Summary
Attackers are turning a single compromised VMware ESXi host into a launchpad for controlling entire virtual environments, using a post-exploitation framework that can enumerate, power-cycle, and harvest credentials from dozens of virtual machines at once. Cyware highlights how GhostFrame, linked to Settra ransomware and TAG-218, leverages persistent implants and disables security controls, putting critical workloads at risk across multiple sectors.
A pair of Barracuda vulnerabilities—CVE-2026-116606 and CVE-2026-111560—are being chained in the wild to grant root access on security appliances, with exploitation attempts traced to 15 IP addresses across three countries. Attackers bypass authentication and inject commands, prompting CISA to add both flaws to its Known Exploited Vulnerabilities catalog and Barracuda to issue urgent patches and mitigation guidance.
Espionage crews worldwide are arming themselves with a shared toolkit supplied by CopperDragon, a digital quartermaster tied to China-nexus operators. Check Point reports that the Sparrow framework and its clusters—SilentDelivery, OceanGate, and DarkWire—have expanded their reach to 21 countries, targeting telecommunications, government, and military networks with watering-hole attacks, trojanized SSH tools, and DNS tunneling for stealthy command and control.
Top Malware Reported in the Last 24 Hours
GhostFrame turns ESXi hosts into hubs
GhostFrame is a post-exploitation framework built to turn a single compromised VMware ESXi host into a control point for many virtual machines, a capability linked to Settra ransomware activity. It does this with an implant called vmhostd-core, which persists by copying itself to /opt/vmhostd-core and modifying the ESXi boot script while disabling security controls. Once in place, it can enumerate VMs, toggle power states, enable VNC access, and harvest credentials using VMkatz and data pulled from memory snapshots or virtual disk images. Recorded Future tied this activity to TAG-218, which has been observed targeting VPN appliances from SonicWall, Palo Alto Networks, and Fortinet for initial access, with MeshCentral infrastructure also appearing in the ecosystem. For organizations running critical workloads on ESXi, the consequence is blunt: attackers can expand access across the environment without having to break into each VM one by one. Its C2 traffic stands out by communicating over multiple TCP ports, including 53, 2222, 3389, 4444, 8443, and 9443.
CopperDragon equips espionage crews worldwide
CopperDragon is described by Check Point as a digital quartermaster that supplies malware and infrastructure to China-nexus operators using the Sparrow framework across three clusters: SilentDelivery, OceanGate, and DarkWire. SilentDelivery has used watering-hole attacks and even fake Chrome certificate warnings to push access tooling, while OceanGate has relied on Trojanized SSH tools and SparrowShell as it exploits Linux servers for initial access. DarkWire, meanwhile, has used CopperDNS and CopperProxy backdoors and leaned on DNS tunneling for command-and-control communications. SparrowShell stands out for kernel-level capabilities with rootkit integration, and related tooling uses WinDivert to intercept network traffic and help attackers stay hidden. The operations span Europe, Asia, and Latin America and focus on telecommunications, government, military, and critical infrastructure—targets where access can translate into long-term intelligence collection. Check Point said the victimology expanded to 21 countries.
Blind Eagle phishes courts with AsyncRAT
Blind Eagle (also known as APT-C-36) is running a phishing campaign across Latin America that impersonates court notices to deliver a remote access trojan. It uses Portuguese and Spanish lures and relies on HTML smuggling so the payload is assembled locally, helping the attack slip past email security. As part of the trick, it shows a fake criminal-citation page as a distraction while a JavaScript dropper performs reconnaissance and sets up persistence. The final payload is an AsyncRAT fork that gives the operator remote control and supports keystroke logging and data exfiltration over an encrypted channel. For judicial, fiscal, administrative, and educational organizations, a single opened attachment can turn routine casework or service requests into quiet surveillance and document theft.
Top Vulnerabilities Reported in Last 24 hours
Barracuda bugs chained for root access
Attackers are exploiting two Barracuda vulnerabilities to bypass authorization and gain root access on affected devices, according to reports covering CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6). The activity hinges on chaining an authentication bypass with command injection, turning exposed security appliances into attacker-controlled footholds that can put an organization’s perimeter defenses and internal traffic at risk. Attackers are already exploiting this in the wild, with exploitation attempts observed between November 9 and November 11 and involving 15 IP addresses from three countries. The U.S. government’s CISA added both flaws to its Known Exploited Vulnerabilities catalog. Barracuda has released patches, and the guidance highlighted alongside the reporting includes restricting administrative interfaces to trusted internal networks and monitoring network traffic for exploitation attempts.
php2shell RCE hits PAN-OS management
The php2shell flaws are being used to remotely run code on network appliances that rely on PHP-based web management interfaces, with active exploitation confirmed against Palo Alto Networks PAN-OS management ports exposed to the internet (CVE-2026-109618 and CVE-2026-109619). For defenders, the immediate consequence is simple: a management interface that should control the device can become the entry point an attacker uses to control it instead, undermining network security controls. Attackers are already exploiting this in the wild, particularly where management access is internet-reachable. Researchers at Eclypsium warned that compromised devices may show signs consistent with web shells and tunneling activity, reflecting an attacker’s attempt to hold persistent access. Fixed hotfixes are referenced for PAN-OS branches in use, alongside limiting management access to trusted internal addresses.
Chrome zero-day exploited via XML handling
Google patched an actively exploited Chrome vulnerability that can be triggered through crafted web content, targeting the browser’s XML handling (CVE-2026-125350, high severity). The bug is a use-after-free in the libxslt component, and while the immediate effect is code execution inside the browser sandbox, it can become full device compromise when chained with other vulnerabilities. Attackers are already exploiting this in the wild, though no specific threat actors have been publicly identified and the scale remains unclear. The fix shipped to Chrome Stable on November 9, 2026, with updates available in 157.0.8103.50 (Stable) and 156.0.8078.96 (Extended Stable). The coverage also calls out watching for updates in other Chromium-based browsers and, if patching is delayed, considering a temporary move to disable XSLT processing after testing for business impact.
Top Threat Actors Reported in Last 24 hours
CopperDragon supplies tools for global espionage
CopperDragon, described by Check Point as a potential digital “quartermaster” tied to China-nexus operators, is being linked to a shared malware framework called Sparrow that shows up across multiple intrusion clusters. Those clusters—SilentDelivery, OceanGate, and DarkWire—have been seen pursuing telecommunications, government, and military targets across Europe, Asia, and Latin America, expanding the known victimology to 21 countries. The activity stands out because each cluster brings a different access style: SilentDelivery uses watering-hole attacks and has also relied on fake Chrome certificate warnings, OceanGate leans on trojanized SSH tooling against Linux systems, and DarkWire uses DNS tunneling for C2 communications. For telecom and government networks, the consequence is more than a single compromised host: access in these environments can translate into intelligence collection at scale, including potential exposure of call detail records and even systems associated with lawful intercept. Check Point also tied the framework’s staying power to stealth features in SparrowShell, which includes kernel-level capabilities with rootkit integration and uses WinDivert to intercept network traffic.
DarkLunnen exploits edge devices across Europe
DarkLunnen, a Russian-speaking threat actor, has been exploiting internet-facing systems to push into European targets, with a particular emphasis on entities in Ukraine. Group-IB said they targeted FortiGate firewalls, VNC services, Hikvision cameras, and Exchange servers, a mix that can place perimeter security and internal administration controls in the same blast radius. For defense and aviation organizations, the stakes are direct: these intrusions could enable unauthorized access to sensitive operational and military-related data, and the report warns that unrecovered files leave intelligence gaps about what the actor did and how far they reached. The actor’s activity included using a modified FortiGate exploit (CVE-2024-55591) to create backdoor accounts and extract VPN credentials, alongside attempts against Hikvision devices (CVE-2017-7921). Group-IB also reported infrastructure touchpoints spanning Latvia and the US, with connections through the Netherlands, Thailand, and France.
TAG-218 brings GhostFrame to ESXi
TAG-218, associated with Settra ransomware, has been observed using GhostFrame, a post-exploitation framework built to take control of multiple virtual machines from a single compromised VMware ESXi host. That approach raises the human cost quickly because a single foothold in virtualization infrastructure can translate into broad disruption across many business-critical systems at once, without compromising each VM individually. Recorded Future said they have targeted VPN appliances including SonicWall, Palo Alto Networks, and Fortinet devices for initial access, and the activity also tied into a MeshCentral remote monitoring and management server. After landing on ESXi, GhostFrame can enumerate VMs, manipulate power states, and enable VNC access, while also harvesting credentials using VMkatz and pulling data from VM memory snapshots and virtual disk images. The reported linkage to ransomware underscores why ESXi hosts are treated as high-value targets: control of the hypervisor can become leverage for both access and extortion.
Frequently Asked Questions
What is GhostFrame? GhostFrame is a post-exploitation framework built to turn a single compromised VMware ESXi host into a control point for many virtual machines, a capability linked to Settra ransomware activity. It does this with an implant called vmhostd-core, which persists by copying itself to /opt/vmhostd-core and modifying the ESXi boot script while disabling security controls.
What is CopperDragon? CopperDragon is described by Check Point as a digital quartermaster that supplies malware and infrastructure to China-nexus operators using the Sparrow framework across three clusters: SilentDelivery, OceanGate, and DarkWire. SilentDelivery has used watering-hole attacks and even fake Chrome certificate warnings to push access tooling, while OceanGate has relied on Trojanized SSH tools and SparrowShell as it exploits Linux servers for initial access.
What is Blind Eagle? Blind Eagle (also known as APT-C-36) is running a phishing campaign across Latin America that impersonates court notices to deliver a remote access trojan. It uses Portuguese and Spanish lures and relies on HTML smuggling so the payload is assembled locally, helping the attack slip past email security.
What is CVE-2026-116606? Attackers are exploiting two Barracuda vulnerabilities to bypass authorization and gain root access on affected devices, according to reports covering CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6). The activity hinges on chaining an authentication bypass with command injection, turning exposed security appliances into attacker-controlled footholds that can put an organization’s perimeter defenses and internal traffic at risk.
What is CVE-2026-109618? The php2shell flaws are being used to remotely run code on network appliances that rely on PHP-based web management interfaces, with active exploitation confirmed against Palo Alto Networks PAN-OS management ports exposed to the internet (CVE-2026-109618 and CVE-2026-109619). For defenders, the immediate consequence is simple: a management interface that should control the device can become the entry point an attacker uses to control it instead, undermining network security controls.
What is CVE-2026-125350? Google patched an actively exploited Chrome vulnerability that can be triggered through crafted web content, targeting the browser’s XML handling (CVE-2026-125350, high severity). The bug is a use-after-free in the libxslt component, and while the immediate effect is code execution inside the browser sandbox, it can become full device compromise when chained with other vulnerabilities.
What is DarkLunnen? DarkLunnen, a Russian-speaking threat actor, has been exploiting internet-facing systems to push into European targets, with a particular emphasis on entities in Ukraine. Group-IB said they targeted FortiGate firewalls, VNC services, Hikvision cameras, and Exchange servers, a mix that can place perimeter security and internal administration controls in the same blast radius.
What is TAG-218? TAG-218, associated with Settra ransomware, has been observed using GhostFrame, a post-exploitation framework built to take control of multiple virtual machines from a single compromised VMware ESXi host. That approach raises the human cost quickly because a single foothold in virtualization infrastructure can translate into broad disruption across many business-critical systems at once, without compromising each VM individually.