Open Cyber Threat Intelligence

The Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies have identified SafePay, a private ransomware group active since August 2024, as responsible for breaching over 600 critical infrastructure organizations globally. The group gains initial access through credential exposure, brute force attacks, and exploitation of VPN vulnerabilities, particularly targeting Mullvad VPN IP addresses. SafePay employs double-extortion tactics, exfiltrating sensitive data before encryption and threatening to leak it if ransoms are unpaid. The group does not use affiliates and has increasingly filled the operational gap left by the decline of BlackCat and LockBit ransomware groups.

Hackers breached the infrastructure of Onamae Desktop Cloud, a VPS service provided by GMO Internet, and installed malicious programs on up to 26,739 customer servers. The company detected the intrusion and began shutting down affected servers starting October 21, 2026. While no confirmed data misuse has been reported, customer data may have been exposed, and users are advised to rotate secrets. The attackers may also attempt follow-on phishing campaigns leveraging the incident.

Hackers are actively exploiting a critical OS command-injection vulnerability, CVE-2026-106931, in the SiteGuard Server Edition web application firewall (WAF). The flaw exists in the statistics feature, which is enabled by default, and allows attackers to execute arbitrary commands with root or SYSTEM privileges on affected systems. The vulnerability impacts multiple versions of SiteGuard Server Edition for Apache httpd, Nginx, and IIS, excluding FreeBSD, prior to 8.00 Update 5, and FreeBSD versions before 7.00 Update 6. Exploitation in the wild has been confirmed, though details about the threat actors, victims, or attack scope remain undisclosed.

Unit 42 uncovered a sophisticated network intrusion campaign tracked as CL-STA-0954, targeting a telecommunications organization via exploitation of CVE-2024-47575 (FortiJump) on a FortiManager appliance. Attackers exfiltrated configuration data, credentials, and cryptographic material for over 500 managed FortiGate firewalls. They later exploited CVE-2025-61624 to deploy PEERSTITCH, a novel memory-resident ARM64 malware that evades detection by patching running processes and establishing covert inter-process communication. The implant enables traffic interception, backdoor access, and privilege escalation without writing to disk or opening network ports.

Unit 42 identified an AI-powered espionage campaign, tracked as CL-UNK-1211, targeting government entities and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, including malicious PHP scripts and custom malware such as SysGoRAT—a cross-platform Go-based remote access Trojan—to maintain persistence, conduct reconnaissance, and exfiltrate sensitive data like government mailboxes and databases. The campaign employed diverse techniques including web shells, credential harvesting via .bashrc hijacking and PHP loggers, reverse shells, and anti-forensics methods such as log tampering and timestomping to evade detection.

A malicious npm package named 'imgdecode' is part of the MALFEX supply chain attack campaign targeting Windows systems. The package contains a compiled Node.js native addon that loads a malicious DLL, which downloads encrypted shellcode from a GitHub repository, decrypts it using a hardcoded key, and injects it into the dllhost.exe process. The campaign uses multiple interdependent packages and infrastructure, including GitHub repositories and a C2 server, to deliver payloads such as Overlord RAT and a Node.js stealer, while employing anti-analysis techniques and establishing persistence via registry and scheduled tasks.

ConnectWise disabled seven of its application identities after discovering that threat actors had gained unauthorized access to them, enabling compromise of Microsoft 365 tenants. The attackers abused stolen application credentials to authenticate as legitimate ConnectWise applications and obtain access tokens via Microsoft Entra ID, potentially accessing mailboxes, SharePoint, Teams, and directory data. A second wave of targeted attacks from IP address 144.172.64[.]128 was observed on October 15, targeting 16 tenants in sensitive sectors, though no further activity has been confirmed. ConnectWise has suspended Cloud Backup and related services while investigation and remediation continue.

BeyondTrust has patched a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support (RS) and Privileged Remote Access (PRA) appliances that was exploited in attacks since August 2026. The flaw is an authentication bypass allowing unprivileged remote attackers to perform file operations on unpatched systems. The China-nexus espionage actor 'Armory Castle' (also known as UNC5221 or 'Warp Panda') exploited the vulnerability to gain initial access, escalate to root privileges, deploy Sawfly web shell and Bareclaw tunneler malware, and move laterally using stolen credentials. Organizations with internet-exposed appliances during the exploitation window should assume compromise.

Hackers conducted a supply-chain attack by compromising ConnectWise's Cloud Backup service, leveraging stolen application identities to gain unauthorized access to Microsoft 365 tenants. The attackers used a single IP address (144.172.64[.]128) to authenticate as the backup application via its secret, bypassing MFA and exploiting broad permissions previously granted in customer tenants. Multiple cybersecurity firms observed malicious activity including reconnaissance, privilege escalation to Exchange and Global Administrator roles, and attempts to establish persistence by adding credentials to third-party tools. ConnectWise shut down customer access to the service, but existing tokens remain valid until expiration, requiring manual review and revocation by administrators.

Drupal has patched two critical remote code execution (RCE) vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. Both flaws could allow unauthenticated attackers to execute arbitrary code on affected servers, especially when combined with contributed or custom modules. The Drupal Security Team warns that exploits could emerge within hours or days of disclosure, urging immediate patching to versions 10.6.19, 11.3.19, 11.4.10, or Entity List 3.0.10.