Intel Exchange

Threat actors are increasingly deploying autonomous AI agent frameworks like CyberStrikeAI and ARTEX to industrialize the attack lifecycle, targeting organizations in Japan and globally.

Ransomware groups including Qilin and Settra are exploiting CVE-2026-0257 to bypass authentication in Palo Alto Networks GlobalProtect for unauthorized internal network access.

Ransomware actors including Spikey Scorpius and Tarnished Scorpius are exploiting CVE-2026-0257 to bypass MFA and gain initial access to corporate networks via PAN-OS VPNs.

Unauthenticated attackers are exploiting CVE-2026-88771 in NetScaler ADC and Gateway appliances using a multi-stage log-poisoning technique to achieve remote code execution and deploy web shells.

Cluster CL-STA-0954 (UNC5820) exploited multiple Fortinet vulnerabilities, including CVE-2024-47575 and CVE-2025-61624, to deploy a novel memory-resident ARM64 implant named PEERSTITCH against telecommunications providers.

Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.

Chinese state-backed actors including Linen Typhoon and Violet Typhoon are exploiting CVE-2025-53770 in Microsoft SharePoint to achieve unauthenticated remote code execution and data theft.

Adversary c05d5254 uses the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.

Adversaries, including activity sharing infrastructure history with APT29, are exploiting CVE-2026-42589 in Gotenberg to deploy the 'cache_base' Go-based reverse shell and a broader toolkit.

A China-linked operator utilized the AI-driven Cairn framework to conduct 66 intrusions against government and industry targets across Asia, leveraging LLM agents for automated exploitation.