Summary
This week’s threat intelligence briefing from Cyware spotlights a surge in coordinated attacks targeting critical infrastructure, enterprise appliances, and financial institutions worldwide. Multiple ransomware and remote access campaigns leveraged both newly disclosed and previously known vulnerabilities, with attackers employing advanced evasion techniques and automation to maximize impact. The exploitation of zero-day vulnerabilities in widely deployed products, combined with the use of AI-assisted malware redeployment and industrialized EDR evasion, underscores the increasing sophistication and scale of cyber threats observed across sectors.
Threat actors linked to China, Russia, and North Korea, as well as financially motivated groups, were active across multiple campaigns, exploiting authentication bypasses, deploying custom implants, and orchestrating large-scale credential theft and fraud. The week’s activity demonstrates a persistent focus on compromising trusted infrastructure and sensitive data, with attackers rapidly adapting to new defenses and leveraging public proof-of-concept exploits. Organizations are urged to prioritize patching, enhance monitoring for advanced TTPs, and strengthen defenses against both targeted and opportunistic attacks.
Top Malware Reported This Week
Warlock ransomware targets critical infrastructure via SharePoint exploits
Warlock ransomware is a China-linked ransomware strain deployed by the Longlegs threat actor to disrupt critical infrastructure sectors, including water, telecommunications, government, and education. Warlock ransomware leverages DLL sideloading, living-off-the-land techniques, and Visual Studio Code tunneling to evade detection and disable security tools. Warlock ransomware exploits Microsoft SharePoint Server vulnerabilities such as CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 to deploy webshells and obtain ASP[.]NET machine keys for remote code execution. Warlock ransomware propagates through the victim's SYSVOL infrastructure using the Distributed File System Replication service (dfsrs.exe). Warlock ransomware has targeted organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America.
Recommended actions include patching SharePoint vulnerabilities, monitoring for unusual SharePoint processes and credential enumeration, tampering with security controls, and implementing multi-layered defense strategies.
BYOVD tactics industrialize EDR evasion for ransomware groups
Bring Your Own Vulnerable Driver (BYOVD) tactics represent a class of techniques where ransomware groups deploy vulnerable drivers to disable Endpoint Detection and Response (EDR) systems. BYOVD tools such as Terminator, AvNeutralizer, and EDRKillShifter are sold and distributed across multiple ransomware groups, including Medusa Locker, LockBit, Black Basta, AvosLocker, BlackCat, and Trigona. BYOVD tools operate by installing vulnerable drivers, registering kernel services, and issuing commands to terminate security processes, leveraging shared infrastructure and code reuse. Ransomware actors distribute these tools via commercialized service models, making EDR-killing capabilities more accessible and scalable. BYOVD tactics have impacted organizations globally by enabling efficient and widespread EDR evasion.
Recommended actions include monitoring for driver loads and termination patterns, using Sysmon and other logging tools to track event IDs related to driver installations and service creations, establishing alerts for unusual driver signatures, conducting regular threat hunting, and ensuring all systems are updated with the latest security patches.
PEERSTITCH FortiGate implant leverages Fortinet vulnerabilities for covert access
PEERSTITCH is a memory-resident ARM64 malware implant that targets FortiGate appliances, providing attackers with stealthy remote access and advanced anti-forensics capabilities. PEERSTITCH uses components such as lldprx, pM.js, index.js, index.wasm, and ipssem.js to perform process memory patching and covert inter-process communication. PEERSTITCH exploits FortiManager and FortiOS vulnerabilities CVE-2024-47575 and CVE-2025-61624, impersonating the FortiManager platform and using Apache mod_md to establish reverse shells. PEERSTITCH enables attackers to issue commands to managed firewalls and maintain persistence without leaving binaries on disk. PEERSTITCH has been observed targeting telecommunications organizations.
Recommended actions include blocking IPs 23[.]240[.]77[.]233, 47[.]18[.]167[.]159, 45[.]32[.]41[.]202, and 198[.]199[.]122[.]22; scanning for indicators such as lldprx, pM.js, index.js, index.wasm, and ipssem.js; inspecting /proc/<pid>/maps for RWX regions; monitoring /proc/<pid>/mem access; auditing configuration revisions for traversal strings; and ensuring Fortinet appliances are updated to the latest firmware versions.
XWorm RAT expands surveillance capabilities with new plugins
XWorm RAT is a Windows-based Remote Access Trojan that has evolved into a comprehensive surveillance platform with support for 46 plugins, up from 35 in July 2025. XWorm RAT enables location tracking via the Maps plugin, live audio streaming through the Microphone plugin, and browser session hijacking with the HBrowser plugin, bypassing multi-factor authentication. XWorm RAT executes commands over an AES-encrypted channel, providing attackers with full remote control and enhanced evasion. XWorm RAT spreads through its expanded plugin architecture and has surged in activity following the public release of a cracked builder and leaked source code. XWorm RAT has impacted over 1,200 incidents across 100 organizations in Q3 2026.
Recommended actions include implementing network segmentation, deploying endpoint detection and response (EDR) solutions, regularly updating and patching systems, conducting security awareness training, utilizing threat intelligence feeds to update blocklists, and monitoring network traffic for anomalies indicative of RAT activity.
Aoki infostealer targets AI coding assistant credentials and session tokens
Aoki, also known as Aokigahara, is an infostealer that exfiltrates credentials and session files from AI coding assistants such as Claude, Codex, Cursor, and Gemini, as well as data from browsers, cryptocurrency wallets, gaming applications, and VPNs. Aoki collects Discord tokens, Telegram session data, Outlook passwords, cookies, autofill data, and credit card information, enabling attackers to perform LLMjacking and operate under legitimate user identities. Aoki exfiltrates data via its command-and-control server using a /gate endpoint, often through domains like dobeqnesmot[.]cc and IPs such as 185[.]141[.]216[.]194. Aoki operates without a backdoor command list, stealing whatever data is available from infected systems. Aoki has no known links to existing malware families and targets a broad range of platforms and applications.
Recommended actions include monitoring and blocking identified IOCs such as dobeqnesmot[.]cc and 185[.]141[.]216[.]194, implementing strict access controls, regularly rotating API keys and tokens for AI coding assistants, enhancing monitoring for unusual data exfiltration, conducting regular security audits, and educating users on credential theft risks.
Top Vulnerabilities Reported This Week
CVE-2026-104935 actively exploited in Ivanti Connect Secure appliances
CVE-2026-104935 is a zero-day authentication bypass vulnerability in Ivanti Connect Secure, enabling unauthorized root access on fully patched appliances. CVE-2026-104935 allows attackers to bypass authentication and execute remote code, resulting in credential theft and network compromise. CVE-2026-104935 has been actively exploited in the wild, with exploitation involving a race condition and the use of the welcome.cgi script and wu.cgi upload handler to execute a Perl script, followed by privilege escalation via DSCache modification. UTA0576 leveraged anti-forensics techniques, including log tampering and payload cleanup, to conceal exploitation of CVE-2026-104935. Ivanti recommends immediate patching to versions 25[.]1[.]1[.]2, 25[.]1[.]3[.]0, or 22.8R2.5, monitoring for high volumes of welcome.cgi requests, and inspecting temporary directories for unexpected scripts. The exploit modifies code only in memory, evading detection by Ivanti’s Integrity Checker Tool.
CVE-2026-35616 exploited in Fortinet FortiClient EMS with public PoC available
CVE-2026-35616 is a critical authentication bypass vulnerability in Fortinet FortiClient EMS versions 7.4.5 through 7.4.6, with a public proof-of-concept exploit available. CVE-2026-35616 enables unauthenticated attackers to access protected API endpoints and potentially execute unauthorized code on managed endpoints. CVE-2026-35616 has been actively exploited since at least March 31, 2026, with exploitation facilitated by a Python script exploiting certificate-based authentication issues via the spoofed X-SSL-CLIENT-VERIFY header. Bishop Fox identified the root cause of CVE-2026-35616, and Fortinet published advisory FG-IR-26-099 in response. Organizations should upgrade to FortiClient EMS 7.4.7 or later, apply hotfixes for 7.4.5 and 7.4.6, and restrict EMS management interfaces to trusted networks.
CVE-2026-102764 zero-day exploited in BeyondTrust Remote Support by ARMORY CASTLE
CVE-2026-102764 is a critical improper origin validation vulnerability in BeyondTrust Remote Support, affecting all versions up to 26.2.3. CVE-2026-102764 allows remote attackers to perform file operations without credentials, leading to host-level control and access to stored credentials. CVE-2026-102764 was exploited as a zero-day by the China-nexus espionage group ARMORY CASTLE, with initial exploitation on August 29 and discovery on September 28, and attackers used the zz-root-persist script and modified the /etc/sudoers file for persistence. Attackers leveraged the bt-secrets tool, deployed web shells, and altered appliance configurations to facilitate data exfiltration. BeyondTrust advises immediate application of patch BT26-05-RS, rebuilding compromised appliances from clean images, and rotating credentials only after patching.
CVE-2026-76519 actively exploited in Cisco Secure Email Gateway
CVE-2026-76519 is a critical unauthenticated command execution vulnerability in Cisco Secure Email Gateway, with a CVSS score of 9.8. CVE-2026-76519 enables attackers to write arbitrary files and execute commands with root privileges on affected devices. CVE-2026-76519 has been actively exploited, with exploitation requiring activation of Cisco AMP's File Reputation service and use of Content Scanner Tools versions older than 25.3.0.5525. Exploitation involves sending emails with specially crafted attachments to trigger file writing and command execution. Cisco recommends updating to AsyncOS version 16.5.0-780 or later, ensuring Content Scanner Tools is at least version 25.3.0.5525, and reviewing system logs for signs of exploitation.
CVE-2026-0322 exploited in Palo Alto Networks PAN-OS for root code execution
CVE-2026-0322 is a critical code injection vulnerability (CWE-94) in Palo Alto Networks PAN-OS, affecting PA-Series, VM-Series firewalls, and Panorama. CVE-2026-0322 allows authenticated attackers with network access to execute arbitrary code as root, enabling unauthorized manipulation of firewall configurations and potential data access. CVE-2026-0322 has been actively exploited, with attackers leveraging weak management-access hygiene, such as stolen admin credentials or exposed management interfaces. The US CISA mandated a fix by October 17, and Palo Alto Networks has released patches for PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2. Organizations should preserve evidence before making changes, restrict management interface access, and enable Threat IDs 510046 and 510047 with SSL decryption.
Top Threat Actors Reported This Week
Midnight Blizzard leverages AI for malware redeployment in government and industrial sector attacks
Midnight Blizzard (also tracked as APT29 or Nobelium) is a Russian state-linked threat actor primarily motivated by cyber espionage. Midnight Blizzard utilized AI-assisted techniques to modify and redeploy malware, employing PowerShell-based ChocoShell and Go-based CornFlake backdoors, and exploited Microsoft 365 access via device-code phishing using the Embassy Kit framework. Midnight Blizzard targeted government and industrial sectors, compromising cloud credentials and trusted infrastructure. The campaign began with device-code phishing, followed by PowerShell and Go malware deployment, with staging infrastructure at 213[.]145[.]86[.]112. ReversingLabs, Anthropic, and Microsoft independently observed and analyzed the campaign, which involved browser credential theft and persistence via %LOCALAPPDATA%\svchost32.exe. Recommended actions include blocking 213[.]145[.]86[.]112 and associated domains, reviewing Microsoft Entra ID sign-ins for device-code authentication, blocking the device-code flow with Conditional Access, monitoring for identified file hashes, and enhancing detection for AI-assisted code modification.
Flax Typhoon exploits multiple vulnerabilities to target critical infrastructure worldwide
Flax Typhoon is a China-linked threat actor believed to be focused on cyber espionage and disruption of critical infrastructure. Flax Typhoon exploited vulnerabilities including CVE-2015-3306 (ProFTPD), CVE-2021-3199 (ONLYOFFICE Docs), CVE-2023-22894 (Strapi), CVE-2016-3081 (Apache Struts), and CVE-2015-5477 (ISC BIND), using scanning tools, cross-site scripting, and password spraying on Microsoft Exchange servers, and established persistence via VPN software. Flax Typhoon targeted critical infrastructure networks across multiple countries, including the U.S., U.K., Australia, Canada, Japan, New Zealand, and Spain. The campaign involved unauthorized access, email and credential exfiltration, and the use of scripts for persistence. CISA and international partners issued a joint advisory, mandating patching of these vulnerabilities by October 11, 2026, implementing temporary workarounds where patches are unavailable, enhancing monitoring for exploitation attempts, reviewing logs for anomalies, and prioritizing remediation based on asset criticality.
FAMOUS CHOLLIMA infiltrates U.S. organizations with fraudulent IT worker scheme
FAMOUS CHOLLIMA (linked to the DPRK RevGen: Domestic Enabler Initiative) is a North Korea-affiliated threat actor focused on revenue generation through fraudulent employment. FAMOUS CHOLLIMA placed overseas operatives in U.S. organizations by redirecting employer-issued laptops, spoofing device hashes, and reusing disguised devices, with methods including fraudulent police reports and last-minute relocation claims. FAMOUS CHOLLIMA targeted over 70 U.S. employers across multiple industries, generating approximately $3 million in illicit revenue. The campaign was disrupted by the FBI and CrowdStrike, resulting in arrests and exposure of U.S.-based facilitators. Organizations are advised to enhance hiring verification processes, monitor device delivery to prevent fraud, and conduct thorough endpoint telemetry and identity investigations to detect similar schemes.
Kimsuky distributes Funhouse ransomware and Quasar RAT via malicious Hangul documents
Kimsuky is a North Korea-linked threat actor primarily engaged in cyber espionage and ransomware deployment. Kimsuky shifted from LNK files to malicious Hangul HWP documents to deliver multi-stage scripts, Quasar RAT, and Funhouse ransomware, with infection chains involving script execution in the %TEMP% directory and installation of Quasar RAT with mutex '_QQ_XCZ_VCXZ'. Kimsuky targeted South Korean organizations, leveraging resume-themed documents to evade suspicion. The campaign involved the download and execution of multiple scripts, leading to ransomware deployment and remote access tool installation. Recommended actions include blocking IPs 45[.]43[.]60[.]53, 45[.]95[.]186[.]232, 70[.]36[.]97[.]236; blocking URLs such as hxxp://daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/adminer/logo[.]php?au=tt and others; adding MD5 hashes 17d97e3ee3185d82812a4014444c36f3, 327617e977eefd15708568f43140e595, 3d802ceaf891ea57ecd7d1d786d96a0d, 5be7578bfe633fb268ad97a520abb4e1, 78c219a6bec5fc30f43b62e4934646eb to blocklists; ensuring systems are fully patched; and increasing monitoring across EDR, SIEM, network, and authentication logs.
Chinese-speaking actor uses ARTEX AI and Claude agents to breach South Korean banks
A Chinese-speaking threat actor, origin uncertain, is motivated by financial gain and data theft. The actor used the ARTEX AI penetration testing suite and Claude agents, leveraging DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 LLMs to conduct cyberattacks on major South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The actor exposed personal and financial data, caused system outages, and maintained infrastructure with open directories containing session histories and configuration files. The campaign resulted in data breaches and operational disruptions, with the attacker seeking to monetize stolen data via Telegram data-sales groups. Organizations are advised to review and enhance security measures focusing on AI-powered attack vectors, monitor for unusual activity, secure sensitive data, and update security protocols to mitigate similar threats.
Frequently Asked Questions
What is Warlock ransomware? Warlock ransomware is a China-linked ransomware strain deployed by the Longlegs threat actor to disrupt critical infrastructure sectors, including water, telecommunications, government, and education. Warlock ransomware leverages DLL sideloading, living-off-the-land techniques, and Visual Studio Code tunneling to evade detection and disable security tools.
What is PEERSTITCH? PEERSTITCH is a memory-resident ARM64 malware implant that targets FortiGate appliances, providing attackers with stealthy remote access and advanced anti-forensics capabilities. PEERSTITCH uses components such as lldprx, pM.js, index.js, index.wasm, and ipssem.js to perform process memory patching and covert inter-process communication.
What is XWorm RAT? XWorm RAT is a Windows-based Remote Access Trojan that has evolved into a comprehensive surveillance platform with support for 46 plugins, up from 35 in July 2025. XWorm RAT enables location tracking via the Maps plugin, live audio streaming through the Microphone plugin, and browser session hijacking with the HBrowser plugin, bypassing multi-factor authentication.
What is CVE-2026-104935? CVE-2026-104935 is a zero-day authentication bypass vulnerability in Ivanti Connect Secure, enabling unauthorized root access on fully patched appliances. CVE-2026-104935 allows attackers to bypass authentication and execute remote code, resulting in credential theft and network compromise.
What is CVE-2026-35616? CVE-2026-35616 is a critical authentication bypass vulnerability in Fortinet FortiClient EMS versions 7.4.5 through 7.4.6, with a public proof-of-concept exploit available. CVE-2026-35616 enables unauthenticated attackers to access protected API endpoints and potentially execute unauthorized code on managed endpoints.
What is CVE-2026-102764? CVE-2026-102764 is a critical improper origin validation vulnerability in BeyondTrust Remote Support, affecting all versions up to 26.2.3. CVE-2026-102764 allows remote attackers to perform file operations without credentials, leading to host-level control and access to stored credentials.
What is CVE-2026-76519? CVE-2026-76519 is a critical unauthenticated command execution vulnerability in Cisco Secure Email Gateway, with a CVSS score of 9.8. CVE-2026-76519 enables attackers to write arbitrary files and execute commands with root privileges on affected devices.
What is CVE-2026-0322? CVE-2026-0322 is a critical code injection vulnerability (CWE-94) in Palo Alto Networks PAN-OS, affecting PA-Series, VM-Series firewalls, and Panorama. CVE-2026-0322 allows authenticated attackers with network access to execute arbitrary code as root, enabling unauthorized manipulation of firewall configurations and potential data access.
What is CVE-2026-104286? CVE-2026-104286 is a critical path traversal vulnerability (CWE-22) with improper NULL byte handling (CWE-158) in Fortinet FortiMail, with a CVSS score of 9.8. CVE-2026-104286 allows unauthenticated attackers to execute commands and place files anywhere on the appliance, exposing stored emails, administrator credentials, and connected systems.
What is Midnight Blizzard? Midnight Blizzard (also tracked as APT29 or Nobelium) is a Russian state-linked threat actor primarily motivated by cyber espionage. Midnight Blizzard utilized AI-assisted techniques to modify and redeploy malware, employing PowerShell-based ChocoShell and Go-based CornFlake backdoors, and exploited Microsoft 365 access via device-code phishing using the Embassy Kit framework.