During the period of April 7-13, 2026, the threat landscape was dominated by critical vulnerabilities in IoT devices and enterprise software, alongside persistent malware distribution campaigns. A critical code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) was added to CISA's KEV catalog, enabling unauthenticated remote code execution and requiring immediate patching. The NVD disclosed 30 new CVEs with 5 rated CRITICAL (CVSS 9.8), primarily targeting Tenda and Totolink routers through OS command injection and stack-based buffer overflows. These IoT vulnerabilities are highly exploitable and likely to be incorporated into botnet malware toolkits.
Malware distribution activity remained elevated with 50 malicious URLs identified by abuse.ch, concentrated on Mozi botnet variants and ClearFake/GuLoader campaigns. Mozi activity targeted ARM and MIPS-based IoT devices across multiple Asian IP ranges, while ClearFake campaigns leveraged fake browser update lures to deliver GuLoader malware. The attack patterns indicate coordinated campaigns using DNS infrastructure across conferen-cesman.in.net, rebutrew0rk.in.net, and mucus-rafter.in.net domains. A separate Mirai variant distribution campaign was observed using infrastructure at 45.128.119.160, deploying variants for 17 different architectures.
Organizations should prioritize patching Ivanti EPMM immediately, implement network segmentation for IoT devices, and enhance email security controls to defend against social engineering campaigns. The convergence of publicly exploitable vulnerabilities and active malware distribution creates elevated risk for organizations with unpatched IoT infrastructure and insufficient email filtering.
One KEV entry and five critical-severity CVEs pose significant risk to enterprise and IoT infrastructure
Ivanti Endpoint Manager Mobile contains a code injection vulnerability allowing unauthenticated remote code execution. Added to CISA KEV catalog, indicating active exploitation or high exploitation likelihood. Enterprise mobile device management platforms are critical infrastructure targets.
Critical OS command injection in setLedCfg function of /cgi-bin/cstecgi.cgi allows remote attackers to execute arbitrary commands through the 'enable' parameter. CVSS 9.8. Affects Totolink A7100RU 7.4cu.2313_b20191024.
Multiple high-severity vulnerabilities in Tenda routers and network devices enable remote exploitation
Sustained Mozi botnet activity targeting ARM and MIPS IoT devices across Asian IP ranges
15 malicious URLs distributing Mozi botnet variants targeting ARM and MIPS architectures. Activity concentrated on IP ranges in China, Thailand, and Taiwan (125.41.x.x, 182.116.x.x, 222.141.x.x, 119.180.x.x, 61.52.x.x). Mozi continues self-propagation despite 2021 takedown attempts.
Coordinated Mirai distribution campaign from 45.128.119.160:1212 delivering 17 architecture-specific variants (ARM, MIPS, x86, PPC, SPARC, etc.). Indicates preparation for large-scale IoT botnet recruitment targeting diverse device types.
Coordinated social engineering campaign using fake browser updates to deliver GuLoader malware
13 malicious URLs on conferen-cesman.in.net domain distributing GuLoader via ClearFake fake browser update lures. Subdomains include dzokbx, cipherdepo, fresh-crest, handleill, 57vl6, quorcore1a, and breezesto. Campaign uses consistent URI pattern with UUID identifier.
SQL injection and authentication bypass vulnerabilities in ERP, CMS, and business applications
Analysis of attack techniques observed across vulnerabilities and malware campaigns
Dominant technique with 20+ instances across IoT vulnerabilities (Tenda, Totolink routers) and enterprise applications. Attackers targeting internet-exposed devices and web applications with publicly disclosed exploits.
Widespread use of command injection vulnerabilities and script-based malware delivery. Observed in OS command injection CVEs and Mozi/Mirai botnet shell script distribution.
Buffer overflow vulnerabilities in client-side applications and network services enabling arbitrary code execution. Observed in Mesa WebGPU and multiple Tenda router vulnerabilities.
New resources published for security operations and incident response teams
New API service enabling automated phishing email analysis for security tools and SOAR platforms. Relevant for organizations implementing detection capabilities against ClearFake and GuLoader campaigns.