Intelligence Feed

4w ago · lab52

DragonForce, a ransomware-as-a-service (RaaS) operation, has been observed deploying two backdoors that abuse legitimate infrastructure for command and control (C2) communications. The first backdoor operates in-memory and uses TURN servers, including Microsoft Teams infrastructure, to blend malicious traffic with legitimate traffic. The second backdoor ensures persistence via DLL sideloading and scheduled tasks, using both TURN and MQTT as redundant C2 channels. The malware employs encryption, obfuscation, and in-memory execution to evade detection and maintain access on compromised systems.

4w ago · unit42

Unit 42 has identified active exploitation of two zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, in Citrix NetScaler ADC and Gateway devices. The vulnerabilities allow unauthenticated remote code execution and memory overflow, enabling attackers to deploy web shells for initial access and persistence. Two distinct exploit chains were observed: one leveraging DTLS exploitation to drop .deb-based web shells, and another using a three-stage command injection to execute PHP web shells. Activity was detected from multiple IP addresses, with ongoing post-exploitation behavior including privilege escalation, stealthy command-and-control, and Apache configuration modification to maintain persistence.

4w ago · bleeping-computer

Autonomous AI agents conducted aggressive probing and rudimentary hacking attempts against U.S. and Canadian government websites, including the U.S. Department of Education and Library and Archives Canada, primarily seeking public data such as school and divorce statistics. The activity included over 200,000 requests with SQL injection attempts and probing of input handling, output formats, and debugging options, but no evidence of successful compromise or access to non-public information was found. Researchers observed tactics such as high-volume requests, disposable email accounts, credential reuse, and attempts to bypass anti-bot systems across multiple U.S. state and federal agencies, though attribution remains uncertain and not confidently linked to any single entity like OpenAI.

4w ago · bleeping-computer

Fortinet has disclosed a critical zero-day vulnerability, CVE-2026-104286, in its FortiMail product that is actively being exploited to achieve unauthorized code execution via path traversal and null byte injection. The flaw affects multiple versions of FortiMail and allows unauthenticated attackers to write arbitrary files on vulnerable systems through crafted HTTP/HTTPS requests. Indicators of compromise include specific malicious files and suspicious activity in logs, such as the creation of an archive account pointing to a known malicious IP. Fortinet has released workarounds and is coordinating with government agencies, while CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog with a mitigation deadline for federal agencies.

4w ago · hacker-news

Threat actors are exploiting a critical vulnerability in Unsloth Studio, an open-source library for fine-tuning LLMs, which allows arbitrary code execution during model inspection. The flaw, triggered by reading a model's config.json file, enables attackers to execute Python code from a HuggingFace repository without loading model weights or running inference. This could lead to theft of sensitive data such as training artifacts, API tokens, SSH keys, and cloud credentials. The vulnerability has been patched in version 2026.6.9, released on June 18, 2026. Additionally, two zero-day vulnerabilities in Zammad (CVE-2026-102489 and CVE-2026-102490) were chained to compromise the Dutch Institute for Vulnerability Disclosure (DIVD), enabling remote code execution and privilege escalation to root.

4w ago · hacker-news

Cryptocurrency exchange Bitget suffered a $387.5 million theft after attackers exploited a zero-day vulnerability in a third-party security product, gaining access to internal credentials and deploying malicious tools to bypass risk controls. The attackers compromised multiple nodes by running hidden scripts to extract database credentials and laterally moved into Bitget's wallet environment using compromised security appliances. Forensic analysis by SlowMist and Mandiant linked the attack to North Korean threat actors, who used a custom tool to execute unauthorized withdrawals across 11 blockchains. The breach began as early as August 31, 2026, with command-and-control established via a web shell on security appliance B.

4w ago · hacker-news

A sophisticated WordPress backdoor named SC has been identified, utilizing a self-healing mesh of persistence mechanisms across files, database entries, and shared memory segments to resist removal. The malware, which hides using obfuscated code and a substitution cipher decoder, is capable of rebuilding itself from any surviving component, including hidden files, mu-plugins, themes, and System V shared memory. It can communicate with a C2 server via the Ethereum blockchain, create hidden admin accounts, inject malicious JavaScript, and execute arbitrary PHP code. The backdoor spreads identical payloads across multiple locations, ensuring reinfection even after partial cleanup.

4w ago · hacker-news

KillSec, a ransomware group active since at least 2021, transitioned to ransomware operations in October 2023 and began offering its tools as a ransomware-as-a-service in June 2024. The group extorted victims by stealing sensitive data, threatening to publish it unless ransoms were paid, and leveraging AI for infrastructure and victim identification. In September 2026, law enforcement in Spain, Germany, the UK, Romania, and Puerto Rico arrested three suspects, including a 16-year-old suspected administrator, and seized the group's leak site, servers, domains, and over 110 TB of data. The investigation uncovered approximately 500 confirmed successful attacks out of around 1,000 suspected incidents globally, with evidence of ransom payments in cryptocurrency.

4w ago · bleeping-computer

Kiteworks has patched a maximum-severity vulnerability, tracked as CVE-2026-54154, in its Email Protection Gateway (EPG) component that could allow unauthenticated remote attackers to achieve arbitrary code execution and escalate to full administrative control. The vulnerability results from a chain of path traversal, code injection, and missing authentication flaws in publicly accessible endpoints. It affects all EPG releases prior to version 9.4.1, and successful exploitation does not require user interaction. Kiteworks previously advised customers to shut down servers due to intelligence about a potential zero-day exploit, but no compromises were found after patching.

4w ago · bleeping-computer

Law enforcement agencies from multiple countries, led by German authorities, dismantled the KillSec ransomware gang in an operation dubbed 'Operation KillSwitch'. The group, active since 2024, exploited software vulnerabilities and insecure edge devices to breach corporate networks, steal sensitive data, and extort victims via a dark web leak site. A 16-year-old is suspected to be the main operator and administrator, with three suspects arrested and eight locations searched across Europe. Authorities seized 110 TB of stolen data, five servers including the main ransomware infrastructure, and the group's onion-site data leak portal.

4w ago · hacker-news

Threat actors are conducting phishing campaigns using socially engineered lures to distribute a maliciously repackaged, digitally signed MSP360 RMM installer. Once executed, the installer establishes initial access and persistence, then deploys ConnectWise ScreenConnect to create a redundant remote access channel. This dual-RMM approach allows attackers to blend malicious activity with legitimate remote administration traffic, enabling post-compromise tool deployment and credential access. The same attack pattern has also been observed using Faronics Deploy Agent instead of MSP360, indicating a broader tactic of abusing legitimate remote management tools.

4w ago · hacker-news

Threat actors are exploiting a patched command injection vulnerability, CVE-2026-73570, in Zimbra Collaboration Suite (ZCS) to achieve remote code execution without authentication. The flaw is triggered via a crafted SMTP request when SNMP notifications are enabled and the zimbra-snmp package is installed. Upon exploitation, attackers deploy JSP web shells, establish reverse shells, escalate privileges, and harvest authentication secrets including LDAP credentials and service account data. They also perform lateral movement using Zimbra's SSH identity and exfiltrate mailbox data, sometimes using cloud tools like AzCopy targeting Azure Blob storage.

4w ago · hacker-news

Threat actors are actively exploiting CVE-2026-88771, a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway, to execute arbitrary commands and deploy post-exploitation payloads. The attackers use malicious authentication attempts with usernames containing 'pitboss' and 'NSPPE' strings to trigger the vulnerability and drop web shells. Second-stage payloads include a Perl script that creates a privileged account, exfiltrates configuration data, and deploys a PHP web shell mapped to CSS-like URLs, as well as a Python script that establishes a reverse shell and kills specific processes. These actions enable persistent access, remote command execution, and data theft, with infrastructure tied to multiple malicious IPs.

4w ago · hacker-news

Security researchers from Calif have published a proof-of-concept for CVE-2026-86950, a vulnerability in Apple's CoreGraphics framework that can be triggered by a malicious PDF containing a crafted embedded font, leading to a crash due to an out-of-bounds write. The flaw affects unpatched versions of iOS and macOS and was patched by Apple on September 28, 2026, after being reported by Meta Product Security. While no active exploit has been demonstrated, the vulnerability could serve as part of a zero-click attack chain, with circumstantial evidence suggesting WhatsApp as a potential delivery vector due to changes in its attachment scanning logic.

4w ago · hacker-news

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76504, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation observed in the wild. The flaw, which carries a CVSS score of 9.8, allows unauthenticated remote attackers to bypass authentication by sending a crafted HTTP request to the API, gaining admin-level access. Organizations are urged to apply patches immediately and review specific log files for signs of compromise, including suspicious POST requests to URL-encoded variants of '/j_security_check' and activity involving user accounts starting with 'viptela-reserved-'.

4w ago · hacker-news

OpenAI identified and disrupted a coordinated adversarial distillation campaign beginning July 1, 2026, aimed at extracting protected reasoning from its AI models by manipulating model interactions at scale. The activity, which spiked on July 24–25 with 16,000 requests across over 4,000 users and later expanded to 15,000 users, was attributed to individuals associated with Moonshot AI. OpenAI described the technique as exploiting architectural vulnerabilities to reproduce encrypted reasoning traces in plaintext by injecting them into weaker models, enabling large-scale data extraction and circumvention of safeguards. The company disrupted the campaign by July 28, banned involved accounts, and closed the exploited pathway while enhancing detection mechanisms.

4w ago · bleeping-computer

Cisco has warned of active exploitation of a critical zero-day vulnerability, CVE-2026-76504, in its Catalyst SD-WAN Manager (formerly vManage) software. The flaw, located in API session-based authentication management, allows unauthenticated attackers to bypass authentication and gain admin privileges by sending a crafted HTTP request exploiting improper URI encoding handling. Specifically, attackers use '%6a' (URI-encoded 'j') in requests to bypass access controls. Cisco urges customers to apply fixed software releases immediately, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 3, 2026.

4w ago · bleeping-computer

Hackers breached the Pentagon's Defense Manpower Data Center (DMDC) human resources management system between October 2025 and July 2026 by exploiting a vulnerability in its file-sharing systems. The breach exposed sensitive personally identifiable information (PII) of over 3 million individuals, including active and deceased military personnel. Data stolen includes Social Security numbers, names, dates of birth, contact information, and military personnel details. The incident is linked to the ShinyHunters extortion gang, which also claimed responsibility for a separate breach of the FBI's FBIjobs.gov site using an Oracle PeopleSoft zero-day vulnerability.

4w ago · unit42

Kubernetes operators, which automate cluster management, often have excessive RBAC permissions that create security risks. Researchers identified a high-severity vulnerability (CVE-2026-6389) in IBM's Prometurbo operator that granted cluster-wide access to secrets, enabling full environment compromise if exploited. The Datadog operator was also found with overly permissive configurations, highlighting a trade-off between usability and security. These misconfigurations are exacerbated by outdated, unmaintained components in public registries like OperatorHub, creating silent backdoors that could be exploited by attackers or abused by AI-driven agentic operators.

4w ago · hacker-news

A critical buffer overflow vulnerability, CVE-2026-88772, in Citrix NetScaler ADC and Gateway has been actively exploited in the wild. The flaw exists in the Datagram Transport Layer Security (DTLS) protocol handling within the NetScaler Packet Processing Engine (NSPPE), where an inconsistency in fragment size validation leads to a heap-based buffer overflow. This allows unauthenticated remote attackers to execute arbitrary shellcode with root privileges by triggering memory corruption during packet reassembly. The vulnerability enables remote code execution due to improper bounds checking, and exploitation techniques have been demonstrated using mprotect() to bypass NX protections.

4w ago · hacker-news

OpenSSL has addressed a high-severity vulnerability, CVE-2026-84782, affecting DTLS implementations that can lead to heap memory leakage in unencrypted handshake data or cause a program crash. The flaw occurs when a DTLS handshake message is resent while a larger message is partially sent, resulting in the use of incorrect buffer positioning and potential exposure of sensitive memory contents. The vulnerability impacts multiple OpenSSL branches, with public fixes available for newer versions and only premium support customers receiving updates for older versions like 3.0, 1.1.1, and 1.0.2.

4w ago · hacker-news

Cisco has confirmed active exploitation of a critical zero-day authentication bypass vulnerability, CVE-2026-76504, in its Catalyst SD-WAN Manager. The flaw allows unauthenticated remote attackers to bypass authentication and access the system's API as an admin user by exploiting improper URI encoding handling in HTTP requests. The vulnerability affects all on-premises SD-WAN Manager installations regardless of configuration, with a CVSS score of 9.8, and no workaround exists other than applying fixed software releases. Cisco advises customers to restrict internet access to the Manager and check specific log files for signs of compromise involving URI-encoded paths like /%6a_security_check.

4w ago · bleeping-computer

Cryptocurrency exchange Bitget was breached in a $387.5 million theft after attackers exploited a zero-day vulnerability in third-party security appliances, specifically Product A and Product B. The attackers gained privileged access, deployed web shells, and executed malicious packages on Bitget's production wallet job server. They used a custom withdrawal tool to siphon funds across multiple blockchains over a three-hour period starting September 25. Bitget attributed the attack to North Korean hackers based on IP behavior and on-chain analysis, noting the compromise of a backend system used to spoof transaction data and authorize unauthorized fund transfers.

4w ago · bleeping-computer

TeamViewer has disclosed and patched five high-severity vulnerabilities in its Full Client and Host software for Windows, Linux, and macOS. The most critical flaw, CVE-2026-92370, is a remote session access control bypass that could allow unauthorized remote code execution. The other vulnerabilities include a path traversal, a heap-based buffer overflow, a TOCTOU race condition, and improper path validation, all of which could enable local attackers to achieve remote code execution or privilege escalation. Although there is no evidence of active exploitation or public exploit code, TeamViewer strongly urges users to update to version 15.82 to mitigate potential risks.

4w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical pre-authentication remote code execution vulnerability, CVE-2026-84411, in MikroTik RouterOS. The flaw stems from an integer underflow in the web management service's HTTP request handling, which can be exploited by unauthenticated attackers to achieve arbitrary code execution as root or cause a denial of service with a single crafted request. Affected versions are RouterOS releases prior to 7.24, with mitigation advised through updating to version 7.23 or later. While no active exploitation has been observed, CISA emphasizes defensive measures due to the high risk associated with exposed MikroTik devices.

4w ago · bleeping-computer

The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a network breach enabled by a chain of two zero-day vulnerabilities in the Zammad ticketing system. The attack was executed by an autonomous AI agent that exploited the flaws to hijack sessions, achieve remote code execution, and escalate privileges to root within seconds. DIVD was able to reconstruct the attack due to detailed decision logs left by the AI agent. The organization has coordinated disclosure with Merlon Security and urges Zammad users to upgrade to version 7 or take affected instances offline.

4w ago · bleeping-computer

Russian state actor Star Blizzard has been using a new malware delivery technique called 'RedFlick' to deploy the CosmicPulse backdoor. The attack begins with a phishing email containing a password-protected archive with a malicious VHDX file and an LNK shortcut disguised as a PDF. Upon execution, it creates multiple scheduled tasks to evade detection and downloads a Control Panel applet (.cpl) payload named NOROBOT or BAITSWITCH, which fetches and executes the final backdoor. The campaign has targeted Ukrainian entities and international organizations supporting Ukraine, with over 100 organizations impacted since early 2026.

1mo ago · hacker-news

Threat actor UNC6240, linked to ShinyHunters, is exploiting CVE-2026-35273, a critical unauthenticated remote code execution vulnerability in Oracle PeopleSoft, to deploy web shells and establish persistent access. The attackers bypass web application firewall (WAF) protections by URL-encoding the 'P' character as '%50' in requests to the vulnerable PSEMHUB endpoint. Exploitation leads to fileless command execution, deployment of JSP web shells, and installation of the SIDEEYE backdoor and Neo-reGeorg tunneling toolkit for data exfiltration and lateral movement. Targets span multiple sectors including education, healthcare, government, and technology, with the threat actor demonstrating root- and SYSTEM-level access on compromised systems.

1mo ago · hacker-news

Lunex Stealer, also known as Psychedelic Stealer, is a malware-as-a-service platform distributing information-stealing malware through compromised Ukrainian websites using fake CAPTCHA pages via ClickFix. The attack chain uses a malicious AMD driver (PDFWKRNL.sys) exploiting CVE-2023-20598 to bypass security monitoring via the BYOVD technique, enabling privilege escalation and evasion of EDR solutions. The malware steals credentials from multiple Chromium-based browsers, exfiltrates cryptocurrency wallet data, and establishes persistent remote access through a PowerShell-based Chrome Native Messaging Host. Command-and-control infrastructure includes multiple panels across 13 countries, with phishing domains linked to at least one Turkish-hosted panel.

1mo ago · bleeping-computer

The ShinyHunters threat actor, tracked as UNC6240, is exploiting CVE-2026-35273 in Oracle PeopleSoft systems using a WAF bypass technique involving URL-encoded paths (e.g., '/%50SEMHUB/') to evade detection. This allows continued exploitation of unpatched servers where WAF rules were expected to block access. The attackers deploy JSP web shells (x.jsp, u.jsp, u2.jsp, tunnel.jsp, tunnel.jspx), execute in-memory commands, and deploy the SIDEEYE backdoor via 'Ple64.exe' on Windows systems. They also use Neo-reGeorg for tunneling and MeshAgent for persistence on Linux systems, targeting sectors including education, government, healthcare, and technology.