> ## Content Index
> Fetch the complete content index at: https://guide.gpplabs.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# Weekly Threat Digest 26.42 || Oct 12
- URL: https://guide.gpplabs.io/weekly-threat-digest-26-42-oct-12/
- Published: 2026-10-12T12:00:00.000Z
- Updated: 2026-10-13T22:42:38.000Z
- Description: FortiMail, NetScaler, and Atlassian flaws under active attack; Warlock hits a water utility
- Author: JP Williams

Fortinet reports active exploitation of a zero-day path traversal flaw (CVE-2026-104286) in FortiMail that lets unauthenticated attackers write arbitrary files and run code. Citrix NetScaler appliances face ongoing exploitation across four CVEs added to CISA's KEV catalog, several of them used as zero-days, with web shells, lateral movement, and new exploitation reported within 36 hours of disclosure. Huntress reports threat actors chaining two vulnerabilities in AhsayCBS backup servers to drop web shells and cryptominers, targeting managed service providers.

Symantec reports the Warlock ransomware group breached a water utility and a telecommunications provider among at least four recent victims. CISA and international partners warn that Chinese government-linked actors are targeting US critical infrastructure in Government Services, Critical Manufacturing, Healthcare, and Information Technology sectors using automated scanning tools and hands-on exploitation to steal sensitive data.

### Act Now

- **Fortinet FortiMail:** An exploited zero-day (CVE-2026-104286) lets unauthenticated attackers write files and run code through the IBE feature. If you run FortiMail 7.2 through 8.0.1: upgrade to 8.0.2, 7.6.7, or 7.4.9, or disable IBE until you can.
- **Citrix NetScaler ADC and Gateway:** Four exploited CVEs are now on CISA's KEV list, several of them used as zero-days, with web shells and lateral movement following. If you run NetScaler as a SAML IdP or SP: apply Citrix's updates and check appliances for web shells.
- **Atlassian Jira, Confluence, and Bitbucket:** An unauthenticated file-read flaw (CVE-2026-21589) with public proof-of-concept code is already being scanned for. If you run Atlassian products yourself: apply the October 5 patches and check web logs for `::` in request paths.

*Drafted with AI from public reporting; reviewed and edited by GPP Labs before publishing.*  

## OT/ICS Advisories

*Marker shows the highest CVSS v3 score in each advisory:* 
 *🔴 9.0 and up · 🟠 7.0–8.9 · 🟡 4.0–6.9*

- 🔴 **Savannah lwIP SMTP client (TCP/IP stack component)** · ICSA-26-279-02 · CVE-2026-15340 · CVSS 9.8\. Used in energy and water systems. Buffer overflow in SMTP client could crash the device or allow remote code execution. Apply patch\_125\_smtp\_txbuf.diff. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02)
- 🔴 **Hitachi Energy REB500 and RTU500 (protection relays and remote terminal units)** · ICSA-26-279-05 and -06 · 8 CVEs · CVSS 9.8 (RTU500; REB500 tops out at 6.5). Used in energy sector. REB500: libexpat vulnerabilities can cause denial of service. RTU500: end-of-life firmware has authentication bypass, path traversal, missing authorization, and VxWorks debug service flaws that could allow code execution. REB500: update to 8.3.4.0\. RTU500: upgrade to 12.7.8 or 13.9.1\. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-05) *·* [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-06)
- 🔴 **Grid Protection Alliance openPDC and openHistorian (synchrophasor data platforms)** · ICSA-26-281-02 · 6 CVEs · CVSS 9.8\. Used in energy sector. Deserialization of untrusted data, missing authentication on data publishers, server-side request forgery, hard-coded credentials in Docker image, and unsafe reflection allow remote code execution and information disclosure. Update openPDC to 2.9.482 or later, openHistorian to 2.8.585 or later; upgraded installs keep their old data publisher binding, so rebind it to loopback by hand, and the Docker image gets no fix. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02)
- 🟠 **Hitachi Energy SOI (software platform built on Apache ActiveMQ)** · ICSA-26-279-04 · CVE-2026-34197 · CVSS 8.8\. Used in energy sector. Apache ActiveMQ code injection vulnerability allows authenticated attackers to execute arbitrary code via crafted discovery URI. Apply patch SOI EP2\. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-04)
- 🟠 **Satel Netco Design (network planning and design platform)** · ICSA-26-281-03 · 4 CVEs · CVSS 8.8\. Used in communications sector. Stored cross-site scripting, inefficient regular expression complexity, and path traversal in import and export functions allow script execution, denial of service, file enumeration, and potentially arbitrary code execution. Update to version 2.1.7\. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-03)
- 🟠 **Red Lion Controls N-Tron 700 Series (industrial Ethernet switch)** · ICSA-26-281-01 · 7 CVEs · CVSS 8.3\. Used in commercial facilities, communications, critical manufacturing, and IT. Hard-coded credentials, plaintext password storage, unauthenticated SNMP administrative access, and firmware upload without integrity checks allow full device compromise and denial of service. Update to firmware 3.11.1 or later; configure or disable SNMP. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01)
- 🟠 **Hitachi Energy Asset Suite (asset management platform)** · ICSA-26-279-03 · CVE-2026-7395 and CVE-2026-11796 · CVSS 8.1\. Used in energy sector. Unauthenticated servlet access allows configuration file upload, information disclosure, integrity compromise, and denial of service. Update to version 9.9.1 when available; until then, disable the affected servlets. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-03)
- 🟠 **Johnson Controls EasyIO FG (building automation controller)** · ICSA-26-279-01 · CVE-2026-27872 and CVE-2026-27873 · CVSS 7.7\. Used in critical manufacturing, commercial facilities, government, transportation, and energy. Hard-coded credentials and improper privilege management allow full device compromise. Not remotely exploitable, but the product is end-of-life and no patch is coming. Migrate to current-generation products; isolate on BAS/OT networks. [*CISA*](https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-01)

## Critical Infrastructure

#### Warlock ransomware targets water and telecom operators

[Symantec reports](https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure) that Longlegs (aka Storm-2603), the China-nexus group behind Warlock ransomware, attacked at least four organizations in the past two months, including a water utility and a telecommunications provider, along with a regional government body and a university. Victims were in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. The group first came to prominence by exploiting the Microsoft SharePoint ToolShell chain, and Symantec says those flaws likely remain in its arsenal.

In one intrusion against a critical infrastructure operator, the attackers pushed a tool to disable security software to at least 40 hosts within two hours, then deployed Warlock on at least 33 hosts by staging it in the domain's SYSVOL share, where domain replication delivered it across the network. Longlegs abuses K7RKScan, a vulnerable signed driver (CVE-2025-1055), to terminate security processes at the kernel level, a bring-your-own-vulnerable-driver (BYOVD) technique. The group also abuses Visual Studio Code's tunneling feature for covert remote access and downloads payloads from legitimate cloud storage services to blend into normal traffic.

- **Exposure:** Organizations running on-premises Microsoft SharePoint Server deployments, particularly in Portuguese- and Spanish-speaking countries; critical infrastructure operators in water and telecommunications sectors were among recent victims.
- **Response:** Patch SharePoint Server against ToolShell vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) and review CISA's July 2026 SharePoint advisory.
- **Detections:** [Symantec published](https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure) file hashes and network IOCs.
- **Also reported by:** [PolySwarm](https://blog.polyswarm.io/china-linked-warlock-ransomware-campaign-targets-critical-infrastructure)

#### Chinese government-linked actors target critical infrastructure with automated tools

[CISA and international partners](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a) report that Chinese government-linked actors enabled by Integrity Technology Group are combining automated scanning tools, large-scale botnets, and hands-on exploitation to steal sensitive data from organizations worldwide. The actors targeted US critical infrastructure sectors including Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology, as well as law enforcement, education, and religious organizations.

The activity overlaps with what is publicly tracked as Flax Typhoon. The actors use open-source scanning tools (BBScan, dirsearch, Fscan, masscan, NMAP) to find vulnerabilities, then exploit them using command-line utilities written in Python and Go. They establish persistence by installing SoftEther VPN clients disguised as common Windows executables, use EBurst for password spraying against Microsoft Exchange servers, and exfiltrate emails using scripts that interface with the Microsoft EWS API. The actors also use DC.exe to execute DCSync attacks against Active Directory and office-cli to continuously access Outlook 365 accounts.

- **Exposure:** Organizations in Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology sectors, particularly those running Microsoft Exchange and Office 365.
- **Response:** Disable unused services and ports, sanitize web application inputs to prevent cross-site scripting attacks, implement multifactor authentication for all services (especially webmail and VPNs), and monitor for unauthorized use of living-off-the-land tools and unexpected Active Directory replication.
- **Detections:** [CISA published](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a) IOCs in STIX XML and JSON formats.
- **Also reported by:** [Cyber Press](https://cyberpress.org/fbi-warns-chinese-state-linked-hackers/)

### On the Radar

- **Hackers target US critical infrastructure to disrupt military operations:** Attackers are exploiting exposed industrial controllers to disrupt US water systems and other critical infrastructure, aiming to affect military operations without directly breaching military bases. [*Cyber Press*](https://cyberpress.org/hackers-target-critical-infrastructure/) *·* [*Cryptika*](https://www.cryptika.com/hackers-exploit-exposed-industrial-controllers-to-disrupt-us-water-and-critical-infrastructure/)
- **Iranian hackers use fake Dubai airports coding test to target Iraqi critical infrastructure:** Iranian threat actors are using a fraudulent coding test themed around Dubai airports as a lure to compromise Iraqi critical infrastructure operators. [*Cryptika*](https://www.cryptika.com/iranian-hackers-use-fake-dubai-airports-coding-test-to-target-iraqi-critical-infrastructure/)
- **CyberXero uses AI agents to target Ukrainian critical infrastructure:** The initial access broker CyberXero is deploying AI-augmented tools, including 51 AI agents and frameworks like Claude Code and PentAGI, to target Ukrainian critical infrastructure and conduct mass WordPress exploitation. [*SOCRadar*](https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/) *·* [*Cyber Press*](https://cyberpress.org/cyberxero-weaponizes-ai-agents/) *·* [*Cryptika*](https://www.cryptika.com/cyberxero-combines-claude-code-pentagi-and-cobalt-strike-in-ai-augmented-cyberattacks/)
- **Frontline Education data breach exposes K-12 school district employee data:** A third-party software vulnerability at Frontline Education has exposed employee data from K-12 school districts. [*Rescana*](https://www.rescana.com/post/frontline-education-data-breach-2026-third-party-software-vulnerability-exposes-k-12-school-district-employee-data)

## Vulnerabilities & Exploits

#### Fortinet FortiMail zero-day exploited in the wild

[Fortinet reports](https://fortiguard.fortinet.com/psirt/FG-IR-26-175) that attackers are exploiting a path traversal and null-byte vulnerability (CVE-2026-104286) in FortiMail to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. The flaw requires no authentication and affects the IBE (Identity-Based Encryption) feature. Fortinet's own product security team found the flaw, and the advisory says it has been exploited in the wild.

The advisory includes system event logs showing attackers creating archive accounts pointing to attacker-controlled IPs, along with IBE decryption errors and failed login attempts. FortiMail Cloud customers were patched on October 5, 2026, and need not take action.

- **Exposure:** FortiMail 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1, when the IBE feature is enabled.
- **Response:** If you cannot immediately upgrade to FortiMail 8.0.2, 7.6.7, or 7.4.9, disable the IBE feature via GUI or CLI, restrict webmail interface access to trusted networks only, or configure a web application firewall to block POST requests to `/ibe` containing `../`.
- **Detections:** [Fortinet published](https://fortiguard.fortinet.com/psirt/FG-IR-26-175) two attacker IP addresses, system event log patterns, and encryption log indicators.
- **Also reported by:** [Rescana](https://www.rescana.com/post/fortinet-fortimail-cve-2026-104286-actively-exploited-critical-path-traversal-and-null-byte-vulnerability-alert), [Rescana](https://www.rescana.com/post/active-exploitation-alert-critical-fortinet-fortimail-zero-day-cve-2026-104286-enables-unauthenticated-arbitrary-file-wr), [CyberVeille](https://cyberveille.ch/posts/2026-10-05-cve-2026-104286-exploitation-active-d-une-faille-critique-dans-fortinet-fortimail/), [Brandefense](https://brandefense.io/blog/cve-2026-104286-fortimail-zero-day/)

#### Citrix NetScaler zero-days exploited to deploy web shells

[CIS reports](https://www.cisecurity.org/advisory/a-vulnerability-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-could-allow-for-remote-code-execution%5F2026-110) that Citrix NetScaler appliances are being actively exploited as part of an ongoing pattern targeting these devices. Four CVEs have been added to CISA's KEV catalog over the last few weeks, several exploited as zero-days before patches were released. Initial exploitation is resulting in web shell deployment, persistence activity, and lateral movement within impacted networks, and exploit chaining is occurring across some of these vulnerabilities.

The actively exploited flaws are CVE-2026-19490, CVE-2026-88771, CVE-2026-88779, and CVE-2026-88772\. Following CVE disclosures, additional exploitation has been reported in under 36 hours. Citrix also disclosed CVE-2026-107406, a memory overflow vulnerability that could lead to remote code execution or denial of service, for which there are currently no reports of exploitation in the wild.

- **Exposure:** NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Provider (IdP) or Service Provider (SP), affecting versions listed in [Center for Internet Security](https://www.cisecurity.org/advisory/a-vulnerability-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-could-allow-for-remote-code-execution%5F2026-110).
- **Response:** Apply Citrix updates immediately after testing, and review NetScaler appliances for signs of compromise including web shells and persistence mechanisms.
- **Also reported by:** [The Raven File](https://theravenfile.com/2026/10/06/citrix-0-day-exploits-cve-2026-88771-cve-2026-88772-in-the-wild/), [SOCRadar](https://socradar.io/blog/netscaler-c2-cve-2026-88771-exploitation/), [Cryptika](https://www.cryptika.com/hackers-exploit-critical-citrix-netscaler-flaw-to-deploy-web-shells-and-steal-configuration-data/)

#### AhsayCBS backup server flaws exploited for web shells and cryptominers

[Huntress reports](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) that threat actors are chaining two vulnerabilities in AhsayCBS (Cloud Backup Server), the management console for Ahsay's backup software used primarily by managed service providers, to deploy web shells and XMRig cryptominers. CVE-2026-105133 (medium severity) bypasses authentication in the `checkSysPwd` function, while CVE-2026-105134 (critical) enables unauthenticated remote code execution as SYSTEM through `/rps/api/json/UpdateReceivers.do`. Huntress observed exploitation starting October 7, 2026.

After gaining access, attackers drop JSP web shells into the application directory and deploy an XMRig miner disguised as a Microsoft Edge process (`edge.exe`), run by a modified copy of the NSSM service tool named `msedge.exe`. A PowerShell script (`Taskgmr.ps1`) stops the mining service when Task Manager opens and restarts it when closed. In one case, attackers used `certutil.exe` to download the vulnerable WinRing0x64.sys driver, giving the miner kernel-level hardware access. Payloads are hosted on Alibaba Cloud Object Storage.

- **Exposure:** AhsayCBS versions through 10.3.4, particularly installations with internet-exposed management interfaces.
- **Response:** Restrict management interface access to trusted IP addresses or require VPN; if any listed IOCs are found, re-image the host from a trusted backup.
- **Detections:** [Huntress published](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) four Sigma rules, IOCs, and file hashes.

#### Atlassian directory traversal flaw under active scanning

Atlassian [published patches](https://isc.sans.edu/diary/rss/33406) for CVE-2026-21589, an arbitrary file access vulnerability affecting multiple products, on October 5th. The flaw allows unauthenticated attackers to read files within the web application directory, including configuration files. Watchtowr published a detailed analysis and proof-of-concept URLs demonstrating exploitation.

The vulnerability exploits Atlassian's escaping mechanism, which replaces slashes with `::` but may reverse this in certain cases, enabling directory traversal. SANS ISC observed scanning activity beginning October 6th using paths from the Watchtowr writeup, targeting files such as `WEB-INF/web.xml` in Jira, Confluence, and Bitbucket. All observed source IPs belonged to Digital Ocean, and the SANS handler believes a single threat actor is behind the scans.

- **Exposure:** Organizations running vulnerable versions of Atlassian Jira, Confluence, Bitbucket, and other affected products (see the Atlassian advisory for the complete list).
- **Response:** Apply the October 5th patches immediately, and review web application logs for requests containing the `::` pattern or targeting `WEB-INF` paths.
- **Detections:** [SANS ISC published](https://isc.sans.edu/diary/rss/33406) 13 scanning source IPs and example exploit paths.

### More This Week

- **Google Chrome patches over 200 vulnerabilities** (more than 240 CVEs): Google released Chrome 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 for Linux, addressing more than 200 vulnerabilities including use-after-free, type confusion, and race condition flaws that could allow arbitrary code execution. [*Center for Internet Security*](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution%5F2026-109)
- **FortiBleed campaign exploits Fortinet firewalls and VPNs:** Cyber Press and SOCRadar report that the FortiBleed campaign continues to exploit Fortinet firewalls and VPNs, with the FBI warning that attackers are locking organizations out of their systems. [*Cyber Press*](https://cyberpress.org/fortibleed-fortinet-firewall-vpn-attacks/) *·* [*SOCRadar*](https://socradar.io/blog/fortibleed-still-active-locking-organizations-out/)
- **BlueMoon exploits Chrome vulnerabilities** (CVE-2026-85046, CVE-2026-87491): Picus Security reports that the BlueMoon threat exploits CVE-2026-85046 and CVE-2026-87491 in Chrome. [*Picus Security*](https://www.picussecurity.com/resource/blog/how-bluemoon-exploits-chrome-cve-2026-85046-and-cve-2026-87491)

## Credential Theft & Phishing

#### Phishing campaign abuses Microsoft Power BI to deploy RMM tools

Attackers sent phishing emails with links to a legitimate Microsoft Power BI domain that prompted targets to download a fake reference document, which deployed malicious ScreenConnect remote monitoring and management (RMM) instances, according to [Huntress](https://www.huntress.com/blog/screenconnect-power-bi). The campaign began September 10, and a retroactive hunt found the same ScreenConnect client on 22 other endpoints.

Because the links point to a real Microsoft domain (`app.powerbi.com`), they slip through Microsoft 365 mail filters. Clicking "Download Reference" opened a new tab that fingerprinted the victim's browser and environment, then downloaded a ScreenConnect installer from `hamham27.screenconnect.com`. The first rogue ScreenConnect client (`2b302081e9e777d0`) deployed a second (`43773b3da4ccb17b`), and a PowerShell script then uninstalled the first. In one intrusion, attackers created a scheduled task (`SCAutoRepairEvery2Min`) to run a persistence script every two minutes.

- **Exposure:** Organizations using Microsoft 365 email and allowing ScreenConnect installations.
- **Response:** Restrict remote management software to approved instances, review phishing protections for links on trusted cloud services, and investigate endpoints with multiple RMM clients installed.
- **Detections:** [Huntress published](https://www.huntress.com/blog/screenconnect-power-bi) file hashes, domains, and URLs.

#### ClickFix attacks use fake CAPTCHAs to execute malware

[Huntress describes](https://www.huntress.com/blog/fix-for-clickfix) a phishing technique that bypasses endpoint security by tricking users into pasting malicious commands directly into the Windows Run dialog. Victims land on fake CAPTCHA pages instructing them to press Windows+R and paste a command to "prove they're human." The pasted commands use obfuscation (carets that cmd.exe discards at parse time) and legitimate Windows binaries like `finger.exe` to download and execute payloads, leaving no file for traditional security tools to scan.

Huntress documented one real attack where a user pasted an obfuscated command six times over 46 minutes; each attempt spawned a four-process chain (`cmd.exe` to `finger.exe`) that Huntress's Attack Disruption engine killed within about 1.25 seconds, matching the command structure and parent process (`explorer.exe`) on the endpoint itself, before payloads could execute. Variants include FileFix, TerminalFix, and DownloadFix.

- **Exposure:** Windows environments where users can access the Run dialog or command prompt.
- **Response:** Deploy endpoint controls that match command-line behavior in real time on the endpoint, not backend telemetry; treat stopping users from running pasted commands as a separate hardening task.
- **Detections:** [Huntress published](https://www.huntress.com/blog/fix-for-clickfix) the defanged command and domains, and links a companion post with host artifacts and detection chokepoints for each variant.
- **Also reported by:** [Cryptika](https://www.cryptika.com/clickfix-fake-captcha-attack-executes-malware-hidden-inside-browser-cache/)

#### Attackers trick users into MFA downgrades through social engineering

[Okta Threat Intelligence](https://www.okta.com/blog/threat-intelligence/when%5Fenrollment%5Fisnt%5Fenough/) reports that attackers are regularly using social engineering to convince users to switch from phishing-resistant authentication methods (such as hardware keys, passkeys, or Okta FastPass) to weaker factors like one-time passcodes that can be stolen. Starting in August 2026, Okta Threat Intelligence observed a phishing kit that displays a fake message claiming "If you currently utilize a Yubikey on your Okta, it may need to be re-registered" to trick users into entering a passcode instead.

Once attackers steal credentials and a passcode, they take over the account, enroll their own devices, and deactivate existing MFA enrollments. Okta has observed similar downgrade pretexts in earlier campaigns, including Slack messages instructing users to avoid Okta FastPass and SMS phishing asking users to remove physical security keys.

- **Exposure:** Organizations using Okta or other identity providers that allow users to choose between phishing-resistant and weaker authentication methods.
- **Response:** Enforce phishing-resistant authenticators (hardware keys, passkeys, or Okta FastPass) in authentication policies and disable the ability to switch to weaker factors; apply account management policies that restrict adding or modifying authenticators based on network context and device management status.
- **Detections:** [Okta published](https://www.okta.com/blog/threat-intelligence/when%5Fenrollment%5Fisnt%5Fenough/) indicators of compromise for the August 2026 phishing kit in an advisory for Okta customers.

### Quick Hits

- **UAT-11985 uses AI-assisted event lures to deliver real-time Google AitM phishing:** Talos reports that the threat actor UAT-11985 is using AI-generated event-themed lures to conduct adversary-in-the-middle phishing attacks targeting Google credentials. [*Talos*](https://blog.talosintelligence.com/uat-11985/)
- **Hackers use fake ChatGPT, Claude and Gemini ads to steal passwords and MFA codes:** Cryptika reports that attackers are using fraudulent advertisements for AI chatbot services to deliver phishing pages that capture credentials and multi-factor authentication codes. [*Cryptika*](https://www.cryptika.com/hackers-use-fake-chatgpt-claude-and-gemini-ads-to-steal-passwords-and-mfa-codes/)
- **Phishing campaign targets hotels with fake guest complaints:** Cofense reports a campaign using fake guest complaint emails to deliver malware to hotel staff, abusing blockchain infrastructure for command and control. [*Cofense*](https://cofense.com/blog/from-guest-complaints-to-malware-blockchain-abuse-targets-hotels)
- **Malicious bookmark phishing attack targets Fomo users:** SlowMist reports a phishing technique using malicious browser bookmarks to steal credentials from users of the Fomo platform. [*SlowMist*](https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36)

## Ransomware

### Ransomware Tracker

*Ransomware and data-extortion groups: group · sectors when named · what's new this week*

- **Akira** · Huntress mapped a September attack showing RDP access, credential dumping with ProcDump, GOST tunneling for persistence and C2, RClone exfiltration, and file encryption with shadow copy deletion. [*Huntress*](https://www.huntress.com/blog/mapping-akira-ransomware-attack)

### Also Notable

- **IronChain ransomware threatens businesses with permanent data loss:** A new ransomware strain is targeting organizations with threats of permanent data loss and operational downtime. [*ANY.RUN's Cybersecurity Blog*](https://any.run/cybersecurity-blog/ironchain-analysis/)
- **Emperador ransomware emerges as new Rust-based RaaS:** A new ransomware-as-a-service operation built in Rust has been identified targeting organizations. [*CyberXTron*](https://cyberxtron.com/resources/blogs/emperador-ransomware-rising-as-a-new-rust-based-raas-8209)

## Threat Activity & Tradecraft

#### Action1 RMM tool abused by threat actors

[SANS Internet Storm Center](https://isc.sans.edu/diary/rss/33400) reports that attackers are delivering the Action1 remote management and monitoring (RMM) tool through phishing emails that contain PDF attachments disguised as invoices or shipping documents. When opened, the PDFs redirect victims to a malicious VBS script hosted on Vercel infrastructure, which downloads and installs a legitimate Action1 MSI package while displaying a decoy PDF.

The MSI installs four signed Action1 components (certificate expired in May 2026) and establishes persistence through the A1Agent service running `action1_agent.exe`. The tool connects to Action1's cloud infrastructure at server.na-2.action1.com using what appears to be a free or test account (customer ID 49b18106-681d-456a-b098-092e2818c09a), giving attackers remote access through the vendor's legitimate platform.

- **Exposure:** Organizations that have not blocked unauthorized RMM tools at the network perimeter or through application control policies.
- **Response:** Block the Action1 customer ID and associated infrastructure if Action1 is not an authorized tool in your environment, and review endpoint logs for `action1_agent.exe` or the A1Agent service.

### Worth Watching

- **UAT-11587 deploys Antino backdoor leveraging Microsoft 365 Outlook and OneDrive:** China-nexus group uses Microsoft 365 services for stealthy espionage operations targeting Asia and the Middle East. [*Rescana*](https://www.rescana.com/post/active-exploitation-alert-china-nexus-uat-11587-deploys-antino-backdoor-leveraging-microsoft-365-outlook-and-onedrive-fo)
- **GhostAction supply chain campaign targets GitHub repositories:** Ongoing campaign uses malicious GitHub Actions workflows to steal CI/CD credentials, cloud secrets, and AI credentials from hundreds of compromised repositories. [*Security Boulevard*](https://securityboulevard.com/2026/10/the-campaign-that-never-stopped-tracking-ghostaction-from-2025-to-2026/) *·* [*Cryptika*](https://www.cryptika.com/ghostaction-supply-chain-campaign-uses-malicious-github-actions-to-steal-ci-cd-credentials/) *·* [*Cryptika*](https://www.cryptika.com/new-ghostaction-attack-compromises-hundreds-of-github-repos-to-steal-secrets/) *·* [*Step Security*](https://www.stepsecurity.io/blog/ghostaction-returns) *·* [*Cyber Press*](https://cyberpress.org/ghostaction-attack-compromises-500-github-accounts/) *·* [*OpenSourceMalware*](https://opensourcemalware.com/blog/ghostaction-attack-escalates)
- **Earth Sirrush: Russia-aligned intrusion set with four years of evolving espionage tooling:** Russia-aligned group has developed and refined espionage tools over four years of operations. [*TrendAI*](https://www.trendaisecurity.com/en/resources-insights/trendai-security-blog/earth-sirrush-russia-aligned-intrusion-set-4-years-evolving-espionage-tooling)
- **Cling botnet encodes C2 commands in STUN traffic to evade detection:** IoT botnet disguises command-and-control communications as legitimate STUN traffic to Google infrastructure, evading network monitoring. [*CyberVeille*](https://cyberveille.ch/posts/2026-10-05-cling-un-botnet-iot-qui-camoufle-ses-communications-c2-en-trafic-stun-google/) *·* [*Fortinet*](https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure) *·* [*Cyber Press*](https://cyberpress.org/cling-botnet-weaponizes-stun/)
- **Lumma stealer traffic analysis:** Analysis details network behavior and communication patterns of Lumma information-stealing malware. [*Mandar Naik*](https://mandarnaik016.in/blog/2026-10-04-traffic-analysis-lumma-in-the-room-ah/)
- **FlexRAT uses ChilloutVR lures and shared secrets:** Remote access trojan leverages virtual reality platform lures and shared-secret authentication in its operations. [*Hexastrike Cybersecurity*](https://hexastrike.com/resources/blog/threat-intelligence/flexrat-chilloutvr-lures-shared-secrets-and-an-opsec-hangover/)
- **GlassWorm supply chain attack uses fake VS Code themes to deliver malware:** Attackers distribute malicious code hidden in counterfeit Visual Studio Code theme packages. [*Cryptika*](https://www.cryptika.com/glassworm-supply-chain-attack-uses-fake-vs-code-themes-to-deliver-hidden-malware/)
- **Malicious RubyGems packages open reverse shell at install time:** Forty-two malicious packages in the RubyGems repository execute reverse shell payloads immediately upon installation. [*SafeDep*](https://safedep.io/rubygems-crypto-gems-install-time-reverse-shell) *·* [*OpenSourceMalware*](https://opensourcemalware.com/blog/malicious-crypto-shell)

## Further Reading

- **Detection rules digest for September 28 to October 5:** New endpoint detections address WSL persistence, ShieldCrash exploitation, and BYOVD attacks; identity rules widen Kerberoasting coverage and detect hybrid-domain discrepancies; Linux runtime monitoring adds ptrace injection and reverse-shell logic. [*Detections Digest*](https://detections-digest.rulecheck.io/p/detections-digest-20261005)
- **MALFEX npm malware hides executables in PNG files to infect Windows developers:** Malicious npm package conceals Windows executables inside PNG image files to evade detection and compromise developer workstations. [*CloudSEK*](https://www.cloudsek.com/blog/malfex-malicious-npm-postinstall-supply-chain-campaign) *·* [*Cryptika*](https://www.cryptika.com/malfex-npm-malware-hides-executables-in-png-files-to-infect-windows-developers/)
- **Hackers compromise 100+ websites with fake Cloudflare checks to spread LUNEXSTEALER:** Attackers injected fake Cloudflare verification prompts into over 100 compromised websites to deliver LUNEXSTEALER information-stealing malware. [*Cryptika*](https://www.cryptika.com/hackers-compromise-100-websites-with-fake-cloudflare-checks-to-spread-lunexstealer/)
- **MATCHBOIL malware adds new tricks:** ESET reports updated capabilities in MATCHBOIL malware while maintaining its core malicious objectives. [*ESET Research*](https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/)
- **Warden stealer targets AI agent data:** Gen reports on the rapid growth of Warden infostealer, which specifically harvests credentials and data from AI agent platforms. [*Gen*](https://www.gendigital.com/blog/insights/research/warden-stealer-rust-infostealer-analysis)
- **Hackers abuse Terraform provider to steal developer credentials and deploy backdoors:** Cyber Press reports attackers exploited a malicious Terraform provider to harvest developer credentials and establish persistent backdoor access. [*Cyber Press*](https://cyberpress.org/hackers-weaponize-terraform-providers/)
- **Malicious PDF reader with 10,000+ installs on Google Play delivers Anatsa banking trojan:** A fraudulent PDF reader application accumulated over 10,000 installations on Google Play before being identified as a delivery mechanism for Anatsa banking malware. [*Cryptika*](https://www.cryptika.com/malicious-pdf-reader-with-10000-installs-on-google-play-delivers-anatsa-banking-trojan/)
- **VulcanRAT207.A intrusion chain escalates from WhatsApp to SYSTEM:** Morphisec details an attack sequence beginning with WhatsApp social engineering and culminating in SYSTEM-level access via VulcanRAT207.A. [*Morphisec*](https://www.morphisec.com/blog/vulcanrat207-a%5Fintrusion-chain%5Fexplained/)

*Every item links to its original source. Spot an error? Reply or leave a comment.*