hacker-news Oct 5, 2026 · Crawled Oct 5, 2026

⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

1 Actors

AI Summary

Multiple critical zero-day vulnerabilities were exploited in the wild this week, including CVE-2026-88779 in Citrix NetScaler ADC and Gateway, and CVE-2026-104286 in Fortinet FortiMail, both allowing remote code execution or arbitrary file writes. Russian state-sponsored group Star Blizzard deployed a new malware delivery technique called RedFlick to install the CosmicPulse backdoor via phishing. A Chinese-linked post-compromise malware, NeedyMantis, has been used in targeted operations since October 2025. Additionally, law enforcement disrupted the KillSec ransomware group and arrested members of ShinyHunters. A new Spectre v2 variant, BTR, enables rapid extraction of Linux root password hashes on Intel systems.

AI-extracted · verify before operational use

Extracted Entities 1 found

Threat Actor Callisto →

MITRE ATT&CK TTPs 17 techniques

T1012 Query Registry · Discovery T1021 Remote Services · Lateral Movement T1021.001 Remote Desktop Protocol · Lateral Movement T1021.002 SMB/Windows Admin Shares · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1087.002 Domain Account · Discovery T1105 Ingress Tool Transfer · Command And Control T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1204.002 Malicious File · Execution