Summary
This week’s threat intelligence briefing from Cyware highlights a surge in both the sophistication and scale of cyber threats impacting organizations worldwide. The convergence of advanced malware campaigns, active exploitation of multiple critical vulnerabilities, and persistent activity from state-sponsored and financially motivated threat actors underscores the need for heightened vigilance across all sectors. Notably, several vulnerabilities with maximum CVSS scores are being exploited in the wild, while infostealer malware continues to evolve with new capabilities targeting both traditional and emerging technologies. The overlap between actor-driven campaigns and technical payloads, as seen with Midnight Blizzard, further illustrates the complex and interconnected nature of the current threat landscape. Organizations are urged to prioritize patching, enhance monitoring, and reinforce user awareness to mitigate these escalating risks.
Top Malware Reported This Week
Midnight Mimosa pre-installed malware targets low-cost Android devices globally
Midnight Mimosa is a pre-installed Android malware campaign that operates with system-level privileges to silently install and remove apps, grant permissions, and execute remote code. Midnight Mimosa uses a system app, com[.]android.system.lite, and other system-sounding names to disguise its presence, leveraging a native library (libeasy[.]so) to decrypt and drop an obfuscated Java framework into the system-uid process. Midnight Mimosa disables the Google Play Store or Play Protect before installing payloads, fetches remote configurations from command-and-control servers, and loads stage-2 and stage-3 DEX plugins for ad fraud and botnet monetization. Midnight Mimosa is embedded in device firmware before sale, making removal impossible without firmware-level intervention, and is distributed on low-cost or counterfeit devices, often using names like "S24 Ultra" or "i17 Pro Max." Midnight Mimosa has impacted thousands of devices across more than 150 countries, with the highest prevalence in Mexico, France, Italy, the US, Germany, Brazil, and Spain. The App Anomaly Detection tool identified Midnight Mimosa by analyzing app behavior, and defenders are advised to block C2 servers such as api[.]weatherlive[.]world and oss[.]showtimetool[.]com, and to educate users about the risks of purchasing low-cost or counterfeit devices, encouraging purchases from reputable sources.
Warden Stealer expands to target AI agent credentials and browser secrets
Warden Stealer is a malware-as-a-service infostealer that harvests configuration files, local tokens, and sensitive data from AI agents such as Claude, Codex, Grok, and Cursor. Warden Stealer uses oversized PE overlays to evade scanning, bypasses Application-Bound Encryption (ABE) in Chromium browsers by extracting the v20 key from memory, and injects shellcode to decrypt the v20_master_key. Warden Stealer includes its own loader and cryptocurrency clipper, enabling independent operation and credential theft. Warden Stealer is delivered through cracked software, game cheats, malvertising, and ClickFix campaigns, exploiting vulnerabilities in AI-agent configuration files and tokens. Warden Stealer targets organizations using AI tools and browsers, with technical overlaps linking it to CallbackBeaver and recent expansion to AI coding agents announced in version 1.9.
CastleStealer evolves with ABE bypass and remote command execution
CastleStealer is a C# information stealer that targets Chromium and Firefox browsers to collect saved logins, cookies, browsing history, and browser-extension data. CastleStealer employs sophisticated loaders with multiple self-decryption stages, obfuscated API resolution, sandbox checks, and bypasses Chrome’s ABE using the IElevator COM interface. CastleStealer implements a remote shell for command execution and self-deletes using a ping-delay technique after completing its activity. CastleStealer is distributed via social engineering and malicious advertisements, often leading to fraudulent Node.js installation sites. CastleStealer has expanded its post-compromise functionality and demonstrates substantial technical proficiency in stealth and anti-analysis.
Lunex Stealer distributed via ClickFix campaign compromises Ukrainian websites
Lunex Stealer is an information-stealing malware-as-a-service platform developed by Russian-speaking actors and sold to independent operators for credential theft and phishing. Lunex Stealer targets seven Chromium-based browsers and uses a browser extension, LunarAxe, to steal cookies and credentials, while the NaiveMess component enables file system access. Lunex Stealer is distributed through compromised Ukrainian websites displaying fake Cloudflare verification pages, tricking users into executing PowerShell commands that install the malware. Lunex Stealer is tracked by CERT-UA as UAC-0277 and has compromised over 100 websites, with its control panel defaulting to Russian language. Lunex Stealer enables attackers to steal passwords, authentication tokens, and cryptocurrency wallet data from affected users.
Midnight Blizzard resumes CaptiveCrunch campaign targeting hospitality Wi-Fi users
Midnight Blizzard, through its Storm-2945 subcluster, has resumed the CaptiveCrunch campaign targeting travelers via hospitality Wi-Fi networks in North America. Midnight Blizzard exploits shared equipment and management systems in captive portal ecosystems, manipulating DNS and HTTP traffic to redirect users to malicious infrastructure. Midnight Blizzard uses ClickFix-style instructions to deceive users into downloading payloads, with potential targeting of Android users through APK installation prompts. Midnight Blizzard deploys the CornFlake RAT, a Rust variant that maintains persistence via service registration and scheduled tasks, and manages implants and payloads through the FruitStone console. Midnight Blizzard has been linked to 70 affected IP addresses across major hotel chains, as identified by Microsoft and Black Lotus Labs.
Top Vulnerabilities Reported This Week
CVE-2026-20131 and CVE-2026-20079 exploited in Cisco Secure Firewall Management Center
CVE-2026-20131 and CVE-2026-20079 are unauthenticated remote code execution vulnerabilities in Cisco Secure Firewall Management Center, both carrying a CVSS score of 10.0. CVE-2026-20131 enables attackers to execute arbitrary code as root by sending a crafted serialized Java object, while CVE-2026-20079 allows authentication bypass due to an improperly configured system process. CVE-2026-20131 has been actively exploited in the wild as a zero-day by the Interlock ransomware group, and CVE-2026-20079 was observed in the wild in August 2026. Amazon's MadPot sensor network detected exploitation of CVE-2026-20131 before Cisco's public disclosure. Administrators should upgrade to fixed releases (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0), deploy Snort rules 66082/66083 (CVE-2026-20131) and 66075-66080 (CVE-2026-20079), and restrict management interface exposure. Exploitation can compromise both the management interface and managed Firepower Threat Defense devices.
CVE-2026-88771 actively exploited in Citrix NetScaler ADC and Gateway
CVE-2026-88771 is a critical unauthenticated remote root command execution vulnerability in Citrix NetScaler ADC and Gateway, with exploitation beginning on September 28, 2026. CVE-2026-88771 allows attackers to execute arbitrary commands as root by injecting attacker-controlled text into appliance logs, specifically via the User-Agent header, resulting in log injection processed as shell commands. The vulnerability is actively exploited in the wild, with over 1,069 injection attempts from 30 distinct IPs and operators using VPS, bulletproof hosts, and Tor exits to obscure origins. Multiple operators with varying goals have been identified, employing credential theft, persistent implants, and a unique log-channel C2 method. Organizations should immediately apply patches (14.1-73.37, 13.1-64.24), restrict management interfaces, deploy WAF/proxy rules, and inspect logs for injection markers.
CVE-2026-63077 under active exploitation in JetBrains TeamCity
CVE-2026-63077 is a deserialization-of-untrusted-data vulnerability in JetBrains TeamCity's agent polling protocol, with a CVSS score of 9.8 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CVE-2026-63077 allows unauthenticated attackers to execute arbitrary OS commands with server privileges, leading to full system compromise and credential theft. Ransomware gangs have actively exploited CVE-2026-63077 since early September 2026, with CISA issuing a warning on September 23, 2026. The vulnerability was privately disclosed on July 10, 2026, and patches were released on July 25, but exploitation began before widespread patching. Administrators must upgrade to TeamCity On-Premises versions 2025.11.7 or 2026.1.3+, rotate cloud credentials, review logs for compromise, and restrict network access to internal IPs or VPN.
Zero-day guest-host escape vulnerability in Linux KVM hypervisor affecting Firecracker MicroVMs
A critical zero-day full VM escape vulnerability has been identified in the Linux KVM hypervisor, specifically impacting Firecracker MicroVMs used by Vercel and created by AWS. The vulnerability enables a guest VM to take control of the host system and potentially other guest systems, resulting in severe security breaches and service disruption. This is the second significant KVM bug discovered in 2026, following the Januscape flaw. The vulnerability poses a major threat to environments using KVM, especially in public cloud and enterprise settings. Administrators should monitor for updates and patches from KVM, prepare for potential downtime during patching, and consider migrating live VMs to patched hosts to minimize exposure.
Multiple critical vulnerabilities in Dell Container Storage Modules threaten Kubernetes clusters
Dell Container Storage Modules (CSM) contain several critical vulnerabilities, including CVE-2026-63688 (missing authentication in the csm-authorization-storage gRPC server, CVSS 10.0), CVE-2026-63692 (authentication bypass, CVSS 10.0), CVE-2026-67269 (improper privilege management, CVSS 9.9), CVE-2026-54472 (hard-coded credentials, CVSS 9.8), CVE-2026-61421 (hard-coded cryptographic key, CVSS 9.8), and CVE-2026-67273 (improper neutralization of special elements, CVSS 9.6). These vulnerabilities allow unauthenticated attackers to gain administrative access and root privileges on Kubernetes nodes, compromising storage infrastructure and cluster security. Exploitation can result in full administrative control, bypassing intended security controls, and recent active exploitation of similar flaws increases urgency. Dell recommends updating to CSM version 1.18.0, rotating JWT signing secrets, and monitoring for unusual activity. All CSM versions prior to 1.17.0 are affected, with no workarounds other than updating.
Top Threat Actors Reported This Week
Integrity Technology Group (Flax Typhoon, Ethereal Panda, Red Juliett) exploits global critical infrastructure with advanced toolset
Integrity Technology Group (also tracked as Flax Typhoon, Ethereal Panda, and Red Juliett) is a Chinese state-sponsored threat actor primarily motivated by cyber espionage and strategic disruption. Integrity Technology Group leveraged tools such as MicroScan, FishHub, EBurst, BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, and wpscan to exploit vulnerabilities including CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894. Integrity Technology Group used MicroScan for vulnerability scanning, FishHub for spear-phishing and data exfiltration, and EBurst for password spraying against Microsoft Exchange servers, while maintaining persistence via VPNs and scheduled scripts. Integrity Technology Group targeted U.S. government agencies, critical manufacturing, healthcare, educational institutions, power companies, airports, universities, and organizations in Southeast Asia, Africa, and North America. The FBI disrupted Integrity Technology Group's operations by seizing malicious domains, and the group's activities have previously resulted in sanctions by the U.S., UK, and EU. Organizations are advised to monitor for unusual network activity, disable unnecessary services, enforce multifactor authentication, implement sandbox detection, conduct regular security audits and vulnerability assessments, and review joint advisories for defanged indicators of compromise.
UAC-0099 deploys MATCHBOIL malware in targeted campaigns across Ukraine’s critical sectors
UAC-0099 is a Russia-aligned threat actor focused on espionage and disruption, with a primary operational motive of targeting Ukrainian organizations. UAC-0099 deployed the MATCHBOIL C# downloader, which evolved to use Eziriz .NET Reactor obfuscation, scheduled tasks for persistence, and sandbox detection to evade defenses. UAC-0099 distributed MATCHBOIL via spearphishing emails containing malicious links that download a VBScript payload, and the malware communicates with its C&C server over HTTPS using specific HTTP headers. UAC-0099 targeted transportation, manufacturing, and energy sectors in Ukraine, with documented activity from 2024 through June 2026. UAC-0099’s campaigns involved system reconnaissance, payload installation, and persistent access, as observed by ESET researchers. Organizations should block identified IPs and domains, add file hashes to blocklists, monitor for unusual HTTPS requests, implement sandbox detection, and conduct regular security audits and vulnerability assessments.
TraderTraitor (North Korea-linked) leverages trojanized Terraform providers to target cryptocurrency sector
TraderTraitor is a North Korea-linked threat actor primarily motivated by financial gain through targeting the cryptocurrency industry. TraderTraitor used a trojanized Terraform provider masquerading as an AWS provider to deliver cross-platform malware, including FLATROOF and ROOFDECK, with payloads disguised as font files and downloaded based on the victim’s operating system. TraderTraitor’s FLATROOF backdoor employs redundant C2 channels such as Telegram Bot API, GitHub API polling, and HTTP webhooks, while Python stealers exfiltrate browser credentials, cookies, terminal history, and cryptocurrency wallet data. TraderTraitor targeted cryptocurrency organizations, with a campaign uncovered by Zscaler ThreatLabz in July 2026 overlapping with the KelpDAO incident. TraderTraitor’s infection chain involves Bash loaders and layered C2 discovery, enabling data theft and remote control. Organizations should block defanged IOCs, restrict untrusted Terraform providers, verify checksums, monitor process and network activity, implement network segmentation, conduct regular security audits, and educate employees on phishing tactics.
CL-STA-1178 (Iranian state-aligned) impersonates recruiters to deliver ShelbyLoader V2 to software engineers
CL-STA-1178 is an Iranian state-aligned threat actor focused on cyber espionage and regional disruption. CL-STA-1178 impersonated Dubai Airports recruiters, delivering ShelbyLoader V2 malware through a decoy Inno Setup installer and a malicious Visual Studio project archive. CL-STA-1178 used GitHub for command-and-control, with fallback to GitHub issues, and established persistence via a MicrosoftRuntime registry startup value and Chisel for encrypted tunnels and reverse SOCKS access. CL-STA-1178 targeted software engineers, Iraqi critical infrastructure, and an Israeli entity, demonstrating regional targeting and infrastructure overlap. CL-STA-1178’s campaign involved polling for commands, uploading host identifiers, and enabling internal network pivoting. Organizations should investigate unexpected DLL loads, monitor for unusual GitHub API traffic and registry changes, block defanged IOCs, scan for indicators, and enhance monitoring for abnormal process and network activity.
Midnight Blizzard (Storm-2945) resumes CaptiveCrunch campaign targeting hospitality Wi-Fi networks
Midnight Blizzard (also tracked as Storm-2945) is a Russia-linked threat actor primarily motivated by cyber espionage. Midnight Blizzard exploited shared equipment and management systems in North American hotel captive portal ecosystems, manipulating DNS and HTTP traffic to redirect travelers to malicious infrastructure. Midnight Blizzard used ClickFix-style instructions to deceive users into downloading payloads, with potential targeting of Android users via APK prompts, and deployed the CornFlake RAT, a Rust variant, for persistence and data collection. Midnight Blizzard targeted travelers using hospitality Wi-Fi networks, with 70 affected IP addresses linked to major hotel chains identified by Microsoft and Black Lotus Labs. Midnight Blizzard’s campaign leveraged the FruitStone console for implant management and infrastructure rotation. Organizations should correlate connectivity with suspicious downloads, monitor for persistence changes and anomalous device authentication, implement private connectivity, and reject portal-delivered software updates.
Frequently Asked Questions
What is Midnight Mimosa? Midnight Mimosa is a pre-installed Android malware campaign that operates with system-level privileges to silently install and remove apps, grant permissions, and execute remote code. Midnight Mimosa uses a system app, com[.]android.system.lite, and other system-sounding names to disguise its presence, leveraging a native library (libeasy[.]so) to decrypt and drop an obfuscated Java framework into the system-uid process.
What is Warden Stealer? Warden Stealer is a malware-as-a-service infostealer that harvests configuration files, local tokens, and sensitive data from AI agents such as Claude, Codex, Grok, and Cursor. Warden Stealer uses oversized PE overlays to evade scanning, bypasses Application-Bound Encryption (ABE) in Chromium browsers by extracting the v20 key from memory, and injects shellcode to decrypt the v20_master_key.
What is CastleStealer? CastleStealer is a C# information stealer that targets Chromium and Firefox browsers to collect saved logins, cookies, browsing history, and browser-extension data. CastleStealer employs sophisticated loaders with multiple self-decryption stages, obfuscated API resolution, sandbox checks, and bypasses Chrome’s ABE using the IElevator COM interface.
What is Lunex Stealer? Lunex Stealer is an information-stealing malware-as-a-service platform developed by Russian-speaking actors and sold to independent operators for credential theft and phishing. Lunex Stealer targets seven Chromium-based browsers and uses a browser extension, LunarAxe, to steal cookies and credentials, while the NaiveMess component enables file system access.
What is CVE-2026-20131? CVE-2026-20131 and CVE-2026-20079 are unauthenticated remote code execution vulnerabilities in Cisco Secure Firewall Management Center, both carrying a CVSS score of 10.0. CVE-2026-20131 enables attackers to execute arbitrary code as root by sending a crafted serialized Java object, while CVE-2026-20079 allows authentication bypass due to an improperly configured system process.
What is CVE-2026-88771? CVE-2026-88771 is a critical unauthenticated remote root command execution vulnerability in Citrix NetScaler ADC and Gateway, with exploitation beginning on September 28, 2026. CVE-2026-88771 allows attackers to execute arbitrary commands as root by injecting attacker-controlled text into appliance logs, specifically via the User-Agent header, resulting in log injection processed as shell commands.
What is CVE-2026-63077? CVE-2026-63077 is a deserialization-of-untrusted-data vulnerability in JetBrains TeamCity's agent polling protocol, with a CVSS score of 9.8 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CVE-2026-63077 allows unauthenticated attackers to execute arbitrary OS commands with server privileges, leading to full system compromise and credential theft.
What is CVE-2026-63688? Dell Container Storage Modules (CSM) contain several critical vulnerabilities, including CVE-2026-63688 (missing authentication in the csm-authorization-storage gRPC server, CVSS 10.0), CVE-2026-63692 (authentication bypass, CVSS 10.0), CVE-2026-67269 (improper privilege management, CVSS 9.9), CVE-2026-54472 (hard-coded credentials, CVSS 9.8), CVE-2026-61421 (hard-coded cryptographic key, CVSS 9.8), and CVE-2026-67273 (improper neutralization of special elements, CVSS 9.6). These vulnerabilities allow unauthenticated attackers to gain administrative access and root privileges on Kubernetes nodes, compromising storage infrastructure and cluster security.
What is CVE-2026-105133? CVE-2026-105133 and CVE-2026-105134 are critical vulnerabilities in AhsayCBS backup solution, allowing unauthenticated remote code execution and unauthorized access on all versions up to 10.3.4. Attackers exploit these vulnerabilities by manipulating function arguments to bypass authentication and inject OS commands, with CVE-2026-105134 enabling unauthenticated RCE via the Replication Receiver API.
What is Integrity Technology Group? Integrity Technology Group (also tracked as Flax Typhoon, Ethereal Panda, and Red Juliett) is a Chinese state-sponsored threat actor primarily motivated by cyber espionage and strategic disruption. Integrity Technology Group leveraged tools such as MicroScan, FishHub, EBurst, BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, and wpscan to exploit vulnerabilities including CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894.
What is UAC-0099? UAC-0099 is a Russia-aligned threat actor focused on espionage and disruption, with a primary operational motive of targeting Ukrainian organizations. UAC-0099 deployed the MATCHBOIL C# downloader, which evolved to use Eziriz .NET Reactor obfuscation, scheduled tasks for persistence, and sandbox detection to evade defenses.
What is TraderTraitor? TraderTraitor is a North Korea-linked threat actor primarily motivated by financial gain through targeting the cryptocurrency industry. TraderTraitor used a trojanized Terraform provider masquerading as an AWS provider to deliver cross-platform malware, including FLATROOF and ROOFDECK, with payloads disguised as font files and downloaded based on the victim’s operating system.
What is CL-STA-1178? CL-STA-1178 is an Iranian state-aligned threat actor focused on cyber espionage and regional disruption. CL-STA-1178 impersonated Dubai Airports recruiters, delivering ShelbyLoader V2 malware through a decoy Inno Setup installer and a malicious Visual Studio project archive.
What is Midnight Blizzard? Midnight Blizzard (also tracked as Storm-2945) is a Russia-linked threat actor primarily motivated by cyber espionage. Midnight Blizzard exploited shared equipment and management systems in North American hotel captive portal ecosystems, manipulating DNS and HTTP traffic to redirect travelers to malicious infrastructure.