Tim Peck

Threat actors are chaining two vulnerabilities in the AhsayCBS backup utility to achieve remote code execution and deploy XMRig cryptominers and JSP webshells.

Adversaries utilize eBPF rootkits like Bad-bpf to evade traditional Linux integrity monitoring by intercepting syscalls and rewriting user-space memory without modifying kernel symbols.

Adversaries leverage ClickFix social engineering, ClearFake etherhiding, and SNEAKY2FA AiTM phishing to deliver malware and hijack sessions.

The Kimsuky threat group is utilizing malicious Hangul (HWP) resume documents to deploy Quasar RAT and ultimately the Funhouse ransomware variant.

An unidentified threat actor targeted popular npm repositories including zod and standard-schema with a malicious install-time loader that fetches payloads via Ethereum smart contracts.

Unauthenticated attackers are exploiting CVE-2026-104286, a critical path traversal vulnerability in FortiMail, to write arbitrary files and achieve persistent remote code execution.

ClingSTUN is a Linux back-connect proxy backdoor that exploits numerous IoT vulnerabilities and abuses public STUN infrastructure for NAT traversal and remote command execution.

IronChain is a destructive malware build packaged with PyInstaller that utilizes multiple kernel drivers for process termination and persistence while intentionally discarding encryption keys to prevent data recovery.

Adversaries are deploying modular Linux implants including BPFDoor, Rekoobe, and the new AVERAT RAT against telecom edge appliances, utilizing SMTP-disguised C2 and BPF packet filtering to evade detection.

Cisco Catalyst SD-WAN Manager is vulnerable to a critical API authentication bypass (CVE-2026-76504) due to improper URI encoding handling, currently being exploited in the wild.