Summary
This week’s threat landscape, as tracked by cyware.com, was shaped by the convergence of high-impact ransomware campaigns, sophisticated supply chain attacks, and a surge in critical vulnerabilities exploited across multiple sectors. Ransomware groups leveraged both newly disclosed and longstanding vulnerabilities to escalate attacks globally, while state-aligned and financially motivated threat actors targeted supply chains and critical infrastructure with advanced persistence and automation techniques. The interplay between rapid vulnerability exploitation and coordinated threat actor campaigns underscores the need for immediate patching, robust monitoring, and cross-sector vigilance.
The escalation of ransomware operations, the exploitation of supply chain weaknesses, and the active targeting of critical vulnerabilities defined a week of persistent and evolving threats. Organizations across manufacturing, technology, healthcare, government, and defense faced coordinated campaigns that combined technical sophistication with broad geographic reach.
Top Malware Reported This Week
SafePay ransomware group escalates global attacks on critical sectors
SafePay ransomware is a double extortion ransomware operation that exfiltrates data, encrypts files, and demands cryptocurrency ransoms from victims. SafePay disables security protections, backup services, and network storage devices, uses ChaCha20 and RSA hybrid encryption, and appends the .SafePay extension to files. SafePay exploits vulnerabilities including CVE-2023-20269, CVE-2020-3259, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766, and leverages brute force, credential theft, phishing, and VPN abuse (notably Mullvad) for initial access. SafePay targets manufacturing, technology, healthcare, professional services, and retail sectors, with attacks spanning North America, South America, Europe, and Australia, and has compromised over 600 organizations including Conduent Business Services and Microlise. SafePay uses legitimate tools such as AnyDesk, TeamViewer, PsExec, WinRM, Mimikatz, PowerShell, FileZilla, 7-Zip, RClone, WinRAR, WinSCP, and OneDrive for lateral movement, persistence, and data exfiltration.
Organizations should align defenses with the Cybersecurity Performance Goals (CPGs) developed by CISA and NIST.
Apply timely patches to known vulnerabilities, especially those exploited by SafePay.
Implement multi-factor authentication, robust password policies, and user access controls.
Maintain encrypted, immutable offline backups and segment networks to restrict lateral movement.
Monitor for unauthorized account creation, abnormal activity, and restrict remote desktop tool usage.
Use CISA’s Eviction Strategies Tool for systematic eviction planning.
Report incidents to relevant authorities such as the FBI, USSS, or CISA.
Gentlemen ransomware leverages BYOVD to disable security software
Gentlemen ransomware is a Russian-speaking ransomware-as-a-service (RaaS) operation that uses a bring-your-own-vulnerable-driver (BYOVD) technique to disable security software and facilitate file encryption. Gentlemen ransomware exploits vulnerabilities in Lenovo’s BootRepair.sys and Safetica’s ProcessMonitorDriver to terminate security processes, disables Microsoft Defender, clears event logs, and removes PowerShell command histories. Gentlemen ransomware achieves persistence through scheduled tasks and registry entries, and encrypts files using ChaCha20 with per-file keys, appending the .cyvzca extension. Gentlemen ransomware is delivered through affiliations with LockBit and Qilin operations, enhancing its technical capabilities. Gentlemen ransomware targets manufacturing, technology, healthcare, professional services, and retail sectors, with over 800 claimed attacks, particularly in the United States and Europe.
Monitor for unexpected kernel-driver services and sudden security-process exits.
Block identified SHA-256 hashes and update all drivers to the latest versions.
Implement strict monitoring of Microsoft Defender configurations and event logs.
Conduct regular threat hunting for BYOVD techniques and ransomware activity.
CROSSROAD and SHINYROAD malware deployed via AOMEI supply chain attack
CROSSROAD is a downloader and SHINYROAD is a backdoor deployed through a sophisticated supply chain attack on AOMEI Technology’s update infrastructure. CROSSROAD validates environments and stages secondary payloads, while SHINYROAD enables covert command and control using the Adaptix C2 framework and a modified Radmin server backdoor. Attackers used short-burst configuration tampering, WebDAV NTLM credential coercion, and shifted infrastructure from Alibaba Cloud to dedicated domains to evade detection. CROSSROAD and SHINYROAD targeted IT services and telecommunications sectors globally from April to July 2026.
Monitor for unsigned processes and unauthorized network redirection.
Implement cryptographic signatures and domain pinning.
Conduct retrospective endpoint hunting using provided IOCs and block known malicious IPs, domains, and URLs.
Use YARA rules for detection of CROSSROAD and SHINYROAD artifacts.
Top Vulnerabilities Reported This Week
PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution
CVE-2026-109618 and CVE-2026-109619 are critical use-after-free vulnerabilities in PHP installations serving web requests, each with a CVSS score of 9.2. Successful exploitation of CVE-2026-109618, triggered by an out-of-memory condition at request exit, and CVE-2026-109619, involving error, session, or extension state persisting after a request, allows unauthenticated remote code execution, arbitrary file reads, and memory disclosure. Security vendors observed exploitation attempts before public disclosure, with attackers leveraging crafted web requests to achieve code execution. The vulnerabilities were identified in PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, and agencies such as CISA and BSI have urged immediate patching. Administrators must upgrade to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart PHP-FPM pools and Apache, and disable session upload-progress tracking and OPcache to reduce exposure. The vulnerabilities impact a broad range of platforms, including WordPress and Drupal, increasing the urgency for remediation.
CVE-2026-20079 exploited in Cisco Secure Firewall Management Center via session fixation and CSRF token abuse
CVE-2026-20079 is a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center versions 7.0.x through 7.7.12 and 10.0.0–10.0.1, with a CVSS score of 10.0. Exploitation of CVE-2026-20079 allows attackers to gain root access by abusing session fixation and CSRF token manipulation, compromising firewall policies, configurations, and user credentials. Cisco PSIRT confirmed active exploitation in August 2026, with Talos tracking three actor clusters—UAT-12197, UAT-11823, and UAT-11988—engaged in deploying web shells, exfiltrating configurations, and deploying ransomware. The vulnerability was initially disclosed on March 4, 2026, with hotfixes released on July 29, 2026. Administrators must install hotfix AM-7[.]7[.]12[.]1-2 for version 7.7 and P-10[.]0[.]1[.]1-2 for version 10.0, restrict management interface access, and monitor for indicators such as /var/tmp/license.tmp and unauthorized root-level execution. Organizations should rotate credentials and monitor for Talos IOCs to detect compromise.
CVE-2026-110264 in GitLab enables unauthenticated remote code execution via integer overflow in regex compiler
CVE-2026-110264 is a critical integer overflow vulnerability in the regular expression compiler of GitLab Community and Enterprise Editions, with a CVSS score of 10.0. Exploitation of CVE-2026-110264 allows unauthenticated users to execute arbitrary code, potentially resulting in full system compromise and severe impacts on confidentiality, integrity, and availability. GitLab released an advisory on October 22, 2026, and provided detection rules to identify exploitation attempts, emphasizing the need for immediate action. The vulnerability affects GitLab versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, and the release also addressed two high, five medium, and four low severity vulnerabilities. Administrators must update to the latest patched versions, implement GitLab's detection rules, and prioritize updates for internet-facing assets. Organizations should conduct thorough assessments for compromise and ensure continuous monitoring for anomalous activities.
Multiple Linux kernel vulnerabilities disclosed, exposing systems to remote code execution and privilege escalation
Several critical vulnerabilities in the Linux kernel, with CVSS scores up to 9.0, were accidentally disclosed on a public mailing list by Trend Micro's Zero Day Initiative. Exploitation of these vulnerabilities—including integer underflow in SMB Direct (ZDI-CAN-33549), race condition in KSMBD (ZDI-CAN-33774), skbuff skb_zerocopy local privilege escalation (ZDI-CAN-33367), out-of-bounds write in VMWGFX (ZDI-CAN-34068), uninitialized resource in NVMET (ZDI-CAN-34076), and TCP query stack buffer overflow (ZDI-CAN-32005)—can result in remote code execution, local privilege escalation, and information disclosure. The vulnerabilities affect components such as SMB Direct, KSMBD, network code, VMWGFX, and NVMET, increasing the risk of unauthorized access and data breaches. The accidental public disclosure heightened the risk of exploitation before patches could be widely deployed. Greg Kroah-Hartman responded to the disclosure, underscoring the urgency of remediation. Administrators should apply patches from the Linux kernel's "-next" branches, monitor for updates, and implement temporary workarounds and enhanced monitoring until patches are applied.
CVE-2026-88771 and CVE-2026-88779 actively exploited in Citrix NetScaler ADC appliances with persistent attacker access
CVE-2026-88771 and CVE-2026-88779 are critical vulnerabilities in Citrix NetScaler ADC appliances, involving a pre-authentication log-poisoning/remote code execution issue and a SAML-parsing crash, respectively. Exploitation of CVE-2026-88771 and CVE-2026-88779 enables attackers to achieve root code execution, deploy PHP web shells, and establish persistent access using dropper versions such as 17447d[.]sh, 1[.]sh, 2[.]sh, and r[.]sh, each with unique SHA-256 hashes. Attackers maintain persistence through cron jobs, tunneling mechanisms, and repeated post-reboot execution, with IOCs including file paths like /nsconfig/.slap/, /flash/.nsvm/, and /var/tmp/.ux/. The vulnerabilities have been actively exploited, with attackers evolving payloads and leveraging multiple persistence mechanisms. Administrators must apply patches for both CVE-2026-88771 and CVE-2026-88779, monitor for the listed IOCs, and implement network segmentation and enhanced monitoring. Regular security audits and vulnerability assessments are recommended to detect and prevent further compromise.
Top Threat Actors Reported This Week
Storm-0940 leverages ARTEX AI for rapid supply chain attacks via ConnectWise compromise
Storm-0940 (China-state aligned) conducts cyber espionage and supply chain attacks using the ARTEX AI framework to automate offensive operations. Storm-0940 utilizes ARTEX, an open-source penetration testing tool, to orchestrate password spraying campaigns and exploit ConnectWise application identities, achieving privileged access to cloud infrastructures in under three hours. Storm-0940 targets sectors including aerospace, defense, automotive, government agencies, banks, manufacturers, and technology firms. Storm-0940 exploited ConnectWise applications to compromise over 2,250 Microsoft 365 tenants, bypassing interactive logins and establishing persistent access through OAuth application identities. The campaign involved over 151,000 failed sign-in attempts between October 10 and 14, 2026, with the breach publicly reported on October 16, 2026. Researchers observed Storm-0940 using user agents such as Python-urllib/3.12 and curl/7.88.1, and IP addresses like 144.172.64[.]99 and 144.172.64[.]128.
APT41 deploys BlackX bootkit in Central Asian diplomatic espionage campaign
APT41 (China-linked) is believed to be motivated by cyber espionage and has deployed the BlackX bootkit, a variant of BlackLotus, in attacks exploiting the Baton Drop vulnerability (CVE-2022-21894). APT41 installs BlackX using files such as inst.exe and PVMDIJGKAX2, leveraging RC4 encryption and custom Machine Owner Keys to bypass Secure Boot and load arbitrary EFI files. APT41 specifically targets diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. APT41's campaign in early 2026 involved injecting malicious drivers signed with revoked certificates, tampering with security solutions, and deploying payloads like OxiDLLRunner and a RAT communicating with www[.]archivetj[.]com. Researchers recommend blocking the domain www[.]archivetj[.]com and monitoring for the MD5 hash af8a983b9ada07eae1259bf2953abd40.
Lazarus Group conducts Operation FlashHole against South Korean software, construction, and communication sectors
Lazarus Group (North Korea-linked, also tracked as Hidden Cobra) is motivated by cyber espionage and financial gain, and has launched Operation FlashHole using a sophisticated malware chain. Lazarus Group employs AI-generated photos in spear-phishing emails, hijacked GitHub accounts, and abuses CrossWeb EX software to deliver malware such as TechHub, Cubridge, TouchShift, and ClientHub. Lazarus Group targets South Korean software, construction, and communication sectors. The campaign, active since July 2025, uses DLL side-loading, in-memory execution, and advanced encryption (ML-KEM-1024, Threefish) to evade detection and conceal payloads. Researchers identified C2 domains including javadevhouse[.]co[.]kr and pythonapischool[.]com, and file hashes such as ec84d6cb2ae7974767aedac246b50a3e.
Swallowtail targets NATO defense firms with credential theft and persistent SSH tunneling
Swallowtail (Russian espionage group) is believed to be motivated by cyber espionage and has targeted defense firms in two NATO countries, focusing on law enforcement, defense manufacturing, and shipbuilding sectors. Swallowtail uses macro-enabled Word documents to drop files including a VBScript launcher and batch script, which facilitate task fetching via a hidden Microsoft Edge browser instance. Swallowtail repeatedly returns to compromised hosts, stealing credentials and establishing persistent SSH tunnels. Swallowtail employs credential theft by pushing SSH private keys and deploying PowerShell scripts to capture NTLM handshakes, with payloads decrypted in memory by a reflective loader. Researchers recommend monitoring for Hookedge indicators and credential theft activity to detect Swallowtail operations.
Prince of Persia uses US-based C2 for espionage and halts operations amid geopolitical tensions
Prince of Persia (Iranian cyber threat group) is believed to be motivated by cyber espionage and has used US-based command-and-control servers for malware operations. Prince of Persia deploys malware such as Tornado, which blends with legitimate network traffic to evade firewalls and maintain covert access. Prince of Persia targets organizations in the US, Europe, and the Middle East. Prince of Persia's operations temporarily ceased following geopolitical tensions involving Iran, as reported by Semperis researchers. The malware facilitates data exfiltration, including document theft and audio capture, and employs sophisticated anti-detection techniques.
Frequently Asked Questions
What is SafePay? SafePay ransomware is a double extortion ransomware operation that exfiltrates data, encrypts files, and demands cryptocurrency ransoms from victims. SafePay disables security protections, backup services, and network storage devices, uses ChaCha20 and RSA hybrid encryption, and appends the .SafePay extension to files.
What is Gentlemen ransomware? Gentlemen ransomware is a Russian-speaking ransomware-as-a-service (RaaS) operation that uses a bring-your-own-vulnerable-driver (BYOVD) technique to disable security software and facilitate file encryption. Gentlemen ransomware exploits vulnerabilities in Lenovo’s BootRepair.sys and Safetica’s ProcessMonitorDriver to terminate security processes, disables Microsoft Defender, clears event logs, and removes PowerShell command histories.
What is CROSSROAD? CROSSROAD is a downloader and SHINYROAD is a backdoor deployed through a sophisticated supply chain attack on AOMEI Technology’s update infrastructure. CROSSROAD validates environments and stages secondary payloads, while SHINYROAD enables covert command and control using the Adaptix C2 framework and a modified Radmin server backdoor.
What is SHINYROAD? CROSSROAD is a downloader and SHINYROAD is a backdoor deployed through a sophisticated supply chain attack on AOMEI Technology’s update infrastructure. CROSSROAD validates environments and stages secondary payloads, while SHINYROAD enables covert command and control using the Adaptix C2 framework and a modified Radmin server backdoor.
What is CVE-2026-109618? CVE-2026-109618 and CVE-2026-109619 are critical use-after-free vulnerabilities in PHP installations serving web requests, each with a CVSS score of 9.2. Successful exploitation of CVE-2026-109618, triggered by an out-of-memory condition at request exit, and CVE-2026-109619, involving error, session, or extension state persisting after a request, allows unauthenticated remote code execution, arbitrary file reads, and memory disclosure.
What is CVE-2026-109619? CVE-2026-109618 and CVE-2026-109619 are critical use-after-free vulnerabilities in PHP installations serving web requests, each with a CVSS score of 9.2. Successful exploitation of CVE-2026-109618, triggered by an out-of-memory condition at request exit, and CVE-2026-109619, involving error, session, or extension state persisting after a request, allows unauthenticated remote code execution, arbitrary file reads, and memory disclosure.
What is CVE-2026-20079? CVE-2026-20079 is a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center versions 7.0.x through 7.7.12 and 10.0.0–10.0.1, with a CVSS score of 10.0. Exploitation of CVE-2026-20079 allows attackers to gain root access by abusing session fixation and CSRF token manipulation, compromising firewall policies, configurations, and user credentials.
What is CVE-2026-110264? CVE-2026-110264 is a critical integer overflow vulnerability in the regular expression compiler of GitLab Community and Enterprise Editions, with a CVSS score of 10.0. Exploitation of CVE-2026-110264 allows unauthenticated users to execute arbitrary code, potentially resulting in full system compromise and severe impacts on confidentiality, integrity, and availability.
What is CVE-2026-88771? CVE-2026-88771 and CVE-2026-88779 are critical vulnerabilities in Citrix NetScaler ADC appliances, involving a pre-authentication log-poisoning/remote code execution issue and a SAML-parsing crash, respectively. Exploitation of CVE-2026-88771 and CVE-2026-88779 enables attackers to achieve root code execution, deploy PHP web shells, and establish persistent access using dropper versions such as 17447d[.]sh, 1[.]sh, 2[.]sh, and r[.]sh, each with unique SHA-256 hashes.
What is CVE-2026-88779? CVE-2026-88771 and CVE-2026-88779 are critical vulnerabilities in Citrix NetScaler ADC appliances, involving a pre-authentication log-poisoning/remote code execution issue and a SAML-parsing crash, respectively. Exploitation of CVE-2026-88771 and CVE-2026-88779 enables attackers to achieve root code execution, deploy PHP web shells, and establish persistent access using dropper versions such as 17447d[.]sh, 1[.]sh, 2[.]sh, and r[.]sh, each with unique SHA-256 hashes.
What is CVE-2026-0257? CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS and Prisma Access, with a CVSS score of 7.8. Exploitation of CVE-2026-0257 allows attackers to establish unauthorized VPN connections, bypass multi-factor authentication, and deploy ransomware, leading to unauthorized access and lateral movement within corporate networks.
What is Storm-0940? Storm-0940 (China-state aligned) conducts cyber espionage and supply chain attacks using the ARTEX AI framework to automate offensive operations. Storm-0940 utilizes ARTEX, an open-source penetration testing tool, to orchestrate password spraying campaigns and exploit ConnectWise application identities, achieving privileged access to cloud infrastructures in under three hours.
What is APT41? APT41 (China-linked) is believed to be motivated by cyber espionage and has deployed the BlackX bootkit, a variant of BlackLotus, in attacks exploiting the Baton Drop vulnerability (CVE-2022-21894). APT41 installs BlackX using files such as inst.exe and PVMDIJGKAX2, leveraging RC4 encryption and custom Machine Owner Keys to bypass Secure Boot and load arbitrary EFI files.
What is Lazarus Group? Lazarus Group (North Korea-linked, also tracked as Hidden Cobra) is motivated by cyber espionage and financial gain, and has launched Operation FlashHole using a sophisticated malware chain. Lazarus Group employs AI-generated photos in spear-phishing emails, hijacked GitHub accounts, and abuses CrossWeb EX software to deliver malware such as TechHub, Cubridge, TouchShift, and ClientHub.
What is Swallowtail? Swallowtail (Russian espionage group) is believed to be motivated by cyber espionage and has targeted defense firms in two NATO countries, focusing on law enforcement, defense manufacturing, and shipbuilding sectors. Swallowtail uses macro-enabled Word documents to drop files including a VBScript launcher and batch script, which facilitate task fetching via a hidden Microsoft Edge browser instance.
What is Prince of Persia? Prince of Persia (Iranian cyber threat group) is believed to be motivated by cyber espionage and has used US-based command-and-control servers for malware operations. Prince of Persia deploys malware such as Tornado, which blends with legitimate network traffic to evade firewalls and maintain covert access.