Cyware Daily Threat Intelligence - October 10, 2026

Summary

A single breach can now ripple across entire organizations, as Warlock ransomware exploits Microsoft SharePoint Server vulnerabilities to disable security tools and spread through Windows domain replication. Cyware highlights how this campaign, linked to the Longlegs threat actor, has triggered outages and exposed millions of customer records at Japanese firms like JR East and Skyticket, with over 14.6 million sets of personal information potentially at risk.

A botnet masquerading as iPhones is slashing through defenses worldwide. PaperPhone, tracked by CrowdSec, leverages a network of 80,000 IPs across 43 countries, using synchronized spikes and spoofed device identities to evade detection and disrupt services. Over 20% of its traffic routes through a single transit provider, making it a formidable challenge for defenders.

Critical infrastructure faces mounting pressure as Flax Typhoon, a China-linked threat actor, exploits five newly cataloged vulnerabilities—including CVE-2015-3306 (CVSS 10.0) and CVE-2021-3199 (CVSS 9.8)—to gain persistent access. A joint advisory from seven nations warns that attackers are already in the wild, using scanning, cross-site scripting, and password spraying to position themselves for future disruption.

Cloud security takes a hit with the discovery of a flaw in AWS AgentCore, where attackers could harvest sensitive credentials and manipulate agent behavior across sessions. Zenity Labs found that a single SSRF exploit could cascade access across multiple agents, prompting AWS to shift to IMDSv2 and urging organizations to review IAM permissions.

Threat actors are targeting overlooked accounts with brute force. TeamFiltration compromised seven Microsoft 365 accounts in Chile by abusing default passwords, launching attacks from 1,487 AWS EC2 IPs and targeting over 5,700 accounts across 28 tenants. The campaign mirrors previous large-scale attacks and underscores the risk of unmanaged service accounts.

Top Malware Reported in the Last 24 Hours

Warlock ransomware exploits SharePoint to spread

Warlock ransomware, linked to the China-nexus threat actor Longlegs, is being used in a campaign that breaks into networks through Microsoft SharePoint Server vulnerabilities and then spreads widely inside domains. Once in, it disables security tools and stages the payload inside SYSVOL so it can ride normal Windows domain replication to reach more systems, turning a single breach into an organization-wide outage. Researchers describe it using a mix of stealthy tradecraft, including DLL sideloading, living-off-the-land techniques, and Visual Studio Code tunneling, before encrypting systems. Separately, Japanese firms have reported major incidents with potential exposure of customer data, including JR East (6.09 million accounts) and JR Kyushu (1.3 million) tied to an IDC Frontier-linked ransomware incident, plus unauthorized access impacting Bookoff Group Holdings (up to 6.43 million), Daiichikosho (up to 8.72 million), and Adventure Inc.’s Skyticket (up to 14.64 million sets of personal information, with credit card and passport numbers not leaked). Those companies say they have found no evidence of unauthorized use so far, but they are urging customers to stay vigilant for suspicious messages that could follow data exposure. A patch is available for the SharePoint issues referenced in the campaign.

PaperPhone botnet mimics iPhones at scale

PaperPhone is a botnet cluster that CrowdSec says spans roughly 80,000 IPs across 43 countries, using rotating infrastructure and spoofed geography to make blocking harder. It stands out for a telltale inconsistency: every bot presents the same 375x812 viewport size associated with an iPhone model, even while cycling through 13 claimed device identities. The traffic also arrives in synchronized spikes across distant time zones, signaling coordinated control rather than organic user behavior. CrowdSec reports that M247 appears as a transit provider for over 20% of the cluster, underscoring how concentrated pieces of the delivery path can be even when the botnet looks globally distributed. For targeted sites, this kind of traffic can translate into account abuse, scraping, and service disruption that feels like “real users” until the pattern is recognized.

Noir drainer uses DNS for control

Noir is a cryptocurrency wallet-drainer kit that uses DNS TXT records and DNS-over-HTTPS (DoH) as a dynamic “control plane,” letting it redirect its backend infrastructure quickly when defenders disrupt it. Instead of asking for seed phrases, it relies on permissions victims grant when a lure convinces them to connect a wallet, enabling theft through spending approvals that can look less alarming than an outright transfer request. Infoblox notes the kit has been seen using multiple lure themes, including fake token “Community Voting” pages, fake airdrop/claim sites, and brand-specific spoofs designed to pull victims into approving transactions. The source code is unusually self-documenting, with plain-English comments about bugs and design choices that researchers suggest could indicate AI assistance. For victims, the consequence is direct financial loss once assets are drained from the connected wallet.

Top Vulnerabilities Reported in Last 24 hours

Flax Typhoon uses old bugs to infiltrate networks

A China-linked threat actor tracked as Flax Typhoon is exploiting multiple widely deployed software flaws—now newly added to CISA’s Known Exploited Vulnerabilities catalog—to gain unauthorized access that can be used to quietly sit inside critical infrastructure networks. The five newly listed issues span ProFTPD (CVE-2015-3306, CVSS 10.0), ONLYOFFICE Docs (CVE-2021-3199, CVSS 9.8), Strapi (CVE-2023-22894, CVSS 7.2), Apache Struts (CVE-2016-3081, CVSS 8.1), and ISC BIND (CVE-2015-5477, CVSS 7.5), and a joint advisory from Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S. frames the activity as an international concern. Attackers are already exploiting this in the wild. The advisory says Flax Typhoon uses scanning tools, cross-site scripting attacks, and password spraying against Microsoft Exchange servers, then maintains access via VPN software and steals emails and credentials with scripts. U.S. officials warn these footholds can translate into real-world disruption later, with actors “positioning themselves within critical infrastructure networks to disrupt critical functions at a future time,” and federal agencies face an October 11, 2026 patch deadline for the newly added KEV items.

AWS AgentCore bug exposed cloud credentials

A weakness in AWS AgentCore let attackers obtain sensitive cloud credentials and then manipulate agent behavior across future sessions, potentially allowing one compromised workflow to cascade to multiple agents in the same AWS account and region. Zenity Labs said the issue hinged on the use of IMDSv1 and could be triggered via a server-side request forgery (SSRF) path to pull temporary AWS credentials, which were then used to enumerate other agents and even access Amazon ECR to inspect source code. No active exploitation has been reported, but the write-up demonstrates how a single misstep can turn an AI agent into a durable access mechanism rather than a one-time incident. Zenity Labs disclosed the issue to AWS in December 2025, and a final review in September 2026 confirmed remediation; AWS moved AgentCore to IMDSv2 in February 2026, while excessive permissions persisted until June 2026. Recommended actions center on ensuring deployments use IMDSv2 and reviewing IAM roles to remove over-permissioned access.

Telegram Desktop link bug enables account takeover

A one-click flaw in Telegram Desktop (CVE-2026-107181) can let an attacker read arbitrary local files and potentially take over a victim’s account by stealing session-related data after the victim clicks a crafted link. The attack chain described publicly starts with a link that redirects into a tg:// link, launching a second Telegram process that forwards data to the running app—where unescaped separators can be abused to trigger file-reading and upload the victim’s files to an attacker-controlled group. Attackers are not described as exploiting this in the wild in the source material; the report focuses on a published attack chain and write-up. The case was reported via ZDI on 2026-06-25, Telegram fixed it independently on 2026-09-16, released Telegram Desktop 7.2.9 on 2026-09-17, ZDI closed the case on 2026-09-30, the public write-up appeared on 2026-10-03, and the CVE was assigned on 2026-10-07. A fix is available in version 7.2.9, which removed the interpret: scheme and added separator escaping in the IPC mechanism; the write-up also recommends upgrading and tightening local download and account-protection settings such as prompting for download locations and using a local passcode.

Top Threat Actors Reported in Last 24 hours

TeamFiltration hits Chilean Microsoft 365 accounts

TeamFiltration is driving a password-spray style campaign for account takeover, leaning on an uncomfortable reality: some cloud service accounts still run on default credentials. The attacker originated activity from 1,487 unique AWS EC2 source IP addresses and targeted over 5,700 accounts across 28 Microsoft 365 tenants, ultimately compromising seven accounts by abusing default passwords in unmanaged service accounts. The activity came in three waves: July 21–24 against Chilean banking institutions, July 26–28 against another major financial institution, and August 13–16 against a major Chilean retailer, with the adversary later pivoting through a German VPN node to push deeper into corporate networks. For retail and financial teams, the consequence is straightforward: a single overlooked “utility” account can become a doorway into business email and internal systems. The campaign mirrors June 2025’s SneakyStrike activity, which targeted over 80,000 user accounts using similar tactics.

Longlegs pushes Warlock ransomware via SharePoint

Longlegs, a China-nexus threat actor, is being linked to the Warlock ransomware campaign hitting critical infrastructure where downtime can quickly become a public-service problem. They exploit Microsoft SharePoint Server vulnerabilities CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 to gain access, plant webshells, and set up the conditions to run code remotely. After getting in, the group has been observed using DLL sideloading, living-off-the-land techniques, and Visual Studio Code tunneling, then disabling security tooling before detonating ransomware. Targets include water, telecommunications, government, and education across Europe, Africa, and Latin America, with a particular focus on Portuguese- and Spanish-speaking countries—raising the stakes for communities that depend on uninterrupted services. Researchers described the ransomware being staged and distributed via Windows domain replication infrastructure, a choice that can help it spread quickly once domain control is established.

Flax Typhoon drives new CISA KEV adds

Flax Typhoon, a China-linked threat actor, is tied to exploitation that prompted CISA to add five flaws to its Known Exploited Vulnerabilities catalog, backed by a joint advisory from Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S. They are linked to abusing CVE-2015-3306 (ProFTPD), CVE-2021-3199 (ONLYOFFICE Docs), CVE-2023-22894 (Strapi), CVE-2016-3081 (Apache Struts), and CVE-2015-5477 (ISC BIND) to gain unauthorized access and establish footholds. For operators of critical infrastructure, the core risk is less about a single server and more about what sustained access enables—positioning inside networks where disruption could be triggered later, as warned publicly by CISA leadership. The advisory describes the group using scanning, cross-site scripting, and password spraying against Microsoft Exchange servers, plus persistence via VPN software and scripted email and credential theft. Federal agencies face an explicit patch deadline of October 11, 2026, alongside calls to monitor for exploitation attempts and anomalous activity.

Frequently Asked Questions

1. What is Warlock? <b>Warlock</b> ransomware, linked to the China-nexus threat actor Longlegs, is being used in a campaign that breaks into networks through Microsoft SharePoint Server vulnerabilities and then spreads widely inside domains. Once in, it disables security tools and stages the payload inside SYSVOL so it can ride normal Windows domain replication to reach more systems, turning a single breach into an organization-wide outage.

2. What is PaperPhone? <b>PaperPhone</b> is a botnet cluster that CrowdSec says spans roughly <b>80,000 IPs</b> across <b>43 countries</b>, using rotating infrastructure and spoofed geography to make blocking harder. It stands out for a telltale inconsistency: every bot presents the same 375x812 viewport size associated with an iPhone model, even while cycling through 13 claimed device identities.

3. What is Noir? <b>Noir</b> is a cryptocurrency wallet-drainer kit that uses DNS TXT records and DNS-over-HTTPS (DoH) as a dynamic “control plane,” letting it redirect its backend infrastructure quickly when defenders disrupt it. Instead of asking for seed phrases, it relies on permissions victims grant when a lure convinces them to connect a wallet, enabling theft through spending approvals that can look less alarming than an outright transfer request.

4. What is Flax Typhoon? A China-linked threat actor tracked as <b>Flax Typhoon</b> is exploiting multiple widely deployed software flaws—now newly added to CISA’s Known Exploited Vulnerabilities catalog—to gain unauthorized access that can be used to quietly sit inside critical infrastructure networks. The five newly listed issues span ProFTPD (<b>CVE-2015-3306</b>, CVSS <b>10.0</b>), ONLYOFFICE Docs (<b>CVE-2021-3199</b>, CVSS <b>9.8</b>), Strapi (<b>CVE-2023-22894</b>, CVSS <b>7.2</b>), Apache Struts (<b>CVE-2016-3081</b>, CVSS <b>8.1</b>), and ISC BIND (<b>CVE-2015-5477</b>, CVSS <b>7.5</b>), and a joint advisory from Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S. frames the activity as an international concern.

5. What is AWS AgentCore? A weakness in <b>AWS AgentCore</b> let attackers obtain sensitive cloud credentials and then manipulate agent behavior across future sessions, potentially allowing one compromised workflow to cascade to multiple agents in the same AWS account and region. Zenity Labs said the issue hinged on the use of <b>IMDSv1</b> and could be triggered via a server-side request forgery (SSRF) path to pull temporary AWS credentials, which were then used to enumerate other agents and even access Amazon ECR to inspect source code.

6. What is CVE-2026-107181? A one-click flaw in <b>Telegram Desktop</b> (<b>CVE-2026-107181</b>) can let an attacker read arbitrary local files and potentially take over a victim’s account by stealing session-related data after the victim clicks a crafted link. The attack chain described publicly starts with a link that redirects into a <i>tg://</i> link, launching a second Telegram process that forwards data to the running app—where unescaped separators can be abused to trigger file-reading and upload the victim’s files to an attacker-controlled group.

7. What is TeamFiltration? <b>TeamFiltration</b> is driving a password-spray style campaign for account takeover, leaning on an uncomfortable reality: some cloud service accounts still run on default credentials. The attacker originated activity from <b>1,487</b> unique AWS EC2 source IP addresses and targeted over <b>5,700</b> accounts across <b>28</b> Microsoft 365 tenants, ultimately compromising <b>seven</b> accounts by abusing default passwords in unmanaged service accounts.

8. What is Longlegs? <b>Longlegs</b>, a China-nexus threat actor, is being linked to the <b>Warlock</b> ransomware campaign hitting critical infrastructure where downtime can quickly become a public-service problem. They exploit Microsoft SharePoint Server vulnerabilities <b>CVE-2025-49704</b>, <b>CVE-2025-49706</b>, <b>CVE-2025-53770</b>, and <b>CVE-2025-53771</b> to gain access, plant webshells, and set up the conditions to run code remotely.

9. What is Flax Typhoon? <b>Flax Typhoon</b>, a China-linked threat actor, is tied to exploitation that prompted CISA to add five flaws to its Known Exploited Vulnerabilities catalog, backed by a joint advisory from Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S. They are linked to abusing <b>CVE-2015-3306</b> (ProFTPD), <b>CVE-2021-3199</b> (ONLYOFFICE Docs), <b>CVE-2023-22894</b> (Strapi), <b>CVE-2016-3081</b> (Apache Struts), and <b>CVE-2015-5477</b> (ISC BIND) to gain unauthorized access and establish footholds.