Author: Staff Writer

Quick Takeaways Attackers can exploit a hidden backdoor in Tenda firmware (CVBE-2026-11405) to gain full administrative access without valid credentials. The backdoor bypasses normal password verification by directly comparing a secret configuration password with user input, enabling remote device control. Successful exploitation can allow unauthorized configuration changes, security disablement, and potential full takeover of affected devices. Threat, Attack Techniques, and Targets CERT/CC warned about a hidden admin backdoor in Tenda router firmware. Several firmware versions are affected. An attacker can use this backdoor to control the web management interface. The backdoor is inside the “login()” function in the “/bin/httpd” server.…

Fast Facts Attackers can bypass authentication and gain unauthorized control of BeyondTrust RS and PRA devices via CVE-2026-40138 and CVE-2026-40139, especially with specific configurations enabled. Unauthenticated remote attackers may exploit CVE-2026-40140 to trigger denial-of-service, disrupting system availability. Authenticated users with limited privileges could access unintended resources due to CVE-2026-40141, risking data breaches or privilege escalation. Threat, Attack Techniques, and Targets BeyondTrust has released patches for two critical vulnerabilities that impact its Remote Support (RS) and Privileged Remote Access (PRA) products. These flaws are pre-authentication, meaning attackers can exploit them without needing login credentials. The vulnerabilities allow attackers to bypass security…

Top Highlights A Microsoft Global Device Identifier (GDID), embedded in Windows systems, was key in identifying and unmasking Peter Stokes, a suspect linked to the Scattered Spider hacking group. Stokes, a dual US-Estonian citizen, was arrested in Finland and faces multiple charges related to hacking, fraud, and conspiracy, with evidence placing him across multiple countries. Investigators linked the same device and personal accounts to various IP addresses in Estonia, New York, and Thailand, correlating these to Stokes’s travel records and social media activity despite VPN use. The case highlights that while anonymity tools protect network layers, endpoint identifiers like GDID…

Top Highlights Human attackers are now using AI to automate technical tasks in ransomware attacks, significantly increasing speed and scale. AI agents demonstrate adaptive, real-time decision-making, enabling more sophisticated and harder-to-detect intrusion techniques. The use of AI in cybercrime raises attribution challenges and complicates legal accountability, as malicious actions may lack clear human fingerprints. Threat, Attack Techniques, and Targets The recent AI ransomware attack involved human operators choosing the target and setting up the attack infrastructure. The attacker provided stolen credentials and configured command-and-control systems. Once these steps were completed, the AI agent took over the technical execution. The AI…

Essential Insights Iranian-linked hackers deploy the modular Cavern C2 framework, targeting Israeli IT and government organizations via exploited software updates. The Cavern framework, built on .NET and designed for anti-analysis, facilitates reconnaissance, data theft, lateral movement, and tunneling through customizable modules. Attackers leverage trusted supply chains and browser-based remote desktop tools for stealthy data exfiltration and movement between multiple service providers. Threat, Attack Techniques, and Targets An Iranian hacking group linked to the country’s Ministry of Intelligence and Security is using a new modular C2 framework called Cavern. This group mainly targets Israeli organizations. Their targets include IT providers and…

Advances like GLM-5.2 and GPT-5.6 are making high-level AI capabilities more accessible and affordable, lowering barriers for both defenders and adversaries in cybersecurity. Tighter restrictions on advanced AI models by governments contrast with the proliferation of open, low-cost models that quickly close performance gaps, increasing cyber risks. The accelerating pace of AI-driven cyber threats demands integrated, automated security operations that leverage AI actively for detection, response, and decision-making. Organizations must adapt by investing in AI-powered, proactive security strategies or risk falling behind in a landscape where threats evolve faster than manual defenses. Impacts of Accessible AI on Everyday IT Security…

Top Highlights Organizations have high awareness of cybersecurity risks but struggle to convert that knowledge into effective action, especially in breach transparency and incident response. Over half of professionals who experienced breaches were instructed to keep incidents confidential, highlighting a governance issue rather than attacker behavior. Many organizations acknowledge the importance of transparency yet face internal pressure to remain silent, undermining trust and accountability. Turning cybersecurity awareness into operational resilience requires internal cultural change and better implementation of breach reporting practices. Breach Transparency: A Reflection of Governance, Not Just Attacker Tactics Many organizations face a critical challenge today. Despite understanding…

Quick Takeaways A new high-severity security flaw, CVE-2026-8451, affecting Citrix NetScaler devices, enables attackers to leak sensitive data via memory overread, similar to the notorious CitrixBleed vulnerability. Attackers are actively exploiting this flaw, with evidence of targeted scanning campaigns and payload deployment shortly after its disclosure and patch release. Security experts warn that exploiting CVE-2026-8451 can lead to privilege escalation, lateral movement, and data exfiltration within impacted networks. Organizations are urged to promptly update systems, disable vulnerable configurations, and monitor for suspicious activity to mitigate ongoing threats. New Vulnerability in NetScaler Devices Sparks Concern Recently, a new security flaw in…

Fast Facts Iranian-linked group Cavern (Cav3rn) employs a sophisticated, modular C2 framework built on .NET, using multi-format compilation and anti-analysis techniques to target Israeli organizations and evade detection. The threat actor leverages trusted supply chain relationships and legitimate remote management tools to move laterally, deploy malware disguised as updates, and exfiltrate data through browser-based remote desktop and remote printing features. MuddyWater, also Iranian state-sponsored, conducts widespread reconnaissance and targeted attacks in the Middle East, exploiting known vulnerabilities in internet-exposed systems, leading to credential theft and sensitive data exfiltration in critical sectors. Threat Overview, Attack Techniques, and Targets An Iranian hacking…

Essential Insights ValleyRAT, deployed by SilverFox, is a multi-stage remote access malware that runs through eight layers, including a kernel rootkit, making detection and removal significantly more difficult than typical RATs. It employs stealth techniques such as DLL sideloading, steganography in PNG images, and polymorphic code that evolves daily to evade signature-based detection. The malware targets sensitive data, including cryptocurrency wallets and Telegram chats, and maintains persistence through dynamic file paths and various plugins tailored to specific targets. The infection chain involves legitimate signed installers with malicious payloads, with attackers actively refining delivery methods and utilizing encrypted WebSocket and QUIC…