Weekly Threat Briefing — 2026-10-12 to 2026-10-19
Edge and remote-access infrastructure dominated this week. CISA added nine entries to KEV. They include a BeyondTrust Remote Support authentication bypass (CVE-2026-102764), a zero-day exploited since late August that Mandiant attributes to the suspected Chinese espionage cluster ARMORY CASTLE. The others are a PAN-OS root code injection (CVE-2026-0322), Ivanti Connect Secure's sixth exploited bug of the year (CVE-2026-104935), a Cisco Secure Email Gateway arbitrary file write, a chained AhsayCBS auth-bypass/command-injection pair, an Atlassian Data Center file exposure flaw, a Windows Shell security-feature bypass fixed in Microsoft's record 1,413-CVE Patch Tuesday, and an older Fortinet path traversal (CVE-2025-61624). Separate reporting describes in-the-wild exploitation of SiteGuard WAF, Collabora/Nextcloud (CVE-2026-110447) and SonicWall SMA 1000. Unit 42 also described PEERSTITCH, a memory-resident FortiGate implant deployed on 500+ firewalls via CVE-2024-47575. Patch internet-facing appliances first and hunt for compromise on BeyondTrust, Ivanti, PAN-OS and FortiGate devices.
Supply-chain and trusted-relationship intrusions were the second theme. Attackers abused ConnectWise Cloud Backup application identities to breach Microsoft 365 tenants. GTIG detailed short-burst tampering of AOMEI update infrastructure. Malicious packages also turned up in npm (Apex Accelerator/REF8801) and the Arch User Repository. Lures impersonating AI brands (Claude, ChatGPT, Copilot) and ClickFix-style delivery continue to grow; abuse.ch logged 746 IClickFix and 262 ClearFake indicators alongside 4,622 Vidar stealer indicators. Disruption activity was notable: Microsoft and partners seized YAM Store, CoGUI and Iron Man phishing infrastructure, DOJ raided DPRK IT-worker laptop farms, and arrests were made against OLVX, DataSuckers and a suspect linked to the Synnovis attack.
Extortion volume remains high. 324 leak-site and breach entries were ingested; the 40 reviewed are led by N0n, Helix, Qilin and Settra. N0n posts frequently advertise credentials (VPN accounts, plaintext passwords, cloud access keys), and the group threatened 38 shipping and port firms with an October 19 deadline. Large disclosures included Burger King Japan (11.18M records), a claimed 80M-record Ampath Laboratories theft, a 13.7M-record Vibetech credential exposure and a California student-data breach. Beyond the items covered here, 2,636 further NVD CVEs, 78 OSV advisories and 266 WordPress plugin vulnerabilities were published in the window.
Read briefing