Open Cyber Threat Intelligence

In December 2025, threat actor Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution, deploying a fileless webshell within the IIS worker process (w3wp.exe). The attack used in-memory execution via a VirtualPathProvider-based implant to maintain persistence without writing to disk, enabling command and control, lateral movement, and data exfiltration. The actor deployed Velociraptor for post-compromise operations, attempted to deploy Warlock ransomware, and used EDR-killing techniques, but was partially blocked by security controls.

Kaspersky GERT investigated two ransomware incidents involving ESXi and Proxmox virtualization environments. In the first case, attackers exploited a monitoring system (PRTG) that stored reusable root credentials, enabling SSH access to multiple ESXi hosts. They disabled the execInstalledOnly security policy and deployed the BlackNevas ransomware binary 'esx' to encrypt systems. In the second case, attackers obtained plaintext credentials from a compromised administrator workstation, allowing them to access Proxmox via the root account and activate VNC websockets to execute ransomware across the cluster. Both attacks leveraged misconfigurations such as credential reuse, unsafe storage, and excessive privileges rather than software vulnerabilities.

A malicious RubyGems package named strutil-core version 1.0.1 was discovered that executes a credential-stealing worm during installation. The package, published by the RubyGems account jamnajiea, delivers a JavaScript-based payload using the Bun runtime, which collects cloud, CI/CD, package registry, SSH, AI coding tool, and cryptocurrency wallet credentials, then exfiltrates them to paleasbest[.]top. The malware includes self-propagation capabilities across RubyGems, npm, and PyPI, poisons AI development environments by injecting malicious configurations, and installs a Python backdoor that executes scripts from signed GitHub commits. A conditional wiper is triggered if a stolen GitHub token is revoked, leading to deletion of the user's home directory.

A critical vulnerability in Ruby on Rails' Active Storage component, when used with ImageMagick, allows unauthenticated attackers to write arbitrary files to the server and potentially read sensitive files such as secret keys and database credentials through crafted uploads. The vulnerability arises because Active Storage does not restrict dangerous ImageMagick coders that can access files outside the uploaded image. Exploitation can lead to remote code execution, especially in applications using the Disk service. The Rails team released patches in versions 8.0.5.2 and 8.1.4.1, while Socket has provided a free interim Certified Patch for GHSA-f3w6-w445-fwh9 to help organizations mitigate the issue before full upgrades.

CVE-2026-123158, dubbed *sshole, is a password authentication bypass vulnerability in OpenSSH when running on musl libc-based systems like Alpine Linux without PAM. The flaw allows an unauthenticated network attacker to log in to accounts with a shadow password field set to '*' by submitting an overlong password (longer than 256 bytes) after a failed initial attempt, exploiting how musl's crypt() function handles input length and returns values. The vulnerability affects Alpine Linux 3.16 and later, OpenWrt with OpenSSH, and other musl-based systems under specific configuration conditions, including PasswordAuthentication enabled and at least one local account with a real SHA-crypt password hash. OpenSSH released version 10.6p2 to fix the issue, and Alpine backported patches across all supported and unsupported branches.

Unidentified threat actors conducted cyberattacks on refrigeration systems across Europe starting in October 2026, targeting at least 700 supermarkets in France and later expanding to over 10 additional countries, impacting over 100 retail locations. The attackers manipulated refrigeration controllers to enter defrost mode, raising temperatures to as high as 50°C, leading to food spoilage and in some cases, fires. French medical facility refrigeration systems were also affected, though no blood product spoilage was confirmed. Initial access may have exploited default credentials or vulnerable software, and pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility, though unverified. CISA issued an advisory warning of exploitation via authentication bypass, arbitrary code injection, and weak configurations.

Cisco Talos discovered VOLTA, a sophisticated Windows infostealer that leverages AI to automate victim profiling and prioritize stolen data for monetization. The malware harvests credentials, browser sessions, and cryptocurrency wallets, then uses large language models (LLMs) to analyze and rank the value of stolen assets, enriching the data by searching victims' emails for purchase receipts. If an LLM refuses to process the data, VOLTA fails over to an alternative model to ensure continuous operation, reducing the need for manual effort by attackers and enabling even low-level threat actors to conduct high-impact attacks.

Two vulnerabilities in Barracuda Email Security Gateway can be chained to achieve remote root access without authentication. CVE-2026-116606 is an authorization bypass that allows an unauthenticated attacker to restore a crafted configuration backup, which when combined with CVE-2026-111560, a command injection flaw, enables execution of arbitrary commands as root. The attack chain exploits a logic flaw in password change handling that grants access to a backup-restore function and leverages a hardcoded checksum secret to forge valid configuration backups. While patches are available, the vulnerabilities have not yet been added to CISA's KEV catalog and are not currently linked to any known attacks.

Chainalysis disclosed a breach resulting from an 'agentic' cyber attack that exposed user credentials, including password hashes and live tokens, prompting the shutdown of key services like Reactor and KYT. The attack is linked to a broader campaign involving AI-driven tools such as ARTEX, which scan GitHub for exposed secrets and conduct rapid follow-on attacks. Microsoft attributes similar activity to threat actors using autonomous agents to exploit valid credentials and target AI/ML services across Azure environments. Suspicious IP addresses and domains tied to LLM token abuse and resale operations have been identified, including infrastructure linked to llm-routing[.]com and xingjiabiapi[.]org.

A remote code execution vulnerability, CVE-2026-83844, exists in Microsoft Paint due to an out-of-bounds read flaw that could allow an attacker to execute code over the network without authentication or user interaction. The fix is available via the Microsoft Store as build 11.2609.401.0 but is not distributed through Windows Update, leading to potential inconsistencies in patch deployment. Microsoft rates the vulnerability as Important with a CVSS score of 8.1, and it was not under active exploitation at the time of disclosure. Organizations are advised to manually verify and update all user-specific and provisioned instances of Paint to ensure full remediation.