Open Cyber Threat Intelligence

The China-nexus threat actor Longlegs (aka Storm-2603), linked to Warlock ransomware, has conducted recent attacks against at least four organizations, including critical infrastructure operators in the water and telecommunications sectors. The group exploits unpatched Microsoft SharePoint vulnerabilities, including the 'ToolShell' exploit chain involving multiple CVEs, to gain initial access and deploy webshells. They use DLL sideloading, living-off-the-land techniques, and abuse of signed vulnerable drivers like K7RKScan (CVE-2025-1055) to disable security software and deploy ransomware across domains via SYSVOL replication. The attackers also leverage Visual Studio Code's tunneling feature for covert remote access and stage payloads on legitimate file-sharing services such as catbox[.]moe and wasabisys[.]com.

A ransomware attack attributed to the BlackNevas group targeted an organization's virtualization environment over a 10-day period, compromising four ESXi hosts, vCenter Server Appliances, and backup infrastructure. The attackers gained access via SSH using stolen credentials, established persistence on the vCenter appliance using MeshAgent and Ligolo-ng tunneled through a systemd service, and leveraged legitimate VMware management features—such as Host Profiles—to enable SSH on ESXi hosts and deploy ransomware. The attack involved destruction of virtual machines, encryption of datastores, and prior disruption of backup systems to hinder recovery. No ESXi vulnerabilities were exploited; instead, the attackers abused legitimate administrative interfaces and living-off-the-land techniques.

Cisco Talos has identified the growing misuse of AI-enabled penetration testing frameworks, particularly ARTEX, by various threat actors for malicious campaigns. ARTEX, developed under the pseudonym Autumn-27 and released in July 2026, is being leveraged by both financially motivated cybercriminals and China-nexus threat groups to automate reconnaissance, credential theft, and post-compromise activities at machine speed. Multiple campaigns have been attributed to actors such as VAPOR PANDA, Storm-0940, and Storm-3358, targeting sectors including government, financial services, defense, and cloud environments. The framework orchestrates tools like VShell, GoPhish, and AdaptixC2, enabling rapid scanning, credential abuse, lateral movement, and data exfiltration across diverse infrastructures.

Threat actors are actively exploiting a vulnerability chain dubbed 4EverAble2Shell in N-able N-central, which combines a flaw in the Apache Axis component with a privilege escalation issue to achieve remote code execution as root. The exploit allows unauthenticated attackers to execute arbitrary OS commands via unsafe class instantiation during SOAP fault processing. Attackers have used the access to deploy a Monero cryptocurrency miner via a shell script downloaded from a malicious server. At least 21 servers have been infected, including 19 that had already applied Hotfix 2, indicating the hotfix alone is insufficient for full protection.

An unknown threat actor exploited the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) in unpatched Check Point Security Gateways to gain initial access, then used a local privilege escalation flaw (CVE-2026-123039) in Gaia OS to deploy the TSGA backdoor and establish persistent access. The attackers deployed PHP web shells, moved laterally to VMware ESXi hosts via SSH, and executed the destroy_v6 wiper malware to delete files and leave politically themed notes. The campaign targeted Israeli organizations initially, then expanded globally, with some evidence suggesting possible ties to the China-nexus group Armory Castle, though attribution remains uncertain due to the use of wiper malware and political messaging.

Operation Endgame, an international law enforcement effort, dismantled infrastructure associated with Gootloader, CastleRAT, and StealC—three malware tools used in cybercrime operations. Gootloader, a loader malware, spread via SEO-poisoned fake legal documents on compromised WordPress sites, enabling ransomware attacks and credential theft. CastleRAT is a remote access trojan allowing full control over infected systems, while StealC is an infostealer that exfiltrates login credentials. Authorities seized 235 servers and 257 domains across the three campaigns, along with 6.4 million stolen credentials, though no arrests were announced. The takedown included disruption of bulletproof hosting provider Virtualine/Omegatech, which supported StealC's infrastructure.

SilentAir is a newly identified cyber espionage group assessed by Enea to be a state-level actor, likely operating with ties to China, that has hijacked telecom infrastructure in at least six Asian countries to intercept SMS two-factor authentication codes and conduct surveillance. The group exploited SS7 and Diameter signaling protocols via compromised equipment within mobile operators' networks, enabling them to redirect calls and texts by spoofing location update messages. SilentAir conducted large-scale silent SMS operations, primarily targeting users in Taiwan, using disguised messages to verify interception success without alerting victims. The group's activity aligns with China Standard Time and overlaps temporally with known Liminal Panda intrusions, though definitive attribution remains unconfirmed.

Trezor confirmed that three of its Safe 5 hardware wallets purchased from the reseller CryptoBilis contain hidden malicious implants designed to steal recovery phrases. The implant, positioned between the main board and screen, captures the recovery phrase during setup or restoration and transmits it over mobile networks to attacker-controlled servers. Although no fund losses have been reported, Trezor advises users who bought from CryptoBilis since March to move funds to a new wallet with a new recovery phrase and warns against using or restoring backups on potentially compromised devices.

The FBI has attributed a social engineering campaign named FaceStealer to North Korea-linked threat actors, specifically the BlueNoroff group, which has stolen over $400 million in cryptocurrency over the past 18 months. The campaign uses deepfake video calls and surreptitiously recorded videos to impersonate trusted contacts during fake Zoom or Teams meetings, tricking high-value targets—primarily cryptocurrency and Web3 industry professionals—into clicking malicious links or running scripts that install malware. The attack chain leverages compromised Telegram accounts to propagate, using typosquatted domains and phishing kits to deliver payloads, ultimately enabling credential theft, supply chain compromises, and lateral movement. A related but distinct campaign, Contagious Interview, uses fake job interviews and weaponized code repositories to deploy malware such as BeaverTail and InvisibleFerret.

Two new attacks, Mior and Skyfall, have been disclosed that compromise AMD SEV-SNP-protected virtual machines by exploiting flaws in the processor's startup and transient execution behaviors. Mior allows a malicious host with control of the hypervisor and BIOS to manipulate the Reverse Map Table (RMP) during VM boot, enabling unauthorized memory access and falsified attestation reports. Skyfall leverages transient scheduler attacks (TSA) to leak VM register data and disk-encryption keys from failed VM startups, even without hardware tampering, by reading leftover cached state through timing side channels.