Summary
AI-powered extortion is slashing response times for defenders, as INC and The Gentlemen ransomware affiliates orchestrate hands-on intrusions using OpenCode and OpenRouter to track victims and automate attacks. Cyware spotlights how this campaign hit 62 organizations in the US industrial, manufacturing, and healthcare sectors, with one healthcare victim paying $2 million to prevent data leaks.
Preinstalled malware is quietly turning thousands of low-cost Android phones into global proxy botnets and ad-fraud engines. The Midnight Mimosa campaign, embedded in device firmware and active in over 150 countries, abuses powerful permissions to install or remove apps without user consent, leaving users and their networks exposed to persistent fraud.
Critical vulnerabilities are being chained for full system compromise, with attackers exploiting a zero-click command-injection flaw in Zimbra Collaboration Suite (CVE-2026-73570) and chaining Citrix NetScaler bugs (CVE-2026-88771, CVE-2026-88779) to gain root access and plant persistent web shells. These exploits are already active in the wild, putting enterprise infrastructure at risk.
Spyware and espionage operations are targeting high-profile individuals and defense firms, as Pegasus spyware was flagged on a Serbian university rector’s iPhone following Apple’s threat alerts, and Swallowtail—a Russian group—was caught infiltrating defense manufacturers in two NATO countries. These campaigns leverage zero-click exploits and credential theft to maintain covert access.
Top Malware Reported in the Last 24 Hours
INC affiliates expose AI-run ransomware ops
INC and The Gentlemen ransomware affiliates were linked to an AI-assisted intrusion ecosystem after OPSEC mistakes exposed command-and-control infrastructure and AI session databases, according to SOCRadar. The operation used AI services such as OpenCode and OpenRouter to track victims and manage hands-on intrusions, while exploiting edge and remote-access flaws including CVE-2026-35616 (FortiClient EMS), CVE-2024-57727 (SimpleHelp), and CVE-2026-41940 (cPanel). It relied on custom tooling like the Phantom framework, Ghost C2, and RevSocks to maintain control and move stolen data out of networks. The campaign hit 62 organizations, primarily in the US, across industrial, manufacturing, and healthcare, underscoring how quickly extortion pressure can land on real operations. Separately, reporting on the broader trend described a healthcare organization paying $2 million to stop stolen data from being published, reflecting the shift toward data-theft-driven extortion even when encryption is not the main lever. In response, the coverage emphasizes tightening access controls, monitoring for unusual activity, and deploying data loss prevention measures as the practical counterweight to faster AI-assisted targeting.
Midnight Mimosa implants malware in firmware
Midnight Mimosa is a preinstalled Android malware campaign that embeds itself in phone firmware, turning low-cost devices into proxy botnets and ad-fraud engines. Because it arrives baked into the system image, it can survive cleanup attempts that only remove visible apps, leaving owners with phones that quietly route traffic or generate fraudulent ad activity. It abuses powerful permissions including INSTALL_PACKAGES, DELETE_PACKAGES, GRANT_RUNTIME_PERMISSIONS, and WRITE_SECURE_SETTINGS to install or remove apps without user interaction. The reporting links some firmware certificates to Shenzhen Zediel Co., Ltd., while stating direct involvement is not confirmed. The campaign has affected thousands of devices across 150+ countries, with especially high concentrations in Mexico, France, and Italy, meaning everyday users and the networks they connect to can become unwilling infrastructure for fraud. Suggested mitigations in the coverage include blocking the C2 domains and monitoring for unauthorized app installs, including packages com.android.system.lite and com.mobile.applock.en.
OVHcloud CLI releases briefly shipped malware
OVHcloud CLI releases were hijacked on GitHub to distribute malware designed to steal secrets, with compromised files live from 12:47 to 14:21 UTC on October 19. It affected users on macOS, Linux x86_64/arm64, and Windows x86_64 who installed or updated during that window, while Linux i386, Windows i386, Windows arm64, and WebAssembly builds were not affected. A customer’s CI job spotted the issue after detecting a SHA-256 mismatch, and OVHcloud removed the files and published a clean v0.16.0 release with immutable settings. The write-up says the malicious binaries appeared to be built from an untagged commit, and notes the incident may be linked to the GlassWorm campaign described as abusing compromised GitHub accounts for malware distribution. OVHcloud’s guidance for potentially exposed users centers on rotating all secrets from a separate machine, verifying downloaded archives against the official release, and removing any compromised binaries before installing the clean version.
Top Vulnerabilities Reported in Last 24 hours
Zero-click Zimbra bug hits email servers
A critical command-injection flaw in Zimbra Collaboration Suite (CVE-2026-73570) is being exploited to compromise email servers with zero user interaction, opening the door to mailbox data theft and broader server takeover. Attackers trigger command execution by abusing the zimbra-snmp package, then move quickly to deploy webshells, escalate privileges, and stage data for exfiltration. Attackers are already exploiting this in the wild. Reporting says intrusions have included specific payloads such as the Go-based zimdown2 installer and the zimclient2 remote-access agent, suggesting a repeatable toolkit rather than one-off hacking. A fix is available in Zimbra 10.1.20 or later.
Citrix NetScaler flaws chained for root
Attackers are chaining two vulnerabilities in Citrix NetScaler ADC appliances (CVE-2026-88771 and CVE-2026-88779) to reach root and run code that can plant web shells and maintain long-term control of the device. The activity described includes persistent access via PHP web shells, cron-based re-execution after reboot, and tunneling mechanisms that can turn a gateway appliance into a hidden foothold inside a network. Attackers are already exploiting this in the wild. Researchers at Rapid7 reported the intrusions and noted evolving droppers identified by filenames including 17447d.sh, 1.sh, and 2.sh / r.sh. Patches are available for CVE-2026-88771 and CVE-2026-88779.
Siemens tool exploited via DLL sideloading
A code-execution weakness in Siemens Software Center (CVE-2026-110936) is being exploited against systems running versions prior to V4.0.9.8, raising the risk of attackers gaining control of affected machines. The issue is a DLL sideloading flaw, meaning a malicious file can be loaded in place of a legitimate component, allowing attacker-controlled code to run under the context of the application. Attackers are already exploiting this in the wild. The alert was published through official channels, with Siemens Product CERT and national-level advisories emphasizing the need to track updates as the situation develops. A fix is available in Siemens Software Center 4.0.9.8 or later.
Top Threat Actors Reported in Last 24 hours
Pegasus spyware targets Serbian university rector
Pegasus, spyware associated with NSO Group customers, was flagged after Apple warned the rector of a Serbian university that his iPhone was likely targeted in a zero-click attack that needs no tap or download from the victim. The warnings arrived on August 13 and August 27, and Citizen Lab (University of Toronto) investigated the case amid reporting that his support for student demonstrations and research into alleged corruption may have made him a target. With this kind of access, attackers can quietly reach messages and files, track location, and turn on the microphone or camera—turning a personal phone into a surveillance device with real safety and privacy consequences. Citizen Lab says recipients of Apple’s threat alerts should act quickly by contacting Access Now for assistance, keeping iPhones updated, and enabling iOS Lockdown Mode to reduce the attack surface.
INC affiliates expose AI intrusion ecosystem
Affiliates of INC and The Gentlemen ransomware groups were linked to an AI-assisted intrusion setup that spilled into view after operational security mistakes exposed command-and-control servers and AI session databases, according to SOCRadar’s Threat Research Unit. The uncovered logs show them using AI services such as OpenCode and OpenRouter to help manage intrusions, track victims, and run campaigns more efficiently. They gained access by exploiting edge and remote-access weaknesses—including FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727), and cPanel (CVE-2026-41940)—at a scale affecting thousands of targets and endpoints. For industrial, manufacturing, and healthcare organizations, this means break-ins and data theft can be organized and scaled like a production workflow, not a one-off criminal effort. The campaign targeted 62 organizations, primarily in the US.
Swallowtail spies on NATO defense firms
Swallowtail, a Russian espionage group, has been caught targeting defense-related firms in two NATO countries, with activity spanning law enforcement, defense manufacturing, and shipbuilding. After gaining a foothold, they returned to compromised hosts repeatedly over a week in hands-on-keyboard sessions to steal credentials and keep access stable. The intrusion chain described an initial lure using macro-enabled Word documents that dropped multiple files, including a VBScript launcher and a batch script, and used a hidden Microsoft Edge instance to fetch tasks. Their tooling included a reflective loader called ld.exe that decrypts its payload in memory, alongside credential theft that supported persistent access via an SSH tunnel and captured NTLM handshakes. Defenders were advised to monitor for Hookedge indicators and related credential-theft and tunneling activity, and to ensure endpoint protection systems are updated to detect and block malicious activity.
Frequently Asked Questions
What is INC? INC and The Gentlemen ransomware affiliates were linked to an AI-assisted intrusion ecosystem after OPSEC mistakes exposed command-and-control infrastructure and AI session databases, according to SOCRadar. The operation used AI services such as OpenCode and OpenRouter to track victims and manage hands-on intrusions, while exploiting edge and remote-access flaws including CVE-2026-35616 (FortiClient EMS), CVE-2024-57727 (SimpleHelp), and CVE-2026-41940 (cPanel).
What is Midnight Mimosa? Midnight Mimosa is a preinstalled Android malware campaign that embeds itself in phone firmware, turning low-cost devices into proxy botnets and ad-fraud engines. Because it arrives baked into the system image, it can survive cleanup attempts that only remove visible apps, leaving owners with phones that quietly route traffic or generate fraudulent ad activity.
What is OVHcloud CLI? OVHcloud CLI releases were hijacked on GitHub to distribute malware designed to steal secrets, with compromised files live from 12:47 to 14:21 UTC on October 19. It affected users on macOS, Linux x86_64/arm64, and Windows x86_64 who installed or updated during that window, while Linux i386, Windows i386, Windows arm64, and WebAssembly builds were not affected.
What is CVE-2026-73570? A critical command-injection flaw in Zimbra Collaboration Suite (CVE-2026-73570) is being exploited to compromise email servers with zero user interaction, opening the door to mailbox data theft and broader server takeover. Attackers trigger command execution by abusing the zimbra-snmp package, then move quickly to deploy webshells, escalate privileges, and stage data for exfiltration.
What is CVE-2026-88771? Attackers are chaining two vulnerabilities in Citrix NetScaler ADC appliances (CVE-2026-88771 and CVE-2026-88779) to reach root and run code that can plant web shells and maintain long-term control of the device. The activity described includes persistent access via PHP web shells, cron-based re-execution after reboot, and tunneling mechanisms that can turn a gateway appliance into a hidden foothold inside a network.
What is CVE-2026-110936? A code-execution weakness in Siemens Software Center (CVE-2026-110936) is being exploited against systems running versions prior to V4.0.9.8, raising the risk of attackers gaining control of affected machines. The issue is a DLL sideloading flaw, meaning a malicious file can be loaded in place of a legitimate component, allowing attacker-controlled code to run under the context of the application.
What is Pegasus? Pegasus, spyware associated with NSO Group customers, was flagged after Apple warned the rector of a Serbian university that his iPhone was likely targeted in a zero-click attack that needs no tap or download from the victim. The warnings arrived on August 13 and August 27, and Citizen Lab (University of Toronto) investigated the case amid reporting that his support for student demonstrations and research into alleged corruption may have made him a target.
What is Swallowtail? Swallowtail, a Russian espionage group, has been caught targeting defense-related firms in two NATO countries, with activity spanning law enforcement, defense manufacturing, and shipbuilding. After gaining a foothold, they returned to compromised hosts repeatedly over a week in hands-on-keyboard sessions to steal credentials and keep access stable.