Find what you’re looking for
Browse everything
6,838 results in Threat Reports
ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants
In October 2026, ConnectWise disclosed a supply-chain credential compromise in which threat actors exploited a vendor application credential to gain unauthorized access to application identities tied to its Cloud Backup service. First identified on October 14, the attackers used a single compromised vendor credential from IP 144.172.64.128 to perform application sign-ins across thousands of Microsoft 365 tenants. Post-compromise activity included self-granting Global Administrator rights and backdooring additional applications with new secrets for persistence. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services, reset credentials, and engaged third-party incident responders. Huntress telemetry across 10,000-plus tenants confirmed the scope. This incident underscores the accelerating threat of supply-chain credential abuse targeting managed service providers. As attackers increasingly pivot through trusted vendor relationships to reach downstream customers at scale, the ConnectWise breach exemplifies why identity hygiene, least-privilege application permissions, and real-time cross-tenant visibility have become non-negotiable security controls for MSP ecosystems in 2026.
APT28's NATO Naval Shipbuilder Breach: Inside the Reflective Loader, HOOKEDGE Backdoor, and Persistent SSH Tunnel Campaign
In late July 2026, Russian state-sponsored threat actor APT28 (Fancy Bear / Forest Blizzard) compromised a NATO-member naval shipbuilder, a law enforcement agency, and a military aircraft engine manufacturer. Operating under the Symantec-designated cluster 'Swallowtail,' attackers delivered the HOOKEDGE backdoor via macro-enabled Word documents, then conducted hands-on-keyboard activity over multiple days. They stole credentials via dual techniques—an SSH tunnel for persistent internal network access and a loopback NTLM-capture PowerShell script—and deployed a previously undocumented reflective loader ('ld.exe') to execute an encrypted in-memory payload, with activity confirmed as recently as September 24, 2026. This campaign reflects APT28's accelerating operational tempo against NATO defense-industrial targets in 2026, combining proven spear-phishing lures with novel in-memory execution techniques that evade traditional endpoint detection. The parallel exploitation of CVE-2026-21509 and CVE-2026-8496 against Ukrainian entities confirms the group's simultaneous multi-front offensive, raising urgent concerns for any organization in the defense, government, or critical-infrastructure supply chain.
Go's Emergency CA Block Exposes the Hidden PKI Risk Inside Your Cloud-Native Stack
On October 20, 2026, the Go team issued an emergency security release (versions 1.27.3 and 1.26.10) that hard-codes a block on eight intermediate certificate authority public keys linked to Indian CA eMudhra's emSign brand. Programs rebuilt against the new releases will refuse TLS connections and reject code signatures whose chains pass through any of the eight blocked keys—six TLS intermediates and two code-signing intermediates—under emSign Root TLS CA - G3 and emSign Root CS CA - G3. Mozilla independently added six related eMudhra certificates to its OneCRL revocation list two days prior. The Go team classified the fix on its URGENT track, reserved for active ecosystem-integrity threats, but has disclosed no specific misbehavior, leaving operators of Go-based services to reissue certificates immediately or face broken connectivity. This incident underscores an accelerating pattern of browser and runtime vendors taking unilateral, emergency action against certificate authorities without public disclosure—compressing the remediation window for enterprises that depend on affected PKI chains and highlighting how supply-chain trust decisions made in CA root programs ripple instantly into production software deployments worldwide.
Critical SCADA Alert: Hitachi Energy MicroSCADA X SYS600 Exposes Energy Infrastructure to Auth Bypass and Privilege Escalation
CISA published advisory ICSA-26-293-04 in October 2026 disclosing three vulnerabilities in Hitachi Energy MicroSCADA X SYS600, a supervisory control and data acquisition platform widely deployed in global energy infrastructure. CVE-2026-9852 is a CSV injection flaw (CVSS 3.1: 5.0) enabling data manipulation and potential code execution via malicious log entries. CVE-2026-9853 (CVSS 3.1: 7.8) allows any OS-authenticated user to read and modify SCADA application objects without SYS600 credentials, bypassing application-layer access controls entirely. CVE-2026-9854 (CVSS 3.1: 7.8) exposes a broken role-based access control mechanism that permits engineering-tool users to escalate privileges to Windows administrator, seizing full host control. All three affect versions 10.7 and prior; version 10.8 partially remediates the issues. These vulnerabilities arrive as threat actors—including nation-state groups targeting operational technology—intensify focus on energy-sector ICS platforms. The combination of authentication bypass and privilege escalation in a single SCADA product creates a chained attack path from low-privilege OS access to full operational disruption, mirroring TTPs observed in recent grid-targeting campaigns and underscoring the urgency of ICS-specific zero-trust segmentation.
Seven Vulnerabilities in Hitachi Energy RTU500 Threaten Global Energy OT Infrastructure
In September 2026, CISA republished a Hitachi Energy PSIRT advisory disclosing seven vulnerabilities across multiple firmware versions of the RTU500 series Communication Management Unit (CMU), widely deployed in global energy infrastructure. The flaws span NULL pointer dereference (CVE-2026-17539, CVE-2026-28388), type confusion in libxml2 (CVE-2026-6732), use-after-free in libxml2 (CVE-2026-6653), cleartext transmission of sensitive information via libcurl cookie leakage (CVE-2026-6276), insufficiently protected proxy credentials (CVE-2026-9079), Digest authentication header leakage (CVE-2026-11856), proxy authorization header leakage (CVE-2026-8927), and mTLS authentication bypass via connection reuse (CVE-2026-8932). Successful exploitation could result in denial of service of IEC 60870-5-104 communications, credential theft, and authentication bypass on operational technology devices managing electric grid assets. These disclosures arrive as nation-state threat actors, including groups like Volt Typhoon and related ICS-focused adversaries, continue to pre-position in critical energy infrastructure. The combination of authentication bypass, credential leakage, and DoS risks in a single OT device underscores growing exposure in legacy-adjacent industrial environments where patching cycles are prolonged and network segmentation is often incomplete.
Moxa AIG-302 ThingsPro Edge: Two ICS Vulnerabilities Put OT Cryptographic Keys and API Secrets at Risk
On October 20, 2026, CISA published ICS Advisory ICSA-26-293-03 disclosing two critical vulnerabilities in the Moxa AIG-302 ThingsPro Edge industrial IoT gateway running firmware version 1.4.0 and earlier. CVE-2026-109812 (CVSS 6.8) exposes a missing authorization flaw in the internal API endpoint /api/v1/secrets/, allowing a privileged but low-trust attacker with adjacent network access to retrieve cryptographic key material and sensitive configuration data. CVE-2026-109813 (CVSS 8.1) reveals a hard-coded cryptographic key embedded in /usr/bin/sysman, enabling an unauthenticated adjacent-network attacker to compromise both the confidentiality and integrity of all device communications. Both flaws are addressed in firmware v1.4.1, released by Moxa under security advisory MPSA-262560. Affected deployments span critical manufacturing, energy, and water and wastewater sectors worldwide. These vulnerabilities arrive amid intensifying scrutiny of OT/ICS supply-chain security, where hard-coded credentials and weak access controls in edge devices continue to serve as reliable pivot points for nation-state and ransomware actors targeting industrial infrastructure. The Cybersecurity and Infrastructure Security Agency's active advisory cadence signals growing regulatory urgency around ICS device hygiene and adjacent-network threat surfaces.
When AI Attacks at Machine Speed: Inside the Cairn Agent Campaign That Hit 1,200 Sites
Beginning around October 2, 2026, a Chinese-speaking threat actor deployed autonomous AI agents via the open-source penetration-testing framework Cairn to systematically target over 1,200 company websites, successfully compromising more than 100 organizations including Deere, SharkNinja, and Cummins. Operating largely unsupervised, the agents exploited web application vulnerabilities—including memcached session-store misconfigurations, unsafe PHP object deserialization, and legacy Zend Framework weaknesses—to plant persistent web shell uploaders. Successful intrusions averaged 23 hours at roughly $50 per breach, with the entire campaign costing an estimated $5,000. The exposed Cairn control panels also leaked harvested credentials and secrets, 11% of which remained valid at time of discovery. This incident marks a watershed moment in offensive AI tradecraft: for the first time, a documented criminal campaign used agentic AI at scale to autonomously discover, exploit, and establish persistence across enterprise web properties with minimal human oversight. The barrier to sophisticated, multi-target web intrusion has collapsed, demanding that defenders modernize detection and network policy enforcement to match machine-speed attacks.
Pegasus Zero-Click Spyware Found on Serbian Rector's iPhone Six Days Before National Election
In October 2026, Citizen Lab confirmed with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and prominent pro-democracy figure, was infected with NSO Group's Pegasus spyware via a zero-click exploit — requiring no user interaction whatsoever. The disclosure came just six days before Serbia's October 25 snap parliamentary election. A second case involved Rade Bajić, a senior prosecutor investigating a Kushner-linked Belgrade property scandal, who received Apple Threat Notifications in August 2026. These findings extend a documented wave of at least 16 civil-society targets in Serbia in 2026 alone, including student activists and opposition politicians, with earlier cases also involving the Android spyware NoviSpy linked to Serbia's civilian intelligence agency BIA. This incident reflects a sharp escalation in mercenary spyware deployment against democratic institutions and civil society ahead of contested elections. The pattern — zero-click exploits on fully updated devices, targeting lawyers, academics, and prosecutors — demonstrates that no device is inherently safe, and that network-level visibility and egress controls remain critical detection layers even when endpoint defenses are bypassed.
Six Kernel-Crash CVEs in HMS Networks PCAN Windows Drivers: What ICS Operators Must Do Now
In October 2026, CISA published ICS Advisory ICSA-26-293-01 disclosing six memory-safety vulnerabilities in HMS Networks PEAK-System PCAN Windows drivers (versions ≤5.1.2 / ≤5.1.2.1151). The flaws—spanning out-of-bounds writes, classic buffer overflows, improper array-index validation, untrusted pointer dereference, and length-parameter inconsistency—allow a local, low-privileged user to crash the Windows kernel, causing denial-of-service conditions on workstations and engineering stations running CAN-bus hardware. Affected sectors include Transportation, Healthcare, Energy, and Critical Manufacturing globally. HMS Networks released a fix in version 5.1.4 and recommends immediate upgrade. Kernel-level driver vulnerabilities in OT/ICS environments are an accelerating trend: attackers increasingly target device drivers as a reliable path to system instability or privilege escalation on engineering workstations that are difficult to patch quickly. With six CVEs simultaneously disclosed across widely deployed industrial CAN-bus drivers, organizations should treat driver patch management as a first-class control within their ICS security programs.
Qilin & INC Ransomware Exploit PAN-OS CVE-2026-0257: How Attackers Bypassed MFA and Owned the Hypervisor
In mid-2026, ransomware groups Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) began actively exploiting CVE-2026-0257, a CVSS 7.8 authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access, to establish unauthorized VPN sessions and circumvent multi-factor authentication controls. After gaining an initial foothold, attackers conducted internal reconnaissance using dual-use RMM tools, moved laterally via RDP and SMB, harvested credentials by targeting vCenter and ESXi hypervisors at the virtualization layer, and deployed ransomware alongside data-exfiltration tooling across sectors including healthcare, financial services, government, and education. Veeam backup infrastructure was also targeted using CVE-2023-27532 to maximize damage and eliminate recovery options. This campaign underscores an accelerating trend of ransomware operators chaining perimeter authentication bypasses with deep virtualization-layer attacks to defeat endpoint detection, MFA, and backup resilience simultaneously. As CISA KEV listings shorten the window between disclosure and exploitation, organizations relying on gateway-centric security without east-west segmentation and encrypted-traffic visibility face compounding risk.
CVE-2026-106173: Public PoC Exploit Drops for Critical FortiSIEM Unauthenticated RCE
In October 2026, Fortinet disclosed CVE-2026-106173, a critical path traversal vulnerability in FortiSIEM (CVSS 9.4) affecting versions up to 7.5.0. Unauthenticated attackers can connect to the gRPC service on TCP port 27918, exploit unsafe path construction in the SendQueryResult() function, and chain a null-byte injection technique to overwrite arbitrary files—including a Redis health-check shell script executed every 60 seconds by a cron job—achieving full unauthenticated remote code execution. Horizon3.ai published a public proof-of-concept exploit within days of patching, dramatically lowering the bar for exploitation across all unpatched FortiSIEM deployments. The public release of a working PoC transforms this from a theoretical risk into an active, weaponizable threat. Security operations platforms like FortiSIEM are high-value targets because compromising them can blind defenders, disrupt incident response, and provide attackers with privileged visibility into an organization's entire security telemetry—amplifying blast radius far beyond a typical application breach.
AI-Powered Espionage: How CL-UNK-1211 Used LLMs to Target Government Linux Servers
Between October 2025 and April 2026, Unit 42 tracked a threat cluster designated CL-UNK-1211 conducting an AI-accelerated espionage campaign against government entities and state-affiliated Linux infrastructure. Attackers gained initial access through widespread web shell deployments, hijacked global PHP configurations for persistence, harvested credentials via .bashrc manipulation and PHP injection, deployed a custom Go-based cross-platform RAT named SysGoRAT over WebSocket C2, and exfiltrated government mailboxes and entire database contents. Defense evasion included log deletion, timestomping, endpoint-protection termination, and planting fake red-team markers. AI-generated payloads with conversational inline comments accelerated the operation's pace across PHP, Python, Bash, and JavaScript. This campaign marks a tangible inflection point in state-level or state-adjacent espionage: AI is no longer theoretical in offensive operations. Attackers used LLM-generated code to compress development timelines, seamlessly pivot across technology stacks, and scale payload generation—signaling that AI-assisted intrusions will become the baseline expectation for advanced threat actors targeting critical government infrastructure.