Weekly Threat Digest 26.43 || Oct 19

Exploited Ivanti, BeyondTrust, Cisco, and Palo Alto flaws lead a heavy patch week

CISA added exploited flaws in Ivanti Connect Secure (CVE-2026-104935), BeyondTrust Remote Support (CVE-2026-102764), and the Palo Alto PAN-OS management interface (CVE-2026-0322) to its Known Exploited Vulnerabilities catalog this week, and Cisco patched a Secure Email Gateway zero-day (CVE-2026-76519) that gives an attacker root through a crafted email attachment. Microsoft's October release fixes more than 1,400 vulnerabilities, including an exploited Windows Shell security feature bypass (CVE-2026-96951). New analysis of Citrix NetScaler CVE-2026-88771 corrects the scope given in 26.42, and Ahsay says its first AhsayCBS patch didn't fully fix the flaws covered there.

For critical infrastructure, attackers forced refrigeration controllers at hundreds of French supermarkets into defrost, and an extortion group posted 38 port and shipping firms to its leak site in a single batch. Stolen ConnectWise Cloud Backup credentials were used to sign in to at least 162 Microsoft 365 tenants.

Act Now

Ivanti Connect Secure: CVE-2026-104935, an authentication bypass exploited as a zero-day, lets attackers run commands and steal credentials. If you run Connect Secure: update now, and use network and memory forensics, since Ivanti's Integrity Checker may miss in-memory activity.
BeyondTrust Remote Support: CVE-2026-102764, exploited by a suspected PRC-nexus actor, lets attackers bypass authentication and pivot to downstream endpoints. If you self-host 26.2.3 or earlier: apply BT26-05-RS and rotate every credential the appliance stored.
Cisco Secure Email Gateway: CVE-2026-76519, exploited in the wild, lets an unauthenticated attacker gain root by emailing a crafted attachment. If File Reputation is enabled: update Content Scanner Tools to 25.3.0.5525 or later and check the appliance for signs of compromise.
Citrix NetScaler ADC and Gateway: CVE-2026-88771 needs no authentication and no optional features, so every unpatched appliance is exposed. If you run NetScaler: preserve evidence, upgrade to 14.1-73.46 or 13.1-64.29 or later, and hunt for web shells.

Drafted with AI from public reporting; reviewed and edited by GPP Labs before publishing.

OT/ICS Advisories

Marker shows the highest CVSS v3 score in each advisory: 🔴 9.0 and up · 🟠 7.0–8.9 · 🟡 4.0–6.9

🟠 Eclipse Milo (OPC UA SDK) · ICSA-26-288-01 · 6 CVEs · CVSS 8.2. Used in chemical, critical manufacturing, energy, and water sectors. Flaws allow unauthorized method execution, credential recovery via padding oracle, memory exhaustion, and access to protected diagnostics data. Update to version 1.1.5; there is no fixed 0.6.x release, so 0.6.x users must migrate. CISA
🟠 Inductive Automation Ignition (SCADA platform) · ICSA-26-286-01 · CVE-2026-92817 · CVSS 8.8. Used in critical manufacturing, energy, and IT sectors. An authenticated user with access to a Vision project can use their session identifier to gain Designer-level privileges and run arbitrary code in the Gateway process. Update to version 8.1.55 or 8.3.9. CISA
🟠 CISA Malcolm (network traffic analysis suite used for OT monitoring) · ICSA-26-280-01 (Update A) · 7 CVEs · CVSS 8.1. Used to monitor networks in energy, IT, and water and wastewater sectors. Flaws include authentication bypass, incorrect authorization, server-side request forgery, cross-site request forgery, and resource exhaustion from highly compressed data; five CVEs affect versions through v26.07.1 and two through v26.08.0. Update to v26.09.0 or later. CISA

Critical Infrastructure

Attackers force supermarket refrigeration into defrost across France

In an overnight attack reported October 12, attackers remotely triggered forced defrost cycles on refrigeration controllers at hundreds of French supermarkets, stretching defrosts from one hour to as long as eight and pushing temperatures as high as 50°C (122°F), Al Jazeera reports. Fires broke out at several stores, and retailers had to discard fresh and frozen stock. Intermarché, Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc were hit; France's finance minister put the total near 700 supermarkets, and a Sekoia analyst told Reuters that stores in Spain, Portugal, Poland, Germany, and Belgium were also affected. The Paris prosecutor's office and ANSSI are investigating, and no group has claimed the attack.

CERT-FR reported compromises of Danfoss AK-SM and AK-SC, Copeland XWEB, and Dixell XWEB controllers, according to eSecurity Planet. Danfoss said the affected units ran outdated firmware, and some models no longer receive security updates. Claroty's Team82 disclosed authentication bypass and command injection flaws in Danfoss AK-SM 800A controllers in August and found thousands of exposed management interfaces, but investigators haven't said how the attackers got in.

Exposure: Food retail and cold-storage operators running Danfoss, Copeland, or Dixell refrigeration controllers, and any organization with internet-reachable building or OT controllers.
Response: Inventory connected controllers and their firmware, remove direct internet exposure, secure remote access with MFA where supported, segment OT from corporate IT, plan replacement of unsupported units, and add independent temperature alarms.
Analysis: Nozomi Networks Labs on the risks of internet-connected OT, and Claroty Team82.

On the Radar

AI pentesting framework ARTEX turned on banks, and seen scanning UK CNI: Zscaler reports attackers used the ARTEX AI pentesting framework to find and exploit vulnerabilities at South Korean financial firms, a campaign first observed in late September 2026 that exposed personal data of about 67,000 people. Separately, Bridewell reports ARTEX-linked infrastructure scanning UK critical national infrastructure. Zscaler · Bridewell
Extortion group posts 38 port and shipping firms in one batch: n0n, a data-theft extortion group active since September, listed 38 port, shipping, and logistics organizations across 18 countries on its leak site on October 12, including Busan terminal operators. SOCRadar says the group usually gets in with infostealer credentials but suspects a shared application flaw in this batch; none of the victims had confirmed a breach. SOCRadar

Vulnerabilities & Exploits

Ivanti Connect Secure zero-day exploited in the wild

CISA reports that attackers are exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure, to run arbitrary commands, steal credentials, and exfiltrate data. CISA added it to the KEV catalog on October 13. Affected versions are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.

Ivanti fixed the flaw in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5, according to CIS, but customers on 22.8 should move to 25.1.1.2 or later, since 22.8 reaches end of life on January 31, 2027. Ivanti's Integrity Checker Tool may not detect exploitation because the attacker's commands run in memory, so finding a compromise takes network and memory forensics.

Exposure: Ivanti Connect Secure appliances on the versions above.
Response: Update now. If you suspect compromise, back up the appliance configuration, factory reset, upgrade, restore the configuration, and reset all passwords, certificates, and API keys.

BeyondTrust Remote Support zero-day tied to a suspected PRC-nexus actor

CISA reports that attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support (formerly Bomgar) 26.2.3 and earlier, to gain access, persist, escalate privileges, and move laterally. CISA added it to the KEV catalog on October 16. Mandiant attributes zero-day exploitation in late August 2026 to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, and warns that broad, opportunistic exploitation may follow now that the flaw is public.

ARMORY CASTLE deployed the SAWFLY web shell and BARECLAW tunneler, gained root by setting SUID permissions on a copied shell binary, harvested credentials from the appliance vault, and modified configuration templates to survive reboots. It deleted logs throughout, then used the appliance to launch remote sessions against downstream endpoints and exfiltrate files.

Exposure: Self-hosted BeyondTrust Remote Support 26.2.3 and earlier. BeyondTrust patched its hosted (SaaS) deployments on October 9.
Response: Apply BT26-05-RS now if you run 24.3.1 or later; older versions must upgrade first, then patch. Run network and memory forensics on any appliance exposed during the window, rebuild suspected compromises from a known-good state, rotate every credential the appliance stored or injected, and revoke active support sessions.
Detections: Mandiant published YARA rules and file hashes.
Also reported by: Beazley Security

Cisco email gateway zero-day exploited with a crafted attachment

Cisco has patched CVE-2026-76519 (CVSS 9.8), a relative path traversal in the Advanced Malware Protection feature of Secure Email Gateway, physical and virtual. A remote, unauthenticated attacker can write arbitrary files and run commands as root by sending an email with a crafted attachment. Cisco's PSIRT became aware of active exploitation in October 2026, and Cisco has deployed mitigations on cloud instances and contacted Secure Email Cloud customers whose devices show signs of compromise, BleepingComputer reports.

Exposure: Secure Email Gateway with File Reputation enabled and assigned to a mail policy, running Content Scanner Tools earlier than 25.3.0.5525.
Response: There are no workarounds. Check the version with the contentscannerstatus CLI command and update Content Scanner Tools to 25.3.0.5525 or later; Cisco also lists fixed AsyncOS releases 15.5.5-014 and 16.5.0-780, and 16.0 users must migrate to a fixed release. Review firewall and network logs for unexpected transfers to or from the appliance, since attackers may erase local evidence. If you find signs of compromise, renew credentials and cryptographic material and restrict access to the appliance.

Microsoft fixes more than 1,400 vulnerabilities, one already exploited

Microsoft's October Patch Tuesday fixes more than 1,400 vulnerabilities, according to SANS Internet Storm Center. CIS reports that CVE-2026-96951, a Windows Shell security feature bypass, is exploited in the wild. It lets attackers get around Mark of the Web protections, making it easier to run code when a victim opens a malicious file sent by email or instant message.

The release also fixes 10 remote code execution flaws in Windows DHCP Server (five critical), a publicly disclosed .NET Framework security feature bypass (CVE-2026-108398), and a high-complexity Exchange Server remote code execution flaw (CVE-2026-70571) triggered by crafted email. SANS flags the large number of Office fixes for quick attention.

Exposure: Windows, Office, SharePoint Server, SQL Server, Exchange Server, and other Microsoft products.
Response: Prioritize CVE-2026-96951 and the Office updates, then DHCP Server and Exchange.

More This Week

Palo Alto PAN-OS management interface flaw exploited (CVE-2026-0322): An attacker with credentials and network access to the management interface can run code as root on PA-Series and VM-Series firewalls and on Panorama. Palo Alto reports very limited exploitation and shared three attacker IP addresses; CISA added the flaw to KEV with an October 17 deadline. Fixes cover PAN-OS 10.2 through 12.2. Palo Alto lists no workarounds, but restricting management access to trusted internal addresses limits exposure. Separately, ReliaQuest reports Qilin and other ransomware groups using CVE-2026-0257, a GlobalProtect authentication bypass Palo Alto disclosed in May, for VPN access. Palo Alto Networks · BleepingComputer · ReliaQuest
Stealthy FortiGate implant found in a telecom intrusion (4 CVEs): Unit 42 reports attackers exploited CVE-2024-47575 in FortiManager to steal configurations for more than 500 FortiGate firewalls, then deployed PEERSTITCH, a memory-resident implant that leaves no disk artifacts and hides in legitimate process traffic. Unit 42
SonicWall SMA1000 flaws could chain to remote code execution (4 CVEs): A pre-authentication server-side request forgery flaw lets unauthenticated attackers reach internal functionality, and chained with a post-authentication command injection flaw, could allow remote code execution. Center for Internet Security
Google Chrome patches 37 vulnerabilities (37 CVEs): The update fixes use-after-free, buffer overflow, and type confusion flaws across components including PDF, Media, V8, and WebRTC. Center for Internet Security
Dell System Update flaws could lead to code execution as root (multiple CVEs): The most severe lets an unauthenticated remote attacker gain filesystem access, which can then be used to run code with root privileges. Versions before 2.3.0.0 are affected; no exploitation is known. Center for Internet Security
Fortinet's October advisories (10 advisories): None are reported exploited. Start with the two critical, unauthenticated flaws: a FortiSandbox web interface authentication bypass (CVE-2026-107656, FG-IR-26-185) affecting FortiSandbox 4.4 through 5.2 and FortiSandbox PaaS, and a FortiSIEM 7.5.0 path traversal that allows code execution through crafted packets (CVE-2026-106173, CVSS 9.4, FG-IR-26-180); upgrade to 7.5.1, or restrict access to TCP port 27918 in the meantime. Also unauthenticated: a FortiSandbox Fabric API bypass from hard-coded keys (CVE-2026-106172, FG-IR-26-179), and a FortiOS HTTPS management-interface denial of service in 7.6.4 through 7.6.6 and 8.0.0 (CVE-2026-106174, FG-IR-26-181). The rest need credentials or local access: FortiManager fgfmd command injection (FG-IR-26-177), FortiAnalyzer and FortiManager SQL injection (FG-IR-26-178), FortiSIEM (FG-IR-26-183), FortiMail webmail SQL injection (FG-IR-26-184), and denial of service in FortiSandbox (FG-IR-26-176) and FortiOS, FortiProxy, and FortiSwitch (FG-IR-26-182). Fortinet PSIRT

Updates on Earlier Stories

Citrix NetScaler CVE-2026-88771: how it's being exploited, and a correction

Issue 26.42 covered four exploited NetScaler CVEs. Zscaler ThreatLabz now details exploitation of the most severe, CVE-2026-88771 (CVSS 9.8), which needs no authentication and no optional features enabled. Correction: 26.42 described the exposure as appliances configured as a SAML identity provider or service provider. Zscaler says that condition applies to a separate flaw, CVE-2026-107406. Treat every unpatched NetScaler ADC and Gateway appliance as exposed to CVE-2026-88771.

ThreatLabz observed a three-stage chain: attackers staged Base64-encoded payloads in HTTP access logs through crafted User-Agent headers, poisoned authentication logs with forged failure messages containing shell commands, and got execution when a legitimate NetScaler Perl script (/netscaler/ns_monuploadd_err.pl) processed the poisoned entry. The payloads dropped web shells, enabled PHP execution by modifying /etc/httpd.conf, and tried to download a FreeBSD implant from infrastructure that overlaps with earlier StyleSmuggler (CVE-2026-75650) exploitation. Zscaler calls the overlap an investigative lead, not attribution.

Exposure: NetScaler ADC and Gateway before 14.1-73.46 and 13.1-64.29, 14.1-FIPS before 14.1-73.46, and 13.1-FIPS and 13.1-NDcPP before 13.1.37.283.
Response: Preserve evidence (VM snapshots, syslogs, support bundles) before updating, isolate suspect appliances, compare /etc/httpd.conf against a known-good system, hunt for recently modified files in /netscaler/ns_gui/ and /var/netscaler/gui/, rotate exposed secrets after containment, and upgrade.
Detections: Zscaler published hunting commands and attacker IP addresses.

More Updates

Integrity Tech and Flax Typhoon, the takedown behind last week's advisory: 26.42 covered the joint advisory on Chinese government-linked actors using Integrity Technology Group's tools against critical infrastructure. The Justice Department also seized websites supporting two of those tools, the Microscan vulnerability scanner and the FishHub phishing and malware platform, and The Record reports that victims of the Microscan scanner included a South Carolina power company and Taiwanese natural gas and power companies. CISA said the actors continue to position themselves within critical infrastructure networks, including OT systems. The Record · CISA
AhsayCBS: the first patch didn't hold: 26.42 covered two chained AhsayCBS flaws (CVE-2026-105133 and CVE-2026-105134) exploited for web shells and cryptominers. Ahsay said on October 10 that its 10.3.4.0 patch did not fully address them and released hotfix 10.3.4.45 through its partner portal; install it and reboot. Keep the management interface off the internet in the meantime. Ahsay · eSecurity Planet
Dubai Airports coding-test lure, now from the primary source: 26.42 linked secondary reporting on Iranian actors using a fake Dubai Airports coding test against Iraqi critical infrastructure. Unit 42's analysis names the campaign Blinder Tunnel and assesses the Iranian nexus with high confidence: a rigged Visual Studio .csproj file triggered AppDomainManager hijacking and DLL sideloading to load ShelbyLoader V2, which used GitHub's API and issues for command and control, followed by Chisel tunnels for lateral movement. Unit 42 published IOCs and YARA rules for ShelbyLoader V2, ShelbyC2 V2, and Blackwood. Unit 42
Trojanized Terraform provider, now from the primary source: 26.42 linked secondary reporting on a malicious Terraform provider. Zscaler's analysis describes a trojanized provider that pulls a second stage from the lookalike domain hashicorp-terraform[.]io and hides encrypted executables in decoy .woff font files, delivering the FLATROOF backdoor and Python stealers to cryptocurrency and Web3 developers. Zscaler sees substantial overlap with North Korea's TraderTraitor but stops short of high-confidence attribution. Zscaler

Credential Theft & Phishing

ConnectWise backup credentials abused to access Microsoft 365 tenants

An attacker used stolen credentials for ConnectWise Cloud Backup (formerly SkyKick) to sign in to customer Microsoft 365 tenants from 144.172.64[.]128 on October 15, according to Huntress. The application authenticated in at least 162 tenants between 06:13 and 08:34 UTC, working through them in sorted GUID order. In one tenant, a related ConnectWise application assigned itself Global Administrator and added client secrets to two other applications, including an MSP management tool and Huntress's own application.

Huntress later found a second, targeted wave from the same address that day against 16 tenants in the policy, national security, trade, and critical mineral sectors, most of which don't use ConnectWise products; those attempts failed where the ConnectWise application wasn't present. Huntress has seen sign-in activity from the address in almost 1,000 Entra tenants, more than 300 of them successful. ConnectWise says it has disabled the affected applications.

Exposure: Microsoft 365 tenants with ConnectWise Cloud Backup or other ConnectWise Cloud Management applications installed, especially those managed through an MSP.
Response: Disable, don't delete, ConnectWise Cloud Backup (application ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and ConnectWise Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640), and consider disabling other ConnectWise Cloud Management applications. Disabling an app doesn't remove credentials already added, so review client secrets and certificates on all your Microsoft 365 applications and remove any unexpected ones added since October 13. Check service principal sign-in logs for 144.172.64[.]128, and review directory role assignments for ConnectWise applications.
Detections: Huntress published application IDs, IP addresses, and user agents.
Also reported by: Beazley Security

Chinese-language phishing ecosystem disrupted

Microsoft describes a Chinese-language cybercrime ecosystem of phishing kit developers, operators, and an illicit marketplace, which its Digital Crimes Unit has now disrupted with law enforcement and partners. Microsoft tracks the cluster behind three kits (CoGUI, Haozi, and Iron Man System) as Storm-2990 and says it facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations since January 2026. It also names YAM Store (Storm-3119), an initial access broker selling compromised infrastructure to the kit operators.

Proofpoint, which supported the disruption, says it detects and blocks more than 100 million messages a month aimed at organizations using the CoGUI kit alone. Iron Man System lures impersonate local government (including traffic and parking fees), law enforcement, healthcare, finance, transportation, and retail brands.

Exposure: Healthcare, financial services, wholesale distribution, and IT organizations, particularly in Japan, the United States, Australia, and India.
Response: Use phishing-resistant MFA, apply Conditional Access to privileged accounts, and review Microsoft's recommended Exchange Online Protection and Defender for Office 365 settings.

Quick Hits

Google phishing kit relays MFA over WebSockets: Cisco Talos details a campaign against Taiwan research organizations whose adversary-in-the-middle kit keeps a WebSocket open to the attacker's server, mirroring Google's live sign-in state to intercept credentials and MFA challenges. Lures included AI-personalized invitations and event posters altered with malicious QR codes. Cisco Talos
ClickFix campaigns deliver multiple malware loaders: Forescout analyzes ClickFix lures delivering loaders including BabaDeda, Lorem Ipsum, Potemkin, and Axolotl, using tradecraft previously attributed to Vice Society, which has operated ransomware families including Rhysida. Forescout · Forescout
ClickFix to business email compromise in 24 hours: Attackers chain AI platform abuse with ClickFix to steal Microsoft 365 session cookies, reach the inbox without passwords or MFA, then create hidden inbox rules and redirect payments within a day. Huntress
Fake WatchGuard VPN site steals credentials: SEO poisoning ranks the lookalike domain watchguard-vpn[.]net in search results, and a fake pop-up harvests the VPN server address and credentials twice, rejecting the first attempt as incorrect. The site then delivers the genuine signed installer from WatchGuard's own CDN, leaving nothing malicious for endpoint tools to flag. A related collection domain, watchguard-ssl[.]online, was registered September 14. Huntress

Threat Activity & Tradecraft

Mercenary spyware delivered through targeted online ads

Citizen Lab reports that devices at Al Jazeera were infected with Candiru spyware (rebranded as Integrity Labs) through targeted online ads, the first public technical confirmation of zero-click mercenary spyware delivered this way. The ads were bought by Discover-Tech, an Israeli company presenting itself as an advertiser while serving several spyware vendors, including Candiru, Bindecy, and Intelos.

Discover-Tech's platform, Controlium, lets those partners de-anonymize, fingerprint, and automatically infect a device when an ad renders. Citizen Lab's analysis of four billion bidding records found its ads on nearly 200,000 websites and apps in dozens of countries over a four-month period, including on networks of NATO, the European Parliament, defense contractors, and media organizations. At least 45 Al Jazeera devices were targeted.

Exposure: Media, telecommunications, government, energy, healthcare, and financial organizations; devices running apps including MX Player, Lark Player, Yahoo Mail, Opera Mini, and Duolingo, or visiting affected websites.
Response: Block ads and tracking at the gateway and on managed devices, especially for high-risk staff, and reset or disable mobile advertising IDs.
Detections: Citizen Lab published fingerprints for Candiru validator and command-and-control servers, plus a spyware sample hash.

Worth Watching

Kazakhstan-nexus actor targets CIS governments, with interest in water and energy: Cisco Talos and Recorded Future track UAT-6275 (TAG-193) attacking government organizations across nine CIS countries from June 2025 through August 2026, using macro documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a WinRAR exploit (CVE-2025-8088) to deploy custom reverse shells. Cisco Talos
Third-party gateway leads to months inside a European bank: Attackers used compromised credentials to enter through a misconfigured third-party gateway, spent months on noisy reconnaissance and credential harvesting, then tried to exploit a WSUS server for persistence. Unit 42
AI-generated payloads used against government Linux infrastructure: In activity observed from October 2025 to April 2026, attackers used AI-generated payloads, custom backdoors, and web shells against government entities to dump databases and target mailboxes. Unit 42
Spam floods and fake IT support lead to ransomware: Attackers flood victims with spam, impersonate IT support over Microsoft Teams, and talk users into granting remote access through Quick Assist or similar tools before deploying ransomware. Zscaler
Aoki infostealer adds AI coding assistant credentials: Symantec reports the Aoki infostealer now steals credentials and session files from AI coding assistants including Claude, Codex, Cursor, Codeium, and Gemini, alongside its existing browser and cryptocurrency wallet theft. Symantec
Brief tampering with AOMEI's update servers: Attackers modified AOMEI's update infrastructure in five- to ten-minute windows to redirect legitimate updates to custom malware, then reverted the changes. Related samples date from late April 2026, and Google expects more tampering happened outside its visibility. Google Threat Intelligence Group