Weekly Threat Briefing — 2026-04-07 to 2026-04-13
28 findings7 sections
- Critical findings
- 0
- High findings
- 0
- CISA KEV additions
- 0
- First seen in this period
- 661 CVEs7,070 IOCs
First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.
Priority queue
Act on these first
Critical and high findings from this briefing and its live updates. Most severe first, then newest.
- Critical severityCVE-2026-1340: Ivanti EPMM Code Injection Enables Unauthenticated RCESection VulnerabilitiesSource: KEV
- Critical severityCVE-2026-6132: Totolink A7100RU OS Command Injection in LED ConfigurationSection VulnerabilitiesSource: CVE
- Critical severityCVE-2026-6131: Totolink A7100RU Traceroute Command InjectionSection VulnerabilitiesSource: CVE
- Critical severityCVE-2026-6116: Totolink A7100RU Diagnosis Configuration Command InjectionSection VulnerabilitiesSource: CVE
- Critical severityCVE-2019-25709: CF Image Hosting Script Database Exposure and Mass DeletionSection VulnerabilitiesSource: CVE
- High severityCVE-2026-6134: Tenda F451 QoS Stack Buffer OverflowSection VulnerabilitiesSource: CVE
- High severityCVE-2026-6133: Tenda F451 Safe URL Filter Buffer OverflowSection VulnerabilitiesSource: CVE
- High severityCVE-2026-6124: Tenda F451 MAC Filter Multiple Buffer OverflowsSection VulnerabilitiesSource: CVE
- High severityCVE-2026-6123: Tenda F451 NAT Configuration Buffer OverflowSection VulnerabilitiesSource: CVE
- High severityCVE-2026-40393: Mesa WebGPU Out-of-Bounds Memory AccessSection VulnerabilitiesSource: CVE
Executive summary · as of 08:46 UTC
The situation
During the period of April 7-13, 2026, the threat landscape was dominated by critical vulnerabilities in IoT devices and enterprise software, alongside persistent malware distribution campaigns. A critical code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) was added to CISA's KEV catalog, enabling unauthenticated remote code execution and requiring immediate patching. The NVD disclosed 30 new CVEs with 5 rated CRITICAL (CVSS 9.8), primarily targeting Tenda and Totolink routers through OS command injection and stack-based buffer overflows. These IoT vulnerabilities are highly exploitable and likely to be incorporated into botnet malware toolkits.
Malware distribution activity remained elevated with 50 malicious URLs identified by abuse.ch, concentrated on Mozi botnet variants and ClearFake/GuLoader campaigns. Mozi activity targeted ARM and MIPS-based IoT devices across multiple Asian IP ranges, while ClearFake campaigns leveraged fake browser update lures to deliver GuLoader malware. The attack patterns indicate coordinated campaigns using DNS infrastructure across conferen-cesman.in.net, rebutrew0rk.in.net, and mucus-rafter.in.net domains. A separate Mirai variant distribution campaign was observed using infrastructure at 45.128.119.160, deploying variants for 17 different architectures.
Organizations should prioritize patching Ivanti EPMM immediately, implement network segmentation for IoT devices, and enhance email security controls to defend against social engineering campaigns. The convergence of publicly exploitable vulnerabilities and active malware distribution creates elevated risk for organizations with unpatched IoT infrastructure and insufficient email filtering.
Browse the full briefing
28 findings · 7 sections- 5 critical
- 18 high
- 3 medium
- 2 info
- Vulnerabilities5 findingsCritical Vulnerabilities Requiring Immediate Action5 critical
- Vulnerabilities5 findingsHigh-Severity IoT and Network Device Vulnerabilities5 high
- Malware3 findingsMozi Botnet Targeting IoT Infrastructure2 high · 1 medium
- Malware4 findingsClearFake and GuLoader Phishing Campaigns3 high · 1 medium
- Vulnerabilities5 findingsLegacy Application and Enterprise Software Vulnerabilities5 high
- Tools & Techniques4 findingsMITRE ATT&CK Technique Trends3 high · 1 medium
- DFIR Lab2 findingsDetection and Analysis Resources2 info
Critical Vulnerabilities Requiring Immediate Action
One KEV entry and five critical-severity CVEs pose significant risk to enterprise and IoT infrastructure
- Critical severityCVE-2026-1340: Ivanti EPMM Code Injection Enables Unauthenticated RCE
Ivanti Endpoint Manager Mobile contains a code injection vulnerability allowing unauthenticated remote code execution. Added to CISA KEV catalog, indicating active exploitation or high exploitation likelihood. Enterprise mobile device management platforms are critical infrastructure targets.
- Critical severityCVE-2026-6132: Totolink A7100RU OS Command Injection in LED Configuration
Critical OS command injection in setLedCfg function of /cgi-bin/cstecgi.cgi allows remote attackers to execute arbitrary commands through the 'enable' parameter. CVSS 9.8. Affects Totolink A7100RU 7.4cu.2313_b20191024.
- Critical severity
- Critical severity
- Critical severity
High-Severity IoT and Network Device Vulnerabilities
Multiple high-severity vulnerabilities in Tenda routers and network devices enable remote exploitation
- High severity
- High severity
- High severity
- High severity
- High severity
Mozi Botnet Targeting IoT Infrastructure
Sustained Mozi botnet activity targeting ARM and MIPS IoT devices across Asian IP ranges
- High severityMozi Botnet Distribution Campaign Across Asia-Pacific
15 malicious URLs distributing Mozi botnet variants targeting ARM and MIPS architectures. Activity concentrated on IP ranges in China, Thailand, and Taiwan (125.41.x.x, 182.116.x.x, 222.141.x.x, 119.180.x.x, 61.52.x.x). Mozi continues self-propagation despite 2021 takedown attempts.
- High severityMirai Variant Multi-Architecture Distribution Infrastructure
Coordinated Mirai distribution campaign from 45.128.119.160:1212 delivering 17 architecture-specific variants (ARM, MIPS, x86, PPC, SPARC, etc.). Indicates preparation for large-scale IoT botnet recruitment targeting diverse device types.
- Medium severity
ClearFake and GuLoader Phishing Campaigns
Coordinated social engineering campaign using fake browser updates to deliver GuLoader malware
- High severityClearFake Campaign Using Conferen-cesman.in.net Infrastructure
13 malicious URLs on conferen-cesman.in.net domain distributing GuLoader via ClearFake fake browser update lures. Subdomains include dzokbx, cipherdepo, fresh-crest, handleill, 57vl6, quorcore1a, and breezesto. Campaign uses consistent URI pattern with UUID identifier.
- High severity
- High severityMucus-rafter.in.net ClearFake Distribution Network
3 malicious URLs (talmarkum1, norvale5on, load9-mount subdomains) on mucus-rafter.in.net delivering GuLoader. Part of coordinated multi-domain ClearFake operation targeting users with fake software update notifications.
- Medium severity
Legacy Application and Enterprise Software Vulnerabilities
SQL injection and authentication bypass vulnerabilities in ERP, CMS, and business applications
- High severity
- High severity
- High severity
- High severity
- High severity
MITRE ATT&CK Technique Trends
Analysis of attack techniques observed across vulnerabilities and malware campaigns
- High severityT1190: Exploit Public-Facing Application - Primary Attack Vector
Dominant technique with 20+ instances across IoT vulnerabilities (Tenda, Totolink routers) and enterprise applications. Attackers targeting internet-exposed devices and web applications with publicly disclosed exploits.
Source: Manual - High severityT1059: Command and Scripting Interpreter Execution
Widespread use of command injection vulnerabilities and script-based malware delivery. Observed in OS command injection CVEs and Mozi/Mirai botnet shell script distribution.
Source: Manual - High severity
- Medium severityT1203: Exploitation for Client Execution
Buffer overflow vulnerabilities in client-side applications and network services enabling arbitrary code execution. Observed in Mesa WebGPU and multiple Tenda router vulnerabilities.
Source: Manual
Detection and Analysis Resources
New resources published for security operations and incident response teams
- Info severityFree Phishing Email Analysis API for Developers
New API service enabling automated phishing email analysis for security tools and SOAR platforms. Relevant for organizations implementing detection capabilities against ClearFake and GuLoader campaigns.
Source: Blog - Info severityComplete Guide to Analyzing Phishing Email Headers for SOC Analysts
Comprehensive methodology for email header analysis to identify phishing campaigns and track threat actor infrastructure. Applicable to investigating delivery mechanisms for GuLoader and social engineering attacks.
Sources & Attribution
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.