un'attenzione costante alle configurazioni di sicurezza e un monitoraggio puntuale dei sistemi, al fine di favorire la resilienza degli asset interessati rispetto alle dinamiche evolutive delle minacce informatiche. Azioni di mitigazione Gli utenti e le organizzazioni possono far fronte a questa tipologia di attacchi attivando le seguenti misure preventive: applicare regolarmente patch di sicurezza a sistemi operativi, applicazioni e middleware, riducendo la superficie di attacco sfruttabile da vulnerabilità note; valutare la sostituzione di prodotti giunti a fine ciclo di vita (EOL), che non riceveranno ulteriori aggiornamenti dal vendor, con soluzioni moderne e supportate; esporre all’esterno solo i servizi strettamente necessari, limitando l’accesso tramite firewall e VPN; implementare la segmentazione della rete e VLAN dedicate al fine di isolare eventuali sistemi critici; rimuovere dalle configurazioni componenti e moduli non necessari; disabilitare funzionalità predefinite non utilizzate e applicare configurazioni sicure consigliate dai vendor; utilizzare meccanismi di autenticazione forte (multi-factor authentication); implementare una gestione rigorosa delle credenziali e ruotare periodicamente le password; abilitare logging e audit dettagliati per individuare attività sospette; integrare sistemi EDR/XDR e SIEM per rilevare indicatori di compromissione (IoC) o tecniche di attacco (es. process injection, credential dumping); mantenere copie di backup offline e testare regolarmente i piani di ripristino; definire procedure di incident response aggiornate al fine di reagire prontamente a eventuali compromissioni. Azioni di risposta agli incidenti Qualora si riscontrino evidenze di avvenuta compromissione sui propri sistemi, si raccomanda agli utenti e alle organizzazioni di attuare le seguenti azioni: collezionare eventuali evidenze, quali processi/servizi in esecuzione su dispositivi target, log di rete e log di autenticazione considerati non convenzionali; porre in isolamento e/o offline gli host potenzialmente interessati dalla compromissione; ripristinare gli host compromessi ad un’immagine precedente consistente (dopo aver espletato le necessarie attività forensi); resettare gli account degli utenti interessati dalla compromissione; segnalare tempestivamente a questo CSIRT, tramite il portale https://segnalazioni.acn.gov.it/ l’evento occorso. Criticità Alto (70.0) Tipologia d'attacco (MITRE) Data pubblicazione 24/02/26 ore 12:11 Data Ultimo Aggiornamento 24/02/26 ore 12:28

CISA flagged two Roundcube Webmail vulnerabilities as actively exploited in attacks and ordered U.S. federal agencies to patch them within three weeks. Roundcube Webmail is a web-based email client that has been the default mail interface for the widely used cPanel web hosting control panel since 2008. The first vulnerability tagged as actively abused by threat actors is a critical remote code execution flaw tracked as CVE-2025-49113, which was first flagged as exploited days after it was patched in June 2025, when Internet security watchdog Shadowserver warned that over 84,000 vulnerable Roundcube webmail installations were vulnerable to attacks. Roundcube patched the second one (CVE-2025-68461) two months ago, in December 2025, warning that remote, unauthenticated attackers can exploit it through low-complexity cross-site scripting (XSS) attacks that abuse the animate tag in SVG documents. "We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions," the Roundcube security team warned when it released versions 1.6.12 and 1.5.12 that address this security flaw. Shodan currently tracks over 46,000 Roundcube instances accessible on the internet. However, there is no information on how many of them are vulnerable to CVE-2025-49113 or CVE-2025-68461 attacks. While it didn't provide any details on attacks exploiting these two security flaws, CISA added them to its Known Exploited Vulnerabilities (KEV) Catalog on Friday, warning that they are "frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise." CISA also tracks ten other Roundcube Webmail vulnerabilities that are either actively exploited in attacks or have been abused in the past. The U.S. cybersecurity agency has ordered Federal Civilian Executive Branch (FCEB) agencies to secure their systems against these security bugs within three weeks, by March 13, as mandated by a binding operational directive (BOD 22-01) issued in November 2021. Roundcube vulnerabilities have been a popular target for cybercrime and state-sponsored threat groups, the most recent being a stored cross-site scripting (XSS) vulnerability (CVE-2023-5631) exploited by the Winter Vivern (TA473) Russian hacking group in zero-day attacks targeting European government entities and by the Russian APT28 cyber-espionage group to breach Ukrainian government email systems. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The US cybersecurity agency CISA on Friday warned of two RoundCube Webmail vulnerabilities being exploited in the wild. Prevalent within government and enterprise networks, RoundCube Webmail is a popular target for hackers, who have been observed exploiting flaws in the email client within days of public disclosure. This was the case in June last year with CVE-2025-49113 (CVSS score of 9.9), a post-authentication remote code execution (RCE) issue that was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on Friday. The critical bug was introduced over a decade ago and impacts all RoundCube versions 1.1.0 through 1.6.10, allowing attackers to include a payload in the name of files to be uploaded, leading to data being injected in the current session. The security defect was patched on June 1, 2025, and threat actors devised exploit code targeting it within days, claiming that credentials needed for successful exploitation could be brute forced. On Friday, CISA warned that, in addition to CVE-2025-49113, threat actors have been exploiting CVE-2025-68461 (CVSS score of 7.2), a high-severity RoundCube vulnerability patched in December 2025. The flaw, an XSS issue exploitable via the animate tag in an SVG document, was resolved in Webmail versions 1.6.12 and 1.5.12. The vulnerable RoundCube releases did not properly sanitize malicious payloads that could be embedded in the animate tag, allowing attackers to execute code in the context of the victim’s browser session without user interaction. CISA has urged federal agencies to patch both RoundCube vulnerabilities within three weeks, as mandated by Binding Operational Directive (BOD) 22-01. All organizations are advised to review CISA’s KEV catalog and prioritize addressing the security defects it contains. Related: BeyondTrust Vulnerability Exploited in Ransomware Attacks Related: Dell RecoverPoint Zero-Day Exploited by Chinese Cyberespionage Group Related: Google Patches First Actively Exploited Chrome Zero-Day of 2026 Related: CISA Warns of Exploited SolarWinds, Notepad++, Microsoft Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Roundcube webmail software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are listed below - CVE-2025-49113 (CVSS score: 9.9) - A deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. (Fixed in June 2025) CVE-2025-68461 (CVSS score: 7.2) - A cross-site scripting vulnerability via the animate tag in an SVG document. (Fixed in December 2025) Dubai-based cybersecurity company FearsOff, whose founder and CEO, Kirill Firsov, was credited with discovering and reporting CVE-2025-49113, said attackers have already "diffed and weaponized the vulnerability" within 48 hours of public disclosure of the flaw. An exploit for the vulnerability was subsequently made available for sale on June 4, 2025. Firsov also noted that the shortcoming can be triggered reliably on default installations, and that it had been hidden in the codebase for over 10 years. There are no details on who is behind the exploitation of the two Roundcube flaws. But multiple vulnerabilities in the email software have been weaponized by nation-state threat actors like APT28 and Winter Vivern. Federal Civilian Executive Branch (FCEB) agencies are to remediate identified vulnerabilities by March 13, 2026, to secure their networks against the active threat.

Roundcube heeft een kwetsbaarheid verholpen in Roundcube Webmail. Een ongeauthenticeerde kwaadwillende kan de kwetsbaarheid misbruiken voor het uitvoeren van een cross-site-scripting-aanval. De kwaadwillende kan op die manier JavaScript-code in de browser van een gebruiker uitvoeren en bijvoorbeeld een gebruikersaccount overnemen. Hiertoe dient de kwaadwillende een e-mail met een malafide SVG-bestand naar het slachtoffer te sturen.

Vulnerabilità in Roundcube Webmail Alert AL08/251219/CSIRT-ITA Sintesi Aggiornamenti di sicurezza sanano due vulnerabilità, di cui una con gravità “alta” in Roundcube Webmail, noto gestore di posta elettronica open source. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato remoto il furto di credenziali, token di sessione e dati sensibili. Tipologia Information disclosure Prodotti e versioni affette Roundcube Webmail 1.6.x, versioni precedenti alla 1.6.12 1.5.x LTS, versioni precedenti alla 1.5.12 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili come indicato nei bollettini di sicurezza riportati nella sezione Riferimenti.

Russia-linked hackers intensify attacks as global APT activity shifts State-aligned hacking groups have spent the past six months ramping up espionage, sabotage, and cybercrime campaigns across multiple regions, according to ESET’s APT Activity Report covering April through September 2025. The research highlights how operations linked to Russia, China, Iran, and North Korea have evolved in scope and technique, showing that nation-state activity remains a constant source of disruption. Attack sources (Source: ESET) Russia’s focus on Ukraine and its allies Russia-linked actors remained among the most aggressive. Their main focus continued to be Ukraine, along with European Union countries that support Kyiv. Roughly 40 percent of all APT activity tracked during this period came from groups tied to Moscow. RomCom, one of the most active Russia-aligned groups, exploited a zero-day vulnerability in WinRAR in mid-2025. The flaw, now patched, let attackers execute malicious code simply by convincing victims to open a crafted archive file. ESET says the campaign targeted financial, manufacturing, defense, and logistics firms across Europe and Canada. Gamaredon also expanded operations in Ukraine with a noticeable rise in both frequency and sophistication. The group experimented with new tools, using cloud storage and tunneling services to move stolen data. In a rare collaboration between Russian cyber units, Gamaredon deployed one of Turla’s backdoors, suggesting selective cooperation on high-value targets. Meanwhile, Sandworm continued destructive attacks inside Ukraine. Using data-wiping malware such as ZEROLOT and Sting, it struck government, energy, logistics, and grain-sector organizations, likely aiming to weaken Ukraine’s wartime economy. Another actor, InedibleOchotense, impersonated ESET itself in phishing campaigns that delivered a trojanized installer carrying the Kalambur backdoor. China expands its reach to Latin America China-aligned groups stayed active across Asia, Europe, and the Americas, accounting for about 26 percent of the observed activity. Their operations reflected Beijing’s strategic goals, with a new emphasis on Latin America. The group FamousSparrow launched an extensive campaign against government entities in Argentina, Guatemala, Honduras, Panama, and Ecuador. ESET researchers believe this regional focus ties to growing U.S.–China competition, as Washington works to curb Beijing’s financial and political influence near the Panama Canal and elsewhere. Other China-linked actors relied on more advanced techniques. SinisterEye and PlushDaemon both used adversary-in-the-middle methods to hijack software updates and move laterally inside networks. These tactics gave attackers control over legitimate update processes, allowing them to implant malware without raising alarms. Jean-Ian Boutin, Director of Threat Research at ESET, told Help Net Security that AiTM has become one of the more effective tools in China-aligned campaigns. “We have identified multiple groups employing adversary-in-the-middle (AiTM) techniques, many of which have been successfully using this method for several years,” Boutin explained. “AiTM is particularly effective when the threat actor can control a device that intercepts network traffic, whether targeting a domestic individual under surveillance or an international visitor of strategic interest.” Boutin added that China-aligned groups continue to diversify their approaches beyond AiTM. “China-aligned threat actors continue to leverage a diverse set of initial access techniques. These include propagation via removable media, exploitation of public-facing applications—so-called edge devices—and spearphishing campaigns,” he said. Speccom targeted the energy sector in Central Asia with spearphishing emails sent from compromised government addresses. Analysts suggest these operations may help China gain visibility into its own overseas projects and energy imports. Meanwhile, Silver Fox blurred the line between espionage and profit-seeking by using tax-themed phishing lures to infect organizations in Hong Kong, Malaysia, and India with remote access tools. Iran adopts internal phishing tactics Iran-aligned activity remained steady, making up nearly 8 percent of observed campaigns. MuddyWater stood out for an unusual method: internal spearphishing. After compromising a mailbox within a target organization, the group sent phishing messages from that trusted account to coworkers, increasing the odds of success. This technique allowed attackers to bypass perimeter defenses and trick employees into installing remote management tools or droppers. MuddyWater targeted victims in regions as diverse as Nigeria, Greece, Israel, and the United States. Other Iranian groups, such as GalaxyGato, improved their existing toolsets and used PowerShell-based scripts to collect information and steal credentials during attacks in Greece and Israel. North Korea mixes espionage with profit North Korean groups remained active in espionage and financially motivated operations, with roughly 14 percent of global activity attributed to them. Lazarus, Kimsuky, Konni, and DeceptiveDevelopment ran multiple campaigns, often overlapping in tooling and techniques. DeceptiveDevelopment continued to lure cryptocurrency developers with fake job offers and trojanized codebases, a tactic the group has refined for years. Lazarus maintained a pattern of exploiting supply-chain weaknesses, including compromised software installers from legitimate South Korean vendors. A new wrinkle appeared when Konni launched attacks against macOS devices in September, using social engineering to steal user credentials and deploy a variant of the EggShell backdoor. ESET also noted North Korean actors extending operations into Uzbekistan, suggesting a widening scope beyond traditional targets. Other campaigns and emerging tactics Outside the major powers, ESET tracked smaller groups exploiting the same vulnerabilities. Several actors abused a Roundcube webmail flaw (CVE-2024-42009) to deliver JavaScript downloaders and credential stealers, while an Android spyware operation named Wibag appeared in Iraq. Wibag disguised itself as the YouTube app, collected messages, call logs, and location data, and displayed a login screen branded with the Iraqi National Security Service logo.

Russian hackers turn to AI as old tactics fail, Ukrainian CERT says Russian hackers are increasingly using artificial intelligence and adopting new tactics in cyberattacks against Ukraine as Kyiv’s defenses grow stronger, Ukrainian government researchers said in a new report. Since Russia’s invasion in 2022, cyberattacks on Ukraine have continued to rise, surpassing 3,000 cases in the first half of this year — about 20 percent more than the same period last year. At the same time, the number of high-impact incidents has declined as Ukraine’s defenses improve. That progress has forced Russian hackers to abandon outdated tactics, automate more of their operations and increasingly experiment with AI-generated malware, according to Ukraine’s computer emergency response team, CERT-UA. In a report released Wednesday, the agency warned that attackers are now using AI not only to write phishing messages but also to generate malicious code itself. Researchers believe AI tools were used to create PowerShell scripts in malware known as Wrecksteel, attributed to the cyberespionage group UAC-0219. “The use of artificial intelligence in cyberattacks has reached a new level,” CERT-UA said. “We have investigated several viruses showing clear signs of being generated with AI, and attackers will certainly not stop there.” Russian hackers are also adapting to faster infrastructure takedowns, researchers said. Improvements in Ukraine’s detection systems and closer cooperation with international cloud providers have pushed attackers toward shorter, more transient campaigns. Instead of maintaining persistence within networks, hackers increasingly deploy data-stealing tools that grab what they can and disappear — a shift CERT-UA described as the “Steal & Go” model. As phishing becomes less effective against better-trained Ukrainian users, Russian hackers are increasingly turning to so-called zero-click vulnerabilities — software flaws that allow infections without any user interaction. CERT-UA noted a surge in the use of such vulnerabilities in early 2025, including renewed exploitation of a known flaw in the open-source email platform Roundcube (CVE-2023-43770). The vulnerability allows attackers to execute malicious code when an email is merely viewed in the inbox — no clicks required. Moscow also continues to synchronize cyber operations with missile and drone strikes to amplify their disruptive effect, the report said. CERT-UA cited the Sandworm hacking unit, linked to Russia’s military intelligence, as one of the groups coordinating such hybrid attacks. CERT-UA said that Russia’s evolving tactics and techniques, including new methods of spreading malware, have been partly successful. Still, Ukraine’s defenders said they have managed to keep up, detecting and neutralizing roughly as many infections as they find. “After more than three years of full-scale war, the enemy has still not achieved the goals of its so-called special military operation,” researchers said. “Every day it increases the number of its attacks — both drones and missiles, and cyberattacks.” Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Mantovano, già titolare delle deleghe per la sicurezza nazionale e Segretario del Consiglio dei ministri, avrà il compito di coordinare le misure di prevenzione e risposta agli attacchi fisici e cyber contro reti e servizi vitali, aggiornando periodicamente la Presidenza sullo stato delle attività. Il Governo rafforza la cabina di regia sulla protezione delle infrastrutture critiche e dei servizi essenziali. Con un decreto del 30 giugno 2025, pubblicato in Gazzetta Ufficiale, il Presidente del Consiglio Giorgia Meloni ha conferito al Sottosegretario Alfredo Mantovano la delega per la resilienza dei soggetti critici, nell’ambito del decreto legislativo 134/2024 che attua la direttiva UE 2022/2557 (CER Directive) e si affianca al quadro normativo NIS2. Mantovano, già titolare delle deleghe per la sicurezza nazionale e Segretario del Consiglio dei ministri, avrà il compito di coordinare le misure di prevenzione e risposta agli attacchi fisici e cyber contro reti e servizi vitali, aggiornando periodicamente la Presidenza sullo stato delle attività. Potrà contare sull’Ufficio di livello dirigenziale generale istituito presso il Segretariato generale, che funge da punto di contatto unico nazionale per la resilienza e collabora con le autorità europee. Italia sempre più sotto attacco La decisione arriva in un momento critico. Secondo il report Operational Summary dell’Agenzia per la Cybersicurezza Nazionale (ACN) pubblicato oggi, a giugno 2025 sono stati registrati 433 eventi cyber, con un incremento del 115% rispetto a maggio, e 90 incidenti confermati. L’aumento è dovuto soprattutto a una massiccia campagna DDoS – 275 attacchi in 13 giorni – e a un’impennata di attività di hacktivism da parte di collettivi filorussi, che hanno colpito siti di imprese manifatturiere e sistemi industriali non critici, come piccoli impianti fotovoltaici e strutture ricettive, sfruttando piattaforme SCADA esposte online senza protezioni. Nel mese, ACN ha inoltre segnalato la diffusione di vulnerabilità critiche su prodotti ampiamente utilizzati – tra cui Citrix NetScaler (CVE-2025-5777, -5349, -6543), Roundcube (CVE-2025-49113) e Veeam (CVE-2025-23121) – e ha inviato 6.428 comunicazioni dirette a enti e imprese per mitigare rischi e compromissioni, quasi il doppio rispetto a maggio. La nuova delega a Mantovano punta a garantire una risposta integrata a questa escalation di minacce, rafforzando il coordinamento tra Governo, ACN e operatori di settori strategici per la sicurezza nazionale ed europea.

In the latest episode of the ESET Research Podcast, ESET Distinguished Researcher Aryeh Goretsky is joined by ESET Security Awareness Specialist Rene Holt to dissect the key findings from ESET’s APT Activity Report. The first actor that steps into the limelight is UnsolicitedBooker, a China-aligned APT group that has demonstrated a level of persistence that truly puts the "P" in APT. This group targeted the same organization three times over several years, attempting to deploy its signature backdoor, MarsSnake. This example highlights the relentless focus of certain groups that will stop at nothing to achieve their objectives. The conversation then shifts to the challenges of attribution, particularly with the increasing trend of tool-sharing, primarily among China-aligned actors such as Worok. Their tactic is to muddy the waters by using overlapping toolsets sourced from digital quartermasters, intertwining their activities with those of other groups such as LuckyMouse and TA428. Turning to Russia-aligned actors, the discussion focuses on groups like Sednit, Gamaredon, and Sandworm. Sednit’s latest activity revolves around Operation RoundPress, which originally targeted the popular webmail service Roundcube but has recently expanded to other platforms such as Horde, MDaemon, and Zimbra. Sednit has been using targeted emails, exploiting flaws in these services, and employing cross-site scripting to attack defense companies located in Bulgaria and Ukraine. Gamaredon remains one of the most active APTs in Ukraine, constantly tweaking its obfuscation techniques to stay ahead of detection. Meanwhile, Sandworm has intensified its use of data-wiping malware, deploying a new wiper called ZEROLOT multiple times in the past six months. This wiper operates with surgical precision, erasing specific files and directories without immediately taking down the entire system—an approach that ensures the malware can complete its destructive mission. Aryeh and Rene also delve into the activities of North Korea-aligned and Iran-aligned groups. If you’re interested in more details, be sure to listen to this episode of the ESET Research Podcast or download the latest ESET APT Activity Report. Discussed topics: UnsolicitedBooker (MarsSnake) 1:45 Worok (and its digital quartermasters) 4:50 Sednit (Operation RoundCube) 9:55 Gamaredon 13:55 Sandworm (ZEROLOT wiper) 16:15 DeceptiveDevelopment (WeaselStore, ClickFix) 24:10 MuddyWater vs Lyceum 29:40