Everything reported in this period, best first. Open a card for the details, sources and the
reasoning behind its ratings.
Law enforcementOngoing since
2026-09-254 publishers
The ShinyHunters group, known for financial data theft and extortion, has announced access to
FBI data. They claim to have sensitive information on nearly all FBI agents and job applicants 1. Meanwhile, the group is exploiting CVE-2026-35273 to deploy web shells in Oracle
PeopleSoft environments globally 2.
Why it mattersDefenders should be vigilant as ShinyHunters continues to target
critical organizations, potentially leading to significant data breaches 12.
What to do
- Patch Oracle PeopleSoft instances for CVE-2026-35273 [A2]
- Implement strict access controls and monitoring on sensitive systems [A1]
Details
- What changed
- The latest reports indicate that ShinyHunters has escalated their attacks by stealing highly sensitive
data from the FBI and extorting other ransomware groups after an arrest of one of their members [A4].
- Vulnerabilities
- CVE-2026-35273 · CISA KEV,
used by ransomware groups, fix due 2026-06-15, EPSS 0.09, CVSS 9.8, exploited itw
- Threat actors
- ShinyHunters
- Malware
- web shellsSIDEEYE
- Indicators (defanged)
- ipv4: 162[.]219[.]30[.]165
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesMass
exploitation reportedZero-day or no patch availableRansomware involvementSupply-chain, wormable or pre-auth
RCEUsed in ransomware campaignsNo patch
availableCoverage is rising fastReported this
weekEmergency-tier vulnerabilityIndependent
publishers agreeReliable sourcesSpecific,
checkable details
For defenders
Hunt: Web servers spawning shells after PeopleSoft exploitation
Detection of web server processes spawning new processes with suspicious names or
paths, often seen as a sign of deploying web shells.
Logs: web server access logs, EDR process events
Prerequisites: Command-line logging enabled on web servers and PeopleSoft
environments.
Logic: Monitor for Apache or IIS processes spawning new processes with names like
'sh' or 'bash', or paths containing 'sideye'.
- Catches the first hours after exploitation before the web shell is renamed.
- Identifies initial compromise points in PeopleSoft environments.
False positives: Legitimate server maintenance and updates may spawn similar
processes.
When it fires: Check if the parent process is related to PeopleSoft. Confirm the
version of PeopleSoft installed on the server.
Hunt: Unusual outbound connections from web servers
Web servers making unexpected outbound connections, especially to known C2 IPs like
162.219.30.165.
Logs: web server access logs, firewall
Prerequisites: Firewall rules and web server logs configured for detailed logging.
Logic: Monitor for outbound connections from Apache or IIS processes to
162.219.30.165, especially during PeopleSoft maintenance windows.
- Identifies initial C2 communication post-exploitation.
- Detects lateral movement attempts.
False positives: Regular web server health checks or updates may generate similar
outbound connections.
When it fires: Review the context of the connection, such as time and destination
port. Check if the process is related to PeopleSoft.
Exploited in the wildOngoing since
2026-09-25Official source2 publishers
The WordPress vulnerability CVE-2026-87902 is being exploited in the wild 1. The Canadian Center for Cyber Security (CCCS) has issued an advisory urging users to
update to version 7.1.2 or later, as prior versions are affected by unauthenticated path traversal leading
to conditional RCE 1.
Why it mattersDefenders should review and apply the necessary updates as they become
available, given that this vulnerability is already being exploited in the wild 1.
What to do
- Patch WordPress to version 7.1.2 or later
Details
- What changed
- The CISA added CVE-2026-87902 to their Known Exploited Vulnerabilities (KEV) Database on September 25,
2026 [A1].
- Vulnerabilities
- CVE-2026-87902 · CISA KEV, fix due 2026-09-28, EPSS
0.20, CVSS 8.1, exploited itw
- Threat actors
- Storm-2570Storm-3168
- Malware
- CLOSEDQUORUMQilinDragonForceAnubisBERT
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesZero-day
or no patch availableSupply-chain, wormable or pre-auth RCEWidely deployed productCritical infrastructure
affectedCISA remediation deadline closeRising
exploit probability (EPSS)No patch availableReported this weekOfficial advisory issuedEmergency-tier vulnerabilityIndependent publishers
agreeReliable sourcesOfficially
confirmedSpecific, checkable details
For defenders
Hunt: WordPress sites with unpatched version accessed by malicious IPs
WordPress sites are being accessed from known malicious IP addresses or ranges after
the vulnerability was disclosed.
Logs: web server access logs, firewall
Prerequisites: Retain web server and firewall logs for at least 30 days, including
detailed client IP information.
Logic: WordPress sites accessed by IPs from malicious lists after the disclosure date
of CVE-2026-87902.
- Identify potential exploitation attempts before full patching is completed
False positives: Legitimate users accessing the site from known malicious IP ranges
due to network policies or other reasons.
When it fires: Verify if the access was part of a legitimate update process, check
for recent changes in firewall rules.
Exploited in the wildNew this weekOfficial source12 publishers
ConfidenceAlmost certainly
CVE-2026-88771 and CVE-2026-88772 were confirmed as exploited in the wild, with Citrix
releasing patches on September 27, 2026 1 3. These
vulnerabilities are part of a larger set of eight critical issues affecting NetScaler ADC and Gateway
products. Threat actors have deployed web shells and tunneling malware post-exploitation 5 6.
Why it mattersDefenders should prioritize applying patches for these critical
vulnerabilities to prevent exploitation by threat actors who have already deployed web shells and tunneling
malware 5 6.
What to do
- Patch NetScaler ADC and Gateway appliances to the latest versions including CVE-2026-88771 and
CVE-2026-88772.
- Hunt for web shells and tunneling malware on affected systems.
Details
- What changed
- The latest reports confirm that CVE-2026-88771 and CVE-2026-88772 were exploited in the wild prior to
patch release, while earlier reports only indicated they were confirmed as zero-day vulnerabilities [A1]
[A3].
- Vulnerabilities
- CVE-2026-19489 · EPSS 0.03, disclosedCVE-2026-19490 · CISA KEV, fix due 2026-09-12, EPSS 0.08, CVSS 9.3, exploited
itwCVE-2026-88771 · CISA KEV, fix due 2026-09-30, EPSS
0.01, CVSS 9.5, exploited itwCVE-2026-88772 · CISA KEV, fix due 2026-09-30, EPSS 0.01, CVSS 9.5, exploited
itwCVE-2026-88773 · EPSS 0.00, disclosedCVE-2026-88774 · EPSS 0.00, disclosedCVE-2026-88775 · EPSS 0.00, disclosedCVE-2026-88776 · EPSS 0.00, disclosedCVE-2026-88777 · EPSS 0.00, disclosedCVE-2026-88778 · EPSS 0.00, disclosed
- Malware
- EliseTunneling Malwarepassword-protected PHP web shell
- ATT&CK techniques
- T1190 Exploit Public-Facing ApplicationT1204.002 Malicious File
- Indicators (defanged)
- sha256:
ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1sha256:
6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7ipv4:
149[.]104[.]78[.]141url:
hxxps://support[.]citrix[.]com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetSurl:
hxxps://sh3llc0d3[.]com/blog/inside-the-netscaler-zero-day-siege-chained-pre-auth-rces-weaponized-in-the-wild-watchtowr-disclosure/ipv4: 149[.]104[.]78[.]208ipv4:
104[.]248[.]244[.]66ipv4: 139[.]180[.]152[.]138ipv4: 77[.]83[.]199[.]39
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesZero-day
or no patch availableWidely deployed productCISA
remediation deadline closeNo patch availableCoverage is rising fastReported this weekOfficial advisory issuedEmergency-tier
vulnerabilityIndependent publishers agreeReliable sourcesOfficially confirmedSpecific, checkable details
For defenders
12 existing public detection rules:
Base64 Decoded Payload
Piped to Interpreter (elastic)Droppers Exploiting CVE-2017-11882
(sigmahq)Elastic Defend Alert Followed by Telemetry Loss
(elastic)Gatekeeper Override and Execution (elastic)Microsoft Build Engine Started by an Office Application (elastic)Potential Execution via FileFix Phishing Attack (elastic)Potential FileFix Command via Windows Explorer Address Bar (elastic)Potential NetScaler Log Poisoning Command Injection Attempt (elastic)
Hunt: Citrix NetScaler web shell creation after exploit
Detection of a PHP web shell being created in /var/tmp or similar directories, likely
named 'watchTowr'.
Logs: web server access logs, file integrity monitoring
Prerequisites: Enable file integrity monitoring on web servers and ensure long-term
retention of web server logs.
Logic: Look for creation of files with names like 'watchTowr' in /var/tmp or similar
directories by processes related to Citrix NetScaler ADC/Gateway.
- Catches the first hours after exploitation before the web shell is renamed.
- Identifies post-exploitation activity on compromised servers.
False positives: Legitimate scripts and maintenance tasks may create temporary files
with similar names. Check for context like process parentage or unusual timing.
When it fires: Confirm if the server was running Citrix NetScaler ADC/Gateway at the
time of file creation. Look for related exploit activity in web logs.
Hunt: Citrix NetScaler process spawning shells
Detection of processes spawned by Citrix NetScaler ADC/Gateway that execute shell
commands or spawn new processes.
Logs: EDR process events, web server access logs
Prerequisites: Enable EDR to capture detailed process creation and command execution
data, especially on web servers.
Logic: Identify processes spawned by Citrix NetScaler ADC/Gateway that execute shell
commands or spawn new processes within a short time window.
- Catches initial post-exploitation activity where the attacker spawns a shell.
- Detects lateral movement attempts.
False positives: Legitimate administrative tasks may spawn processes. Check for
unusual parent-child process relationships and timing.
When it fires: Verify if the parent process is related to Citrix NetScaler
ADC/Gateway. Confirm the version of the product in use.
Exploited in the wildNew this weekOfficial source2 publishers
Exploitation itw: Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited in
Attacks. Names CVE-2026-104286. 3 articles from 2 publishers.
Details
- What changed
- new official from CISA Advisories; new origin from CybersecurityNews; new echo from Security Affairs;
CVE-2026-104286 added to CISA KEV; advisory emergency for CVE-2026-104286; official confirmation; +1
cves
- Vulnerabilities
- CVE-2026-104286 · CISA KEV, fix due 2026-10-04,
CVSS 9.8, exploited itw
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesZero-day
or no patch availableWidely deployed productCISA
remediation deadline closeNo patch availableReported in the last 48 hoursOfficial advisory
issuedEmergency-tier vulnerabilityIndependent
publishers agreeReliable sourcesOfficially
confirmedSpecific, checkable details
For defenders
Hunt: FortiMail process spawning unusual child processes
A FortiMail process spawns an unknown or suspicious executable.
Logs: EDR process events
Prerequisites: Command-line logging enabled for FortiMail processes.
Logic: Monitor FortiMail parent process spawning new child processes with unusual
command lines.
- Catches the initial exploitation stage where a 0-day vulnerability is exploited.
False positives: Legitimate updates or patches being installed by FortiMail.
When it fires: Check if the spawned process is part of an update or patch, and
confirm the version of FortiMail in use.
Patch advisoryNew this weekSingle-source report1 publisher
ConfidenceUnconfirmed claim
Advisory patch: Cloud CISO Perspectives: How cybersecurity startups can win CISOs. Names
CVE-2026-35273. 1 article from 1 publisher.
Details
- What changed
- new origin from Google Cloud Security Blog; CVE-2026-35273 added to CISA KEV; advisory emergency for
CVE-2026-35273; +1 cves
- Vulnerabilities
- CVE-2026-35273 · CISA KEV,
used by ransomware groups, fix due 2026-06-15, EPSS 0.09, CVSS 9.8, exploited itw
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesMass
exploitation reportedZero-day or no patch availableSupply-chain, wormable or pre-auth RCECritical infrastructure
affectedUsed in ransomware campaignsNo patch
availableReported in the last 48 hoursEmergency-tier vulnerabilityReliable sourcesSpecific, checkable details
Exploited in the wildNew this weekOfficial source1 publisher
ConfidenceRoughly even chance
CISA advisories disclose multiple vulnerabilities (CVE-2023-46604, CVE-2026-94591-4) affecting
Armatura LLC Armatura One versions <4.7.2 and <4.6.1, allowing unauthorized access or code execution
1.
Why it mattersDefenders should review affected versions of Armatura LLC Armatura One
for vulnerabilities as they could be exploited to gain unauthorized access or execute arbitrary code 1.
What to do
- Review and patch all instances of Armatura LLC Armatura One <4.7.2 and <4.6.1.
Details
- What changed
- Initial report.
- Vulnerabilities
- CVE-2023-46604 · CISA KEV, used by ransomware
groups, fix due 2023-11-23, EPSS 1.00, CVSS 10.0, exploited itwCVE-2026-94591 · disclosedCVE-2026-94592 · disclosedCVE-2026-94593 · disclosedCVE-2026-94594 · disclosed
- Indicators (defanged)
- domain: RewCon[.]co
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesZero-day
or no patch availableCritical infrastructure affectedUsed in ransomware campaignsVery high exploit probability
(EPSS)No patch availableReported in the last 48
hoursOfficial advisory issuedEmergency-tier
vulnerabilityReliable sourcesOfficially
confirmedSpecific, checkable details
For defenders
1 existing public detection rule:
Malware User Agent
(sigmahq)
Hunt: Web servers accessing suspicious domains after Armatura One exploitation
Web servers attempting to connect to RewCon.co, a known victim infrastructure domain.
Logs: web server access logs
Prerequisites: Ensure web server access logs are collected and retained for at least
30 days.
Logic: Monitor HTTP requests from Armatura One instances to RewCon.co within 24 hours
of the exploitation window.
- Identify potential lateral movement or data exfiltration attempts after initial compromise.
False positives: Legitimate business-to-business connections, DNS resolution checks,
and routine maintenance activities.
When it fires: Verify the version of Armatura One on the server. Check if there are
any recent changes in network configurations or access patterns.
Exploited in the wildNew this week6 publishers
ConfidenceRoughly even chance
On September 30, 2026, Cisco disclosed a critical authentication bypass vulnerability
(CVE-2026-76504) in its Catalyst SD-WAN Manager API. The flaw allows unauthenticated attackers to gain
admin-level access via improper handling of URL encoding 1. This was confirmed by
CISA and added to the Known Exploited Vulnerabilities catalog on October 1, 2026 2
3 4 5 6.
Why it mattersDefenders should care as this flaw is being actively exploited, posing a
significant risk to organizations using Cisco Catalyst SD-WAN Manager 1 5.
What to do
- Patch all affected Cisco Catalyst SD-WAN Manager systems immediately
- Review and update API access controls
Details
- What changed
- The initial report indicated active exploitation in September 2026, with no new details provided
beyond the confirmation by CISA and other sources.
- Vulnerabilities
- CVE-2026-76504 · CISA KEV, fix due
2026-10-03, EPSS 0.01, CVSS 9.8, exploited itw
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesZero-day
or no patch availableWidely deployed productCISA
remediation deadline closeNo patch availableReported in the last 48 hoursEmergency-tier
vulnerabilityIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
Hunt: Web servers handling unauthorized admin requests
Unusual API calls to /admin endpoints with improperly encoded URLs.
Logs: web server access logs
Prerequisites: Enable logging of all web server request parameters and paths.
Logic: Monitor for HTTP GET/POST requests targeting /admin paths with URL encoding
issues.
- Catches the first unauthorized admin-level actions post-exploitation.
False positives: Legitimate API testing or development activities using malformed
URLs.
When it fires: Verify if the request originated from a known good IP address and
confirm the version of the affected Cisco Catalyst SD-WAN Manager.
Exploited in the wildNew this week3 publishers
ConfidenceRoughly even chance
Apple has released emergency security updates for CVE-2026-86950, an out-of-bounds write
vulnerability in CoreGraphics that could be exploited to execute arbitrary code via malicious files. The
flaw was reported by Meta Product Security and may have been used in highly sophisticated attacks against
specific targets 13.
Why it mattersDefenders should prioritize patching affected Apple devices to mitigate
the risk of targeted attacks exploiting this vulnerability 13.
What to do
- Patch all affected Apple devices with the latest security updates.
- Review and update device configurations to block malicious file types.
Details
- What changed
- The latest reports confirm the existence of a zero-day exploit, indicating potential real-world
exploitation beyond initial reports [A2]
- Vulnerabilities
- CVE-2026-86950 · CISA KEV, fix due
2026-10-02, EPSS 0.01, CVSS 8.8, exploited itw
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesZero-day
or no patch availableWidely deployed productCritical infrastructure affectedCISA remediation deadline
closeReported in the last 48 hoursIndependent
publishers agreeReliable sourcesSpecific,
checkable details
For defenders
Hunt: Web servers spawning shells after CoreGraphics exploitation
Web servers executing shell commands or spawning processes indicative of
post-exploitation activity.
Logs: web server access logs, EDR process events
Prerequisites: Command-line logging enabled on web servers and EDR integration with
the web server environment.
Logic: Monitor for web server processes spawning shell commands or new processes
within 5 minutes of a CoreGraphics exploit attempt.
- Catches the first hours after exploitation before the web shell is renamed.
False positives: Web servers executing scheduled maintenance tasks, such as cron
jobs.
When it fires: Check if the parent process and account are legitimate. Confirm the
version of CoreGraphics on the server.
CampaignNew this weekSingle-source report1 publisher
ConfidenceUnconfirmed claim
Campaign: Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom
Operators. Names Warlock, Net, Nltest, CVE-2025-1055, CVE-2025-49704. 1 article from 1 publisher.
Details
- What changed
- new origin from CybersecurityNews; CVE-2025-49704 added to CISA KEV; CVE-2025-49706 added to CISA KEV;
CVE-2025-53770 added to CISA KEV; +1 actors; +2 malware; +5 cves; +21 iocs
- Vulnerabilities
- CVE-2025-1055 · EPSS 0.00, disclosedCVE-2025-49704 · CISA KEV, used by ransomware groups, fix due 2025-07-23,
EPSS 1.00, exploited itwCVE-2025-49706 · CISA KEV, used
by ransomware groups, fix due 2025-07-23, EPSS 0.99, exploited itwCVE-2025-53770 · CISA KEV, used by ransomware groups, fix due 2025-07-21,
EPSS 1.00, exploited itwCVE-2025-53771 · EPSS 1.00, disclosed
- Threat actors
- Warlock
- Malware
- NetNltest
- Indicators (defanged)
- sha256:
116ca4e88a1bcebb6c0da7fb431c8eca7b8ef3f9767194820c56091972ccac2csha256:
155fb1cbdaea12c83ba92d18c88cf38bbc42bb684f913ca0bc26fcf115426a55sha256:
1edb2c0b537cd95bbd5fc16321b4c38a6adf325ccc7b588ad6acc980b0463b60sha256:
206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261sha256:
27b7591cf9e1283010ca98fa5dbe970a73fee0d8cde277639924c144718db7c0sha256:
37f94fe1b4a106f02b6f74a69cbc05e69c17406f688beef4c9a045ffcbd2e65esha256:
6d07f1232dc59b84038fd0b2e75fdd3d5b825882bb0dba9e6724b7b0823fa3adsha256:
73c5268256c9da5488cd9e2b79013060ac321c7e54129344dc7b51e268af36easha256:
8b58f7811a2a2f2a5024220490473774f02759dd2dd904b5b9fabfbaae37125fsha256:
8ce8d8270ee9de02644530b8dd7fa78973b4a3b80f121e2c5f45ae68cce196f9sha256:
9ceb01f8bf7d6dba2ae07f5bd6070de3ec67b5eb01f969b0ba85e74564fb83a7sha256:
aaff04d84ef85353966aa4af186ff1254b72c068f33f802417b29dc23fb9f192
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesRansomware involvementWidely deployed productCritical infrastructure affectedUsed in ransomware
campaignsVery high exploit probability (EPSS)Reported in the last 48 hoursReliable sourcesSpecific, checkable details
For defenders
8 existing public detection rules:
Enumerating Domain Trusts
via NLTEST.EXE (elastic)Nltest.EXE Execution (sigmahq)Potential Recon Activity Via Nltest.EXE (sigmahq)Unusual Web
Config File Access (elastic)Potential SharePoint ToolShell CVE-2025-53770
Exploitation - File Create (sigmahq)Potential SharePoint ToolShell
CVE-2025-53770 Exploitation Indicators (sigmahq)SharePoint ToolShell
CVE-2025-53770 Exploitation - Web IIS (sigmahq)Suspicious File Write to
SharePoint Layouts Directory (sigmahq)
Hunt: SharePoint files accessed by suspicious processes
Processes accessing SharePoint files with unknown or malicious SHA256 hashes.
Logs: File system access logs, Web server access logs
Prerequisites: Enable detailed file system and web server logging, including full
path and process information.
Logic: Monitor for processes accessing SharePoint files with any of the provided
SHA256 hashes.
- Detects initial compromise when Warlock Ransomware accesses SharePoint to spread
False positives: Legitimate administrative access or testing scripts that use known
good hashes.
When it fires: Verify if the process is legitimate and check for any recent changes
in the environment.
Hunt: Unusual network activity from SharePoint
Unexpected outbound connections to known malicious domains or IP addresses from
SharePoint servers.
Logs: Firewall logs, DNS logs
Prerequisites: Enable detailed firewall and DNS logging, including full domain names
and IP addresses.
Logic: Monitor for outbound connections from SharePoint servers to any of the
provided malicious domains or IP addresses.
- Identifies lateral movement after initial compromise via SharePoint
False positives: Scheduled backups or legitimate administrative access to known good
domains/IPs.
When it fires: Check if the domain or IP is part of a known good list and verify
recent changes in the environment.
Exploited in the wildNew this week2 publishers
ConfidenceUnlikely / unverified
CISA added two vulnerabilities impacting Microsoft SharePoint and MikroTik RouterOS to its
Known Exploited Vulnerabilities (KEV) catalog, with evidence of active exploitation. CVE-2026-65660 allows
code injection by an authorized attacker, while CVE-2026-67279 lets unauthenticated clients send exec
requests in MikroTik RouterOS 1 2.
Why it mattersDefenders should review and patch affected systems to mitigate potential
exploitation, especially given the low authentication requirement for CVE-2026-65660 2.
What to do
- Patch SharePoint servers immediately
- Review and update MikroTik RouterOS deployments
Details
- What changed
- Initial report.
- Vulnerabilities
- CVE-2026-65660 · CISA KEV, fix due 2026-09-28,
EPSS 0.02, CVSS 8.8, exploited itwCVE-2026-67279 · CISA KEV, fix due 2026-09-28, EPSS 0.01, CVSS 6.9,
exploited itw
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesZero-day
or no patch availableWidely deployed productCISA
remediation deadline closeReported in the last 48 hoursIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
Hunt: SharePoint web applications spawning PowerShell after CVE-2026-65660 exploitation
PowerShell processes spawned by SharePoint web applications, indicating potential
exploitation of CVE-2026-65660.
Logs: web server access logs, EDR process events
Prerequisites: Enable command-line logging and script block logging on affected
SharePoint servers.
Logic: Monitor for PowerShell processes spawned by SharePoint web applications with
suspicious arguments or parent processes.
- Catches the first hours after exploitation before the web shell is renamed.
False positives: Legitimate administrative actions using PowerShell, especially
during maintenance windows.
When it fires: Check the version of SharePoint and confirm if it's exposed to
CVE-2026-65660. Review parent process for signs of exploitation.
Hunt: RouterOS exec requests from untrusted IPs
Unauthenticated exec requests to MikroTik RouterOS devices, indicating potential
exploitation of CVE-2026-67279.
Logs: firewall, M365 audit
Prerequisites: Enable firewall logging and ensure M365 audit logs are collected for
network activity.
Logic: Monitor for exec requests to MikroTik RouterOS devices from untrusted IP
addresses or unusual times.
- Identifies initial access attempts before the device is compromised.
False positives: Scheduled maintenance or legitimate network management activities.
When it fires: Verify the legitimacy of the IP address and check for any recent
changes in network configurations.
Exploited in the wildNew this weekOfficial source1 publisher
ConfidenceRoughly even chance
CISA disclosed two critical vulnerabilities (CVE-2026-84409, CVE-2026-91191) in the Lantronix
G520 Series Cellular Gateway that could allow an attacker to replace software and execute arbitrary code
with root privileges. 1
Why it mattersDefenders should review their network for affected devices as these
vulnerabilities pose a significant risk if exploited. 1
What to do
- Review network configurations for Lantronix G520 Series Cellular Gateway installations.
Details
- What changed
- Initial report.
- Vulnerabilities
- CVE-2026-84409 · EPSS 0.00, disclosedCVE-2026-91191 · EPSS 0.00, disclosed
- Why it is rated this way
- Exploited in the wildSupply-chain, wormable or pre-auth
RCECritical infrastructure affectedReported this
weekOfficial advisory issuedReliable
sourcesOfficially confirmedSpecific, checkable
details
For defenders
Hunt: Lantronix G520 Series process spawning shell after exploitation
Detection of a process spawned by known Lantronix G520 Series software that executes
a shell or command-line interface.
Logs: EDR process events, command-line logging
Prerequisites: Enable command-line logging on affected devices and ensure EDR is
collecting process event data.
Logic: Monitor for processes spawned by Lantronix G520 Series software that execute a
shell or command-line interface within 1 hour of the known exploitation time window.
- Catches initial post-exploitation activity where attackers spawn a shell to maintain persistence.
False positives: Legitimate administrative tasks that require spawning a shell, such
as troubleshooting network issues.
When it fires: Verify if the process is part of normal operations or if it's an
unauthorized action. Check for any recent changes in software versions and configurations.
Exploited in the wildNew this weekSingle-source report1 publisher
ConfidenceUnlikely / unverified
Microsoft Threat Intelligence reported that the actor Swatchdog exploited CVE-2026-73570, an
unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite's SNMP notification path.
Exploitation led to web shell deployment and privilege escalation 12.
Why it mattersDefenders should care because the specific attribution to Swatchdog
highlights a known threat actor's use of this vulnerability, indicating potential future attacks 1.
What to do
- Patch Zimbra Collaboration Suite to address CVE-2026-73570.
- Hunt for JSP web shells and reverse shells on exposed Zimbra servers.
Details
- What changed
- The initial report did not specify the actor; Microsoft Threat Intelligence now identifies Swatchdog
as the exploiters of this vulnerability.
- Vulnerabilities
- CVE-2026-73570 · CISA KEV,
fix due 2026-08-24, EPSS 0.12, CVSS 8.9, exploited itw
- Threat actors
- Swatchdog
- ATT&CK techniques
- T1041 Exfiltration Over C2 ChannelT1047
Windows Management InstrumentationT1059.003 Windows Command ShellT1074 Data
StagedT1204.002 Malicious FileT1219
Remote Access ToolsT1567.002 Exfiltration to Cloud StorageT1589.001 Credentials
- Indicators (defanged)
- domain: wsweb03[.]blob[.]core[.]windows[.]neturl:
hxxps://aka[.]ms/downloadazcopy-v10-linuxdomain: oast[.]onlinedomain: dnslog[.]pp[.]uadomain: requestrepo[.]com
- Why it is rated this way
- Listed in CISA Known Exploited VulnerabilitiesSupply-chain, wormable or pre-auth RCERising exploit
probability (EPSS)Reported in the last 48 hoursEmergency-tier vulnerabilityReliable sourcesSpecific, checkable details
For defenders
12 existing public detection rules:
AppLocker Prevented
Application or Script from Running (sigmahq)Execution of a Downloaded Windows
Script (elastic)Potential Execution via FileFix Phishing Attack
(elastic)Potential FileFix Command via Windows Explorer Address Bar
(elastic)Process Activity via Compiled HTML File (elastic)Suspicious Cmd Execution via WMI (elastic)Suspicious Execution
from VS Code Extension (elastic)Suspicious Execution from a Mounted Device
(elastic)
Hunt: Zimbra service account executing shell commands
Detection of Zimbra service account running shell commands, indicative of privilege
escalation and post-exploitation activity.
Logs: EDR process events, systemd journal
Prerequisites: Enable command-line logging for the Zimbra service account.
Logic: Zimbra service account executing sh or shell commands within 15 minutes of
Zimbra service start.
- Catches privilege escalation post-exploitation
- Identifies potential lateral movement
False positives: Scheduled maintenance, legitimate administrative tasks using shell
scripts.
When it fires: Verify if the command execution is part of a known good process or
recent changes in service account permissions.
Hunt: Webshell deployment via JSP files
Detection of JSP file creation and modification, indicative of web shell deployment
post-exploitation.
Logs: web server access logs, file system change events
Prerequisites: Enable detailed file system monitoring and web server access logging.
Logic: Creation or modification of .jsp files in the Zimbra web root directory within
30 minutes of Zimbra service start.
- Catches initial post-exploitation activity
- Identifies persistent backdoors
False positives: Scheduled updates, legitimate application deployments.
When it fires: Check for recent changes in the web root directory and correlate with
known good versions of Zimbra.
Hunt: Out-of-band scanning tools probing vulnerable injection point
Detection of out-of-band scanning tools probing the SNMP notification path,
indicative of initial exploitation attempt.
Logs: EDR process events, DNS logs
Prerequisites: Enable detailed EDR logging and DNS query logging.
Logic: Processes such as curl or wget making DNS requests to oast.online,
dnslog.pp.ua, requestrepo.com within 15 minutes of Zimbra service start.
- Catches initial exploitation attempt
- Identifies scanning behavior
False positives: Legitimate network diagnostics, security testing by internal teams.
When it fires: Verify if the DNS requests are part of a known good process or recent
changes in network activity patterns.
Threat actorNew this weekSingle-source report1 publisher
ConfidenceUnconfirmed claim
Actor report: Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine's
Defense Industry. Names Saint Bear. 1 article from 1 publisher.
Details
- What changed
- new origin from SOCRadar; +1 actors; +11 procedures; +3 iocs
- Threat actors
- Saint Bear
- ATT&CK techniques
- T1003 OS Credential DumpingT1005 Data
from Local SystemT1036 MasqueradingT1041
Exfiltration Over C2 ChannelT1055 Process InjectionT1190
Exploit Public-Facing ApplicationT1505.003 Web ShellT1550.002 Pass the HashT1557
Adversary-in-the-Middle
- Indicators (defanged)
- ipv4: 46[.]8[.]236[.]121ipv4:
129[.]146[.]87[.]174ipv4: 130[.]12[.]182[.]216
- Why it is rated this way
- Mass exploitation reportedState-linked or espionage
actorSupply-chain, wormable or pre-auth RCECritical infrastructure affectedReported this
weekReliable sourcesSpecific, checkable
details
For defenders
12 existing public detection rules:
File with High Entropy
Created by Web Server (elastic)File with Suspicious Double Extension Created
by Web Server (elastic)Microsoft Exchange Worker Spawning Suspicious
Processes (elastic)Potential Invoke-Mimikatz PowerShell Script
(elastic)Potential Polyglot Bypass File Created by Web Server
(elastic)Potential SAP NetWeaver Exploitation (elastic)Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation
(elastic)ScreenConnect Server Spawning Suspicious Processes (elastic)
Hunt: Web servers hosting webshells from C2
IIS or PHP applications serving files with known webshell names (Godzilla, r57, suo5,
Neo-reGeorg) to 46.8.236.121.
Logs: web server access logs, web application firewall
Prerequisites: Enable logging of file requests and responses for web applications.
Logic: Check IIS or PHP logs for requests to known webshell filenames from C2 IPs.
- Detects initial compromise via web shell upload.
- Identifies ongoing exfiltration attempts.
False positives: Legitimate file downloads by developers or automated tools,
confirmed by context and version control systems.
When it fires: Verify the legitimacy of the request by cross-referencing with source
code repositories and developer activity logs.
Hunt: Process injection to 46.8.236.121
Processes injecting Sliver implant and beaconing to C2 IP at regular intervals.
Logs: process creation logs, network flow data
Prerequisites: Enable process monitoring and network traffic capture on critical
systems.
Logic: Monitor for processes with known Sliver signatures spawning child processes
that periodically connect to 46.8.236.121:11008 or 11009.
- Identifies initial compromise via process injection.
- Detects ongoing exfiltration attempts.
False positives: Legitimate system maintenance and scheduled tasks, confirmed by
reviewing the parent process and time of day.
When it fires: Investigate the parent process to determine if it is legitimate or
part of a larger attack chain.
Data breachNew this weekSingle-source report1 publisher
ConfidenceUnconfirmed claim
CrowdStrike investigated a cyberattack on Boston Scientific that disrupted its manufacturing,
order processing, and shipping. The attacker used an external-facing network device as the entry point and
reached limited IT systems but did not compromise SCADA or business systems 1.
Why it mattersDefenders should monitor developer workstations for potential entry
points into their networks, given this attack's method of access 1.
What to do
- Review security measures on external-facing network devices.
Details
- What changed
- Initial report.
- Malware
- NodeRabbitPollCatPER-linked
RATcolorized_terminal
- Affected
- BerlinBerlin's Senate DepartmentsBoston Scientific
- Why it is rated this way
- Ransomware involvementSupply-chain, wormable or
pre-auth RCELarge breach (1M+ records)Critical
infrastructure affectedReported this weekReliable sourcesSpecific, checkable details
MalwareNew this weekSingle-source report1 publisher
ConfidenceUnlikely / unverified
Initial report 1 suggests KMS Auto, a legitimate key management
utility, has been repackaged by APT36 for delivering malware. The tool's presence on compromised systems
indicates its use as an initial access vector in ransomware cases.
Why it mattersDefenders should monitor endpoints for KMS Auto and investigate any
instances where it is present, as it may be a sign of APT36 activity 1.
What to do
- Monitor endpoints for KMS Auto
Details
- Threat actors
- APT36
- Malware
- KMS AutoXMRigMeshAgentSecurityHealthServices.exe
- ATT&CK techniques
- T1027 Obfuscated Files or InformationT1036
MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1053.005 Scheduled TaskT1078
Valid AccountsT1105 Ingress Tool TransferT1204 User
ExecutionT1204.002 Malicious FileT1219
Remote Access ToolsT1547.001 Registry Run Keys / Startup Folder
- Indicators (defanged)
- md5: 6dc495f33d4e1b6beb27cd418c8ed5aemd5:
d24448ec0257adfb258846b3317c3b7cmd5:
d4e0f18025b3f8f329b136bbbee6deeamd5:
ac458ece671fdde066ce60e448f12bc0md5:
d87d7173116eb5fa992ae2b4e57fa025
- Why it is rated this way
- Ransomware involvementWidely deployed
productCritical infrastructure affectedReported
this weekReliable sourcesSpecific, checkable
details
For defenders
12 existing public detection rules:
Base64 Decoded Payload
Piped to Interpreter (elastic)Decoded Payload Piped to Interpreter Detected
via Defend for Containers (elastic)Encoded Payload Detected via Defend for
Containers (elastic)Ingress Tool Transfer Followed by Execution and Deletion
Detected via Defend for Containers (elastic)Lure-Themed Internet-Delivered
RMM Executable (elastic)Masquerading Space After Filename
(elastic)Multi-Base64 Decoding Attempt from Suspicious Location
(elastic)Potential FileFix Command via Windows Explorer Address Bar
(elastic)
Hunt: KMS Auto execution followed by XMRig mining
Detection of KMS Auto execution, followed by the deployment and execution of XMRig.
Logs: EDR process events, cloud audit
Prerequisites: Enable EDR to capture detailed process creation events and cloud audit
logs for remote access tools.
Logic: Monitor for KMS Auto process followed by XMRig within 15 minutes.
- Identify initial compromise vector leading to cryptocurrency mining
False positives: Legitimate use of KMS Auto in enterprise environments, such as
software deployment or maintenance.
When it fires: Verify the version and context of KMS Auto execution. Check if XMRig
is known good or malicious.
Hunt: Persistence mechanisms via registry run keys
Creation of new registry entries in Run, RunOnce, and Startup folders to maintain
persistence.
Logs: EDR process events, registry changes
Prerequisites: Enable EDR for detailed process creation events and enable Windows
Event Logs for registry modifications.
Logic: Look for new registry keys in Run, RunOnce, and Startup folders created by KMS
Auto within 24 hours of initial execution.
- Detect long-term persistence mechanisms post-compromise
False positives: Legitimate software updates or user-initiated changes to the
registry.
When it fires: Check if the new keys are known good or malicious. Confirm the context
and version of KMS Auto execution.
Hunt: Self-copying payloads with hidden attributes
Detection of self-copying files in AppData folders with super hidden attributes.
Logs: EDR process events, file system changes
Prerequisites: Enable EDR to capture detailed file creation and modification events,
and enable file system monitoring for hidden attribute changes.
Logic: Monitor for files in AppData folders with super hidden attributes created by
KMS Auto within 12 hours of initial execution.
- Identify stealthy persistence mechanisms
False positives: Legitimate software updates or user-initiated file copies.
When it fires: Verify the context and version of KMS Auto execution. Check if the
copied files are known good or malicious.
CampaignNew this week2
publishers
ConfidenceUnlikely / unverified
Campaign: AI agents hacked the hackers, stealing email addresses from security research org.
Names smartphone surveillance tools, corp ransomware. 2 articles from 2 publishers.
Details
- What changed
- new corroboration from Security Affairs; new origin from Theregister; +2 malware
- Malware
- smartphone surveillance toolscorp ransomware
- Why it is rated this way
- Widely deployed productCritical infrastructure
affectedReported in the last 48 hoursIndependent
publishers agreeReliable sourcesSpecific,
checkable details
VulnerabilityNew this weekOfficial source1 publisher
ConfidenceRoughly even chance
Vulnerability: CISA Malcolm. Names Elise, route, CVE-2026-90443, CVE-2026-90444. 1 article
from 1 publisher.
Details
- What changed
- new official from CISA Advisories; official confirmation; +2 malware; +15 cves
- Vulnerabilities
- CVE-2026-90443 · EPSS 0.01, disclosedCVE-2026-90444 · EPSS 0.00, disclosedCVE-2026-90445 · EPSS 0.01, disclosedCVE-2026-90446 · EPSS 0.00, disclosedCVE-2026-90447 · EPSS 0.00, disclosedCVE-2026-90448 · EPSS 0.00, disclosedCVE-2026-90449 · EPSS 0.01, disclosedCVE-2026-90450 · EPSS 0.00, disclosedCVE-2026-90451 · EPSS 0.01, disclosedCVE-2026-90452 · EPSS 0.00, disclosedCVE-2026-90453 · EPSS 0.00, disclosedCVE-2026-90454 · EPSS 0.00, disclosed
- Malware
- Eliseroute
- Why it is rated this way
- Critical infrastructure affectedReported in the last 48
hoursOfficial advisory issuedReliable
sourcesOfficially confirmedSpecific, checkable
details
VulnerabilityNew this weekOfficial source1 publisher
ConfidenceRoughly even chance
Vulnerability: Anjvision YSSD-RTMP-H5. Names CVE-2026-100291, CVE-2026-100292. 1 article from
1 publisher.
Details
- What changed
- new official from CISA Advisories; official confirmation; +9 cves; +1 iocs
- Vulnerabilities
- CVE-2026-100291 · EPSS 0.00, disclosedCVE-2026-100292 · EPSS 0.00, disclosedCVE-2026-100293 · EPSS 0.00, disclosedCVE-2026-100294 · EPSS 0.00, disclosedCVE-2026-100295 · EPSS 0.00, disclosedCVE-2026-100296 · EPSS 0.00, disclosedCVE-2026-100297 · EPSS 0.00, disclosedCVE-2026-100298 · EPSS 0.00, disclosedCVE-2026-100299 · EPSS 0.00, disclosed
- Indicators (defanged)
- url: hxxp://www[.]anjvision[.]com/problem/list-129-cn[.]html
- Why it is rated this way
- Critical infrastructure affectedReported this
weekOfficial advisory issuedReliable
sourcesOfficially confirmedSpecific, checkable
details
VulnerabilityNew this week2 publishers
ConfidenceUnlikely / unverified
Vulnerability: TeamViewer Fixes Five Remote Access Flaws. Names CVE-2026-19743,
CVE-2026-92368. 2 articles from 2 publishers.
Details
- What changed
- new origin from SOCRadar; new corroboration from TRUESEC; +5 cves
- Vulnerabilities
- CVE-2026-19743 · EPSS 0.00, disclosedCVE-2026-92368 · EPSS 0.00, disclosedCVE-2026-92369 · EPSS 0.00, disclosedCVE-2026-92370 · EPSS 0.00, disclosedCVE-2026-92371 · EPSS 0.00, disclosed
- Why it is rated this way
- Widely deployed productReported in the last 48
hoursIndependent publishers agreeReliable
sourcesSpecific, checkable details