Mandiant and GTIG identified active exploitation of CVE-2026-88772 against Citrix NetScaler ADC and NetScaler Gateway, with intrusions using custom tooling to gain root access, persist, and move into internal networks. The campaign deployed WHIPSHOT and SLAPSHOT to hide C2 in HTTP headers, proxy traffic for reconnaissance and credential theft, and abuse modified web server settings, while Citrix also warned that CVE-2026-88771 is being actively exploited. #CVE-2026-88772 #CVE-2026-88771 #CitrixNetScaler #WHIPSHOT #SLAPSHOT
Category: Threat Research
Validin has added Open Directories in beta for Enterprise customers, letting analysts search, browse, and compare internet-exposed folders and files as a historical dataset. The feature supports deep searches across infrastructure and file attributes, a dedicated VQL syntax, file previews, and change tracking over time for exposed content. #Validin #OpenDirectories #VQL
AhnLab ASEC reported phishing emails posing as project quote requests that lure recipients into downloading a compressed attachment containing a VBScript and obfuscated PowerShell chain. The attack downloads and executes Remcos RAT through Google Drive, performs UAC bypass and process injection, and uses C2 infrastructure at 102.220.160[.]104:2404. #AhnLabASEC #RemcosRAT #MicrosoftEdgeUpdateExe…
eSentire TRU detected exploitation of PaperCut MF zero-days (CVE-2026-82078 and CVE-2026-81578) against an education customer, leading to a web shell, a trojanized Microsoft Copilot binary, and deployment of an AdaptixC2 implant. The intrusion progressed to domain controller compromise, credential dumping, NTDS.dit extraction, and pass-the-hash movement across the Active Directory environment. #PaperCutMF #CVE-2026-82078 #CVE-2026-81578 #AdaptixC2 #MicrosoftCopilot
ASEC reported phishing emails impersonating employees of a Korean company and luring victims into opening a malicious XLS file that abuses CVE-2017-0199 to fetch an HTA payload, then a steganographic PNG-delivered loader and finally Remcos RAT. The attack uses layered execution via WMI and obfuscated PowerShell to deploy the malware and…
September’s attacks showed how CSuite, N0va, IronToll, Wazza, and TerminalFix blurred the line between legitimate business workflows and malicious activity by abusing trusted services, authentication flows, and infrastructure. The campaigns increased risk to Microsoft 365 users, payment data, endpoints, and enterprise identity systems while making detection and incident scoping much harder….
Huntress found a campaign abusing ChatGPT Custom GPTs, Google Sites, and ClickFix lures to trick victims into running PowerShell that installs a malicious MSI and deploys DLL sideloading malware. The operation impacted dozens of users, used signed Canon and Stardock binaries to load hidden payloads, and relied on encrypted storage, persistence, and a RAT that could steal data and control infected hosts. #ChatGPT #CustomGPT #Canon #Stardock #GoogleSites
Security researchers analyzed Jewelbug, a China-based hackers-for-hire group running espionage and crypto fraud campaigns from a single control panel across the Middle East and Asia. The investigation found over 1 million implant check-ins and 580,000 stolen browser cookies in less than three months, along with numerous domains, subdomains, and IPs tied to the operation. #Jewelbug #SocGholish #Cloudflare #Azure #CloudFront
EclecticIQ Intelligence Center 3.9 now supports MITRE ATT&CK v19.1, updating threat mappings to reflect major changes such as the split of Defense Evasion into Stealth and Defense Impairment, plus new capabilities for ICS, Mobile, AI-enabled, and social engineering threats. The release also highlights EclecticIQ’s interactive ATT&CK Navigator, which helps analysts visualize coverage, identify gaps, and stay aligned with the evolving framework. #MITREATTACK #EclecticIQ #IntelligenceCenter
AhnLab SEcurity intelligence Center (ASEC) reported two attack cases abusing CVE-2019-18935 against unpatched Telerik UI for ASP.NET AJAX servers, where one intruder used a reverse shell, privilege escalation, and a Godzilla-style web shell. Another attacker used the same flaw to launch a Rust-based scanner that searched for exposed WordPress pages and…
CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, including two critical zero-day flaws that can independently enable remote code execution. CISA says these issues are being actively exploited worldwide and urges organizations to review Citrix guidance, check for indicators of compromise before…
Mandiant and GTIG report renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), which bypasses WAF rules by using a percent-encoded /%50SEMHUB/ path to reach Oracle PeopleSoft’s vulnerable PSEMHUB endpoint. The campaign spans multiple sectors worldwide and uses web shells, SIDEEYE via a trojanized Ple64.exe installer, Neo-reGeorg tunnels, and MeshAgent for persistence and lateral movement. #UNC6240 #ShinyHunters #CVE-2026-35273 #OraclePeopleSoft #SIDEEYE #Ple64.exe #Neo-reGeorg #MeshAgent
The article explains that ransomware defense is most effective before encryption, when defenders can detect exposed credentials, malicious infrastructure, and attacker behavior earlier in the attack lifecycle. It also shows how Recorded Future uses threat intelligence, the Intelligence Graph, and workflow integrations to help organizations prioritize relevant ransomware threats and disrupt them sooner. #RecordedFuture #IntelligenceGraph #RaaS
ANZ threat activity is dominated by identity- and access-driven compromise, with credential stuffing, stolen credentials, and initial-access broker sales recurring across financial services, manufacturing, and mining. Qilin is the most active cross-sector ransomware actor, while the report also highlights state-aligned pre-positioning by Volt Typhoon and Salt Typhoon, plus exploited vulnerabilities such as CVE-2023-20198, CVE-2025-59287, and CVE-2026-41940. #Qilin #VoltTyphoon #SaltTyphoon #CVE-2023-20198 #CVE-2025-59287 #CVE-2026-41940
Researchers uncovered Kothamine Agent, an undocumented RAT linked to malicious npm packages that can control Windows systems, steal browser data, and capture audio/video on some builds. Recent variants use tailcat and earlier ones used Tailscale VPN, giving operators encrypted command access while avoiding a conventional C2 domain. #KothamineAgent #tailcat #Tailscale #npm…