Cyware Daily Threat Intelligence - November 10, 2026

Summary

Attackers are turning trusted infrastructure into covert collection points, as seen in Turla’s Cereal backdoor campaign that siphons sensitive government emails from Microsoft Exchange servers in Kazakhstan and Romania. Cyware highlights how this modular toolkit blends into normal traffic, using encrypted requests and stealthy injection techniques to evade detection and compromise internal communications.

A supply-chain compromise of @ethersphere/bee-js and Swarm Desktop has exposed developer environments to the SleepyDuck backdoor, allowing attackers to exfiltrate secrets and deploy persistent payloads via malicious JavaScript fetched from api[.]frameworkmetrics[.]xyz. This breach underscores the risk that a single dependency update can open production systems to covert control.

Critical vulnerabilities are under active attack, with the OpenSSH 'SSHole' flaw (CVE-2026-123158, CVSS 8.1) enabling authentication bypass on musl-based Linux systems and the Xen Orchestra bug granting admin-level access to virtualization pools. SAP’s release of patches for four CVSS 10.0 vulnerabilities further signals the urgent need for organizations to update exposed business-critical systems.

Threat actors are escalating real-world impact, as France attributes supermarket refrigeration sabotage affecting 700 stores and causing at least 15 fires to Iran’s IRGC. Meanwhile, Lazarus is leveraging recruitment-themed social engineering to infiltrate drone technology firms, aiming to steal proprietary designs and source code, and expanding its reach through software supply-chain attacks.

Top Malware Reported in the Last 24 Hours

Turla’s Cereal backdoor raids Exchange inboxes

Cereal is a Turla-attributed malware set that turns Microsoft Exchange servers into quiet collection points for sensitive emails, blending its traffic into what looks like ordinary server activity. It does this with CerealNeuron, a backdoor that listens for web requests on paths including /owa/sdds/ and /autodiscover/proxyservice/, using encrypted requests to keep operators’ commands and data collection hard to spot. A second component, CerealBox, injects itself into EdgeTransport.exe and avoids attention by not registering as a new transport agent, then captures emails with specific attachments for later pickup. ESET reported that the loader disguises itself as ncobjapi.dll inside C:\Windows\System32\wbem and also appears in the .NET native image cache. The activity was found on Exchange servers at government organizations in Kazakhstan and Romania, meaning affected agencies could have internal communications siphoned out without obvious disruption.

SleepyDuck backdoor taints bee-js releases

SleepyDuck is an Ethereum C2 backdoor delivered through a software supply-chain compromise of @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2, using compromised GitHub accounts and automation to publish malicious releases. The attackers rewrote project logic into a remote-code loader by altering package.json and scripts/generate-version.cjs, causing infected systems to fetch JavaScript and run it with full Node.js privileges. That downloaded code is retrieved from api[.]frameworkmetrics[.]xyz, allowing follow-on stages to pull data and deploy additional payloads. Socket reported that later stages include exfiltrating node secrets (including config.yaml and swarm.key) and deploying a Go backdoor for persistence, with smart contracts used for command-and-control. For developers and organizations consuming these packages, the impact is trust erosion: a routine dependency update can become a covert entry point into production environments.

AhsayCBS bugs open door to webshells

CVE-2026-105133 and CVE-2026-105134 are vulnerabilities in AhsayCBS that attackers exploited to plant five JSP webshell families, then expand access with additional tooling. Huntress said the webshells enabled capabilities such as command execution, file uploads, and self-deletion, and intruders also installed a cryptominer plus a separate C2 implant. To keep control and move through environments, they used tunneling tools including gost and chisel, alongside remote access software like AnyDesk, Atera, and Splashtop. The intrusion window described ran from October 8 to October 11, 2026, and included indicators of an attempt to operate across different operating systems. For businesses running the affected backup platform, the practical consequence is that a server meant to protect data can be turned into infrastructure that executes attacker commands and consumes resources for mining.

Top Vulnerabilities Reported in Last 24 hours

Attackers bypass logins on OpenSSH

Attackers are actively exploiting an OpenSSH authentication-bypass issue dubbed SSHole to break into certain musl-based Linux systems, including Alpine, and then run commands, steal credentials, and establish persistence (CVE-2026-123158, CVSS 8.1). The attack hinges on logging into accounts whose password hash is set to an asterisk (*), which the vulnerable behavior can mistakenly treat as a valid match, effectively turning a locked account into a doorway. Attackers are already exploiting this in the wild, with exploitation attempts reported from November 5 and the first successful exploitation recorded on November 7. GreyNoise said it observed post-compromise activity such as container and system reconnaissance, cloud metadata queries, and attempts to read password hashes and root SSH keys, and it tied the activity to a “TAC Agent” tool whose code comments suggest a potential Chinese origin. A fix is available in OpenSSH 10.6p2.

Xen Orchestra bug hands over admin

A critical authentication bypass in Xen Orchestra is being actively exploited to gain Admin-level control and potentially reach arbitrary code execution across managed pools—risking full XCP-ng node takeover as root. The issue stems from how Xen Orchestra parses a REST cookie, where a crafted token string is interpreted as an empty object, letting the token provider authenticate as the token owner if the token is unexpired. Attackers are already exploiting this in the wild, according to the vendor advisory. Vates attributed observed activity to an actor using the IP address and .onion domain cited in its report, and described detection focused on characteristic HTTP request patterns and artifacts on XCP-ng hosts. Fixes are available in Xen Orchestra 6.10.0 or 6.9.1 and xo-server 5.213.1.

SAP fixes four maximum-severity flaws

SAP issued patches for four vulnerabilities scored 10.0 that can enable remote code execution or unauthorized access across widely deployed components including Internet Communication Manager (ICM), SAP Web Dispatcher, SAP Gateway, and the SAML2 service provider. The practical risk is straightforward: an attacker who can reach exposed services could potentially impersonate users or execute code, leading to broad compromise of business-critical SAP systems. No active exploitation was explicitly confirmed in the provided source text. The issues are tracked as CVE-2026-76964 (ICM), CVE-2026-89126 (Web Dispatcher), CVE-2026-89103 (SAP Gateway), and CVE-2026-120017 (SAML2), with SAP releasing fixes via Notes 3778530, 3778556, 3798345, and 3849308. Patches are available from SAP.

Top Threat Actors Reported in Last 24 hours

Turla plants Cereal on Exchange servers

Turla (also tracked as a Russia-aligned group) has been caught using a modular “Cereal” malware toolkit to quietly siphon sensitive email from Microsoft Exchange servers by blending into normal-looking web traffic. The group’s main backdoor, CerealNeuron, listens for requests on Exchange-like paths such as /owa/sdds/ and /autodiscover/proxyservice/, and uses encrypted requests to keep commands and data movement hard to spot. On compromised servers, they also deploy CerealBox, which injects into EdgeTransport.exe to capture emails with specific attachments without registering as a new transport agent. ESET said it found the malware on Exchange servers at government organizations in Kazakhstan and Romania, putting internal communications and sensitive files at risk. The activity was observed from November to December 2025, with increased activity noted in January 2026, and the loader was seen disguised as ncobjapi.dll in a Windows system directory and the .NET native image cache.

Lazarus hunts drone firms via recruiting

Lazarus (also tracked as a North Korean-aligned group) is using recruitment-themed social engineering to pry into the drone sector, turning the hiring process into an espionage channel aimed at stealing industrial know-how. After establishing trust through job-related interactions, they deploy tools including ScoringMathTea and BinMergeLoader to gain a foothold and reach sensitive engineering environments and source code. For drone technology organizations and their partners, the consequence is that proprietary designs and development plans can be exposed in ways that may accelerate adversary military capabilities. In parallel, DeceptiveDevelopment (also tracked as a North Korean-aligned cluster) is targeting software supply chains by harvesting developer credentials and injecting malicious code into repositories, shifting the blast radius from one victim to downstream users. ESET linked these themes to historical North Korean tradecraft, including embedding malicious routines in open-source applications during Operation DreamJob.

IRGC blamed for supermarket refrigeration sabotage

France has accused Iran’s Islamic Revolutionary Guard Corps (IRGC)—specifically the Shahid Kaveh unit—of cyberattacks that tampered with refrigeration systems and caused real-world disruption in the food supply chain. According to reports, they targeted internet-exposed, unpatched Danfoss refrigeration controllers, changing temperature settings and defrost cycles in ways that triggered widespread spoilage and business interruption. For retailers and public services caught up in the incidents, the impact was tangible: around 700 grocery stores in France were affected, with extensive food losses and at least 15 fires, and disruptions also hit the French Blood Establishment. A second wave in November reportedly spread across 11 European countries, including British meat suppliers, while separate activity also hit Schneider Electric equipment at hydroelectric facilities, causing moderate disruption. Investigators pointed to Farsi text artefacts and reconnaissance tooling as part of the operational fingerprints, and reporting cited potential financial impacts reaching tens of millions of euros.

Frequently Asked Questions

1. What is Cereal? <b>Cereal</b> is a Turla-attributed malware set that turns Microsoft Exchange servers into quiet collection points for sensitive emails, blending its traffic into what looks like ordinary server activity. It does this with <i>CerealNeuron</i>, a backdoor that listens for web requests on paths including <b>/owa/sdds/</b> and <b>/autodiscover/proxyservice/</b>, using encrypted requests to keep operators’ commands and data collection hard to spot.

2. What is SleepyDuck? <b>SleepyDuck</b> is an Ethereum C2 backdoor delivered through a software supply-chain compromise of <b>@ethersphere/bee-js</b> 13.3.0 and <b>Swarm Desktop</b> 0.56.2, using compromised GitHub accounts and automation to publish malicious releases. The attackers rewrote project logic into a remote-code loader by altering <b>package.json</b> and <b>scripts/generate-version.cjs</b>, causing infected systems to fetch JavaScript and run it with full Node.js privileges.

3. What is CVE-2026-105133? <b>CVE-2026-105133</b> and <b>CVE-2026-105134</b> are vulnerabilities in AhsayCBS that attackers exploited to plant <b>five JSP webshell families</b>, then expand access with additional tooling. Huntress said the webshells enabled capabilities such as command execution, file uploads, and self-deletion, and intruders also installed a cryptominer plus a separate C2 implant.

4. What is CVE-2026-123158? Attackers are actively exploiting an OpenSSH authentication-bypass issue dubbed <b>SSHole</b> to break into certain musl-based Linux systems, including Alpine, and then run commands, steal credentials, and establish persistence (<b>CVE-2026-123158</b>, CVSS <b>8.1</b>). The attack hinges on logging into accounts whose password hash is set to an asterisk (<i>*</i>), which the vulnerable behavior can mistakenly treat as a valid match, effectively turning a locked account into a doorway.

5. What is Xen Orchestra? A critical authentication bypass in <b>Xen Orchestra</b> is being actively exploited to gain <i>Admin</i>-level control and potentially reach arbitrary code execution across managed pools—risking full XCP-ng node takeover as <i>root</i>. The issue stems from how Xen Orchestra parses a REST cookie, where a crafted token string is interpreted as an empty object, letting the token provider authenticate as the token owner if the token is unexpired.

6. What is CVE-2026-76964? SAP issued patches for four vulnerabilities scored <b>10.0</b> that can enable remote code execution or unauthorized access across widely deployed components including Internet Communication Manager (ICM), SAP Web Dispatcher, SAP Gateway, and the SAML2 service provider. The practical risk is straightforward: an attacker who can reach exposed services could potentially impersonate users or execute code, leading to broad compromise of business-critical SAP systems.

7. What is Turla? <b>Turla</b> (also tracked as a Russia-aligned group) has been caught using a modular “Cereal” malware toolkit to quietly siphon sensitive email from Microsoft Exchange servers by blending into normal-looking web traffic. The group’s main backdoor, CerealNeuron, listens for requests on Exchange-like paths such as <b>/owa/sdds/</b> and <b>/autodiscover/proxyservice/</b>, and uses <b>encrypted requests</b> to keep commands and data movement hard to spot.

8. What is Lazarus? <b>Lazarus</b> (also tracked as a North Korean-aligned group) is using recruitment-themed social engineering to pry into the drone sector, turning the hiring process into an espionage channel aimed at stealing industrial know-how. After establishing trust through job-related interactions, they deploy tools including <b>ScoringMathTea</b> and <b>BinMergeLoader</b> to gain a foothold and reach sensitive engineering environments and source code.

9. What is Islamic Revolutionary Guard Corps (IRGC)? France has accused Iran’s <b>Islamic Revolutionary Guard Corps (IRGC)</b>—specifically the <b>Shahid Kaveh</b> unit—of cyberattacks that tampered with refrigeration systems and caused real-world disruption in the food supply chain. According to reports, they targeted internet-exposed, unpatched <b>Danfoss refrigeration controllers</b>, changing temperature settings and defrost cycles in ways that triggered widespread spoilage and business interruption.