Summary
Attackers are burrowing into the heart of enterprise networks by exploiting authentication bypasses in Cisco SD-WAN controllers, giving them a durable foothold in environments that connect critical sites and remote operations. The KeyDrift malware framework, wielded by APT actor UAT-11473, leverages CVE-2026-20127 to embed itself deep within network control layers, intercepting and manipulating high-value traffic. Cyware highlights how this campaign targets sectors like space, satellite services, and defense, where a single compromise can expose sensitive operations for months.
A critical flaw in Google’s Brotli compression library is turning routine web traffic into a weapon, as attackers actively exploit CVE-2026-111497 (CVSS 9.2) to trigger memory disclosure, denial of service, or remote code execution across a vast ecosystem. Dubbed Node2Shell, this bug impacts widely used components such as Node.js, Microsoft .NET, PowerShell, and Python Brotli, making a single embedded library a hidden exposure point for countless applications. The vulnerability’s addition to CISA’s Known Exploited Vulnerabilities Catalog underscores the urgency for organizations to patch to Brotli versions 1.0.10, 1.1.1, or 1.2.1.
A state-sponsored hacking group is quietly rerouting zero-day attacks through a shifting relay network, making it nearly impossible for defenders to trace the true source. Volt Typhoon, described as a Chinese group, has rebuilt its covert infrastructure—Silent Train—by chaining compromised Intelbras modems and Netgear Orbi units to mask operations targeting US critical infrastructure. This evolution, tracked after the FBI’s disruption of the KV-Botnet, means routine administrative activity can now double as covert access to communications, energy, and transportation systems.
Top Malware Reported in the Last 24 Hours
KeyDrift backdoors Cisco SD-WAN controllers
KeyDrift is a malware framework used by APT actor UAT-11473 to break into Cisco SD-WAN systems by exploiting an authentication bypass, CVE-2026-20127, and then stay embedded for long-term access. Once inside, it is built to watch and manipulate high-value network control traffic, giving attackers a durable perch in environments that often connect critical sites and remote operations. The framework’s components include PolyFlame, which intercepts control-plane traffic, and LittleFilch, which steals control-session keying material and stages encrypted data for exfiltration. Cisco Talos reported the activity and linked observed behavior to MITRE ATT&CK techniques including Process Injection (T1055.008) and Network Sniffing (T1040). The targeting focus spans space, satellite services, defense, and aerospace technology, where a foothold at the controller layer can translate into prolonged visibility into sensitive operations.
NIK C2 adds AI to intrusions
NIK C2 is an AI-enabled command-and-control framework seen in the wild that gives attackers a flexible way to run Windows intrusions—from credential theft to launching screen-locking ransomware for cryptocurrency payments. It relies on a Go-based implant with a resilient dual-channel design that helps it maintain control even as infrastructure changes, including runtime-updated URLs and embedded fallback addressing. The toolset supports over 52 commands, spanning keylogging, browser and WiFi password theft, and cryptocurrency wallet theft, while also using defense-evasion features such as AMSI bypass and process masquerading. Cisco Talos described the framework’s development as evolving across at least three versions, pointing to an operator with the resources to keep improving it. For businesses, the risk is more than data loss: this kind of framework can pivot from quiet spying into disruptive ransomware when attackers decide it is time to cash out.
Fake AI apps and court notices spread malware
The Yoba campaign is pushing Windows malware through fake ChatGPT and Claude apps that bundle legitimate signed executables from OpenAI and Anthropic, then trigger malicious code via DLL sideloading. After installation, it uses a Telegram channel and an image to derive a domain, pulls encrypted instructions via Google’s DNS-over-HTTPS, retrieves payloads from the Catbox file-hosting service, and routes traffic through Tor; the final payload observed was XMRig, though the loader can fetch other code. In parallel, a separate phishing operation impersonating the US District Court for the Southern District of Florida is aimed at over 100,000 companies, using fake case IDs and a counterfeit court site to deliver LodaRAT. Once run, it can steal browser credentials, log keystrokes, capture screenshots and audio, access webcams, establish persistence, and attempt to weaken Windows Defender, turning a single click into long-lived surveillance. Together, the campaigns show how familiar brands—AI tools and official court processes—are being weaponized to trick employees and compromise corporate devices at scale.
Top Vulnerabilities Reported in Last 24 hours
Node2Shell bug hits Brotli across stacks
Attackers are actively exploiting a critical flaw in Google’s Brotli compression library that can lead to memory disclosure, denial of service, or remote code execution in affected applications (CVE-2026-111497, CVSS 9.2). The weakness sits in Brotli’s decoder and can be triggered by sending specially crafted compressed data to services that process Brotli content, turning everyday web traffic into a potential attack path. Attackers are already exploiting this in the wild. Sophos and the Canadian Centre for Cyber Security tracked the issue—also referred to as Node2Shell, Broccoli2Shell, and HTTP2Shell—and CISA added it to the Known Exploited Vulnerabilities Catalog on October 27. The risk spans widely used components and runtimes including Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, Python Brotli, and brotlicffi packages, meaning a single embedded library can become a hidden exposure. A fix is available in Brotli versions 1.0.10, 1.1.1, or 1.2.1 (as applicable).
Sophos UTM email proxy enables root RCE
A pre-authentication remote code execution bug in Sophos UTM means an internet attacker could run arbitrary commands as root on appliances using the product’s Email Protection features (CVE-2026-118633). The issue stems from a path traversal weakness that can be exploited by repeating requests to “win” a race condition, letting an attacker break out of intended boundaries and reach code execution. No active exploitation was stated in the provided source material. Sophos credits Sam Pizzey for responsibly reporting the flaw via its bug bounty program, underscoring that researchers—not attackers—surfaced it first. In real-world terms, a compromised gateway can expose email flows and become a foothold for wider intrusion across a business network. A patch is available from Sophos, and the advisory notes Sophos UTM is end-of-life.
Zero-click Android SMS bug can drop calls
A newly disclosed zero-click vulnerability in Android’s WapPushOverSms component allows a remote attacker to crash the com.android.phone process simply by sending a malformed WAP Push SMS, abruptly dropping active calls—including emergency calls. The immediate consequence is a silent denial of service that can leave a device in a telephony blackout, and rapid message delivery can also trigger SQLite corruption that causes persistent crashes on boot. Exploitation is described as straightforward: a malformed WAP Push message sent over SMS (port 2948) triggers an unchecked cast that leads to a negative array size exception and repeated crashes. The researcher disclosed the issue publicly on October 29, 2026 after reporting it to Google on May 5, 2026; the site states Google classified it as a non-security issue and will not provide a fix. For affected people, this is less about data theft and more about losing basic phone reliability at the worst moment—calls can fail without warning. No fix is planned by Google, according to the disclosure.
Top Threat Actors Reported in Last 24 hours
Volt Typhoon rebuilds covert Silent Train
Volt Typhoon, described as a Chinese state-sponsored hacking group, is back with a fresh way to mask zero-day intrusions by routing operations through a relay network it calls Silent Train. They chain compromised consumer and small-office devices— including Intelbras modems and Netgear Orbi units—so victims see traffic coming from a shifting series of intermediaries instead of the original attacker. The group exploits zero-day flaws in edge and management infrastructure, steals credentials, and keeps persistent remote access long enough to reach downstream customers before wiping traces using “live off the land” utilities. For US critical infrastructure operators in communications, energy, and transportation, the consequence is that routine admin activity can double as covert access to systems people rely on every day. Reporting ties this evolution to the FBI’s disruption of the KV-Botnet that they previously used for cover, and guidance highlighted alongside the coverage emphasizes tightening exposure around centralized management systems and watching for unusual administrative behavior.
Warp Panda hits law firms via VMware
Warp Panda, a China-linked threat actor, is exploiting a VMware ESX zero-day to make intrusions harder to see by reducing audit-trail visibility in environments defenders typically depend on for investigation. The vulnerability, tracked as CVE-2026-41709, is described as an insufficient logging flaw that lets an attacker with admin access execute operations without those actions being logged. They are reported to use internet-facing edge devices for initial access, then pivot into VMware vCenter environments and maintain footholds by registering rogue MFA devices. For the US legal sector, this raises the risk that client communications, M&A materials, and litigation strategy could be accessed without clear forensic breadcrumbs. The advisory guidance accompanying the report calls for applying available patches, monitoring for rogue MFA registrations and unauthorized cloud session token access, and enhancing logging and monitoring to catch activity that would otherwise blend into routine administration.
Emperador claims AB InBev data theft
Emperador, a ransomware group operating for financial gain, has claimed a breach of AB InBev and says it exfiltrated 3.9 GB of data spanning corporate emails, access logs, PKI certificates, and Azure cloud files. They are seeking $1 million in Bitcoin, pairing data theft with pressure tactics that can escalate into encryption and public shaming. The exposure of PKI certificates is particularly fraught for large enterprises because it can enable follow-on abuse such as man-in-the-middle scenarios and deeper access to cloud assets. The report maps the operation to MITRE ATT&CK techniques including Credential Access (T1552), Collection (T1005), Exfiltration (T1537), and Impact (T1486). Recommended actions referenced with the analysis include revoking and rotating potentially compromised PKI certificates and updating incident response plans.
Frequently Asked Questions
What is KeyDrift? KeyDrift is a malware framework used by APT actor UAT-11473 to break into Cisco SD-WAN systems by exploiting an authentication bypass, CVE-2026-20127, and then stay embedded for long-term access. Once inside, it is built to watch and manipulate high-value network control traffic, giving attackers a durable perch in environments that often connect critical sites and remote operations.
What is NIK C2? NIK C2 is an AI-enabled command-and-control framework seen in the wild that gives attackers a flexible way to run Windows intrusions—from credential theft to launching screen-locking ransomware for cryptocurrency payments. It relies on a Go-based implant with a resilient dual-channel design that helps it maintain control even as infrastructure changes, including runtime-updated URLs and embedded fallback addressing.
What is Yoba? The Yoba campaign is pushing Windows malware through fake ChatGPT and Claude apps that bundle legitimate signed executables from OpenAI and Anthropic, then trigger malicious code via DLL sideloading. After installation, it uses a Telegram channel and an image to derive a domain, pulls encrypted instructions via Google’s DNS-over-HTTPS, retrieves payloads from the Catbox file-hosting service, and routes traffic through Tor; the final payload observed was XMRig, though the loader can fetch other code.
What is CVE-2026-111497? Attackers are actively exploiting a critical flaw in Google’s Brotli compression library that can lead to memory disclosure, denial of service, or remote code execution in affected applications (CVE-2026-111497, CVSS 9.2). The weakness sits in Brotli’s decoder and can be triggered by sending specially crafted compressed data to services that process Brotli content, turning everyday web traffic into a potential attack path.
What is CVE-2026-118633? A pre-authentication remote code execution bug in Sophos UTM means an internet attacker could run arbitrary commands as root on appliances using the product’s Email Protection features (CVE-2026-118633). The issue stems from a path traversal weakness that can be exploited by repeating requests to “win” a race condition, letting an attacker break out of intended boundaries and reach code execution.
What is Volt Typhoon? Volt Typhoon, described as a Chinese state-sponsored hacking group, is back with a fresh way to mask zero-day intrusions by routing operations through a relay network it calls Silent Train. They chain compromised consumer and small-office devices— including Intelbras modems and Netgear Orbi units—so victims see traffic coming from a shifting series of intermediaries instead of the original attacker.
What is Warp Panda? Warp Panda, a China-linked threat actor, is exploiting a VMware ESX zero-day to make intrusions harder to see by reducing audit-trail visibility in environments defenders typically depend on for investigation. The vulnerability, tracked as CVE-2026-41709, is described as an insufficient logging flaw that lets an attacker with admin access execute operations without those actions being logged.
What is Emperador? Emperador, a ransomware group operating for financial gain, has claimed a breach of AB InBev and says it exfiltrated 3.9 GB of data spanning corporate emails, access logs, PKI certificates, and Azure cloud files. They are seeking $1 million in Bitcoin, pairing data theft with pressure tactics that can escalate into encryption and public shaming.