Open Cyber Threat Intelligence

UAT-11985, an advanced persistent threat group, has conducted a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations using fake event invitations. The emails impersonate legitimate institutions and include malicious links or QR codes that direct victims to adversary-in-the-middle (AitM) phishing sites mimicking Google Forms and Google login pages. These sites harvest Google credentials and multi-factor authentication codes in real time, enabling full account takeover, with infrastructure tailored to Chinese-speaking users by supporting Simplified and Traditional Chinese locales.

A proxyjacking campaign has compromised D-Link, Ubiquiti, and other edge devices across 34 countries, leveraging known vulnerabilities to install the legitimate bandwidth-sharing app Pawns.app without user consent. The attackers monetize victims' internet bandwidth by enrolling devices into a residential proxy network, potentially earning payouts through unauthorized participation. The campaign exploited specific vulnerabilities in D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, and SAP NetWeaver, with evidence of SSH key configuration for persistent access. Organizations are advised to patch known vulnerabilities and secure internet-facing devices to prevent compromise.

Cisco Talos and Recorded Future’s Insikt Group identified espionage activity conducted by threat actor UAT-6275 targeting government and critical infrastructure entities in the Commonwealth of Independent States (CIS). The group uses multiple infection chains, including macro-enabled documents, GitHub-hosted scripts, and exploitation of a WinRAR vulnerability, to deploy custom reverse shells. Operational security lapses by the actor allowed researchers to observe their infrastructure and malware development. The group is evolving its tradecraft, leveraging legitimate platforms like GitHub for payload hosting and showing signs of expanding to Linux and internet-facing appliances.

NGINX has released updates (versions 1.30.6 and 1.31.7) to address five vulnerabilities, including potential remote code execution (RCE) and a TLS session forgery flaw that could bypass client-certificate checks. The most severe flaws are heap overflows and a use-after-free condition, exploitable under specific configurations involving alias with rewrite, regex maps, AIO with SSI, or shared TLS session caches. The TLS flaw (CVE-2026-97629) stems from improper rotation of session ticket keys, allowing non-deterministic forged session resumption. No active exploitation has been reported, but prior NGINX flaws have seen rapid weaponization post-disclosure.

Citizen Lab identified a zero-click spyware campaign conducted by the Israeli firm Candiru, targeting Al Jazeera staff through malicious online ads served via Discover-Tech, a company posing as a legitimate digital advertising vendor. The attack exploited ad delivery infrastructure to silently deploy spyware without user interaction, with initial access established when targeted devices loaded malicious ads that triggered callbacks to attacker-controlled servers. At least 45 devices were targeted in 2024 and 2025, and the attack chain was confirmed through traffic logs and a recovered Windows malware sample linked to Candiru's known toolset.

Multiple active threats were reported, including ransomware groups Qilin and Settra exploiting a PAN-OS authentication bypass vulnerability (CVE-2026-0257). A cryptocurrency wallet drainer kit called Noir uses DNS TXT records hosted on Cloudflare Pages to locate backend infrastructure. A new Rust-based remote access trojan, CikaBika Bot, leverages Discord for C2 communications. The KGB RAT malware, advertised on cybercrime forums, combines data theft with psychological harassment features. Adobe Experience Manager cloud instances are vulnerable to an unauthenticated RCE chain. Samsung patched a critical unauthenticated RCE in its QA-Board tool, while NVIDIA's Linux GPU driver has a privilege escalation and container escape flaw.

A critical vulnerability in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows guest virtual machines to read host memory, crash the host, and potentially execute code on it. The flaw resides in the kernel's networking code and was demonstrated against Vercel's production sandboxes, where specially crafted network packets from a guest VM could exfiltrate up to 32 bytes of host memory per packet. Although the vulnerability has not been exploited in the wild, it poses a broad risk to cloud providers using shared Linux kernel infrastructure, as it enables VM escape and host-level compromise.

A threat actor uploaded malicious packages to the Arch User Repository (AUR) under the username 'marchos1as', impersonating popular AUR helper tools 'yay' and 'paru' using typosquatted names like 'yyay'. These packages contained legitimate source code combined with a malicious install script that executed a remote shell script with root privileges. The payload was fetched via a Wayback Machine URL pointing to a GitFlic-hosted repository 'hellscripter/install-scripts'. Potential connections exist to the 'DirtyBlanket' npm campaign involving the same infrastructure, though no definitive link has been confirmed. Arch Linux maintainers removed the packages and banned the account.

Threat actors are actively exploiting a critical remote command execution vulnerability, CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. The flaw exists in versions prior to 26.4.303 and allows unauthenticated OS command injection via the proxy.php endpoint when the built-in server is stopped. Attackers are deploying PHP webshells to search for password databases, password manager artifacts, and cryptocurrency wallets. Exploitation began in mid-September, over four weeks before the CVE was published on October 14, highlighting a dangerous gap between patch availability and formal disclosure.

The article discusses the evolving threat landscape due to AI-accelerated development and exploitation, highlighting the importance of Application Security Posture Management (ASPM) to manage increased risk velocity. It references a specific critical vulnerability, CVE-2025-55182 (React2Shell), which enables remote code execution in Next.js applications, leading to widespread exposure across micro-frontends and containerized workloads. The vulnerability results in thousands of findings across repositories and container images, necessitating contextual prioritization to identify exploitable instances. Wiz Code is presented as a solution to correlate scanner findings with cloud exposure and runtime context to prioritize remediation.