Summary
AI-powered automation is slashing the time it takes ransomware operators to breach networks and steal data. Cyware spotlights GOLD OGRE, a Russian-speaking group now using models from Anthropic, xAI, and Moonshot to orchestrate Aur0ra ransomware attacks, accelerating intrusions from initial access to domain-wide compromise with stolen VPN credentials and advanced tooling.
A trio of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances has turned a trusted perimeter device into a launchpad for root-level attacks. UTA0576 exploited CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 to steal credentials and erase forensic evidence, with active exploitation confirmed since October 3, 2026 and patches released only weeks later.
Espionage operations are scaling up with artificial intelligence as VAPOR PANDA, a North Korea-linked group, targets over 200 organizations worldwide. Their ARTEX framework and DeepSeek LLM enable rapid identity and infrastructure attacks, blending SAML assertion chaining and VPN exploits to quietly infiltrate foreign ministries, defense, and technology sectors.
Top Malware Reported in the Last 24 Hours
GOLD OGRE automates Aur0ra ransomware with AI
GOLD OGRE is a Russian-speaking ransomware group that Sophos says is using AI to speed up intrusions tied to Aur0ra ransomware, turning tasks that used to take hands-on operator time into guided, semi-automated workflows. It uses AI models from Anthropic, xAI, and Moonshot to help orchestrate steps like network enumeration and credential extraction, then pushes onward toward full domain control. For footholds, the threat relies on stolen VPN credentials and SOCKS access, and it uses tools such as BloodHound, PetitPotam, and Certipy to map domains and enable NTLM relay-style attacks that can lead to domain administrator privileges. Sophos observed operators prompting AI agents in Russian, with the practical consequence that a single intrusion can progress faster from initial access to data theft and ransomware deployment, cutting response time for affected businesses. Recommended actions in the source include network segmentation and isolating critical servers, restricting domain administrator privileges, deploying phishing-resistant MFA, and monitoring for suspicious activity.
Claude Code extension ships SSH backdoor
A trojanized Claude Code extension for VS Code was reported as a supply chain incident that planted an SSH backdoor on developer machines, potentially affecting up to 5,000 users, according to British security researcher Kevin Beaumont. The malicious code collects system information, adds an attacker SSH key, enables the local SSH service, and opens a reverse SSH tunnel so the intruder can regain access later across Linux, macOS, and Windows. A related report also describes anthropic.claude-code version 2.1.313 on Open VSX as containing a malicious loader that installs persistent SSH access while suppressing errors to keep running and collecting environment details that may include credential-related data. For organizations, the real-world impact is straightforward: a compromised developer workstation can become a quiet entry point into source code, internal systems, and production pipelines. Recommended actions listed include removing compromised versions, auditing for unauthorized SSH keys and activity, and rotating exposed credentials and sessions from a clean system.
Coruna iOS kit steals crypto seed phrases
The Coruna iOS Exploit Kit is a malicious-ad-driven campaign that targets iPhones and iPads to steal cryptocurrency wallet recovery seed phrases, putting victims at risk of losing control of their funds. ADEX describes a four-stage chain that starts with device fingerprinting, then reviewer evasion, followed by tailored payload delivery, and ends in financial theft. It targets iOS versions 13.0 to 17.2.1, with older or unpatched devices called out as particularly exposed. ADEX also forecasts that by 2027 attackers will increasingly target AI agents using tactics like invisible text, page plumbing, and agent cloaking to manipulate automated actions. Recommended actions in the source include updating iOS to the latest version, auditing landing pages for hidden machine-targeted content, and increasing monitoring to detect and block malicious ads.
Top Vulnerabilities Reported in Last 24 hours
Ivanti VPN zero-days yield root access
Hackers tracked as UTA0576 exploited multiple zero-day vulnerabilities in Ivanti Connect Secure VPN appliances—CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527—to run commands as root and steal credentials from targeted environments. The intrusions hinged on manipulating the appliances’ CGI scripts (welcome.cgi and wu.cgi) to chain an authentication bypass with privilege escalation and predictable-filename file uploads, turning a perimeter access product into a foothold for internal network probing. Attackers are already exploiting this in the wild; activity in this campaign began on October 3, 2026, and the group also attempted to erase traces by selectively removing evidence from logs. Reporting attributes the activity to UTA0576, which used custom Python tooling for credential extraction and reconnaissance, while investigators relied on memory captures, disk images, and core dumps to reconstruct what happened. A fix is available as of October 29.
N-central zero-day opens managed endpoints
A critical zero-day in N-able N-central (CVE-2026-18577) allowed attackers to gain remote administrative access to managed endpoints without authentication, turning a single RMM compromise into downstream customer impact. The incident also exposed a persistence playbook: attackers used Cloudflare tunnels and the built-in account mspsupport[@]n-able[.]com to maintain access even after the initial weakness was addressed. Attackers exploited the flaw before it was fully closed—N-able says the issue was an incomplete patch for CVE-2026-18556—and the suspicious activity was detected on 31 July 2026 by N-able’s Adlumin MDR service. In one documented instance, the attackers reached nine downstream organizations, underscoring how compromise can cascade through MSP tooling into multiple businesses at once. A fix is available in Hotfix 2, build 2026.3.1.10.
Hackers abuse Drupal Commerce authorization gap
Attackers are actively exploiting an authorization bypass in Drupal’s Commerce Core component (CVE-2026-118539) that can let unauthorized users access certain routes and entity fields tied to online selling workflows. For organizations running Drupal Commerce, the practical risk is business-facing: attackers can reach sensitive commerce data paths and potentially trigger financial harm for vendors relying on shopping carts and APIs. Attackers are already exploiting this in the wild, though the public reporting did not provide a detailed victim list or a step-by-step account of how the intrusions unfolded. Researchers Dan Puccetti, Marcus Johansson, and Robert Snyder reported the flaw, while the same coverage also flagged active exploitation of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, with Wiz reporting affected organizations declining to 52.1%. Fixes are available in Commerce Core 3.3.13 (for 3.x) and 8.x-2.41 (for earlier versions).
Top Threat Actors Reported in Last 24 hours
VAPOR PANDA scales espionage with AI
VAPOR PANDA, a North Korea-linked espionage group, is using an AI-driven framework called ARTEX alongside the DeepSeek LLM to run a fast-moving, global intrusion campaign. Since October 17, 2026, they have targeted over 200 organizations, focusing on foreign ministries while also reaching into defense, telecommunications, pharmaceuticals, and semiconductors. The group’s playbook blends identity and infrastructure attacks, including SAML assertion chaining, XXE flaws, and VPN configuration exploitation, allowing them to move across many environments at once. For governments and critical industries, the consequence is that routine identity and appliance weaknesses can translate into quiet, durable access to sensitive communications and networks. They maintain access with web shells and by leaning on unrotated authentication keys, while deploying the BLOODALCHEMY backdoor via legitimate binaries to blend into normal system activity. CrowdStrike reported the activity.
GOLD OGRE automates Aur0ra ransomware
GOLD OGRE, described by Sophos as Russian-speaking and financially motivated, has been observed using AI models to help run the Aur0ra ransomware operation. Rather than using AI for simple copywriting, they reportedly prompt AI agents in Russian to assist with tasks like network enumeration and credential extraction, reducing how much hands-on work operators need to do during an intrusion. In the observed activity, they used stolen VPN credentials and SOCKS access to get in, then leaned on tools including BloodHound, PetitPotam, and Certipy to map environments and support NTLM relay-style attacks. For affected businesses, this kind of automation raises the odds that an initial foothold quickly becomes domain-wide compromise, data theft, and an extortion event. Sophos tied the behavior to AI-assisted escalation from credential access to domain administrator privileges.
UTA0576 hits Ivanti VPNs with zero-days
UTA0576 is being linked to active exploitation of zero-day vulnerabilities in Ivanti Connect Secure appliances, turning a perimeter device into a gateway for credential theft and internal reconnaissance. The attacks began on October 3, 2026 and used CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527, which Ivanti patched on October 29. According to the report, they manipulated CGI scripts including welcome.cgi and wu.cgi to bypass authentication and execute code, enabling root-level command execution. Organizations running versions prior to 25.1.1.3 and 22.8R2.6 face the risk that appliance compromise can spill into broader network access and stolen service credentials. The actor also selectively removed evidence from logs, with investigators relying on memory captures, disk images, and core dumps to reconstruct what happened.
Frequently Asked Questions
What is GOLD OGRE? GOLD OGRE is a Russian-speaking ransomware group that Sophos says is using AI to speed up intrusions tied to Aur0ra ransomware, turning tasks that used to take hands-on operator time into guided, semi-automated workflows. It uses AI models from Anthropic, xAI, and Moonshot to help orchestrate steps like network enumeration and credential extraction, then pushes onward toward full domain control.
What is Claude Code? A trojanized Claude Code extension for VS Code was reported as a supply chain incident that planted an SSH backdoor on developer machines, potentially affecting up to 5,000 users, according to British security researcher Kevin Beaumont. The malicious code collects system information, adds an attacker SSH key, enables the local SSH service, and opens a reverse SSH tunnel so the intruder can regain access later across Linux, macOS, and Windows.
What is Coruna iOS Exploit Kit? The Coruna iOS Exploit Kit is a malicious-ad-driven campaign that targets iPhones and iPads to steal cryptocurrency wallet recovery seed phrases, putting victims at risk of losing control of their funds. ADEX describes a four-stage chain that starts with device fingerprinting, then reviewer evasion, followed by tailored payload delivery, and ends in financial theft.
What is CVE-2026-104935? Hackers tracked as UTA0576 exploited multiple zero-day vulnerabilities in Ivanti Connect Secure VPN appliances—CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527—to run commands as root and steal credentials from targeted environments. The intrusions hinged on manipulating the appliances’ CGI scripts (welcome.cgi and wu.cgi) to chain an authentication bypass with privilege escalation and predictable-filename file uploads, turning a perimeter access product into a foothold for internal network probing.
What is CVE-2026-18577? A critical zero-day in N-able N-central (CVE-2026-18577) allowed attackers to gain remote administrative access to managed endpoints without authentication, turning a single RMM compromise into downstream customer impact. The incident also exposed a persistence playbook: attackers used Cloudflare tunnels and the built-in account mspsupport[@]n-able[.]com to maintain access even after the initial weakness was addressed.
What is CVE-2026-118539? Attackers are actively exploiting an authorization bypass in Drupal’s Commerce Core component (CVE-2026-118539) that can let unauthorized users access certain routes and entity fields tied to online selling workflows. For organizations running Drupal Commerce, the practical risk is business-facing: attackers can reach sensitive commerce data paths and potentially trigger financial harm for vendors relying on shopping carts and APIs.
What is VAPOR PANDA? VAPOR PANDA, a North Korea-linked espionage group, is using an AI-driven framework called ARTEX alongside the DeepSeek LLM to run a fast-moving, global intrusion campaign. Since October 17, 2026, they have targeted over 200 organizations, focusing on foreign ministries while also reaching into defense, telecommunications, pharmaceuticals, and semiconductors.
What is UTA0576? UTA0576 is being linked to active exploitation of zero-day vulnerabilities in Ivanti Connect Secure appliances, turning a perimeter device into a gateway for credential theft and internal reconnaissance. The attacks began on October 3, 2026 and used CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527, which Ivanti patched on October 29.