Summary
Cloud identities are under siege as adversaries wield AI to rapidly retool malware, sidestepping traditional defenses and exposing government and industrial targets to persistent account hijacking. Cyware spotlights how Midnight Blizzard’s campaign leverages device-code phishing and a modular toolkit to quietly siphon credentials and browser data from Microsoft 365 environments.
A zero-day flaw in Ivanti Connect Secure VPNs is granting attackers root access even on fully patched appliances, with exploitation chains bypassing authentication and escalating privileges through race conditions. CISA’s rapid addition of CVE-2026-104935 to its Known Exploited Vulnerabilities catalog underscores the urgency for organizations to patch or risk credential theft and network mapping.
Proxyjacking attacks are sweeping across 34 countries, as threat actors exploit known vulnerabilities to install bandwidth-hijacking software on devices from D-Link, Ubiquiti, SAP, and more. Victims’ internet connections are being resold to third parties, leaving organizations exposed to IP blocks and reputational risk when malicious traffic is routed through their compromised networks.
Top Malware Reported in the Last 24 Hours
Midnight Blizzard uses AI to retool malware
Midnight Blizzard, a Russian-linked threat group, was tied to a campaign that used AI-assisted changes to quickly modify and redeploy malware across multiple builds, complicating traditional detection. ReversingLabs traced the activity from two samples shared by Anthropic and mapped it to a wider operation that abused Microsoft 365 access via device-code phishing using a framework called Embassy Kit. The intrusion chain included ChocoShell, a PowerShell stager that reuses PowerSploit and Empire code to collect browser history and credentials and exfiltrate them over HTTPS. It also deployed CornFlake, a Go backdoor that persists by copying itself to %LOCALAPPDATA%\svchost32.exe and pulls data from browser profiles. ReversingLabs said its pivoting and similarity analysis expanded the picture to a broader campaign targeting government and industrial sectors, raising the stakes for organizations whose cloud identities can be quietly hijacked.
ClickFix tricks users into running malware
The ClickFix campaign uses social engineering to convince victims to run commands in Windows Terminal or PowerShell, kicking off a multi-stage infection chain that can end in covert network access. In this activity, attackers use the Lorem Ipsum Loader to deliver a Python-based tunneling implant that can give them a hidden foothold inside an environment. It stands out for how it rebuilds shellcode from a dictionary of random five-letter words and then unhooks ntdll using a clean on-disk copy, helping the payload blend in while it runs. Reporting says the campaign also spreads through multiple execution chains, including Node.js and standalone PowerShell methods, and it has used DLL sideloading and trojanized Microsoft Teams MSI installers. One intrusion was detected and contained in late September before ransomware deployment, underscoring how these “run this command” lures can be a fast on-ramp to bigger attacks.
Proxyjackers resell bandwidth from hacked devices
A proxyjacking campaign tracked by GreyNoise has been caught installing Pawns.app on compromised devices across 34 countries, turning victims’ internet connections into a commodity. The attackers monetize access by routing third-party traffic through hijacked networks, which can leave organizations and individuals dealing with IP blocks or suspicion when that traffic is abused. GreyNoise linked the activity to exploitation of multiple known flaws — CVE-2024-3272, CVE-2024-3273, CVE-2021-44228, and CVE-2025-31324 — to push the proxy software onto internet-facing gear. Affected products named in the report include D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, SAP NetWeaver Visual Composer, and Hikvision and Dahua DVR/NVR devices. GreyNoise said some cases also involved setting up SSH key authentication for backup access, suggesting the operators expected to return even if the initial route was disrupted.
Top Vulnerabilities Reported in Last 24 hours
Ivanti VPN zero-day grants root access
Attackers have been exploiting a zero-day in Ivanti Connect Secure that can deliver unauthorized root access even on fully patched appliances (CVE-2026-104935). The exploit chain starts by bypassing authentication through the welcome.cgi script, then uses a race condition to upload and run a Perl script via the wu.cgi upload handler, before escalating privileges by modifying DSCache to reach root. Attackers are already exploiting this in the wild. SocRadar linked the activity to UTA0576, describing anti-forensics such as log tampering and payload cleanup alongside credential theft and network mapping. CISA added the bug to its Known Exploited Vulnerabilities catalog on October 13, 2026, and Ivanti has released fixes in 25.1.1.2, 25.1.3.0, and 22.8R2.5.
BeyondTrust zero-day used for silent takeover
A zero-day in BeyondTrust Remote Support let remote attackers perform file operations without credentials, a path to host-level control and access to stored secrets (CVE-2026-102764). The attack hinged on improper origin validation in an internal messaging component, allowing intruders to reach deep into the appliance without user interaction. Attackers exploited this as a zero-day, with initial exploitation reported on August 29 and discovery on September 28. Reporting described a suspected China-nexus espionage group tracked as ARMORY CASTLE, which used persistence including a zz-root-persist script and edits to /etc/sudoers, plus tools like bt-secrets to pull stored credentials. A patch is available as BT26-05-RS.
CISA flags exploited Atlassian file leak
A widely used set of Atlassian Data Center products is under active attack via an arbitrary file access flaw that can expose sensitive files inside the web application root directory (CVE-2026-21589). Attackers abuse a path traversal technique that uses double colons ([:][:]) as path separators to reach unintended files. Attackers are already exploiting this in the wild, with Security Affairs reporting attempts began two hours after watchTowr published additional technical details, observed from IPs in Japan and the U.S. against honeypots. The affected product list spans Bitbucket (9.4.26, 10.2.8, 10.5.1), Confluence (9.2.26, 10.2.19), Jira Service Management (5.12.40, 10.3.26, 11.3.12), Jira Software (9.12.40, 10.3.26, 11.3.12), Bamboo (10.2.24, 12.1.12), Crowd (6.3.7, 7.0.3, 7.1.7, 7.2.4), plus Crucible (4.9.15) and Fisheye (4.9.15). CISA added it to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 18, 2026.
Top Threat Actors Reported in Last 24 hours
Midnight Blizzard rebuilds malware with AI
Midnight Blizzard (also tracked as Nobelium), a Russia-linked espionage group, is being tied to a campaign where malware was repeatedly modified and redeployed with help from AI to slip past detections. ReversingLabs said they first observed the activity in early July 2026, then mapped it outward from two malware hashes shared by Anthropic—using five pivots and similarity analysis to uncover a staging server and additional builds. They abused Microsoft 365 access via device-code phishing using a framework called Embassy Kit, then followed with a PowerShell stager and a Go-based backdoor. The PowerShell component, ChocoShell, collected browser history and credentials and exfiltrated data over HTTPS, while the Go backdoor, CornFlake, persisted by copying itself to %LOCALAPPDATA%\svchost32.exe and reading browser profile data. For government and industrial targets caught in the middle, the practical risk is long-lived account and data exposure even as defenders block one malware build and the adversary rapidly iterates to the next.
ARMORY CASTLE hits BeyondTrust zero-day
ARMORY CASTLE, a suspected China-nexus espionage group, exploited a BeyondTrust Remote Support vulnerability as a zero-day to gain deep control of affected systems. The initial exploitation reportedly began on August 29 and was discovered on September 28, with the flaw tracked as CVE-2026-102764. Because the bug enables remote file operations without credentials or user interaction, victims faced the prospect of host-level control and access to stored credentials across Remote Support versions up to 26.2.3. After getting in, they used BeyondTrust’s bt-secrets tool to pull stored secrets, deployed a persistence script called zz-root-persist, and modified /etc/sudoers to maintain privileged access. The underlying issue was described as improper origin validation in an internal messaging component, and a delayed response—partly blamed on false positives from a third-party detection platform—gave the intruders more time to operate.
APTs shift attacks to trusted systems
AhnLab’s September 2026 Threat Trend Report describes an evolution in APT tradecraft where adversaries lean harder on supply chain attacks, abuse of legitimate services for C2, and the compromise of trusted infrastructure—moving the battleground from endpoints to developer ecosystems, cloud credentials, and network trust. North Korea-linked APT groups are reported targeting developers and IT professionals through fake job postings and “technical interview” lures, pairing them with malware such as OtterCookie and stealthy command-and-control through services like GitHub. China-linked APT groups were said to exploit trusted infrastructure and legitimate services while deploying malware such as PolinRider, and Russia-linked APT groups were described escalating activity with techniques involving VelvetCake. Iranian and Pakistani APT groups were highlighted for focusing on aviation, aerospace, and fintech, including the use of services like Microsoft 365 and OneDrive for C2. For organizations that rely on developer accounts and cloud identity as the “keys to the kingdom,” the consequence is that a single compromised account or management layer can cascade into broader access across production systems.
Frequently Asked Questions
What is Midnight Blizzard? Midnight Blizzard, a Russian-linked threat group, was tied to a campaign that used AI-assisted changes to quickly modify and redeploy malware across multiple builds, complicating traditional detection. ReversingLabs traced the activity from two samples shared by Anthropic and mapped it to a wider operation that abused Microsoft 365 access via device-code phishing using a framework called Embassy Kit.
What is ClickFix? The ClickFix campaign uses social engineering to convince victims to run commands in Windows Terminal or PowerShell, kicking off a multi-stage infection chain that can end in covert network access. In this activity, attackers use the Lorem Ipsum Loader to deliver a Python-based tunneling implant that can give them a hidden foothold inside an environment.
What is CVE-2024-3272? A proxyjacking campaign tracked by GreyNoise has been caught installing Pawns.app on compromised devices across 34 countries, turning victims’ internet connections into a commodity. The attackers monetize access by routing third-party traffic through hijacked networks, which can leave organizations and individuals dealing with IP blocks or suspicion when that traffic is abused.
What is CVE-2026-104935? Attackers have been exploiting a zero-day in Ivanti Connect Secure that can deliver unauthorized root access even on fully patched appliances (CVE-2026-104935). The exploit chain starts by bypassing authentication through the welcome.cgi script, then uses a race condition to upload and run a Perl script via the wu.cgi upload handler, before escalating privileges by modifying DSCache to reach root.
What is CVE-2026-102764? A zero-day in BeyondTrust Remote Support let remote attackers perform file operations without credentials, a path to host-level control and access to stored secrets (CVE-2026-102764). The attack hinged on improper origin validation in an internal messaging component, allowing intruders to reach deep into the appliance without user interaction.
What is CVE-2026-21589? A widely used set of Atlassian Data Center products is under active attack via an arbitrary file access flaw that can expose sensitive files inside the web application root directory (CVE-2026-21589). Attackers abuse a path traversal technique that uses double colons ([:][:]) as path separators to reach unintended files.
What is ARMORY CASTLE? ARMORY CASTLE, a suspected China-nexus espionage group, exploited a BeyondTrust Remote Support vulnerability as a zero-day to gain deep control of affected systems. The initial exploitation reportedly began on August 29 and was discovered on September 28, with the flaw tracked as CVE-2026-102764.