PaperCut servers are under active attack, while 47% of tracked installations still run unpatched versions vulnerable to remote code execution.

PaperCut, the print management software running in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers. Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install.

“Observed activity focused on system discovery. We have not observed secondary malware, further command-and-control traffic, or additional persistence or post-exploitation from the recovered payload.” reads the report published by Hutress.

“Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG 25.0.11.75758 server. We have reached out to PaperCut to coordinate with them on continued vulnerability analysis.”

The vulnerability starts with a simple authorization mistake in PaperCut. An attacker can send a specially crafted request that makes the server display one page while actually running an action from another page.

PaperCut checks the permissions for the page it displays instead of the action it actually performs. This flaw, tracked as CVE-2026-81578, can let an attacker change the server’s configuration without logging in.

That access can then be combined with a second flaw, CVE-2026-82078. The issue in PaperCut’s database utilities can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server.

The real-world attacks Huntress observed were almost quaint compared to the severity of the bug itself. One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver, basic commands to identify the compromised account and Windows version. A second incident added tasklist to the mix, checking what processes were running, but neither case showed evidence of deeper persistence, secondary malware, or follow-up command-and-control traffic.

The activities observed by Huntress read like reconnaissance rather than a finished operation, the kind of activity that usually precedes something worse.

The forensic trail attackers left behind is genuinely useful for defenders, and it’s worth understanding exactly what it looks like. Investigators found a malicious Java class file dropped directly into PaperCut’s own installation directory, capable of running commands, writing results to a temporary file, and then deleting both the output and the server’s own log file to cover its tracks. One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn, an oddly named database directory that PaperCut’s own investigation guidance now flags as a high-confidence indicator of compromise.

“After exploitation, the .class file deletes its own Udydn.out file, as well as the server’s server.log file. The server.log file recorded the execution of this code in a log line that contains the string DB URL: jdbc:derby:memory:pwn that immediately followed the large encoded data blob’s appearance in the log.” continues the report. “We observed /data/internal/derby.log was not deleted, and it contains one insightful breadcrumb”

PaperCut’s patching process is more complicated than simply installing an update. The company released an emergency patch first, then issued another update less than 24 hours later after additional testing. Fixes for version 24 were still being developed when the report was published.

The timing is important because the second confirmed attack targeted a server running version 24, before the fix for that version was available.

Huntress successfully recreated the exploit chain in a test environment. From a remote system, the researchers were able to trigger code execution without authentication. The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.

The bigger concern involves older versions. Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.

Huntress is working with PaperCut to analyze the vulnerability and coordinate the response.

If your organization runs one of these older versions, the safest option for now is to remove the PaperCut Application Server from the public internet. Restrict access through a VPN or a trusted internal network until a proper fix becomes available.

If your PaperCut server has been publicly accessible recently, installing the patch should not be the end of your response. It should be the start of an investigation.

Before restarting the server, save its logs and configuration files so you don’t lose important evidence. Check whether pc-app.exe has launched a command shell or tools such as tasklist, and look for unexpected .class files in the server’s lib directory.

Even a short two-minute reconnaissance attempt could be an early sign of a more serious attack.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Philippine nuclear and naval targets)

PaperCut warns that a zero-day in NG and MF is being exploited. The company already release emergency patches to address it.

PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products. The flaw has no CVE yet, and the company has not released technical details.

PaperCut issued emergency patches on Friday and urged customers to install them immediately. It also recommends disconnecting application servers from the internet and limiting access to trusted IP addresses.

“If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).” states the advisory. “Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.”

The company confirmed incidents affecting customers and said its investigation is still underway.

“PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.” reads the advisory. “We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.”

PaperCut has not yet disclosed details about the vulnerability, the attack method, or the attackers behind the campaign.

So far, the company has identified several indicators of compromise:

• Intrusion-detection, endpoint-security, or network-monitoring tools may flag suspicious activity involving the PaperCut Application Server, especially activity linked to pc-app.exe.
• Attackers may delete, truncate, or alter PaperCut server.log files to hide their activity.
• The server.log file may contain these entries:
  • ERROR No suitable driver found for jdbc:no:x
  • ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

Users running PaperCut should check their systems for these signs of compromise.

In May 2023, Microsoft warned that Iran-linked APT groups were exploiting another flaw, tracked as CVE-2023-27350, in attacks against PaperCut MF/NG print management servers. The CVE-2023-27350 flaw is a PaperCut MF/NG Improper Access Control Vulnerability. PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of SYSTEM.

In April 2023, Microsoft linked the attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to a financially motivated threat actor tracked as Lace Tempest (formerly DEV-0950). The group is known to be an affiliate of the Clop ransomware RaaS affiliate, it has been linked to GoAnywhere attacks and Raspberry Robin infection. Since April 13, 2023, Lace Tempest added the PaperCut exploits to its arsenal.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zero-Day)

GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects.

WatchTowr researchers warn of active exploitation of critical GitLab flaw CVE-2026-19478 (CVSS score of 9.4). This week, GitLab pushed out an emergency patch to address this flaw, which could let an attacker with zero credentials remotely modify or delete public projects and user data.

“GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.” reads the advisory.

GitLab issued an emergency patch on August 17, five days after its regular update. The vulnerability impacts only self-managed installations, users should upgrade to versions  19.2.4, 19.1.6, 19.0.8, and 18.11.11.

There’s a gap worth flagging for anyone still sitting on an older release. The available patches don’t cover the 18.2 through 18.10 branches, even though those versions technically fall inside the affected range. If you’re running anything in that window, staying put isn’t really an option; you’ll need to upgrade to a patched branch entirely rather than waiting for a fix that isn’t coming for your current one.

hiimguardian reported the flaw through the company HackerOne bug bounty program.

Organizations should urgently patch internet-facing GitLab servers. Until they can update, they should restrict unauthenticated access to /api/graphql, disable public repositories where possible, and check logs for requests containing @gl_introduced.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-19478)

Hackers are exploiting a macOS Screen Sharing flaw to gain root access and install Monero miners on Macs with port 5900 exposed online.

The Dutch National Cyber Security Centre confirmed active exploitation of a critical macOS authentication flaw, tracked as CVE-2026-65400 (CVSS score of 9.8), less than two weeks after Apple shipped the fix.

The bug sits in macOS’s built-in Screen Sharing feature, the remote desktop tool baked into every Mac. Apple’s fix improved how the system manages authentication state, closing a gap that let attackers on the network authenticate to Screen Sharing without valid credentials at all.

Apple patched this issue with the release of  macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, crediting researcher Alfredo Pesoli (@__rev) at Bynario Atlas (bynar.io) for the discovery.

“An attacker on the network may be able to authenticate to Screen Sharing without valid credentials” reads the advisory.

That’s a fast, coordinated fix by industry standards. It just wasn’t fast enough to beat whoever started scanning for exposed systems.

NCSC-NL says it received reports of active abuse hitting multiple systems where port 5900, the port Screen Sharing runs on, was reachable directly from the internet.

“The vulnerability concerns an authentication issue in the Screen Sharing functionality where network attackers can gain access without valid credentials. This is made possible by insufficient state management during the authentication process. As a result, unauthorized individuals can perform authentication attempts that would normally not be accepted.” reads the advisory. “The NCSC has received a security advisory indicating that active exploitation of this vulnerability has been observed on multiple systems where port 5900 was accessible from the internet. In all these cases, root access was obtained on the affected system and a Monero crypto miner was placed.”

In every case documented so far, attackers gained root access and dropped a Monero cryptocurrency miner on the compromised machine. Cryptomining is a relatively boring payload compared to what root access on a Mac could actually enable, which makes this look more like opportunistic scanning than a targeted campaign, for now.

This flaw sits in the same source code file as two other Screen Sharing bugs Apple patched a month earlier in macOS 26.6, one of them a genuinely pre-authentication flaw that a researcher going by @osxreverser described needing nothing but a target’s IP address to exploit, no password, no username, nothing.

That researcher claimed to have found around 40,000 exposed Screen Sharing hosts on the internet during a scan, nearly half of them in the US, spanning residential connections, university networks, and at least a few corporate servers.

What ties both bugs together is how mechanically simple they are to trigger. Security firm Calif, which analyzed the flaws, found no memory corruption, no exploitation trickery, no race condition to win, just logic errors that let a couple of correctly ordered packets walk straight past authentication. Calif also said it built a working exploit for both vulnerabilities in about four hours using an AI coding agent, which is the detail that should worry defenders more than the Monero miner itself: the gap between a patch note and a working exploit keeps shrinking, and it’s shrinking because building the exploit barely takes effort anymore.

If you’re running a Mac with Screen Sharing enabled and haven’t updated yet, do it now rather than after finishing this article. And if updating isn’t possible immediately, turn Screen Sharing off entirely under General, Sharing, until you can; leaving port 5900 open to the internet at this point is less a risk than an open invitation.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Monero)

Lazarus targets defense professionals with fake Lockheed Martin jobs, exploiting a Windows zero-day to deploy backdoors and evade security controls.

Check Point Research has uncovered a new wave of Operation Dream Job, the long-running North Korean campaign that lures defense and aerospace professionals with convincing fake job offers. This iteration is more dangerous than previous versions: it includes a previously unknown Windows vulnerability now patched as CVE-2026-68820, a newly documented backdoor called Troy, and command infrastructure built almost entirely from legitimate servers the attackers didn’t build, they hijacked them. Targets confirmed in France, Germany, Brazil, and India.

“The attackers used a previously unknown vulnerability in Windows (CVE-2026-68820) to gain full control of infected computers and evade EDR visibility. Check Point reported the issue to Microsoft, which released a fix before this research was published” reads the report published by Check Point Research. “Rather than running their own servers, the attackers are hijacking legitimate but compromised websites and webmail servers to relay commands, making the malicious traffic harder to distinguish from normal activity”

The vulnerability, CVE-2026-68820, is the same actively exploited zero-day that Microsoft patched on August 11 as part of Patch Tuesday, a privilege escalation flaw in AFD.sys, the kernel driver underlying Windows Sockets. Check Point reported the issue to Microsoft on July 28, Microsoft confirmed it three days later, and the fix shipped two weeks after that. The zero-day in this campaign and the zero-day under active exploitation are the same bug.

The attack runs through two parallel infection chains. In the first, victims download an encrypted archive containing a legitimate signed PDF viewer and a malicious DLL. The DLL displays a convincing Lockheed Martin job description while silently loading MISTPEN, a lightweight downloader that communicates through Microsoft Graph API and OneDrive. MISTPEN then runs reconnaissance modules, triggers the AFD.sys exploit to achieve SYSTEM privileges, and deploys ForestTiger, a well-documented Lazarus backdoor, along with an updated version of the group’s kernel-mode rootkit, FudModule 3.1, which can now tamper with Windows Smart App Control to bypass software verification.

“The second chain is more recent and shares several characteristics with a campaign described by ESET against the UAV sector in 2025. Victims are instructed to download SecurityPDF, a trojanized PDF viewer, from one of several websites impersonating Enveil, a legitimate privacy technology company with no actual connection to the attack. Once installed, the modified viewer inspects any PDF opened through it for a hidden marker.” continues the report. “When the marker is present, the application decrypts and launches an embedded payload that loads the Troy backdoor directly into memory.”

Troy is a single DLL implant that supports 17 operator commands covering file operations, shell access, process termination, in-memory DLL injection, and configuration updates. Its name comes from a PDB path embedded in the binary that Check Point also observed in earlier Lazarus samples. Enveil has no connection to the campaign; its brand was simply borrowed because it sounds credible to defense sector professionals.

The C2 infrastructure is built from compromised Roundcube webmail installations and WordPress sites, many vulnerable to CVE-2025-49113, infected with a previously undocumented PHP webshell called RelayShell. RelayShell functions as a relay rather than a traditional backdoor, exchanging commands and responses through simple text files. In at least one confirmed case, an already-breached French organization was used to send phishing messages to new victims — the attackers borrowed the company’s reputation to get past filters. Check Point identified at least 17 unique server identifiers in this relay network, with operators connecting through commercial VPNs to further obscure their location.

The most urgent action is applying the August 2026 Patch Tuesday update, which contains the CVE-2026-68820 fix. For organizations running public-facing Roundcube or CMS installations, the secondary risk is becoming part of the relay infrastructure rather than the intended target: the servers used in this campaign were compromised through leaked credentials and a known unpatched vulnerability, not anything exotic. The full indicators of compromise are in Check Point’s report.

“Given the combination of a zero day vulnerability that now have a patch, a new modular backdoor, and web based infrastructure designed to resemble legitimate traffic, security teams in these sectors should prioritize the August Patch Tuesday update, review the indicators of compromise published in Check Point Research publication, and apply the same level of scrutiny to unsolicited recruiting outreach that they would apply to any unverified download request.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Lazarus)

Brown Health Medical Group-MA breach exposed personal, medical, and financial data of over 311,000 individuals after hackers accessed its servers.

Brown Health Medical Group-MA data breach exposed personal, medical, and financial data of over 311,000 individuals after hackers accessed its servers.

The healthcare group identified a data security breach involving a legacy file server on December 16, 2025 and launched an investigation into the incident that found unauthorized access occurred between December 15–16, 2025. The organization immediately isolated the affected server. According to the notification letter, the security breach did not impact the electronic health record system.

The organization determined the potential scope of exposed data on June 22, 2026, and notified affected individuals as a precaution.

“We first became aware of a data security incident impacting a historic file server at the Practice on December 16, 2025. We immediately initiated an investigation and isolated the server. Through our investigation, we determined that the unauthorized access to the server occurred between December 15–16, 2025. This incident did not impact the Practice’s electronic health record system.” reads the data breach notification letter.

The compromised information may include personal details, employment and HR records, medical or disability-related information, government identification numbers, payment card data, and financial account information. Not all data categories were affected for every individual.

“Due to the nature of the incident, we have been unable to conclusively determine exactly what information was impacted. However, on June 22, 2026, we determined the scope of personal information that may have been impacted by this incident, and we are providing this notice out of an abundance of caution.” continues the letter.”The following are the categories of information that may have been impacted: demographic information (such as name, date of birth, and contact information); personnel and human resources records (such as compensation or payroll information, licensure or credentialing information, and medical or disability-related records); and other personal information (such as Social Security numbers, driver’s license numbers or other government-issued identification numbers, credit or debit card numbers, and financial account information). Not all categories of information were impacted for all individuals.”

The Practice stated that it is taking steps to address the incident, including employee retraining, additional security measures, and cooperation with law enforcement. It also offered affected individuals two years of free identity protection and fraud monitoring services through Experian IdentityWorks, while advising them to monitor financial accounts for suspicious activity.

Brown Health Medical Group-MA reported the breach to the U.S. HHS revealing that 311,760 individuals were impacted.

At this time, no ransomware group has claimed responsibility for the attack.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Brown Health Medical Group-MA)

SMOKE#SCREEN uses fake Zoom updates to install ScreenConnect RMM, giving attackers persistent remote access while bypassing defenses.

Securonix Threat Research has been tracking an active multi-wave campaign they’ve named SMOKE#SCREEN, in which unknown attackers use rotating social engineering lures, fake Zoom updates, Adobe software notices, business document reviews, system maintenance utilities, to silently install ConnectWise ScreenConnect on victim machines.

ScreenConnect is a legitimate remote monitoring and management tool used by IT teams worldwide. Once installed, it gives the attacker persistent full remote access that looks exactly like authorized IT activity. That’s the point.

“The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and a HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0.143:8080.” reads the report published by Securonix. “Victims who execute any of the initial access files end up with a fully functional ScreenConnect agent silently installed and beaconing to one of three attacker-controlled relay servers, providing the threat actor with persistent, legitimate-looking remote access to compromised hosts.”

Researchers found a live server hosting the malicious files, while frequent payload changes help attackers avoid detection based only on file hashes.

Securonix found the staging server by following a single VBScript dropper named zoom-update.vbs, and when they looked at it, the entire directory was openly browsable, exposing 15 payload files. The same IP address (207.174.0[.]143) that hosts the staging server also runs the primary ScreenConnect relay on port 8041. One machine delivering payloads and maintaining remote control over already-compromised hosts. Efficient.

The campaign has evolved significantly since its earliest samples, and tracking that evolution tells you more about the attacker than any single sample would. The first VBScript dropper used XOR encryption, a state machine execution flow to confuse static analysis, junk arithmetic operations to alter byte signatures between builds, and environment checks that abort if the machine has less than 2 GB of RAM or runs analysis tools like Wireshark or Process Monitor.

The third sample abandoned all that subtlety and went fully aggressive: a batch file that disables AMSI via memory patching, re-launches itself with a UAC prompt disguised as a system maintenance tool, kills SmartScreen through registry modifications, adds the entire C:\ drive as a Defender exclusion path, stops and permanently disables the WinDefend service, and strips the Zone.Identifier stream from the downloaded MSI before running it silently.

“The actor’s delivery strategy has also rotated across multiple trusted hosting services. An early phishing page (zoom-update.html) delivers its payload via a Dropbox shared link, bypassing domain reputation filters since Dropbox is an allow-listed platform in most corporate environments. A compiled .NET loader (MemoryLoader.cs) references a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com), a service designed for temporary local server exposure that is rarely monitored.” continues the report. “The staging server itself runs cloudflared.exe, confirming that the actor uses the Cloudflare binary directly on their infrastructure to generate these ephemeral tunnels.”

The researchers noted that the fake Zoom update HTML page is particularly polished: correct logo SVG, correct brand color hex code, a fake version number, urgency messaging about secure connections failing, and a JavaScript timer that triggers the download automatically after two seconds, no click required. The page then instructs the victim to run the downloaded MSI to complete the update. By the time they do, the attacker already has a relay waiting.

The most significant finding came when Securonix observed a major payload rotation mid-investigation. The actor replaced their aggressive MemoryLoader.cs, which executed a nine-step Defender destruction sequence within 15 seconds of execution, with a new loader.cs that takes the opposite approach: avoid detection entirely instead of destroying controls.

“The most revealing addition is an explicit comment in the source code:

// WAIT 3 MINUTES (Breaks Elastic correlation)

Thread.Sleep(180000);

The actor is deliberately introduced a 180-second delay between MSI installation and service start to break EDR event correlation windows, and they are targeting Elastic specifically.” continues the report. “This is direct evidence of adversary testing against commercial security products. The removal of the entire Defender destruction sequence strongly suggests those behavioral detections were working. The actor has pivoted from a “destroy the AV” to an “avoid the AV” strategy.

The removal of the Defender destruction sequence in the new version strongly suggests those behavioral detections were working. The attacker noticed, adapted, and published cleaner code. The campaign also has a macOS variant: ZoomUpdateInstaller.pkg connects to the same primary relay server as the Windows MSIs.

The final payload in every attack path is a legitimate ConnectWise-signed ScreenConnect MSI, signed with a valid DigiCert certificate chain.

“All MSI files are signed with a valid Authenticode certificate issued to Connectwise, LLC by DigiCert’s trusted root chain. This is the most significant evasion technique in the arsenal, many EDR products apply reduced scrutiny to binaries signed by recognized enterprise software vendors, and ScreenConnect in particular is a known legitimate RMM tool used by IT teams worldwide.” states Securonix.

“Once installed, each agent silently connects to its configured relay server with the URL parameters e=Access&y=Guest, presenting as a guest access connection. The threat actor uses the relay server to establish a remote desktop session with the victim’s machine.”

The practical detection guidance from Securonix focuses on behavior rather than signatures: alert on processes stopping WinDefend, adding C:\ as a Defender exclusion path, or installing MSIs from %TEMP% or AppData. Block unauthorized RMM tools connecting to raw IP addresses rather than vendor domains. And treat any ScreenConnect connection to an IP address rather than a ConnectWise subdomain as a red flag worth investigating immediately.

“The SMOKE#SCREEN campaign demonstrates a capable, actively maintained, and rapidly adapting threat actor who has built a diversified toolkit around a single objective: gaining persistent, legitimate-looking remote access to victim systems through weaponized ScreenConnect deployments.” concludes the report. “What makes this campaign particularly notable for defenders is the observable arc of the actor’s tradecraft. From cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction sequences and then, most recently, a pivot back to stealth with anti-EDR timing and self-contained encrypted bundles, the campaign reads like a real-time arms race between attacker and defender. “

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SMOKE#SCREEN)

An alleged Ryuk ransomware member pleaded guilty in the U.S. for helping deploy attacks on American companies and faces up to 15 years in prison.

Armenian national Karen Serobovich Vardanyan (34) pleaded guilty in the U.S. for his role in Ryuk ransomware attacks targeting American organizations between 2019 and 2020. Extradited from Ukraine after his 2025 arrest, he admitted providing initial access to corporate networks that enabled ransomware deployment.

“An Armenian national extradited from Ukraine to the United States pleaded guilty yesterday for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies throughout the United States, including a technology company operating in Oregon.” reads the press release published by DoJ. “Karen Serobovich Vardanyan, 34, pleaded guilty to conspiracy and computer fraud.”

Between November 2019 and April 2020, Karen Vardanyan illegally accessed corporate networks and helped deploy Ryuk ransomware on hundreds of servers and workstations.

The attacks encrypted victims’ data and demanded Bitcoin payments in exchange for decryption keys. Among the victims were a Michigan company that paid 200 Bitcoin (worth over $1.1 million at the time), a company in Oregon, and a school in Texas. Overall, the group is believed to have collected around 1,610 Bitcoin, valued at more than $15 million when the ransoms were paid.

A U.S. federal grand jury indicted Vardanyan in February 2024 on conspiracy, computer fraud, and extortion charges. He faces up to 15 years in prison and will be sentenced on September 22, 2026. Under his plea agreement, he also agreed to pay more than $1.1 million in restitution.

According to a report published by Advanced-intel and HYAS in 2021, Ryuk was a highly profitable ransomware operation, generating an estimated $150 million in Bitcoin ransom payments. Researchers traced 61 wallet addresses linked to the group and identified laundering mechanisms involving brokers, intermediary wallets, and cryptocurrency exchanges such as Binance and Huobi. The operators used professional money-flow techniques and created unique ProtonMail addresses for each victim to improve operational security and avoid detection.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ryuk ransomware)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer  

Building a CI/CD pipeline for Sigma rules  

Inside StegoAd: How a Threat Actor Evolved to Fuel Silent Ad Fraud and Credential Theft at Scale 

A Djinn in the Machine: TaskWeaver’s Node.js Intrusion Chain  

Chromium extension uses AI‑related branding to redirect browser search  

Mustang Panda targets India’s government and energy sectors with ZOHOMURK and MINIRECON  

RustDuck: An In-Depth Analysis of a Two-Stage Botnet  

From Langflow to Monero: Inside CVE-2026-33017 Cryptominer  

The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

Veil#Drop: Blogspot-Hosted PowerShell Loader Delivers PureLog Stealer Through XOR-Encoded In-Memory .NET Payloads

Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula    

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique      

Popa: From Sourcing to Distribution  

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks      

ToddyCat: your hidden email assistant. Part 2 

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

JADEPUFFER: Agentic ransomware for automated database extortion        

Don’t Eat The ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised Exploits

PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems      

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware

AI-Generated PowerShell Malware: An Experimental Framework and Dataset

A Lightweight Framework for Android Malware Detection via SDAE-Based Multi-View Static Feature Fusion

Addressing Data Scarcity in Malware Classification via Pixel-Level Synthetic Image Generation

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

81 Million Login Attempts, 78 Compromised Accounts: The LSHIY Password Spray Hitting Azure CLI

Huntress researchers have been tracking a massive automated password spray campaign against Microsoft Azure CLI environments since June 12, 2026.

A password spray attack is when attackers try a small number of common passwords across many accounts instead of many passwords on one account. This helps avoid lockouts while exploiting weak or reused passwords. It is often used in large-scale account takeover attempts.

In fourteen days, the attackers made over 81 million login attempts against Huntress customer accounts and successfully broke into 78 Microsoft accounts across 64 organizations. Last week the pace accelerated sharply: on June 22 alone, 30 user accounts across 23 businesses were compromised in a single day.

The traffic originates almost entirely from the IPv6 range 2a0a:d683::/32, controlled by LSHIY LLC, an internet infrastructure provider registered to AS32167.

“LSHIY operates to distinct ASNs: in addition to AS32167 (which was registered June 14, 2021), it also operates AS955 (registered June 22, 2022). Third parties report that the IPv6 ranges associated with both of these autonomous systems originate in China. Upon further investigation into this IPv6 range of interest, Huntress found specific IPv6 addresses in that range that were recent, including one from a maintainer created on June 11, 2026.” reads the report published by Huntress.

LSHIY lists business addresses at two factory buildings in Hong Kong and Wuhan, and one at a shared office rental space in New York. Huntress reported the activity through the company’s abuse channel, but it received no reply.

The attacker’s method is straightforward and effective. They replay old username and password combinations from breach data against the OAuth ROPC flow, the Resource Owner Password Credentials grant type, which sends credentials directly to the /token endpoint with no interactive MFA prompt.

“In the campaign, threat actors replayed validated credentials via the OAuth ROPC (Resource Owner Password Credentials) flow. ROPC is an OAuth 2.0 grant type that has been deprecated in OAuth 2.1. This auth flow takes a username/password at the /token endpoint for a tenant and mints a new user-delegated token once provided with the correct credentials.” continues the report. “This matters because many of the compromised businesses had implemented multi-factor authentication (MFA) via a Conditional Access Policy (CAP), but the MFA was not configured to cover this specific flow that attackers used. “

No MFA challenge fires because ROPC doesn’t support modern authentication flows, making it an effective bypass for organizations that haven’t specifically blocked it.

Here’s the part that should make every Microsoft 365 admin uncomfortable. Of the 23 businesses hit on June 22, 15 had MFA enforced via Conditional Access Policy. It didn’t help them.

“When analyzing the June 22 spike in attacks that impacted 23 businesses, we found that 15 of those companies had MFA implemented and enforced via CAP.” states the report.”However, while these organizations thought they were protected by MFA, the MFA did not fire for various reasons during this campaign.”

Some had MFA scoped to specific apps like Microsoft Admin Portals rather than all cloud apps. Others enforced MFA only for admin accounts, not regular users. Several triggered MFA only from untrusted locations, and the attacker’s IP addresses — inconsistently geolocated between China and Nebraska depending on the tool, slipped through the trusted location check. Two organizations had MFA in report-only mode, meaning it was set up but never enforced. Eight impacted businesses had no MFA policy at all.

The volume of this type of attack is not new but it’s growing fast. In the past six months, Huntress has seen credential spray attacks increase by over 155 times across its customer base, with a current mean of roughly 1,964 failed attempts per month per protected tenant. The targeting appears purely opportunistic, driven by which credentials appear most frequently in compromised password lists rather than by business sector or size.

The fix is not complicated but requires precision. Conditional Access Policies need to cover all users, all cloud apps, and all client app types without exceptions, partial coverage is what this campaign exploits. Enabling the userStrongAuthClientAuthNRequired setting enforces strong authentication at the client level and blocks ROPC flows outright. Restricting Azure CLI access for non-admin users removes another attack surface. And on the detection side, Huntress notes that triggering response based on spray volume alone points defenders at the most-sprayed and least-compromised tenants; prioritizing by credential validity is more effective.

“One glaring error here is that legacy protocols like ROPC can bypass some poorly-configured CAPs entirely since they don’t go through the authorization endpoint where policies are enforced. However, some of the other issues outlined above – such as misconfigured trusted locations or user groups – can also lead to gaps.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, password spray campaign)

Microsoft warns of a phishing campaign targeting the hospitality sector with fake guest emails that install TonRAT using resilient persistence.

Microsoft Threat Intelligence published a detailed analysis on an ongoing hacking campaign against hospitality organizations that has been running since April 2026. The targets are specific: device names observed across compromised environments include strings like “reception,” “frontdesk,” “reservations,” “accueil,” “recepcja,” and “recepce” in English, French, Polish, Czech, and Spanish. The attacker knows exactly who opens guest-related emails without thinking twice about it.

The delivery mechanism is what Microsoft calls authentication laundering.

“The threat actor uses Calendly’s email notification system and Google’s URL redirect functionality to construct a multi-hop delivery chain in which the direct Calendly path passes Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) checks.” reads the report published by Microsoft.

The emails arrive with the display name “Booking Manager (via Calendly)” and carry lures about bedbug infestations, health inspections, guest complaints, final warnings, and threatened suspensions. They came in Japanese, Danish, and Dutch, with Japanese the most common. The researchers observed that the messages have no recipient name, no property name which suggests this is high-volume list-driven sending, not tailored spearphishing.

Upon clicking the embedded link, the victim is routed through four hops: a Calendly redirect to share.google, then to www.google.com, then to a freshly registered Cloudflare-fronted .cfd domain sitting behind a Turnstile challenge. That challenge serves double duty as an anti-analysis gate and a geolocation filter before the payload lands. The downloaded archive contains a shortcut file named IMG-<numbers>.png.lnk in Wave 1 or PHOTO-<numbers>.png.lnk in Wave 2, both sized consistently between 1,989 and 2,079 bytes, suggesting the same builder tool across the campaign.

Opening the shortcut fires PowerShell. The script uses BigInt arithmetic to decode a download URL, a technique that evolved across seven distinct obfuscation phases over the course of the campaign.

“A defining characteristic of this campaign is its steady but disciplined obfuscation evolution. Microsoft observed seven PowerShell obfuscation phases over the course of the campaign, but the underlying logic remained consistent: decode embedded data through arithmetic operations, recover the next-stage content, and retrieve a PowerShell script that runs from the %TEMP% folder.” continues the report. “This pattern suggests that the threat actor is iterating for durability against static detections rather than experimenting with entirely new tradecraft. “

The operators never abandoned PowerShell or Node.js. They just kept re-skinning the same working loader as detections caught up.

The decoded script downloads a legitimate Node.js v24.13.0 runtime from nodejs.org into user space, then runs a JavaScript implant tracked as TonRAT from AppData\Local\Nodejs\. No system-wide Node installation is needed. Wave 2 added an intermediate stage: the downloaded PowerShell script triggers dynamic .NET DLL compilation through csc.exe and cvtres.exe, producing small 3,072-byte DLLs with random names before reaching Node.js. Microsoft assesses this step is preparatory or conditional, as the compiled DLL wasn’t observed being explicitly loaded in available telemetry.

The persistence design is what makes this campaign technically notable.

“The persistence design itself is a meaningful post-compromise observation. The combination of a durable Node.js launch point in HKCU\Run and a repeatedly refreshed ProgramData payload through HKCU\RunOnce suggests an effort to maintain execution options across user sign-ins while also preserving a secondary recovery path.” states Microsoft. “This RunOnce loop is unusual enough that it might provide defenders with a strong hunting pivot even when file names, domains, or script syntax change.”

The RunOnce entry doesn’t fire once and disappear: the payload refreshes its own persistence after each execution, creating a loop. Microsoft observed this in practice: Defender blocked the PE payload xmnrwv9l.exe on a confirmed compromised device, but the Node.js Run key survived. Two days later, the implant reactivated, reconnected to new C2 domains, and resumed pushing additional payloads. Blocking one path left the other alive.

Post-compromise activity on a subset of devices included C2 beaconing to fixed IPs over non-standard ports including 56001, 56002, 56003, 8443, 8445, 8453, and 5555. Some hosts showed headless browser automation with --headless --no-sandbox flags, a geolocation check via ip-api.com, and a forced shutdown through cmd /c shutdown -s -t 0.

The forced shutdown may have served to interrupt user activity, reduce defender response time at a specific stage, or conceal visible symptoms after automated browser tasks completed. Microsoft has not confirmed data theft, ransomware deployment, or named any victims. The campaign’s ultimate objective remains unclear, which is itself a useful piece of information: whoever built this invested heavily in persistence and evasion for something they haven’t shown yet.

Complete remediation requires removing both persistence mechanisms simultaneously: the HKCU\RunOnce entry pointing into ProgramData, the HKCU\Run key pointing to the Node.js component, the Node.js runtime itself, and all associated .js files under AppData\Local\Nodejs\. Start with reception, reservations, and front office systems, and treat any device where Node.js appears in user-space paths as potentially compromised until proven otherwise.

The report includes Indicators of compromise (IoCs) for this campaign.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, hospitality)

DirtyClone: a Linux kernel privilege escalation that silently rewrites executables in memory, leaving no disk trace. Patch now.

JFrog Security Research published a working exploit walkthrough on June 25 for CVE-2026-43503 (CVSS score of 8.8), a Linux kernel privilege escalation they call DirtyClone. It’s the fourth vulnerability in the DirtyFrag family, all sharing the same root failure: file-backed memory gets treated as packet data, and an in-place network operation writes where it should have copied. CVSSIf your kernel doesn’t have the May 21 mainline patch, update now.

“The severity of this issue is significant because it allows any unprivileged local user to gain root access (LPE) by manipulating the Linux page cache.” reads the report published by JFrog. “The attack is silent, leaves no kernel logs or audit traces, and bypasses common on-disk integrity monitoring tools.”

The attacker loads a privileged binary like /usr/bin/su into memory, wires those pages into a network packet, and forces the kernel to clone it through a loopback IPsec tunnel they control. The decryption step overwrites the binary’s authentication logic with attacker-chosen bytes, and the next run of su hands over root — while the file on disk stays untouched.

The exploit requires CAP_NET_ADMIN to configure the IPsec environment. On Debian and Fedora that capability is reachable by any local user through unprivileged user namespaces, which are enabled by default.

“The attacker begins by creating a fresh network namespace:

unshare -Urn

This provides network administrative capabilities inside the namespace.” continues the report. “While capabilities are namespaced, page cache is shared at the host level, so if file-backed pages are modified through shared mappings, the effects may propagate to other processes using those pages.”

Ubuntu 24.04 and later restrict namespace creation via AppArmor, blocking the default exploit path, but every other distribution with default namespace configurations is exposed.

The DirtyFrag family now has four members. Copy Fail (CVE-2026-31431) arrived in late April. DirtyFrag (CVE-2026-43284 and CVE-2026-43500) followed on May 7. Fragnesia (CVE-2026-46300) appeared on May 13, bypassing the DirtyFrag patch through a flag-dropping bug in skb_try_coalesce().

“DirtyFrag is a family of Linux kernel memory corruption vulnerabilities in the core networking stack affecting how socket buffers (skb) reference shared page-cache memory, which are subsequently weaponized through in-place cryptographic transformations in subsystems like XFRM/IPsec or RxRPC.” continues the report. “Despite targeting different packet cloning or forwarding paths, variants like DirtyFrag, Fragnesia, and DirtyClone all rely on a shared technique: tricking the kernel into treating read-only, file-backed page cache memory as writable network buffers.”

Each patch closed one code path and left others open. The underlying contract, that every function moving socket buffer fragments must preserve the shared-frag flag, every time, was never fully enforced across the codebase.

The original DirtyFrag researcher Hyunwoo Kim submitted a broader multi-site patch on May 16 covering the remaining fragment-transfer helpers. JFrog independently rediscovered one of the affected functions on May 19, built a working exploit, and reported it. The combined fix merged on May 21, CVE-2026-43503 was published on May 23, and Linux v7.1-rc5 shipped on May 24 as the first fixed release. Ubuntu, Debian, and SUSE have published advisories; Red Hat has a Bugzilla tracking entry.

If patching today isn’t an option, two workarounds reduce the attack surface. Setting kernel.unprivileged_userns_clone=0 on Debian and Ubuntu blocks the namespace-based path to CAP_NET_ADMIN. Blacklisting the esp4, esp6, and rxrpc kernel modules removes the in-place decryption primitives the exploit needs, though that breaks IPsec and AFS. Neither is a fix. The DirtyFrag class probably isn’t finished: any fragment-transfer function that drops the shared-frag flag along the way is a potential new variant, and auditing every such path in the kernel networking stack is a large and unfinished job.

JFrog published a Proof Of Concept video for the exploitation of the flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Linux)

Attackers exploit Cisco Unified CM flaw (CVE-2026-20230) allowing unauth HTTP requests to trigger SSRF, write files, and gain root access

Cisco Unified Communications Manager has a serious vulnerability, tracked as CVE-2026-20230 (CVSS score of 8.6), that attackers are already exploiting. The flaw, caused by improper validation of certain HTTP requests, allows a remote attacker without authentication to perform server-side request forgery (SSRF) attacks. Early June, Cisco warned that public PoC code is available and that successful exploitation could allow attackers to write files that may later be used to gain root privileges.

This makes affected systems high risk if exposed. Be careful.

“This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.” reads the advisory. “A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.”

Cisco rated this advisory as Critical instead of High because successful exploitation could allow an attacker to escalate privileges to root. However, the risk depends on configuration: the vulnerability can only be exploited if the WebDialer service is enabled, which is disabled by default on affected systems.

There is no full workaround for this vulnerability. The networking giant recommends mitigating risk by disabling the WebDialer service until a patch is applied. Administrators can do this through the Unified CM Administration interface by going to Unified Serviceability, opening Service Activation under Tools, and unchecking the WebDialer Web Service option in the CTI Services section before saving the changes.

Below are the fixed releases:

The company confirms that PoC exploit code for the vulnerability is publicly available. However, the PSIRT is not aware of attacks in the wild exploiting this issue.

This week, Defused Cyber researchers confirmed it observed active exploitation of the issue in attacks in the wild.

“Over the weekend we observed exploitation of CVE-2026-20230 – Cisco Unified CM (CUCM) WebDialer SSRF → root file-write (CVSS 8.6)” the researchers wrote on X. “No previously recorded exploitation, and not yet listed in CISA KEV.

This is currently being exploited from a single source using an unvetted PoC, with genuinely-formatted file:// file-write payloads landing on our decoys. Track Cisco CUCM exploitation”

At this time, Cisco PSIRT has yet to confirm active exploitation of the flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-20230)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

International Press – Newsletter

Cybercrime

The Gentlemen ransomware: 483 victims and a leaked playbook  

iRhythm Confirms Data Stolen in Hack

Who Runs the Ransomware Group ‘The Gentlemen?’

Novo Nordisk hit by FulcrumSec: the stealer logs saw it coming  

FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025

‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm  

International law enforcement initiate hunt on malware group SocGholish  

Killing me gently: Inside Gentlemen’s EDR killer framework  

Malware

OptinMonster supply chain attack hits 1.2 million sites  

Rokarolla : Android Banker with Complete Device Takeover Capabilities  

WordPress PBN Plugin Drops Dual Webshells via Database Injection     

Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk  

Crypto Clipper uses Tor and worm-like propagation for persistence and control      

Sayonara, SocGholish: Operation Endgame Disrupts Major Cybercrime Operation  

Hacking

Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 

CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation

A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale 

FortiBleed — 75k Fortinet firewalls have admin passwords cracked 

Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline

SocGholish Compromised WordPress Sites Special Report

1.16 billion attacks: how the FortiBleed crew broke FortiGate  

Intelligence and Information Warfare

Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research

Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2

Don’t Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency     

FishMonger’s arsenal upgraded: SprySOCKS for Windows  

White House’s export limits on Anthropic linked to concerns about Chinese access  

Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society

French president urges US to share cutting-edge AI and democracies to cooperate on regulation    

Cybersecurity

IT security incident at Novo Nordisk

Maine closes data breach portal to the public after fake reports

How we’re combatting AI scams with security, legislation and more     

UK to ban social media access for children under 16

We Audited the Same Codebase with Claude Opus 4.8 and MiniMax M3  

24 billion records, including usernames and passwords, exposed in colossal data leak: What does that mean for you? 

CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure       

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

USB .lnk malware steals crypto via clipboard hijack, replaces wallet addresses, steals seed phrases, and screenshots.

Microsoft Threat Intelligence has been tracking a clipboard-stealing malware (Clipper) campaign since February 2026 that targets cryptocurrency wallets. A clipper is a type of malicious software that monitors and manipulates your clipboard, the temporary memory where data is stored when you copy and paste.

It spreads through malicious shortcut files on USB drives, hides its command server inside the Tor network, and can replace wallet addresses in your clipboard before you paste them. The attacker collects the crypto; you collect the confusion.

What makes it harder to spot is that this clipper doesn’t use a traditional installer or expose any real IP addresses. It ships with its own Tor client, routes traffic through a local proxy on port 9050, and resolves everything to .onion domains inside Tor.

“The clipper in this campaign relies on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C2 server. It carries out high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution.” reads the report published by Microsoft. “The execution of this clipper is notable because it does not depend on a traditional installer or exposed IP-based C2 infrastructure. Instead, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, turning a financially motivated stealer into a lightweight backdoor.”

The attack chain starts when someone opens a .lnk shortcut file from a USB drive. The malware then scans the device for document files like .doc, .xlsx, and .pdf, hides the originals, and replaces them with malicious shortcuts carrying the same names. Open what you think is a spreadsheet and you’re running malware. It also sets up scheduled tasks to copy itself onto any new USB drive that gets plugged in.

Malware steals crypto data from clipboard by capturing BIP39 seed phrases and private keys, exfiltrates via Tor, and sends screenshots for context.

“The malware detects 12 or 24-word BIP39 seed phrases in clipboard data. It saves the seed to local file (GOOD path) as a backup and exfiltrates it to the C2 domain via Tor.” states the report. “It retries network transmission until it is acknowledged and deletes local backup after successful transmission.”

Beyond seed phrases, it also grabs Ethereum and Bitcoin WIF private keys, and checks the clipboard every 500 milliseconds for wallet addresses across Bitcoin, Ethereum, Tron, and Monero. When it finds one, it swaps it out for an attacker-controlled address that partially resembles the original, so a quick glance won’t catch the swap.

The stealer also takes five screenshots every ten seconds and sends them over Tor, giving the attacker a live view of what the victim is doing with their wallet. There’s also a remote code execution channel: the C2 can send an EVAL instruction, the malware downloads JavaScript into a file called “cfile,” and runs it. That turns what looks like a simple crypto thief into something with full backdoor potential.

Microsoft researchers highlight that all the malware components are encrypted and only decrypted at runtime, wrapped in PyArmor-obfuscated Python and packaged with PyInstaller. The JavaScript payloads get two layers of obfuscation on top of that. It also checks for Task Manager before doing anything, and exits if it’s running.

“For defenders, the strongest signals are behavioral: script interpreters spawning suspicious child processes, localhost:9050 proxy usage, screen-capture commands in PowerShell, and signs of clipboard inspection or crypto-address replacement.” Microsoft continues.

Microsoft Defender for Endpoint detects components of this threat and flags it as Trojan:Win32/CryptoBandits.A. If you’re handling any sensitive financial workflows, monitoring wscript.exe and cscript.exe activity and blocking .lnk execution from removable drives via Group Policy are the right places to start.

“This malware family shows how lightweight, script-based stealers can deliver outsized impact when paired with anonymized communications and runtime tasking.” concludes the report. “The combination of Tor-routed C2, clipboard targeting, screenshot capture, and remote code execution gives attackers both immediate monetization paths and continued control over compromised devices.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, clipper)

Cisco addressed CVE-2026-20181, a critical ISE vulnerability that lets authenticated admins execute commands and gain root access.

Cisco addressed a critical command execution vulnerability, tracked as CVE-2026-20181 (CVSS score of 9.1), affecting Identity Services Engine (ISE) and ISE-PIC. The flaw stems from improper validation of user-supplied input, allowing an authenticated attacker with administrative credentials to send crafted HTTP requests and execute commands on the underlying operating system. Successful exploitation can lead to privilege escalation and full root access.

According to the advisory, only an attacker with valid administrative credentials can exploit this vulnerability.

“This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.” reads the advisory. “In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.”

In single-node deployments, attackers could exploit the flaw to trigger a denial-of-service condition, blocking unauthenticated endpoints from accessing the network until recovery.

Cisco fixed the issue in ISE/ISE-PIC 3.3 Patch 11 and 3.4 Patch 6, while a hotfix is available for version 3.5 and will be included in Patch 4 scheduled for August.

Cisco also patched CVE-2026-20190 (CVSS score of 7.5), a high-severity information disclosure flaw that could expose sensitive data, including hashed credentials, to unauthenticated attackers.

“This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device.” states the advisory. “A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.”

The Cisco Product Security Incident Response Team (PSIRT) is not aware of attacks in the wild exploiting one of these vulnerabilities.

Additional information is available on the security advisories page.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Identity Services Engine)