ForestTiger

Multiple active threats were reported this week, including exploitation of critical vulnerabilities in VMware, Apple macOS, and GeoServer, as well as ongoing campaigns by state-linked actors. A suspected China-nexus APT exploited CVE-2026-59310 in VMware vCenter to deploy Babuk-derived ransomware, likely as a forensic distraction. The Lazarus Group leveraged a Windows zero-day (CVE-2026-68820) in a campaign dubbed Operation Dream Job, targeting aerospace and defense sectors. GeoServer faced active exploitation of a critical SQL injection flaw prior to patching. Additionally, new macOS malware Amnesia Stealer enables real-time browser hijacking via Chrome DevTools Protocol, stealing authenticated sessions and sensitive data.

The North Korean threat actor Lazarus Group has exploited a Windows zero-day vulnerability, CVE-2026-68820, in the AFD.sys driver to escalate privileges to SYSTEM and deploy a new in-memory backdoor named Troy. The attack is part of Operation Dream Job, a long-running cyber espionage campaign using fake job offers on LinkedIn to lure victims into downloading trojanized software or opening malicious PDFs. Two infection chains were observed: one using DLL side-loading with the malicious libmupdf.dll and another via a trojanized SecurityPDF viewer that triggers payload execution upon detecting a specific marker in a PDF. The attackers also use compromised legitimate infrastructure, including WordPress, SharePoint, and vulnerable Roundcube servers (CVE-2025-49113), to host C2 communications and distribute the ForestTiger (ScoringMathTea) backdoor.