Open Cyber Threat Intelligence

Hackers are actively exploiting a critical OS command-injection vulnerability, CVE-2026-106931, in the SiteGuard Server Edition web application firewall (WAF). The flaw exists in the statistics feature, which is enabled by default, and allows attackers to execute arbitrary commands with root or SYSTEM privileges on affected systems. The vulnerability impacts multiple versions of SiteGuard Server Edition for Apache httpd, Nginx, and IIS, excluding FreeBSD, prior to 8.00 Update 5, and FreeBSD versions before 7.00 Update 6. Exploitation in the wild has been confirmed, though details about the threat actors, victims, or attack scope remain undisclosed.

Unit 42 uncovered a sophisticated network intrusion campaign tracked as CL-STA-0954, targeting a telecommunications organization via exploitation of CVE-2024-47575 (FortiJump) on a FortiManager appliance. Attackers exfiltrated configuration data, credentials, and cryptographic material for over 500 managed FortiGate firewalls. They later exploited CVE-2025-61624 to deploy PEERSTITCH, a novel memory-resident ARM64 malware that evades detection by patching running processes and establishing covert inter-process communication. The implant enables traffic interception, backdoor access, and privilege escalation without writing to disk or opening network ports.

Unit 42 identified an AI-powered espionage campaign, tracked as CL-UNK-1211, targeting government entities and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, including malicious PHP scripts and custom malware such as SysGoRAT—a cross-platform Go-based remote access Trojan—to maintain persistence, conduct reconnaissance, and exfiltrate sensitive data like government mailboxes and databases. The campaign employed diverse techniques including web shells, credential harvesting via .bashrc hijacking and PHP loggers, reverse shells, and anti-forensics methods such as log tampering and timestomping to evade detection.

A malicious npm package named 'imgdecode' is part of the MALFEX supply chain attack campaign targeting Windows systems. The package contains a compiled Node.js native addon that loads a malicious DLL, which downloads encrypted shellcode from a GitHub repository, decrypts it using a hardcoded key, and injects it into the dllhost.exe process. The campaign uses multiple interdependent packages and infrastructure, including GitHub repositories and a C2 server, to deliver payloads such as Overlord RAT and a Node.js stealer, while employing anti-analysis techniques and establishing persistence via registry and scheduled tasks.

ConnectWise disabled seven of its application identities after discovering that threat actors had gained unauthorized access to them, enabling compromise of Microsoft 365 tenants. The attackers abused stolen application credentials to authenticate as legitimate ConnectWise applications and obtain access tokens via Microsoft Entra ID, potentially accessing mailboxes, SharePoint, Teams, and directory data. A second wave of targeted attacks from IP address 144.172.64[.]128 was observed on October 15, targeting 16 tenants in sensitive sectors, though no further activity has been confirmed. ConnectWise has suspended Cloud Backup and related services while investigation and remediation continue.

BeyondTrust has patched a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support (RS) and Privileged Remote Access (PRA) appliances that was exploited in attacks since August 2026. The flaw is an authentication bypass allowing unprivileged remote attackers to perform file operations on unpatched systems. The China-nexus espionage actor 'Armory Castle' (also known as UNC5221 or 'Warp Panda') exploited the vulnerability to gain initial access, escalate to root privileges, deploy Sawfly web shell and Bareclaw tunneler malware, and move laterally using stolen credentials. Organizations with internet-exposed appliances during the exploitation window should assume compromise.

Hackers conducted a supply-chain attack by compromising ConnectWise's Cloud Backup service, leveraging stolen application identities to gain unauthorized access to Microsoft 365 tenants. The attackers used a single IP address (144.172.64[.]128) to authenticate as the backup application via its secret, bypassing MFA and exploiting broad permissions previously granted in customer tenants. Multiple cybersecurity firms observed malicious activity including reconnaissance, privilege escalation to Exchange and Global Administrator roles, and attempts to establish persistence by adding credentials to third-party tools. ConnectWise shut down customer access to the service, but existing tokens remain valid until expiration, requiring manual review and revocation by administrators.

Drupal has patched two critical remote code execution (RCE) vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. Both flaws could allow unauthenticated attackers to execute arbitrary code on affected servers, especially when combined with contributed or custom modules. The Drupal Security Team warns that exploits could emerge within hours or days of disclosure, urging immediate patching to versions 10.6.19, 11.3.19, 11.4.10, or Entity List 3.0.10.

A sophisticated threat actor exploited CVE-2025-61624, a path traversal vulnerability in Fortinet FortiOS, to deploy a novel memory-resident ARM64 malware named PEERSTITCH. The malware operates entirely in memory, avoids opening network connections, and hijacks legitimate FortiOS processes (miglogd and iked) to create a covert inter-process communication channel for bypassing security checks on tagged VPN sessions. The attack enabled long-term persistence, credential theft, and lateral movement across managed firewalls, with evidence linking it to the CL-STA-0954 (UNC5820) intrusion campaign targeting a telecommunications managed service provider.

Threat actors have compromised a Microsoft 365 credential used by ConnectWise Cloud Backup, enabling unauthorized access to 173 Microsoft 365 tenant environments. The attackers used the stolen credential to obtain Microsoft Graph tokens from IP address 144.172.64[.]128, moving systematically through tenants in sorted GUID order, indicating automated tooling. In at least one tenant, a malicious actor assigned the ConnectWise Cloud Management app Global Administrator privileges and added new client secrets to privileged applications, including an MSP management tool and the Huntress Security Platform, expanding access across customer environments. Organizations with the ConnectWise app installed remain at risk until credentials are rotated and the app is disabled.