Summary
This month’s threat landscape was marked by the escalation of ransomware campaigns, the industrialization of EDR evasion techniques, and the rapid exploitation of critical vulnerabilities across widely used platforms. Ransomware groups such as SafePay and Gentlemen intensified attacks on critical sectors worldwide, leveraging both established and emerging vulnerabilities, while BYOVD tactics became increasingly accessible and scalable. Pre-installed malware like Midnight Mimosa and supply chain threats such as the Miasma npm worm further broadened the scope of compromise, impacting organizations and individuals across more than 150 countries.
Critical vulnerabilities in PHP, Cisco Secure Firewall Management Center, Google Brotli, Citrix NetScaler ADC, and Ivanti Connect Secure moved swiftly from disclosure to active exploitation, prompting emergency responses and widespread patching efforts. These vulnerabilities affected a broad range of digital infrastructure, from web servers and network appliances to cloud platforms, with several incidents resulting in persistent attacker access and significant operational disruption.
State-sponsored threat actors, particularly those aligned with China and Russia, demonstrated advanced toolsets and operational scale. Groups including Integrity Technology Group, VAPOR PANDA, Volt Typhoon, Star Blizzard, and Storm-0940 conducted coordinated campaigns targeting government, critical infrastructure, and technology sectors. These actors leveraged AI-driven automation, supply chain compromises, and persistent access techniques to accelerate and expand their intrusions, underscoring the evolving sophistication and reach of global cyber operations.
Top Malware Reported This Month
SafePay ransomware group escalates global attacks on critical sectors
SafePay ransomware is a double extortion ransomware operation that exfiltrates data, encrypts files, and demands cryptocurrency ransoms from victims. SafePay disables security protections, backup services, and network storage devices, uses ChaCha20 and RSA hybrid encryption, and appends the .SafePay extension to files. SafePay exploits vulnerabilities including CVE-2023-20269, CVE-2020-3259, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766, and leverages brute force, credential theft, phishing, and VPN abuse (notably Mullvad) for initial access. SafePay targets manufacturing, technology, healthcare, professional services, and retail sectors, with attacks spanning North America, South America, Europe, and Australia, and has compromised over 600 organizations including Conduent Business Services and Microlise. SafePay uses legitimate tools such as AnyDesk, TeamViewer, PsExec, WinRM, Mimikatz, PowerShell, FileZilla, 7-Zip, RClone, WinRAR, WinSCP, and OneDrive for lateral movement, persistence, and data exfiltration.
Organizations should align defenses with the Cybersecurity Performance Goals (CPGs) developed by CISA and NIST.
Apply timely patches to known vulnerabilities, especially those exploited by SafePay.
Implement multi-factor authentication, robust password policies, and user access controls.
Maintain encrypted, immutable offline backups and segment networks to restrict lateral movement.
Monitor for unauthorized account creation, abnormal activity, and restrict remote desktop tool usage.
Use CISA’s Eviction Strategies Tool for systematic eviction planning.
Report incidents to relevant authorities such as the FBI, USSS, or CISA.
Gentlemen ransomware leverages BYOVD to disable security software
Gentlemen ransomware is a Russian-speaking ransomware-as-a-service (RaaS) operation that uses a bring-your-own-vulnerable-driver (BYOVD) technique to disable security software and facilitate file encryption. Gentlemen ransomware exploits vulnerabilities in Lenovo’s BootRepair.sys and Safetica’s ProcessMonitorDriver to terminate security processes, disables Microsoft Defender, clears event logs, and removes PowerShell command histories. Gentlemen ransomware achieves persistence through scheduled tasks and registry entries, and encrypts files using ChaCha20 with per-file keys, appending the .cyvzca extension. Gentlemen ransomware is delivered through affiliations with LockBit and Qilin operations, enhancing its technical capabilities. Gentlemen ransomware targets manufacturing, technology, healthcare, professional services, and retail sectors, with over 800 claimed attacks, particularly in the United States and Europe.
Monitor for unexpected kernel-driver services and sudden security-process exits.
Block identified SHA-256 hashes and update all drivers to the latest versions.
Implement strict monitoring of Microsoft Defender configurations and event logs.
Conduct regular threat hunting for BYOVD techniques and ransomware activity.
Midnight Mimosa pre-installed malware targets low-cost Android devices globally
Midnight Mimosa is a pre-installed Android malware campaign that operates with system-level privileges to silently install and remove apps, grant permissions, and execute remote code. Midnight Mimosa uses a system app, com[.]android.system.lite, and other system-sounding names to disguise its presence, leveraging a native library (libeasy[.]so) to decrypt and drop an obfuscated Java framework into the system-uid process. Midnight Mimosa disables the Google Play Store or Play Protect before installing payloads, fetches remote configurations from command-and-control servers, and loads stage-2 and stage-3 DEX plugins for ad fraud and botnet monetization. Midnight Mimosa is embedded in device firmware before sale, making removal impossible without firmware-level intervention, and is distributed on low-cost or counterfeit devices, often using names like "S24 Ultra" or "i17 Pro Max." Midnight Mimosa has impacted thousands of devices across more than 150 countries, with the highest prevalence in Mexico, France, Italy, the US, Germany, Brazil, and Spain. The App Anomaly Detection tool identified Midnight Mimosa by analyzing app behavior, and defenders are advised to block C2 servers such as api[.]weatherlive[.]world and oss[.]showtimetool[.]com, and to educate users about the risks of purchasing low-cost or counterfeit devices, encouraging purchases from reputable sources.
BYOVD tactics industrialize EDR evasion for ransomware groups
Bring Your Own Vulnerable Driver (BYOVD) tactics represent a class of techniques where ransomware groups deploy vulnerable drivers to disable Endpoint Detection and Response (EDR) systems. BYOVD tools such as Terminator, AvNeutralizer, and EDRKillShifter are sold and distributed across multiple ransomware groups, including Medusa Locker, LockBit, Black Basta, AvosLocker, BlackCat, and Trigona. BYOVD tools operate by installing vulnerable drivers, registering kernel services, and issuing commands to terminate security processes, leveraging shared infrastructure and code reuse. Ransomware actors distribute these tools via commercialized service models, making EDR-killing capabilities more accessible and scalable. BYOVD tactics have impacted organizations globally by enabling efficient and widespread EDR evasion.
Recommended actions include monitoring for driver loads and termination patterns, using Sysmon and other logging tools to track event IDs related to driver installations and service creations, establishing alerts for unusual driver signatures, conducting regular threat hunting, and ensuring all systems are updated with the latest security patches.
Miasma npm worm variant arms 42 GitHub repositories for credential theft
Miasma-family npm worm is a worm variant arming 42 GitHub repositories with a stealthy payload designed to evade detection and steal credentials. Miasma-family npm worm uses large payload blobs to evade GitHub code search, exploits CVE-2026-41940 for authentication bypass in cPanel and WHM, and plants execution hooks for AI coding assistants and development tools such as Claude, Gemini, Cursor, and VS Code. Miasma-family npm worm decrypts and launches payloads using a compiled native add-on, checks for CI runners, and can pull loaders from the operator's GitHub account, linking to a shellpanel scanner used in large-scale GitHub Actions exploitation. Miasma-family npm worm spreads by compromising repositories and CI configurations, with the CementBeetleSteeple account hosting 17 campaign repositories and connecting to the testmetest victim cluster through artifacts and workflows. Miasma-family npm worm targets developers and organizations using GitHub and AI coding tools, with JFrog researchers confirming real-world impact.
Top Vulnerabilities Reported This Month
CVE-2026-109618 and CVE-2026-109619 trigger emergency response in PHP-powered environments
CVE-2026-109618 is an out-of-memory execution flaw and CVE-2026-109619 is a stale global state vulnerability, both affecting PHP-based websites and applications, including WordPress, which powers over 40% of global websites. Successful exploitation of CVE-2026-109618 and CVE-2026-109619 enables remote code execution, memory manipulation, server compromise, credential theft, and administrative session hijacking. Proof-of-concept leaks led to active exploitation and global shutdowns of vulnerable systems, with emergency patches released by PHP maintainers. Researchers from Wiz and Calif discovered CVE-2026-109618 and CVE-2026-109619 using AI-assisted methods. Administrators are instructed to immediately apply emergency patches, restart affected server processes, monitor for exploitation attempts, and implement additional security measures until full remediation is achieved. The vulnerabilities have had significant impact on government portals and critical digital infrastructure due to the widespread use of PHP.
CVE-2026-20131 and CVE-2026-20079 exploited in Cisco Secure Firewall Management Center
CVE-2026-20131 and CVE-2026-20079 are unauthenticated remote code execution vulnerabilities in Cisco Secure Firewall Management Center, both carrying a CVSS score of 10.0. CVE-2026-20131 enables attackers to execute arbitrary code as root by sending a crafted serialized Java object, while CVE-2026-20079 allows authentication bypass due to an improperly configured system process. CVE-2026-20131 has been actively exploited in the wild as a zero-day by the Interlock ransomware group, and CVE-2026-20079 was observed in the wild in August 2026. Amazon's MadPot sensor network detected exploitation of CVE-2026-20131 before Cisco's public disclosure. Administrators should upgrade to fixed releases (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0), deploy Snort rules 66082/66083 (CVE-2026-20131) and 66075-66080 (CVE-2026-20079), and restrict management interface exposure. Exploitation can compromise both the management interface and managed Firepower Threat Defense devices.
CVE-2026-111497 actively exploited in Google Brotli and dependent platforms
CVE-2026-111497 is a critical out-of-bounds write (buffer overflow) vulnerability in the Google Brotli decoder, affecting versions 1.0.3 through 1.2.0 and brotlicffi 1.2.0.x, with a CVSS score of 9.2. Successful exploitation of CVE-2026-111497 allows remote attackers to achieve arbitrary code execution, memory disclosure, denial of service, or system takeover by sending specially crafted Brotli-compressed streams. CVE-2026-111497 is actively exploited in the wild, with public exploits detected and its inclusion in the CISA Known Exploited Vulnerabilities Catalog confirming ongoing attacks. The vulnerability was highlighted by multiple agencies, including the U.S. CISA, Canadian Centre for Cyber Security, and the UK NCSC, and affects a wide range of technologies such as Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, Python Brotli, and brotlicffi packages. Agencies recommend upgrading Brotli to version 1.2.1 or later, brotlicffi to 1[.]2[.]1[.]0 or later, and Node.js to versions 22.23.4, 24.22.1, or 26.12.1, as well as monitoring systems for unexpected crashes or suspicious activity and reporting incidents via My Cyber Portal or contact[@]cyber[.]gc[.]ca. Organizations are also advised to remove 'br' from Accept-Encoding headers, prevent processing of Brotli-compressed content from untrusted sources, and apply all relevant vendor updates promptly.
CVE-2026-88771 and CVE-2026-88779 actively exploited in Citrix NetScaler ADC appliances with persistent attacker access
CVE-2026-88771 and CVE-2026-88779 are critical vulnerabilities in Citrix NetScaler ADC appliances, involving a pre-authentication log-poisoning/remote code execution issue and a SAML-parsing crash, respectively. Exploitation of CVE-2026-88771 and CVE-2026-88779 enables attackers to achieve root code execution, deploy PHP web shells, and establish persistent access using dropper versions such as 17447d[.]sh, 1[.]sh, 2[.]sh, and r[.]sh, each with unique SHA-256 hashes. Attackers maintain persistence through cron jobs, tunneling mechanisms, and repeated post-reboot execution, with IOCs including file paths like /nsconfig/.slap/, /flash/.nsvm/, and /var/tmp/.ux/. The vulnerabilities have been actively exploited, with attackers evolving payloads and leveraging multiple persistence mechanisms. Administrators must apply patches for both CVE-2026-88771 and CVE-2026-88779, monitor for the listed IOCs, and implement network segmentation and enhanced monitoring. Regular security audits and vulnerability assessments are recommended to detect and prevent further compromise.
CVE-2026-104935 actively exploited in Ivanti Connect Secure appliances
CVE-2026-104935 is a zero-day authentication bypass vulnerability in Ivanti Connect Secure, enabling unauthorized root access on fully patched appliances. CVE-2026-104935 allows attackers to bypass authentication and execute remote code, resulting in credential theft and network compromise. CVE-2026-104935 has been actively exploited in the wild, with exploitation involving a race condition and the use of the welcome.cgi script and wu.cgi upload handler to execute a Perl script, followed by privilege escalation via DSCache modification. UTA0576 leveraged anti-forensics techniques, including log tampering and payload cleanup, to conceal exploitation of CVE-2026-104935. Ivanti recommends immediate patching to versions 25[.]1[.]1[.]2, 25[.]1[.]3[.]0, or 22.8R2.5, monitoring for high volumes of welcome.cgi requests, and inspecting temporary directories for unexpected scripts. The exploit modifies code only in memory, evading detection by Ivanti’s Integrity Checker Tool.
Top Threat Actors Reported This Month
Integrity Technology Group (Flax Typhoon, Ethereal Panda, Red Juliett) exploits global critical infrastructure with advanced toolset
Integrity Technology Group (also tracked as Flax Typhoon, Ethereal Panda, and Red Juliett) is a Chinese state-sponsored threat actor primarily motivated by cyber espionage and strategic disruption. Integrity Technology Group leveraged tools such as MicroScan, FishHub, EBurst, BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, and wpscan to exploit vulnerabilities including CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894. Integrity Technology Group used MicroScan for vulnerability scanning, FishHub for spear-phishing and data exfiltration, and EBurst for password spraying against Microsoft Exchange servers, while maintaining persistence via VPNs and scheduled scripts. Integrity Technology Group targeted U.S. government agencies, critical manufacturing, healthcare, educational institutions, power companies, airports, universities, and organizations in Southeast Asia, Africa, and North America. The FBI disrupted Integrity Technology Group's operations by seizing malicious domains, and the group's activities have previously resulted in sanctions by the U.S., UK, and EU. Organizations are advised to monitor for unusual network activity, disable unnecessary services, enforce multifactor authentication, implement sandbox detection, conduct regular security audits and vulnerability assessments, and review joint advisories for defanged indicators of compromise.
VAPOR PANDA escalates AI-driven global espionage with ARTEX and DeepSeek LLM
VAPOR PANDA, a suspected Chinese state-sponsored threat actor, is conducting a global cyber espionage campaign targeting foreign ministries, defense, telecommunications, pharmaceuticals, and semiconductor sectors. VAPOR PANDA leverages the ARTEX platform in conjunction with DeepSeek LLM and a second commercial LLM to automate intrusions, employing tactics such as SAML assertion chaining, exploitation of XXE flaws, and VPN configuration abuse. VAPOR PANDA deploys the BLOODALCHEMY backdoor via legitimate binaries, uses web shells, abuses cloud services, and leverages unrotated authentication keys to maintain persistent access and evade detection. VAPOR PANDA has targeted over 200 organizations across Latin America, Europe, Asia, and the Middle East, coordinating multiple simultaneous intrusions with advanced technological sophistication. The campaign began on October 17, 2026, and demonstrates rapid, scalable attacks across diverse targets.
Recommended actions include rotating signing keys and service credentials after suspected data exposure, enforcing SAML signature validation, restricting cloud roles' permissions, hunting for ARTEX markers, patching internet-facing appliances, and deploying advanced EDR agents across the environment.
Volt Typhoon leverages Silent Train framework to target U.S. critical infrastructure
Volt Typhoon (also tracked as Bronze Silhouette), a Chinese state-sponsored threat actor, is focused on cyber espionage and disruption of U.S. critical infrastructure. Volt Typhoon deploys the Silent Train framework, which uses a relay network of compromised Intelbras modems, Netgear Orbi devices, routers, and IT management tools to conceal attack origins and maintain persistence. Volt Typhoon exploits zero-day vulnerabilities in edge and management infrastructure, steals credentials, and uses temporary SSH services and 'live off the land' utilities, removing traces after operations. Volt Typhoon targets energy, communications, and transportation sectors, with a specific focus on regions such as Hawaii, California, and Texas. Recent campaigns involve targeting Energy Department facilities and utility providers, using brief, managed connections and dismantling paths post-operation to evade detection.
Recommended actions include strengthening security around centralized management systems, restricting internet access to administrative interfaces, rapidly patching vulnerabilities, centralizing logs, monitoring for unusual administrative activity, and following CISA and NCSC guidance.
Star Blizzard (FSB-linked) escalates global phishing campaigns with CosmicPulse and RedFlick malware
Star Blizzard (also known as a Russian state-sponsored group linked to the FSB) is engaged in cyber espionage and information operations targeting organizations worldwide. Star Blizzard exploits hacked WordPress and cPanel accounts to send phishing emails, delivering the CosmicPulse backdoor and RedFlick malware, and has shifted from free email services to compromised infrastructure for increased credibility. Star Blizzard targets NGOs, think tanks, and government organizations, with a focus on the U.S., U.K., and Ukraine. Star Blizzard's campaigns use lures such as fake event invitations and tax audit notices, with malware infection flows requiring minimal user interaction and establishing persistence via scheduled tasks. Researchers observed at least 13 significant campaigns in 2026, affecting over 100 organizations and demonstrating a strategic enhancement in operational capabilities.
Storm-0940 leverages ARTEX AI for rapid supply chain attacks via ConnectWise compromise
Storm-0940 (China-state aligned) conducts cyber espionage and supply chain attacks using the ARTEX AI framework to automate offensive operations. Storm-0940 utilizes ARTEX, an open-source penetration testing tool, to orchestrate password spraying campaigns and exploit ConnectWise application identities, achieving privileged access to cloud infrastructures in under three hours. Storm-0940 targets sectors including aerospace, defense, automotive, government agencies, banks, manufacturers, and technology firms. Storm-0940 exploited ConnectWise applications to compromise over 2,250 Microsoft 365 tenants, bypassing interactive logins and establishing persistent access through OAuth application identities. The campaign involved over 151,000 failed sign-in attempts between October 10 and 14, 2026, with the breach publicly reported on October 16, 2026. Researchers observed Storm-0940 using user agents such as Python-urllib/3.12 and curl/7.88.1, and IP addresses like 144.172.64[.]99 and 144.172.64[.]128.
Frequently Asked Questions
How does SafePay ransomware operate and which sectors does it target? SafePay ransomware is a double extortion ransomware operation that exfiltrates data, encrypts files, and demands cryptocurrency ransoms from victims. SafePay disables security protections, backup services, and network storage devices, uses ChaCha20 and RSA hybrid encryption, and appends the .SafePay extension to files.
What techniques does Gentlemen ransomware use to disable security software? Gentlemen ransomware is a Russian-speaking ransomware-as-a-service (RaaS) operation that uses a bring-your-own-vulnerable-driver (BYOVD) technique to disable security software and facilitate file encryption. Gentlemen ransomware exploits vulnerabilities in Lenovo’s BootRepair.sys and Safetica’s ProcessMonitorDriver to terminate security processes, disables Microsoft Defender, clears event logs, and removes PowerShell command histories.
What is Midnight Mimosa and how does it affect Android devices? Midnight Mimosa is a pre-installed Android malware campaign that operates with system-level privileges to silently install and remove apps, grant permissions, and execute remote code. Midnight Mimosa uses a system app, com[.]android.system.lite, and other system-sounding names to disguise its presence, leveraging a native library (libeasy[.]so) to decrypt and drop an obfuscated Java framework into the system-uid process.
What are CVE-2026-109618 and CVE-2026-109619 and how do they impact PHP-powered environments? CVE-2026-109618 is an out-of-memory execution flaw and CVE-2026-109619 is a stale global state vulnerability, both affecting PHP-based websites and applications, including WordPress, which powers over 40% of global websites. Successful exploitation of CVE-2026-109618 and CVE-2026-109619 enables remote code execution, memory manipulation, server compromise, credential theft, and administrative session hijacking.
How is CVE-2026-20131 exploited in Cisco Secure Firewall Management Center? CVE-2026-20131 and CVE-2026-20079 are unauthenticated remote code execution vulnerabilities in Cisco Secure Firewall Management Center, both carrying a CVSS score of 10.0. CVE-2026-20131 enables attackers to execute arbitrary code as root by sending a crafted serialized Java object, while CVE-2026-20079 allows authentication bypass due to an improperly configured system process.
What is the Integrity Technology Group and what are its recent activities? Integrity Technology Group (also tracked as Flax Typhoon, Ethereal Panda, and Red Juliett) is a Chinese state-sponsored threat actor primarily motivated by cyber espionage and strategic disruption. Integrity Technology Group leveraged tools such as MicroScan, FishHub, EBurst, BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, and wpscan to exploit vulnerabilities including CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894.